From f1f611ba015c122a11a2507248b04016915790ea Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Fri, 6 Nov 2026 20:30:17 +0100
Subject: [PATCH] tmpfiles creates the agents root owned by hive-core

a fresh host's hive-priv made /var/lib/hyperhive/agents root-owned, so
hive-c0re could not create agent dirs (nightly run #7113). the rule
names no mode, so existing hosts are unchanged.

Closes #6143
---
 nix/host-modules/hive-c0re/default.nix |  6 ++++++
 nix/module-eval/core-toggle.nix        | 10 ++++++++++
 2 files changed, 16 insertions(+)

diff --git a/nix/host-modules/hive-c0re/default.nix b/nix/host-modules/hive-c0re/default.nix
index d6eee697..0292f781 100644
--- a/nix/host-modules/hive-c0re/default.nix
+++ b/nix/host-modules/hive-c0re/default.nix
@@ -208,6 +208,12 @@ in
       });
     '';
 
+    # The parent of every agent's state dir. hive-c0re runs as hive-core and
+    # makes `agents/<name>/...` itself, so the root must be hive-core's before
+    # the first agent exists; hive-priv would otherwise create it root-owned.
+    # No mode: tmpfiles creates it 0755 and leaves an existing dir's mode alone.
+    systemd.tmpfiles.rules = [ "d /var/lib/hyperhive/agents - hive-core hive-core -" ];
+
     # The gateway nginx is always the sole external entry point (it runs
     # alongside hyperhive), so the per-agent web-port range stays closed on
     # the host firewall. See `docs/4-implementation/networking/gateway.md::Firewall posture (host-level)`.
diff --git a/nix/module-eval/core-toggle.nix b/nix/module-eval/core-toggle.nix
index 4b0f5c41..ba7f62b1 100644
--- a/nix/module-eval/core-toggle.nix
+++ b/nix/module-eval/core-toggle.nix
@@ -807,6 +807,16 @@ let
         && hive.extraConfig == gw.lib.securityHeaders
         && hive.locations ? "/";
     }
+    {
+      # hive-priv creates the agents root as root on a host with no agents yet,
+      # and hive-c0re (hive-core) then cannot make `agents/<name>`. The rule
+      # names no mode, so a host that has the dir keeps its mode. The second
+      # arm needs the first: a host with the controller off has no such rule.
+      name = "the agents root is created hive-core-owned with the mode left to the default";
+      ok =
+        lib.elem "d /var/lib/hyperhive/agents - hive-core hive-core -" allLocal.systemd.tmpfiles.rules
+        && !(lib.any (lib.hasInfix "/var/lib/hyperhive/agents") centralToggleOff.systemd.tmpfiles.rules);
+    }
     {
       # The file held bcrypt hashes at 0644; a host carrying one from before
       # gets it deleted, and nothing names it for nginx.