feat: gate updates behind vet supply-chain checksHEADmain

update now holds inputs and skills back by a cooldown, has Claude review
third-party diffs, and reports CVE changes before switching. Homebrew taps
are pinned through nix-homebrew, and npm/pnpm get install policies.

1 files changed, 5 insertions, 1 deletions

diff --git a/README.md b/README.md
index dbca951..b8f3adc 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@ My Development Setup, managed with [Nix](https://nixos.org), [nix-darwin](https:
 ## Quickstart
 
 Setting up a new machine? Follow [INSTALL.md](INSTALL.md) — it covers the
-prerequisites (Homebrew, App Store, 1Password SSH agent) that the commands below
+prerequisites (Nix, App Store, 1Password SSH agent) that the commands below
 assume are already in place.
 
 ### 1. Install Determinate Nix
@@ -63,6 +63,7 @@ home-manager switch --flake .#simenandre@aarch64-linux
 
 ```
 flake.nix               # Entry point – inputs & all configurations
+vet.json                # Cooldown and own/trusted sources for vet
 INSTALL.md              # Full setup guide for a new machine
 hosts/
   nixbox/
@@ -77,6 +78,7 @@ modules/
     claude.nix           # Claude Code instructions and skills
     git.nix              # Git configuration (platform-aware SSH signing path)
     zsh.nix              # Zsh configuration (zshenv, zshrc, aliases, path, completions)
+    supply-chain.nix     # npm/pnpm install policy, osv-scanner
     starship.nix         # Starship prompt
     tmux.nix             # Tmux configuration
     lazygit.nix          # Lazygit configuration
@@ -84,6 +86,8 @@ modules/
     ghostty.nix          # Ghostty terminal configuration
   nixos/
     default.nix          # NixOS system configuration
+pkgs/
+  vet/                   # Cooldown and Claude review gate for `update`
 scripts/
   cleanup.sh             # macOS cleanup utility
 ```