vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

docs: clear write-good.Passive hits in docs/trust-boundary/security.md

Browse source 
2 genuine passive-voice rewrites (actor named — a caller, the
hard-coded unit name); 5 false positives left untouched — a
definitional/classificatory statement ('an agent is trusted code'),
a predicate-adjective state description ('is privileged'), two
quoted-literal framing phrases ('can the agent be stopped...', 'the
whole hive is affected'), and the already-established 'is tracked as
a TODO' pattern.
This commit is contained in:
iris 2026-09-20 05:27:26 +02:00 • committed by mara
commit 2aa9f19ccb
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/trust-boundary/security.md
View file

@ -236,7 +236,7 @@ this gap.
⚠️ **`ReloadGatewayNginx` acts on a host unit, so nothing implicitly ⚠️ **`ReloadGatewayNginx` acts on a host unit, so nothing implicitly
scopes it.** Its containment is the unit name hard-coded in `hive-priv`: scopes it.** Its containment is the unit name hard-coded in `hive-priv`:
a caller can't name the unit, so the verb can't be steered at another a caller can't name the unit, so it can't steer the verb at another
service. **A privileged verb needs something bounding what it can act service. **A privileged verb needs something bounding what it can act
on; when that isn't a namespace, it has to be a constant the caller on; when that isn't a namespace, it has to be a constant the caller
can't supply.** can't supply.**
@ -290,7 +290,7 @@ matching the agent-name convention (char-validated) or the known
sibling service containers (`hive-forge`, `hive-matrix`, `hive-ci`), sibling service containers (`hive-forge`, `hive-matrix`, `hive-ci`),
and rejects arbitrary container names. `hive-gateway` is a host unit, and rejects arbitrary container names. `hive-gateway` is a host unit,
not a container, so it's not in this list — see `ReloadGatewayNginx` not a container, so it's not in this list — see `ReloadGatewayNginx`
above for how its access is scoped instead. above for how the hard-coded unit name scopes its access instead.
**Socket-activated** — systemd starts `hive-priv` on the first **Socket-activated** — systemd starts `hive-priv` on the first
incoming connection (`LISTEN_FDS=1`); it's not running between calls. incoming connection (`LISTEN_FDS=1`); it's not running between calls.