push green meta builds to the attic cache and record cached

swarm-builder/README.md

@@ -19,7 +19,7 @@ the answer into a `swarm-builder` commit status on the PR's head.
   as an untrusted client, so a config can neither set daemon options nor read
   this service's environment.
 - Nothing is pushed and nothing is recorded: the closure stays in the host's
-  store until it is collected.
+  store until it is collected. (A meta build can push, see below.)
 
 ## Meta builds
 
@@ -31,16 +31,21 @@ the platform it builds for. The controller records the answer; the service
 writes nothing. It takes the same one-build slot as the PR checks. See
 [`docs/swarm/builder.md`](../docs/swarm/builder.md#deploy-gate).
 
+Where `services.hyperhive.swarm.attic.{domain,cache}` are set, it first pushes a
+green build's closure to that cache with `attic push`, and the answer says
+whether that worked. A failed push leaves the build green. See
+[`docs/swarm/builder.md`](../docs/swarm/builder.md#binary-cache).
+
 ## Credentials
 
 The container holds one credential: its own store certificate, which nspawn
 hands in at start without a copy on disk. With it the service reads its
 queue client secret at start and again when authelia refuses it, and its
-read-only forge token at every build.
+read-only forge token at every build, and the cache push token at every push.
 `git` gets the token through a credential helper reading the child's
 environment, never in a URL or an argument, and the helper answers only an
 `https` request for the forge's host. Its store role reads exactly
-those two paths.
+those three paths.
 
 ## Archetypes