Unify workspace authoring, verification and scaffolding workflows

nix/checked-package.nix

@@ -0,0 +1,17 @@
+# One derivation path for provisional checking and activation. The source and
+# schema come from exact committed inputs resolved by the Quixos compiler.
+{ source, schema, generator, packageRevisionId, system ? builtins.currentSystem }:
+let
+  packageSource = builtins.path {
+    path = /. + source;
+    name = "quixos-package-source";
+    filter = path: _: let name = baseNameOf path; in name != ".git" && name != ".jj";
+  };
+  package = builtins.getFlake ("path:" + builtins.unsafeDiscardStringContext (toString packageSource));
+  checked = package.quixosPackages.${system}.checkedServer or
+    (throw "Package ${packageRevisionId} lacks checkedServer; use the supported package scaffold.");
+in checked {
+  inherit packageRevisionId;
+  schema = builtins.path { path = /. + schema; name = "candidate-package-bindings.json"; };
+  generator = builtins.storePath generator;
+}