tatara-build-remote — layered Nix build transport for tatara guests.

Takes a BuildRef (flake + attr, raw Nix expression, store path, or OCI image) and resolves it to a concrete StorePath using a priority-ordered chain of transports. First match wins. Default chain:

1. Attic cache — pulls from a shared Attic instance (e.g. quero.lol). Fastest path when the artifact is already cached.
2. ssh-ng remote builder — submits to a remote Nix builder over ssh-ng://. Used when Attic misses and the local machine can't or shouldn't build (cross-arch, resource constrained, etc.).
3. Local — nix build on the host. Last resort.

Any transport declared absent in the spec is skipped. If all declared transports fail, BuildError::AllTransportsFailed bubbles up and hospedeiro refuses to boot the guest — we fail closed.

Status

Phase H.5 landed. AtticTransport, SshRemoteTransport, and LocalTransport all ship in transports.rs. BuildTransportChain::to_layered() composes them into a priority- ordered LayeredTransport driven by (defguest …)'s :build-on keyword.

Why layered, not single-target

The fleet at quero.lol has a shared Attic cache and an ssh-ng builder pool. Cache hits are free; builds are expensive. Layering lets the common case (pleme-io team members pulling pre-built artifacts) skip the slow path entirely. Keys + SSH config come from the cid node's pangea-builder.nix — no new auth plumbing.