- Rust 95%
- Nix 5%
JMARyA
a94ad9ae34
The module installs a setuid bwrap wrapper via security.wrappers, which lands only in config.security.wrapperDir (/run/wrappers/bin). The unit's `path` pinned an explicit package list that did not include it, so the agent never resolved bwrap and fell back to running every step without sandbox isolation. systemd's `path` appends /bin to each entry, so pass the wrapper dir's parent via builtins.dirOf — passing wrapperDir directly would yield /run/wrappers/bin/bin, and hardcoding /run/wrappers would ignore a customised wrapperDir. Verified by evaluating config.systemd.services.moira-agent.environment.PATH: it now starts with /run/wrappers/bin, and follows a customised security.wrapperDir. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|---|---|---|
| .moira/envs | ||
| crates | ||
| docs | ||
| grafana | ||
| k8s | ||
| nix | ||
| .gitignore | ||
| AGENTS.md | ||
| Cargo.lock | ||
| Cargo.toml | ||
| CLAUDE.md | ||
| devenv.lock | ||
| devenv.nix | ||
| flake.lock | ||
| flake.nix | ||
| README.md | ||
| zensical.toml | ||
Moira
Alpha software. Moira is under active development — interfaces, config schemas, and APIs may change without notice between commits. Run it, break it, report what you find, but don't depend on stability yet.
moira is a unified automation fabric for infrastructure engineers who believe the git repository is the only legitimate source of truth. It merges the concerns of CI pipelines, scheduled automation, workflow orchestration, and IaC execution into a single declarative system — hermetically sealed by Nix, driven by Rust, and accountable to nothing but your repo.
The mythology
Hydra builds moira.
In Hesiod's Theogony, the three Moirai — the Fates — are daughters of Nyx, the primordial goddess of night. They weave the thread of every mortal life: Clotho spins it into being, Lachesis measures its length, Atropos cuts it with inexorable finality.
Your infrastructure has the same shape. Intent is declared. Work is measured and scheduled. Execution is final, hermetic, irreversible. And it all runs on Nix — named, knowingly or not, for the same primordial darkness the Fates were born from.
Hydra — the many-headed — spawns Moira. Moira, daughters of Nyx, runs on Nix.
The lore wrote itself.
Internal architecture: the three sisters
The moira runtime is divided internally along the mythological grain:
| Sister | Role |
|---|---|
| Clotho (CLI) | Git watcher and intent compiler — she reads your declared threads and spins them into executable task graphs |
| Lachesis (Server) | Scheduler and reconciler — she measures, allots work to agents, manages approval gate state, and ensures reality converges to declaration |
| Atropos (Agent) | Step executor — she cannot be turned aside; hermetic, deterministic, she runs the step and cuts the thread when done |
These are internal names. Users interact only with moira.
Documentation
Full docs live in docs/. To serve locally:
zensical serve
Standard library
moira-modules — curated environments, typed modules (HTTP, git, S3, SSH, …), and reference threads. Import as a flake input and use directly in your pipelines.