my thought was, main Emacs goes "I want this straight recipe (package! blabla :pin "whatever")" and system()s a nix-build --argstr recipe "…", then there's another little Emacs spawned inside the Nix sandbox which is a FOD and has network access, so it goes on fetching that package and then brings the output back through Nix to the main Emacs