{
  self,
  nixpkgs,
  pkgs,
  system,
}:
let
  inherit (nixpkgs) lib;
  evaluate =
    modules:
    (lib.nixosSystem {
      inherit system;
      modules = modules ++ [
        {
          system.stateVersion = "26.05";
          boot.loader.grub.enable = false;
          fileSystems."/" = {
            device = "/dev/root";
            fsType = "ext4";
          };
        }
      ];
    }).config;
  valid = cfg: lib.all (item: item.assertion) cfg.assertions;
  appviewConfig.services.provenance.appview = {
    enable = true;
    serviceKeyFile = "/run/secrets/provenance/service-key";
    listenAddress = "[::1]:9091";
    stateDirectory = "test-appview";
    databaseFile = "graph.sqlite";
    jetstreamURL = "wss://stream.example.com/subscribe";
    jetstreamAfterSequence = 100;
    jetstreamBeforeSequence = 1000;
    slingshotURL = "https://records.example.com";
    hopPenalty = 0.25;
    trustCacheTTL = "48h";
    externalWorkers = 2;
    logLevel = "debug";
    enableSoftVouch = true;
    softVouchLists = true;
    softVouchAllAuthors = true;
  };
  uiConfig.services.provenance.ui = {
    enable = true;
    serviceKeyFile = "/run/secrets/provenance/service-key";
    encryptionKeyFile = "/run/secrets/provenance/encryption-key";
    listenAddress = "[::1]:9090";
    stateDirectory = "test-ui";
    databaseFile = "sessions.sqlite";
    publicOrigin = "https://provenance.example.com";
    appviewURL = "https://appview.example.com";
    externalWorkers = 3;
  };
  disabled = evaluate [ self.nixosModules.default ];
  appview = evaluate [
    self.nixosModules.appview
    appviewConfig
  ];
  ui = evaluate [
    self.nixosModules.ui
    uiConfig
  ];
  combined = evaluate [
    self.nixosModules.default
    appviewConfig
    uiConfig
  ];
  missingSecrets = evaluate [
    self.nixosModules.default
    {
      services.provenance.appview.enable = true;
      services.provenance.ui.enable = true;
    }
  ];
  storeSecret = evaluate [
    self.nixosModules.appview
    {
      services.provenance.appview = {
        enable = true;
        serviceKeyFile = "/nix/store/not-a-runtime-secret";
      };
    }
  ];
  sharedState = evaluate [
    self.nixosModules.default
    appviewConfig
    uiConfig
    {
      services.provenance.ui.stateDirectory = lib.mkForce "test-appview";
    }
  ];
  appUnit = appview.systemd.services.provenance-appview;
  custom = evaluate [
    self.nixosModules.default
    appviewConfig
    uiConfig
    {
      services.provenance.appview = {
        dataDirectory = "/srv/provenance/graph";
        jetstreamReplay = true;
        jetstreamAPIKeyFile = "/run/agenix/jetstream";
        traceEndpoint = "http://127.0.0.1:10428/insert/opentelemetry/v1/traces";
      };
      services.provenance.ui.dataDirectory = "/srv/provenance/ui";
    }
  ];
  uiUnit = ui.systemd.services.provenance-ui;
  fixture = pkgs.runCommand "provenance-package-fixture" { } "mkdir -p $out/bin";
  override = evaluate [
    self.nixosModules.ui
    uiConfig
    {
      services.provenance.ui.package = fixture;
    }
  ];
  invalidPenalty =
    builtins.tryEval
      (evaluate [
        self.nixosModules.appview
        {
          services.provenance.appview.hopPenalty = -0.1;
        }
      ]).services.provenance.appview.hopPenalty;
in
assert valid custom;
assert
  custom.systemd.services.provenance-appview.environment.PROVENANCE_TRACE_ENDPOINT
  == "http://127.0.0.1:10428/insert/opentelemetry/v1/traces";
assert !(appUnit.environment ? PROVENANCE_TRACE_ENDPOINT);
assert
  custom.systemd.services.provenance-appview.environment.PROVENANCE_APPVIEW_DB
  == "/srv/provenance/graph/graph.sqlite";
assert
  custom.systemd.services.provenance-ui.environment.PROVENANCE_UI_DB
  == "/srv/provenance/ui/sessions.sqlite";
assert !custom.systemd.services.provenance-appview.serviceConfig.DynamicUser;
assert custom.systemd.services.provenance-appview.serviceConfig.User == "provenance-appview";
assert lib.elem "JETSTREAM_API_KEY_FILE:/run/agenix/jetstream"
  custom.systemd.services.provenance-appview.serviceConfig.LoadCredential;
assert lib.hasInfix
  ''export JETSTREAM_API_KEY_FILE="$CREDENTIALS_DIRECTORY/JETSTREAM_API_KEY_FILE"''
  custom.systemd.services.provenance-appview.script;
assert !(disabled.systemd.services ? provenance-appview);
assert !(disabled.systemd.services ? provenance-ui);
assert valid appview && valid ui && valid combined;
assert !(appview.systemd.services ? provenance-ui);
assert !(ui.systemd.services ? provenance-appview);
assert !(valid missingSecrets) && !(valid storeSecret);
assert !(valid sharedState);
assert !invalidPenalty.success;
assert appUnit.environment.PROVENANCE_APPVIEW_ADDR == "[::1]:9091";
assert appUnit.environment.PROVENANCE_APPVIEW_DB == "/var/lib/test-appview/graph.sqlite";
assert appUnit.environment.PROVENANCE_JETSTREAM_URL == "wss://stream.example.com/subscribe";
assert appUnit.environment.PROVENANCE_JETSTREAM_AFTER_SEQ == "100";
assert appUnit.environment.PROVENANCE_JETSTREAM_BEFORE_SEQ == "1000";
assert appUnit.environment.PROVENANCE_SLINGSHOT_URL == "https://records.example.com";
assert appUnit.environment.PROVENANCE_HOP_PENALTY == toString 0.25;
assert appUnit.environment.PROVENANCE_TRUST_CACHE_TTL == "48h";
assert appUnit.environment.PROVENANCE_EXTERNAL_WORKERS == "2";
assert appUnit.environment.PROVENANCE_LOG_LEVEL == "debug";
assert uiUnit.environment.PROVENANCE_LOG_LEVEL == "info";
assert uiUnit.environment.PROVENANCE_EXTERNAL_WORKERS == "3";
assert appUnit.environment.ENABLE_SOFT_VOUCH == "true";
assert appUnit.environment.ENABLE_SOFT_VOUCH_LISTS == "true";
assert appUnit.environment.ENABLE_SOFT_VOUCH_ALL_AUTHORS == "true";
assert !(appUnit.environment ? PROVENANCE_SERVICE_KEY);
assert !(uiUnit.environment ? PROVENANCE_ENCRYPTION_KEY);
assert
  appUnit.serviceConfig.LoadCredential
  == [ "PROVENANCE_SERVICE_KEY:/run/secrets/provenance/service-key" ];
assert builtins.length uiUnit.serviceConfig.LoadCredential == 2;
assert appUnit.serviceConfig.DynamicUser && uiUnit.serviceConfig.DynamicUser;
assert appUnit.serviceConfig.ProtectSystem == "strict";
assert uiUnit.environment.PROVENANCE_PUBLIC_ORIGIN == "https://provenance.example.com";
assert uiUnit.environment.PROVENANCE_UI_ADDR == "[::1]:9090";
assert uiUnit.environment.PROVENANCE_UI_DB == "/var/lib/test-ui/sessions.sqlite";
assert uiUnit.environment.PROVENANCE_APPVIEW_URL == "https://appview.example.com";
assert lib.elem "provenance-appview.service" combined.systemd.services.provenance-ui.after;
assert lib.hasInfix (builtins.unsafeDiscardStringContext (
  toString fixture
)) override.systemd.services.provenance-ui.script;
pkgs.runCommand "provenance-module-checks" { } ''
  mkdir -p "$out"
  echo "NixOS module checks passed." > "$out/result"
''