vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

docs/observability: hive→swarm ingest auth shipped, stop calling it planned

Browse source 
The security section said hive→swarm ingest auth was "planned" and that the
`hive` label "becomes" unforgeable. Sixty lines later, `### Authenticated
ingest` in the same file describes it as shipped and mandatory — "No
unauthenticated mode exists" — and the code agrees: swarm-otel.nix:157 derives
one receiver port per entry in `swarm.hives`, :1387 stamps `key = "hive"` from
the receiver that accepted the sample, :751 asserts `swarm.hives != {}`, and
otel.nix:659 makes a hive without an identity a build error.

Not drift. Ordered by position in main rather than by author date, the "planned"
wording is the NEWEST of the three commits: `9dc60061` documented authenticated
ingest and `9bd2b9e9` dropped the unauthenticated mode (both 2026-08-19), while
`5fcd2a93` — authored 00:59 that morning, merged on 08-30 — added the sentence
eleven days later into a tree where the feature already existed. A long-lived
branch's prose is a snapshot of the tree it was written against, and nothing
re-reads it at merge time.

Matters because §"what the agent→collector hop is and isn't" is the page a
reader goes to for "can a hive forge a label". It answered "auth is planned",
which reads as "`hive=` is forgeable today". The truth is the opposite and
stronger.

Closes #4216.
This commit is contained in:
atlas 2026-09-11 13:46:28 +02:00 • committed by mara
commit 78a53cc9ac
1 changed files with 8 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/scheduler/observability.md
View file

@ -63,10 +63,10 @@ boundary (`docs/trust-boundary/security.md`: capability = accepted risk), so an
able to _send_ is an accepted extension of that boundary — but it's not able to _send_ is an accepted extension of that boundary — but it's not
closed by this design, and nothing here should be read as closing it. closed by this design, and nothing here should be read as closing it.
**The `agent` label is self-reported, and no planned authentication changes **The `agent` label is self-reported, and the hive→swarm authentication below
that.** Treat it as a convenience for grouping dashboards, never as evidence of doesn't change that.** Treat it as a convenience for grouping dashboards, never
which container produced a sample: any agent that can reach this hive's as evidence of which container produced a sample: any agent that can reach this
collector can label its data as any other agent. hive's collector can label its data as any other agent.
**Logs ride the same hop, and a journal carries more than a counter does.** Each **Logs ride the same hop, and a journal carries more than a counter does.** Each
agent container forwards its own journal through this port — every unit in it at agent container forwards its own journal through this port — every unit in it at
@ -77,13 +77,13 @@ destination, same credential, and an agent could already send arbitrary OTLP);
what changes is how much detail leaves by default. what changes is how much detail leaves by default.
Worth spelling out, because two different hops are in play and only one of them Worth spelling out, because two different hops are in play and only one of them
is getting a credential: carries a credential:
- **agent→collector** (this section's hop) stays open on the bridge. Nothing - **agent→collector** (this section's hop) stays open on the bridge. Nothing
downstream can tell one agent's export from another's. downstream can tell one agent's export from another's.
- **hive→swarm** is where the planned ingest auth goes. The swarm tier stamps - **hive→swarm** authenticates. The swarm tier gives each hive its own receiver
`hive=` from the connection it authenticated, so _that_ label becomes and stamps `hive=` from whichever one accepted the sample, so _that_ label is
unforgeable. unforgeable — see [Authenticated ingest](#authenticated-ingest) below.
A verified `hive` is reachable and a verified `agent` isn't — and that falls A verified `hive` is reachable and a verified `agent` isn't — and that falls
out of the topology rather than being a gap someone forgot to close. The swarm out of the topology rather than being a gap someone forgot to close. The swarm