mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

describe core/meta as the legacy permission repo; drop stale meta-flake prose

Browse source 
Comments, docs and the hive-c0re README no longer say the hive renders, locks or pushes a meta flake. core/meta is the legacy permission-seed repo that meta::remove_permission_files still commits to; builds come from internal/meta (meta_rev.rs). Docs note that a start of a stale stopped agent can fail until the swarm's update pins the config.
This commit is contained in:
atlas 2026-10-25 15:08:50 +01:00
commit bd54372fcc
1 changed files with 35 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

24
hive-c0re/src/forge/mod.rs
View file

@ -1,5 +1,6 @@
//! Optional Forgejo wiring — the `core/meta` repo and meta read-access
//! grants. Those writes, as `core`, run only beside a local `hive-forge`
//! Optional Forgejo wiring — the legacy `core/meta` repo (the hive's old
//! permission-seed repo, which `meta::remove_permission_files` still commits
//! to) and its read-access grants. Those writes, as `core`, run only beside a local `hive-forge`
//! container; reads of the forge go through [`reader_token`] on every hive.
//! The swarm-wide orgs, teams and repos, and each agent's read grant on
//! `internal/docs`, are swarm-controller's. Full design:
@ -215,8 +216,8 @@ where
.map_err(|_| anyhow::anyhow!("{op}: no answer from the forge within {API_TIMEOUT:?}"))
}
/// Per-agent forge sync: grant read access to `core/meta`, and wire the
/// `meta` remote in its proposed repo. All operations are idempotent;
/// Per-agent forge sync: grant read access to the legacy `core/meta`, and wire
/// the `meta` remote in its proposed repo. All operations are idempotent;
/// failures are logged as warnings but don't abort the caller.
///
/// `core_token` is `core_token()` — passed in so callers that already
@ -234,8 +235,9 @@ pub async fn sync_agent(name: &str, core_token: Option<&str>) -> bool {
// swarm-controller's; this hive creates none of them and pushes nothing
// to the repo.
let mut ok = true;
// Grant read-only access to core/meta and wire the `meta` remote
// into the proposed repo so agents can fetch their deployment context.
// Grant read-only access to the legacy core/meta and wire the `meta`
// remote into the proposed repo. Agents build from `internal/meta`, not
// from this repo.
if let Some(token) = core_token
&& let Err(e) = meta_read_access(name, token).await
{
@ -249,7 +251,7 @@ pub async fn sync_agent(name: &str, core_token: Option<&str>) -> bool {
ok
}
/// The `core_token.is_some()` half of [`ensure_all`]: the meta repo, the
/// The `core_token.is_some()` half of [`ensure_all`]: the legacy meta repo, the
/// core avatar, and removing this hive's own config-PR hook —
/// every step that needs an authenticated forge client. The swarm-wide
/// objects (orgs, the `operators` team, mirrors, `internal/docs`,
@ -258,9 +260,9 @@ pub async fn sync_agent(name: &str, core_token: Option<&str>) -> bool {
/// `ensure_all` under clippy's function-length limit; not meant to be called
/// from anywhere else.
async fn ensure_all_orgs_and_repos(token: &str) {
// Meta repo lives at core/meta — pushed from git_commit in
// meta.rs on every deploy/lock-update. Make sure it exists
// before the first push hits a 404.
// The legacy meta repo lives at core/meta. The only push to it is
// `meta::remove_permission_files`' commit; make sure the repo exists
// before that push hits a 404.
if let Err(e) = ensure_repo("meta", token).await {
tracing::warn!(error = ?e, "forge: ensure_repo core/meta failed");
crate::warnings::set_boot_warning(
@ -380,7 +382,7 @@ async fn wait_until_ready() -> bool {
}
/// Sweep the forge at startup: seed the `core` admin user (hive-c0re's own
/// identity for pushing the meta repo + driving the API) and its token, the
/// identity for pushing the legacy meta repo + driving the API) and its token, the
/// `core/meta` repo and the local knowledge clone, then run [`sync_agent`]
/// over every existing container (manager + sub-agents). Agent accounts,
/// tokens and `agent-configs/<name>` repos are the swarm-controller's, as is