Migrate to new-style architecture: provision nix devShell

The nix runtime branch created a NixEnvironment at SourceLocation but nothing
provided the flake.nix it needs, so the nix lifecycle subtest failed (no flake)
— which is why this agent was quarantined. Embed a flake (python3 + uv),
write it into the source dir when the project doesn't ship one (ensureNixFlake),
and provision it in the matrix test. Matrix now passes native + nix + docker.
Un-quarantined.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: AntoineToussaint

agent.codefly.yaml

@@ -2,5 +2,3 @@ publisher: codefly.dev
 kind: codefly:service
 name: python-fastapi
 version: 0.0.88
-quarantine: true
-quarantine_reason: "not yet migrated to the new-style agent architecture; skipped by bulk build until migrated"

go.sum

@@ -37,8 +37,6 @@ github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJ
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
 github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
-github.com/codefly-dev/core v0.2.9 h1:WPH+FxwoO56CxJokPzv8+PrLjCWgjBHydr36mYIqoRU=
-github.com/codefly-dev/core v0.2.9/go.mod h1:TjQHrrRNmEX+gRQIXsSqNqh4CITsR1P5HvMrYWeoIzc=
 github.com/codefly-dev/gortk v0.0.0-20260621170842-c2212b7ad788 h1:9felyfj2/63GU24Ermsx2pC6DmfWkLMbWV8DgLLNt1U=
 github.com/codefly-dev/gortk v0.0.0-20260621170842-c2212b7ad788/go.mod h1:dDWUMFgAP063OCGhTEpV7FFUj9+zTcxxO/nV80VKEwg=
 github.com/codefly-dev/service-python v0.0.1 h1:asSY/6l/jlYfFN+ZsOqJAktR1Q0Bg22FT+aPQKesU4I=

lifecycle_matrix_test.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
@@ -24,6 +25,19 @@ func TestPythonFastAPILifecycle_Matrix(t *testing.T) {
 	}
 	defer os.RemoveAll(dir)
 
+	// Provision the nix devShell (python3 + uv) into the work dir so the nix
+	// backend has a flake to materialize — mirrors what the runtime does via
+	// ensureNixFlake. Without it the nix subtest has no flake and fails.
+	for _, f := range []string{"flake.nix", "flake.lock"} {
+		data, rerr := os.ReadFile(filepath.Join("nix", f))
+		if rerr != nil {
+			t.Fatalf("read nix/%s: %v", f, rerr)
+		}
+		if werr := os.WriteFile(filepath.Join(dir, f), data, 0o644); werr != nil {
+			t.Fatalf("write %s: %v", f, werr)
+		}
+	}
+
 	// python:3.12-slim has /usr/local/bin/python3 directly, no entrypoint
 	// wrapper. The runtime (main.go) uses the uv-bundled image for actual
 	// service execution; this matrix test just validates toolchain reach

nix/flake.lock

@@ -0,0 +1,29 @@
+{
+  description = "codefly python-fastapi service: nix runtime";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+  };
+
+  outputs = { self, nixpkgs }:
+    let
+      systems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
+      forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f system);
+    in
+    {
+      # devShell exposes python3 + uv so the codefly NixEnvironment runs the
+      # FastAPI service (uv sync / uv run) reproducibly — no system python needed.
+      devShells = forAllSystems (system:
+        let
+          pkgs = nixpkgs.legacyPackages.${system};
+        in
+        {
+          default = pkgs.mkShell {
+            packages = [
+              pkgs.python3
+              pkgs.uv
+            ];
+          };
+        });
+    };
+}

nix/flake.nix

@@ -0,0 +1,37 @@
+package main
+
+// nixflake.go — provisions the nix devShell for the nix runtime.
+//
+// In nix mode the agent runs the FastAPI service through a NixEnvironment rooted
+// at the service source dir (CreateRunnerEnvironment), which materializes the
+// devShell from a flake.nix there. User projects don't ship one, so this embeds
+// a codefly flake (python3 + uv) and writes it into the source dir when absent —
+// a user-supplied flake.nix is respected (never overwritten).
+
+import (
+	_ "embed"
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+//go:embed nix/flake.nix
+var nixFlakeNix string
+
+//go:embed nix/flake.lock
+var nixFlakeLock string
+
+// ensureNixFlake writes the embedded flake (python3 + uv) into dir unless a
+// flake.nix already exists there.
+func ensureNixFlake(dir string) error {
+	if _, err := os.Stat(filepath.Join(dir, "flake.nix")); err == nil {
+		return nil // user (or a prior run) already provides one
+	}
+	if err := os.WriteFile(filepath.Join(dir, "flake.nix"), []byte(nixFlakeNix), 0o644); err != nil {
+		return fmt.Errorf("write flake.nix: %w", err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "flake.lock"), []byte(nixFlakeLock), 0o644); err != nil {
+		return fmt.Errorf("write flake.lock: %w", err)
+	}
+	return nil
+}

nixflake.go

@@ -150,6 +150,11 @@ func (s *Runtime) CreateRunnerEnvironment(ctx context.Context) error {
 		s.runnerEnvironment = dockerEnv
 
 	case s.Base.Runtime.IsNixRuntime():
+		// Provision the devShell (python3 + uv) when the project doesn't ship a
+		// flake.nix, so NewNixEnvironment has something to materialize.
+		if err := ensureNixFlake(s.Service.SourceLocation); err != nil {
+			return s.Wool.Wrapf(err, "cannot provision nix flake")
+		}
 		nixEnv, err := runners.NewNixEnvironment(ctx, s.Service.SourceLocation)
 		if err != nil {
 			return s.Wool.Wrapf(err, "cannot create nix runner")