feat(emacs): Add prebuilt Doom option using nix-doom-emacs-unstraightened

Implement pre-built Doom Emacs packages for the live USB image, eliminating
the need to run `doom sync` after first boot.

Changes:
- Add nix-doom-emacs-unstraightened flake input
- Add homeModule to all three module sets (nixos, unstable, darwin)
- Add `prebuiltDoom` option to emacs role (default: false)
- Enable prebuiltDoom for live-usb configuration
- Pin custom packages in packages.el for deterministic builds:
  - claude-code-ide, gptel-tool-library, beads

When prebuiltDoom=true, all Doom packages are compiled at nix build time
using emacs-overlay. The doom configuration is stored in the nix store
(read-only), and no `doom sync` is required at runtime.

This is ideal for:
- Live USB images
- Immutable/reproducible systems
- Offline deployments

Closes: nixos-configs-1wd

flake.lock

@@ -21,6 +21,45 @@
         "type": "github"
       }
     },
+    "doomemacs": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767773143,
+        "narHash": "sha256-QL/t9v2kFNxBDyNJb/s411o3mxujan+QX5IZglTdpTk=",
+        "owner": "doomemacs",
+        "repo": "doomemacs",
+        "rev": "3e15fb36d7f94f0a218bda977be4d3f5da983a71",
+        "type": "github"
+      },
+      "original": {
+        "owner": "doomemacs",
+        "repo": "doomemacs",
+        "type": "github"
+      }
+    },
+    "emacs-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "nix-doom-emacs-unstraightened"
+        ],
+        "nixpkgs-stable": [
+          "nix-doom-emacs-unstraightened"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768011937,
+        "narHash": "sha256-SnU2XTo34vwVaijs+4VwcXTNwMWO4nwzzs08N39UagA=",
+        "owner": "nix-community",
+        "repo": "emacs-overlay",
+        "rev": "79abf71d9897cf3b5189f7175cda1b1102abc65c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "emacs-overlay",
+        "type": "github"
+      }
+    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -159,6 +198,27 @@
         "type": "github"
       }
     },
+    "nix-doom-emacs-unstraightened": {
+      "inputs": {
+        "doomemacs": "doomemacs",
+        "emacs-overlay": "emacs-overlay",
+        "nixpkgs": [],
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1768034604,
+        "narHash": "sha256-62pIZMvGHhYJmMiiBsxHqZt/dFyENPcFHlJq5NJF3Sw=",
+        "owner": "marienz",
+        "repo": "nix-doom-emacs-unstraightened",
+        "rev": "9b3b8044fe4ccdcbb2d6f733d7dbe4d5feea18bc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "marienz",
+        "repo": "nix-doom-emacs-unstraightened",
+        "type": "github"
+      }
+    },
     "nix-github-actions": {
       "inputs": {
         "nixpkgs": [
@@ -303,6 +363,7 @@
         "home-manager-unstable": "home-manager-unstable",
         "jovian": "jovian",
         "nix-darwin": "nix-darwin",
+        "nix-doom-emacs-unstraightened": "nix-doom-emacs-unstraightened",
         "nixos-wsl": "nixos-wsl",
         "nixpkgs": "nixpkgs_2",
         "nixpkgs-unstable": "nixpkgs-unstable",
@@ -324,6 +385,21 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -47,6 +47,12 @@
       url = "github:steveyegge/beads";
       inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
+
+    nix-doom-emacs-unstraightened = {
+      url = "github:marienz/nix-doom-emacs-unstraightened";
+      # Don't follow nixpkgs to avoid rebuild issues with emacs-overlay
+      inputs.nixpkgs.follows = "";
+    };
   };
 
   outputs = { self, nixpkgs, nixpkgs-unstable, nixos-wsl, ... } @ inputs: let
@@ -70,6 +76,7 @@
         home-manager.useUserPackages = true;
         home-manager.sharedModules = [
           inputs.plasma-manager.homeModules.plasma-manager
+          inputs.nix-doom-emacs-unstraightened.homeModule
         ];
         home-manager.extraSpecialArgs = {
           globalInputs = inputs;
@@ -98,6 +105,7 @@
         home-manager.useUserPackages = true;
         home-manager.sharedModules = [
           inputs.plasma-manager-unstable.homeModules.plasma-manager
+          inputs.nix-doom-emacs-unstraightened.homeModule
         ];
         home-manager.extraSpecialArgs = {
           globalInputs = inputs;
@@ -129,6 +137,9 @@
         ];
         home-manager.useGlobalPkgs = true;
         home-manager.useUserPackages = true;
+        home-manager.sharedModules = [
+          inputs.nix-doom-emacs-unstraightened.homeModule
+        ];
         home-manager.extraSpecialArgs = {
           globalInputs = inputs;
         };

home/home-live-usb.nix

@@ -14,7 +14,12 @@
     desktop.enable = true;
     tmux.enable = true;
     plasma-manager.enable = true;
-    emacs.enable = true;
+    emacs = {
+      enable = true;
+      # Use pre-built Doom Emacs - all packages built at nix build time
+      # This means no doom sync is needed after booting the live USB
+      prebuiltDoom = true;
+    };
     i3_sway.enable = true;
     # development.enable = false;  # Not needed for live USB
     # communication.enable = false; # Not needed for live USB

home/home-server.nix

@@ -1,24 +0,0 @@
-{ pkgs, globalInputs, system, ... }:
-
-{
-  # Home Manager configuration for servers (minimal with development tools)
-  home.username = "johno";
-  home.homeDirectory = "/home/johno";
-  home.stateVersion = "24.05";
-
-  # Minimal roles for server with development capability
-  home.roles = {
-    base.enable = true;
-    development.enable = true;
-    tmux.enable = true;
-  };
-
-  targets.genericLinux.enable = true;
-  home.sessionVariables = {};
-  home.sessionPath = [];
-
-  imports = [
-    ./roles
-    ./roles/base-linux
-  ];
-}

home/roles/development/default.nix

@@ -85,20 +85,11 @@ in
         fi
       done
 
-      # Copy local skills from this repo
-      for file in ${./skills}/*.md; do
-        if [ -f "$file" ]; then
-          filename=$(basename "$file" .md)
-          dest="$HOME/.claude/commands/''${filename}.md"
-          cp "$file" "$dest"
-        fi
-      done
-
       $DRY_RUN_CMD echo "Claude Code humanlayer commands and agents installed successfully${
         if cfg.allowArbitraryClaudeCodeModelSelection
         then " (model specifications preserved)"
         else " (model selection removed)"
-      } + local skills"
+      }"
     '';
 
     # Set up beads Claude Code integration (hooks for SessionStart/PreCompact)

home/roles/development/skills/parallel_beads.md

@@ -1,198 +0,0 @@
----
-description: Orchestrate parallel bead processing with worktrees, PRs, and reviews
----
-
-# Parallel Beads Workflow
-
-This skill orchestrates parallel bead processing using subagents. Each bead gets its own worktree, implementation, PR, and review.
-
-## Phase 1: Selection
-
-1. **Get ready beads**: Run `bd ready` to list all beads with no blockers
-2. **Present selection**: Use `AskUserQuestion` with `multiSelect: true` to let the user choose which beads to work on
-   - Include bead ID and title for each option
-   - Allow selection of multiple beads
-
-Example:
-```
-AskUserQuestion with:
-- question: "Which beads do you want to work on in parallel?"
-- multiSelect: true
-- options from bd ready output
-```
-
-## Phase 2: Parallel Implementation
-
-For each selected bead, launch a subagent using the Task tool. All subagents should be launched in parallel (single message with multiple Task tool calls).
-
-### Subagent Instructions Template
-
-Each implementation subagent should receive these instructions:
-
-```
-Work on bead [BEAD_ID]: [BEAD_TITLE]
-
-1. **Create worktree**:
-   - Branch name: `bead/[BEAD_ID]`
-   - Worktree path: `~/wt/[REPO_NAME]/[BEAD_ID]`
-   - Command: `git worktree add -b bead/[BEAD_ID] ~/wt/[REPO_NAME]/[BEAD_ID]`
-
-2. **Review the bead requirements**:
-   - Run `bd show [BEAD_ID]` to understand the acceptance criteria
-   - Note any external issue references (GitHub issues, Linear tickets, etc.)
-
-3. **Implement the changes**:
-   - Work in the worktree directory
-   - Complete all acceptance criteria listed in the bead
-   - Run any relevant tests or checks
-
-4. **Commit and push**:
-   - Stage all changes: `git add -A`
-   - Create a descriptive commit message
-   - Push the branch: `git push -u origin bead/[BEAD_ID]`
-
-5. **Create a PR**:
-   - Detect hosting provider from origin URL: `git remote get-url origin`
-   - If URL contains `github.com`, use `gh`; otherwise use `tea` (Gitea/Forgejo)
-   - PR title: "[BEAD_ID] [BEAD_TITLE]"
-   - PR body must include:
-     - Reference to bead ID: "Implements bead: [BEAD_ID]"
-     - Any external issue references from the bead (e.g., "Closes #123")
-     - Summary of changes
-   - For GitHub (`gh`):
-     ```bash
-     gh pr create --title "[BEAD_ID] [BEAD_TITLE]" --body "$(cat <<'EOF'
-     ## Summary
-     [Brief description of changes]
-
-     ## Bead Reference
-     Implements bead: [BEAD_ID]
-
-     ## External Issues
-     [Any linked issues from the bead]
-
-     ## Changes
-     - [List of changes made]
-     EOF
-     )"
-     ```
-   - For Gitea (`tea`):
-     ```bash
-     tea pr create --head bead/[BEAD_ID] --base main \
-       --title "[BEAD_ID] [BEAD_TITLE]" \
-       --description "## Summary
-     [Brief description of changes]
-
-     ## Bead Reference
-     Implements bead: [BEAD_ID]
-
-     ## External Issues
-     [Any linked issues from the bead]
-
-     ## Changes
-     - [List of changes made]"
-     ```
-
-6. **Report results**:
-   - Return: PR URL, bead ID, success/failure status
-   - If blocked or unable to complete, explain what's blocking progress
-```
-
-### Launching Subagents
-
-Use `subagent_type: "general-purpose"` for implementation subagents. Launch all selected beads' subagents in a single message for parallel execution:
-
-```
-<Task calls for each selected bead - all in one message>
-```
-
-Collect results from all subagents before proceeding.
-
-## Phase 3: Parallel Review
-
-After all implementation subagents complete, launch review subagents for each PR.
-
-### Review Subagent Instructions Template
-
-```
-Review PR for bead [BEAD_ID]
-
-1. **Detect hosting provider**: Run `git remote get-url origin` - if it contains `github.com` use `gh`, otherwise use `tea`
-
-2. **Read the PR**:
-   - For GitHub: `gh pr view [PR_NUMBER] --json title,body,additions,deletions,files`
-   - For Gitea: `tea pr view [PR_NUMBER]`
-   - View the diff: `git diff main...bead/[BEAD_ID]`
-
-3. **Review against acceptance criteria**:
-   - Run `bd show [BEAD_ID]` to get the acceptance criteria
-   - Verify each criterion is addressed
-
-4. **Leave review comments**:
-   - For GitHub: `gh pr review [PR_NUMBER] --comment --body "[COMMENTS]"`
-   - For Gitea: `tea pr review [PR_NUMBER] --comment "[COMMENTS]"`
-   - Include:
-     - Acceptance criteria checklist (which are met, which might be missing)
-     - Code quality observations
-     - Suggestions for improvement
-
-5. **Return summary**:
-   - Overall assessment (ready to merge / needs changes)
-   - Key findings
-```
-
-Launch all review subagents in parallel.
-
-## Phase 4: Cleanup and Summary
-
-After reviews complete:
-
-1. **Clean up worktrees**:
-   ```bash
-   git worktree remove ~/wt/[REPO_NAME]/[BEAD_ID] --force
-   ```
-   Do this for each bead's worktree.
-
-2. **Provide final summary**:
-   Present a table or list with:
-   - Bead ID
-   - PR URL
-   - Status (success / failed / blocked)
-   - Review summary
-   - Any failures or blockers encountered
-
-Example output:
-```
-## Parallel Beads Summary
-
-| Bead | PR | Status | Review |
-|------|-----|--------|--------|
-| beads-abc | #123 | Success | Approved |
-| beads-xyz | #124 | Success | Needs changes |
-| beads-123 | - | Failed | Blocked by missing dependency |
-
-### Failures/Blockers
-- beads-123: Could not complete because [reason]
-
-### Next Steps
-- Review PRs that need changes
-- Address blockers for failed beads
-```
-
-## Error Handling
-
-- **Subagent failures**: If a subagent fails or times out, note it in the summary but continue with other beads
-- **PR creation failures**: Report the error but continue with reviews of successful PRs
-- **Worktree conflicts**: If a worktree already exists, ask the user if they want to remove it or skip that bead
-
-## Resource Limits
-
-- Consider limiting concurrent subagents to 3-5 to avoid overwhelming system resources
-- If user selects more beads than the limit, process them in batches
-
-## Notes
-
-- This workflow integrates with the beads system (`bd` commands)
-- Worktrees are created in `~/wt/[REPO_NAME]/` by convention
-- Each bead gets its own isolated branch and worktree
-- PRs automatically reference the bead ID for traceability

home/roles/emacs/default.nix

@@ -23,13 +23,30 @@ let
     if pkgs.stdenv.isDarwin
     then pkgs.emacs-macport.pkgs.withPackages emacsPackages
     else pkgs.emacs.pkgs.withPackages emacsPackages;
+
+  # Path to doom config directory (relative to this file)
+  doomConfigDir = ./doom;
 in
 {
   options.home.roles.emacs = {
     enable = mkEnableOption "Doom Emacs with vterm and tree-sitter support";
+
+    prebuiltDoom = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Use nix-doom-emacs-unstraightened to pre-build all Doom packages at
+        nix build time. This eliminates the need to run `doom sync` after
+        first boot, making it ideal for live USB images or immutable systems.
+
+        When enabled, the doom configuration is read-only (stored in nix store).
+      '';
+    };
   };
 
-  config = mkIf cfg.enable {
+  config = mkIf cfg.enable (mkMerge [
+    # Common configuration for both modes
+    {
       home.packages = [
         pkgs.emacs-all-the-icons-fonts
         pkgs.fira-code
@@ -46,13 +63,16 @@ in
         pkgs.python3
       ];
 
+      fonts.fontconfig.enable = true;
+    }
+
+    # Standard Doom Emacs mode (requires doom sync at runtime)
+    (mkIf (!cfg.prebuiltDoom) {
       programs.emacs = {
         enable = true;
         package = defaultEmacsPackage;
       };
 
-    fonts.fontconfig.enable = true;
-
       # Mount emacs and tree-sitter grammars from nix store
       home.file = {
         "${config.xdg.configHome}/emacs".source = doomEmacs;
@@ -73,5 +93,20 @@ in
         rm -rf "${config.xdg.configHome}/doom"
         ln -sf "${config.home.homeDirectory}/nixos-configs/home/roles/emacs/doom" "${config.xdg.configHome}/doom"
       '';
+    })
+
+    # Pre-built Doom Emacs mode (no doom sync needed - ideal for live USB)
+    (mkIf cfg.prebuiltDoom {
+      programs.doom-emacs = {
+        enable = true;
+        doomDir = doomConfigDir;
+        doomLocalDir = "${config.xdg.dataHome}/doom";
+        # Add extra packages that aren't part of Doom but needed for our config
+        extraPackages = epkgs: [
+          epkgs.vterm
+          epkgs.treesit-grammars.with-all-grammars
+        ];
       };
+    })
+  ]);
 }

home/roles/emacs/doom/packages.el

@@ -51,11 +51,21 @@
 
 ;; (package! org-caldav)
 
+;; Note: Packages with custom recipes must be pinned for nix-doom-emacs-unstraightened
+;; to build deterministically. Update pins when upgrading packages.
+
 (package! gptel :recipe (:nonrecursive t))
 
 (package! claude-code-ide
-  :recipe (:host github :repo "manzaltu/claude-code-ide.el"))
+  :recipe (:host github :repo "manzaltu/claude-code-ide.el")
+  :pin "760240d7f03ff16f90ede9d4f4243cd94f3fed73")
 
 (package! gptel-tool-library
   :recipe (:host github :repo "aard-fi/gptel-tool-library"
-           :files ("*.el")))
+           :files ("*.el"))
+  :pin "baffc3b0d74a2b7cbda0d5cd6dd7726d6ccaca83")
+
+(package! beads
+  :recipe (:type git :repo "https://codeberg.org/ctietze/beads.el.git"
+           :files ("lisp/*.el"))
+  :pin "f40a6461d3c0fa0969311bbb6a1e30d1bba86c88")

machines/john-endesktop/MIGRATION_PLAN.md

@@ -170,7 +170,6 @@ This document outlines the plan to migrate the john-endesktop server from Arch L
    ```bash
    blkid /dev/nvme0n1p5
    # Note the UUID for updating hardware-configuration.nix
-/dev/nvme0n1p5: LABEL="nixos" UUID="5f4ad025-bfab-4aed-a933-6638348059e5" UUID_SUB="4734d820-7b8a-4b7f-853a-026021c1d204" BLOCK_SIZE="4096" TYPE="btrfs" PARTLABEL="data" PARTUUID="9ea025df-cdb7-48fd-b5d4-37cd5d8588eb"
    ```
 
 8. **Copy your NixOS configuration to the server**
@@ -389,11 +388,11 @@ After successful migration and 24-48 hours of stable operation:
 
 Pre-migration:
 - [x] nvme0n1p5 removal from media pool complete
-- [x] Recent backup verified (< 24 hours)
-- [x] Maintenance window scheduled
-- [x] NixOS ISO downloaded
-- [x] Bootable USB created
-- [x] NixOS config builds successfully
+- [ ] Recent backup verified (< 24 hours)
+- [ ] Maintenance window scheduled
+- [ ] NixOS ISO downloaded
+- [ ] Bootable USB created
+- [ ] NixOS config builds successfully
 
 During migration:
 - [ ] ZFS pools exported