this derivation will be built:
  /nix/store/kqfswap3ifmkv8llpsngr9nrfmaflh2z-spaces-landlock-policy-test.drv
building '/nix/store/kqfswap3ifmkv8llpsngr9nrfmaflh2z-spaces-landlock-policy-test.drv'
spaces-landlock-policy-test> bun test v1.3.13 (bf2e2cec)
spaces-landlock-policy-test> 
spaces-landlock-policy-test> sandbox.test.ts:
spaces-landlock-policy-test> ✓ the landlockconfig policy is deny-by-default with fs/net/scope grants [3.00ms]
spaces-landlock-policy-test> ✓ the policy excludes the home and sibling integrations (leaf-scoped)
spaces-landlock-policy-test> ✓ multiple connect ports collapse into one connect_tcp rule
spaces-landlock-policy-test> ✓ no connect ports means no egress rule [1.00ms]
spaces-landlock-policy-test> ✓ bind ports emit a bind_tcp rule alongside connect egress
spaces-landlock-policy-test> ✓ multiple bind ports collapse into one bind_tcp rule
spaces-landlock-policy-test> ✓ no bind ports still handles bind_tcp so every bind is denied
spaces-landlock-policy-test> 
spaces-landlock-policy-test> landlock-policy-cli.test.ts:
spaces-landlock-policy-test> ✓ lowerIntegrationPolicy: writable surface is StateDirectory + private tmpfs
spaces-landlock-policy-test> ✓ lowerIntegrationPolicy: credentials mount is read-only, ports pass through [1.00ms]
spaces-landlock-policy-test> ✓ lowerIntegrationPolicy: a shared exchange dir joins the writable surface
spaces-landlock-policy-test> ✓ resolveFromEnv: colon-lists split, absent vars yield empty
spaces-landlock-policy-test> ✓ end-to-end: deny-by-default doc grants exactly StateDir(rw) + cred(ro) + 443
spaces-landlock-policy-test> ✓ lowerIntegrationPolicy: bindPorts fold through into a bind_tcp rule
spaces-landlock-policy-test> ✓ lowerIntegrationPolicy: absent bindPorts grants no bind but keeps it handled
spaces-landlock-policy-test> ✓ lowerIntegrationPolicy: extraPaths route ro→roDirs, rw→rwDirs [1.00ms]
spaces-landlock-policy-test> ✓ lowerIntegrationPolicy: extraPaths ro-file routes to roFiles, not roDirs
spaces-landlock-policy-test> ✓ lowerIntegrationPolicy: %t/%h in extraPaths expand from the unit env
spaces-landlock-policy-test> ✓ lowerIntegrationPolicy: an unresolvable specifier fails closed [1.00ms]
spaces-landlock-policy-test> ✓ resolveFromEnv: %t/%h sources come from XDG_RUNTIME_DIR/HOME
spaces-landlock-policy-test> 
spaces-landlock-policy-test>  19 pass
spaces-landlock-policy-test>  0 fail
spaces-landlock-policy-test>  55 expect() calls
spaces-landlock-policy-test> Ran 19 tests across 2 files. [79.00ms]

post-build step Upload to niks3: ok
time=2026-09-13T04:21:43.129Z level=INFO msg="Uploading 0 paths to 127.0.0.1 (1 already cached)"
time=2026-09-13T04:21:43.743Z level=INFO msg="Uploading 1 narinfos"
time=2026-09-13T04:21:44.357Z level=INFO msg="Upload complete. (1.253s)"