From 2095bb2d0ff9e20a0d7314ab1404533865c576d1 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Wed, 28 Oct 2026 22:25:41 +0100
Subject: [PATCH] compare the seed file in the unit environment as a path
 string

---
 nix/module-eval/hive-otel.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/nix/module-eval/hive-otel.nix b/nix/module-eval/hive-otel.nix
index cf378a95..b085d702 100644
--- a/nix/module-eval/hive-otel.nix
+++ b/nix/module-eval/hive-otel.nix
@@ -650,7 +650,9 @@ let
         && builtins.elem "f ${sq.agentAllowFile} 0640 hive-core squid - -" rules
         && env.HIVE_SQUID_ALLOWED_FILE == sq.allowedFile
         && env.HIVE_SQUID_AGENT_ALLOW_FILE == sq.agentAllowFile
-        && env.HIVE_SQUID_ALLOWED_SEED_FILE == toString sq.allowedSeedFile
+        # The unit's environment holds the seed as a derivation until the unit file
+        # is rendered, so it is compared as a path string.
+        && toString env.HIVE_SQUID_ALLOWED_SEED_FILE == toString sq.allowedSeedFile
         &&
           env.HIVE_SQUID_ALWAYS_ALLOWED == "api.anthropic.com claude.ai platform.claude.com cache.nixos.org";
     }