From b14ae9e34b5c14d89debc09b312aec38209e7366 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Tue, 10 Nov 2026 00:56:23 +0100
Subject: [PATCH] full-setup vm test: spawn, a reviewer-archetype agent,
 replaces ruth

mara chose on the PR to test a reviewer-archetype agent named spawn first
and leave a custom root agent (ruth) for later. So the test creates spawn
with the archetype's default permissions and drops manage_root_agent, which
only ruth carried.

- hive-meta-flake/testdata/meta-flake-swarm.nix.in: the agent is spawn, and
  its web port is 8316, the port the name hashes to (ruth's was 8232).
- hive-meta-flake/src/lib.rs: the unit test that compares this fixture with
  the rendered flake renders spawn instead of ruth.
- nix/vm-tests/full-setup.nix: the agents list and step 8 use spawn.
- The `swarmctl setup status` expectation keeps its "9  ruth created and up"
  row: that is the product's fixed step text (swarmctl/src/setup.rs), not the
  test's agent. The test creates no root agent, so step 9 is expected to be
  not done, and the subtest's comment says so.
---
 hive-meta-flake/src/lib.rs                       |  2 +-
 hive-meta-flake/testdata/meta-flake-swarm.nix.in |  2 +-
 nix/vm-tests/full-setup.nix                      | 16 ++++++++--------
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/hive-meta-flake/src/lib.rs b/hive-meta-flake/src/lib.rs
index 1d0aac1d5..db69d426f 100644
--- a/hive-meta-flake/src/lib.rs
+++ b/hive-meta-flake/src/lib.rs
@@ -604,7 +604,7 @@ mod tests {
             "@HYPERHIVE_URL@",
             &[
                 spec("iris", archetype(), None),
-                spec("ruth", archetype(), None),
+                spec("spawn", archetype(), None),
             ],
             &vars,
             false,
diff --git a/hive-meta-flake/testdata/meta-flake-swarm.nix.in b/hive-meta-flake/testdata/meta-flake-swarm.nix.in
index c7df8a2f9..5cd5a9cfe 100644
--- a/hive-meta-flake/testdata/meta-flake-swarm.nix.in
+++ b/hive-meta-flake/testdata/meta-flake-swarm.nix.in
@@ -87,7 +87,7 @@
     {
       nixosConfigurations = {
         iris = mkAgent { name = "iris"; port = 8178; archetype = { source = "hyperhive"; name = "reviewer"; }; };
-        ruth = mkAgent { name = "ruth"; port = 8232; archetype = { source = "hyperhive"; name = "reviewer"; }; };
+        spawn = mkAgent { name = "spawn"; port = 8316; archetype = { source = "hyperhive"; name = "reviewer"; }; };
       };
     };
 }
diff --git a/nix/vm-tests/full-setup.nix b/nix/vm-tests/full-setup.nix
index 198fcb82e..31eb4e1e9 100644
--- a/nix/vm-tests/full-setup.nix
+++ b/nix/vm-tests/full-setup.nix
@@ -10,12 +10,12 @@
 #                   needs a TPM). A pkcs11 store unseals itself at init, so here
 #                   the unseal comes right after init, before the granter.
 #   2 SSO account   `swarmctl user add mara --group admins`.
-#   8 ruth          `POST /api/agents` on the controller socket, as the swarm
-#                   UI's create form does, plus `manage_root_agent`.
+#   8 spawn         `POST /api/agents` on the controller socket, as the swarm
+#                   UI's create form does, with the reviewer archetype's defaults.
 #   9 first agent   The same endpoint, for `iris`: `swarmctl agent create` has no
 #                   archetype flag, and a custom agent's config repo would need
 #                   inputs the VM cannot resolve offline.
-# `swarmctl setup status` is read last: steps 1-6 done, ruth not yet up.
+# `swarmctl setup status` is read last: step 9 (the product's `ruth`) stays undone.
 # Not scripted yet; a later slice adds them: step 3, the first SSO login to the
 # forge (an OIDC code flow against authelia), `swarmctl forge make-admin`, and
 # the agents' deploy up to the point where each says it needs a login. Green
@@ -36,7 +36,7 @@ let
   swarmDomain = "swarm.test";
   agents = [
     "iris"
-    "ruth"
+    "spawn"
   ];
 
   inherit (import ./hyperhive-fixture-repo.nix { inherit pkgs self; }) hyperhiveRepo;
@@ -356,12 +356,12 @@ pkgs.testers.runNixOSTest (
           ).split()[0]
           assert pushed == machine.succeed("cat ${hyperhiveRepo}/rev").strip(), pushed
 
-      with subtest("step 8: ruth, through the endpoint the swarm UI calls"):
+      with subtest("step 8: spawn, a reviewer-archetype agent, through the endpoint the swarm UI calls"):
           machine.wait_until_succeeds(
               f"curl --fail --silent --unix-socket {SOCKET} {API}/api/permissions >/dev/null", timeout=900
           )
-          default = json.loads(controller("GET", "/api/permissions"))["default"]
-          create_agent({"name": "ruth", "hive": HIVE, "permissions": default + ["manage_root_agent"], "archetype": ARCHETYPE})
+          # A custom root agent (ruth, as the UI creates her) is a follow-up, not covered yet.
+          create_agent({"name": "spawn", "hive": HIVE, "archetype": ARCHETYPE})
 
       with subtest("step 9: the first agent"):
           create_agent({"name": "iris", "hive": HIVE, "archetype": ARCHETYPE})
@@ -384,7 +384,7 @@ pkgs.testers.runNixOSTest (
           assert committed == expected, "the controller's flake differs from the one the toplevels came from:\n" + committed
 
       with subtest("swarmctl setup status reports the steps done so far"):
-          # Ruth is declared paused and her `up` is a later step, so the report
+          # Step 9 names ruth, the root agent of the real setup; this test creates none, so the report
           # ends on step 9 not done and the exit status is 1.
           reported = [
               "✅   1  secret store initialised",