Nockchain evidence

Scaffold provenance

Nockchain Nockup Source Trace

Source anchors for Nockup manifests, cached templates, toolchain channels, dependency resolution, registry install paths, package symlinks, git cache, and experimental untrusted-code boundaries.

Commit
33ba97b1e206
Anchors
11
Capabilities
7
Crate
nockup

Source Anchors

nockup-readme-contract

file

crates/nockup/README.md

symbols

nockup update, nockup project init, nockup package install

lineRange

1-132

Documents Nockup's experimental status, local cache/toolchain workflow, manifest fields, template names, dependency commands, and untrusted-code security posture.

The README states Nockup is experimental, bootstraps ~/.nockup, scaffolds from nockapp.toml, installs Hoon dependencies, and treats template/dependency execution as untrusted code execution.

nockup-manifest-schema

file

crates/nockup/src/manifest.rs

symbols

HoonPackage, NockAppManifest, PackageMeta, DependencySpec, NockAppLock

lineRange

1-154

Defines package metadata, template/template_commit fields, dependency specs, and lockfile records.

The manifest schema supports simple, versioned, and full git dependency specs plus lock entries with exact commit hashes.

nockup-template-init

file

crates/nockup/src/commands/init.rs

symbols

run, load_project_config, create_template_context, copy_template_directory

lineRange

1-179

Scaffolds a new project from a cached template and applies manifest values through Handlebars.

The init command loads <project>.toml, resolves ~/.nockup/templates/<template>, rejects existing target directories, builds template context, copies template files, and processes libraries.

nockup-template-cache

file

crates/nockup/src/commands/common.rs

symbols

download_templates, clone_templates, has_existing_templates, copy_dir_recursive

lineRange

69-240

Downloads or refreshes bundled templates and manifests from the canonical Nockchain repository.

Nockup clones nockchain/nockchain master, moves crates/nockup/templates and crates/nockup/manifests into ~/.nockup, and writes commit.toml with the fetched commit id.

nockup-toolchain-channel

file

crates/nockup/src/commands/common.rs

symbols

download_toolchain_files, clone_toolchain_files, get_target_identifier

lineRange

241-360

Fetches channel manifests for the local architecture and writes cache config for stable/nightly tooling.

The common command code derives architecture identifiers, writes config.toml defaults, downloads release manifests for the active channel, and keeps channel binaries under ~/.nockup.

nockup-dependency-resolver

file

crates/nockup/src/resolver/engine.rs

symbols

Resolver::resolve, Resolver::resolve_dependency, dep_spec_to_git_spec, validate_source_files

lineRange

1-430

Resolves dependencies recursively, fetches sources, validates requested .hoon files, loads transitive hoon.toml dependencies, and caches packages by exact commit.

The resolver records exact commits, converts specs into GitSpec values, checks cache, validates source files, loads transitive deps, and computes an install graph.

nockup-registry-install-path

file

crates/nockup/src/resolver/registry.rs

symbols

RegistryEntry, lookup, get_dependencies, to_git_spec

lineRange

1-318

Maps registry packages and Typhoon registry entries into git source paths, install paths, file selections, and dependencies.

Registry entries carry git_url, path, install_path, and file; online registry lookup falls back to hardcoded entries and to_git_spec preserves install_path for package install.

nockup-resolved-graph-order

file

crates/nockup/src/resolver/types.rs

symbols

ResolvedPackage, ResolvedGraph, ResolvedGraph::compute_install_order

lineRange

1-83

Defines resolved package metadata and topological install order with cycle detection.

ResolvedPackage stores exact commit, source_url, source_path, install_path, source_files, and dependencies; compute_install_order visits deps first and rejects cycles.

nockup-package-install-links

file

crates/nockup/src/commands/package/install.rs

symbols

run, link_registry_package, link_package_files, NockAppLock::save

lineRange

1-360

Installs resolved packages into hoon/packages, creates symlinks into hoon/lib, hoon/sur, or registry install_path directories, and writes nockapp.lock.

Package install creates hoon/packages/lib/sur directories, uses install_path plus source_files for registry packages, sanitizes names/versions, and records exact git source commits in the lockfile.

nockup-cache-index

file

crates/nockup/src/cache.rs

symbols

PackageCache, PackageCache::cache_package, CacheIndex, CachedPackage

lineRange

1-300

Tracks package cache identity under ~/.nockup/cache/packages with source URL, version spec, exact commit, timestamp, and cache index.

cache_package copies source into the package cache, records cached_at, and writes cache-index.json; the cache can list, prune, and find packages by version spec.

nockup-git-fetcher

file

crates/nockup/src/git_fetcher.rs

symbols

GitSpec, GitFetcher::fetch, resolve_branch, resolve_tag, checkout_commit

lineRange

1-240

Fetches git dependencies by commit, tag, branch, or default branch and caches them by URL hash plus short commit.

GitFetcher resolves refs with git ls-remote, prefers commit > tag > branch > default, clones repos, checks out exact commits, and supports sparse checkout for subdirectories.

Nockup Capabilities

manifest-template-selection

Manifest template selection

A Nockup receipt should identify the template and manifest hash before treating scaffold output as comparable.

sourceAnchorIds

nockup-manifest-schema, nockup-readme-contract

receiptFields

templateName, templateCommit, manifestHash

template-cache-and-toolchain-channel

Template cache and toolchain channel

Template and channel evidence must include the cache commit and target architecture so local scaffold results can be reproduced.

sourceAnchorIds

nockup-template-cache, nockup-toolchain-channel

receiptFields

templateCommit, cacheChannel, targetIdentifier, nockchainBuild

registry-install-path-symlinks

Registry install_path symlinks

install_path behavior should be checked before Nocksperimental assumes a generated Hoon dependency appears under hoon/lib, hoon/sur, hoon/sys, or another registry path.

sourceAnchorIds

nockup-registry-install-path, nockup-package-install-links

receiptFields

installPathMap, sourceFileAllowlist, lockfileHash

experimental-untrusted-code-warning

Experimental untrusted code warning

Nockup-generated code and dependency execution should remain clearly experimental until source, build, and safety checks are attached.

sourceAnchorIds

nockup-readme-contract

receiptFields

validationStatus, nockupCommit, templateCommit

Receipt Contract

nockupCommit
nockchainBuild
templateName
templateCommit
manifestHash
dependencySpecs
resolvedPackageCommits
installOrder
installPathMap
lockfileHash
cacheChannel
targetIdentifier
validationStatus
highlightedField

templateCommit

highlightedField

manifestHash

highlightedField

resolvedPackageCommits

highlightedField

lockfileHash

reviewRule

Publish template names, commits, hashes, dependency specs, resolved commits, and install-path summaries rather than raw project sources.

reviewRule

Treat Nockup templates and dependencies as untrusted code until the receipt links source commit, lockfile hash, and validation status.

reviewRule

Keep landed source behavior separate from open PR behavior for template manifests, extension hooks, install_path fixes, and patches.

reviewRule

Hash nockapp.toml, nockapp.lock, cache-index.json, generated source trees, and compiled jams instead of storing raw content in public receipts.

Upstream Watch

Current Nocksperimental receipts should model landed Nockup behavior and watch open PRs before claiming template manifests, hooks, patches, or symlink fixes are canonical.

highlightedWatch

PR #125

highlightedWatch

PR #120

PR #125

Template manifests from hbs sources

May turn template manifests into generated artifacts that Nockup receipts should hash and verify separately.

PR #122

install_path support and nested symlink fixes

May change install_path receipt fields and symlink evidence for registry-backed dependencies.

PR #120

Extension hooks for downstream templates and subcommands

May add hook execution surfaces that need explicit untrusted-code and output-hash fields.

PR #117

Declarative post-install patches

May require patch id, patch hash, target path, and applied/failed state in Nockup receipts.

PR #114

Basic template dependency pinning

May change the baseline scaffold reproducibility contract for the basic template.

Local Verification

status

source-inspected

inspectedSourceCommit

33ba97b1e206dd89b15c61b72b7802caf2136c18

highlightedCommand

cargo check -p nockup

command

cargo check -p nockup

command

cargo test -p nockup

command

cargo test -p nockup resolver::spec_parser::tests

Forbidden Evidence

forbiddenField

rawTemplateArchive

forbiddenField

rawGitCheckout

forbiddenField

rawNockappToml

forbiddenField

rawHoonSource

forbiddenField

rawCompiledJam

forbiddenField

gpgPrivateKey

forbiddenField

walletSeedPhrase

forbiddenField

privateSpendKey

highlightedForbidden

rawTemplateArchive

highlightedForbidden

rawCompiledJam

highlightedForbidden

gpgPrivateKey

symbol

NockAppManifest

symbol

download_templates

symbol

Resolver::resolve

symbol

link_registry_package

symbol

PackageCache::cache_package