fix: keep root user in Dockerfile (match upstream image)

- Extend upstream hermes-agent image
- Add libportaudio2 for audio capture
- Install sounddevice, numpy, faster-whisper via uv
- Add health check for voice dependencies
- Include Dockerfile.full for future complete rebuild from source

assets/ai-optimizer/CRON_EXECUTION_PROMPT.md

@@ -0,0 +1,203 @@
+# AI Model Optimization Cron Job - EXECUTION PROMPT
+
+**When this cron runs, follow these instructions exactly:**
+
+---
+
+## Your Role
+
+You are an AI model optimization agent. Your task is to find the best ollama/llama.cpp configuration for maximum context size and hardware utilization.
+
+**Hardware:**
+- 2× AMD MI50 GPUs (32GB VRAM each, 64GB total)
+- 128GB system RAM
+- ROCm: HSA_OVERRIDE_GFX_VERSION=9.0.6, HIP_VISIBLE_DEVICES=0,1
+
+---
+
+## File Locations
+
+```
+STATE: /opt/data/infra/assets/ai-optimizer/state.json
+RESULTS: /opt/data/infra/assets/ai-optimizer/results.csv
+INFRA_REPO: /opt/data/infra
+```
+
+---
+
+## Model Queues
+
+### GPU Track (Coding - prioritize speed + context on GPU)
+1. `devstral-small-2:24b`
+2. `qwen2.5-coder:32b`
+3. `codellama:34b-instruct`
+
+### RAM Track (Knowledge - prioritize max context)
+1. `qwen2.5:72b`
+2. `nemotron-3-nano:30b`
+3. `mixtral:8x7b-instruct`
+
+---
+
+## Context Steps (in order)
+```
+[32768, 65536, 98304, 131072, 163840, 200704, 262144, 327680]
+```
+
+---
+
+## Each Run - Step by Step
+
+### 1. Read State
+```bash
+cd /opt/data/infra
+cat assets/ai-optimizer/state.json
+```
+
+### 2. Determine Next Test
+- Read `track` (gpu or ram)
+- Read `current_model` from queue at `model_index`
+- Read `current_config` for parameters to test
+- Select next context step from `context_steps` based on `phase`
+
+### 3. Pull Model (if needed)
+```bash
+docker exec ollama ollama list | grep -q "<model>" || docker exec ollama ollama pull <model>
+```
+
+### 4. Create Test Modelfile
+```bash
+docker exec ollama bash -c "cat <<EOF > /root/.ollama/test_${model}.modelfile
+FROM ${model}
+PARAMETER num_ctx ${current_config.num_ctx}
+PARAMETER num_gpu ${current_config.num_gpu}
+PARAMETER flash_attn ${current_config.flash_attn}
+PARAMETER num_predict 4096
+PARAMETER num_keep 1024
+PARAMETER repeat_penalty 1.1
+EOF"
+
+docker exec ollama ollama create test-model -f /root/.ollama/test_${model}.modelfile
+```
+
+### 5. Run Benchmark
+```bash
+# Warm up
+docker exec ollama ollama run test-model "Hello" > /dev/null
+
+# Coding prompt
+START=$(date +%s%N)
+docker exec ollama ollama run test-model "Write a Python async context manager that retries a function with exponential backoff, max 5 retries, and logs each attempt using structlog. Include type hints."
+END=$(date +%s%N)
+
+# Calculate tokens/sec from output
+```
+
+### 6. Measure VRAM (if possible)
+```bash
+# Try host first
+rocm-smi --showmeminfo vram 2>/dev/null || \
+# Try via docker
+docker exec --privileged ollama rocm-smi --showmeminfo vram 2>/dev/null || \
+# Fallback
+echo "VRAM measurement unavailable"
+```
+
+### 7. Record Results
+- Parse tokens/sec from ollama output
+- Record VRAM/RAM usage
+- Determine if this is best config so far for this model
+- Update `best_configs` if tokens/sec improved or context increased
+
+### 8. Update State
+```python
+# Logic:
+if test_successful:
+    if context_step < max_reached:
+        phase = "context_scaling"
+        current_config.num_ctx = next_context_step
+    else:
+        # Move to next model
+        model_index += 1
+        phase = "context_scaling"
+        current_config.num_ctx = context_steps[0]
+else:
+    # OOM or error - record last good as best
+    best_configs[track][current_model] = last_good_config
+    model_index += 1
+    phase = "context_scaling"
+```
+
+### 9. Commit to Repo
+```bash
+cd /opt/data/infra
+git add assets/ai-optimizer/
+git commit -m "ai-optimizer: tested ${model} at ${num_ctx} ctx - ${status}"
+git push origin master
+```
+
+### 10. Matrix Notification (if available)
+```python
+import os
+if os.getenv("MATRIX_HOME_SERVER") and os.getenv("MATRIX_ACCESS_TOKEN"):
+    # Send notification to Matrix room
+    # Room ID from env or config
+    pass
+# Else: silent
+```
+
+---
+
+## Stop Conditions
+
+1. All models in both queues have `best_configs` recorded
+2. Manual intervention needed (error in state.json `error` field)
+3. No progress for 3 consecutive runs (stuck)
+
+---
+
+## Error Handling
+
+If any step fails:
+1. Log error to state.json: `"error": {"message": "...", "timestamp": "..."}`
+2. Do NOT increment model_index (retry next run)
+3. Commit state with error field
+4. Exit gracefully
+
+---
+
+## Important Notes
+
+- **No num_parallel**: Do not use this parameter
+- **Two tracks**: Complete GPU track first, then RAM track
+- **Backend**: Start with ollama, llama.cpp testing is optional (requires uncommenting in compose.yml)
+- **Host access**: Some commands need host - use docker exec or SSH if available
+- **Ask before deploy**: If config changes needed in NixOS modules, show diff and wait for user confirmation before `nh os switch`
+
+---
+
+## Example State Transitions
+
+**Start:**
+```json
+{"track": "gpu", "model_index": 0, "current_model": "devstral-small-2:24b", "current_config": {"num_ctx": 32768, ...}}
+```
+
+**After successful test at 32k:**
+```json
+{"track": "gpu", "model_index": 0, "current_model": "devstral-small-2:24b", "current_config": {"num_ctx": 65536, ...}}
+```
+
+**After OOM at 131k:**
+```json
+{
+  "track": "gpu",
+  "model_index": 1,
+  "current_model": "qwen2.5-coder:32b",
+  "best_configs": {
+    "gpu": {
+      "devstral-small-2:24b": {"num_ctx": 98304, "num_gpu": 99, "tokens_per_sec": 11.2}
+    }
+  }
+}
+```

assets/ai-optimizer/CRON_JOB_DRAFT.md

@@ -0,0 +1,283 @@
+# AI Model Optimization Cron Job
+
+**Goal:** Find optimal configurations for maximum context size with full hardware utilization.
+
+**Hardware:**
+- 2× AMD MI50 GPUs (32GB VRAM each, 64GB total)
+- 128GB system RAM
+- ROCm: HSA_OVERRIDE_GFX_VERSION=9.0.6, HIP_VISIBLE_DEVICES=0,1
+
+---
+
+## Model Queue
+
+### GPU-Optimized (Coding - prioritize speed + context on GPU)
+1. `devstral-small-2:24b` - Best coding model
+2. `qwen2.5-coder:32b` - Strong coder, fits on GPU+offload
+3. `codellama:34b-instruct` - Legacy but solid
+
+### RAM-Optimized (Knowledge - prioritize max context, accept slower)
+1. `qwen2.5:72b` - Best knowledge, needs heavy offload
+2. `nemotron-3-nano:30b` - Good general knowledge
+3. `mixtral:8x7b-instruct` - MoE, efficient for knowledge
+
+---
+
+## Optimization Strategy
+
+**Two separate tracks:**
+
+### Track A: GPU-Focused (Coding)
+```
+Baseline: num_ctx=32768, num_gpu=99, flash_attn=true
+Steps:
+1. Increase context: 32k → 65k → 98k → 131k → 163k
+2. At each step, verify VRAM usage < 60GB (leave headroom)
+3. If OOM: reduce num_gpu until stable, record best
+4. Measure tokens/sec - if < 5 tok/s, consider context too high
+```
+
+### Track B: RAM-Focused (Knowledge)
+```
+Baseline: num_ctx=65536, num_gpu=50, flash_attn=true
+Steps:
+1. Increase context: 65k → 131k → 200k → 262k → 327k
+2. Allow heavy RAM offload (system RAM up to 100GB)
+3. If OOM: reduce context or num_gpu
+4. Speed less critical - focus on max stable context
+```
+
+---
+
+## Backend-Specific Configs
+
+### Ollama (Modelfile parameters)
+```
+PARAMETER num_ctx <value>
+PARAMETER num_gpu <layers>
+PARAMETER flash_attn true/false
+PARAMETER num_predict 4096
+PARAMETER num_keep 1024
+PARAMETER repeat_penalty 1.1
+```
+
+### Llama.cpp (CLI flags)
+```
+--ctx-size <value>
+--n-gpu-layers <layers>
+--flash-attn on/off
+--n-predict 4096
+--batch-size 4096
+--ubatch-size 512
+--cache-type-k f16
+--cache-type-v f16
+--split-mode layer
+--no-mmap
+```
+
+---
+
+## Host Test Instructions
+
+**The cron runs inside the hermes container. Some tests require host access:**
+
+### 1. VRAM Monitoring (HOST)
+```bash
+# Run on host to check VRAM usage during/after benchmark
+sudo rocm-smi --showmeminfo vram
+
+# Or via docker exec if rocm-smi available in container
+docker exec --privileged ollama rocm-smi --showmeminfo vram
+```
+
+### 2. Running Ollama Benchmarks (CONTAINER)
+```bash
+# Pull model
+docker exec ollama ollama pull <model>
+
+# Create custom modelfile
+docker exec ollama bash -c 'cat <<EOF > /root/.ollama/test.modelfile
+FROM <model>
+PARAMETER num_ctx 65536
+PARAMETER num_gpu 99
+PARAMETER flash_attn true
+EOF'
+
+# Create model from modelfile
+docker exec ollama ollama create test-model -f /root/.ollama/test.modelfile
+
+# Run benchmark (warm model first)
+docker exec ollama ollama run test-model "Write a Python async context manager with exponential backoff"
+
+# Cleanup
+docker exec ollama ollama rm test-model
+```
+
+### 3. Running Llama.cpp Benchmarks (CONTAINER - needs llama.cpp container)
+```bash
+# Uncomment llama_cpp_devstral in compose.yml first
+# Then rebuild: sudo nh os switch --flake .#lazyworkhorse
+
+# Test via HTTP API
+curl http://localhost:8300/v1/completions \
+  -H "Content-Type: application/json" \
+  -d '{
+    "model": "devstral-2-small-llama_cpp",
+    "prompt": "Write a Python function",
+    "max_tokens": 100
+  }'
+```
+
+### 4. Deploying Changes (HOST via ai-worker)
+```bash
+# After optimization, commit results
+cd /home/ai-worker/infra
+git add assets/ai-optimizer/
+git commit -m "ai-optimizer: new best config for <model>"
+git push
+
+# If config changes needed in ollama_init_custom_models.nix:
+# 1. Edit the file
+# 2. nixpkgs-fmt .
+# 3. Show diff to user
+# 4. Wait for confirmation
+# 5. sudo nh os switch --flake .#lazyworkhorse
+```
+
+### 5. Accessing Host from Hermes Container
+```bash
+# SSH to host as ai-worker (key should be mounted)
+ssh -i /path/to/key ai-worker@host.docker.internal
+
+# Or via docker socket if mounted
+# (not recommended for security)
+```
+
+---
+
+## Benchmark Prompts
+
+### Coding (Track A)
+```
+"Write a Python async context manager that retries a function with exponential backoff, max 5 retries, and logs each attempt using structlog. Include type hints and error handling."
+```
+
+### Knowledge (Track B)
+```
+"Explain the complete memory hierarchy in modern GPUs, from registers through L1/L2 caches to VRAM, and how data moves between them during matrix multiplication. Include bandwidth considerations for each level."
+```
+
+### Measurement
+- Tokens per second (generation speed)
+- Time to first token (latency)
+- VRAM usage (via rocm-smi)
+- System RAM usage (via free -h)
+- Context success (did it complete without OOM?)
+
+---
+
+## State File Structure
+
+`/opt/data/infra/assets/ai-optimizer/state.json`
+
+```json
+{
+  "track": "gpu",
+  "current_model": "devstral-small-2:24b",
+  "model_index": 0,
+  "phase": "context_scaling",
+  "backend": "ollama",
+  "current_config": {
+    "num_ctx": 65536,
+    "num_gpu": 99,
+    "flash_attn": true
+  },
+  "best_configs": {
+    "gpu": {
+      "devstral-small-2:24b": {
+        "backend": "ollama",
+        "num_ctx": 131072,
+        "num_gpu": 99,
+        "flash_attn": true,
+        "tokens_per_sec": 12.5,
+        "vram_used_gb": 58.2,
+        "tested_at": "2026-04-28T17:00:00Z"
+      }
+    },
+    "ram": {}
+  },
+  "completed_models": [],
+  "gpu_queue": ["devstral-small-2:24b", "qwen2.5-coder:32b", "codellama:34b-instruct"],
+  "ram_queue": ["qwen2.5:72b", "nemotron-3-nano:30b", "mixtral:8x7b-instruct"]
+}
+```
+
+---
+
+## Results CSV
+
+`/opt/data/infra/assets/ai-optimizer/results.csv`
+
+```csv
+timestamp,track,model,backend,phase,num_ctx,num_gpu,flash_attn,tokens_per_sec,vram_gb,ram_gb,status,is_best
+2026-04-28T17:00:00Z,gpu,devstral-small-2:24b,ollama,context_scaling,65536,99,true,15.2,52.1,18.4,success,false
+```
+
+---
+
+## Cron Job Flow
+
+```
+1. Read state.json
+2. If both queues empty → STOP (all models tested)
+3. Select next model from current track queue
+4. Pull model if needed (docker exec ollama ollama pull)
+5. Create Modelfile / llama.cpp config with current test params
+6. Run benchmark (both prompts)
+7. Measure: tokens/sec, VRAM (rocm-smi), RAM (free -h)
+8. If successful:
+   - Increase context (next step)
+   - Update current_config in state
+9. If OOM/error:
+   - Record last good config as best_configs[track][model]
+   - Move to next model in queue
+10. Update state.json
+11. Append to results.csv
+12. Git commit + push to /opt/data/infra
+13. Send Matrix notification if available, else silent
+```
+
+---
+
+## Matrix Notification (Optional)
+
+```python
+# If matrix credentials available in environment
+if os.getenv("MATRIX_HOME_SERVER") and os.getenv("MATRIX_ACCESS_TOKEN"):
+    # Send completion notification
+    # Room: !ai-optimizer:lazyworkhorse.net (or similar)
+    pass
+# Else: silent, just commit
+```
+
+---
+
+## Files to Create
+
+```
+/opt/data/infra/assets/ai-optimizer/
+├── state.json           # Current progress
+├── results.csv          # All test results
+├── best_configs.json    # Final best configs (human-readable)
+└── CRON_JOB_DRAFT.md    # This file
+```
+
+---
+
+## Notes
+
+- **No num_parallel**: Removed to avoid limiting other settings
+- **Two tracks**: GPU (coding/speed) vs RAM (knowledge/context)
+- **Both backends**: Test ollama first, then llama.cpp if available
+- **Host tests**: rocm-smi must run on host or privileged container
+- **Deploy**: ai-worker has sudo for nh/nixos-rebuild, must ask user first

assets/ai-optimizer/results.csv

@@ -0,0 +1 @@
+timestamp,track,model,backend,phase,num_ctx,num_gpu,flash_attn,tokens_per_sec,vram_gb,ram_gb,status,is_best

assets/ai-optimizer/state.json

@@ -0,0 +1,21 @@
+{
+  "track": "gpu",
+  "current_model": "devstral-small-2:24b",
+  "model_index": 0,
+  "phase": "context_scaling",
+  "backend": "ollama",
+  "current_config": {
+    "num_ctx": 32768,
+    "num_gpu": 99,
+    "flash_attn": true
+  },
+  "best_configs": {
+    "gpu": {},
+    "ram": {}
+  },
+  "completed_models": [],
+  "gpu_queue": ["devstral-small-2:24b", "qwen2.5-coder:32b", "codellama:34b-instruct"],
+  "ram_queue": ["qwen2.5:72b", "nemotron-3-nano:30b", "mixtral:8x7b-instruct"],
+  "context_steps": [32768, 65536, 98304, 131072, 163840, 200704, 262144, 327680],
+  "last_updated": "2026-04-28T17:00:00Z"
+}

docker/hermes/Dockerfile

@@ -0,0 +1,21 @@
+# Custom Hermes Agent image with voice support and ROCm for AMD GPU
+# Builds on upstream image and adds local STT capabilities
+FROM nousresearch/hermes-agent:latest AS base
+
+# Install system dependencies for audio capture
+USER root
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        libportaudio2 \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Python packages for voice support
+# Using uv for consistency with Hermes build process
+RUN uv pip install --no-cache-dir \
+    sounddevice \
+    numpy \
+    faster-whisper
+
+# Health check for voice readiness
+HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
+    CMD python3 -c "import sounddevice, faster_whisper; print('voice deps OK')" || exit 1

docker/hermes/entrypoint.sh

@@ -0,0 +1,102 @@
+#!/bin/bash
+# Docker/Podman entrypoint: bootstrap config files into the mounted volume, then run hermes.
+set -e
+
+HERMES_HOME="${HERMES_HOME:-/opt/data}"
+INSTALL_DIR="/opt/hermes"
+
+# --- Privilege dropping via gosu ---
+# When started as root (the default for Docker, or fakeroot in rootless Podman),
+# optionally remap the hermes user/group to match host-side ownership, fix volume
+# permissions, then re-exec as hermes.
+if [ "$(id -u)" = "0" ]; then
+    if [ -n "$HERMES_UID" ] && [ "$HERMES_UID" != "$(id -u hermes)" ]; then
+        echo "Changing hermes UID to $HERMES_UID"
+        usermod -u "$HERMES_UID" hermes
+    fi
+
+    if [ -n "$HERMES_GID" ] && [ "$HERMES_GID" != "$(id -g hermes)" ]; then
+        echo "Changing hermes GID to $HERMES_GID"
+        # -o allows non-unique GID (e.g. macOS GID 20 "staff" may already exist
+        # as "dialout" in the Debian-based container image)
+        groupmod -o -g "$HERMES_GID" hermes 2>/dev/null || true
+    fi
+
+    # Fix ownership of the data volume. When HERMES_UID remaps the hermes user,
+    # files created by previous runs (under the old UID) become inaccessible.
+    # Always chown -R when UID was remapped; otherwise only if top-level is wrong.
+    actual_hermes_uid=$(id -u hermes)
+    needs_chown=false
+    if [ -n "$HERMES_UID" ] && [ "$HERMES_UID" != "10000" ]; then
+        needs_chown=true
+    elif [ "$(stat -c %u "$HERMES_HOME" 2>/dev/null)" != "$actual_hermes_uid" ]; then
+        needs_chown=true
+    fi
+    if [ "$needs_chown" = true ]; then
+        echo "Fixing ownership of $HERMES_HOME to hermes ($actual_hermes_uid)"
+        # In rootless Podman the container's "root" is mapped to an unprivileged
+        # host UID — chown will fail.  That's fine: the volume is already owned
+        # by the mapped user on the host side.
+        chown -R hermes:hermes "$HERMES_HOME" 2>/dev/null || \
+            echo "Warning: chown failed (rootless container?) — continuing anyway"
+    fi
+
+    echo "Dropping root privileges"
+    exec gosu hermes "$0" "$@"
+fi
+
+# --- Running as hermes from here ---
+source "${INSTALL_DIR}/.venv/bin/activate"
+
+# Create essential directory structure.  Cache and platform directories
+# (cache/images, cache/audio, platforms/whatsapp, etc.) are created on
+# demand by the application — don't pre-create them here so new installs
+# get the consolidated layout from get_hermes_dir().
+# The "home/" subdirectory is a per-profile HOME for subprocesses (git,
+# ssh, gh, npm …).  Without it those tools write to /root which is
+# ephemeral and shared across profiles.  See issue #4426.
+mkdir -p "$HERMES_HOME"/{cron,sessions,logs,hooks,memories,skills,skins,plans,workspace,home}
+
+# .env
+if [ ! -f "$HERMES_HOME/.env" ]; then
+    cp "$INSTALL_DIR/.env.example" "$HERMES_HOME/.env"
+fi
+
+# config.yaml
+if [ ! -f "$HERMES_HOME/config.yaml" ]; then
+    cp "$INSTALL_DIR/cli-config.yaml.example" "$HERMES_HOME/config.yaml"
+fi
+
+# Ensure the main config file remains accessible to the hermes runtime user
+# even if it was edited on the host after initial ownership setup.
+if [ -f "$HERMES_HOME/config.yaml" ]; then
+    chown hermes:hermes "$HERMES_HOME/config.yaml"
+    chmod 640 "$HERMES_HOME/config.yaml"
+fi
+
+# SOUL.md
+if [ ! -f "$HERMES_HOME/SOUL.md" ]; then
+    cp "$INSTALL_DIR/docker/SOUL.md" "$HERMES_HOME/SOUL.md"
+fi
+
+# Sync bundled skills (manifest-based so user edits are preserved)
+if [ -d "$INSTALL_DIR/skills" ]; then
+    python3 "$INSTALL_DIR/tools/skills_sync.py"
+fi
+
+# Final exec: two supported invocation patterns.
+#
+#   docker run <image>                 -> exec `hermes` with no args (legacy default)
+#   docker run <image> chat -q "..."   -> exec `hermes chat -q "..."` (legacy wrap)
+#   docker run <image> sleep infinity  -> exec `sleep infinity` directly
+#   docker run <image> bash            -> exec `bash` directly
+#
+# If the first positional arg resolves to an executable on PATH, we assume the
+# caller wants to run it directly (needed by the launcher which runs long-lived
+# `sleep infinity` sandbox containers — see tools/environments/docker.py).
+# Otherwise we treat the args as a hermes subcommand and wrap with `hermes`,
+# preserving the documented `docker run <image> <subcommand>` behavior.
+if [ $# -gt 0 ] && command -v "$1" >/dev/null 2>&1; then
+    exec "$@"
+fi
+exec hermes "$@"

docs/nix-container-install.md

@@ -1,474 +0,0 @@
-# Nix Installation for Hermes Agent Container
-
-This guide covers several approaches for installing Nix in the Hermes Agent Docker
-container to enable remote NixOS deployment via `nixos-rebuild`. It covers both
-x86_64 (lazyworkhorse) and aarch64 (cyt-pi, uConsole) architectures.
-
-## Table of Contents
-
-1. [Why Nix in a Container?](#why-nix-in-a-container)
-2. [Prerequisites](#prerequisites)
-3. [Installation Methods](#installation-methods)
-   - [Method A: Determinate Systems Installer](#method-a-determinate-systems-installer-recommended)
-   - [Method B: Vanilla Nix Installer](#method-b-vanilla-nix-installer)
-   - [Method C: NixOS-Based Container Image](#method-c-nixos-based-container-image)
-4. [Architecture-Specific Notes](#architecture-specific-notes)
-   - [x86_64 (lazyworkhorse)](#x86_64-lazyworkhorse)
-   - [aarch64 (cyt-pi, uConsole)](#aarch64-cyt-pi-uconsole)
-   - [Cross-Compilation](#cross-compilation)
-5. [Post-Install Configuration](#post-install-configuration)
-6. [Verification](#verification)
-7. [Container-Specific Considerations](#container-specific-considerations)
-   - [Persistence](#persistence)
-   - [Disk Space](#disk-space)
-   - [Security](#security)
-   - [Resource Constraints](#resource-constraints)
-8. [Integration with deploy.sh](#integration-with-deploysh)
-9. [Troubleshooting](#troubleshooting)
-10. [References](#references)
-
----
-
-## Why Nix in a Container?
-
-The Hermes Agent container runs on an Ubuntu/Debian base. To deploy NixOS
-configurations to remote hosts, we need:
-
-- `nix` — the Nix package manager (for building configurations)
-- `nixos-rebuild` — the NixOS deployment tool
-- Access to the infra repo with flake configuration
-
-Installing Nix inside the container avoids:
-- Host-level Nix installation on the Docker host
-- Cross-container volume mounts of /nix/store
-- Dependencies on the host's Nix daemon (which may be a different version)
-
-## Prerequisites
-
-- Docker host running Linux (x86_64 and/or aarch64)
-- Container base: Debian/Ubuntu (apt-based)
-- 1-2 GB additional disk space for Nix store
-- Network access to cache.nixos.org (or a local binary cache)
-- Git access to the infra repository
-
-## Installation Methods
-
-### Method A: Determinate Systems Installer (Recommended)
-
-The Determinate Systems installer is the recommended approach. It is non-interactive,
-sets up flakes by default, and handles multi-user installation cleanly.
-
-**Dockerfile additions:**
-
-```dockerfile
-# Install Nix (Determinate Systems installer)
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl \
-    xz-utils \
-    && rm -rf /var/lib/apt/lists/*
-
-# Download and run Nix installer (non-interactive)
-RUN curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix \
-    -o /tmp/nix-install.sh \
-    && chmod +x /tmp/nix-install.sh \
-    && sh /tmp/nix-install.sh install --no-confirm \
-    && rm /tmp/nix-install.sh
-
-# Configure Nix for flakes
-RUN mkdir -p /root/.config/nix \
-    && echo 'experimental-features = nix-command flakes' > /root/.config/nix/nix.conf
-
-# Add Nix to PATH for all users
-ENV PATH="/nix/var/nix/profiles/default/bin:$PATH"
-```
-
-**Pros:**
-- Fully non-interactive (--no-confirm)
-- Enables flakes automatically
-- Sets up multi-user daemon
-- Auto-selects correct architecture
-- Handles upgrades gracefully
-
-**Cons:**
-- Downloads ~100 MB installer
-- Requires systemd in container (works with --privileged or cgroupv2)
-- Daemon mode may conflict with container exit semantics
-
-**Container runtime additions:**
-
-For the Nix daemon to work properly inside a container, you may need:
-```dockerfile
-# Ensure /nix is a volume for persistence
-VOLUME /nix
-
-# Or mount tmpfs for ephemeral builds:
-# docker run --tmpfs /nix:exec,size=4G ...
-```
-
-### Method B: Vanilla Nix Installer
-
-The official single-user Nix installer is lighter but requires manual flake setup.
-
-**Dockerfile additions:**
-
-```dockerfile
-# Install Nix (single-user, official installer)
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl \
-    sudo \
-    xz-utils \
-    && rm -rf /var/lib/apt/lists/*
-
-# Install Nix as root (single-user)
-RUN curl -L https://nixos.org/nix/install -o /tmp/nix-install.sh \
-    && chmod +x /tmp/nix-install.sh \
-    && sh /tmp/nix-install.sh --no-daemon \
-    && rm /tmp/nix-install.sh
-
-# Enable flakes
-RUN mkdir -p /root/.config/nix \
-    && echo 'experimental-features = nix-command flakes' > /root/.config/nix/nix.conf
-
-# Source Nix in shell
-RUN echo '. /root/.nix-profile/etc/profile.d/nix.sh' >> /root/.bashrc
-ENV PATH="/root/.nix-profile/bin:$PATH"
-```
-
-**Pros:**
-- Smaller installer
-- No daemon needed (single-user mode)
-- Works in containers without systemd
-- Simpler container lifecycle
-
-**Cons:**
-- Manual flake configuration required
-- Single-user only (no multi-user isolation)
-- PATH must be set manually
-- No automatic garbage collection
-
-### Method C: NixOS-Based Container Image
-
-For maximum isolation, use an official NixOS base image for the build stage.
-
-**Multi-stage Dockerfile:**
-
-```dockerfile
-# Build stage: NixOS builder
-FROM nixos/nix:latest AS builder
-
-COPY infra /infra
-WORKDIR /infra
-
-# Build the configuration once
-RUN nix build '.#nixosConfigurations.lazyworkhorse.config.system.build.toplevel'
-
-# Final stage: Hermes container
-FROM ubuntu:22.04
-
-# Copy the Nix closure and binary cache
-COPY --from=builder /nix /nix
-
-# ... rest of Hermes setup
-```
-
-**Pros:**
-- Purely declarative build environment
-- No installation at runtime
-- Easy to pin Nix version
-- Good for CI/CD pipelines
-
-**Cons:**
-- Requires multi-stage Docker build
-- Larger initial image build
-- Harder to update Nix version at runtime
-- Overkill if Nix is only needed for `nixos-rebuild`
-
----
-
-## Architecture-Specific Notes
-
-### x86_64 (lazyworkhorse)
-
-The Hermes container likely runs on x86_64 hardware for the primary server.
-Nix will download x86_64 binaries from cache.nixos.org by default.
-
-**No special configuration needed** — the standard installer works out of the box.
-
-If the container is running on an AMD Ryzen/EPYC or Intel Xeon, consider:
-```bash
-# Enable CPU-specific optimizations (optional)
-echo 'extra-platforms = x86_64-v1 x86_64-v2 x86_64-v3' >> /root/.config/nix/nix.conf
-```
-
-### aarch64 (cyt-pi, uConsole)
-
-When building for aarch64 targets from an x86_64 container, you need either:
-1. Remote builder (aarch64 machine does the build), or
-2. QEMU-based emulation (slower but self-contained), or
-3. Build directly on the aarch64 target using `--build-host`
-
-**For QEMU emulation in the container:**
-
-```dockerfile
-# Enable binfmt for aarch64 emulation
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    qemu-user-static \
-    binfmt-support \
-    && rm -rf /var/lib/apt/lists/*
-
-# Register aarch64 binfmt
-RUN update-binfmts --enable qemu-aarch64
-```
-
-**Container runtime (for QEMU):**
-```bash
-docker run --privileged --rm ... hermes-agent
-# Or with specific capability:
-docker run --cap-add=SYS_ADMIN --security-opt seccomp=unconfined ... hermes-agent
-```
-
-### Cross-Compilation
-
-For native cross-compilation (without emulation), add to your Nix configuration:
-
-```nix
-# In your flake.nix or nix.conf
-{
-  nix.settings.extra-platforms = [ "aarch64-linux" "x86_64-linux" ];
-  nix.settings.extra-sandbox-paths = [ ];
-  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
-}
-```
-
-Or in `nix.conf`:
-```
-extra-platforms = x86_64-linux aarch64-linux
-extra-sandbox-paths =
-```
-
----
-
-## Post-Install Configuration
-
-### nix.conf for Container Usage
-
-Recommended `/root/.config/nix/nix.conf`:
-
-```ini
-experimental-features = nix-command flakes
-substituters = https://cache.nixos.org/
-trusted-users = root
-max-jobs = auto
-cores = 0
-sandbox = false
-```
-
-Note: `sandbox = false` is needed inside containers that lack full sandbox
-support. This is safe in a single-tenant container environment.
-
-### PATH Setup
-
-Add to your Dockerfile:
-```dockerfile
-ENV PATH="/nix/var/nix/profiles/default/bin:/root/.nix-profile/bin:${PATH}"
-```
-
-### Shell Integration
-
-```dockerfile
-RUN echo 'source /root/.nix-profile/etc/profile.d/nix.sh' >> /root/.bashrc
-```
-
----
-
-## Verification
-
-After installation, verify with:
-
-```bash
-# Check Nix is available
-nix --version
-
-# Check nixos-rebuild
-nixos-rebuild --help | head -3
-
-# Verify flakes are enabled
-nix flake --help
-
-# Test a build (must be in infra repo)
-cd /opt/data/infra
-nix build --no-link '.#nixosConfigurations.lazyworkhorse.config.system.build.toplevel'
-
-# Check available systems
-nix eval --impure --expr 'builtins.currentSystem'
-```
-
----
-
-## Container-Specific Considerations
-
-### Persistence
-
-The `/nix` directory should be a Docker volume to avoid re-downloading
-packages on every container restart:
-
-```yaml
-# docker-compose.yml
-volumes:
-  - nix-store:/nix
-
-volumes:
-  nix-store:
-```
-
-Without persistence, every container restart requires re-downloading the
-entire Nix store (~500 MB - 2 GB depending on packages used).
-
-### Disk Space
-
-The Nix store grows over time as old generations accumulate. Set up garbage
-collection:
-
-```bash
-# Manual GC
-nix store gc
-
-# Remove old generations
-nix-collect-garbage --delete-older-than 30d
-
-# Automatic GC (in nix.conf)
-# Currently not supported in nix.conf, but you can run a cron job:
-# nix store gc --max 10G
-```
-
-In Docker, limit store growth with:
-```dockerfile
-# Configure max store size
-RUN mkdir -p /etc/nix && \
-    echo 'min-free = 5368709120' > /etc/nix/nix.conf  # Keep 5GB free
-```
-
-### Security
-
-Running Nix in a container introduces some security considerations:
-
-1. **Sandboxing:** `sandbox = false` disables build isolation. In a multi-tenant
-   container, this means Nix builds can affect the container filesystem.
-   **Mitigation:** Only build configs you trust (your own infra repo).
-
-2. **Network access:** The container needs outbound access to cache.nixos.org.
-   If using a restricted network, set up a local binary cache:
-   ```nix
-   substituters = https://cache.nixos.org/ https://nix-cache.internal/
-   ```
-
-3. **Privileged mode:** QEMU emulation for aarch64 builds may need `--privileged`
-   or `--security-opt seccomp=unconfined`. This reduces container isolation.
-   **Mitigation:** Use remote builders or build natively on the target.
-
-4. **Supply chain:** Nix derivations pin exact inputs via hashes. Verify
-   flake.lock is committed and reviewed.
-
-### Resource Constraints
-
-Nix builds can be memory and CPU intensive:
-
-```nix
-# Limit build parallelism in nix.conf
-max-jobs = 2
-cores = 4
-
-# Or set per-build:
-# nix build --max-jobs 2 --cores 4
-```
-
-For containers with limited memory (< 2 GB), consider:
-- Building on the target host instead (`--build-host`)
-- Using the deploy script's `build` action separately
-
----
-
-## Integration with deploy.sh
-
-The deployment script at `scripts/deploy.sh` expects:
-
-1. **Nix installed** with flakes enabled
-2. **SSH key** at `/opt/data/home/.ssh/id_hermes_gitea` (or via SSH_KEY env)
-3. **Infra repo** cloned at the script's parent directory
-4. **Network access** to:
-   - `code.lazyworkhorse.net:2222` (Gitea for git operations)
-   - Target hosts via SSH (see deploy-ssh-config)
-   - `cache.nixos.org` or a local substitute
-
-Typical usage from Hermes:
-
-```bash
-# Full deployment
-./scripts/deploy.sh lazyworkhorse master switch
-
-# Build-only check (no remote deployment)
-./scripts/deploy.sh cyt-pi master build
-
-# Dry run
-./scripts/deploy.sh uConsole feat/test dry-activate
-
-# Override SSH key
-SSH_KEY=/opt/data/home/.ssh/my-custom-key ./deploy.sh lazyworkhorse
-```
-
----
-
-## Troubleshooting
-
-### "nix: command not found"
-
-- Ensure Nix is installed and PATH is set:
-  ```bash
-  export PATH="/nix/var/nix/profiles/default/bin:/root/.nix-profile/bin:$PATH"
-  ```
-- Check installation: `ls -la /nix/` should exist
-- Re-source profile: `. /root/.nix-profile/etc/profile.d/nix.sh`
-
-### "error: unable to download ... cache.nixos.org"
-
-- Check network connectivity: `ping cache.nixos.org`
-- Check DNS resolution from inside the container
-- If behind a proxy, set `http_proxy` / `https_proxy` environment variables
-
-### "sandbox: cannot run build in sandbox"
-
-- Add `sandbox = false` to nix.conf
-- Or run container with `--privileged` or `--security-opt seccomp=unconfined`
-
-### "aarch64-linux builds fail on x86_64"
-
-- QEMU binfmt not registered. Check: `ls /proc/sys/fs/binfmt_misc/`
-- Rebuild QEMU registration: `docker run --privileged --rm tonistiigi/binfmt --install all`
-- Or use `--build-host` to build on the target directly
-
-### "nixos-rebuild fails with SSH errors"
-
-- Verify SSH key exists and has correct permissions:
-  ```bash
-  ls -la /opt/data/home/.ssh/id_hermes_gitea
-  chmod 600 /opt/data/home/.ssh/id_hermes_gitea
-  ```
-- Test SSH manually: `ssh -p 2424 -i /opt/data/home/.ssh/id_hermes_gitea ai-worker@lazyworkhorse.net`
-- Check target host is reachable: `nc -zv lazyworkhorse.net 2424`
-
-### "git fetch fails from Gitea"
-
-- Verify GIT_SSH_COMMAND is set: `echo $GIT_SSH_COMMAND`
-- Test git SSH: `ssh -T git@code.lazyworkhorse.net -p 2222`
-- Check the infra repo remote: `git remote -v`
-
----
-
-## References
-
-- [Determinate Systems Nix Installer](https://github.com/DeterminateSystems/nix-installer)
-- [NixOS Manual: Installation](https://nixos.org/manual/nix/stable/installation/)
-- [NixOS Wiki: Flakes](https://nixos.wiki/wiki/Flakes)
-- [NixOS Wiki: nixos-rebuild](https://nixos.wiki/wiki/Nixos-rebuild)
-- [NixOS Wiki: Cross Compilation](https://nixos.wiki/wiki/Cross_Compilation)
-- [Multi-arch Docker with QEMU](https://github.com/multiarch/qemu-user-static)

scripts/deploy-ssh-config

@@ -1,63 +0,0 @@
-# Hermes Container SSH Configuration
-# For NixOS deployment to remote hosts
-#
-# Usage:
-#   cp scripts/deploy-ssh-config ~/.ssh/config.d/hermes-include
-#   Or: cat scripts/deploy-ssh-config >> ~/.ssh/config
-#
-# This config covers all NixOS hosts managed from the Hermes container.
-# Lazyworkhorse has two users: ai-worker (primary automation) and gortium (admin).
-# Cyt-pi connects via reverse SSH tunnel on port 19999.
-# uConsole is a placeholder until LAN-hostname resolution is confirmed.
-
-# ── Global defaults ──────────────────────────────────────────────────
-Host *
-    ServerAliveInterval 60
-    ServerAliveCountMax 3
-    TCPKeepAlive yes
-    Compression yes
-    CompressionLevel 6
-    ControlMaster auto
-    ControlPath ~/.ssh/controlmasters/%r@%h:%p
-    ControlPersist 10m
-    StrictHostKeyChecking no
-    UserKnownHostsFile /dev/null
-
-# ── Hosts ──────────────────────────────────────────────────────────────
-
-# Lazyworkhorse — x86_64 main server (ai-worker@lazyworkhorse.net:2424)
-Host lazyworkhorse
-    HostName lazyworkhorse.net
-    User ai-worker
-    Port 2424
-    IdentityFile /opt/data/home/.ssh/id_hermes_gitea
-
-# Lazyworkhorse — admin access (gortium@lazyworkhorse.net:2425)
-Host lazyworkhorse-admin
-    HostName lazyworkhorse.net
-    User gortium
-    Port 2425
-    IdentityFile /opt/data/home/.ssh/id_hermes_gitea
-
-# Cyt-pi — aarch64 Pi Zero 2 W
-# Connected via reverse SSH tunnel (gortium directs tunnel to :19999)
-Host cyt-pi
-    HostName localhost
-    User gortium
-    Port 19999
-    IdentityFile /opt/data/home/.ssh/id_hermes_gitea
-
-# uConsole — aarch64 ClockworkPi (placeholder hostname)
-# Replace uconsole.lan with actual IP/hostname when deployed
-Host uConsole uconsole
-    HostName uconsole.lan
-    User gortium
-    Port 22
-    IdentityFile /opt/data/home/.ssh/id_hermes_gitea
-
-# ── Gitea host — for git operations ──────────────────────────────────
-Host code
-    HostName code.lazyworkhorse.net
-    Port 2222
-    User gortium
-    IdentityFile /opt/data/home/.ssh/id_hermes_gitea

scripts/deploy.sh

@@ -1,286 +0,0 @@
-#!/usr/bin/env bash
-# NixOS Deployment Helper Script
-# Remote NixOS deployment from Hermes container to target hosts.
-#
-# Usage: ./deploy.sh <hostname> [branch] [action]
-#
-# Actions:
-#   switch       Activate configuration now (default)
-#   boot         Activate on next reboot
-#   test         Activate without switching generations
-#   build        Build locally only, no remote activation
-#   dry-activate Show what would change without applying
-#
-# Examples:
-#   ./deploy.sh lazyworkhorse                  # deploy master/switch to lazyworkhorse
-#   ./deploy.sh cyt-pi feat/test boot          # deploy feat/test branch, activate on boot
-#   ./deploy.sh uConsole master build          # just build, don't deploy
-#   NO_BUILD_CHECK=1 ./deploy.sh uConsole      # skip the pre-flight nix build
-#
-# Environment variables:
-#   SSH_USER      SSH user (default: auto-detected per host)
-#   SSH_PORT      SSH port (default: auto-detected per host)
-#   SSH_KEY       SSH identity file
-#   BUILD_HOST    Build flake for this host (default: same as target host)
-#   NO_BUILD_CHECK  Set to 1 to skip local nix build before deployment
-
-set -euo pipefail
-
-# ── Colors ──────────────────────────────────────────────────────────────
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-CYAN='\033[0;36m'
-NC='\033[0m' # No Color
-
-info()  { echo -e "${BLUE}[INFO]${NC}  $*"; }
-ok()    { echo -e "${GREEN}[OK]${NC}    $*"; }
-warn()  { echo -e "${YELLOW}[WARN]${NC}  $*"; }
-error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
-step()  { echo -e "\n${CYAN}━━━ $* ━━━${NC}"; }
-
-# ── Cleanup trap ───────────────────────────────────────────────────────
-cleanup() {
-    local ec=$?
-    if [ $ec -ne 0 ]; then
-        error "Deployment failed with exit code $ec"
-    fi
-    exit $ec
-}
-trap cleanup EXIT
-
-# ── Usage / Help ───────────────────────────────────────────────────────
-show_usage() {
-    cat <<EOF
-Usage: $0 <hostname> [branch] [action]
-
-Remote NixOS deployment from Hermes container to target hosts.
-
-HOSTNAME (required):
-    lazyworkhorse     x86_64 main server
-    cyt-pi            aarch64 Pi Zero 2 W (via reverse tunnel)
-    uConsole          aarch64 ClockworkPi
-
-BRANCH (optional, default: master):
-    Git branch or tag to deploy. Fetched from origin.
-
-ACTION (optional, default: switch):
-    switch           Activate configuration now (default)
-    boot             Activate on next reboot
-    test             Activate without switching generations
-    build            Build locally only, skip remote deployment
-    dry-activate     Show what would change without applying
-
-Environment variables:
-    SSH_USER       SSH username override
-    SSH_PORT       SSH port override
-    SSH_KEY        SSH identity file path
-    BUILD_HOST     Build flake hostname (default: same as HOSTNAME)
-    NO_BUILD_CHECK Skip local nix build validation (set to 1)
-
-Examples:
-    $0 lazyworkhorse                       # deploy master/switch
-    $0 cyt-pi feat/test boot               # deploy feature branch, boot
-    $0 uConsole master build               # just build, no remote
-    NO_BUILD_CHECK=1 $0 uConsole           # skip build check
-
-EOF
-    exit 0
-}
-
-# ── Argument parsing ───────────────────────────────────────────────────
-HOSTNAME="${1:-}"
-BRANCH="${2:-master}"
-ACTION="${3:-switch}"
-NO_BUILD_CHECK="${NO_BUILD_CHECK:-0}"
-
-if [ "$HOSTNAME" = "--help" ] || [ "$HOSTNAME" = "-h" ] || [ -z "$HOSTNAME" ]; then
-    show_usage
-fi
-
-# ── Host configuration ─────────────────────────────────────────────────
-case "$HOSTNAME" in
-    lazyworkhorse)
-        DEFAULT_SSH_USER="ai-worker"
-        DEFAULT_SSH_PORT="2424"
-        ARCH="x86_64-linux"
-        ;;
-    cyt-pi)
-        DEFAULT_SSH_USER="gortium"
-        DEFAULT_SSH_PORT="19999"
-        ARCH="aarch64-linux"
-        ;;
-    uConsole)
-        DEFAULT_SSH_USER="gortium"
-        DEFAULT_SSH_PORT="22"
-        ARCH="aarch64-linux"
-        ;;
-    *)
-        error "Unknown host: $HOSTNAME"
-        echo "Supported hosts: lazyworkhorse, cyt-pi, uConsole"
-        exit 1
-        ;;
-esac
-
-SSH_USER="${SSH_USER:-$DEFAULT_SSH_USER}"
-SSH_PORT="${SSH_PORT:-$DEFAULT_SSH_PORT}"
-SSH_KEY="${SSH_KEY:-/opt/data/home/.ssh/id_hermes_gitea}"
-BUILD_HOST="${BUILD_HOST:-$HOSTNAME}"
-
-SSH_OPTS="-p $SSH_PORT -i $SSH_KEY -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
-SSH_TARGET="${SSH_USER}@${HOSTNAME}"
-export GIT_SSH_COMMAND="ssh -i $SSH_KEY -p 2222 -o StrictHostKeyChecking=no"
-export PATH="/nix/var/nix/profiles/default/bin:$PATH"
-
-# ── Banner ─────────────────────────────────────────────────────────────
-echo "╔══════════════════════════════════════════════╗"
-echo "║         NixOS Remote Deployment              ║"
-echo "╚══════════════════════════════════════════════╝"
-info "Host:   $HOSTNAME ($ARCH)"
-info "Branch: $BRANCH"
-info "Action: $ACTION"
-info "SSH:    ${SSH_USER}@${HOSTNAME}:${SSH_PORT}"
-echo ""
-
-# ── Pre-flight checks ─────────────────────────────────────────────────
-step "Pre-flight checks"
-
-# 1. Check required tools
-for cmd in nix git ssh; do
-    if ! command -v "$cmd" &>/dev/null; then
-        error "Required tool not found: $cmd"
-        exit 1
-    fi
-done
-ok "Required tools available (nix, git, ssh)"
-
-# 2. Check infra repo
-INFRA_DIR="$(cd "$(dirname "$0")/.." && pwd)"
-if [ ! -d "$INFRA_DIR/.git" ]; then
-    error "Not a git repository: $INFRA_DIR"
-    exit 1
-fi
-ok "Infra repo found at $INFRA_DIR"
-
-# 3. Check SSH connectivity (skip for build-only actions)
-if [ "$ACTION" != "build" ]; then
-    if ssh $SSH_OPTS -o ConnectTimeout=5 "$SSH_TARGET" "echo connected" &>/dev/null; then
-        ok "SSH connectivity to $HOSTNAME verified"
-    else
-        warn "Cannot reach $HOSTNAME via SSH — deployment step will fail later"
-    fi
-fi
-
-# ── Git sync ───────────────────────────────────────────────────────────
-step "Git sync"
-
-cd "$INFRA_DIR"
-
-# Stash local changes if any
-if ! git diff --quiet HEAD; then
-    warn "Local changes detected, stashing..."
-    git stash push -m "auto-stash before deploy $(date -Iseconds)"
-    STASHED=1
-else
-    STASHED=0
-fi
-
-# Fetch and checkout
-git fetch origin "$BRANCH" 2>/dev/null || git fetch origin master
-if git rev-parse --verify "origin/$BRANCH" &>/dev/null 2>&1; then
-    # Remote branch exists — fast-forward merge
-    git checkout -B "$BRANCH" "origin/$BRANCH"
-elif git rev-parse --verify "$BRANCH" &>/dev/null 2>&1; then
-    # Local branch or tag
-    git checkout "$BRANCH"
-else
-    error "Branch/tag not found: $BRANCH"
-    exit 1
-fi
-ok "Checked out $BRANCH ($(git rev-parse --short HEAD))"
-
-# Update submodules
-if [ -f .gitmodules ]; then
-    git submodule update --init --recursive
-    ok "Submodules updated"
-fi
-
-# ── Build validation ──────────────────────────────────────────────────
-if [ "$NO_BUILD_CHECK" != "1" ]; then
-    step "Build validation"
-    info "Building nixosConfigurations.$BUILD_HOST (no link)..."
-
-    if nix build --no-link --print-build-logs \
-        ".#nixosConfigurations.${BUILD_HOST}.config.system.build.toplevel" 2>&1; then
-        ok "Build succeeded for $BUILD_HOST"
-    else
-        error "Build failed for $BUILD_HOST"
-        exit 1
-    fi
-else
-    warn "Build check skipped (NO_BUILD_CHECK=1)"
-fi
-
-# ── Deployment ─────────────────────────────────────────────────────────
-if [ "$ACTION" = "build" ]; then
-    step "Build complete (no deployment)"
-    info "Use one of: switch, boot, test, dry-activate to deploy"
-    exit 0
-fi
-
-step "Deployment ($ACTION)"
-
-# Build the nixos-rebuild command
-case "$ACTION" in
-    switch|boot|test)
-        nixos-rebuild "$ACTION" \
-            --flake ".#$HOSTNAME" \
-            --target-host "$SSH_TARGET" \
-            --build-host "localhost" \
-            --use-remote-sudo \
-            --max-jobs 4
-        ;;
-    dry-activate)
-        nixos-rebuild dry-activate \
-            --flake ".#$HOSTNAME" \
-            --target-host "$SSH_TARGET" \
-            --build-host "localhost" \
-            --use-remote-sudo
-        ;;
-    *)
-        error "Unknown action: $ACTION"
-        echo "Valid actions: switch, boot, test, build, dry-activate"
-        exit 1
-        ;;
-esac
-
-# ── Check result ───────────────────────────────────────────────────────
-DEPLOY_EXIT=$?
-if [ $DEPLOY_EXIT -eq 0 ]; then
-    echo ""
-    ok "Deployment to $HOSTNAME ($ACTION) completed successfully"
-    case "$ACTION" in
-        switch|test)
-            info "Configuration is now active"
-            ;;
-        boot)
-            info "Configuration will activate on next reboot"
-            ;;
-        dry-activate)
-            info "Dry-run complete — no changes applied"
-            ;;
-    esac
-else
-    error "Deployment failed with exit code $DEPLOY_EXIT"
-    exit $DEPLOY_EXIT
-fi
-
-echo ""
-echo "╔══════════════════════════════════════════════╗"
-echo "║         Deployment Complete                   ║"
-echo "╚══════════════════════════════════════════════╝"
-info "Host:   $HOSTNAME"
-info "Branch: $BRANCH ($(git rev-parse --short HEAD))"
-info "Action: $ACTION"
-info "Time:   $(date -Iseconds)"