The card and its detail showed the message alone, so a message from an hour
ago read like the current one. Both now add the age, (5m ago), which ticks
like the other relative times. An agent with no message still shows a dash.
- swarm-archive.nix, lib/archive-server.nix: deploy.archive.backend and
deploy.archive.s3.* options; the s3 server and the prune read the key from the
store into rclone's environment; the prune lists and addresses repositories
through rclone instead of a local directory
- swarm-bao.nix: the archive reads swarm/services/archive/s3/*
- docs: archive.md "External S3" section, two credentials-reference rows
- module-eval: builder.nix cases for local and s3, the missing-setting
assertion; bao-grants.nix gains the s3 read grant
- vm test: second node with a fake rclone serve s3 whose key is generated at
test time
The controller's status, queue, AGENTS.md and forge-webhook details move to
4-implementation/swarm/controller.md. The metrics, logs and OTEL detail moves to
4-implementation/swarm/telemetry.md. Each leaves a short operator blurb with the
options to touch, and links into the moved text are updated.
The directory covered GitHub and GitLab only; the forge and matrix account
kinds an operator can link were described under the swarm UI page. Two new
pages (forgejo.md, matrix.md) cover linking, what the agent gets and
deleting in operator terms, the directory README lists them, and the UI page
keeps a pointer for each kind.
The card header carried a fresh/stale badge with the report's age. It now
sits in the status row of the opened card, which already showed it, and the
card header keeps the name, the message and the controls.
The board gained a Runner filter and one series per runner; the CI runner
section now says what the board shows and how it differs from the forge's CI
runs tab.
A client chooses a snapshot's time, so snapshots dated ahead could fill
--keep-last and push the real ones out of a prune. The prune now forgets
snapshots dated more than an hour after now first, and logs their ids. The
VM test forges one and checks the real snapshot stays. The bao-grants case
that read a + path as a glob now names the literal path, and two cases that
pinned 'nothing else' list the archive grants. The ciRunner stanza is back
at its original indent.
The archive host creates a ready marker in the store and swarm-controller
writes no credentials before it exists, so a swarm without an archive, and a
mixed-version swarm, leave every hive backup a logged no-op. A hive with no
declaration no longer counts as placing nothing: its copies and its agents'
user lines stay. The restic password is pinned by tests across a revoke, a
re-placement and a move.
swarm-archive serves restic repositories with rclone, append-only, one login
and one repository per agent. swarm-controller writes each placed agent's
login and restic password to the store, replaces them on a move and removes
them when the agent is destroyed. Every hive backs its agents up hourly under
its own store identity. The archive host prunes by retention.
the harness writes the reason into the pause marker when it pauses itself and reports it as paused_by_hive in its turn-state header. swarm-controller declares such an agent paused (only if declared up) and shows the reason on the agents status row and the swarm ui card.
A delete removes the leaf's metadata, so the KV number restarts at 1. A login
made right after a delete, before the next poll, was version 1 again and
looked no newer than the recorded 1, so it never installed. The version file
now records the store's write time next to the number and a later write
installs whatever its number. A record from before the time was kept falls
back to the number and gets its time when the same number is read again.
With the harness poll, an agent that holds a session logs out within 5
minutes of its stored login being deleted. The confirmation and the
claude-login page said the agent keeps its session.
wait_for_login read the store leaf only while the agent waited for a login.
A logged-in agent now reads it every 5 minutes, and a paused one once before
it resumes, so a login made or deleted in the swarm UI reaches an agent that
never failed. A newer version is installed; a store that answers nothing
stored after a version was installed means the stored login was deleted, and
the agent is logged out as /api/logout does it, with the recorded version
forgotten so the next login installs. A read that fails changes nothing.
The report had an approvals column (1/2) and a separate approved column.
They are one fact, so approvals now carries the filter, complete or missing,
and the approved column is gone.
The agent's settings get a claude login row: when the swarm stored the
login, read by the minter from the leaf's metadata, or that none is, with a
delete that removes every version after a confirmation. New minter steps
(status, delete), controller routes (GET claude-login, DELETE
claude-login/stored) and a read and delete grant on the leaf's metadata,
pinned in the module-eval check.
The services intro claimed singleHostSwarm runs every service with no further
setting. The CI runner is never derived, and the builder and cache need their
store identities on the host. The overview table is also formatted the way
treefmt wants it.
A short blurb per service with its enable option and a link to its section
or page, so an operator on a single host can see what each one is and which
two (builder, CI runner) are worth a look before switching on.
Three handbook pages carried sections an operator never reads, named after
source paths and build internals. They move to pages under 4-implementation,
and each handbook page keeps a short pointer.
- forge.md: the notification poller (what it polls, how it formats,
de-duplicates and marks notifications read) is now
agent-tools/forge-notify.md. The forge page keeps a short Notifications
section.
- matrix.md: the retired hive-side matrix code, the evaluation assertions and
the fluffychat-web build fixes are now networking/matrix-homeserver.md.
- github.md: the Implementation section (how `gh` and `git push`
authenticate, and the GitHub poller) is now agent-tools/github.md.
docs/README.md and the agent-tools README list the new pages, and AGENTS.md's
note on mixed operator and implementation docs now says to move the detail
and leave a pointer.
The setup page's first-agent example named the agent iris, and a user
copied it verbatim. Use <name> there, with a line saying the name is free
to choose, and agent1/agent2 in the hivectl, schedule and label examples.
The login dialog stayed open with a success line after the code was
accepted, though nothing is left to do in it. It now closes and a toast
says the login is stored. The toast is a new swarm-ui primitive: a short
note raised with showToast, rendered by a ToastHost at the app root, gone
after a few seconds or on click.
swarmctl setup with no subcommand checks the setup status first, then takes the open steps one at a time: prompts for input, shows a running action as one live line, prints the store keys, root token and new password under a warning until the operator confirms, and names the deploy option for a step this host cannot do. It calls the code of bao init, bao grant-bootstrap, user add, forge make-admin, agent create, agent permissions set and agent set-state. Refuses without root or a terminal.
init prints the store's keys and root token once and keeps none; with
--and-grant it goes on to the granter bootstrap in the same process.
grant-bootstrap does that step alone, reading the root token from a
hidden prompt or stdin. The token reaches bao only as BAO_TOKEN in the
child's environment.
Adds host.json (hive and host filters over the hostmetrics series),
registers it in the provisioned dashboard list, lists it in the swarm
services handbook, and adds a module-eval case that it ships and every
query filters on both variables.
The handbook's sections were agent-lifecycle, integrations, swarm, tools,
trust-boundary and web-ui, which do not follow how the system is built, so a
reader could not tell which layer a page is about. Its pages now sit in
swarm/, hives/ and agents/, with the accounts an agent can hold outside the
system in external-accounts/.
- swarm/: forge, matrix and the knowledge repo join the swarm pages, and so
does the swarmctl reference.
- hives/: the dashboard, hivectl and its reference, and the operator/agent
boundary, with a README that takes over the old web-ui and tools pages.
- agents/: the roster, persistence, config changes, the agent's own web page
(was web-ui/agent) and the security model, with a README.
- external-accounts/: GitHub and GitLab.
Pages are moved whole; none is split yet. Every reference follows: relative
links in the docs, `docs/2-handbook/...` paths in code comments, the nix
checks that regenerate the CLI references and the ignore list, and docs/README.md,
whose handbook section is now by layer.
The reports tab holds cards, so a card named "issue report" repeats the word.
The card is now "issues", beside "pull requests", and the handbook says the
same.
The pull requests card gets a diff column, the lines a PR adds and removes
(`+120 −8`), sortable on the total. The controller takes the counts from the
forge's pull request list, so no call is added. The column that said "has all
approvals" is now headed "approved".
The reports tab gets a "pull requests" card under the issue report. It lists
the open PRs of every repo, or of one picked in a repo select, with the
columns a reviewer or merger filters on: author, labels, requested
reviewers, base branch, WIP (the forge's draft flag), approvals against the
base branch's protection rule, has all approvals, conflicts, protected base
and CI. Every column sorts, the small-set columns filter by picking values,
and the browser keeps the filters and the repo. No filter applies at first.
swarm-controller resolves each row so the page makes no calls of its own:
GET /api/pr-report and GET /api/repos/{org}/{repo}/pr-report. The required
approvals come from the first matching branch protection rule (an
unprotected base asks for none); an approval counts when it is the
reviewer's latest decision, on the current head, neither stale nor
dismissed and official.
A free-text table cell gets a minimum width, so a table with many columns
scrolls sideways instead of wrapping a title to a word a line.
The limit was a constant of ten in swarm-wire, so a repo with eleven rules
could not be reviewed and nothing short of a rebuild changed it. It is now
`max_classifications` in the classifier settings, beside
`max_concurrent_reviews`: 1 to 1000, ten until set, and a document stored
before the field decodes with the default. The classifier settings form in
the swarm UI gets a "rules per review" field, and the try-out's add button
stops at the saved limit instead of a hard-coded ten.
The controller checks a try-out, and a requested review's rules file, against
the setting where the run starts. The rules file itself may hold up to the
1000 the setting allows, so raising the limit needs no change to a repo.
A review whose rules exceed the limit posts a no-verdict comment saying so.
A run's reply deadline was a constant that covered ten classifications, a
minute plus three each. It is now computed from the run's own size, so a
bigger run waits as long as it needs and a default-sized one still waits 31
minutes. The classifier's answer window in the queue permissions covers the
biggest run the setting allows.
