Adds checks.<system>.vm-test-typecheck-<name> for hive-squid, swarm-archive, agent-ephemeral-rootfs, full-setup and wg-hive: ty and ruff F over nixpkgs' test-script prelude, the machine hints from the node names, and the script text. Node configs are never evaluated. vm-test-typecheck-control passes only when ty rejects a known type error.
A forward chain in the hive-owned nft table logs each new flow from the agent bridge to the uplink (v4 and v6) and counts every packet. It never blocks. The mesh interface is skipped. Logging is rate limited per source address; a flow that limit cannot log gets one line from a shared limit with its own prefix. services.hyperhive.network.egress.forward selects accept, log (default) or drop; drop is refused at evaluation until the interception it needs exists.
The clock shows the date without the time of day. Elasticity drops from 0.3 to 0.1 so the tree sways less through large refactors. Captions come from the git tags and a tracked milestones file with a milestone per component and service at the commit that introduced it, plus growth markers (commit counts, 50k-line steps, issue and PR id doublings). --record writes gource-hyperhive.webm, AV1 in WebM through SVT-AV1, instead of a near-lossless H.264 file. --help (or -h) lists the flags; an unknown argument prints it on stderr and exits 2.
The classifier's Anthropic and ACP provider keys were written by hand in the
secret store's UI. The controller now stores them: GET
/api/review-classifier/keys says whether each is set and when it changed, and
PUT /api/review-classifier/keys/{runtime} writes one. No route answers a key.
The controller's store policy gains create and update on the two leaves with
no read of their values, and a metadata read for the set state. The swarm UI's
classifier settings card gets a key form beside the settings, saved apart
because it goes to the secret store.
A domain variable, the destination host from the proxy's access log, sits beside
the agent one and every query on the board filters on both, so one domain and
its agents show which agents queried it and when.
An archetype's meta gets an optional icon, the SVG text (at most 16 KiB), which
the controller checks, stores and serves on GET /api/archetypes. The built-in
archetypes read theirs from nix/archetypes/icons. The create form shows each
archetype as a tile with its icon and name, laid out like the broadcast screen's
agent tiles, in place of the dropdown, and draws the SVG through an img data URL.
The queue subjects, scratch directory and stdio steps of a login, the harness's
newer-version rule, the minter's grants, the caveat and the metrics move to
4-implementation/swarm/claude-login.md. The handbook page keeps how to log an agent
in, the stored login and who may do it. Design pointers in the nix module, the
crate README and AGENTS.md name the new page.
reviewer, android-dev and reverse-engineer set services.hyperhive.agent.icon, with
lib.mkDefault, to an SVG under nix/archetypes/icons, so an agent built from one
shows an icon in the swarm UI until its config sets another. The archetype
module-eval check requires an svg icon on each.
The hive dashboard and the per-agent page lose their control-by-control UI
description and endpoint tables from the handbook. The full text moves to
4-implementation/web-ui/dashboard.md and agent-page.md, and the handbook pages
keep what an operator needs to find and use them. Code comments that named the
old sections point at the new pages.
