@celilo/cli 1.13.0 → 2.0.0

package/src/services/backup-restore.ts

@@ -30,6 +30,7 @@ import {
   refuseIfInFlight,
   startOperation,
 } from './module-operations';
+import { remoteAccessPolicy } from './remote-access';
 
 export interface RestoreResult {
   success: boolean;
@@ -288,6 +289,7 @@ export async function restoreModuleBackup(
       {
         debug: false,
         systems: getModuleSystems(backup.moduleId, db),
+        remoteAccess: remoteAccessPolicy(backup.moduleId, db),
       },
     );
 

package/src/services/celilo-mgmt-hooks.test.ts

@@ -1,19 +1,3 @@
-/**
- * Behavior tests for the celilo-mgmt module's on_backup / on_restore
- * hooks (Phase 3 of openspec/specs/management-server-backup/spec.md).
- *
- * We import the hook scripts directly and call their handlers with a
- * synthesized HookContext, then assert on the side-effects (files
- * written to backup_dir / restore staging dirs). This catches
- * regressions in the hook bodies without spinning up the full
- * deploy/backup pipeline.
- *
- * What this DOESN'T test: invokeHook validation, end-to-end backup
- * envelope round-trip. Those live in backup-envelope-roundtrip.test.ts
- * and (eventually) a fresh-box e2e.
- */
-
-import { Database } from 'bun:sqlite';
 import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
@@ -82,13 +66,13 @@ describe.skipIf(skipIntegration({ tools: ['wg'] }))('celilo-mgmt on_backup', ()
   let dir: string;
   let backupDir: string;
   let crossModuleRoot: string;
-  let dbPath: string;
-  let keyPath: string;
+  let systemStateRoot: string;
 
   beforeEach(() => {
     dir = mkdtempSync(join(tmpdir(), 'celilo-mgmt-backup-test-'));
     backupDir = join(dir, 'backup-dir');
     mkdirSync(backupDir, { recursive: true });
+
     crossModuleRoot = join(dir, 'cross-module-root');
     mkdirSync(join(crossModuleRoot, 'modules', 'caddy', 'terraform'), { recursive: true });
     writeFileSync(
@@ -104,25 +88,20 @@ describe.skipIf(skipIntegration({ tools: ['wg'] }))('celilo-mgmt on_backup', ()
       }),
     );
 
-    dbPath = join(dir, 'celilo.db');
-    // A REAL (minimal) SQLite DB. on_backup snapshots it via bun:sqlite
-    // serialize(), which requires a valid database file — a plain byte blob
-    // makes the serializer read a garbage page count and OOM. One table with a
-    // row is enough to exercise the snapshot path.
-    const seed = new Database(dbPath);
-    seed.run('CREATE TABLE backup_probe (id INTEGER PRIMARY KEY, v TEXT)');
-    seed.run("INSERT INTO backup_probe (v) VALUES ('hello')");
-    seed.close();
-    process.env.CELILO_DB_PATH = dbPath;
-
-    keyPath = join(dir, 'master.key');
-    writeFileSync(keyPath, 'fake-master-key-32-bytes-padding!');
-    process.env.CELILO_MASTER_KEY_PATH = keyPath;
+    // celilo's own state, as the framework stages it before invoking the hook
+    // (services/system-state-stage.ts). The hook reads nothing outside this
+    // directory and cross_module_root — that is what design D9b bought, and
+    // it is why there is no CELILO_DB_PATH or master.key on disk here.
+    systemStateRoot = join(dir, 'system-state');
+    mkdirSync(join(systemStateRoot, 'ssh'), { recursive: true });
+    mkdirSync(join(systemStateRoot, 'module_src', 'caddy'), { recursive: true });
+    writeFileSync(join(systemStateRoot, 'celilo.db'), 'SQLite format 3\u0000snapshot');
+    writeFileSync(join(systemStateRoot, 'master.key'), 'fake-master-key-32-bytes-padding!');
+    writeFileSync(join(systemStateRoot, 'ssh', 'id_ed25519'), 'PRIVATE');
+    writeFileSync(join(systemStateRoot, 'module_src', 'caddy', 'manifest.yml'), 'id: caddy');
   });
 
   afterEach(() => {
-    process.env.CELILO_DB_PATH = undefined;
-    process.env.CELILO_MASTER_KEY_PATH = undefined;
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -130,16 +109,20 @@ describe.skipIf(skipIntegration({ tools: ['wg'] }))('celilo-mgmt on_backup', ()
     }
   });
 
-  it('writes celilo.db, master.key, machine-pool.json, and cross_module_state into backup_dir', async () => {
+  it('lays the staged celilo state into backup_dir alongside the cross-module state', async () => {
     const { default: hook } = await import(`${HOOK_DIR}/on_backup.ts`);
-    const ctx = buildContext({
-      backup_dir: backupDir,
-      cross_module_root: crossModuleRoot,
-    });
-    const result = (await hook(ctx)) as BackupHookOutput;
+    const result = (await hook(
+      buildContext({
+        backup_dir: backupDir,
+        cross_module_root: crossModuleRoot,
+        system_state_root: systemStateRoot,
+      }),
+    )) as BackupHookOutput;
 
     expect(existsSync(join(backupDir, 'celilo.db'))).toBe(true);
     expect(existsSync(join(backupDir, 'master.key'))).toBe(true);
+    expect(existsSync(join(backupDir, 'ssh', 'id_ed25519'))).toBe(true);
+    expect(existsSync(join(backupDir, 'module_src', 'caddy', 'manifest.yml'))).toBe(true);
     expect(existsSync(join(backupDir, 'machine-pool.json'))).toBe(true);
     expect(
       existsSync(
@@ -153,39 +136,27 @@ describe.skipIf(skipIntegration({ tools: ['wg'] }))('celilo-mgmt on_backup', ()
     expect(result.size_bytes).toBeGreaterThan(0);
   });
 
-  it('captures LEAN module source (excludes generated/, node_modules/, large build artifacts)', async () => {
-    // stateDir = dirname(db_path) = dir; on_backup reads dir/modules/<id>.
-    const modSrc = join(dir, 'modules', 'caddy');
-    mkdirSync(join(modSrc, 'scripts', 'node_modules', '@celilo'), { recursive: true });
-    mkdirSync(join(modSrc, 'generated', 'terraform'), { recursive: true });
-    mkdirSync(join(modSrc, 'ansible', 'files'), { recursive: true });
-    writeFileSync(join(modSrc, 'manifest.yml'), 'id: caddy');
-    writeFileSync(join(modSrc, 'scripts', 'hook.ts'), '// hook');
-    writeFileSync(join(modSrc, 'generated', 'terraform', 'main.tf'), 'resource {}');
-    writeFileSync(join(modSrc, 'scripts', 'node_modules', '@celilo', 'dep.js'), '// vendored');
-    // A >2MB "compiled binary" sitting in source — must be skipped by size.
-    writeFileSync(join(modSrc, 'ansible', 'files', 'server-bin'), Buffer.alloc(3 * 1024 * 1024));
-
+  it('refuses when the framework did not stage celilo state', async () => {
     const { default: hook } = await import(`${HOOK_DIR}/on_backup.ts`);
-    await hook(buildContext({ backup_dir: backupDir, cross_module_root: crossModuleRoot }));
 
-    // Source files captured...
-    expect(existsSync(join(backupDir, 'module_src', 'caddy', 'manifest.yml'))).toBe(true);
-    expect(existsSync(join(backupDir, 'module_src', 'caddy', 'scripts', 'hook.ts'))).toBe(true);
-    // ...but build/vendored content excluded (keeps the backup small enough to
-    // not OOM the in-memory tar+encrypt — turnip's full dirs were ~1.6GB).
-    expect(existsSync(join(backupDir, 'module_src', 'caddy', 'generated'))).toBe(false);
-    expect(existsSync(join(backupDir, 'module_src', 'caddy', 'scripts', 'node_modules'))).toBe(
-      false,
-    );
+    // Silence is the dangerous outcome here. Without the DB and the master
+    // key an envelope restores to nothing, and a hook that shrugged and
+    // returned success would report artifact_count > 0 for the machine-pool
+    // and cross-module files alone. Found at restore, which is too late.
     expect(
-      existsSync(join(backupDir, 'module_src', 'caddy', 'ansible', 'files', 'server-bin')),
-    ).toBe(false);
+      hook(buildContext({ backup_dir: backupDir, cross_module_root: crossModuleRoot })),
+    ).rejects.toThrow(/system_state_root was not provided/);
   });
 
   it('machine-pool.json is valid JSON (array)', async () => {
     const { default: hook } = await import(`${HOOK_DIR}/on_backup.ts`);
-    await hook(buildContext({ backup_dir: backupDir, cross_module_root: crossModuleRoot }));
+    await hook(
+      buildContext({
+        backup_dir: backupDir,
+        cross_module_root: crossModuleRoot,
+        system_state_root: systemStateRoot,
+      }),
+    );
 
     const machinePool = JSON.parse(readFileSync(join(backupDir, 'machine-pool.json'), 'utf-8'));
     expect(Array.isArray(machinePool)).toBe(true);
@@ -194,25 +165,13 @@ describe.skipIf(skipIntegration({ tools: ['wg'] }))('celilo-mgmt on_backup', ()
   it('proceeds (with a warning) when cross_module_root is missing', async () => {
     const { default: hook } = await import(`${HOOK_DIR}/on_backup.ts`);
     const result = (await hook(
-      buildContext({ backup_dir: backupDir }), // no cross_module_root
+      buildContext({ backup_dir: backupDir, system_state_root: systemStateRoot }),
     )) as BackupHookOutput;
 
     expect(existsSync(join(backupDir, 'celilo.db'))).toBe(true);
     expect(existsSync(join(backupDir, 'cross_module_state'))).toBe(false);
     expect(result.schema_version).toBe('1.1');
   });
-
-  it('proceeds (with a warning) when master.key is missing on disk', async () => {
-    rmSync(keyPath);
-    const { default: hook } = await import(`${HOOK_DIR}/on_backup.ts`);
-    const result = (await hook(
-      buildContext({ backup_dir: backupDir, cross_module_root: crossModuleRoot }),
-    )) as BackupHookOutput;
-
-    expect(existsSync(join(backupDir, 'master.key'))).toBe(false);
-    expect(existsSync(join(backupDir, 'celilo.db'))).toBe(true);
-    expect(result.artifact_count).toBeGreaterThan(0);
-  });
 });
 
 describe.skipIf(skipIntegration({ tools: ['wg'] }))('celilo-mgmt on_restore', () => {

package/src/services/deploy-ansible.ts

@@ -138,7 +138,7 @@ function parseAnsibleLine(line: string): string | null {
  */
 export async function executeAnsible(
   generatedPath: string,
-  options?: { noInteractive?: boolean; check?: boolean },
+  options?: { noInteractive?: boolean; check?: boolean; tags?: string[] },
 ): Promise<AnsibleResult> {
   const ansibleDir = join(generatedPath, 'ansible');
   const inventoryPath = join(ansibleDir, 'inventory', 'hosts.ini');
@@ -166,6 +166,14 @@ export async function executeAnsible(
         // stored record of the host (celilo#902 design D6). One argument, not a
         // second execution path — everything else about the run is identical.
         ...(options?.check ? ['--check'] : []),
+        // `--tags` scopes the run to the tagged tasks. The static-content
+        // converge uses it (capability-owned-tables D10): the full playbook
+        // re-templates the bootstrap Caddyfile, which would overwrite the
+        // REAL config the provider's reconcile wrote to disk and reload caddy
+        // into serving nothing. A publish converge must touch /srv/www and
+        // nothing else. An unscoped run (the deploy) still executes every
+        // untagged task alongside the tagged ones.
+        ...(options?.tags?.length ? ['--tags', options.tags.join(',')] : []),
         shellEscape(playbookPath),
       ],
       cwd: ansibleDir,

package/src/services/fleet-key.test.ts

@@ -0,0 +1,47 @@
+/**
+ * celilo's fleet SSH keypair, minted by the framework rather than by
+ * celilo-mgmt's on_install (design D9b of
+ * openspec/changes/hook-process-boundary).
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { ensureFleetKey, getFleetSshDir } from './fleet-key';
+
+describe('ensureFleetKey', () => {
+  let dataDir: string;
+
+  beforeEach(() => {
+    dataDir = mkdtempSync(join(tmpdir(), 'celilo-fleet-key-'));
+    process.env.CELILO_DB_PATH = join(dataDir, 'celilo.db');
+  });
+
+  afterEach(() => {
+    process.env.CELILO_DB_PATH = undefined;
+    rmSync(dataDir, { recursive: true, force: true });
+  });
+
+  it('mints an ed25519 keypair next to the DB and returns the public half', () => {
+    const key = ensureFleetKey();
+
+    expect(key.created).toBe(true);
+    expect(key.publicKey.startsWith('ssh-ed25519 ')).toBe(true);
+    expect(existsSync(join(dataDir, '.ssh', 'id_ed25519'))).toBe(true);
+    expect(readFileSync(join(dataDir, '.ssh', 'id_ed25519.pub'), 'utf-8').trim()).toBe(
+      key.publicKey,
+    );
+    expect(getFleetSshDir()).toBe(join(dataDir, '.ssh'));
+  });
+
+  it('reuses an existing key instead of re-keying', () => {
+    const first = ensureFleetKey();
+    const second = ensureFleetKey();
+
+    // Re-keying would strand every machine whose authorized_keys holds the
+    // old public half, and a redeploy calls this every time.
+    expect(second.created).toBe(false);
+    expect(second.publicKey).toBe(first.publicKey);
+  });
+});

package/src/services/fleet-key.ts

@@ -0,0 +1,75 @@
+/**
+ * celilo's fleet SSH keypair — the key celilo authenticates to managed
+ * machines with. The DB carries only the public half (`ssh.public_key`);
+ * the private half lives on disk and never leaves the management box.
+ *
+ * It used to be minted by celilo-mgmt's `on_install`, which derived
+ * `dirname(config.db_path)` and wrote into celilo's data directory from
+ * inside a module hook. That is a write into the one directory the hook
+ * jail exists to keep out of the mount set
+ * (openspec/changes/hook-process-boundary, design D9b): staging covers
+ * copies OUT of celilo's state, and nothing covers writes IN.
+ *
+ * So minting moved here. celilo owns the key's lifecycle, and "create it
+ * if absent" wants to be idempotent and tested once rather than in each
+ * module that reaches for it.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { getDbPath } from '../config/paths';
+
+/**
+ * Where the fleet keypair lives.
+ *
+ * Next to the DB, not under `getDataDir()`. Those are the same directory
+ * on a deb install (`CELILO_DATA_DIR=/var/celilo`, db at
+ * `/var/celilo/celilo.db`) and differ only when `CELILO_DB_PATH` points
+ * somewhere custom. Following the DB is what `on_install` did, so it is
+ * where every existing box's key already sits, and restore has followed
+ * the same rule since it was written (`applyStagedSystemFiles`).
+ *
+ * One exported helper rather than two hand-derived joins is the point:
+ * mint and restore can no longer drift to different directories.
+ */
+export function getFleetSshDir(): string {
+  return join(dirname(getDbPath()), '.ssh');
+}
+
+export interface FleetKey {
+  /** The public half, as it goes into `ssh.public_key` and authorized_keys. */
+  publicKey: string;
+  /** True when this call minted the key; false when it was already there. */
+  created: boolean;
+}
+
+/**
+ * Ensure the fleet keypair exists and return its public half.
+ *
+ * Idempotent: an existing key is reused, never regenerated. Re-keying
+ * would silently strand every machine whose authorized_keys holds the old
+ * public half, and a redeploy must not do that.
+ *
+ * Permissions are left to `mkdirSync`'s mode and to ssh-keygen, which
+ * `fchmod`s the private half to 0600 itself. An explicit chmod pass was
+ * written here first and then removed: umask only ever REMOVES mode bits, so
+ * neither the directory nor the key can come out wider than asked for, and no
+ * test could be made to fail without it.
+ */
+export function ensureFleetKey(): FleetKey {
+  const sshDir = getFleetSshDir();
+  const keyPath = join(sshDir, 'id_ed25519');
+  const publicKeyPath = `${keyPath}.pub`;
+
+  if (existsSync(publicKeyPath)) {
+    return { publicKey: readFileSync(publicKeyPath, 'utf-8').trim(), created: false };
+  }
+
+  mkdirSync(sshDir, { recursive: true, mode: 0o700 });
+  execFileSync('ssh-keygen', ['-t', 'ed25519', '-N', '', '-f', keyPath, '-C', 'celilo-fleet'], {
+    stdio: 'pipe',
+  });
+
+  return { publicKey: readFileSync(publicKeyPath, 'utf-8').trim(), created: true };
+}

package/src/services/health-runner.ts

@@ -18,6 +18,7 @@ import type { ModuleManifest } from '../manifest/schema';
 import { decryptSecret } from '../secrets/encryption';
 import { getOrCreateMasterKey } from '../secrets/master-key';
 import { getModuleSystems } from './deployed-systems';
+import { remoteAccessPolicy } from './remote-access';
 
 export interface HealthCheckItem {
   name: string;
@@ -196,6 +197,7 @@ export async function runModuleHealthCheck(
       capabilities: capabilityFunctions,
       requiredCapabilities,
       systems: getModuleSystems(moduleId, db),
+      remoteAccess: remoteAccessPolicy(moduleId, db),
     },
   );
   presentation.finish(hookResult.success);

package/src/services/module-build.test.ts

@@ -1,8 +1,7 @@
-import { afterEach, beforeEach, describe, expect, spyOn, test } from 'bun:test';
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
 import { existsSync } from 'node:fs';
 import { mkdir, rm, writeFile } from 'node:fs/promises';
 import { eq } from 'drizzle-orm';
-import { log } from '../cli/prompts';
 import { type DbClient, createDbClient } from '../db/client';
 import { moduleBuilds, modules } from '../db/schema';
 import { skipIntegration } from '../test-utils/integration-guard';
@@ -40,7 +39,6 @@ describe('Module Build Service', () => {
         version TEXT NOT NULL,
         built_at INTEGER NOT NULL DEFAULT (unixepoch()),
         artifacts TEXT NOT NULL,
-        environment TEXT,
         status TEXT NOT NULL,
         build_log TEXT,
         FOREIGN KEY (module_id) REFERENCES modules(id) ON DELETE CASCADE
@@ -98,65 +96,6 @@ describe('Module Build Service', () => {
       expect(result.error).toContain('does not have a build section');
     });
 
-    test('should detect Nix environment from flake.nix', async () => {
-      // Create test module directory with flake.nix
-      await mkdir(TEST_MODULE_DIR, { recursive: true });
-      await mkdir(`${TEST_MODULE_DIR}/build`, { recursive: true });
-      await writeFile(`${TEST_MODULE_DIR}/flake.nix`, '# Nix flake');
-      await writeFile(
-        `${TEST_MODULE_DIR}/build/playbook.yml`,
-        `---
-- name: Test build
-  hosts: localhost
-  gather_facts: false
-  tasks:
-    - name: Debug message
-      ansible.builtin.debug:
-        msg: "Nix build test"
-`,
-      );
-
-      db.insert(modules)
-        .values({
-          id: 'nix-module',
-          name: 'Nix Module',
-          version: '1.0.0',
-          sourcePath: TEST_MODULE_DIR,
-          manifestData: {
-            id: 'nix-module',
-            name: 'Nix Module',
-            version: '1.0.0',
-            build: {
-              script: 'build/playbook.yml',
-            },
-          },
-        })
-        .run();
-
-      // Mock log.info / log.warn to capture output (module-build.ts now
-      // routes through these instead of console.log so output flows through
-      // the active ProgressDisplay during a real deploy).
-      const logInfoSpy = spyOn(log, 'info').mockImplementation(() => {});
-      const logWarnSpy = spyOn(log, 'warn').mockImplementation(() => {});
-
-      const _result = await buildModuleFromSource('nix-module', db);
-
-      // Verify Nix detection or fallback message was logged
-      // If nix is available: "Entering Nix environment"
-      // If nix not available: "flake.nix detected but nix command not available"
-      const calls = [...logInfoSpy.mock.calls, ...logWarnSpy.mock.calls].map((c) => c[0]);
-      const hasNixMessage = calls.some(
-        (msg) => msg.includes('Nix environment') || msg.includes('flake.nix detected'),
-      );
-      expect(hasNixMessage).toBe(true);
-
-      logInfoSpy.mockRestore();
-      logWarnSpy.mockRestore();
-
-      // Build result depends on whether Nix is installed
-      // We're just testing that detection happens (message logged)
-    }, 10000); // 10 second timeout
-
     test.skipIf(skipIntegration({ tools: ['ansible'] }))(
       'should record build metadata in database',
       async () => {
@@ -208,7 +147,6 @@ describe('Module Build Service', () => {
         expect(buildRecord?.moduleId).toBe('record-test');
         expect(buildRecord?.version).toBe('1.0.0');
         expect(buildRecord?.status).toBe('success');
-        expect(buildRecord?.environment).toBe('system'); // No flake.nix
       },
       10000,
     ); // 10 second timeout for ansible execution
@@ -282,7 +220,6 @@ describe('Module Build Service', () => {
           artifacts: ['/path/to/artifact'],
           status: 'success',
           buildLog: 'Build completed',
-          environment: 'nix',
         })
         .run();
 

package/src/services/module-build.ts

@@ -1,7 +1,7 @@
 /**
  * Module Build Service
  *
- * Executes module build scripts (Ansible playbooks) in Nix environments
+ * Executes module build scripts (Ansible playbooks)
  * to compile custom software binaries before deployment.
  *
  * Example: Caddy with RFC2136 DNS provider
@@ -40,65 +40,26 @@ export interface BuildStatusRecord {
   buildLog?: string;
 }
 
-/**
- * Detect if module uses Nix environment
- * Policy function - checks for flake.nix existence
- *
- * @param modulePath - Path to module directory
- * @returns True if flake.nix exists
- */
-function detectNixEnvironment(modulePath: string): boolean {
-  const flakePath = `${modulePath}/flake.nix`;
-  return existsSync(flakePath);
-}
-
-/**
- * Check if nix command is available
- * Policy function - validates nix availability
- *
- * @returns True if nix command can be executed
- */
-async function isNixAvailable(): Promise<boolean> {
-  const { spawn } = await import('node:child_process');
-
-  return new Promise((resolve) => {
-    const child = spawn('nix', ['--version'], {
-      stdio: 'ignore',
-    });
-
-    child.on('close', (code) => {
-      resolve(code === 0);
-    });
-
-    child.on('error', () => {
-      resolve(false);
-    });
-  });
-}
-
 /**
  * Execute build playbook with streaming progress
  * Execution function - runs ansible-playbook with fuel-gauge progress indicator
  *
  * @param modulePath - Path to module directory
- * @param playbookPath - Path to build playbook (relative to module)
- * @param useNix - Whether to run inside Nix environment
+ * @param commandStr - Build command to execute
  * @returns Build result with output
  */
 async function executeBuildCommand(
   modulePath: string,
   commandStr: string,
-  useNix: boolean,
 ): Promise<{ success: boolean; output: string; error?: string }> {
   const { executeBuildWithProgress } = await import('./build-stream');
-  const { shellEscape } = await import('../utils/shell');
 
   // build-stream passes through `shell: true`, so spawn re-wraps everything in
   // `/bin/sh -c`. If we sent ['bash', '-c', commandStr] as command+args, sh
   // would re-parse the join — `&&` outside the inner quotes splits the chain
   // and `bun install` runs in modulePath instead of the cd'd subdir. Pass the
   // full command as one string so sh -c gets a single, unsplit shell command.
-  const command = useNix ? `nix develop --command bash -c ${shellEscape(commandStr)}` : commandStr;
+  const command = commandStr;
 
   const result = await executeBuildWithProgress({
     command,
@@ -117,7 +78,6 @@ async function executeBuildCommand(
 async function executeBuildScript(
   modulePath: string,
   scriptPath: string,
-  useNix: boolean,
 ): Promise<{ success: boolean; output: string; error?: string }> {
   const fullScriptPath = `${modulePath}/${scriptPath}`;
 
@@ -132,11 +92,7 @@ async function executeBuildScript(
   let command: string;
   let args: string[];
 
-  if (useNix) {
-    const innerCommand = isShellScript ? 'bash' : 'ansible-playbook';
-    command = 'nix';
-    args = ['develop', '--command', innerCommand, scriptPath];
-  } else if (isShellScript) {
+  if (isShellScript) {
     command = 'bash';
     args = [scriptPath];
   } else {
@@ -207,7 +163,6 @@ function formatBytes(bytes: number): string {
  * @param artifacts - List of artifact paths
  * @param status - Build status
  * @param buildLog - Build output log
- * @param environment - Build environment (nix or system)
  * @param db - Database client
  */
 async function recordBuildMetadata(
@@ -216,7 +171,6 @@ async function recordBuildMetadata(
   artifacts: string[],
   status: BuildStatus,
   buildLog: string,
-  environment: 'nix' | 'system' | null,
   db: DbClient,
 ): Promise<void> {
   await db.insert(moduleBuilds).values({
@@ -225,7 +179,6 @@ async function recordBuildMetadata(
     artifacts,
     status,
     buildLog,
-    environment,
   });
 }
 
@@ -268,38 +221,18 @@ export async function buildModuleFromSource(moduleId: string, db: DbClient): Pro
     };
   }
 
-  // Detect Nix environment and verify availability
-  const nixDetected = detectNixEnvironment(modulePath);
-  const nixAvailable = nixDetected ? await isNixAvailable() : false;
-  const useNix = nixDetected && nixAvailable;
-  const environment: 'nix' | 'system' = useNix ? 'nix' : 'system';
-
-  if (useNix) {
-    log.info('Entering Nix environment (flake.nix detected)...');
-  } else if (nixDetected && !nixAvailable) {
-    log.warn('flake.nix detected but nix command not available - using system Ansible');
-  }
-
   try {
     // Execute build script with streaming progress
     const buildResult = command
-      ? await executeBuildCommand(modulePath, command, useNix)
-      : await executeBuildScript(modulePath, script as string, useNix);
+      ? await executeBuildCommand(modulePath, command)
+      : await executeBuildScript(modulePath, script as string);
 
     // Check if build command failed
     if (!buildResult.success) {
       const errorMsg = buildResult.error || 'Build command failed';
 
       // Record failed build
-      await recordBuildMetadata(
-        moduleId,
-        manifest.version,
-        [],
-        'failed',
-        buildResult.output,
-        environment,
-        db,
-      );
+      await recordBuildMetadata(moduleId, manifest.version, [], 'failed', buildResult.output, db);
 
       return {
         success: false,
@@ -327,7 +260,6 @@ export async function buildModuleFromSource(moduleId: string, db: DbClient): Pro
           [],
           'failed',
           `${buildLog}\n\n${errorMsg}`,
-          environment,
           db,
         );
 
@@ -346,15 +278,7 @@ export async function buildModuleFromSource(moduleId: string, db: DbClient): Pro
 
       // Record successful build
       const artifactPaths = verification.map((v) => v.path);
-      await recordBuildMetadata(
-        moduleId,
-        manifest.version,
-        artifactPaths,
-        'success',
-        buildLog,
-        environment,
-        db,
-      );
+      await recordBuildMetadata(moduleId, manifest.version, artifactPaths, 'success', buildLog, db);
 
       return {
         success: true,
@@ -364,7 +288,7 @@ export async function buildModuleFromSource(moduleId: string, db: DbClient): Pro
     }
 
     // No artifacts defined, just record success
-    await recordBuildMetadata(moduleId, manifest.version, [], 'success', buildLog, environment, db);
+    await recordBuildMetadata(moduleId, manifest.version, [], 'success', buildLog, db);
 
     return {
       success: true,
@@ -376,7 +300,7 @@ export async function buildModuleFromSource(moduleId: string, db: DbClient): Pro
     const buildLog = `Build failed: ${errorMsg}`;
 
     // Record failed build
-    await recordBuildMetadata(moduleId, manifest.version, [], 'failed', buildLog, environment, db);
+    await recordBuildMetadata(moduleId, manifest.version, [], 'failed', buildLog, db);
 
     return {
       success: false,