feat(starry): add nix test (no sandbox currently) and kernel regression suite

apps/starry/nix/README.md

@@ -0,0 +1,112 @@
+# Starry Nix App
+
+This case runs a minimal Nix smoke test inside StarryOS through the app runner.
+A prebuilt Nix is injected into the Alpine rootfs; the guest evaluates a Nix
+expression and verifies a store-path write, covering the
+install→startup→evaluate→artifact chain.
+
+```bash
+cargo xtask starry app qemu -t nix --arch x86_64
+cargo xtask starry app qemu -t nix --arch aarch64
+```
+
+## No-Sandbox Only
+
+Sandboxed `nix-build` is not yet enabled. Nix requires mount namespace
+isolation to activate the build sandbox, and StarryOS mount namespace support is
+still incomplete. Without working `unshare(CLONE_NEWNS)`, Nix prints:
+
+> auto-disabling sandboxing because the prerequisite namespaces are not
+> available
+
+and silently falls back to unsandboxed mode. Running the sandbox variant as-is
+would produce a **false PASS** — the build succeeds, but the claimed
+sandboxed-build behaviour was never exercised.
+
+Per the [discussion](https://github.com/rcore-os/tgoskits/pull/1125#issuecomment-4639168301)
+on PR #1125: the teacher advised small-step iteration and submitting
+no-sandbox first. The current version uses `builtins.toFile` for store-path
+creation, which verifies Nix evaluation and store writes without depending on
+the builder communication protocol (socketpair).  Full `builtins.derivation`
+builder workflow is deferred until the builder protocol (Nix socketpair hook)
+is working on StarryOS — currently blocked by a poll notification gap in the
+IRQ-safe deferred notification layer.
+
+For now `test_nix.sh` intentionally skips the sandbox test and only runs
+`nix-nosandbox`, which passes `--option sandbox false` explicitly so the result
+honestly reflects the exercised code path. The sandbox test (`nix.sh`) will be
+connected once mount namespace isolation is available in StarryOS.
+
+## Test Content
+
+| Script | Mode | Runs? |
+|--------|------|-------|
+| `nix-nosandbox` | `builtins.toFile` store-path write (no builder) | ✅ CI |
+| `nix` | `nix-build --option sandbox true` (full derivation builder) | ❌ blocked (mount ns + socketpair) |
+
+`test_nix.sh` runs only the `nix-nosandbox` phase. The sandbox test (`nix.sh`)
+is blocked until mount namespace isolation is ready.
+
+nixpkgs / `stdenv.mkDerivation` testing is tracked on a separate branch and is
+intentionally not part of this smoke test; it requires mount namespace
+isolation and a working `builtins.fetchTarball` download path that StarryOS
+does not yet provide.
+
+## Kernel Regression Tests
+
+Kernel-level semantics (pipe poll, pidfd, rsext4 open-unlink, mount namespace
+isolation, etc.) are covered separately by the **qemu-smp1/system** grouped suite:
+
+```bash
+cargo xtask starry test qemu --arch x86_64 -c qemu-smp1/system
+cargo xtask starry test qemu --arch aarch64 -c qemu-smp1/system
+```
+
+These C-language regression tests were migrated from the former
+`test-nix-prereqs` case and now live alongside other kernel regression tests
+under the unified system grouped suite.
+See `test-suit/starryos/qemu-smp1/system/`.
+
+## File Structure
+
+```
+apps/starry/nix/
+├── prebuild.sh          # apk add nix into staging rootfs
+├── nix.sh               # sandbox-enabled nix-build (blocked, not CI)
+├── nix-nosandbox.sh     # builtins.toFile store-path write (CI gate)
+├── test_nix.sh          # nosandbox only
+├── build-x86_64-unknown-none.toml
+├── build-aarch64-unknown-none-softfloat.toml
+├── qemu-x86_64.toml     # 1200s timeout, shell_init_cmd=test_nix.sh
+├── qemu-aarch64.toml
+└── README.md            # this file
+```
+
+## Dependencies
+
+- Nix 2.31.5 (prebuilt via `apk add nix` in `prebuild.sh`)
+- Alpine musl shared libraries (libc, libcrypto, libcurl, libgit2, libseccomp,
+  libsodium, libsqlite3, libssh2, etc.)
+- Guest network access during prebuild only (Nix is injected into rootfs; no
+  network required at QEMU runtime)
+
+## aarch64 Verification
+
+`prebuild.sh` selects the correct `qemu-*-static` binary by `STARRY_ARCH`.
+Both architectures have been verified end-to-end in the CI container:
+
+```bash
+# x86_64
+podman run --rm \
+  -v "$(pwd)":/workspace -w /workspace \
+  ghcr.io/rcore-os/tgoskits-container:latest \
+  cargo xtask starry app qemu -t nix --arch x86_64
+# → NIX_NOSANDBOX_COMPLETE
+
+# aarch64
+podman run --rm \
+  -v "$(pwd)":/workspace -w /workspace \
+  ghcr.io/rcore-os/tgoskits-container:latest \
+  cargo xtask starry app qemu -t nix --arch aarch64
+# → NIX_NOSANDBOX_COMPLETE
+```

apps/starry/nix/build-aarch64-unknown-none-softfloat.toml

@@ -0,0 +1,8 @@
+target = "aarch64-unknown-none-softfloat"
+env = { AX_IP = "10.0.2.15", AX_GW = "10.0.2.2" }
+log = "Warn"
+features = [
+    "ax-driver/virtio-blk",
+    "ax-driver/virtio-net",
+]
+plat_dyn = true

apps/starry/nix/build-x86_64-unknown-none.toml

@@ -0,0 +1,8 @@
+target = "x86_64-unknown-none"
+env = { AX_IP = "10.0.2.15", AX_GW = "10.0.2.2" }
+log = "Warn"
+features = [
+    "ax-driver/virtio-blk",
+    "ax-driver/virtio-net",
+]
+plat_dyn = true

apps/starry/nix/nix-nosandbox.sh

@@ -0,0 +1,64 @@
+#!/bin/sh
+set -eu
+
+# Create Nix subcommand symlinks (overlay doesn't support symlinks).
+for cmd in build channel collect-garbage copy-closure env hash \
+           instantiate prefetch-url shell store; do
+    ln -sf nix /usr/bin/nix-$cmd 2>/dev/null || true
+done
+
+fail() {
+    echo "NIX_NOSANDBOX_ERROR: $1"
+    echo 'NIX_NOSANDBOX_TEST_FAILED'
+    exit 1
+}
+
+echo 'NIX_NOSANDBOX_PHASE_ROOTFS_BEGIN'
+mkdir -p /nix /etc/nix /tmp/nix-nosandbox || fail 'failed to create Nix smoke directories'
+
+echo 'NIX_NOSANDBOX_PHASE_PREBUILT_NIX_BEGIN'
+command -v nix >/dev/null 2>&1 || fail 'prebuilt Nix is missing from case rootfs'
+echo 'NIX_NOSANDBOX_PHASE_PREBUILT_NIX_DONE'
+
+echo 'NIX_NOSANDBOX_PHASE_NIX_BEGIN'
+nix --version || fail 'nix --version failed'
+echo 'NIX_NOSANDBOX_PHASE_NIX_DONE'
+
+echo 'NIX_NOSANDBOX_PHASE_BUILD_BEGIN'
+
+# Use builtins.toFile for store path creation (no builder subprocess).
+# This verifies Nix expression evaluation + store write without depending on
+# the builder communication protocol (socketpair), which requires poll
+# notification semantics not yet complete on StarryOS.
+# See nix.sh (sandbox variant) for the full derivation workflow once
+# mount namespace isolation and builder protocol support are available.
+eval_output="/tmp/nix-nosandbox/eval_output"
+rm -f "$eval_output"
+set +e
+nix --extra-experimental-features nix-command eval --raw --expr \
+  'builtins.toFile "nix-nosandbox" "NIX_LOCAL_BUILD_NOSANDBOX_OK"' \
+  >"$eval_output" 2>/tmp/nix-nosandbox/eval.log
+eval_rc=$?
+set -e
+if [ "$eval_rc" -ne 0 ]; then
+    echo 'NIX_NOSANDBOX_DIAG_EVAL_LOG_BEGIN'
+    cat /tmp/nix-nosandbox/eval.log
+    echo 'NIX_NOSANDBOX_DIAG_EVAL_LOG_END'
+    echo "NIX_NOSANDBOX_EVAL_EXIT=$eval_rc"
+    fail 'tiny local nix eval failed'
+fi
+store_path=$(cat "$eval_output")
+store_path=$(echo "$store_path" | tr -d '\n\r')  # strip trailing newlines
+
+echo 'NIX_NOSANDBOX_DIAG_STORE_PATH_BEGIN'
+echo "$store_path"
+echo 'NIX_NOSANDBOX_DIAG_STORE_PATH_END'
+
+if [ ! -f "$store_path" ]; then
+    fail "store path does not exist: $store_path"
+fi
+
+cat "$store_path" || fail 'nix store output could not be read'
+grep -q 'NIX_LOCAL_BUILD_NOSANDBOX_OK' "$store_path" || fail 'nix store output marker missing'
+echo 'NIX_NOSANDBOX_PHASE_BUILD_DONE'
+echo 'NIX_NOSANDBOX_TEST_PASSED'