[dezren39]

Summary

Enable SSH on id-web, the runtime package passed to nixos-integration, so the VM runs the SSH world tests against an SSH-capable binary.

 buildFeatures = [
   "web"
   "sandbox"
+  "ssh"
   "world"
 ];

Closes #4960.

Evidence

• Before: the captured id(ci): nixos-integration's id binary lacks the ssh feature, so the SSH world tests fail #4960 VM run fails its SSH world tests with this build has no SSH support.
• Baseline: clean current-main cargo check --all-targets --no-default-features --features 'sandbox world' --locked passed; the separate id(chain): ChainExt literals in pkgs/id tests missing the #3794 checkpoint field — cargo check --all-targets fails on main #4850 checkpoint-field failure was not reproduced.
• After: nix eval --raw .#packages.x86_64-linux.id-web.drvPath passed. The local post-change all-target check with web sandbox ssh world reached existing web asset Assets::get/Assets::iter compile errors; it did not produce an SSH-specific diagnostic. Nix/CI checks are needed for the packaged build and VM.

Merge Danger

Door: two-way (the feature can be reverted).

Blast Radius: narrow — only the id-web feature set used for integration builds changes.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 57 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: b8b0144b-692c-40ea-8f95-f29c25ebc1fe

Commits

Reviewing files that changed from the base of the PR and between 8bb1e43 and d90f1b6.

Files selected for processing: 1

• pkgs/id/flake.nix

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-04T07:23:48.589535Z	d90f1b6	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[dezren39]

🤖 Agent note · handed off (task 9303)

Claimed by lane code-h and assigned to the opencode execution lane (§1b) — handed to the bound opencode claimant session for the follow-up disposition itself; the sandbox lane does not work this task itself.

Revalidation leads for the claimant (fresh gh checks at handoff, 2026-11-04 — re-verify before acting):

• PR fix(id): enable ssh in nixos integration runtime #5339 is OPEN, no hard-stop labels, head queue/9308-4960-nixos-integration-ssh — the PR belongs to task 9308; do not create a competing PR or take over its branch.
• Its only failing check is basic: production line limit (2500) (run 41791795378) — the known pre-existing main violation (pkgs/id/src/world/core.rs 2515 lines) whose fix is PR fix(id): extract checkpoint parts from world/core.rs to satisfy production line guard (#5358) #5365 / task 9340 (issue main CI failure: production-line-guard (run 41790193563) #5358). Prove pre-existing on clean main per the runbook before repeating that disposition; the packet's substantive questions (authorized_keys empty-assert availability outside the VM; composition-vs-single-node ssh proof) are the claimant's to disposition against the diff.

[dezren39]

agent-note:v1
task: 9308
lane: code-k
transition: merge_ready
Resumed PR #5339 (branch queue/9308-4960-nixos-integration-ssh) rather than restarting. Verified fresh: diff is exactly the scoped one-line change (+"ssh" in id-web buildFeatures, pkgs/id/flake.nix); Cargo.toml defines ssh = ["world", "dep:russh"]; laptop nix eval of .#packages.x86_64-linux.id-web succeeds and the derivation's buildFeatures are "web sandbox ssh world". Codex review: no findings. The only failing check (production-line-guard, pkgs/id/src/world/core.rs 2515 lines) fails identically on main (runs 41808480303, 41803764792) and is untouched by this diff — pre-existing, tracked separately. Prior attempt's baseline: clean-main cargo check --all-targets passed; #4850 not reproduced. Merging under standing criteria.