ci

 1@@ -509,13 +509,22 @@ VM.
 2 
 3 Multi-arch: jobs use the host nix-daemon, which routes derivations by
 4 `system`. x86_64 work runs natively. aarch64 work (`nix build` /
 5-`colmena build` / flake `checks`) goes to **`mx99.eu.sovrn.at`** as a remote
 6-builder (`nix.buildMachines`, native aarch64, staging host so it may be
 7-loaded). `boot.binfmt.emulatedSystems = [ "aarch64-linux" ]` stays as a slow
 8-fallback only. The builder login is a restricted `nix-ssh` user, not root, and
 9-mx99 limits builds (`maxJobs = 1`, a build slice with `MemoryMax`, low
10-`CPUWeight`/`IOWeight`, `Nice`, zram) so a build cannot starve the staging
11-app.
12+`colmena build` / flake `checks`) goes to a **builder host** as a remote
13+builder: any host with the `builder` role in `servers`' hosts.json (planned:
14+`mx99.eu.sovrn.at`, the aarch64 staging host), listed in the CI host's
15+`nix.buildMachines` from that data (`servers/roles/ci/builders.nix`).
16+`boot.binfmt.emulatedSystems = [ "aarch64-linux" ]` stays as a slow fallback.
17+The `builder` role (`servers/roles/builder`) is separate from the sovrn roles:
18+a key-only `nix-ssh` login whose forced command is `nix-daemon --stdio`, with
19+its own key pair (`keys/nix-builder.pub`, secret `nix-builder-ssh-key`). It is
20+a trusted user, since the CI host's own build outputs carry no signature the
21+builder knows; that grants nothing new, because the CI host already has root
22+on the fleet. The builder fetches inputs from the caches itself
23+(`builders-use-substitutes`), and limits builds: `max-jobs = 1`, `cores = 1`,
24+idle CPU/IO scheduling, and a memory ceiling plus low weights on
25+`nix-daemon.service` (the daemon runs every build, including those that
26+arrive over SSH; a VM test checks the cgroup), and zram. `servers`'
27+`checks.x86_64-linux.builder` exercises both halves.
28 
29 Binary cache: the CI host's own `/nix/store` is the cache, served read-only by
30 `harmonia` behind Caddy (basic auth, one shared netrc: store paths reveal host