refactor: nix/host-modules + nix/agent-modules layout, update doc paths

nix/agent-modules/claude-settings.nix

@@ -82,7 +82,7 @@ let
 in
 {
   # OTEL stats export is configured ONCE at host level via
-  # `services.hyperhive.otel.*` (see nix/modules/hive-c0re.nix) and
+  # `services.hyperhive.otel.*` (see nix/host-modules/hive-c0re.nix) and
   # injected into every agent's build by the meta-flake renderer
   # (`hive-c0re/src/meta.rs::otel_config`). These per-agent options are
   # the build-time implementation surface that injection writes into;

nix/agent-modules/default.nix

@@ -1,5 +1,5 @@
 # Shared scaffolding for every hyperhive harness container.
-# `../agent.nix` and `../ruth.nix` both import this; all
+# `../templates/agent.nix` and `../templates/ruth.nix` both import
 # agents use the same service unit regardless of which entry-point
 # they came from.
 #

nix/agent-modules/docs.nix

@@ -15,7 +15,7 @@
     `$HIVE_DOCS_DIR/`, and appends a single pointer sentence to the agent's
     system prompt so it knows the docs exist (see
     `hive-ag3nt::prompt::render`). Default-on for the root/manager agent
-    (see `../ruth.nix`), off elsewhere; any agent can flip it from its
+    (see `../templates/ruth.nix`), off elsewhere; any agent can flip it from its
     `agent.nix`.
   '';
 

nix/agent-modules/matrix.nix

@@ -37,7 +37,7 @@ in
       - runs `hive-matrix-daemon` as a systemd unit that holds a
         matrix-sdk Client + sync against the homeserver at
         `HIVE_MATRIX_URL` (default `http://localhost:8008` — the
-        in-host tuwunel from `nix/modules/hive-matrix.nix`). The
+        in-host tuwunel from `nix/host-modules/hive-matrix.nix`). The
         daemon auto-skips when `<state>/matrix-token` is missing,
         and a `systemd.paths` watcher restarts it the moment
         hive-c0re provisions the token (same path-trigger shape

nix/agent-modules/network.nix

@@ -19,7 +19,7 @@
   # the hyperhive-isolated-dns oneshot owns resolv.conf. (Same "take
   # resolvconf out of the loop" approach the matrix container uses.)
   # All agent containers receive their bridge IP via DHCP from the hive
-  # dnsmasq pool (see nix/modules/hive-gateway.nix). useDHCP runs dhcpcd
+  # dnsmasq pool (see nix/host-modules/hive-gateway.nix). useDHCP runs dhcpcd
   # on every interface (just eth0 in practice — the nspawn bridge veth).
   config = {
     networking.useDHCP = true;

nix/docs/default.nix

@@ -33,7 +33,7 @@ let
   hostEval = nixosSystem {
     system = pkgs.stdenv.hostPlatform.system;
     modules = [
-      "${nixSrc}/modules"
+      "${nixSrc}/host-modules"
       (
         { lib, ... }:
         {
@@ -51,7 +51,7 @@ let
   };
 
   # Agent module eval from the content-addressed nixSrc. Relative
-  # imports inside agent.nix (the ./harness module dir) resolve
+  # imports inside agent.nix (the ../agent-modules dir) resolve
   # correctly against the nixSrc directory tree. `hyperhive.packages`
   # stays unset — every option default that references it carries a
   # `defaultText`, so the doc walk never forces the packages.
@@ -155,7 +155,7 @@ let
       `hyperhive.nixosModules.default` to operator host configurations
       (`services.hyperhive.{enable,domain,c0re,forge,matrix,gateway}.*`).
     - [per-agent options](agent.md) — options declared in
-      `nix/templates/harness/`, visible from every `agent.nix`
+      `nix/agent-modules/`, visible from every `agent.nix`
       (`hyperhive.model`, `hyperhive.allowedRecipients`,
       `hyperhive.extraMcpServers`, `hyperhive.frontend.*`,
       `hyperhive.forge.*`, `hyperhive.matrix.*`, `hyperhive.gui.*`).

nix/packages/default.nix

@@ -158,7 +158,7 @@ in
   # so operators can `nix build .#agent-base-toplevel` (or wire
   # them into their host system closure via the
   # `preBuildAgentTemplates` option on the hive-c0re module —
-  # see nix/modules/hive-c0re.nix). Speeds up the first agent
+  # see nix/host-modules/hive-c0re.nix). Speeds up the first agent
   # spawn dramatically because the heavy lifting (nixpkgs +
   # claude-code + hive-ag3nt binary) is already in the store
   # when the meta evaluator goes to build the container.

nix/templates/agent.nix

@@ -1,6 +1,6 @@
 { ... }:
 {
-  imports = [ ./harness ];
+  imports = [ ../agent-modules ];
   # Entry-point for sub-agent containers. Referenced from `flake.nix`
   # (`nixosConfigurations.agent-base`) and the meta-flake's
   # `applied/<name>/flake.nix`.

nix/templates/ruth.nix

@@ -3,7 +3,7 @@
   # Entry-point for the privileged root agent (ruth). Referenced from
   # `flake.nix` (`nixosConfigurations.ruth`) and the meta-flake's
   # `applied/ruth/flake.nix`.
-  imports = [ ./harness ];
+  imports = [ ../agent-modules ];
 
   # The root/manager bootstraps a fresh hive, so it gets the hyperhive
   # reference docs made available by default (readable at