From 640751074434e3452927dcd152c8365d8146148f Mon Sep 17 00:00:00 2001
From: damocles <damocles@hyperhive.local>
Date: Sat, 18 Jul 2026 16:31:18 +0200
Subject: [PATCH] fix(#2573): add /run/hive-ci to hive-priv ReadWritePaths so
 the ci-runner token write doesn't EROFS

---
 nix/host-modules/hive-priv.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/nix/host-modules/hive-priv.nix b/nix/host-modules/hive-priv.nix
index cf5ca4e2..85eea6af 100644
--- a/nix/host-modules/hive-priv.nix
+++ b/nix/host-modules/hive-priv.nix
@@ -120,6 +120,13 @@ in
         #                            first `nixos-container create` (ruth, on a
         #                            fresh host) dies with "Read-only file
         #                            system" before any container exists.
+        #   /run/hive-ci           — hive-c0re delegates the forge CI-runner
+        #                            registration-token write to hive-priv
+        #                            (`register_ci_runner` → /run/hive-ci/runner-token).
+        #                            Without this carve-out the write EROFSes under
+        #                            ProtectSystem=strict, the token stays the tmpfiles
+        #                            `TOKEN=placeholder` seed, and gitea-runner
+        #                            crash-loops → no CI runs hive-wide.
         #   /var/lib/nixos-containers — container rootfs written by nixos-container
         #   /var/lib/hyperhive     — agent state files written by WriteAgentForgeToken
         #                            / WriteAgentMatrixToken (tokens under agents/<n>/state/)
@@ -131,6 +138,7 @@ in
           "/run/hive-agent"
           "/run/systemd"
           "/run/lock"
+          "/run/hive-ci"
           "/var/lib/nixos-containers"
           "/var/lib/hyperhive"
           "/nix"