autoUpgrade was silently failing daily on both hosts (legacy channel path,
no --flake set) without reaching the network — disabled outright since
rebuilds should only happen manually. Separately, nix-gc.timer's nightly
sweep was deleting eval-time-only flake input sources (not part of the
runtime closure), forcing the next evaluation to cold-refetch hermes-agent's
entire dependency tree from GitHub in one burst, which alone was enough to
hit the unauthenticated codeload rate limit. keep-outputs/keep-derivations
stop GC from evicting those sources.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TJS8qsYPXSUm5mdWGdaHjF
Wires sops-nix into every machine via machines/core/sops.nix so hosts
decrypt with their existing SSH host key. Adds a devShell exposing
sops/age/ssh-to-age for the operator workflow, which also fixes .envrc's
previously no-op `use flake`.
finn.markwitzandClaude Sonnet 5