From 2989c5ccdb9a55fcf21aad3fc636abb1ba93c553 Mon Sep 17 00:00:00 2001 From: atlas Date: Sun, 13 Sep 2026 00:42:14 +0200 Subject: [PATCH] swarm: say "no queue coordinates", never "a hive with no queue" The swarm always has exactly one queue; a hive can only lack its address. Reworded every prose site this PR added that stated or implied the opposite, to name what is actually absent (coordinates, credential, or address) instead of the queue itself. Refs #3805 --- docs/swarm/README.md | 6 +++--- docs/swarm/secrets.md | 2 +- hive-agent/src/swarm_queue.rs | 11 ++++++----- hive-c0re/src/lifecycle/host_config.rs | 8 ++++---- hive-c0re/src/meta.rs | 2 +- nix/agent-modules/queue.nix | 10 +++++----- nix/host-modules/swarm.nix | 3 ++- nix/module-eval.nix | 15 +++++++++------ 8 files changed, 31 insertions(+), 26 deletions(-) diff --git a/docs/swarm/README.md b/docs/swarm/README.md index 2223f395..e67bd379 100644 --- a/docs/swarm/README.md +++ b/docs/swarm/README.md @@ -385,9 +385,9 @@ above, plus `HIVE_AGENT_OIDC_CLIENT_SECRET_FILE` and `HIVE_AGENT_OIDC_CLIENT_ID_FILE`, which point into the unit's own credentials directory. The last two come from the delivered credential rather than from config — see [`secrets.md`](secrets.md#hive-level--one-of-each-per-hive) for -how it gets there. A hive with no queue sets none of the four and each agent -logs that it has none; a half-set environment logs an error and the harness -keeps serving. +how it gets there. A hive that hasn't been given the queue's address for its +agents sets none of the four and each agent logs that it has none; a half-set +environment logs an error and the harness keeps serving. ### Swarm-wide forge webhooks diff --git a/docs/swarm/secrets.md b/docs/swarm/secrets.md index c3dbf43f..afce2a45 100644 --- a/docs/swarm/secrets.md +++ b/docs/swarm/secrets.md @@ -180,7 +180,7 @@ reads them out of its own `$CREDENTIALS_DIRECTORY`, owned by the agent user and by nobody else. `hive-c0re` never reads the bytes at any point: it runs as `hive-core`, which is the reason a copy wasn't an option either. When the files aren't there the daemon forwards nothing and says so in its journal, and -the harness logs that it has no queue — the same absent-and-legal state, twice, +the harness logs that it has no queue coordinates — the same absent-and-legal state, twice, rather than a container that refuses to start. ⚠️ **Service↔store mTLS is its own trust domain.** A credential you must diff --git a/hive-agent/src/swarm_queue.rs b/hive-agent/src/swarm_queue.rs index da842244..ab93fac7 100644 --- a/hive-agent/src/swarm_queue.rs +++ b/hive-agent/src/swarm_queue.rs @@ -61,7 +61,7 @@ impl QueueEnv { enum Resolution { /// Everything is here; the agent can reach the queue. Configured(Box), - /// No queue for this agent, and that is a legal state — carries why. + /// No queue coordinates for this agent, and that is a legal state — carries why. Absent(&'static str), /// Some of the environment, not all of it. A deployment bug rather than /// an absent integration, so it is reported and then survived. @@ -141,7 +141,7 @@ pub fn init() { Some(*cfg) } Resolution::Absent(why) => { - tracing::info!(why, "no swarm queue for this agent"); + tracing::info!(why, "no swarm queue coordinates for this agent"); None } Resolution::Partial => { @@ -219,9 +219,10 @@ mod tests { ); } - /// A hive with no swarm queue at all. Silence here is correct, and it has - /// to be distinguishable from the half-set case below — that distinction - /// is the only thing that makes the error branch worth logging. + /// A hive that has not been given its queue's coordinates at all. Silence + /// here is correct, and it has to be distinguishable from the half-set + /// case below — that distinction is the only thing that makes the error + /// branch worth logging. #[test] fn an_empty_environment_is_no_queue_rather_than_an_error() { let e = env([None, None, None, None]); diff --git a/hive-c0re/src/lifecycle/host_config.rs b/hive-c0re/src/lifecycle/host_config.rs index d90ff22a..09b55c66 100644 --- a/hive-c0re/src/lifecycle/host_config.rs +++ b/hive-c0re/src/lifecycle/host_config.rs @@ -133,8 +133,8 @@ fn bind_child_agent_dirs(child: &str, binds: &mut Vec) { /// Env var naming the host directory `swarm-bao-queue-agent.service` lands /// this hive's agent queue credential in. Set by the hive-c0re NixOS module /// from `deploy.hive-controller.queue.agentCredentialDir`; absent means this -/// daemon runs outside its unit, which is the same "no queue" answer as an -/// empty directory. +/// daemon runs outside its unit, which is the same "no queue credential" +/// answer as an empty directory. const QUEUE_CREDENTIAL_DIR_ENV: &str = "HIVE_C0RE_AGENT_QUEUE_CREDENTIAL_DIR"; /// systemd credential ids the two files arrive under inside the container. @@ -167,7 +167,7 @@ fn queue_agent_credentials(agent_name: &str, dir: Option<&Path>) -> Vec) -> Vec