Base system is NixOS; Nix is the engine, Tacid is the face

Context

An agent that changes its own body needs the machine to be a value: declared in text, diffable, buildable before activation, atomically switchable, rollbackable, versionable, signable, portable to new hardware, and self-hostable from source, on every architecture Tacid will ever target. The base system is the first irreversible decision.

The three plans

• Grok: Alpine or Debian slim with dinit/s6, a read-mostly /usr, and a homegrown tacid rebuild engine applying a TOML tree. Explicitly “not NixOS under another name”, but lists “a hidden Nix/Guix core with a Tacid face” as an option in Q-1.
• Fable: NixOS unstable with flakes, Home Manager, disko; the system state is a text file and text is what models are best at.
• Codex: NixOS, with nixpkgs pinned and promoted through Tacid’s own tested channels; never raw nixos-unstable.

Decision

NixOS is the base. Nix is the engine and never the face: the owner does not have to write Nix, the agent does, through typed options (ADR-0008). nixpkgs is consumed pinned, through Tacid channels (ADR-0013).

The Nix implementation is Lix: community governed, flakes treated as a de-facto stable v1, Rust arriving in the codebase. nix.package is one line if this changes; no Lix-only features are used in the genome. switch-to-configuration-ng (Rust) is required. nixos-rebuild is not used: tacidd evaluates and builds, tacid-stem activates.

Requests that fall outside the curated option surface (packaging a project, an overlay) are served by agent-authored derivations in the genome’s quarantined pkgs/ directory, built in the Nix sandbox and tagged untrusted by policy (added after review).

Consequences

• Every change to the machine is an evaluation and a build; the engine’s cost (2–4 GB of memory and seconds to tens of seconds per evaluation) is paid, and tacidd runs evaluation in a capped cgroup while tacid-infer evicts models under pressure.
• Channels must advance only when the cache is fully populated for both architectures, or edge machines compile the world.
• Tacid inherits nixpkgs’ breadth, its module system, VM tests and cross-compilation.
• Grok’s objection about identity is honoured by the face, not by the engine.

Alternatives rejected

• Alpine/Debian + homegrown rebuild engine: reinvents Nix with fewer guarantees (no build-before-activate, no content-addressed store, no VM tests) and would consume the project.
• Guix: the same model in Scheme, but nonfree firmware and NVIDIA userspace are excluded by policy and “any device” needs them.
• Image-based immutable systems (ostree, sysupdate-only): atomic updates, but configuration stays imperative on top and the agent cannot reason about it as a value.
• A new operating system from scratch: not an operating system for this decade.