asepharyana
4cb4904517
Root causes found by reproducing the 2026-08-10 run:
- attic 'gmw' cache was created private -> every narinfo/nix-cache-info
read returned 401, so the VPS could never actually substitute from
attic ('Substituted from Attic cache' was a false positive when the
store path happened to be already present locally).
- VPS nix.conf used extra-trusted-substituters, which Determinate Nix
never merges for nix-store CLI clients; extra-substituters (all
users, no trust gate) fixes substitution (verified end-to-end:
delete path -> nix-store --realise pulls from attic over HTTPS).
- runner bootstrap of the attic client depended on nix copy --from
ssh:// (fragile, failed on runner); now the prebuilt attic client
closure lives in the attic cache itself and the runner pulls it over
HTTPS via extra-substituters configured in the Install Nix step.
Also surfaces bootstrap stderr on fallback for future debugging.