From d94a48594e06ab000d6a04daf7b2683fc7c0087c Mon Sep 17 00:00:00 2001
From: Conrad Kramer <conrad@conradkramer.com>
Date: Wed, 10 Jun 2026 03:56:47 -0700
Subject: [PATCH] Run new CI gates through Nix

---
 .forgejo/workflows/ci-gates.yml                    | 14 ++++----------
 ...0123-instant-station-guide-and-player-warmup.md |  2 ++
 2 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/.forgejo/workflows/ci-gates.yml b/.forgejo/workflows/ci-gates.yml
index c6f3f6f..15aa7e6 100644
--- a/.forgejo/workflows/ci-gates.yml
+++ b/.forgejo/workflows/ci-gates.yml
@@ -79,22 +79,16 @@ jobs:
         run: |
           set -euo pipefail
           cd .repo
-          if [[ -f "$HOME/.cargo/env" ]]; then
-            . "$HOME/.cargo/env"
-          fi
-          cargo test -p ec-node publisher_proof
-          cargo test -p ec-node archive_convergence
+          nix develop --accept-flake-config -c cargo test -p ec-node publisher_proof
+          nix develop --accept-flake-config -c cargo test -p ec-node archive_convergence
 
       - name: Distributed simulation gates
         shell: bash
         run: |
           set -euo pipefail
           cd .repo
-          if [[ -f "$HOME/.cargo/env" ]]; then
-            . "$HOME/.cargo/env"
-          fi
-          cargo test -p ec-node sim_system_
-          cargo run -p ec-node -- sim-system \
+          nix develop --accept-flake-config -c cargo test -p ec-node sim_system_
+          nix develop --accept-flake-config -c cargo run -p ec-node -- sim-system \
             --fault-profile foundationdb \
             --seed 1 \
             --iterations 1024 \
diff --git a/evolution/proposals/ECP-0123-instant-station-guide-and-player-warmup.md b/evolution/proposals/ECP-0123-instant-station-guide-and-player-warmup.md
index a808839..29c7f32 100644
--- a/evolution/proposals/ECP-0123-instant-station-guide-and-player-warmup.md
+++ b/evolution/proposals/ECP-0123-instant-station-guide-and-player-warmup.md
@@ -61,3 +61,5 @@ The workflow ECP gate starts at ECP-0120 because older proposals predate the cur
 The lint script uses ripgrep when available and falls back to GNU grep on the Forgejo runner.
 Cloudflare deployment decrypts the API token through the repo's agenix workflow and builds web
 assets through `scripts/build-web.sh` so local and runner build paths stay aligned.
+All Rust gates in Forgejo, including duplicate-publisher proof and simulation checks, enter through
+the same Nix dev shell so later CI additions do not silently depend on rustup state.