From 63ae5d6cbfddb7fa7996046badbc827fa0a3161a Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Sun, 8 Nov 2026 10:34:11 +0100
Subject: [PATCH] otel: look up unrestricted_internet by agent, skip the ci
 container

---
 hive-c0re/src/stats/otel_metrics.rs | 49 ++++++++++++++++++++++++++++-
 1 file changed, 48 insertions(+), 1 deletion(-)

diff --git a/hive-c0re/src/stats/otel_metrics.rs b/hive-c0re/src/stats/otel_metrics.rs
index 06d963ad..804bd7d9 100644
--- a/hive-c0re/src/stats/otel_metrics.rs
+++ b/hive-c0re/src/stats/otel_metrics.rs
@@ -250,7 +250,9 @@ fn register_instruments(provider: &SdkMeterProvider, snapshot: Arc<Mutex<Vec<Con
             };
             if let Ok(g) = snap.lock() {
                 for c in g.iter() {
-                    obs.observe(unrestricted_value(&stored, &c.name), &attrs(c));
+                    if let Some(value) = unrestricted_reading(&stored, c) {
+                        obs.observe(value, &attrs(c));
+                    }
                 }
             }
         })
@@ -279,6 +281,14 @@ fn register_closure_pullable(meter: &opentelemetry::metrics::Meter) {
         .build();
 }
 
+/// The gauge value for a sampled container: `None` for one that belongs to no
+/// agent (the CI runner), else [`unrestricted_value`] for its agent.
+fn unrestricted_reading(stored: &permissions::Stored, c: &ContainerResource) -> Option<u64> {
+    c.agent
+        .as_deref()
+        .map(|agent| unrestricted_value(stored, agent))
+}
+
 /// The gauge value for `agent`: 1 when unrestricted, 0 when not. An agent
 /// missing from `stored` reads 1.
 fn unrestricted_value(stored: &permissions::Stored, agent: &str) -> u64 {
@@ -582,6 +592,43 @@ mod tests {
         );
     }
 
+    #[test]
+    fn unrestricted_reading_follows_the_agent_not_the_machine_name() {
+        let stored = permissions::Stored::from([
+            (
+                "open".to_owned(),
+                serde_json::from_str(r#"{"unrestricted_internet":true}"#).expect("decodes"),
+            ),
+            (
+                "closed".to_owned(),
+                serde_json::from_str(r#"{"unrestricted_internet":false}"#).expect("decodes"),
+            ),
+        ]);
+        let row = |name: &str, agent: Option<&str>| ContainerResource {
+            name: name.to_owned(),
+            agent: agent.map(str::to_owned),
+            cpu_pct: 0.0,
+            cpu_time_usec: None,
+            mem_current_bytes: 0,
+            mem_peak_bytes: None,
+            mem_max_bytes: None,
+            disk_bytes: None,
+        };
+        assert_eq!(
+            unrestricted_reading(&stored, &row("h-open", Some("open"))),
+            Some(1)
+        );
+        // Control: a restricted agent reads 0, so the 1 above is the lookup, not a default.
+        assert_eq!(
+            unrestricted_reading(&stored, &row("h-closed", Some("closed"))),
+            Some(0)
+        );
+        assert_eq!(
+            unrestricted_reading(&stored, &row(container_stats::CI_MACHINE, None)),
+            None
+        );
+    }
+
     #[test]
     fn unrestricted_gauge_reads_absent_as_one() {
         let record = |json: &str| serde_json::from_str(json).expect("decodes");