diff --git a/docs/integrations/forge.md b/docs/integrations/forge.md index b410972e..b0813026 100644 --- a/docs/integrations/forge.md +++ b/docs/integrations/forge.md @@ -216,7 +216,7 @@ pipeline steps in order: tab, or end-of-line), prepend `\` so the embedded body doesn't blow into a top-level h1/h2 inside the wrapper message when the dashboard renders it. Lines like `#tag`, `#123`, `#!/bin/bash` - are NOT headings — no escape, no cosmetic noise. Indented + **aren't** headings — no escape, no cosmetic noise. Indented "headings" inside lists / nested quotes keep their leading whitespace. diff --git a/docs/integrations/matrix.md b/docs/integrations/matrix.md index a0370ed1..056728a0 100644 --- a/docs/integrations/matrix.md +++ b/docs/integrations/matrix.md @@ -179,7 +179,7 @@ join floor. - `space-room-id` — the Space itself - `chat-room-id` — the `hive-chat` room -These paths are **outside** every agent state dir and are NOT deleted by +These paths are **outside** every agent state dir and **aren't** deleted by `nixos-container destroy --purge` — both survive full agent purges, and hive-c0re reuses them on re-provision. diff --git a/docs/process/conventions.md b/docs/process/conventions.md index 5de97651..85c78a88 100644 --- a/docs/process/conventions.md +++ b/docs/process/conventions.md @@ -156,7 +156,7 @@ the row with `redelivered: true`. Idempotent + cheap when there's nothing in flight, so the at-boot fire is unconditional. `AgentRequest::AckUntil { up_to }` is the agent-facing bulk-triage -escape hatch (`mcp__hyperhive__ack_until`). Unlike `AckTurn` it IS +escape hatch (`mcp__hyperhive__ack_until`). Unlike `AckTurn` **it's** visible to claude: each recv row and wake prompt carries a `[msg #]` marker (the broker row id; transient pings show no marker — their sentinel id 0 has nothing to ack), and diff --git a/docs/process/gotchas.md b/docs/process/gotchas.md index b719c19c..0b12f05d 100644 --- a/docs/process/gotchas.md +++ b/docs/process/gotchas.md @@ -163,7 +163,7 @@ it and the old generations are gone. ### Claude credentials are per-agent `/var/lib/hyperhive/agents//claude/` bind-mounts to -`/home//.claude` (RW). Sharing one dir across agents is NOT viable — +`/home//.claude` (RW). Sharing one dir across agents **isn't** viable — OAuth refresh tokens rotate, so any sibling refresh invalidates all the others. Login flow runs from the per-agent web UI; creds persist across `destroy`/recreate (`--purge` wipes them). diff --git a/docs/scheduler/ci.md b/docs/scheduler/ci.md index 59c7b6e2..64f617b2 100644 --- a/docs/scheduler/ci.md +++ b/docs/scheduler/ci.md @@ -180,7 +180,7 @@ A malicious `default.nix` or build script in a PR can therefore: - **Make arbitrary network requests** to any address reachable from the container. The container runs in its own netns behind the hive bridge, so it reaches the forge only through the gateway (`http://`, public/read endpoints — no admin credentials) and **can't** reach host-loopback services: the unauthenticated core dashboard at `127.0.0.1:7000` and the raw forge port are off-limits (bridge→127.0.0.0/8 is dropped). - **Write to the container filesystem**, including corrupting the runner's state dir or `.runner` credentials. -The core admin token (`forge-core-token`) is **not** bind-mounted into the container. it's held and used only by hive-c0re on the host (`forge/ci_runner.rs`), which mints per-runner registration tokens; only that registration token reaches the container's env-file. A build process can still reach forge over the network, but can't use the admin token to issue privileged API calls. +The core admin token (`forge-core-token`) **isn't** bind-mounted into the container. it's held and used only by hive-c0re on the host (`forge/ci_runner.rs`), which mints per-runner registration tokens; only that registration token reaches the container's env-file. A build process can still reach forge over the network, but can't use the admin token to issue privileged API calls. Note: `nix flake check --no-build` (eval-only) reduces the attack surface but doesn't eliminate it — `builtins.fetchGit`, `builtins.fetchurl`, and import-from-derivation can reach the network and filesystem during evaluation. The default CI workflow runs full `nix flake check` (builds derivations), which is the higher-risk path. @@ -214,7 +214,7 @@ following to your host config: # # `randomizedDelaySec` because a fixed daily time lands on the same wall # clock as whatever else runs nightly. A collection that overlaps a CI - # job does not fail it — the runner builds through the host nix-daemon, + # job doesn't fail it — the runner builds through the host nix-daemon, # so an in-flight build's temp roots are protected — but the first build # after a collection rebuilds what the collection deleted, so a run that # lands just behind one pays for it in wall time. diff --git a/docs/tools/forge.md b/docs/tools/forge.md index 38a01712..4fd63e5a 100644 --- a/docs/tools/forge.md +++ b/docs/tools/forge.md @@ -325,7 +325,7 @@ to discover valid label names before triaging or to audit the label set. --list-allowed` prints the instance's actual configured shortcode list (`GET /settings/ui`'s `allowed_reactions`) instead of guessing — instance-global, this path ignores ``/`--comment`. -- Do NOT use raw `curl` for forge access -- the CLI handles auth, +- **Don't** use raw `curl` for forge access -- the CLI handles auth, error checking, and output formatting. - `issue-create --label ` / `pr-create --label ` are repeatable and take the same spelling `labels add` does. **An diff --git a/docs/tools/lifecycle.md b/docs/tools/lifecycle.md index 3e9d1708..5a0be58b 100644 --- a/docs/tools/lifecycle.md +++ b/docs/tools/lifecycle.md @@ -64,7 +64,7 @@ flake. Pass specific input names (for example `["bitburner-agent"]`) or omit / pass `[]` for all inputs. Returns immediately; the lock update runs on operator approval. -Does NOT trigger container rebuilds — call `update(name)` on affected +**Doesn't** trigger container rebuilds — call `update(name)` on affected agents after the approval resolves. ## Boundary summary diff --git a/docs/tools/swarmctl-cli.md b/docs/tools/swarmctl-cli.md index 8079a308..bc70f6a2 100644 --- a/docs/tools/swarmctl-cli.md +++ b/docs/tools/swarmctl-cli.md @@ -67,7 +67,7 @@ Add a user, generating a password for them Change an existing user's attributes. -Every flag is optional and they compose, so one call can set multiple things at once. Deliberately does **not** touch the password: regenerating a credential is a different intent from editing an attribute, and folded together an attribute edit can invalidate a login by accident. +Every flag is optional and they compose, so one call can set multiple things at once. Deliberately **doesn't** touch the password: regenerating a credential is a different intent from editing an attribute, and folded together an attribute edit can invalidate a login by accident. **Usage:** `swarmctl user update [OPTIONS] ` diff --git a/docs/turn-loop/claude-invocation.md b/docs/turn-loop/claude-invocation.md index dfc62b5b..1a236496 100644 --- a/docs/turn-loop/claude-invocation.md +++ b/docs/turn-loop/claude-invocation.md @@ -250,7 +250,7 @@ needs to `chown` a bind mount), once at startup: **Marker grammar.** `` opens a block; any `` closes the current block. The renderer always uses - role `agent`, so it elides blocks with other role tags. Nesting is NOT + role `agent`, so it elides blocks with other role tags. Nesting **isn't** supported — a stray opener with no closer runs until end of file. The renderer tolerates whitespace inside markers (`` parses the same as ``). Content outside any marker is always diff --git a/docs/turn-loop/mcp.md b/docs/turn-loop/mcp.md index 145c3a6f..23238cf7 100644 --- a/docs/turn-loop/mcp.md +++ b/docs/turn-loop/mcp.md @@ -209,7 +209,7 @@ status hint lives in the wake prompt + UI header, not here. `Bash`, `Task`, `NotebookEdit`, `TodoWrite`. - Additionally in the managed-settings deny list (`/etc/claude-code/managed-settings.json`, un-overridable): `Task`, - `TodoWrite`. `Bash` is **not** in the managed deny — see below. + `TodoWrite`. `Bash` **isn't** in the managed deny — see below. - Allowed MCP tools: as listed above (by tool group). `Bash` is disallowed for the autonomous harness — shell execution goes diff --git a/docs/web-ui/css-vars.md b/docs/web-ui/css-vars.md index 74c5f950..e4510732 100644 --- a/docs/web-ui/css-vars.md +++ b/docs/web-ui/css-vars.md @@ -73,7 +73,7 @@ default palette). Default hexes shown are Catppuccin Mocha. ## Common mistakes -The Catppuccin colour names do **not** map 1:1 to the variable names. +The Catppuccin colour names **don't** map 1:1 to the variable names. Variables to avoid (undefined — they will silently resolve to transparent / inherited): | Wrong | Correct | diff --git a/docs/web-ui/dashboard.md b/docs/web-ui/dashboard.md index e349fb0a..e1ea75bb 100644 --- a/docs/web-ui/dashboard.md +++ b/docs/web-ui/dashboard.md @@ -99,8 +99,8 @@ messages are visible from any tab even while inactive. Backed by in_reply_to, file_refs). **◆ PR3F3R3NC3S ◆** — operator-local preferences. State lives in the -browser's `localStorage` — preferences do NOT sync between devices and -do NOT survive a profile wipe. One section today (browser +browser's `localStorage` — preferences **don't** sync between devices and +**don't** survive a profile wipe. One section today (browser notifications); future preferences land here as sibling `

` blocks in `dashboard.html`. Was its own S3TT1NGS page/tile (`/settings.html`) until mara moved it in here — a standalone page for one toggle didn't @@ -508,7 +508,7 @@ live container + any extra name that appears as a target on some schedule but isn't a current container (same `buildTargetChips` membership rule the new/edit forms use, so table and forms agree on what's addressable). Column -headers tilt -45° via CSS so each column reads as a narrow +headers tilt –45° via CSS so each column reads as a narrow ~28px strip; per-agent cells render as: - **active target** → `` that cancels just @@ -614,7 +614,7 @@ the model id, longest match wins) mapping to `{ input, output, cache_read, cache_write }` USD-per-million-token prices. Models not covered fall back to hive-c0re's built-in estimate. -The FL0W page does NOT host the PR3F3R3NC3S pane — it lives only on the +The FL0W page **doesn't** host the PR3F3R3NC3S pane — it lives only on the dashboard's Y3R C4LL tab (reach it via the FL0W page's `← home` back-link → Dashboard). Notifications still fire on the FL0W page when they're enabled there, because `NOTIF.show()` in diff --git a/swarmctl/src/main.rs b/swarmctl/src/main.rs index 2f98edf9..6e8a54e4 100644 --- a/swarmctl/src/main.rs +++ b/swarmctl/src/main.rs @@ -146,7 +146,7 @@ enum UserVerb { /// Change an existing user's attributes. /// /// Every flag is optional and they compose, so one call can set - /// multiple things at once. Deliberately does **not** touch the + /// multiple things at once. Deliberately **doesn't** touch the /// password: regenerating a credential is a different intent from /// editing an attribute, and folded together an attribute edit can /// invalidate a login by accident.