mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-controller: stop minting the per-hive matrix sender account and token nothing reads

Browse source
This commit is contained in:
damocles 2026-11-12 15:38:34 +01:00
commit c66832febf
1 changed files with 40 additions and 556 deletions
Download patch file Download diff file Expand all files Collapse all files

34
docs/4-implementation/swarm/matrix-provisioning.md
View file

@ -42,8 +42,7 @@ a token.
not talk to matrix.
5. **`swarm-controller` creates every account**: each agent's, with its
token stored at `swarm/agents/<agent>/matrix/main` for the agent's
`hive-matrix-daemon` to read as the agent itself, and each hive's
sender account (below).
`hive-matrix-daemon` to read as the agent itself.
A homeserver whose `swarm-matrix-ctl` has no store identity
(`services.hyperhive.deploy.matrix.ctlBaoClientCertFile`) loads no
@ -60,8 +59,7 @@ Until you do, `swarm-bao-matrix-oidc` fails naming both.
The registration's id is `swarm`, its sender `@swarm`, and its user
namespace non-exclusive. It's the swarm's identity on the homeserver:
`swarm-controller` creates every agent's account and every hive's sender
account with it.
`swarm-controller` creates every agent's account with it.
The swarm secret store holds the registration's tokens, at
`swarm/controller/swarm-controller/matrix/appservice-registration`.
@ -95,26 +93,14 @@ when it's missing, unknown to the homeserver, or someone else's. An
agent's daemon picks a re-minted token up on its next start, and a timer
restarts it while it's down.
### A hive's sender account, and why it isn't an admin
### Hives have no matrix account
`@hive-<hive>:<server_name>` is the account a hive acts as.
`swarm-controller` creates it with the swarm's appservice token, for every
hive in its directory. It's an **ordinary account**: nothing promotes it;
the homeserver's `admin_execute` promotes only `@swarm`.
**One account per hive.** The localpart carries the hive's name, so a swarm
whose hives share a homeserver gives each of them its own identity: the
homeserver attributes an action to the hive that took it, and revoking one
hive's standing leaves the others alone.
Its access token is the **sender token**. `swarm-controller`, its only
minter, mints it for every hive with the swarm's appservice token and
publishes it to `swarm/hives/<hive>/matrix/sender-token`, inside the hive's own
read grant (`swarm/hives/<hive>/*`). Nothing on the hive uses it any more:
hive-c0re used to present it for its Space and invite calls and no longer
makes any. The name says what it authenticates as — an account the
swarm's appservice creates — rather than any privilege level, because it
carries none.
Earlier versions created an `@hive-<hive>:<server_name>` sender account per
hive and stored its token at `swarm/hives/<hive>/matrix/sender-token`.
hive-c0re no longer talks to matrix, so `swarm-controller` no longer creates
or refreshes either. Existing accounts and the stored tokens are harmless
leftovers: nothing reads them, and the `swarm-controller` policy has no grant
on the path.
Promoting a user to homeserver admin and resetting a password both need an
admin **sender**: `!admin …` messages into `#admins:<server_name>`, and
@ -136,7 +122,7 @@ boot has both halves. With the store down or sealed, tuwunel waits for it.
`login_with_password` stays on, so the password fallback works
too.
- **The homeserver's `admin_execute` promotes only `@swarm` at boot**
(above); a hive's sender account is never promoted.
(above); no other swarm account is promoted.
- **The value that matters lives at
`swarm/controller/swarm-controller/matrix/appservice-token`.**
`appservice sync` writes it there whenever the store's differs from the