fix(colmena): deploy the systems nixosConfigurations evaluates

Colmena deployments now ship the same toplevel as nixosConfigurations: nodes gain the nixpkgs
registry, nixPath and dated version, and akane no longer gets the x86_64 dsh.

Assisted-by: DeepSeek Harness 0.2.1-rc.2 (claude-opus-5-5)

lib/colmenaSystem.nix

@@ -1,23 +1,16 @@
 # colmena - Remote Deployment via SSH
+#
+# Only the deployment settings live here. `outputs/default.nix` takes each node's modules,
+# specialArgs and nixpkgs from the host's `nixosConfigurations` entry, so colmena deploys the
+# system that `just eval-host`, `just build-host` and `just test` evaluate.
 {
-  lib,
-  inputs,
-  nixos-modules,
-  home-modules ? [ ],
-  myvars,
-  system,
   tags,
   ssh-user,
   # optional override; defaults to the host name. Use an IP when the host's
   # DNS name is not resolvable yet (e.g. right after a hostname change).
   targetHost ? null,
-  genSpecialArgs,
-  specialArgs ? (genSpecialArgs system),
   ...
 }:
-let
-  inherit (inputs) home-manager;
-in
 { name, ... }:
 {
   deployment = {
@@ -25,18 +18,4 @@ in
     targetUser = ssh-user;
     targetHost = if targetHost != null then targetHost else name;
   };
-
-  imports =
-    nixos-modules
-    ++ (lib.optionals ((lib.lists.length home-modules) > 0) [
-      home-manager.nixosModules.home-manager
-      {
-        home-manager.useGlobalPkgs = true;
-        home-manager.useUserPackages = true;
-        home-manager.backupFileExtension = "home-manager.backup";
-
-        home-manager.extraSpecialArgs = specialArgs;
-        home-manager.users."${myvars.username}".imports = home-modules;
-      }
-    ]);
 }

outputs/aarch64-linux/default.nix

@@ -20,15 +20,6 @@ let
       map (it: it.nixosConfigurations or { }) dataWithoutPaths
     );
     packages = lib.attrsets.mergeAttrsList (map (it: it.packages or { }) dataWithoutPaths);
-    # colmena contains some meta info, which need to be merged carefully.
-    colmenaMeta = {
-      nodeNixpkgs = lib.attrsets.mergeAttrsList (
-        map (it: it.colmenaMeta.nodeNixpkgs or { }) dataWithoutPaths
-      );
-      nodeSpecialArgs = lib.attrsets.mergeAttrsList (
-        map (it: it.colmenaMeta.nodeSpecialArgs or { }) dataWithoutPaths
-      );
-    };
     colmena = lib.attrsets.mergeAttrsList (map (it: it.colmena or { }) dataWithoutPaths);
   };
 in

outputs/aarch64-linux/tests/colmena-parity/expected.nix

@@ -0,0 +1,7 @@
+{
+  lib,
+  outputs,
+}:
+lib.genAttrs [ "akane" ] (
+  name: outputs.nixosConfigurations.${name}.config.system.build.toplevel.drvPath
+)

outputs/aarch64-linux/tests/colmena-parity/expr.nix

@@ -0,0 +1,6 @@
+{
+  lib,
+  inputs,
+}:
+# Colmena must deploy the system that nixosConfigurations evaluates and builds.
+lib.genAttrs [ "akane" ] (name: inputs.self.colmenaHive.toplevel.${name}.drvPath)

outputs/default.nix

@@ -91,32 +91,45 @@ let
   darwinSystemValues = builtins.attrValues darwinSystems;
   allSystemValues = nixosSystemValues ++ darwinSystemValues;
 
+  nixosConfigurations = lib.attrsets.mergeAttrsList (
+    map (it: it.nixosConfigurations or { }) nixosSystemValues
+  );
+
+  # Per-node deployment settings from `mylib.colmenaSystem`, keyed by host name.
+  colmenaDeployments = lib.attrsets.mergeAttrsList (map (it: it.colmena or { }) nixosSystemValues);
+
   # Raw Colmena hive (nodes + meta), evaluated below into the exposed
   # `colmenaHive` output. The nix-community Colmena rewrite only reads
   # `colmenaHive`, so the raw hive is not an output of its own.
+  #
+  # Each node is rebuilt from its `nixosConfigurations` entry: the same modules
+  # (including the one `nixpkgs.lib.nixosSystem` appends), specialArgs and
+  # system. Colmena applies `nodeNixpkgs`' overlays and config on top of the
+  # node's own, so it gets a package set with none: not the node's `pkgs`, and
+  # not `legacyPackages`, which carries the flake's own overlays.
   rawColmenaHive = {
-    meta =
+    meta = {
-      (
+      nixpkgs = import nixpkgs { system = "x86_64-linux"; };
-        let
+      nodeNixpkgs = builtins.mapAttrs (
-          system = "x86_64-linux";
+        name: _: import nixpkgs { inherit (nixosConfigurations.${name}.pkgs.stdenv.hostPlatform) system; }
-        in
+      ) colmenaDeployments;
-        {
+      nodeSpecialArgs = builtins.mapAttrs (
-          # colmena's default nixpkgs & specialArgs
+        name: _: nixosConfigurations.${name}._module.specialArgs
-          nixpkgs = import nixpkgs { inherit system; };
+      ) colmenaDeployments;
-          specialArgs = genSpecialArgs system;
+    };
-        }
-      )
-      // {
-        # per-node nixpkgs & specialArgs
-        nodeNixpkgs = lib.attrsets.mergeAttrsList (
-          map (it: it.colmenaMeta.nodeNixpkgs or { }) nixosSystemValues
-        );
-        nodeSpecialArgs = lib.attrsets.mergeAttrsList (
-          map (it: it.colmenaMeta.nodeSpecialArgs or { }) nixosSystemValues
-        );
-      };
   }
-  // lib.attrsets.mergeAttrsList (map (it: it.colmena or { }) nixosSystemValues);
+  // builtins.mapAttrs (name: deployment: {
+    imports = [
+      deployment
+      # Colmena evaluates with nixpkgs' plain lib, which lacks the version the
+      # flake's lib reports; without this the toplevel differs (`26.11pre-git`).
+      {
+        system.nixos.versionSuffix = lib.trivial.versionSuffix;
+        system.nixos.revision = lib.trivial.revisionWithDefault null;
+      }
+    ]
+    ++ nixosConfigurations.${name}._module.args.modules;
+  }) colmenaDeployments;
 
   # Helper function to generate a set of attributes for each system
   forAllSystems = func: (nixpkgs.lib.genAttrs allSystemNames func);
@@ -133,9 +146,7 @@ in
   };
 
   # NixOS Hosts
-  nixosConfigurations = lib.attrsets.mergeAttrsList (
+  inherit nixosConfigurations;
-    map (it: it.nixosConfigurations or { }) nixosSystemValues
-  );
 
   # Colmena - remote deployment via SSH. The nix-community evaluator reads the
   # evaluated `colmenaHive` output built from the raw hive in the `let` block.

outputs/x86_64-linux/default.nix

@@ -20,15 +20,6 @@ let
       map (it: it.nixosConfigurations or { }) dataWithoutPaths
     );
     packages = lib.attrsets.mergeAttrsList (map (it: it.packages or { }) dataWithoutPaths);
-    # colmena contains some meta info, which need to be merged carefully.
-    colmenaMeta = {
-      nodeNixpkgs = lib.attrsets.mergeAttrsList (
-        map (it: it.colmenaMeta.nodeNixpkgs or { }) dataWithoutPaths
-      );
-      nodeSpecialArgs = lib.attrsets.mergeAttrsList (
-        map (it: it.colmenaMeta.nodeSpecialArgs or { }) dataWithoutPaths
-      );
-    };
     colmena = lib.attrsets.mergeAttrsList (map (it: it.colmena or { }) dataWithoutPaths);
   };
 in

outputs/x86_64-linux/tests/colmena-parity/expected.nix

@@ -0,0 +1,7 @@
+{
+  lib,
+  outputs,
+}:
+lib.genAttrs [ "kana" ] (
+  name: outputs.nixosConfigurations.${name}.config.system.build.toplevel.drvPath
+)

outputs/x86_64-linux/tests/colmena-parity/expr.nix

@@ -0,0 +1,6 @@
+{
+  lib,
+  inputs,
+}:
+# Colmena must deploy the system that nixosConfigurations evaluates and builds.
+lib.genAttrs [ "kana" ] (name: inputs.self.colmenaHive.toplevel.${name}.drvPath)