sui-spec 0.1.15

Declarative Lisp-authored specs for CppNix-parity behaviors. Rust types are the hard boundary; Lisp forms are the free-middle authoring surface. Both engines (tree-walker + VM) drive the same spec, so they cannot drift.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

;; sui-spec/specs/trust_model.lisp — typed trust postures.

;; ── Single-user (permissive) ─────────────────────────────────────

(deftrust-model
  :name                  "single-user-permissive"
  :trusted-public-keys   ("cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=")
  :trusted-substituters  ("https://cache.nixos.org")
  :trusted-users         ("*")
  :posture               Permissive)

;; ── Multi-user (cppnix default) ──────────────────────────────────

(deftrust-model
  :name                  "multi-user-default"
  :trusted-public-keys   ("cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=")
  :trusted-substituters  ("https://cache.nixos.org")
  :trusted-users         ("@wheel")
  :posture               MultiUser)

;; ── Sealed (compliance / air-gapped) ─────────────────────────────

(deftrust-model
  :name                  "sealed-compliance"
  :trusted-public-keys   ()
  :trusted-substituters  ()
  :trusted-users         ("root")
  :posture               Sealed)