nanofil/nix/bash.nix
GNU bash 5.3 (patch level 9, as nixpkgs pins it) built entirely by nanofil, with nixpkgs' patches and filnix's bash port patch (the unwind_prot buffer that saves jmp_bufs, aligned for their capabilities) and the port's configure flags (--without-bash-malloc). Readline, history, glob, tilde, termcap and the builtins are bash's bundled copies, so they are nanofil's too.
configure runs with filcc; make then runs with CC=nanofil-cc, and every object must come from nanofil (the build-time generators are compiled straight to executables and leave no objects). A deterministic workload (workloads/bash.sh) must print byte for byte what a filcc-built bash prints, plainly and under FUGC_SCRIBBLE and FUGC_VERIFY, and each of bash's own tests/run-* scripts (workloads/bash-tests.sh) must pass or differ as it does with filcc's bash in the same sandbox (some need a terminal or locales it lacks), with nanofil's middle end off and with -O, each in its own derivation (configurations.nix).