Merge branch 'main' into fix/security-scan-dead-repo-name

Author: hyperpolymath

.github/workflows/secret-scanner.yml

@@ -24,5 +24,5 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586
     secrets: inherit

flake.nix

@@ -0,0 +1,34 @@
+# SPDX-License-Identifier: MPL-2.0
+# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell
+#
+# Development environment for verisimdb.
+#
+# Estate policy is Guix primary / Nix fallback (hyperpolymath/standards).
+# This is the Nix fallback tier. It is a dev shell, not a package build:
+# it declares the toolchain needed to work on this repo, pinned to an
+# exact nixpkgs revision per the estate SHA-pinning rule.
+#
+# Packages mirror the build tooling actually present in this repo
+# (just rust) — not a generic estate default.
+#
+#   nix develop      # enter the shell
+#   nix flake check  # verify this file evaluates (run before committing)
+{
+  description = "verisimdb development environment";
+
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/b134951a4c9f3c995fd7be05f3243f8ecd65d798";
+
+  outputs = { self, nixpkgs }:
+    let
+      systems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
+      forAllSystems = f:
+        nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
+    in
+    {
+      devShells = forAllSystems (pkgs: {
+        default = pkgs.mkShell {
+          packages = with pkgs; [ just cargo rustc rustfmt clippy ];
+        };
+      });
+    };
+}