vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(forge): reword tracker-tag references in doc comments to prose

Browse source 
Address argus review on the config-repo PR surface: 6 issue-number tags
appeared in Rust doc comments in forge.rs; the tracker-tag lint matches
${'#'}NNN in code comments (markdown docs are exempt, doc comments are not).
Reword to prose, no behavior change.
This commit is contained in:
atlas 2026-06-23 15:29:20 +02:00 • committed by mara
commit 60da6c14b4
1 changed files with 13 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

27
hive-c0re/src/forge.rs
View file

@ -31,15 +31,14 @@ const CORE_TOKEN_PATH: &str = "/var/lib/hyperhive/forge-core-token";
// rendered from its SVG during the `hyperhive-assets` derivation's
// build.
/// Forgejo org grouping every agent's config repo. Core is a site admin
/// and reads + writes every repo here. As of #1787 each agent is a **write
/// collaborator on its own** `agent-configs/<name>` repo — the editable
/// PR surface it pushes config-change branches to — but `main` is
/// and reads + writes every repo here. As of the agent-config-PR flow each
/// agent is a **write collaborator on its own** `agent-configs/<name>` repo —
/// the editable PR surface it pushes config-change branches to — but `main` is
/// branch-protected core-only, so only hive-c0re's verify-and-ff-push merge
/// handler lands on it (operator approval required; the agent can't push
/// `main` or self-merge). The repos remain private, so an agent still can't
/// reach *another* agent's config. During the transition `push_config` also
/// force-mirrors `applied → main` here until the PR flow (#1838 P2) replaces
/// it.
/// force-mirrors `applied → main` here until the PR-merge flow replaces it.
const CONFIG_ORG: &str = "agent-configs";
/// Forgejo org hosting the operator-curated shared docs/skills repo
/// that every agent gets read-only access to. Agents use it as a
@ -692,8 +691,8 @@ pub async fn push_meta(dir: &Path) -> Result<()> {
}
/// Ensure the `agent-configs/<name>` repo exists so the first
/// `push_config` doesn't 404, and wire it as the agent-editable PR surface
/// (#1787): the agent is a **write** collaborator (can push feature branches +
/// `push_config` doesn't 404, and wire it as the agent-editable PR surface:
/// the agent is a **write** collaborator (can push feature branches +
/// open config PRs) and `main` is branch-protected core-only (only hive-c0re's
/// merge handler lands on it; operator approval required). No-op when the forge
/// isn't running or the core token isn't minted yet. Safe to call on every
@ -991,7 +990,7 @@ async fn apply_operator_branch_protection(repo: &str, token: &str) -> Result<()>
}
/// Apply branch protection to an `agent-configs/<name>` repo's `main` so it
/// can serve as the agent-editable, PR-merge config surface (#1787 / #1838):
/// can serve as the agent-editable, PR-merge config surface:
/// - **push + merge whitelists are `core`-only** — the agent (a write
/// collaborator) can push feature branches and open config PRs, but only
/// hive-c0re lands on `main`, via its verify-and-ff-push merge handler
@ -999,12 +998,12 @@ async fn apply_operator_branch_protection(repo: &str, token: &str) -> Result<()>
/// - **operator-team approval is required** to merge, and the author (not in
/// the team) cannot self-approve.
/// - **`enable_force_push` is a TRANSITIONAL allowance**: `push_config` still
/// force-mirrors `applied → main` until the PR flow (#1838 P2) replaces it,
/// and a protected branch otherwise rejects force-push. Forgejo's force-push
/// allowlist is deploy-keys-only (no per-user list), so this is a plain
/// `enable_force_push` toggle — only `core` is in the push-whitelist, so
/// only `core` can force-push anyway. When `push_config` is retired (#1838
/// P2), flip this to `false`; keep `core` in the push-whitelist so
/// force-mirrors `applied → main` until the agent-opened PR-merge flow
/// replaces it, and a protected branch otherwise rejects force-push.
/// Forgejo's force-push allowlist is deploy-keys-only (no per-user list), so
/// this is a plain `enable_force_push` toggle — only `core` is in the
/// push-whitelist, so only `core` can force-push anyway. When `push_config`
/// is retired, flip this to `false`; keep `core` in the push-whitelist so
/// `ff_push_to_main` can still land fast-forwards.
///
/// Idempotent: an existing rule for the branch (200/409/422) is success.