feat(b-0852.4): flip zeta.credsRestore default-on with interactive mode via common.nix — closes the loop on 'don't re-enter credentials over and over' at installed-system-boot scope

[AceHack]

Summary

Closes the loop on the operator pain point named 2026-05-27. The B-0852 install-side cascade (PRs #5637 + #5638 + #5639) writes the encrypted cred-blob; this PR enables the installed system to READ it at every subsequent boot.

What changed

Single 2-line addition to common.nix (+ multi-line comment update):

```nix
zeta.credsRestore = {
enable = lib.mkDefault true;
passphraseMode = lib.mkDefault "interactive";
};
```

Inherits across all hosts that import common.nix (control-plane, worker-gpu, worker-template, future configs).

Why safe

The module's systemd.services.zeta-creds-restore unit has ConditionPathExists guards for blob + uuid + script + bun shim. On any host without a written cred-blob (first install before picker fires, OR fresh install where operator skipped Step 6.56), the unit no-ops cleanly. No failure mode.

On hosts WITH a blob, systemd-ask-password prompts on tty1 at boot for the passphrase. Operator types ONCE per boot; restore CLI decrypts blob + writes /home/zeta/.config/{gh,claude,gemini,codex} per the declarative manifest.

Why interactive (not file)

• File mode requires operator to pre-stage /run/zeta-creds-passphrase BEFORE service start — not auto-restore
• Interactive mode prompts the operator ONCE at boot via tty1 (well-established systemd pattern) — IS auto-restore

Per-host opt-out path preserved: set zeta.credsRestore.passphraseMode = \"file\" for headless / cluster scenarios where tty1 prompting is inappropriate.

Why mkDefault

Per-host configs can override without conflict warnings; common module sets fleet default; individual hosts can override per their substrate.

End-to-end operator experience (post all 4 PRs)

Step	What happens	PR
First install: boot live-USB	zeta-install.sh runs	—
Step 6.56	Passphrase prompt	#5638
iter-4.2	USB UUID captured to /etc/zeta/usb-uuid	#5637
Step 6.95-picker	Auto-fires; writes /esp/zeta-creds.enc	#5639
Operator	Goes through gh/claude/gemini/codex device-flow logins ONCE	—
Picker	Bundles them into the encrypted blob	—
Subsequent boots	zeta-creds-restore.service fires	THIS PR
systemd-ask-password	Prompts on tty1 ONCE	THIS PR
Restore CLI	Decrypts blob + writes /home/zeta/.config/{gh,claude,gemini,codex}	THIS PR
Operator	NEVER re-enters gh/claude/gemini/codex device-flow	CLOSES LOOP

Composes with

• PR feat(b-0852.3a-prep): capture USB UUID during iter-4.2 ESP probe — closes precondition #3 for Step 6.95-picker (operator-blocking 're-enter credentials over and over' pain point) #5637 (B-0852.3a-prep USB UUID capture)
• PR feat(b-0852.3b): cred-blob passphrase prompt at Step 6.56 + unset-after-picker discipline (closes precondition #2 for cred-persistence picker) #5638 (B-0852.3b passphrase prompt + unset-after-picker)
• PR feat(b-0852.3c): flip ZETA_CREDS_PICKER default-ON with 4-path operator-opt-out — closes precondition #1 (the 3-of-3 closer for cred-persistence picker) #5639 (B-0852.3c default-flip with 4-path opt-out)
• full-ai-cluster/nixos/modules/zeta-creds-restore.nix (existing module; 214 lines; no changes needed)
• tools/installer/zeta-creds-restore.ts (existing TS impl)
• B-0855.1 zeta-self-register (declares After = \"zeta-creds-restore.service\"; ordering preserved)
• full-ai-cluster/INJECTION-POINTS.md (catalog; in-flight item Round 29 — CI pipeline + three-way parity install + factory-improvement surge #5 now operator-facing end-to-end)

Test plan

• Branch guard checked before commit
• Tree-count canary 61
• CI: build-ai-cluster-iso (TRIGGERED via full-ai-cluster/nixos/modules/disko-shapes/**? — actually this file is full-ai-cluster/nixos/modules/common.nix which is NOT in the workflow's trigger path; ISO won't rebuild from this PR alone. Combined with the install-substrate PRs (feat(b-0852.3a-prep): capture USB UUID during iter-4.2 ESP probe — closes precondition #3 for Step 6.95-picker (operator-blocking 're-enter credentials over and over' pain point) #5637/feat(b-0852.3b): cred-blob passphrase prompt at Step 6.56 + unset-after-picker discipline (closes precondition #2 for cred-persistence picker) #5638/feat(b-0852.3c): flip ZETA_CREDS_PICKER default-ON with 4-path operator-opt-out — closes precondition #1 (the 3-of-3 closer for cred-persistence picker) #5639) that DO trigger ISO rebuild, the substrate ships together once those merge)
• Once merged + ISO rebuilds + first install completes: every subsequent boot fires the restore service + prompts ONCE for passphrase + restores creds

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[Copilot]

Pull request overview

Flips zeta.credsRestore defaults in the shared NixOS common.nix so the boot-time credential restore service is enabled fleet-wide with interactive (systemd-ask-password on tty1) passphrase mode. Pairs with the install-side PRs (#5637/#5638/#5639) so that on every subsequent boot the operator types the passphrase once and the restore CLI rehydrates client creds from the encrypted USB-ESP blob.

Changes:

• Set zeta.credsRestore.enable = lib.mkDefault true and passphraseMode = lib.mkDefault "interactive" in common.nix, inheriting to all hosts importing it.
• Expand the import-block comment to document the default-on rationale, ConditionPathExists no-op safety, opt-out paths, and composition with B-0855.1 self-register ordering.