From 78a53cc9ac3db602fb7e729a2a3c985222e4b287 Mon Sep 17 00:00:00 2001 From: atlas Date: Fri, 11 Sep 2026 13:46:28 +0200 Subject: [PATCH] =?UTF-8?q?docs/observability:=20hive=E2=86=92swarm=20inge?= =?UTF-8?q?st=20auth=20shipped,=20stop=20calling=20it=20planned?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The security section said hive→swarm ingest auth was "planned" and that the `hive` label "becomes" unforgeable. Sixty lines later, `### Authenticated ingest` in the same file describes it as shipped and mandatory — "No unauthenticated mode exists" — and the code agrees: swarm-otel.nix:157 derives one receiver port per entry in `swarm.hives`, :1387 stamps `key = "hive"` from the receiver that accepted the sample, :751 asserts `swarm.hives != {}`, and otel.nix:659 makes a hive without an identity a build error. Not drift. Ordered by position in main rather than by author date, the "planned" wording is the NEWEST of the three commits: `9dc60061` documented authenticated ingest and `9bd2b9e9` dropped the unauthenticated mode (both 2026-08-19), while `5fcd2a93` — authored 00:59 that morning, merged on 08-30 — added the sentence eleven days later into a tree where the feature already existed. A long-lived branch's prose is a snapshot of the tree it was written against, and nothing re-reads it at merge time. Matters because §"what the agent→collector hop is and isn't" is the page a reader goes to for "can a hive forge a label". It answered "auth is planned", which reads as "`hive=` is forgeable today". The truth is the opposite and stronger. Closes #4216. --- docs/scheduler/observability.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/scheduler/observability.md b/docs/scheduler/observability.md index 9e63f669..34471003 100644 --- a/docs/scheduler/observability.md +++ b/docs/scheduler/observability.md @@ -63,10 +63,10 @@ boundary (`docs/trust-boundary/security.md`: capability = accepted risk), so an able to _send_ is an accepted extension of that boundary — but it's not closed by this design, and nothing here should be read as closing it. -**The `agent` label is self-reported, and no planned authentication changes -that.** Treat it as a convenience for grouping dashboards, never as evidence of -which container produced a sample: any agent that can reach this hive's -collector can label its data as any other agent. +**The `agent` label is self-reported, and the hive→swarm authentication below +doesn't change that.** Treat it as a convenience for grouping dashboards, never +as evidence of which container produced a sample: any agent that can reach this +hive's collector can label its data as any other agent. **Logs ride the same hop, and a journal carries more than a counter does.** Each agent container forwards its own journal through this port — every unit in it at @@ -77,13 +77,13 @@ destination, same credential, and an agent could already send arbitrary OTLP); what changes is how much detail leaves by default. Worth spelling out, because two different hops are in play and only one of them -is getting a credential: +carries a credential: - **agent→collector** (this section's hop) stays open on the bridge. Nothing downstream can tell one agent's export from another's. -- **hive→swarm** is where the planned ingest auth goes. The swarm tier stamps - `hive=` from the connection it authenticated, so _that_ label becomes - unforgeable. +- **hive→swarm** authenticates. The swarm tier gives each hive its own receiver + and stamps `hive=` from whichever one accepted the sample, so _that_ label is + unforgeable — see [Authenticated ingest](#authenticated-ingest) below. A verified `hive` is reachable and a verified `agent` isn't — and that falls out of the topology rather than being a gap someone forgot to close. The swarm