- swarm-archive.nix, lib/archive-server.nix: deploy.archive.backend and
deploy.archive.s3.* options; the s3 server and the prune read the key from the
store into rclone's environment; the prune lists and addresses repositories
through rclone instead of a local directory
- swarm-bao.nix: the archive reads swarm/services/archive/s3/*
- docs: archive.md "External S3" section, two credentials-reference rows
- module-eval: builder.nix cases for local and s3, the missing-setting
assertion; bao-grants.nix gains the s3 read grant
- vm test: second node with a fake rclone serve s3 whose key is generated at
test time
The panels took the max or sum over the one swarm runner. A runner variable
(the series' service.instance.id) filters every panel, and uptime, job slots
and slot use show one series per runner, so a runner registered by hand shows
up beside the swarm's once its metrics reach the store.
A client chooses a snapshot's time, so snapshots dated ahead could fill
--keep-last and push the real ones out of a prune. The prune now forgets
snapshots dated more than an hour after now first, and logs their ids. The
VM test forges one and checks the real snapshot stays. The bao-grants case
that read a + path as a glob now names the literal path, and two cases that
pinned 'nothing else' list the archive grants. The ciRunner stanza is back
at its original indent.
The archive host creates a ready marker in the store and swarm-controller
writes no credentials before it exists, so a swarm without an archive, and a
mixed-version swarm, leave every hive backup a logged no-op. A hive with no
declaration no longer counts as placing nothing: its copies and its agents'
user lines stay. The restic password is pinned by tests across a revoke, a
re-placement and a move.
swarm-archive serves restic repositories with rclone, append-only, one login
and one repository per agent. swarm-controller writes each placed agent's
login and restic password to the store, replaces them on a move and removes
them when the agent is destroyed. Every hive backs its agents up hourly under
its own store identity. The archive host prunes by retention.
The agent's settings get a claude login row: when the swarm stored the
login, read by the minter from the leaf's metadata, or that none is, with a
delete that removes every version after a confirmation. New minter steps
(status, delete), controller routes (GET claude-login, DELETE
claude-login/stored) and a read and delete grant on the leaf's metadata,
pinned in the module-eval check.
Squid logs a tunnel's bytes once, when it closes, so a large download was
one point in a small bucket and read as instantaneous. The panel now has a
5 minute minimum interval and bars, so that point is a visible bar. The
module-eval check pins both.
init prints the store's keys and root token once and keeps none; with
--and-grant it goes on to the granter bootstrap in the same process.
grant-bootstrap does that step alone, reading the root token from a
hidden prompt or stdin. The token reaches bao only as BAO_TOKEN in the
child's environment.
Adds host.json (hive and host filters over the hostmetrics series),
registers it in the provisioned dashboard list, lists it in the swarm
services handbook, and adds a module-eval case that it ships and every
query filters on both variables.
Each agent row on the hive dashboard, and the agent page's link menu, linked
to the agent's forge profile and its config repo. Both are gone, with what
only they used:
- hive-agent no longer builds the two links, the `Forge` link kind, or the
`forge_public_url` field of its state, and no longer reads
`HIVE_FORGE_PUBLIC_URL`. The agent page's link menu and the dashboard row's
icon strip (which skips a forge link an agent not yet rebuilt still sends)
drop their forge handling.
- hive-c0re's dashboard state no longer carries `forge_public_url`.
- `HIVE_FORGE_PUBLIC_URL` is no longer forwarded to agents through the meta
flake (the forwarded-variable list, its test fixture, the controller's
settings and the VM test), so the next meta flake render differs by that
one line. hive-c0re still reads it for the forge URL a hive publishes, so
`swarm.forge.publicUrl` stays, with its description corrected.
- The docs stop describing the links.
The handbook's sections were agent-lifecycle, integrations, swarm, tools,
trust-boundary and web-ui, which do not follow how the system is built, so a
reader could not tell which layer a page is about. Its pages now sit in
swarm/, hives/ and agents/, with the accounts an agent can hold outside the
system in external-accounts/.
- swarm/: forge, matrix and the knowledge repo join the swarm pages, and so
does the swarmctl reference.
- hives/: the dashboard, hivectl and its reference, and the operator/agent
boundary, with a README that takes over the old web-ui and tools pages.
- agents/: the roster, persistence, config changes, the agent's own web page
(was web-ui/agent) and the security model, with a README.
- external-accounts/: GitHub and GitLab.
Pages are moved whole; none is split yet. Every reference follows: relative
links in the docs, `docs/2-handbook/...` paths in code comments, the nix
checks that regenerate the CLI references and the ignore list, and docs/README.md,
whose handbook section is now by layer.
a re-created cache signs with a new key; the fact was only created once, so
every hive then rejected the swarm's closures. the cache's grant gains update
on that one leaf, and a store that refuses it leaves the key as it was.
Closes#6181
a fresh host's hive-priv made /var/lib/hyperhive/agents root-owned, so
hive-c0re could not create agent dirs (nightly run #7113). the rule
names no mode, so existing hosts are unchanged.
Closes#6143
Every docs directory moves under 1-getting-started, 2-handbook,
4-implementation or 5-project; the options reference (section 3) comes from
the website and has no directory here. trust-boundary stays whole under the
handbook for now. web-ui, swarm and tools split between handbook and
implementation, and the command-line references move to
2-handbook/reference. Links, path references in code and nix, and the docs
index follow the moves; no page content changes.
a late store root dependency-fails forgejo-swarm-controller-account on
first boot and the refresh never started it, so the controller got no
forge token (vm-nightly #7084). list it as a trust consumer.
Closes#6109
tuwunel 1.9.4 exports no metrics. The host collector gets an httpcheck
receiver on the gateway's /_matrix/client/versions (new
services.hyperhive.otel.httpChecks, declared by hive-matrix), and a timer in
the hive-matrix container pushes the database directory's size through the
forwarder's OTLP port, as the attic cache-size unit does. The size step
dereferences the state directory's symlink and pushes nothing for a result
under 4096 bytes.
The builder pushes its build metrics (builds by kind and outcome, build
duration, queue depth and wait, reply publish failures) to its forwarder's
OTLP receiver, which relays them to the swarm collector.
It also registers the standard store client-certificate gauges
(bao.client_cert.*, cert=builder) on the same exporter. They are the
builder's liveness signal: exported every minute whether or not a build
runs. The cert-metrics table in docs/scheduler/observability.md gains the
builder row.
