machines/core/nix.nix

@@ -12,6 +12,13 @@
 
     settings = {
       auto-optimise-store = true;
+      # Without these, gc sweeps away eval-time-only sources (flake inputs,
+      # their build deps) since they're not part of the runtime closure.
+      # The next evaluation then cold-refetches everything from GitHub,
+      # which is enough on its own to trip GitHub's unauthenticated rate
+      # limit for large dependency trees (e.g. hermes-agent's).
+      keep-outputs = true;
+      keep-derivations = true;
     };
 
     gc = {

machines/jupiter/configuration.nix

@@ -72,6 +72,9 @@
 
   system = {
     stateVersion = "23.05";
-    autoUpgrade.enable = true;
+    # Was silently failing daily (legacy channel path, no --flake set) without
+    # ever reaching the network. Disabled rather than fixed: rebuilds should
+    # only happen when triggered manually.
+    autoUpgrade.enable = false;
   };
 }

machines/mibook/configuration.nix

@@ -61,6 +61,9 @@
 
   system = {
     stateVersion = "23.05";
-    autoUpgrade.enable = true;
+    # Was silently failing daily (legacy channel path, no --flake set) without
+    # ever reaching the network. Disabled rather than fixed: rebuilds should
+    # only happen when triggered manually.
+    autoUpgrade.enable = false;
   };
 }