lifecycle: bind each sub-agent's config repo read-only at /agents/<name>/config

This commit is contained in:
damocles 2026-05-20 10:00:28 +02:00
parent 56e7eb6e73
commit 1529c2d777
4 changed files with 46 additions and 3 deletions

View file

@ -84,7 +84,11 @@ Survives destroy/recreate, gone on `--purge`.
Under `/var/lib/hyperhive/agents/<name>/`:
- `config/` — the proposed nix repo (manager-editable).
- `config/` — the proposed nix repo (manager-editable). Bind-mounted
**read-only** to `/agents/<name>/config` inside the sub-agent's own
container so the agent can inspect what defines it and request
precise changes from the manager; RW into the manager via the
`/agents` tree bind.
- `claude/` — claude OAuth credentials, bind-mounted RW to
`/root/.claude` inside the container.
- `state/` — durable notes, the events.sqlite db, and the