substrate: coordinator pusher and puller as user units, ON; pkgs/substrate-apps at fc2f8bd; tokens sealed

docs/ax-conwip.md

@@ -7,6 +7,13 @@ Module: `home/ax-conwip.nix`. Option namespace: `myAxConwip`. Check:
 this module defines no unit on any host today.** The flake check asserts exactly
 that, and it is written so that it goes red on the flip. Flipping it is Tom's.
 
+**2026-09-24 note.** The repository this page describes was renamed substrate
+(E10). Its box-side programs are not run through this module: the capacity
+pusher and the interpreter-host puller are the user units `substrate-pusher`
+and `substrate-puller` from `modules/substrate.nix`, declared ON on the
+coordinator as of 2026-09-24. They replace the hand-started nohup processes of
+`~/today/wednesday-prep-2026-09-23/substrate` (RUN.md), with the same configs.
+
 ## What the CONWIP is
 
 `/home/tom/mecattaf/ax-conwip` is a CONWIP scheduler. CONWIP is constant

flake.nix

@@ -659,6 +659,9 @@
         let
           amdAi = inputs.nix-amd-ai.packages.${system};
           strixAi = inputs.nix-strix-halo.packages.${system};
+          # The Cloudflare Substrate's box-side programs, vendored from
+          # agency-agency/substrate at the sha in pkgs/substrate-apps/SYNC.md.
+          substrateApps = pkgs.callPackage ./pkgs/substrate-apps { };
         in
         {
           inherit (pkgs)
@@ -725,6 +728,14 @@
               go_1_27 = inputs.nixpkgs-go.legacyPackages.${system}.go_1_27;
             };
           };
+          # `nix build .#substrate-pusher`, `.#substrate-puller`, `.#substrate-apps-link`:
+          # the coordinator's gentle capacity pusher, its interpreter-host puller and
+          # the floor-to-ax link from the same pinned
+          # substrate sha (pkgs/substrate-apps). Installed by modules/substrate.nix
+          # (gates OFF) and hosts/nas/substrate-link.nix (still on pkgs/substrate-link).
+          substrate-pusher = substrateApps.pusher;
+          substrate-puller = substrateApps.puller;
+          substrate-apps-link = substrateApps.link;
         };
 
       # The same teardown the control and harness roles keep on their PATH
@@ -778,6 +789,12 @@
           inherit pkgs self;
           inherit (nixpkgs) lib;
         };
+        # modules/substrate.nix rendered OFF on the coordinator and armed with
+        # fixtures (tests/substrate-modules); every assertion is eval-time.
+        substrate-modules = import ./tests/substrate-modules {
+          inherit pkgs self;
+          inherit (nixpkgs) lib;
+        };
 
         # DF-5: the vendored Cargo.lock must equal upstream's at the pinned rev.
         # A build-time comparison, not an evaluation-time read, so evaluation

hosts/coordinator/default.nix

@@ -86,10 +86,37 @@
     # all three interactive hosts, OFF on all three; read that module's header
     # for the runbook and for what it deliberately does not declare.
     ../../modules/ax-client.nix
+    # The Cloudflare Substrate's coordinator side (2026-09-23, E1/A2): the
+    # gentle capacity pusher and the interpreter-host puller, both declared
+    # ON below (2026-09-24). The NAS side is hosts/nas/substrate-link.nix.
+    ../../modules/substrate.nix
   ];
 
   networking.hostName = "coordinator";
 
+  # ── Substrate on this box: declared ON (2026-09-24) ────────────────────
+  # modules/substrate.nix. Two user units on tom's manager, replacing the
+  # hand-started nohup processes of
+  # ~/today/wednesday-prep-2026-09-23/substrate (RUN.md) with the same
+  # configuration (runtimes opus/halogen/codex/codex-rw, pusher peerCacheDir
+  # "inherit"). Tokens: secrets/substrate-floor-token.age (FLOOR_TOKEN) and
+  # secrets/substrate-link-token-coordinator.age (this holder's LINK_TOKENS
+  # entry), delivered to tom 0400. No runtime-test wrapper: the puller runs
+  # with the real /run/user so herdr and ssh stay reachable. Cutover, in this
+  # order: (1) SIGTERM both nohup processes by their HOST pids and confirm
+  # they exited (a unit pusher treats the namespace pid 2 in pusher.pid as
+  # stale and would run beside a live nohup pusher); (2) rm -f
+  # ~/.local/state/substrate/{puller.pid,pusher.pid,puller.host.pid,puller.supervisor.pid};
+  # (3) only then switch. Rollback: both `false` and switch.
+  services.substrate = {
+    floorUrl = "https://substrate.mecattaf.dev";
+    pusher = {
+      enable = true;
+      owners.codex = "tom"; # E6 (2026-09-23): the codex login is Tom's
+    };
+    puller.enable = true;
+  };
+
   # ── ax on the fleet: THE kill switch for this host ─────────────────────
   # The HARNESS node (modules/ax-fleet/harness.nix): a k3s agent tainted
   # ate.dev/sandboxClass=gvisor:NoSchedule, so only atelet and the gVisor