mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

docs: the trust-boundary pages keep the operator guidance, the mechanism moves to implementation

Browse source 
boundary.md keeps the model, the design rule, why network isolation
matters and host admin socket access; the hive-priv socket activation and
the per-agent socket directory move to 4-implementation/trust-boundary.
security.md keeps the agent trust model and the path-name rule; the nix
builds mode with its threat model, and the hive-c0re privilege separation,
move to their own pages there. Headings and text move as they were, with
one level shaved off the heading depth. Links, code and nix pointers, and
the docs index follow the moves.
This commit is contained in:
iris 2026-11-06 19:07:29 +01:00 • committed by mara
commit 30a8f71bb5
1 changed files with 338 additions and 307 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/README.md
View file

@ -141,6 +141,15 @@ Nothing of it sits in this tree.
- **How does an agent get a todo when someone assigns it an issue, and lose it
when the issue closes?** → [`4-implementation/swarm/notify-router.md`](4-implementation/swarm/notify-router.md).
### Trust boundary mechanics
- **How does systemd activate `hive-priv`, and how does the per-agent socket
directory get its owner and mode?** → [`4-implementation/trust-boundary/boundary-mechanism.md`](4-implementation/trust-boundary/boundary-mechanism.md).
- **How does `hive-c0re` run unprivileged and delegate root operations?** →
[`4-implementation/trust-boundary/hive-c0re-privilege.md`](4-implementation/trust-boundary/hive-c0re-privilege.md).
- **How do in-container nix builds stay apart from the credentials?** →
[`4-implementation/trust-boundary/nix-builds.md`](4-implementation/trust-boundary/nix-builds.md).
### Web UI internals
- **How's the dashboard built, and how does the terminal render?** →