claim(M1-nixenv): single-source harness runtime env — ccciPyEnv+ccciRuntimeTools+cc-ci-run in packages.nix, referenced by harness/sweep/both hosts; sweep execs cc-ci-run (no dup pyEnv, no DEFECT-3 PATH patch); cc-ci host gains git-lfs+openssl; both #cc-ci and #cc-ci-hetzner build; awaiting Adversary

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nix/modules/nightly-sweep.nix

@@ -13,30 +13,22 @@
 # and lets sweep-logic changes ship via a checkout pull without a store rebuild.
 { pkgs, ... }:
 let
-  # The sweep drives run_recipe_ci.py (pytest/playwright) — needs the full harness env like cc-ci-run.
-  pyEnv = pkgs.python3.withPackages (ps: with ps; [ pytest playwright ]);
+  # Phase `nixenv`: the sweep drives nightly_sweep.py (pytest/playwright) through the SAME
+  # entrypoint the Drone runner uses — `cc-ci-run` (pkgs.cc-ci-run, defined once in packages.nix).
+  # So the python env + recipe-test tooling are IDENTICAL to the Drone path by construction: no
+  # duplicate pyEnv, no parallel runtimeInputs list, and no host-PATH-prepend patch (the old
+  # DEFECT-3 fix) — git-lfs/bash/util-linux/openssl/etc. now come from cc-ci-run's runtimeInputs,
+  # which is the single shared `ccciRuntimeTools`. This wrapper only sets the sweep-specific
+  # environment (HOME, the deployed-checkout repo) before handing off.
   sweep = pkgs.writeShellApplication {
     name = "cc-ci-nightly-sweep";
-    # util-linux provides `script` (abra's PTY wrapper for backup/restore TTY ops) — same as cc-ci-run.
-    # bash: the sweep's mirror_sync shells out to `bash scripts/recipe-mirror-sync.sh`; writeShellApplication
-    # sets a clean PATH limited to runtimeInputs, so bash must be listed (a real timer fire caught its
-    # absence — manual ssh runs had bash on PATH and masked it).
-    runtimeInputs = with pkgs; [ bash abra docker git curl jq gnused gnugrep gnutar coreutils util-linux procps ];
+    runtimeInputs = [ pkgs.cc-ci-run ];
     text = ''
       export HOME=/root
-      export PLAYWRIGHT_BROWSERS_PATH=${pkgs.playwright-driver.browsers}
-      export PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
-      # ENV PARITY with the Drone recipe-CI runner (canon DEFECT-3): the recipes + their tests shell
-      # out to host tooling (git-lfs for gitea, openssl, etc.). Drone's exec runner runs them with
-      # PATH=/run/current-system/sw/bin:/run/wrappers/bin; writeShellApplication otherwise gives a
-      # clean nix-only PATH, so the timer sweep silently lacked tools the recipes assume (a real fire
-      # caught git-lfs + bash gaps that manual ssh runs, with a login PATH, masked). Prepend the host
-      # system PATH so the sweep validates recipes in the SAME environment Drone does.
-      export PATH="/run/current-system/sw/bin:/run/wrappers/bin:$PATH"
       # canon M1.4: read enrollment + run the harness from the deployed checkout (has tests/).
       export CCCI_REPO=/etc/cc-ci
       cd "$CCCI_REPO"
-      exec ${pyEnv}/bin/python3 "$CCCI_REPO/runner/nightly_sweep.py"
+      exec cc-ci-run "$CCCI_REPO/runner/nightly_sweep.py"
     '';
   };
 in