+1 for Home Manager, as someone who uses Nix extensively (NixOS for server, Nix devshells, Home Manager on my dev machine) it's by far the most versatile tool the Nix ecosystem has to offer!

What do you do if they hand you a Windows machine? Demand WSL? What if they don't give it to you?

Agreed. Vanta does not support Linux.

yeah i was a little confused by the suggestion. If a client hands you a laptop to use for a project then there's corp. policy reasons why you have to use it as a contractor. (some companies have serious teeth in these policies)

It would be interesting to be a fly on the wall and listen in when infosec calls you and asks why your laptop disappeared from their monitoring tools and you told them you installed nixos (assuming that would even be possible) because that's what you prefer.

Exactly. They don’t want you to just use their hardware. They want you to use all of it.

Purity here is a difficult ask without the whole "erase your darlings" impermanence. In general, there is something regardless which handles stateful interactions.

Often this is activation scripts, e.g. home-manager will complain at you if you are attempting to overwrite an existing file not managed with home-manager unless you tell it to forcibly overwrite the file.

You can get yourself into situations where even in NixOS land, switch-to-configuration will refuse to switch due to some kind of violation, e.g. a systemd mount service wholly failing. I've had an experience like that recently.

The Nix store is not a perfect get out of jail free card for this, everything impure must be wrangled by something eventually.

What I'm really trying to say is, the world is messy and full of impurity, it's unavoidable. The thing that manages Brew, casks and app store applications for you within nix-darwin is no different than home-manager managing home.files or switch-to-configuration acting upon systemd.