From 09e2ad326c1617930f9a0b07047fd4e4a32ee24b Mon Sep 17 00:00:00 2001
From: iris <iris@hyperhive.local>
Date: Fri, 5 Jun 2026 18:36:39 +0200
Subject: [PATCH] fix: update PrivRequest table to match actual
 hive-sh4re::priv_proto variants

Replace stale AddBindMount/RemoveBindMount/SetNetworkIsolation/ReloadGateway
entries with the actual current variants from hive-sh4re/src/priv_proto.rs:

- WriteNspawnFlags (replaces AddBindMount/RemoveBindMount/SetNetworkIsolation)
- WriteResourceLimits (new)
- RemoveServiceDropin (new)
- DaemonReload (new)
- ChownSocketDir / ChmodSocketDir (new)
- RunForgeAdmin (new)
- RestartMatrixDaemon (new)
- ReloadGatewayNginx (renamed from ReloadGateway)
---
 docs/security.md | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/docs/security.md b/docs/security.md
index 4c9ead78..cebfb621 100644
--- a/docs/security.md
+++ b/docs/security.md
@@ -98,10 +98,15 @@ known operations; there is no arbitrary command pass-through:
 | `DestroyContainer` | `nixos-container destroy <name>` |
 | `ListContainers` | `nixos-container list` |
 | `ReadContainerJournal` | `journalctl -M <container> -n <n> [filters...]` |
-| `ReloadGateway` | `systemctl -M hive-gateway reload/start/reset-failed nginx` |
-| `AddBindMount` / `RemoveBindMount` | `systemctl set-property` or `machinectl bind` |
-| `WriteAgentForgeToken` / `WriteAgentMatrixToken` | write `0600` credential file into agent state |
-| `SetNetworkIsolation` | manage per-container network isolation flags |
+| `ReloadGatewayNginx` | `systemctl -M hive-gateway reload/start/reset-failed nginx` |
+| `WriteNspawnFlags` | write `/etc/nixos-containers/<container>.conf` (bind-mount list + network isolation vars) |
+| `WriteResourceLimits` | write `CPUQuota=`/`MemoryMax=` systemd drop-in for agent container |
+| `RemoveServiceDropin` | remove `container@<name>.service.d/` drop-in on destroy |
+| `DaemonReload` | `systemctl daemon-reload` |
+| `ChownSocketDir` / `ChmodSocketDir` | chown/chmod `/run/hive-agent/<name>/` socket directory |
+| `RunForgeAdmin` | `nixos-container run hive-forge -- runuser -u forgejo -- forgejo admin <args>` |
+| `WriteAgentForgeToken` / `WriteAgentMatrixToken` | write `0600` credential file into agent state dir |
+| `RestartMatrixDaemon` | `systemctl --machine=h-<name> restart hive-matrix-daemon.service` |
 
 **Container allowlist** — every request is validated against an
 allowlist before any operation: only names matching `h-<agent>` (the