vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

agents: swap the agent's bao leaf in with one rename

Browse source 
The live pair was replaced with two renames, key then cert. A run
stopped between them (timeout, container stop, power loss) left a new
key beside the old cert, and every later run logged in with that pair,
so the agent could not re-pull until its container restarted.

Each pair now goes into a fresh directory under
/run/hive-agent-bao-identity, and `current`, a symlink to it, is
replaced by one rename. Wherever a run stops, `current` names one whole
pair; the next run removes whatever a stopped run left. Consumers read
`current/cert` and `current/key` through the same read-only options and
still re-read them on every login.

The script test covers a swap stopped at each of its link and rename
steps: the live pair is always one whole pair, and the next run puts
the new one live.

Refs #5017
This commit is contained in:
atlas 2026-10-11 03:24:49 +02:00 • committed by mara
commit 4c4ecb8ed9
7 changed files with 166 additions and 58 deletions
Download patch file Download diff file Expand all files Collapse all files

6
nix/module-eval/agent-forge-bao.nix
View file

@ -84,8 +84,8 @@ let
e = u.environment;
in
e.BAO_ADDR == baoAddr
&& e.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/cert"
&& e.BAO_CLIENT_KEY == "/run/hive-agent-bao-identity/key";
&& e.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/current/cert"
&& e.BAO_CLIENT_KEY == "/run/hive-agent-bao-identity/current/key";
}
{
# The field is the secret. It goes to a file by redirect and is never
@ -199,7 +199,7 @@ let
in
u.serviceConfig.User == name
&& u.serviceConfig.UMask == "0077"
&& u.environment.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/cert";
&& u.environment.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/current/cert";
}
{
# Files a hive wrote keep working until the operator re-links them.

4
nix/module-eval/agent-github-bao.nix
View file

@ -83,8 +83,8 @@ let
u.serviceConfig.User == name
&& u.serviceConfig.UMask == "0077"
&& u.environment.BAO_ADDR == baoAddr
&& u.environment.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/cert"
&& u.environment.BAO_CLIENT_KEY == "/run/hive-agent-bao-identity/key";
&& u.environment.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/current/cert"
&& u.environment.BAO_CLIENT_KEY == "/run/hive-agent-bao-identity/current/key";
}
{
# A file a hive wrote keeps working until the operator links a token in

4
nix/module-eval/agent-matrix.nix
View file

@ -124,8 +124,8 @@ let
in
u.serviceConfig.LoadCredential == [ "hive-agent-bao-server-ca" ]
&& u.environment.BAO_ADDR == "https://bao.t.local:8200"
&& u.environment.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/cert"
&& u.environment.BAO_CLIENT_KEY == "/run/hive-agent-bao-identity/key"
&& u.environment.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/current/cert"
&& u.environment.BAO_CLIENT_KEY == "/run/hive-agent-bao-identity/current/key"
&& builtins.elem "hive-agent-bao-identity.service" u.after;
}
{

8
nix/module-eval/agent-queue-bao.nix
View file

@ -97,8 +97,8 @@ let
u = agentBaoIdentity agentBao;
e = u.environment;
in
e.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/cert"
&& e.BAO_CLIENT_KEY == "/run/hive-agent-bao-identity/key"
e.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/current/cert"
&& e.BAO_CLIENT_KEY == "/run/hive-agent-bao-identity/current/key"
&& u.serviceConfig.RuntimeDirectory == "hive-agent-bao-identity"
&& u.serviceConfig.RuntimeDirectoryPreserve == "yes"
&& e.BAO_ADDR == agentBao.services.hyperhive.agent.bao.addr;
@ -177,8 +177,8 @@ let
let
u = agentHarness agentBao;
in
u.environment.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/cert"
&& u.environment.BAO_CLIENT_KEY == "/run/hive-agent-bao-identity/key"
u.environment.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/current/cert"
&& u.environment.BAO_CLIENT_KEY == "/run/hive-agent-bao-identity/current/key"
&& builtins.elem "hive-agent-bao-identity.service" u.after
&& u.environment.BAO_ADDR == agentBao.services.hyperhive.agent.bao.addr;
}

8
nix/module-eval/agent-runtime.nix
View file

@ -116,8 +116,8 @@ let
u.serviceConfig.LoadCredential == [ "hive-agent-bao-server-ca" ]
&& u.environment.HIVE_AGENT_NAME == "a1"
&& u.environment.BAO_ADDR == "https://bao.t.local:8200"
&& u.environment.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/cert"
&& u.environment.BAO_CLIENT_KEY == "/run/hive-agent-bao-identity/key"
&& u.environment.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/current/cert"
&& u.environment.BAO_CLIENT_KEY == "/run/hive-agent-bao-identity/current/key"
)
[
(subagent claudeBao)
@ -134,8 +134,8 @@ let
u.serviceConfig.LoadCredential == [ "hive-agent-bao-server-ca" ]
&& u.environment.HIVE_AGENT_NAME == "a1"
&& u.environment.BAO_ADDR == "https://bao.t.local:8200"
&& u.environment.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/cert"
&& u.environment.BAO_CLIENT_KEY == "/run/hive-agent-bao-identity/key";
&& u.environment.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/current/cert"
&& u.environment.BAO_CLIENT_KEY == "/run/hive-agent-bao-identity/current/key";
}
{
name = "an opencode agent with no store hands its subagent daemon no store identity";