vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(#1787): make agent-configs/<n> the agent-editable, PR-merge config surface

Browse source 
Wires the per-agent config repo as the editable PR surface the #1838
merge handler (run_merge_config_pr) consumes, without yet retiring the
push_config force-mirror (that waits for #1838 P2 — the agent-opens-PR
MCP surface — so config changes keep working through the transition).

ensure_config_repo now, after creating agent-configs/<name>:
- adds the agent as a WRITE collaborator (can push config-change branches
  + open PRs);
- branch-protects main core-only via apply_config_repo_branch_protection:
  push + merge whitelists are core-only (only hive-c0re lands on main, via
  its verify-and-ff-push handler), operator-team approval required, the
  agent can't push main directly or self-merge.

The protection sets enable_force_push=true as a TRANSITIONAL allowance so
push_config's applied->main force-mirror keeps working until P2 retires it
(a protected branch otherwise rejects force-push). Forgejo's force-push
allowlist is deploy-keys-only — no per-user list — so this is a plain
enable_force_push toggle; only core is in the push-whitelist so only core
can force-push anyway. At P2, flip it to false and keep core in the
push-whitelist so ff_push_to_main still lands.

Agent code repos (AGENTS_ORG) are intentionally untouched — their merge
flow has no auto-merge handler yet, so switching them to core-only-merge
would strand those PRs.

All steps idempotent (runs on every spawn + startup sweep). Updated the
CONFIG_ORG doc comment + docs/forge.md to drop the "mirror-only" framing.
This commit is contained in:
atlas 2026-06-23 15:11:22 +02:00 • committed by mara
commit 2fe79aaef5
2 changed files with 71 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

14
docs/forge.md
View file

@ -51,10 +51,16 @@ read it without touching c0re's host-side credential store.
Two things live in the `agent-configs` Forgejo organization:
- A mirror repo per agent (`agent-configs/<name>`) — c0re pushes the
agent's applied config repo on each `↻ R3BU1LD`. Agents are
read-only collaborators on `core/meta` (the hive-c0re-owned meta
flake) so they can fetch but never push.
- A config repo per agent (`agent-configs/<name>`). As of #1787 the
agent is a **write collaborator on its own** repo — it can push
config-change branches and (once #1838 P2 lands) open config PRs — but
`main` is branch-protected core-only: only hive-c0re's verify-and-ff-push
merge handler lands on `main`, an operator-team approval is required, and
the agent can neither push `main` directly nor self-merge. During the
transition c0re still force-mirrors the agent's applied config repo here
on each `↻ R3BU1LD` (the `enable_force_push` allowance), until the PR
flow replaces that. Repos stay private, so an agent can't read another
agent's config. (Agents remain read-only collaborators on `core/meta`.)
- The dashboard links each container's "config" anchor to this
mirror, so operators can click straight from the SW4RM tab into
the rendered repo without an extra `git` step.