From 27ac0153c4015793adef8e42f0e69f79a964f8f4 Mon Sep 17 00:00:00 2001 From: atlas Date: Fri, 19 Jun 2026 13:15:43 +0200 Subject: [PATCH] forge authz: scrub tracker tags from comments Replace the #-number tracker references in code comments with prose (tracker-tag lint; hive convention is prose in source). No behaviour change. Branch-protection / collaborator / team / repo API field names were verified against the live Forgejo swagger. --- hive-c0re/src/agent_server.rs | 2 +- hive-c0re/src/forge.rs | 18 +++++++++--------- hive-c0re/src/paths.rs | 2 +- hive-sh4re/src/lib.rs | 4 ++-- 4 files changed, 13 insertions(+), 13 deletions(-) diff --git a/hive-c0re/src/agent_server.rs b/hive-c0re/src/agent_server.rs index 0032911b..66002c6d 100644 --- a/hive-c0re/src/agent_server.rs +++ b/hive-c0re/src/agent_server.rs @@ -318,7 +318,7 @@ fn valid_repo_name(name: &str) -> bool { } /// `CreateRepo` — create a repo for `agent` *through hive-c0re* in the -/// c0re-owned `agents` org with operator-team branch protection (#1787). +/// c0re-owned `agents` org with operator-team branch protection. /// The sanctioned create path now that agents can't create repos directly. async fn handle_create_repo(agent: &str, repo: &str) -> hive_sh4re::Response { if !valid_repo_name(repo) { diff --git a/hive-c0re/src/forge.rs b/hive-c0re/src/forge.rs index e44e8dc6..d0f4f8eb 100644 --- a/hive-c0re/src/forge.rs +++ b/hive-c0re/src/forge.rs @@ -51,7 +51,7 @@ const SHARED_DOCS_REPO: &str = "docs"; /// Bind-mounted read-only into every container at `/knowledge`. /// See `hive-c0re/src/knowledge.rs`. const KNOWLEDGE_REPO: &str = crate::knowledge::REPO; -/// Forgejo org that owns agent-created repos (#1787). Agents can't create +/// Forgejo org that owns agent-created repos. Agents can't create /// repos with their own token (`max_repo_creation = 0`); instead hive-c0re /// creates them here and adds the requesting agent as a **write** member /// (not owner/admin). Because the org — not the agent — owns the repo, @@ -66,7 +66,7 @@ const AGENTS_ORG: &str = "agents"; /// rule never hardcodes a specific reviewer agent (which may not exist). const OPERATORS_TEAM: &str = "operators"; /// Hive-managed Forgejo namespaces that agent-initiated repo creation must -/// never target (#1787). `internal` is operator-curated shared content; +/// never target. `internal` is operator-curated shared content; /// `agent-configs` + `core` are hive-c0re-internal mirror/meta namespaces. /// (`hyperhive` is NOT managed — it's just a repo that happens to be built /// by this hive.) hive-c0re's create path forces [`AGENTS_ORG`], so this is @@ -271,7 +271,7 @@ async fn ensure_user_email(name: &str) { } /// Disable direct repo creation for agent `name` by setting -/// `max_repo_creation = 0` on its Forgejo account (#1787). Agents must +/// `max_repo_creation = 0` on its Forgejo account. Agents must /// create repos *through hive-c0re* (which owns the perms), never with /// their own token — a write-scoped token can otherwise create + own /// repos and self-merge, bypassing the operator-only-merge policy. @@ -894,7 +894,7 @@ async fn ensure_org(name: &str, admin_token: &str) -> Result<()> { } /// Whether `ns` is a hive-managed Forgejo namespace that agent-initiated -/// repo creation must never target (#1787) — `internal` (operator-curated +/// repo creation must never target — `internal` (operator-curated /// shared content) + `agent-configs` / `core` (hive-c0re-internal). The /// create path forces [`AGENTS_ORG`], so this guards a future surface that /// might accept an explicit owner. @@ -904,7 +904,7 @@ pub fn is_hive_managed_namespace(ns: &str) -> bool { } /// Provision the [`OPERATORS_TEAM`] inside [`AGENTS_ORG`] as an **empty** -/// team (#1787). Branch protection on agents-org repos references it as the +/// team. Branch protection on agents-org repos references it as the /// merge/approval whitelist; the operator adds herself as a member via the /// forge UI / hivectl. `includes_all_repositories` so the gate applies to /// every agent repo; `write` is enough to approve + merge. hive-c0re never @@ -955,7 +955,7 @@ async fn add_collaborator( } /// Apply the operator merge-gate branch protection to `repo`'s default -/// branch (#1787): only [`OPERATORS_TEAM`] members can merge, and an +/// branch: only [`OPERATORS_TEAM`] members can merge, and an /// approving review from that team is required — so the author (a write-level /// agent, not in the team) cannot merge its own PR. Idempotent: an existing /// rule for the branch (200/409/422) is treated as success. @@ -979,7 +979,7 @@ async fn apply_operator_branch_protection(repo: &str, token: &str) -> Result<()> } /// Create a repo for `agent` in the c0re-owned [`AGENTS_ORG`] and wire the -/// #1787 perms: the org owns it (perms stay c0re-managed), the agent is added +/// perms: the org owns it (perms stay c0re-managed), the agent is added /// as a **write** collaborator (not owner — can push + open PRs but can't /// bypass branch protection), and the default branch gets the operator /// merge gate. This is the sanctioned create path now that agents can't @@ -1011,7 +1011,7 @@ pub async fn sync_agent(name: &str, core_token: Option<&str>) { // so commits link to the agent's Forgejo profile. Best-effort; // also patches up agents created before this fix (old @hive.local). ensure_user_email(name).await; - // Block direct agent-initiated repo creation (#1787): agents create + // Block direct agent-initiated repo creation: agents create // repos through hive-c0re, never with their own token. Idempotent + // marker-guarded; also covers agents provisioned before this landed. ensure_repo_creation_disabled(name).await; @@ -1073,7 +1073,7 @@ pub async fn ensure_all() { } // Provision the operator merge-gate team (empty) inside the agents // org so branch protection can reference it before anyone joins - // (#1787). The operator adds herself as a member out-of-band. + //. The operator adds herself as a member out-of-band. if let Err(e) = ensure_operators_team(token).await { tracing::warn!(error = ?e, "forge: ensure_operators_team failed"); } diff --git a/hive-c0re/src/paths.rs b/hive-c0re/src/paths.rs index 72887b7f..df63d19c 100644 --- a/hive-c0re/src/paths.rs +++ b/hive-c0re/src/paths.rs @@ -62,7 +62,7 @@ pub fn forge_email_aligned_marker(name: &str) -> PathBuf { /// `forge/repo-creation-disabled-` — marker: ``'s forge user /// has had `max_repo_creation = 0` applied (blocks direct agent-initiated -/// repo creation — see #1787). One-shot guard so the PATCH runs once per +/// repo creation). One-shot guard so the PATCH runs once per /// agent (including agents provisioned before the change); delete to /// re-apply. #[must_use] diff --git a/hive-sh4re/src/lib.rs b/hive-sh4re/src/lib.rs index bc4a3623..b49f1963 100644 --- a/hive-sh4re/src/lib.rs +++ b/hive-sh4re/src/lib.rs @@ -572,7 +572,7 @@ pub enum Request { /// per-kind semantics in /// `docs/conventions.md::Loose-ends wire shape`. CancelLooseEnd { kind: CancelLooseEndKind, id: i64 }, - /// Create a git repo *through hive-c0re* (#1787). Agents can't create + /// Create a git repo *through hive-c0re*. Agents can't create /// repos with their own forge token (`max_repo_creation = 0`); this is /// the sanctioned path. hive-c0re creates `repo` in the c0re-owned /// `agents` org, adds the calling agent as a write collaborator (not @@ -966,7 +966,7 @@ pub enum ToolGroup { /// `get_logs` - *(privileged)* Diagnostics, /// `create_repo` — create git repos through hive-c0re (the only path - /// now that agents can't create them directly; see #1787). Opt-in per + /// now that agents can't create them directly). Opt-in per /// agent so the operator controls who can spin up repos. Forge, /// `run`, `status` (via `mcp__bash__*`)