feat: gate updates behind vet supply-chain checksHEADmain

update now holds inputs and skills back by a cooldown, has Claude review
third-party diffs, and reports CVE changes before switching. Homebrew taps
are pinned through nix-homebrew, and npm/pnpm get install policies.

1 files changed, 33 insertions, 11 deletions

diff --git a/INSTALL.md b/INSTALL.md
index 1938748..83ec0e0 100644
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -34,15 +34,11 @@ Installing plain upstream Nix here leaves the daemon unmanaged.
 
 Open a new shell afterwards so `nix` is on `PATH`.
 
-### 3. Install Homebrew
+### 3. Homebrew
 
-nix-darwin declares Homebrew packages but does **not** install Homebrew itself.
-The first switch fails without it.
-
-```shell
-/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
-eval "$(/opt/homebrew/bin/brew shellenv)"
-```
+Nothing to do: nix-homebrew installs Homebrew during the first switch, and its
+taps are pinned in `flake.lock` like every other input. Brew installs from those
+pinned taps, not from its JSON API.
 
 ### 4. Clone the repository
 
@@ -230,15 +226,41 @@ Aliases defined in `modules/home/zsh.nix` (macOS):
 | Alias     | Does                                              |
 | --------- | ------------------------------------------------- |
 | `rebuild` | `darwin-rebuild switch` against this flake        |
-| `update`  | `nix flake update`, then rebuild                  |
+| `update`  | Vetted input update, build, diff, switch, commit  |
 | `nix-gc`  | Garbage-collect store paths older than 14 days    |
 
 `scripts/cleanup.sh` is a separate macOS cleanup utility (caches, logs, trash).
 
+### Updating
+
+`update` runs `vet` (`pkgs/vet`) before anything is switched:
+
+1. `vet lock` moves flake inputs and skills to the newest revisions at least
+   `cooldownDays` (`vet.json`) old. nixpkgs moves to a channel release, so it
+   stays in the binary cache. Own sources go to their newest revision, and
+   inputs pinned to a commit in `flake.nix` are left alone.
+2. `vet check` compares the locks with `HEAD`. Changes inside the cooldown are
+   blocked. Third-party sources (anything not listed as own or trusted in
+   `vet.json`) have their diff reviewed by Claude, which runs with no tools.
+   A `review` verdict asks before continuing; a `block` stops the update.
+3. The new system is built and compared with `nvd diff`, and `vet cves` lists
+   the CVEs it adds and fixes (vulnix against the NVD; the first run downloads
+   the whole NVD and takes a while). Add known false positives to `vulnix.toml`.
+4. After you confirm, it switches and commits both locks with the vet report.
+
+Set `VET_COOLDOWN_DAYS=0` to let an urgent fix through. Run `vet check` by hand
+after adding a new input or skill source to have it reviewed before committing.
+
+npm and pnpm get matching defaults in `modules/home/supply-chain.nix`: a
+seven-day minimum release age, no trust downgrades and no exotic transitive
+dependencies for pnpm, and no install scripts for npm. Scan a project's
+lockfiles for known vulnerabilities with `osv-scanner scan -r .`.
+
 ## Troubleshooting
 
-**`error: Homebrew is not installed`** — step 3 was skipped, or `brew` is not on
-`PATH` for the shell running the switch. Run `eval "$(/opt/homebrew/bin/brew shellenv)"`.
+**`An existing /opt/homebrew/Library/Taps is in the way`** — Homebrew was
+installed before nix-homebrew took over. Move the old taps aside and switch
+again: `sudo mv /opt/homebrew/Library/Taps /opt/homebrew/Library/Taps.old`.
 
 **Mac App Store apps fail to install** — sign in to the App Store, then re-run
 the switch. `mas` cannot authenticate on its own.