tentaflake: Instructions file for Codex

Agent instructions — Tentaflake

Generic NixOS template for isolated agents. Deployment identities, hardware, secrets, private memories and company policy belong in forks. Nix/TOML/settings and seed inputs enter the Nix store. Never print credentials for diagnostics. Do not replace declarative agents with a mandatory runtime, UI or control service.

Ownership

• tentaflake.toml is the sole public desired-system source. Public systemFromData { file = ./tentaflake.toml; } is file-only and returns one NixOS module; mkAgent and adapter builds are internal. Each adapters/<id>.nix owns its runtime implementation and pure preset facts. lib/runtimeCatalog.nix projects presets; adapters/catalog.json and the marked adapter-doc table are generated with python3 scripts/runtime-catalog-docs.py, never edited as independent runtime sources.
• lib/runtimeContract.nix owns generic definitions; lib/containerSecurity.nix owns shared containment. modules/ owns host broker, Research, worker, quota, backup, provenance and management policy. Runtime hooks cannot weaken it; host policy may consume instance metadata but must not define more instances.
• All managed IDs are agent-<name>, names globally unique; default host state is /var/lib/tentaflake/agents/<name>. Read explicit agentInstances metadata for effective paths, stateStorage, workspace, numeric owners and runnable. Inventory retains unmanaged OCI fallback. TOML requires schemaVersion = 1 and agents; optional _securityNote is metadata. No legacy wrapper/data APIs. Ship only the empty, commented inventory (schemaVersion = 1, agents = []), without a separate example file. Real desired state belongs in a consumer/fork Git source, loaded with its own explicit file path; never import or fall back to the upstream template for an installation. Missing/Git-filtered sources fail. Remaining agents.toml or agents.json requires explicit migration.
• Hermes/ZeroClaw real vendor acceptance is pending. OpenClaw is a stopped refusal unit only: no OCI artifact, state, credentials or sockets. Pi Durable is the same refusal unit unless the host explicitly admits the reviewed runtime (tentaflake.piDurableRuntime: exact package/image proof, runsc-pi-durable-v1, broker, Research, worker and quotas); never relax that admission. Generic custom OCI is offline, with no accepted model/Research integration. Synthetic fixtures are not vendor acceptance. See adapters.
• crates/ owns CLI/broker/worker. Shared Rust packaging in lib/mkRustPackage.nix includes workspace manifests and selected crate source; root versions and image metadata remain authoritative. Keep required root inputs explicit.
• CLI help/catalog/templates and offline config validate|normalize|migrate do not require generated host inputs. Management uses generated host inputs; imports validate via the shared parser/plan, publish stopped additions atomically and never stage, activate or download runtime images. Preserve ordinary Git flake filtering and redact raw Nix source diagnostics.
• Editor, Hive Research and speech integrations belong in consumer flakes.