2026-09-04 The Exclusion That Excluded Nothing

What I set out to do

Finish an in-progress working tree: an attempt to keep acl-mcp-server and arxiv-mcp-server off athena, plus two fixes to the update pipeline. The prompt was one word, “fix”, so the first job was working out what was actually broken rather than what the diff claimed to do.

What I actually did

Ran the tests first, and they were green, which was the misleading part: the pytest suite under nix/tests/update-changelogs/ only reads the update script as text, so it could not see that nix/flake.nix no longer parsed. nix eval on the flake did: syntax error, unexpected identifier, expecting '{'. The working tree had written } // let ... in uvPackages ..., and in Nix a let expression cannot be the right operand of //. The whole flake was dead, on every system, and nothing in the test suite was positioned to notice.

Three defects in one small block, each hiding behind the one in front of it.

The syntax error was the visible one. Behind it, the exclusion excluded nothing: the code was uvPackages (removeAttrs final excludedUvPackages), which strips two attributes from the package set handed to the uv2nix builder rather than from the projects it builds. Both packages would still have been emitted. Worse, removeAttrs on final forces attrNames of the overlay’s own fixed point from inside the attrset that feeds overlayAttrs, which is the standing recipe for infinite recursion here. Corrected to removeAttrs (uvPackages final) excludedUvPackages.

Behind that, the gate was pkgs.stdenv.hostPlatform.isx86_64, which also matches x86_64-linux. Those are the corp workstations, they run the full desktop profile, and coding-agents/common/mcp.nix puts both servers in home.packages unconditionally. I verified it rather than assuming: evaluating homeConfigurations."x86_64-linux".config.home.packages lists arxiv-mcp-server acl-mcp-server, so the gate as written would have broken a real deployed host with a missing-attribute error while leaving the Darwin problem it targeted untouched. Rekeyed on the full system double, system == "x86_64-darwin".

The underlying reason for the exclusion is a second instance of the Intel wheel cliff: both projects reach pymupdf4llm, then pymupdf-layout, then onnxruntime, whose locked 1.28.0 publishes neither an Intel macOS wheel nor an sdist. Unlike the cryptography case there is no lock to fork and no sdist to build, so dropping the projects on that one system is the whole fix. It is safe because home-server.nix does not import the MCP module and because checks maps over hostHomeConfigurations, which deliberately omits x86_64-darwin.

Verified by evaluation rather than by reading: x86_64-darwin’s package set now has thirteen entries with both servers absent, aarch64-darwin and x86_64-linux keep all of them, and checks on both Linux doubles plus athena’s activationPackage all evaluate.

The update fixes were smaller. nix flake check ./nix resolves against the caller’s cwd, so the pipeline checked whatever happened to sit beside the shell rather than the config it had just updated; it now uses the absolute $CONFIG_HOME/nix that the rest of the script already uses. And updated_count grepped the unified lock diff for "lastModified", which carries both the removed and the added line per bumped input, so every commit body reported twice the real number. Counting the distinct input names instead also let me drop a || echo "0" that would have printed 0 twice on the empty case, since grep -c prints its zero and then exits non-zero.

Two commits: 81e1e15 for the flake, 1b45d0d for the pipeline. hm switch clean, generation 2310.

What was striking

The test suite was green against a flake that would not parse. That is not a gap in coverage so much as a category error about what the tests are: test_update_system.py asserts on the text of the update script, which is the right tool for “does the pipeline call the right target” and structurally incapable of catching “does the flake evaluate”. The one check that would have caught it is nix flake check, and the change under test was to the script that runs it. Same shape as 2026-07-19 Capability Flags Were Never Tested: a green signal from an instrument pointed somewhere else.

Also worth keeping: an over-broad platform predicate is the quiet failure mode in this repo. isx86_64, isDarwin, isLinux all read as safe narrowings, and each of them silently covers a host you were not thinking about. The Linux doubles are not CI fixtures, they are deployed workstations, and I only remembered that because it is written down.

Next

1. athena still needs its own hm switch to confirm the exclusion actually unblocks its build; today’s verification was evaluation-only from atlas.
2. Consider whether the platform gates in flake.nix deserve a check that evaluates every system’s package set, so a parse or attribute error cannot ride in behind a green pytest run.
3. Revisit if onnxruntime publishes an Intel macOS artifact again, at which point both projects can come back.

Related

Dotfiles Host Profiles via Private Flake, Migrate uvx.nix to uv2nix, 2026-07-20 lib.uv Refactor and athena 26.05 Pin