3c82db60

By: syd <syd@kronor.io>

Derive the graph from the manifests by default; drop the checked-in table

nix/graph.nix is now the source of the project graph, and nix/projects.json is
deleted. Every one of the 38 build and test derivation paths is byte-identical
across all three states: the old checked-in table, graph.nix reading that table
as an override, and graph.nix deriving from the manifests. So the generated file
was never carrying information the manifests did not already have.

Nx is no longer involved in the recommended path at all, not even offline. It
knows dependencies at exactly one level in a pnpm workspace, project to
project, derived from the manifests: results/nx-dependency-levels.json shows
all 16 dependency-carrying files are package.json and none of the 88 TypeScript
files carries any.

The checked-in table survives as an optional override. Dropping one at
nix/projects.json switches to it with no other change, for a workspace where
the manifests stop being the graph: a hoisted node_modules where phantom
imports resolve, or edges coming from tsconfig path aliases.
scripts/nx-to-nix.mjs generates one and now says so.

The graph-agreement guard is replaced. Comparing a manifest-derived table
against the manifests is tautological; the residual risk moved to the one file
Nix cannot read, pnpm-workspace.yaml, whose globs graph.nix restates. The new
guard asks pnpm, which reads that file itself, over a source tree containing
every manifest in the repository rather than only those under Nix globs.
Demonstrated: dropping "apps" from the globs silently takes the test
derivations from 19 to 16, and the guard exits 1 naming apps/cli, apps/report
and apps/web.

Total

5m17s

Created Started Finished

Time to Start Worker time Duration Time to finish Idle
Config 0s 1s 1s 1s 0s
Eval 1s 5m16s 5m16s 5m17s 0s
Build 3s 48s 5m12s 5m16s 0s
Suite 0s 6m06s 5m17s 5m17s 0s

Timeline

Config Eval Build
0s1m2m3m4m5m