From a960dcf91a2fc7b2bb36e2c5be228b31546bdb73 Mon Sep 17 00:00:00 2001
From: iris <iris@hyperhive.local>
Date: Fri, 5 Jun 2026 17:02:42 +0200
Subject: [PATCH] docs(boundary): rewrite sequencing list as prose, drop
 checklist markers

---
 docs/boundary.md | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/docs/boundary.md b/docs/boundary.md
index ba3f7b2b..fe93de85 100644
--- a/docs/boundary.md
+++ b/docs/boundary.md
@@ -47,16 +47,15 @@ claim above is aspirational. Network isolation is what makes the
 boundary *real*; the gateway and privsep are ergonomics and
 defence-in-depth layered on top.
 
-Suggested sequencing of the `area:ops` issues:
+The `area:ops` issues followed this sequencing:
 
-1. **Gateway** first — pure ergonomics win, unblocks same-origin
-   (lets the cross-origin CORS shim on `/answer-question/{id}` go
-   away), no behavioural risk. ✅ **Done** — nginx gateway in front of
-   all surfaces; per-agent UIs proxied under `/agent/<name>/`.
-2. **Network isolation** next — the step that makes the boundary
-   real. Everything before it is honour-system.
-3. **Privsep** last — defence in depth on the core process
-   itself; valuable independent of the other two, but the
-   biggest refactor. ✅ **Done** — `hive-c0re` dropped from root to
-   `hive-core` user; `hive-priv` is the narrow root helper.
-   See [`docs/security.md`](security.md) for the privilege boundary table.
+1. **Gateway** — pure ergonomics win, unblocks same-origin (lets the
+   cross-origin CORS shim on `/answer-question/{id}` go away), no
+   behavioural risk. An nginx nixos-container now sits in front of all
+   surfaces; per-agent UIs are proxied under `/agent/<name>/`.
+2. **Network isolation** — the load-bearing step that turns the
+   honour-system split into an enforced boundary. In progress.
+3. **Privsep** — defence in depth on the core process; `hive-c0re`
+   runs as the unprivileged `hive-core` user and delegates root
+   operations to `hive-priv`, a narrow socket-activated helper. See
+   [`docs/security.md`](security.md) for the privilege boundary table.