From 609657f1ffcec384f50321465dcdeb0ad0023c00 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Sun, 11 Oct 2026 03:27:56 +0200
Subject: [PATCH] module-eval: accept the agent's live bao pair as a store path

`agent-matrix`'s "handed store paths and never store values" case
required every `BAO_*` entry on hive-matrix-daemon to be `BAO_ADDR` or a
`%d/` credential path. The daemon now presents the live pair that
hive-agent-bao-identity keeps in /run/hive-agent-bao-identity/current,
because a `LoadCredential=` copy is taken at unit start and would never
see a re-issued leaf. So the case failed on a path, not on a value.

It now also accepts exactly that pair: BAO_CLIENT_CERT must be
.../current/cert and BAO_CLIENT_KEY .../current/key, spelled out rather
than read from the option. Any other entry, including a value, a
different path, the two swapped, or the pair under another variable,
still fails.

Refs #5017
---
 nix/module-eval/agent-matrix.nix | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/nix/module-eval/agent-matrix.nix b/nix/module-eval/agent-matrix.nix
index 0ca35876..5366637e 100644
--- a/nix/module-eval/agent-matrix.nix
+++ b/nix/module-eval/agent-matrix.nix
@@ -140,16 +140,24 @@ let
         && !(lib.any (lib.hasInfix "swarm/agents") (lib.attrValues e));
     }
     {
-      # 🩸 A secret is a path: every `BAO_*` entry is the store's address or a
-      # file under this unit's own credentials directory, never bytes in an
-      # environment `/proc/<pid>/environ` publishes.
+      # 🩸 A secret is a path: every `BAO_*` entry is the store's address, a
+      # file under this unit's own credentials directory, or the one file of
+      # the live pair ./bao.nix keeps that its name stands for — never bytes
+      # in an environment `/proc/<pid>/environ` publishes. The live pair is
+      # spelled out rather than read from the option, so a default that
+      # turned into a value would fail here too.
       name = "the matrix daemon is handed store paths and never store values";
       ok =
         let
           store = lib.filterAttrs (n: _: lib.hasPrefix "BAO_" n) (daemon agentMatrixBao).environment;
+          livePair = {
+            BAO_CLIENT_CERT = "/run/hive-agent-bao-identity/current/cert";
+            BAO_CLIENT_KEY = "/run/hive-agent-bao-identity/current/key";
+          };
+          isPath =
+            n: n == "BAO_ADDR" || lib.hasPrefix "%d/" store.${n} || (livePair.${n} or null) == store.${n};
         in
-        store != { }
-        && lib.all (n: n == "BAO_ADDR" || lib.hasPrefix "%d/" store.${n}) (lib.attrNames store);
+        store != { } && lib.all isPath (lib.attrNames store);
     }
     {
       # A token the swarm mints or replaces in the store changes no file, so