From 2aa9f19ccb64b57854f6071f19123717c2582760 Mon Sep 17 00:00:00 2001 From: iris Date: Sun, 20 Sep 2026 05:27:26 +0200 Subject: [PATCH] docs: clear write-good.Passive hits in docs/trust-boundary/security.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 2 genuine passive-voice rewrites (actor named — a caller, the hard-coded unit name); 5 false positives left untouched — a definitional/classificatory statement ('an agent is trusted code'), a predicate-adjective state description ('is privileged'), two quoted-literal framing phrases ('can the agent be stopped...', 'the whole hive is affected'), and the already-established 'is tracked as a TODO' pattern. --- docs/trust-boundary/security.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/trust-boundary/security.md b/docs/trust-boundary/security.md index 14007901..907726c8 100644 --- a/docs/trust-boundary/security.md +++ b/docs/trust-boundary/security.md @@ -236,7 +236,7 @@ this gap. ⚠️ **`ReloadGatewayNginx` acts on a host unit, so nothing implicitly scopes it.** Its containment is the unit name hard-coded in `hive-priv`: -a caller can't name the unit, so the verb can't be steered at another +a caller can't name the unit, so it can't steer the verb at another service. **A privileged verb needs something bounding what it can act on; when that isn't a namespace, it has to be a constant the caller can't supply.** @@ -290,7 +290,7 @@ matching the agent-name convention (char-validated) or the known sibling service containers (`hive-forge`, `hive-matrix`, `hive-ci`), and rejects arbitrary container names. `hive-gateway` is a host unit, not a container, so it's not in this list — see `ReloadGatewayNginx` -above for how its access is scoped instead. +above for how the hard-coded unit name scopes its access instead. **Socket-activated** — systemd starts `hive-priv` on the first incoming connection (`LISTEN_FDS=1`); it's not running between calls.