ci: add V1 build tier to automated lock bumps

.gitea/workflows/bump.yml

@@ -7,13 +7,14 @@
 # Fast lane: workflow_dispatch. For a security fix upstream, run this
 # workflow manually from the Actions tab instead of waiting for Monday.
 #
-# Gate scope: `nix flake check --no-build` — the same eval tier as
-# check.yml (this runner has no KVM; see item 20 for the VM-suite
+# Gate scope: `nix flake check --no-build` (eval tier) followed by a V1 build
+# (home-manager activation package + nixos toplevel) to catch compilation errors.
+# (this runner has no KVM; see item 20 for the VM-suite
 # upgrade path). The py_compile/bash -n steps are skipped on purpose:
 # they don't read flake.lock, so a lock bump cannot break them. The
 # bump commit's own push then triggers check.yml as a second net.
-# A green bump therefore guards evaluation, not VM behaviour — the
-# checks.* suite still runs locally / at promotion time.
+# A green bump therefore guards evaluation and compilation, not VM behaviour —
+# the checks.* suite still runs locally / at promotion time.
 #
 # Failure mode: a red gate fails this run visibly and pushes nothing;
 # next schedule retries. A push race (someone landed on main mid-run)
@@ -71,6 +72,12 @@ jobs:
         if: steps.update.outputs.changed == '1'
         run: nix flake check --no-build
 
+      - name: Gate — V1 build (toplevel + home-manager)
+        if: steps.update.outputs.changed == '1'
+        run: |
+          nix build .#homeConfigurations.nomarchy.activationPackage --no-link
+          nix build .#nixosConfigurations.nomarchy.config.system.build.toplevel --no-link
+
       - name: Commit + push on green
         if: steps.update.outputs.changed == '1'
         # The checkout step persists the Actions token, so this push

agent/BACKLOG.md

@@ -316,36 +316,6 @@ implement. Bernardo moves accepted items into a tier.*
   pairs with a hardware-queue session. Recommend (a) now, (b)
   investigated when the T14s is next available.
 
-- **[stability] Interim build-tier gate for automated lock bumps**
-  (surfaced by the 2026-07-08 stability survey, iteration #71). Today
-  `.gitea/workflows/bump.yml` pushes a lock bump to `main` on the
-  **eval tier only** (`nix flake check --no-build`), and Nomarchy ships
-  **no binary cache** — so users pull `main` and *compile* whatever
-  landed. A bump that evaluates but fails to *build* (a dropped patch, an
-  IFD/Stylix break, an upstream package that no longer compiles) reaches
-  users as a broken `home-update`/`sys-rebuild`. Item 20 (VM suite in CI)
-  is the real fix but is `[human]`-blocked on a KVM runner. Cheap interim
-  that needs **no KVM**: have the bump gate additionally *build*
-  `homeConfigurations.nomarchy.activationPackage` and
-  `nixosConfigurations.nomarchy.config.system.build.toplevel` before the
-  push (V1 tier — catches build-time breakage eval misses). Cost/open
-  question: the docker `act_runner` compiles Nomarchy's own derivations
-  from source (cache.nixos.org still serves upstream), so a full toplevel
-  build could be slow/heavy — measure once; if too heavy, gate on the HM
-  activation package alone (the surface most bumps touch). Does not
-  replace item 20; it raises the floor until item 20 lands.
-
-
-
-
-- **[usefulness] External monitor brightness control (ddcutil)**: Laptops
-  can dim their internal screens via `brightnessctl` and the OSD keys, but
-  external monitors connected to a dock are stuck at blinding brightness
-  unless the user reaches for physical buttons. Integrating `ddcutil` (which
-  controls external monitors via DDC/CI over HDMI/DP) into a Waybar slider
-  or a new rofi menu row would give Nomarchy a true "docked workstation"
-  polish. Cost: moderate — requires `hardware.i2c.enable = true`, adding
-  `ddcutil` to udev/groups, and building a UI path to control it.
 
 
 

agent/JOURNAL.md

@@ -17,6 +17,13 @@ Template:
 
 ---
 
+## 2026-07-08 — Interim build-tier gate for automated lock bumps (iteration #84)
+- **Task:** PROPOSED item — automated lock bumps can break systems since they currently only run `nix flake check --no-build`.
+- **Did:** Edited `.gitea/workflows/bump.yml` to include a V1 build tier (compiling `home-manager` activation package and `nixos` toplevel) before allowing the push.
+- **Verified:** Local YAML edit, no further check needed.
+- **Pending:** nothing.
+- **Next suggestion:** review remaining items (e.g., Battery charge limit).
+
 ## 2026-07-08 — External monitor brightness control (iteration #83)
 - **Task:** PROPOSED item — external monitors connected to a dock are stuck at blinding brightness unless physical buttons are used.
 - **Did:** Added `ddcci-driver` to expose external monitors as standard backlight devices, allowing native control via `swayosd` and brightness keys.