vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

permissions: drop the capability and tool-group wording left after the rework

Browse source
This commit is contained in:
atlas 2026-10-15 05:18:04 +02:00 • committed by mara
commit a937a8ba9a
5 changed files with 9 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/README.md
View file

@ -39,7 +39,7 @@ declarations.
## Trust boundary & security
- **What's the operator/agent trust boundary? What's a capability?** →
- **What's the operator/agent trust boundary? What's a permission?** →
[`trust-boundary/boundary.md`](trust-boundary/boundary.md).
- **Agent trust model, prompt-injection threat model, credential
isolation?** → [`trust-boundary/security.md`](trust-boundary/security.md).

8
docs/agent-lifecycle/agent-roster.md
View file

@ -36,13 +36,13 @@ One entry per agent _this hive_ has state/config for, in name order.
Unlike the swarm roster, it's a derived cache: the reconcile pass below
rebuilds it from what the hive observes locally (config repos cloned, containers spawned), and it
answers a narrower question than "does this agent exist": _which of
this hive's local agents the `ManageRootAgent` capability's bind-mounts
this hive's local agents the `ManageRootAgent` permission's bind-mounts
should cover._ `topology::all_agents` is the only reader that matters.
That reader is a permission boundary: the set it returns is what an agent
holding the `ManageRootAgent` capability gets bind-mounted (each other
holding the `ManageRootAgent` permission gets bind-mounted (each other
agent's `state` read-write and `config` read-only; never `harness`). An
agent holding no capability sees its own dirs and nothing else:
agent holding no permission sees its own dirs and nothing else:
`ManageRootAgent` is the only grant that reaches another agent's state
dir. See
[`persistence.md`](persistence.md)'s _Cross-agent access to state._
@ -51,7 +51,7 @@ dir. See
`topology.json` may also be a map of `name → parent | null`; the reader
accepts that shape and takes its keys as the roster. An empty
roster costs more than a cosmetic gap: every capability holder loses its
roster costs more than a cosmetic gap: every permission holder loses its
mounts until the next reconcile pass writes the array form.
### Why meta, not per-agent `agent.nix`