Update llm-agents

Configure the Numtide substituter and signing key in the shared cache
settings and flake configuration so Codex can use prebuilt binaries.
Document the cache and retain the input’s tested nixpkgs pin.

AGENTS.md

@@ -35,7 +35,7 @@ see its help, or browse `devshell/commands.nix` / `devshell/install.nix` / `devs
 Common ones:
 - `fmt` — format Nix with `nixpkgs-fmt` (the canonical formatter here).
 - `build-system <host> [nix args]` — build a NixOS system's `toplevel`.
-- `build-n-switch <args>` — wraps `doas nixos-rebuild --flake .`.
+- `build-n-switch <args>` — wraps `doas nixos-rebuild --accept-flake-config --flake .`.
 - `build-home <name>` / `home-switch` — build / switch a home-manager config.
 - `run-vm <host>` — build & boot a system as a dev VM (installs `.keys/dev.key` into the VM).
 - `build-iso` / `build-kexec` / `build-netboot <host>` — alternate build outputs via `config.my.buildAs.*`.

devshell/commands.nix

@@ -106,7 +106,8 @@ in
         # HACK: Upstream changes in Git + Nix makes this necessary
         # https://github.com/NixOS/nix/issues/10202
         doas git config --global --add safe.directory "$PWD"
-        doas nixos-rebuild --flake . "$@"
+        # doas drops the devshell's NIX_USER_CONF_FILES, including accept-flake-config.
+        doas nixos-rebuild --accept-flake-config --flake . "$@"
       '';
     }
     {

docs/deployment.md

@@ -68,6 +68,10 @@ The shared GUI home-manager module installs Codex from the `llm-agents` input, r
 that input's tested nixpkgs pin. Run `nix flake update llm-agents`, then switch the system
 or home configuration to use the updated package.
 
+The shared cache settings in `lib.my.c.nix.cache` and the flake's `nixConfig` include
+the [Numtide binary cache](https://github.com/numtide/llm-agents.nix#binary-cache), so
+Codex can be downloaded prebuilt. Keep the input's tested nixpkgs pin to preserve cache hits.
+
 `programs.codex.mutableSettings` merges the declared status-line settings into the writable
 `~/.codex/config.toml` during activation. Declared values take precedence on each switch;
 other settings, including model selection, providers and project trust, remain imperative.
@@ -82,7 +86,7 @@ command with no arguments for its help. From
 |---|---|
 | `check-system <host> [nix args]` | Evaluates `.#nixosConfigurations."<host>".config.system.build.toplevel.drvPath` — catches module/option errors without building. Prefer this to validate a config change. |
 | `build-system <host> [nix args]` | Builds the system's `toplevel` (extra args pass through to `nix build`). |
-| `build-n-switch <args>` | `doas nixos-rebuild --flake .` (adds the repo as a git `safe.directory` for root first). |
+| `build-n-switch <args>` | `doas nixos-rebuild --accept-flake-config --flake .` (accepts the flake's cache settings and adds the repo as a git `safe.directory` for root first). |
 | `build-home <name> [nix args]` | Builds `.#homeConfigurations."<name>".activationPackage`. |
 | `home-switch [args]` | `home-manager switch --flake .`. |
 | `deploy [args]` | `deploy-rs --skip-checks` (wrapper package in `devshell/default.nix`). |
@@ -178,8 +182,8 @@ are unchanged, and the Determinate NixOS module is deliberately not imported.
   Determinate without further change.
 - **`accept-flake-config`.** Set true only in the devshell `nix.conf`, `.envrc` (as
   `--accept-flake-config`, for direnv) and CI — the contexts that build this flake — so its
-  `nixConfig` (the Harmonia cache) is trusted without an interactive prompt. It is deliberately not
+  `nixConfig` (the Harmonia and Numtide caches) is trusted without an interactive prompt. It is
-  set system-wide: boxes already trust that cache via `nix.settings`, so a global setting would only
+  deliberately not set system-wide: boxes already trust those caches via `nix.settings`, so a global setting would only
   blanket-trust every flake's `nixConfig` for no gain.
 
 ## Secrets

flake.lock

@@ -695,11 +695,11 @@
         "treefmt-nix": "treefmt-nix_2"
       },
       "locked": {
-        "lastModified": 1793267696,
+        "lastModified": 1793435943,
-        "narHash": "sha256-pU0HWLzBuoGIYLMIjoZNqiALCAUl9JwV6ujIyOZO3i4=",
+        "narHash": "sha256-kl4L50m8mMMyQLjH2d46ljtdzR+9vlgpoDmOrpNV/SU=",
         "owner": "numtide",
         "repo": "llm-agents.nix",
-        "rev": "e452052b9efb54fd59f8a06cbc09978fb542a3c2",
+        "rev": "b14f9d18b6d127221bd9f63817a40e1cca2b344b",
         "type": "github"
       },
       "original": {
@@ -919,11 +919,11 @@
     },
     "nixpkgs_6": {
       "locked": {
-        "lastModified": 1793225069,
+        "lastModified": 1793345420,
-        "narHash": "sha256-sx1f99WGrDfJ83KKuQrqGPmot0rnDgmpLJDzpU2oHQQ=",
+        "narHash": "sha256-e/yiZ31gXRROBDcnOtT3YwDQ73NVG9Cepccbt86LIn8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e62746b0b472753ef019baceab6f1e2e52014980",
+        "rev": "885ba4d038f10c3d17d7a92e8c3cc185b99c9158",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,16 +1,18 @@
 {
   description = "System configs";
 
-  # Offer our Harmonia cache when building the flake itself, so `nix develop` / `nix build` don't
+  # Offer our Harmonia and Numtide caches when building the flake, so `nix develop` / `nix build` don't
   # rebuild from source. Nix reads `nixConfig` before the flake evaluates and rejects any computed
   # value (imports/thunks), so these must stay literal — keep them in sync with `lib.my.c.nix.cache`.
   # Consumers must trust these (accept-flake-config / a trusted user) for them to take effect.
   nixConfig = {
     extra-substituters = [
       "https://nix-cache.nul.ie"
+      "https://cache.numtide.com"
     ];
     extra-trusted-public-keys = [
       "nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4="
+      "niks3.numtide.com-1:DTx8wZduET09hRmMtKdQDxNNthLQETkc/yaX7M4qK0g="
     ];
   };
 

lib/constants.nix

@@ -102,9 +102,11 @@ rec {
     cache = rec {
       substituters = [
         "https://nix-cache.${pubDomain}"
+        "https://cache.numtide.com"
       ];
       keys = [
         "nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4="
+        "niks3.numtide.com-1:DTx8wZduET09hRmMtKdQDxNNthLQETkc/yaX7M4qK0g="
       ];
       conf = ''
         extra-substituters = ${concatStringsSep " " substituters}