[clhodapp]

Adds caisson-nixops4, the native NixOps4 integration.

A nixops4 configuration declares the machines NixOps4 deploys as NixOS configurations beneath it, under caisson.nixos.configurations.<name>, and the module of the NixOps4 root component as the option component. Each machine becomes a member of the root component under its name. The member is an exec resource of the local provider of NixOps4. It copies the machine's toplevel to the host with nix copy and runs bin/apply switch over SSH, as the NixOS resource of nixops4-nixos does. The member declares the SSH settings of that resource under the same names (ssh.host, ssh.user, ssh.hostPublicKey, ssh.opts, copy.substituteOnDestination, sudo.enable). The component module sets them, and it may set them from the outputs of other resources. A machine is evaluated by caisson before NixOps4 runs, so the NixOS modules of a machine cannot read resource outputs.

How the root is built:

• The integration imports nix/lib/lib.nix from the NixOps4 source over the composed library and calls its mkRoot. It does not use the lib that the NixOps4 flake builds over its own nixpkgs.
• The package set that library needs for a deploying system, and the shell the deployment runs in, come from the set caisson selects for the nixops4 configuration (defaultPkgs), for that system.
• The root gets the local provider as providers.local unless the component module declares one under that name.
• The configuration named default is published as the nixops4 flake output, which the NixOps4 command reads. The machines are published as nixosConfigurations from the same evaluation.

The default module of the class adds a new NixOS module, nixops4-apply, to the machines. It imports the apply module of nixops4-nixos, which builds bin/apply, from the source pinned or declared as nixops4-nixos.

The root refuses a machine name that NixOps4 cannot address (empty, or containing .). It also refuses a machine evaluated for more than one system. That check moves from caisson-colmena into lib.caisson.integrations.evaluatedMoreThanOnce, so both integrations use it.

tests/dependencies pins nixops4 and nixops4-nixos. The pinned-world suite has six new probes: the root end to end, the apply script on machines, SSH settings taken from a resource output, the deploy shell from the selected set, unaddressable names, and the ecosystem record. I checked that a broken expectation makes nixops4RootEvaluatesEndToEnd fail by name. pinned-world and every other x86_64-linux check pass locally, except the three VM tests, which I did not run.

The upstream-compatible nixops4 integration is not part of this pull request.

Docs: nix-caisson/nix-caisson.github.io, branch docs/caisson-nixops4.

🤖 Generated with Claude Code

[clhodapp]

Superseded by #141 and #142, which build the NixOps4 integrations as deferred configurations rather than as flake-time children.