Build the full system/HM closure without activating it. Returns the output store path; a failed build carries failed_derivation{drv, log_tail}.

Build the new closure and diff it against the running system (nvd, falling back to nix store diff-closures): package additions, removals, version changes. Include the changeset in the reply and switch unless the user asked only to preview or check.

Activate the configuration (sudo -n nixos-rebuild switch / home-manager switch). Records rollback_generation first. Returns a structured 'summary' (units changed, derivations built, package delta, systemd health) plus gen before/after; on success the raw log is trimmed to a tail (pass full_log=True for all of it). Status is 'degraded' when activation succeeded but units newly failed. No implicit validation by default; pass validate=True to gate on check('dry-build') first. On a sudo auth failure returns a 'privilege' diagnosis.

action='list': enumerate system/HM generations with dates and current marker. NixOS entries include path when the profile link exists. action='rollback': revert to the previous generation, or pass generation= to activate that generation. Bare rollback is previous-only. Pass mode='home-manager' for HM generations.

Evaluate the final merged value of an attribute in the user's actual NixOS/Home Manager configuration via nix eval (e.g. attr='services.openssh.enable'). flake_uri and mode auto-resolve when omitted. Pass a list of attrs to batch several evals into one call, returning per-attr results. Values above the size guard degrade to attr names / length / a head slice (truncated: true).

Where does this configuration set an option: files declaring it and every file defining it, with each contributed value (e.g. attr='services.openssh.enable'). The bridge from mcp-nixos discovery to editing the right file. For integrated Home Manager, query the NixOS config with attr='home-manager.users..'.

Validation ladder for the configuration, fast to slow: level='lint' (statix+deadnix; returns a structured findings list), 'dry-build' (evaluate and plan the closure build), 'dry-activate' (NixOS only, shows what activation would change).