💡 Codex Review

https://github.com/willyrgf/nixfied/blob/edfe201aac13d14e0ec7f45451e8a0171a3a8325//tmp/nixfied-review/runtime/crates/nixfied-model/src/validation.rs#L257-L260
Allow task-only models through runtime validation

When a downstream module declares only bounded tasks and no services, the Nix compiler explicitly accepts it (nix/compiler/validate.nix allows services == {} as long as tasks exist), but load_model calls Model::validate() before admission/lowering and this branch rejects the emitted model as MODEL_INVALID. That makes the documented/supported task-only selection unusable through nixfied-runtime check/run; the structural validator should align with the compiler and only require runnable content rather than a non-empty service map.

https://github.com/willyrgf/nixfied/blob/edfe201aac13d14e0ec7f45451e8a0171a3a8325//tmp/nixfied-review/nix/modules/primitives.nix#L162-L164
Constrain endpoint host to loopback IP literals

This user-facing Nix option accepts any non-empty string, but the runtime wire type is LoopbackHost, whose deserializer rejects non-IP literals such as localhost and non-loopbacks such as 0.0.0.0. A project can therefore successfully build a model.json that the runtime/CLI cannot even parse; validate or type this option on the Nix side so invalid endpoint hosts fail during model evaluation instead of at runtime admission.

https://github.com/willyrgf/nixfied/blob/edfe201aac13d14e0ec7f45451e8a0171a3a8325//tmp/nixfied-review/nix/install/install.nix#L115-L117
Include the starter test workflow in the installer

For projects scaffolded via the flake #install app, the generated nixfied.nix imports the synthetic adapter but never declares the test workflow that projectApps.test and projectApps.ci unconditionally run (--workflow test). The README and the Rust CLI installer both promise this starter workflow, so a fresh install followed by nix run .#test/.#ci fails with a missing workflow until the user manually adds one.

https://github.com/willyrgf/nixfied/blob/edfe201aac13d14e0ec7f45451e8a0171a3a8325//tmp/nixfied-review/runtime/crates/nixfied-runtime/src/service/readiness.rs#L20-L21
Build TCP probe addresses from parsed IPs

When a model uses an IPv6 loopback endpoint such as ::1 (accepted by LoopbackHost), this string concatenation produces ::1:23080, which is not a valid SocketAddr, so every TCP readiness probe fails at admission/address parsing before it can connect. Construct the address from the parsed IpAddr and port (or bracket IPv6 literals) so all loopback hosts admitted by the model type are runnable.

https://github.com/willyrgf/nixfied/blob/edfe201aac13d14e0ec7f45451e8a0171a3a8325//tmp/nixfied-review/nix/modules/source.nix#L20-L23
Reject unsupported dirtyPolicy at evaluation time

Selecting nixfied.codebases.main.dirtyPolicy = "reject" currently evaluates and emits a model because this enum advertises it as supported, but admission unconditionally rejects that value with SOURCE_MISMATCH because the runtime cannot prove live-workspace cleanliness. This creates another buildable model that can never pass nixfied-runtime check/run; either remove/reject the option in Nix until it is implemented, or implement the cleanliness proof.

https://github.com/willyrgf/nixfied/blob/edfe201aac13d14e0ec7f45451e8a0171a3a8325//tmp/nixfied-review/runtime/crates/nixfied-runtime/src/service/process.rs#L893-L894
Reconcile stale registry refs before cleaning

If a run crashes or an owned process dies, the registry can still contain open process/port/lease rows until reconciliation marks them stale; clean_marked_state refuses those active refs, but the clean path calls it directly here without the reconciliation that ps/down perform (and that clean_reconciled_state exists for). After stale evidence is left behind, nixfied-runtime clean can keep refusing cleanup even though no owner is live, unless the user first knows to run another control command.

https://github.com/willyrgf/nixfied/blob/edfe201aac13d14e0ec7f45451e8a0171a3a8325//tmp/nixfied-review/runtime/crates/nixfied-runtime/src/service/task.rs#L124-L126
Reject path separators in filesystem-backed IDs

Workflow node ids come from unconstrained model/Nix attr keys, but this path uses the raw id as part of a filename. A node id containing / (valid as a quoted Nix attr) makes the task fail before it runs because the parent directory is absent, and ids containing traversal segments can target paths outside the intended logs directory if those directories exist; validate/sanitize filesystem-backed service/task/workflow/node ids before using them in paths.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0e81de43e7