build: unify the test+lint gate under nix flake check (closes #347, #348)

`just test-go`/`lint-go` ran go test/vet/golangci-lint in the devshell
against the real environment. Two bugs this session (the discovery_test
HOME/cwd env-leak and the SSE data-race/hang) were invisible there and
only surfaced in the merge hook. Make `nix flake check` the single
hermetic gate.

New checks (mirroring igloo's buildGoRace, used by madder):
- go-test-race: `go test -race ./...` on a lean base off `moxy`
  (doCheck on, plugin postInstall dropped, MOXIN_PATH unset, CGO+race via
  buildGoRace). The sandbox's fresh HOME makes env-dependent tests
  isolated by construction — it immediately caught the asyncjob clown
  stub's `/usr/bin/env bash` shebang (no /usr/bin/env in the pure
  sandbox), now resolved via exec.LookPath. Folds in #348 (-race lane).
- go-vet: `go vet ./...` hermetically.
- go-lint: golangci-lint run offline against the buildGoApplication
  module graph, --config pointed at the flake's .golangci.yml (the
  dotfile isn't in the filtered moxySrc). Hermetic golangci-lint-in-nix
  is novel across the eng fleet — proven feasible here.
- bats: the comprehensive bats-default lane (net_cap/host_only need
  sandbox capabilities a flake check can't grant — they stay explicit
  recipes; per-tag lanes stay packages for `just test-bats-tag`).

justfile: `default`/`test` route through `nix flake check`; the devshell
test-go/test-bats/lint recipes stay as fast iteration loops, with the
flake check as the source of truth. test-bats-net_cap + the runtime
smokes (validate-mcp, status) run alongside.

🤡 Generated with [Clown 0.3.10+44f75d5](amarbel-llc/clown@44f75d5)

Author: friedenberg

flake.nix

@@ -969,6 +969,52 @@
             bats-host_only = mkBatsLane { filter = "host_only"; };
           };
 
+        # Hermetic Go test + vet checks (#347, folds #348). A lean base off
+        # `moxy`: doCheck on, the plugin-gen postInstall dropped (irrelevant to
+        # a test run), MOXIN_PATH unset to match `just test-go`. The build
+        # sandbox gives each a fresh HOME/TMPDIR, so env-dependent tests (e.g.
+        # discovery's MOXIN_PATH/HOME fallback) are isolated by construction —
+        # the class that leaked into the merge hook. buildGoRace flips
+        # CGO_ENABLED=1 + -race for the race deriv only, leaving the shipped
+        # binary untouched.
+        goCheckBase = moxy.overrideAttrs (_: {
+          doCheck = true;
+          postInstall = "";
+          preCheck = "export MOXIN_PATH=";
+        });
+        goTestRace = pkgs.buildGoRace { base = goCheckBase; };
+        goVet = goCheckBase.overrideAttrs (_: {
+          pname = "moxy-govet";
+          checkPhase = ''
+            runHook preCheck
+            go vet ./...
+            runHook postCheck
+          '';
+        });
+        # golangci-lint as a hermetic check. moxy's .golangci.yml uses only the
+        # standard built-in analyzers (no external plugins), so it typechecks
+        # offline against the buildGoApplication module graph. Caches go to
+        # $TMPDIR (the sandbox HOME is read-only). golangci-lint from
+        # pkgs-master matches the devshell `lint-go` binary (config schema v2).
+        goLint = goCheckBase.overrideAttrs (old: {
+          pname = "moxy-golangci-lint";
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [
+            pkgs-master.golangci-lint
+          ];
+          # --config points at the flake's copy of .golangci.yml: the dotfile
+          # is not in the filtered moxySrc, so without this golangci-lint runs
+          # with defaults (errcheck on, no exclusions) and flags ~50 idiomatic
+          # sites the repo config deliberately suppresses. Path-based
+          # exclusions still resolve against the analyzed paths (cwd-relative).
+          checkPhase = ''
+            runHook preCheck
+            export HOME="$TMPDIR"
+            export GOLANGCI_LINT_CACHE="$TMPDIR/golangci-lint-cache"
+            golangci-lint run --config ${./.golangci.yml} --timeout 10m ./...
+            runHook postCheck
+          '';
+        });
+
       in
       {
         packages = batsLaneOutputs // {
@@ -983,7 +1029,21 @@
         # `conformist check`, which also runs the dead-jq linter over
         # zz-tests_bats/*.bats.
         formatter = conformistFormatter;
-        checks.conformist = conformistCheck;
+        # `nix flake check` is the single hermetic gate: conformist (fmt +
+        # dead-jq), the Go test (-race) / vet / golangci-lint checks, and the
+        # comprehensive `bats-default` lane (every test except the net_cap and
+        # host_only tags, which need sandbox capabilities a flake check can't
+        # grant — those stay as their own `nix build` recipes). The per-tag
+        # lanes remain in `packages` for focused `just test-bats-tag` runs;
+        # bats-default already covers them in aggregate, so re-listing each as
+        # a check would only double-build.
+        checks = {
+          conformist = conformistCheck;
+          go-test-race = goTestRace;
+          go-vet = goVet;
+          go-lint = goLint;
+          bats = batsLaneOutputs.bats-default;
+        };
 
         devShells.default = pkgs-master.mkShell {
           packages = [

internal/asyncjob/asyncjob_test.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"regexp"
 	"strings"
@@ -19,10 +20,19 @@ import (
 // signature: exit 0, no output).
 func writeClownStub(t *testing.T, startOutput string) (bin, record string) {
 	t.Helper()
+	// Resolve a real interpreter rather than hardcoding `/usr/bin/env bash`:
+	// the hermetic nix-check sandbox has bash on PATH but no /usr/bin/env, so
+	// an env-shebang stub silently fails to exec and `startJob` mints a local
+	// id instead of running the stub. A direct shebang to the resolved bash
+	// works in both the sandbox and the devshell.
+	shell, err := exec.LookPath("bash")
+	if err != nil {
+		t.Skipf("no bash on PATH for clown stub: %v", err)
+	}
 	dir := t.TempDir()
 	record = filepath.Join(dir, "record")
 	bin = filepath.Join(dir, "clown")
-	script := "#!/usr/bin/env bash\n" +
+	script := "#!" + shell + "\n" +
 		"printf '%s\\n' \"$*\" >> " + record + "\n" +
 		"if [ \"$1\" = job ] && [ \"$2\" = start ]; then\n"
 	if startOutput != "" {

justfile

@@ -1,9 +1,15 @@
 export MOXIN_PATH := justfile_directory() / "result-moxins" / "share" / "moxy" / "moxins"
 
-default: lint build test test-status-clean-env
-
-# Pre-build gate aggregate: treefmt formatting check + golangci-lint. A hard
-# CI gate via `default`.
+# The hermetic gate is `nix flake check` (via `test`): it runs conformist
+# (fmt + dead-jq), go-test-race, go-vet, go-lint, and every bats lane in the
+# build sandbox — so the formatting/lint/go-test/bats coverage `lint` and the
+# old devshell `test-*` recipes provided is now subsumed there and not
+# repeated here. `lint`, `test-go`, `test-bats`, etc. remain as fast
+# devshell loops for iteration; `nix flake check` is the source of truth.
+default: build test test-status-clean-env
+
+# Fast devshell lint loop (treefmt check + golangci-lint). NOT the gate — the
+# hermetic equivalents (conformist + go-lint) run inside `nix flake check`.
 [group("pre-build")]
 lint: lint-fmt lint-go
 
@@ -107,8 +113,14 @@ lint-go:
 
 dir_build := "build"
 
+# The gate. `test-flake-check` (= `nix flake check`) runs the hermetic
+# go-test-race / go-vet / go-lint / conformist / bats-default checks, so the
+# devshell test-go/test-bats and lint recipes are NOT repeated here (they stay
+# as standalone fast loops). test-bats-net_cap stays explicit: the loopback
+# lane needs a sandbox capability a flake check can't grant. The runtime
+# smokes (validate-mcp, status) aren't expressible as flake checks either.
 [group("post-build")]
-test: test-go test-bats test-bats-net_cap test-validate-mcp test-status test-flake-check
+test: test-flake-check test-bats-net_cap test-validate-mcp test-status
 
 # Run the bats integration suite inside the nix build sandbox via
 # `nix build .#bats-default`. The default lane filters