Update llm-agents

Configure the Numtide substituter and signing key in the shared cache
settings and flake configuration so Codex can use prebuilt binaries.
Document the cache and retain the input’s tested nixpkgs pin.

AGENTS.md

@@ -35,7 +35,7 @@ see its help, or browse `devshell/commands.nix` / `devshell/install.nix` / `devs
 Common ones:
 - `fmt` — format Nix with `nixpkgs-fmt` (the canonical formatter here).
 - `build-system <host> [nix args]` — build a NixOS system's `toplevel`.
-- `build-n-switch <args>` — wraps `doas nixos-rebuild --flake .`.
+- `build-n-switch <args>` — wraps `doas nixos-rebuild --accept-flake-config --flake .`.
 - `build-home <name>` / `home-switch` — build / switch a home-manager config.
 - `run-vm <host>` — build & boot a system as a dev VM (installs `.keys/dev.key` into the VM).
 - `build-iso` / `build-kexec` / `build-netboot <host>` — alternate build outputs via `config.my.buildAs.*`.
@@ -116,6 +116,11 @@ Four pkgs sets are threaded everywhere as `pkgsFlakes` / `pkgs'` (and `hmFlakes`
 channel via `nixpkgs` / `home-manager` / `hmNixpkgs` options (e.g. `nixpkgs = "mine-stable"`).
 Modules receive `pkgs'` = an attrset of all channels for the current system.
 
+For options absent from older channels, omit the attribute with `optionalAttrs` guarded by
+the module's `options` argument. `mkIf false` still checks option existence. Add a `TODO`
+comment explaining which older release needs the guard and which release upgrade allows
+its removal, matching the existing release-gated TODOs.
+
 ### `lib.my` and the `my` option namespace
 `lib/default.nix` extends `lib` with a `my` attrset (helpers like `mkOpt'`, `mkBoolOpt'`,
 `mkDefault'`, `inlineModule'`, `mkDefaultSystemsPkgs`, `homeStateVersion`). It also pulls in:
@@ -187,6 +192,13 @@ in churn.
 
 ## Conventions
 
+- Prefer `jj` for status, diffs, history, commits, rebases and remote operations when it is
+  available and the checkout has a Jujutsu workspace. Use Git when `jj` is unavailable or the
+  checkout is Git-only, and for Git-specific tooling. The shared home config and devshell install
+  `jujutsu`; see [`docs/deployment.md#version-control`](docs/deployment.md#version-control) for
+  setup and the workflow. Inspect `jj status`, `jj diff` and `jj log` before editing; `jj`
+  snapshots working-copy changes automatically, so preserve existing user changes and use
+  explicit revisions when rewriting history or moving bookmarks.
 - Format with `nixpkgs-fmt` (`fmt`). 2-space indent, `inherit (...)` blocks at the top of `let` —
   prefer `inherit (lib) mkOption ...;` (and bare use) over qualifying inline as `lib.mkOption`.
   **Ask before running `fmt`** — some files aren't canonically formatted, so `fmt` can reindent a
@@ -212,11 +224,12 @@ in churn.
   command, option or upstream technical term such as QEMU's machine type.
 - Commit subjects follow `area/scope: Capitalized summary` (e.g. `nixos/home: ...`); keep logically
   distinct changes in separate commits. Aim for 50-character subjects and do not exceed 72
-  characters. Hard-wrap commit body lines at 72 characters; Git preserves an unwrapped `-m`
-  argument as one long line, so include literal line breaks or use a commit-message file. Before
-  reporting a commit, inspect `git show -s --format=%B HEAD` and amend it if any line exceeds 72
-  characters. A concise body describing the change and its rationale is welcome when the subject
-  alone does not provide enough context — keep it to the essentials rather than restating the diff.
+  characters. Hard-wrap commit body lines at 72 characters; `-m` preserves unwrapped text, so
+  include literal line breaks or use a commit-message file. Before reporting a commit, inspect
+  `jj log --no-graph -r <revision> -T description` (or `git show -s --format=%B HEAD` in a Git-only
+  checkout) and amend its description if any line exceeds 72 characters. A concise body describing
+  the change and its rationale is welcome when the subject alone does not provide enough context —
+  keep it to the essentials rather than restating the diff.
   `Co-Authored-By` is the only trailer used here; do **not** add a `Claude-Session` link (or any
   other session/tooling trailer).
 - **"Logically distinct" means unrelated** — two different applications, two boxes that have nothing

devshell/commands.nix

@@ -106,7 +106,8 @@ in
         # HACK: Upstream changes in Git + Nix makes this necessary
         # https://github.com/NixOS/nix/issues/10202
         doas git config --global --add safe.directory "$PWD"
-        doas nixos-rebuild --flake . "$@"
+        # doas drops the devshell's NIX_USER_CONF_FILES, including accept-flake-config.
+        doas nixos-rebuild --accept-flake-config --flake . "$@"
       '';
     }
     {

devshell/default.nix

@@ -32,5 +32,6 @@ in
       exec ${deploy-rs.deploy-rs}/bin/deploy --skip-checks "$@"
     '')
     home-manager
+    jujutsu
   ];
 }

docs/README.md

@@ -24,7 +24,7 @@ Not every box fits this pattern, but **colony** and **home** are organised this
   nixpkgs channels, shared module inventory.
 - [`networking.md`](networking.md) — network assignments, domains, site topologies, router HA,
   the AS211024 L2 mesh, BGP, WireGuard, Tailscale.
-- [`deployment.md`](deployment.md) — deploy-rs, devshell commands, secrets workflow, CI.
+- [`deployment.md`](deployment.md) — deploy-rs, devshell commands, `jj` workflow, secrets, CI.
 - [`nixpkgs-upgrade.md`](nixpkgs-upgrade.md) — guided procedure for the periodic upgrade of the four
   nixpkgs channels and home-manager (fork rebase, stable bumps, input review).
 - [`install-box.md`](install-box.md) — guided procedure for installing a new box, from the booted

docs/deployment.md

@@ -68,6 +68,10 @@ The shared GUI home-manager module installs Codex from the `llm-agents` input, r
 that input's tested nixpkgs pin. Run `nix flake update llm-agents`, then switch the system
 or home configuration to use the updated package.
 
+The shared cache settings in `lib.my.c.nix.cache` and the flake's `nixConfig` include
+the [Numtide binary cache](https://github.com/numtide/llm-agents.nix#binary-cache), so
+Codex can be downloaded prebuilt. Keep the input's tested nixpkgs pin to preserve cache hits.
+
 `programs.codex.mutableSettings` merges the declared status-line settings into the writable
 `~/.codex/config.toml` during activation. Declared values take precedence on each switch;
 other settings, including model selection, providers and project trust, remain imperative.
@@ -82,7 +86,7 @@ command with no arguments for its help. From
 |---|---|
 | `check-system <host> [nix args]` | Evaluates `.#nixosConfigurations."<host>".config.system.build.toplevel.drvPath` — catches module/option errors without building. Prefer this to validate a config change. |
 | `build-system <host> [nix args]` | Builds the system's `toplevel` (extra args pass through to `nix build`). |
-| `build-n-switch <args>` | `doas nixos-rebuild --flake .` (adds the repo as a git `safe.directory` for root first). |
+| `build-n-switch <args>` | `doas nixos-rebuild --accept-flake-config --flake .` (accepts the flake's cache settings and adds the repo as a git `safe.directory` for root first). |
 | `build-home <name> [nix args]` | Builds `.#homeConfigurations."<name>".activationPackage`. |
 | `home-switch [args]` | `home-manager switch --flake .`. |
 | `deploy [args]` | `deploy-rs --skip-checks` (wrapper package in `devshell/default.nix`). |
@@ -120,6 +124,43 @@ VM's unix sockets from `/run/vms/<vm>/` on `<host>` over SSH):
 | `vm-monitor <host> <vm>` | QEMU monitor socket in `minicom`. |
 | `vm-viewer <host> <vm>` | SPICE display in `virt-viewer` (not on Darwin). |
 
+## Version control
+
+The shared [Home Manager module](../home-manager/modules/common.nix) enables `programs.git`
+and `programs.jujutsu`, including Git LFS and `diff-so-fancy`, for graphical and non-graphical
+homes. Jujutsu uses the identity declared in `programs.git.settings.user`; Home Manager writes
+its `jj/config.toml`. The [devshell](../devshell/default.nix) also installs `jujutsu`, which
+provides `jj`. Prefer `jj` when it is available and the checkout has a Jujutsu workspace;
+use Git for Git-only checkouts and Git-specific tooling such as the installer-tag command
+and CI scripts.
+
+To use an existing Git checkout with both tools, run `jj git init --colocate` at its root.
+This creates local `.jj` metadata and keeps `.git` for Nix flake source discovery and existing
+Git tooling. Switch the home configuration to install the managed identity. When using only
+the devshell, configure your identity with `jj config set --user user.name '<name>'` and
+`jj config set --user user.email '<email>'` before creating commits.
+
+| Task | Command |
+|---|---|
+| Inspect the working copy and history | `jj status`, `jj diff`, `jj log` |
+| Describe the current change | `jj describe -m 'area/scope: Capitalized summary'` |
+| Start the next change | `jj new` |
+| Inspect a completed description | `jj log --no-graph -r <revision> -T description` |
+| Fetch remote history | `jj git fetch` |
+| Name a revision for publishing | `jj bookmark create <name> -r <revision>` |
+| Move an existing bookmark | `jj bookmark set <name> -r <revision>` |
+| Publish a bookmark | `jj git push --bookmark <name>` |
+
+`@` is the working-copy revision; after `jj new`, the completed change is normally `@-`.
+Working-copy edits are snapshotted automatically, without a staging step. Inspect existing
+changes before editing, keep unrelated work separate, and check the target revision before
+rewriting history or moving a bookmark. Follow the commit-message conventions in
+[`AGENTS.md`](../AGENTS.md#conventions).
+
+See the upstream [Jujutsu CLI reference](https://docs.jj-vcs.dev/latest/cli-reference/)
+for command options and [Git compatibility](https://docs.jj-vcs.dev/latest/git-compatibility/)
+for colocation details.
+
 ## Nix implementation
 
 Every context uses **Determinate Nix** as its `nix.package`, for its performance features
@@ -141,8 +182,8 @@ are unchanged, and the Determinate NixOS module is deliberately not imported.
   Determinate without further change.
 - **`accept-flake-config`.** Set true only in the devshell `nix.conf`, `.envrc` (as
   `--accept-flake-config`, for direnv) and CI — the contexts that build this flake — so its
-  `nixConfig` (the Harmonia cache) is trusted without an interactive prompt. It is deliberately not
-  set system-wide: boxes already trust that cache via `nix.settings`, so a global setting would only
+  `nixConfig` (the Harmonia and Numtide caches) is trusted without an interactive prompt. It is
+  deliberately not set system-wide: boxes already trust those caches via `nix.settings`, so a global setting would only
   blanket-trust every flake's `nixConfig` for no gain.
 
 ## Secrets

flake.lock

@@ -695,11 +695,11 @@
         "treefmt-nix": "treefmt-nix_2"
       },
       "locked": {
-        "lastModified": 1791001326,
-        "narHash": "sha256-pwJhtpRcNX1pJ9luUy3Eh1EYUFsZjv5m2xSqZ1hEhMU=",
+        "lastModified": 1793435943,
+        "narHash": "sha256-kl4L50m8mMMyQLjH2d46ljtdzR+9vlgpoDmOrpNV/SU=",
         "owner": "numtide",
         "repo": "llm-agents.nix",
-        "rev": "83984ebbbe5322b261d9fdc24eb15cf44f23abec",
+        "rev": "b14f9d18b6d127221bd9f63817a40e1cca2b344b",
         "type": "github"
       },
       "original": {
@@ -919,11 +919,11 @@
     },
     "nixpkgs_6": {
       "locked": {
-        "lastModified": 1790600678,
-        "narHash": "sha256-6k3n7X2UsZ6tAlWTz99RimiZab+17tMUrw9sRUcELiA=",
+        "lastModified": 1793345420,
+        "narHash": "sha256-e/yiZ31gXRROBDcnOtT3YwDQ73NVG9Cepccbt86LIn8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f45c6f04c2f013f004bf94e284e95d72898d9393",
+        "rev": "885ba4d038f10c3d17d7a92e8c3cc185b99c9158",
         "type": "github"
       },
       "original": {
@@ -1163,11 +1163,11 @@
     },
     "systems_6": {
       "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "lastModified": 1791244623,
+        "narHash": "sha256-uuanbkFk8a313Zfrxdcz8Us/yQtaxNnKJtX8v0ZPpd8=",
         "owner": "nix-systems",
         "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "rev": "d36eeed142f88b5a636f2e3856a53c61654cf29b",
         "type": "github"
       },
       "original": {
@@ -1250,11 +1250,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1786901030,
-        "narHash": "sha256-WSFCsDSE5ffgD2MqzkM2CYjeFiKhRF/dJUN8uedb6YE=",
+        "lastModified": 1791885023,
+        "narHash": "sha256-C3alQ2MEt0zVrUSho5NUDo3jmhbff72++bfwoqT9Omo=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "27b3b12a8e6375f28ebe122f07d230ca5459bbfa",
+        "rev": "0d6d739a833ba9a9c93034862e4a7b061a062a1c",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,16 +1,18 @@
 {
   description = "System configs";
 
-  # Offer our Harmonia cache when building the flake itself, so `nix develop` / `nix build` don't
+  # Offer our Harmonia and Numtide caches when building the flake, so `nix develop` / `nix build` don't
   # rebuild from source. Nix reads `nixConfig` before the flake evaluates and rejects any computed
   # value (imports/thunks), so these must stay literal — keep them in sync with `lib.my.c.nix.cache`.
   # Consumers must trust these (accept-flake-config / a trusted user) for them to take effect.
   nixConfig = {
     extra-substituters = [
       "https://nix-cache.nul.ie"
+      "https://cache.numtide.com"
     ];
     extra-trusted-public-keys = [
       "nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4="
+      "niks3.numtide.com-1:DTx8wZduET09hRmMtKdQDxNNthLQETkc/yaX7M4qK0g="
     ];
   };
 

home-manager/modules/common.nix

@@ -67,6 +67,24 @@ in
         # never care about.
         home-manager.enable = true;
 
+        git = {
+          enable = true;
+          settings = {
+            user = {
+              email = "jackos1998@gmail.com";
+              name = "Jack O'Sullivan";
+            };
+            pull.rebase = true;
+          };
+          lfs.enable = true;
+        };
+        diff-so-fancy.enable = true;
+
+        jujutsu = {
+          enable = true;
+          settings.user = config.programs.git.settings.user;
+        };
+
         lsd = {
           enable = mkDefault true;
           enableFishIntegration = mkDefault true;
@@ -202,6 +220,7 @@ in
           file
           tree
           pwgen
+          python3
 
           minicom
           iperf3

home-manager/modules/gui/default.nix

@@ -1,6 +1,6 @@
-{ lib, pkgs', pkgs, inputs, config, ... }:
+{ lib, pkgs', pkgs, inputs, config, options, ... }:
 let
-  inherit (lib) genAttrs mkIf mkMerge mkForce mapAttrs mkOptionDefault mkDefault optional;
+  inherit (lib) genAttrs mkIf mkMerge mkForce mapAttrs mkOptionDefault mkDefault optional optionalAttrs;
   inherit (lib.my) mkOpt' mkBoolOpt';
   inherit (lib.my.c) pubDomain;
 
@@ -84,7 +84,7 @@ in
 
             grim
             slurp
-            swappy
+            satty
 
             python3Packages.python-lsp-server
             nil # nix language server
@@ -187,10 +187,11 @@ in
             };
           };
 
+          # TODO: Remove mutableSettings guard when Home Manager 26.11 releases; 26.05 lacks it.
           codex = {
             enable = true;
             package = inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.codex;
-            mutableSettings = true;
+            settings.sandbox_workspace_write.network_access = true;
             settings.tui = {
               status_line = [
                 "model-with-reasoning"
@@ -205,6 +206,8 @@ in
               ];
               status_line_use_colors = true;
             };
+          } // optionalAttrs (options.programs.codex ? mutableSettings) {
+            mutableSettings = true;
           };
 
           claude-code = {
@@ -407,8 +410,8 @@ in
                   "${mod}+Shift+n" = "exec ${clearWsName}";
 
                   # Screenshots
-                  "${mod}+Shift+d" = ''exec grim - | swappy -f -'';
-                  "${mod}+Shift+s" = ''exec grim -g "$(slurp)" - | swappy -f -'';
+                  "${mod}+Shift+d" = ''exec grim - | satty -f -'';
+                  "${mod}+Shift+s" = ''exec grim -g "$(slurp)" - | satty -f -'';
 
                   "XF86MonBrightnessDown" = "exec ${pkgs.brightnessctl}/bin/brightnessctl set 5%-";
                   "XF86MonBrightnessUp" = "exec ${pkgs.brightnessctl}/bin/brightnessctl set +5%";
@@ -505,19 +508,6 @@ in
         };
 
         programs = {
-          git = {
-            enable = true;
-            settings = {
-              user = {
-                email = "jackos1998@gmail.com";
-                name = "Jack O'Sullivan";
-              };
-              pull.rebase = true;
-            };
-            lfs.enable = true;
-          };
-          diff-so-fancy.enable = true;
-
           waybar = import ./waybar.nix { inherit lib pkgs config font; };
           rofi = {
             enable = true;

lib/constants.nix

@@ -102,9 +102,11 @@ rec {
     cache = rec {
       substituters = [
         "https://nix-cache.${pubDomain}"
+        "https://cache.numtide.com"
       ];
       keys = [
         "nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4="
+        "niks3.numtide.com-1:DTx8wZduET09hRmMtKdQDxNNthLQETkc/yaX7M4qK0g="
       ];
       conf = ''
         extra-substituters = ${concatStringsSep " " substituters}

nixos/modules/common.nix

@@ -147,6 +147,7 @@ in
         [
           bash-completion
           git
+          python3
           unzip
           tcpdump
         ]