refactor: extend upstream maintenance policy

AGENTS.md

@@ -60,7 +60,7 @@ Do not reintroduce long-lived mutable proxy files for steady-state Nix behavior.
 - Keep Codex updates upstream-owned. Do not reintroduce a downstream headless `maint-refresh-codex`; `116` receives Codex updates by updating the `upstream` flake input after upstream refreshes the official OpenAI release binary pin.
 - Renovate may update only the `upstream` flake input automatically. The CI cache gate stubs `yazelix-next` because GitHub Actions cannot rely on Lucca's private repository SSH access; do not broaden this automation to private or downstream-owned inputs without a new explicit decision.
 - Keep routine tool updates binary-friendly. Before adding inputs to the tools maintenance group, consider whether they normally use binary caches or upstream-provided release binaries instead of expensive local source builds. Put low-frequency infrastructure inputs such as `sops-nix`, `impermanence`, and `disko` in the infra maintenance group instead.
-- `scripts/maint/policy.json` mirrors the upstream maintenance gate policy so `maint-switch --repo /home/ysun/github.com/sctmes/dotfiles` can read current markers before activation. If a gate blocks a clearly generated glue derivation, fix the upstream policy narrowly, refresh the downstream mirror/input, and do not bypass the gate or allowlist heavy components.
+- `scripts/maint/policy-overrides.json` contains only downstream maintenance markers; the effective policy is `lib.maintenancePolicy`, composed from the locked upstream base plus these overrides. If a gate blocks a clearly generated shared glue derivation, fix the upstream base narrowly and refresh the input; keep company-only markers in the overlay. Do not bypass the gate or allowlist heavy components.
 - Diagnose network failures by fetch path: Nix substituters, GitHub release/direct fetches, npm registry or node-gyp, Cargo registries, and runtime proxies are separate paths and should not be collapsed into one generic proxy fix.
 - Long-term upstream direction: prefer a lighter reusable/headless flake boundary so headless downstream hosts do not see desktop-only upstream inputs in routine maintenance.
 - `scripts/install-116.nu` is the canonical install entrypoint. Keep examples aligned with `nu ./scripts/install-116.nu root@192.168.0.116 --proxy http://<lan-proxy>:<port>`.

CONTRIBUTING.md

@@ -47,15 +47,15 @@ git commit -m "chore: update upstream dotfiles"
 maint-switch --no-pull
 ```
 
-本仓库的 `scripts/maint/policy.json` 显式转发 upstream 的维护门控策略，供
-`maint-switch --repo /home/ysun/github.com/sctmes/dotfiles` 在新系统激活前读取。
-更新 upstream 时，如果 upstream 的 `scripts/maint/policy.json` 变了，也要同步更新
-本仓库的转发文件。
-
-如果 `maint-switch` 因轻量生成式 glue derivation 被拦住，先修 upstream policy，
-再更新本仓库的 `upstream` input 和 `scripts/maint/policy.json`；不要直接绕过 gate，
-也不要把 kernel、driver、Hyprland、GCC/Rust toolchain、Chromium/Electron 等重组件
-加入 allowlist。
+本仓库的 `scripts/maint/policy-overrides.json` 只声明公司专属的维护门控规则。
+`maint-switch --repo /home/ysun/github.com/sctmes/dotfiles` 在新系统激活前读取 flake
+输出的 `lib.maintenancePolicy`；该有效策略由锁定的 upstream 共享基线和本仓库的窄
+overlay 合成，不需要复制 upstream 的完整 policy。
+
+如果 `maint-switch` 因共享的轻量生成式 glue derivation 被拦住，先修 upstream
+policy，再更新本仓库的 `upstream` input；公司专属 derivation 才加入
+`scripts/maint/policy-overrides.json`。不要直接绕过 gate，也不要把 kernel、driver、
+Hyprland、GCC/Rust toolchain、Chromium/Electron 等重组件加入 allowlist。
 
 网络问题需要按路径拆分：Nix cache、GitHub release/direct fetch、npm registry 或
 node-gyp、Cargo registry 和运行时代理不是同一个问题。

flake.nix

@@ -44,8 +44,15 @@
         inherit inputs;
         username = "ysun";
       };
+      maintenancePolicy = upstream.lib.extendMaintenancePolicy upstream.lib.maintenancePolicyBase (
+        builtins.fromJSON (builtins.readFile ./scripts/maint/policy-overrides.json)
+      );
     in
     {
+      lib = {
+        inherit maintenancePolicy;
+      };
+
       devShells.${system} = {
         reactive-resume = pkgs.mkShell {
           packages = with pkgs; [

homes/ysun/default.nix

@@ -4,11 +4,6 @@
   pkgs,
   ...
 }:
-let
-  upstreamMaintPolicy = builtins.fromJSON (
-    builtins.readFile "${inputs.upstream}/scripts/maint/policy.json"
-  );
-in
 {
   imports = [
     inputs.upstream.homeManagerModules.devHeadless
@@ -31,10 +26,6 @@ in
     enable = true;
     repo = "/home/ysun/github.com/sctmes/dotfiles";
     host = "116";
-    riskMarkers = upstreamMaintPolicy.riskMarkers ++ [
-      "docker"
-      "containerd"
-    ];
   };
 
   programs.git = {

scripts/maint/README.md

@@ -1,6 +1,6 @@
 # Maintenance Policy
 
-`policy.json` mirrors `bioinformatist/dotfiles/scripts/maint/policy.json`.
-Keep it aligned when updating the `upstream` flake input so
-`maint-switch --repo /home/ysun/github.com/sctmes/dotfiles` can read the current
-gate markers before the next system generation has activated.
+`policy-overrides.json` contains only SCTMES-specific maintenance markers. The
+flake exposes `lib.maintenancePolicy` by extending the policy base from its
+locked `upstream` input, so `maint-switch` and CI evaluate the same target policy
+before activation.

scripts/maint/ci-cache-gate.sh

@@ -50,14 +50,27 @@ EOF
 
 collect_blocked_derivations() {
   local repo="$1"
-  local policy_repo="$2"
-  local output_file="$3"
-  local direct_file="$4"
+  local output_file="$2"
+  local direct_file="$3"
   local dry_run_output="${tmp}/dry-run-$(basename "$repo").log"
+  local policy_file="${tmp}/policy-$(basename "$repo").json"
 
   : > "$output_file"
   : > "$direct_file"
 
+  if [[ -f "${repo}/scripts/maint/policy.json" \
+    && ! -f "${repo}/scripts/maint/policy-workstation.json" \
+    && ! -f "${repo}/scripts/maint/policy-overrides.json" ]]; then
+    # Revisions from before the flake policy interface stored one complete policy.
+    cp "${repo}/scripts/maint/policy.json" "$policy_file"
+  else
+    nix eval \
+      --json \
+      --override-input yazelix-next "path:${tmp}/yazelix-next-stub" \
+      "${repo}#lib.maintenancePolicy" \
+      > "$policy_file"
+  fi
+
   if ! (
     cd "$repo"
     nix build \
@@ -77,10 +90,10 @@ collect_blocked_derivations() {
     awk '/^[[:space:]]*\/nix\/store\/.*\.drv$/ { sub(/^[[:space:]]+/, ""); print }' "$dry_run_output" | sort -u
   )
   mapfile -t allowed_markers < <(
-    jq -r '.allowedLocalBuildMarkers[]' "${policy_repo}/scripts/maint/policy.json"
+    jq -r '.allowedLocalBuildMarkers[]' "$policy_file"
     printf '%s\n' "-yzn-ci-stub.drv"
   )
-  mapfile -t direct_markers < <(jq -r '.allowedDirectFetchMarkers[]' "${policy_repo}/scripts/maint/policy.json")
+  mapfile -t direct_markers < <(jq -r '.allowedDirectFetchMarkers[]' "$policy_file")
 
   local drv
   for drv in "${derivations[@]}"; do
@@ -108,8 +121,8 @@ head_direct="${tmp}/head.direct"
 new_blocked="${tmp}/new.blocked"
 new_direct="${tmp}/new.direct"
 
-collect_blocked_derivations "${tmp}/base" "$PWD" "$base_blocked" "$base_direct"
-collect_blocked_derivations "$PWD" "$PWD" "$head_blocked" "$head_direct"
+collect_blocked_derivations "${tmp}/base" "$base_blocked" "$base_direct"
+collect_blocked_derivations "$PWD" "$head_blocked" "$head_direct"
 
 comm -13 "$base_blocked" "$head_blocked" > "$new_blocked"
 comm -13 "$base_direct" "$head_direct" > "$new_direct"

scripts/maint/policy-overrides.json

@@ -0,0 +1,14 @@
+{
+  "riskMarkers": [
+    "docker",
+    "containerd"
+  ],
+  "allowedLocalBuildMarkers": [
+    "-futu-opend-10.8.6818.drv",
+    "-futu-opend-service.drv",
+    "-futu-opend.service.drv"
+  ],
+  "allowedDirectFetchMarkers": [
+    "Futu_OpenD_10.8.6818_Ubuntu18.04.tar.gz"
+  ]
+}