From 72b2a0357b8b0de58b7b108ae233d4a26c7c20aa Mon Sep 17 00:00:00 2001 From: atlas Date: Tue, 18 Aug 2026 22:20:03 +0200 Subject: [PATCH] docs(otel): stop describing the removed credential path in present tense environment.nix explains why HYPERHIVE_OTEL_HEADERS_CREDENTIAL is not emitted by naming the machinery that used to consume it -- machinery this PR deletes. Left as written it would describe a removed nspawn credential and a removed oneshot as if both still ran, in the same paragraph that justifies withholding the variable. That is this PR's own defect inverted: it exists so an auditor asking 'can an agent obtain the OTEL token?' finds nothing misleading, and a comment claiming live delivery machinery is exactly the kind of thing that costs an auditor a reconstruction. Keeps the rule rather than the history -- one holder, on the host -- since that is the part still worth reading. --- nix/host-modules/hive-c0re/environment.nix | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/nix/host-modules/hive-c0re/environment.nix b/nix/host-modules/hive-c0re/environment.nix index a88572fb..64975b30 100644 --- a/nix/host-modules/hive-c0re/environment.nix +++ b/nix/host-modules/hive-c0re/environment.nix @@ -99,13 +99,17 @@ in HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES = otel.extraResourceAttributes; } # HYPERHIVE_OTEL_HEADERS_CREDENTIAL is deliberately NOT emitted, and - # its absence is the security half of this design. It is the variable - # that put the upstream token in an agent's own settings.json: - # host_config.rs forwards it into the container as an nspawn - # credential, and claude-settings.nix's `hive-otel-header` oneshot - # then writes the value into a file the agent can read. The collector - # holding the credential achieves nothing while the harness keeps - # handing out a copy — so there is exactly one holder, on the host. + # its absence is the security half of this design: it was the variable + # that put the upstream token into an agent's own settings.json. The + # delivery path it drove — an nspawn credential forwarded by + # host_config.rs, then written to an agent-readable file by + # claude-settings.nix's `hive-otel-header` oneshot — no longer exists + # anywhere; it was removed along with this variable's last consumer. + # + # Kept as a comment rather than deleted because the useful part is the + # RULE, not the history: the collector holding the credential achieves + # nothing while anything else hands out a copy, so there is exactly one + # holder and it is on the host. // lib.optionalAttrs (otel.metricIntervalMs != null) { HYPERHIVE_OTEL_METRIC_INTERVAL_MS = toString otel.metricIntervalMs; }