fix(dolt): remove non-reproducible dolt-data FOD; seed via runtime clone (prx-zj8)

.changeset/dolt-data-runtime-seed.md

@@ -0,0 +1,10 @@
+---
+"@bounded-systems/prx": patch
+---
+
+Remove the `dolt-data` nix FOD — `dolt clone`+`gc` are NOT byte-reproducible
+across builders (proven: same pinned commit → different NAR hashes on Lima vs the
+container builder), so a content-addressed fixed-output derivation is the wrong
+model. The beads data volume is seeded by a builder-INDEPENDENT runtime clone of
+the pinned commit instead (deterministic per-commit; the path `prx dolt provision`
+should take when wired). Updates the dolt-service / pod-spec docs accordingly.

flake.nix

@@ -68,9 +68,6 @@
           keeperd-box = import ./nix/oci/keeperd-box.nix self { inherit pkgs system; };
           forge-d-box = import ./nix/oci/forge-d-box.nix self { inherit pkgs system; };
           dolt-box = import ./nix/oci/dolt-box.nix self { inherit pkgs system; };
-          # The deterministic beads dolt-data artifact (prx-asr): the
-          # network-fetch stage; the pod volume is populated from it (no network).
-          dolt-data = import ./nix/oci/dolt-data.nix self { inherit pkgs system; };
           # The nix remote BUILDER as a pinned container (prx-zj8 capstone) —
           # replaces the Lima builder VM (sshd + single-user nix on a /nix volume).
           nix-builder-box = import ./nix/oci/nix-builder-box.nix self { inherit pkgs system; };

packages/prx/src/room/dolt-service.ts

@@ -37,14 +37,20 @@ export const DOLT_BOX_ENV: Readonly<Record<string, string>> = {
 };
 
 /**
- * The deterministic data SEED is the `dolt-data` nix FOD
- * (nix/oci/dolt-data.nix) — the network-fetch stage. The COPY stage populates
- * the {@link DOLT_DATA_VOLUME} from that artifact with NO network, via:
+ * SEEDING the data volume — a RUNTIME clone, not a nix build artifact.
  *
- *   tar -C "$(nix path)" -cf - . | podman volume import prx-dolt-data -
- *   podman run --rm -v prx-dolt-data:/d alpine chmod -R a+rwX /d   # nix store is read-only
+ * A content-addressed nix FOD was tried (the old nix/oci/dolt-data.nix) but
+ * `dolt clone` + `dolt gc` are NOT byte-reproducible across builders (or runs),
+ * so the FOD's fixed output hash mismatched on any rebuild — proven: the same
+ * pinned commit yielded different NAR hashes on the Lima vs the container
+ * builder. So the seed is builder-INDEPENDENT and deterministic only PER-COMMIT:
+ * clone the DoltHub remote at the pinned commit straight into the volume:
  *
- * (podman-machine can't see the host /nix/store, so a tar stream — not a bind —
- * is the transport; the chmod makes the read-only store bytes writable for the
- * dolt server.) Wired into pod provisioning in the pod-model phase.
+ *   podman run --rm -v prx-dolt-data:/var/lib/dolt:U -e HOME=/tmp \
+ *     <dolt-box> dolt clone <remote> /var/lib/dolt/io_github_bounded_systems_prx
+ *   # then `dolt reset --hard <pinnedCommit>` for the pin (optional)
+ *
+ * One-time at provision; the volume then persists. This is what `prx dolt
+ * provision` (the stubbed GH-1685 verb) should do when wired — no nix FOD, no
+ * cross-builder hash to break.
  */

packages/prx/src/room/per-repo-pod.ts

@@ -29,7 +29,7 @@ import type { PodService } from "./spec.ts";
  * dolt-box — the standalone dolt SQL server (a backing service, NOT a room): it
  * owns the beads database on the {@link DOLT_DATA_VOLUME} named volume and serves
  * the MySQL wire on the pod netns, which beadsd-box connects to. Seeded out-of-
- * band from the dolt-data FOD (see dolt-service.ts). No doors.
+ * band by a runtime clone of the pinned commit (see dolt-service.ts). No doors.
  */
 const doltService: PodService = {
   name: "dolt",

packages/prx/src/room/spec.ts

@@ -189,8 +189,8 @@ export const PodServiceSchema = z.object({
    * A named volume holding the service's persistent state, mounted at
    * `mountPath`. Rendered as a `persistentVolumeClaim` (podman kube play maps
    * the claim name to a podman named volume, auto-creating it if absent and
-   * preserving it across `kube down`). Seeded out-of-band (e.g. the dolt-data
-   * FOD → `podman volume import`).
+   * preserving it across `kube down`). Seeded out-of-band (e.g. a runtime
+   * `dolt clone` of the pinned commit into the volume — see dolt-service.ts).
    */
   dataVolume: z.object({ name: z.string().min(1), mountPath: z.string().min(1) }).optional(),
   /** Environment for the service container. */