Repository navigation
id(ci): nixos-integration's id binary lacks the ssh feature, so the SSH world tests fail #4960
Description
Problem
nixos-integration runs the SSH world tests against an id binary that is
built without the ssh feature, so those tests cannot pass on current
main even when the harness itself is green.
pkgs/id/flake.nix:649-659buildsid-webwith
buildFeatures = [ "web" "sandbox" "world" ]— nossh.pkgs/id/flake.nix:637-641passesidPackage = self.packages.${system}.id-web
tonix/tests/integration-test.nix.flake.nix:127buildsintegrationTestRunnerwith
cargo test --all-features --test cli_integration --no-run, so the test
binary contains the SSH tests.
The spawned server therefore exits with:
Error: this build has no SSH support (feature `ssh`)
Evidence
VM run of checks.x86_64-linux.nixos-integration on branch
queue/7796-1372-legible-vm-timeout (PR #4913, the legibility fix for #1372),
2026-11-03, reusing the branch's built test runner and id binary:
[id-integration] 126 tests in 4 named groups: fast_unit=49, serve=43, tag=29, harness_unit=5
[id-integration] group 'fast_unit' finished in 7.4s
[id-integration] waiting on group 'serve' (filters: serve_tests::); per-group deadline 2200s, 3393s of suite budget left
...
test result: FAILED. 40 passed; 3 failed; 0 ignored; 0 measured; 83 filtered out; finished in 14.40s
Failures:
serve_tests::test_world_join_via_ssh_carries_the_frame_protocolserve_tests::test_world_ssh_tunnel_carries_join_via_sshserve_tests::test_world_module_shared_over_iroh_and_web_presentations
(assertionjoin denied; its server stderr shows the same missing-ssh exit)
Two are explicitly SSH tests; the third's server dies before the forged-join
assertion. The shared root cause in the captured stderr is
Error: this build has no SSH support (feature 'ssh').
Why it matters
#1372's acceptance is "the suite passes, or it fails fast with a named
assertion". The legibility half now holds (the run fails in seconds naming the
group and tests), but the "passes" half cannot be met while the binary under
test lacks a feature the test binary was compiled with.
Options
- Build the integration test's
idbinary with thesshfeature (matching
the runner's--all-features), so the SSH tests exercise real behaviour. - Gate the SSH tests on the spawned binary's capabilities and skip them
otherwise — weaker, and it reduces coverage.
Preferred: option 1. A separate pre-existing blocker (#4850, ChainExt
literals missing the #3794 checkpoint field) also makes id-web's
checkPhase fail to build on main; both have to be cleared before a stock
nix build .#checks.x86_64-linux.nixos-integration can be green.
Activity
developing-today commentedon Nov 3, 2026
agent-note:v1
state: reviewed (coverage loop-back)
Coverage pass 2026-11-03, loop-back review: this issue was re-reviewed (drift / overlap / already-handled / stale / blockers / ordering) so every open issue in the four repos is reviewed and in the system. Verdict: still live; in the system as task 8550 (triage, queued, priority 50) in repo-health-code-pilot. Labels audited and synced. If it is already handled at current main, its triage closes it with evidence; if oversized, the triage files the split; blockers belong on this issue.
Found via: coverage loop-back 2026-11-03
dezren39 commentedon Nov 4, 2026
🤖 Agent note · handed off
opencode22 remaining items
dezren39 commentedon Nov 4, 2026
🤖 Agent note · picked up
sshaddition to id-web buildFeatures in pkgs/id/flake.nix) already open from the prior attempt; revalidating fresh state and CI.dezren39 commentedon Nov 4, 2026
🤖 Agent note · parked
sshaddition to id-web buildFeatures (pkgs/id/flake.nix), no Codex findings, no hard-stop labels. Its only check, basic: production line limit (2500), is still QUEUED on run 41791795378 since 2026-11-04T07:22Z with no completed build checks, so per runbook §5 the task parks instead of waiting or merging past unverified checks.dezren39 commentedon Nov 4, 2026
agent-note:v1
task: 9308
lane: code-k
transition: done
PR #5339 merged (squash, merge sha 22477f8); issue #4960 closed by the PR. Verification: derivation buildFeatures "web sandbox ssh world" via laptop nix eval; production-line-guard failure pre-existing on main and untouched by this diff.