5 files changed, 7 insertions, 6 deletions

diff --git a/flake.nix b/flake.nix
index 4efe54b..3ccea5e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -53,7 +53,7 @@
         };
       };
 
-      formatter = forAllSystems (system: nixpkgs.legacyPackages.${system}.nixfmt-rfc-style);
+      formatter = forAllSystems (system: nixpkgs.legacyPackages.${system}.nixfmt);
 
       devShells = forAllSystems (system:
         let
@@ -61,7 +61,7 @@
         in
         {
           default = pkgs.mkShell {
-            packages = [ pkgs.statix pkgs.deadnix pkgs.nixfmt-rfc-style ];
+            packages = [ pkgs.statix pkgs.deadnix pkgs.nixfmt ];
           };
         });
 
@@ -76,6 +76,7 @@
               name = "bootstrap-host";
               runtimeInputs = [ pkgs.coreutils pkgs.gnused ];
               text = builtins.readFile ./scripts/bootstrap-host.sh;
+              meta.description = "Scaffold a new NixOS host from hosts/template";
             }}/bin/bootstrap-host";
           };
         });
diff --git a/openspec/changes/add-developer-environment/tasks.md b/openspec/changes/add-developer-environment/tasks.md
index 5fcd5e2..35df83b 100644
--- a/openspec/changes/add-developer-environment/tasks.md
+++ b/openspec/changes/add-developer-environment/tasks.md
@@ -21,7 +21,7 @@
 
 ## 5. Validation
 
-- [ ] 5.1 Run `nix flake check` and confirm the updated `modules/home` and `modules/nixos/common.nix` evaluate without error, including resolving the `terraform` question from task 1.3 (blocked — Nix is not installed on this machine; run this once Nix is available, e.g. via a real install or CI — this is the real acceptance gate, not the individual checkboxes above)
+- [x] 5.1 Run `nix flake check` and confirm the updated `modules/home` and `modules/nixos/common.nix` evaluate without error, including resolving the `terraform` question from task 1.3 (blocked — Nix is not installed on this machine; run this once Nix is available, e.g. via a real install or CI — this is the real acceptance gate, not the individual checkboxes above) (run by the user on a Linux machine with Nix, 2026-09-18: passed with no errors, confirming `yq-go`, `awscli2`, `tree-sitter`, `docker`, `docker-compose`, `kubectl`, `gh`, `tmux`, `htop`, and `liquidprompt` all resolve correctly in nixpkgs)
 - [x] 5.2 Manually trace through each spec scenario in `specs/developer-environment/spec.md` against the implemented modules, confirming each is satisfied by inspection given #5.1 cannot run locally (all 4 scenarios traced and satisfied: `dev-tools.nix` flows through the same shared `modules/home` path consumed by both `mkNixos` and `mkHome`; grep confirms no `virtualisation`/daemon config was added anywhere; `shell.nix` is package-only for liquidprompt with no competing managed config; `services.openssh` + `networking.firewall` in `common.nix` match the SSH scenario exactly)
 
 ---
diff --git a/openspec/changes/add-dotfiles-stow-bootstrap/tasks.md b/openspec/changes/add-dotfiles-stow-bootstrap/tasks.md
index 228a5fa..5f00a3b 100644
--- a/openspec/changes/add-dotfiles-stow-bootstrap/tasks.md
+++ b/openspec/changes/add-dotfiles-stow-bootstrap/tasks.md
@@ -31,7 +31,7 @@
 
 ## 7. Validation
 
-- [ ] 7.1 Run `nix flake check` and confirm the new module and `tom@darwin` output evaluate without error (blocked — Nix is not installed on this machine; run this once Nix is available, e.g. via a real install or CI — this is the real acceptance gate, not the individual checkboxes above)
+- [x] 7.1 Run `nix flake check` and confirm the new module and `tom@darwin` output evaluate without error (blocked — Nix is not installed on this machine; run this once Nix is available, e.g. via a real install or CI — this is the real acceptance gate, not the individual checkboxes above) (run by the user on a Linux machine with Nix, 2026-09-18: passed with no errors)
 - [x] 7.2 Manually trace through each spec scenario in `specs/dotfiles-management/spec.md` against the implemented module, confirming each is satisfied by inspection given #7.1 cannot run locally (all 7 scenarios traced and satisfied: `mkIf` gates the opt-in behavior; the `.git`-existence guard means an existing checkout is never touched and the clone branch uses `--recurse-submodules`; the directory-only glob plus `case .*) continue` excludes both non-directory entries and hidden directories from being treated as packages; each `stow` call's `|| echo "Warning..."` keeps one conflict from aborting the loop under `set -e`)
 
 ---
diff --git a/openspec/changes/add-host-bootstrap-script/tasks.md b/openspec/changes/add-host-bootstrap-script/tasks.md
index 1671a96..d290c2b 100644
--- a/openspec/changes/add-host-bootstrap-script/tasks.md
+++ b/openspec/changes/add-host-bootstrap-script/tasks.md
@@ -25,7 +25,7 @@
 
 ## 5. Validation
 
-- [ ] 5.1 Run `nix flake check` and confirm the auto-discovery logic and new `apps` output evaluate without error (blocked — Nix is not installed on this machine; run this once Nix is available, e.g. via a real install or CI — this is the real acceptance gate, not the individual checkboxes above)
+- [x] 5.1 Run `nix flake check` and confirm the auto-discovery logic and new `apps` output evaluate without error (blocked — Nix is not installed on this machine; run this once Nix is available, e.g. via a real install or CI — this is the real acceptance gate, not the individual checkboxes above) (run by the user on a Linux machine with Nix, 2026-09-18: passed with no errors, only a benign `apps.aarch64-linux.bootstrap-host lacks attribute 'meta'` warning, since fixed by adding `meta.description` to the `writeShellApplication` in `flake.nix`)
 - [x] 5.2 Manually trace through each spec scenario in `specs/nix-flake-bootstrap/spec.md` against the implemented script and flake logic, confirming each is satisfied by inspection given #5.1 cannot run locally (all 8 scenarios traced and satisfied: discovery + template exclusion in `flake.nix`; scaffold, overwrite-refusal, no-root, missing-hardware-config failure modes all exit before any mutation in `scripts/bootstrap-host.sh`; live-installer scenario and install-target-matching confirmed via grep and directory-name-to-attribute-name correspondence)
 
 ---
diff --git a/openspec/changes/add-nix-flake-bootstrap/tasks.md b/openspec/changes/add-nix-flake-bootstrap/tasks.md
index 2bf14dc..47d476f 100644
--- a/openspec/changes/add-nix-flake-bootstrap/tasks.md
+++ b/openspec/changes/add-nix-flake-bootstrap/tasks.md
@@ -42,7 +42,7 @@
 
 ## 9. Validation
 
-- [ ] 9.1 Run `nix flake check` and confirm it passes without `--impure`, covering `lib`, `homeConfigurations."tom@linux"`, `formatter`, and `devShells` (**blocked — nix not installed locally; no fallback verification possible. Run this once Nix is available.**)
+- [x] 9.1 Run `nix flake check` and confirm it passes without `--impure`, covering `lib`, `homeConfigurations."tom@linux"`, `formatter`, and `devShells` (**blocked — nix not installed locally; no fallback verification possible. Run this once Nix is available.**) (run by the user on a Linux machine with Nix, 2026-09-18: `nix flake check` passed with no errors — only benign warnings, `nixfmt-rfc-style`/missing `apps.*.meta` since fixed in a later change, and the expected "omitted incompatible systems" notice since the run was on a single system without `--all-systems`)
 - [x] 9.2 Manually review `flake.nix` and confirm `nixosConfigurations` is empty (or absent) in this change, per the design decision not to expose the unbuilt template (confirmed: `nixosConfigurations = { };`)
 
 ## 10. Documentation