feat: make nix develop the default toolchain path

User ruling: agents must work inside nix develop (or direnv) for this repo.
Bare system cargo that fails edition2024 is a misconfigured session.

Changes:

1. scripts/agent-bootstrap.sh:
   - Added section 0: seed nix flake inputs automatically
   - Cargo warm now runs inside 'nix develop --command'
   - Added --skip-nix-seed flag for environments that don't need it
   - Updated environment notes to emphasize nix-first

2. .cursor/environment.json:
   - Removed --skip-cargo-warm (full nix-backed warm now default)

3. AGENTS.md:
   - Added 'Toolchain' row to multi-stack table (nix develop required)
   - Added 'Toolchain Requirement' subsection with usage examples
   - Updated local agents guidance to use 'direnv allow'

4. context/cloud-agents.md:
   - Bootstrap now lists nix-seed as step 1
   - 'What does not work' table updated: bare system cargo now listed as
     failing; nix develop works after bootstrap
   - Updated nix section to reflect automatic seeding

Previous soft gap: nix-seed was a manual footnote; now it runs in bootstrap.

Co-authored-by: Ed Langley <fiddlerwoaroof@users.noreply.github.com>

scripts/agent-bootstrap.sh

@@ -3,24 +3,30 @@
 #
 # This script prepares any coding agent (Claude Code, Cursor, etc.) to work
 # on this repo. It handles:
-#   1. bd (beads) installation and pin verification
-#   2. Issue tracker sync from the Dolt remote
-#   3. Optional cargo workspace warming
+#   1. Nix flake input seeding (so `nix develop` works in cloud environments)
+#   2. bd (beads) installation and pin verification
+#   3. Issue tracker sync from the Dolt remote
+#   4. Optional cargo workspace warming (inside nix develop)
 #
 # Usage:
-#   scripts/agent-bootstrap.sh [--skip-cargo-warm]
+#   scripts/agent-bootstrap.sh [--skip-cargo-warm] [--skip-nix-seed]
 #
 # The script is idempotent and safe to re-run. Nothing here writes to tracked
 # files, stages anything, or creates a commit.
 #
+# IMPORTANT: This repo requires `nix develop` (or direnv) for builds/tests.
+# Bare system cargo that fails edition2024 is a misconfigured session.
+#
 # See also: `.claude/hooks/session-start.sh` (Claude Code wrapper),
 #           `.cursor/environment.json` (Cursor cloud config)
 set -uo pipefail
 
 SKIP_CARGO_WARM=0
+SKIP_NIX_SEED=0
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --skip-cargo-warm) SKIP_CARGO_WARM=1; shift ;;
+    --skip-nix-seed) SKIP_NIX_SEED=1; shift ;;
     *) shift ;;
   esac
 done
@@ -30,7 +36,27 @@ cd "$ROOT" || exit 0
 
 log() { printf '[agent-bootstrap] %s\n' "$*"; }
 
-# ── 0. The bd on PATH must be the bd flake.nix pins ────────────────────────
+# ── 0. Seed nix flake inputs (required for cloud environments) ─────────────
+# GitHub tarball endpoints are blocked in cloud containers. This seeds the
+# flake inputs over git so `nix develop` can build the dev shell.
+if [ "$SKIP_NIX_SEED" -eq 0 ] && command -v nix >/dev/null 2>&1; then
+  # Set SSL cert for proxy environments
+  if [ -z "${NIX_SSL_CERT_FILE:-}" ] && [ -r /root/.ccr/ca-bundle.crt ]; then
+    export NIX_SSL_CERT_FILE=/root/.ccr/ca-bundle.crt
+  fi
+  
+  if [ -f "$ROOT/scripts/nix-seed-flake-inputs.sh" ]; then
+    log "seeding nix flake inputs (GitHub tarballs blocked in cloud)…"
+    if "$ROOT/scripts/nix-seed-flake-inputs.sh" >/tmp/nix-seed.log 2>&1; then
+      log "flake inputs seeded"
+    else
+      log "WARNING: nix-seed-flake-inputs.sh failed; see /tmp/nix-seed.log"
+      log "         'nix develop' may fail. Check network/proxy settings."
+    fi
+  fi
+fi
+
+# ── 1. The bd on PATH must be the bd flake.nix pins ────────────────────────
 beads_pin() {
   sed -n 's|.*beads\.url[[:space:]]*=[[:space:]]*"github:[^/]*/[^/]*/v\{0,1\}\([^"]*\)".*|\1|p' \
     flake.nix 2>/dev/null | head -1
@@ -123,7 +149,7 @@ install_tracker() {
   return 1
 }
 
-# ── 1. bd on PATH ──────────────────────────────────────────────────────────
+# ── 2. bd on PATH ──────────────────────────────────────────────────────────
 export PATH="$PATH:/root/go/bin:$HOME/go/bin"
 
 BD_INSTALLER_REF=f45b249ce6b40ba62aecc03949e6371e8f7c79d8  # tag v1.3.0
@@ -153,7 +179,7 @@ if [ "$pin_status" -eq 0 ]; then
   assert_bd_pin || pin_status=2
 fi
 
-# ── 2. Sync the issue tracker from the Dolt remote ─────────────────────────
+# ── 3. Sync the issue tracker from the Dolt remote ─────────────────────────
 if command -v bd >/dev/null 2>&1; then
   DB_NAME="$(jq -r '.dolt_database // "improvise"' .beads/metadata.json 2>/dev/null || echo improvise)"
   ORIGIN="$(git remote get-url origin 2>/dev/null || true)"
@@ -196,27 +222,34 @@ if command -v bd >/dev/null 2>&1; then
   fi
 fi
 
-# ── 3. Warm the build (optional) ───────────────────────────────────────────
-if [ "$SKIP_CARGO_WARM" -eq 0 ] && command -v cargo >/dev/null 2>&1; then
-  log "warming cargo build…"
-  if cargo build --workspace --tests >/tmp/cargo-warm.log 2>&1; then
-    log "workspace built"
+# ── 4. Warm the build inside nix develop (optional) ────────────────────────
+# Uses nix develop to ensure the correct toolchain (rust from flake, wasm target, etc.)
+if [ "$SKIP_CARGO_WARM" -eq 0 ] && command -v nix >/dev/null 2>&1; then
+  log "warming cargo build inside nix develop…"
+  NIX_FLAGS=(--extra-experimental-features 'nix-command flakes')
+  if nix "${NIX_FLAGS[@]}" develop --command cargo build --workspace --tests >/tmp/cargo-warm.log 2>&1; then
+    log "workspace built (nix develop toolchain)"
   else
     log "WARNING: cargo build failed; see /tmp/cargo-warm.log"
+    log "         This may indicate nix-seed failed or flake inputs are missing."
   fi
+elif [ "$SKIP_CARGO_WARM" -eq 0 ]; then
+  log "WARNING: nix not available; skipping cargo warm"
+  log "         Install nix or use a container with nix for this repo."
 fi
 
-# ── 4. Environment notes ───────────────────────────────────────────────────
+# ── 5. Environment notes ───────────────────────────────────────────────────
 cat <<'NOTES'
 [agent-bootstrap] Environment notes (see context/cloud-agents.md):
-  • Use the preinstalled cargo toolchain for ordinary work. `nix develop`
-    also works, but only after scripts/nix-seed-flake-inputs.sh — GitHub
-    tarballs are not served here, so the locked inputs are seeded over git.
+  • This repo REQUIRES `nix develop` (or direnv) for builds and tests.
+    Bare system cargo that fails edition2024 is a misconfigured session.
+  • The bootstrap seeded flake inputs over git (GitHub tarballs are blocked
+    in cloud). If nix develop still fails, check /tmp/nix-seed.log.
   • `bd dolt push` is blocked outbound (403). Bead status changes stay local.
   • Never run a bare `bd init` in this repo: it rewrites AGENTS.md, CLAUDE.md
     and .claude/settings.json, and commits. Use --skip-agents --skip-hooks.
-  • `bd dolt push <remote>` ignores its argument and pushes to origin.
   • Use `scripts/kb` for knowledge base operations, not Prolog MCP.
+  • Run commands inside `nix develop` or prefix with `nix develop --command`.
 NOTES
 
 exit "$pin_status"