# REVIEW — phase `nixenv` (Adversary)

Phase plan: `/srv/cc-ci/cc-ci-plan/plan-phase-nixenv-shared-runtime-env.md`
SSOT for verification. Verdicts below; cold-runs only.

Status: **nixenv not yet started by Builder** as of 2026-06-17T17:11Z — no `STATUS-nixenv.md`,
no nixenv code commits. Settings phase closed `## DONE` @ dd6712c (M1+M2 PASS standing). Idle,
prepped, awaiting `claim(...)` for M1.

---

## Cold-prep — enumeration of the CURRENT (pre-refactor) declarations @ HEAD dd6712c

The M1 superset-or-equal proof must show the new shared set ⊇ the union of all of these. Captured
from the code (SSOT), independent of any Builder narrative:

**(A) `nix/modules/harness.nix` — `cc-ci-run` (Drone entrypoint) `runtimeInputs`:**
`pyEnv  abra  docker  git  coreutils  util-linux`
- `pyEnv = python3.withPackages [ pytest playwright ]`
- env: `PLAYWRIGHT_BROWSERS_PATH=${playwright-driver.browsers}`, `PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1`

**(B) `nix/modules/nightly-sweep.nix` — sweep `runtimeInputs`:**
`bash  abra  docker  git  curl  jq  gnused  gnugrep  gnutar  coreutils  util-linux  procps`
- DUPLICATE `pyEnv = python3.withPackages [ pytest playwright ]`
- same PLAYWRIGHT env
- DEFECT-3 patch: `export PATH="/run/current-system/sw/bin:/run/wrappers/bin:$PATH"` (host-PATH prepend)

**(C) Drone runner path — `nix/modules/drone-runner.nix`:**
`PATH = mkForce "/run/current-system/sw/bin:/run/wrappers/bin"` → recipe shell-outs resolve from
**host `environment.systemPackages`**, NOT a runtimeInputs list.

**(D) Host `systemPackages` (feeds C):**
- `nix/hosts/cc-ci/configuration.nix`:        `curl  git  jq  openssh`   ← **NO git-lfs**
- `nix/hosts/cc-ci-hetzner/configuration.nix`: `curl  git  git-lfs  jq  openssh`

### UNION the shared set must cover (≥):
`python3+pytest+playwright` (pyEnv) · playwright browsers · `abra docker git git-lfs coreutils
util-linux bash curl jq gnused gnugrep gnutar procps openssh`
Plan §2 also names `openssl` as a recipe shell-out → expect it present too.

### Pre-noted suspicions to break on M1/M2 (cold, not yet verdicts):
1. **Host divergence**: `cc-ci` config lacks `git-lfs` but `hetzner` has it. Which config is the
   LIVE `ssh cc-ci` server running, and does `git-lfs` actually resolve there today? If the shared
   set is applied to both host configs, cc-ci should GAIN git-lfs. Verify both configs end identical.
2. **Nothing dropped**: any token in the union missing from the shared set = blast-radius break.
3. **Sweep parity by construction**: plan wants sweep to invoke `cc-ci-run` (same entrypoint) — if
   it instead keeps a parallel list, "single source" is not actually achieved; grep must prove no
   module declares its own harness dep list.
4. **DEFECT-3 patch removal**: the host-PATH prepend should be gone/subsumed; if removed, git-lfs
   etc. must now come from the shared runtimeInputs, else the sweep regresses.
5. **Live witness**: gitea `test_lfs_roundtrip` must stay GREEN under BOTH Drone path and a real
   timer fire from the unified env.