vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

revert(#2502): render agent config input from local applied mirror, not forge

Browse source
This commit is contained in:
atlas 2026-07-17 17:53:54 +02:00 • committed by mara
commit b9cef9507b
1 changed files with 24 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

60
hive-c0re/src/meta.rs
View file

@ -74,7 +74,6 @@ pub async fn sync_agents(hive: &HiveEnv, agents: &[AgentSpec]) -> Result<()> {
&hive.operator_pronouns, &hive.operator_pronouns,
&hive.context_window_tokens, &hive.context_window_tokens,
agents, agents,
crate::forge::forge_http_base(),
); );
let flake_path = dir.join("flake.nix"); let flake_path = dir.join("flake.nix");
let on_disk = std::fs::read_to_string(&flake_path).unwrap_or_default(); let on_disk = std::fs::read_to_string(&flake_path).unwrap_or_default();
@ -648,7 +647,6 @@ fn render_flake(
operator_pronouns: &str, operator_pronouns: &str,
context_window_tokens: &std::collections::HashMap<String, u64>, context_window_tokens: &std::collections::HashMap<String, u64>,
agents: &[AgentSpec], agents: &[AgentSpec],
forge_base: &str,
) -> String { ) -> String {
render_flake_with_lookup( render_flake_with_lookup(
hyperhive_flake, hyperhive_flake,
@ -658,7 +656,6 @@ fn render_flake(
operator_pronouns, operator_pronouns,
context_window_tokens, context_window_tokens,
agents, agents,
forge_base,
agent_canonical_inputs, agent_canonical_inputs,
) )
} }
@ -935,7 +932,6 @@ fn render_flake_with_lookup<F>(
operator_pronouns: &str, operator_pronouns: &str,
context_window_tokens: &std::collections::HashMap<String, u64>, context_window_tokens: &std::collections::HashMap<String, u64>,
agents: &[AgentSpec], agents: &[AgentSpec],
forge_base: &str,
lookup: F, lookup: F,
) -> String ) -> String
where where
@ -980,19 +976,20 @@ where
let _ = writeln!(out, " hyperhive-docs.url = \"{docs_flake}\";"); let _ = writeln!(out, " hyperhive-docs.url = \"{docs_flake}\";");
out.push_str(" hyperhive-docs.flake = false;\n"); out.push_str(" hyperhive-docs.flake = false;\n");
} }
// Each agent's *persistent* config input is its canonical repo on the // Each agent's config input is its LOCAL applied mirror
// forge (`git+{forge_base}/agent-configs/<name>.git`, `forge_base` supplied // (`git+file://<applied>`), so the meta flake resolves entirely from
// by the caller from `HIVE_FORGE_URL`), authenticated by hive-core's git // on-disk state and boot never depends on the forge being reachable.
// credential helper (which reads the live `forge-core-token` — no token in // The forge `agent-configs/<name>` repos stay the review/audit surface
// the URL or lock). The deploy re-lock + `verify_commit` eval keep pinning // (config PRs land there) but are not the flake's build input. deploy +
// the local `applied/<name>` override (`agent_input_override`), so a deploy // rebuild re-lock this input to `applied/<name>`'s current `main` head;
// never does a network fetch — only the persistent input tracks the forge. // `verify_commit` overrides it to a proposed `?rev=<sha>` for eval
// before that head moves.
for spec in agents { for spec in agents {
let _ = writeln!( let _ = writeln!(
out, out,
" agent-{name}.url = \"git+{forge_base}/{org}/{name}.git\";", " agent-{name}.url = \"git+file://{applied}\";",
name = spec.name, name = spec.name,
org = crate::forge::CONFIG_ORG, applied = crate::paths::applied_dir(&spec.name).display(),
); );
// For each canonical input the agent declares in its own // For each canonical input the agent declares in its own
// `flake.nix` (detected by reading its applied `flake.lock`), // `flake.nix` (detected by reading its applied `flake.lock`),
@ -1542,7 +1539,6 @@ mod tests {
"she/her", "she/her",
&std::collections::HashMap::new(), &std::collections::HashMap::new(),
&[sample_spec("alice", false, 9001)], &[sample_spec("alice", false, 9001)],
"http://forge.test",
); );
// nixpkgs is a top-level input with an explicit URL; hyperhive // nixpkgs is a top-level input with an explicit URL; hyperhive
// follows it. // follows it.
@ -1586,7 +1582,6 @@ mod tests {
"she/her", "she/her",
&std::collections::HashMap::new(), &std::collections::HashMap::new(),
&[sample_spec("alice", false, 9001)], &[sample_spec("alice", false, 9001)],
"http://forge.test",
); );
assert!( assert!(
!out.contains("hyperhive-docs"), !out.contains("hyperhive-docs"),
@ -1606,7 +1601,6 @@ mod tests {
"she/her", "she/her",
&std::collections::HashMap::new(), &std::collections::HashMap::new(),
&[sample_spec("alice", false, 9001)], &[sample_spec("alice", false, 9001)],
"http://forge.test",
); );
assert!( assert!(
out.contains("nixpkgs.follows = \"hyperhive/nixpkgs\""), out.contains("nixpkgs.follows = \"hyperhive/nixpkgs\""),
@ -1640,7 +1634,6 @@ mod tests {
sample_spec("bitburner", false, 9002), sample_spec("bitburner", false, 9002),
sample_spec("dmatrix", false, 9003), sample_spec("dmatrix", false, 9003),
], ],
"http://forge.test",
lookup, lookup,
); );
// bitburner declares nixpkgs → follows emitted. // bitburner declares nixpkgs → follows emitted.
@ -1669,7 +1662,6 @@ mod tests {
"she/her", "she/her",
&std::collections::HashMap::new(), &std::collections::HashMap::new(),
&[sample_spec("alice", false, 9001)], &[sample_spec("alice", false, 9001)],
"http://forge.test",
|_| Vec::new(), |_| Vec::new(),
); );
// No agent-side follows when the lookup reports nothing // No agent-side follows when the lookup reports nothing
@ -1704,7 +1696,6 @@ mod tests {
"she/her", "she/her",
&std::collections::HashMap::new(), &std::collections::HashMap::new(),
&[sample_spec("alice", false, 9001)], &[sample_spec("alice", false, 9001)],
"http://forge.test",
); );
unsafe { unsafe {
std::env::remove_var("HIVE_FORGE_URL"); std::env::remove_var("HIVE_FORGE_URL");
@ -1728,13 +1719,12 @@ mod tests {
} }
#[test] #[test]
fn render_flake_agent_input_points_at_forge_config_repo() { fn render_flake_agent_input_points_at_local_applied_mirror() {
// The persistent agent config input must reference the canonical // The agent config input references the LOCAL applied mirror
// repo on the forge (git+http, org `agent-configs`), NOT the local // (`git+file://<applied>`), NOT the forge — so the meta flake
// `applied/<n>` checkout — that's what lets the config live on the // resolves entirely from on-disk state and boot never depends on the
// forge instead of a hand-synced local copy. Auth is out-of-band via // forge being reachable. The forge `agent-configs/<n>` repos stay the
// hive-core's git credential helper, so no creds appear in the URL. // review surface, but they are not the flake's build input.
// `forge_base` is an explicit param now, so no env mutation is needed.
let out = render_flake( let out = render_flake(
"github:example/hyperhive", "github:example/hyperhive",
"path:/nix/store/bbbb-hyperhive-docs-source", "path:/nix/store/bbbb-hyperhive-docs-source",
@ -1743,17 +1733,18 @@ mod tests {
"she/her", "she/her",
&std::collections::HashMap::new(), &std::collections::HashMap::new(),
&[sample_spec("alice", false, 9001)], &[sample_spec("alice", false, 9001)],
"http://forge.example.test", );
let want = format!(
"agent-alice.url = \"git+file://{}\"",
crate::paths::applied_dir("alice").display()
); );
assert!( assert!(
out.contains( out.contains(&want),
"agent-alice.url = \"git+http://forge.example.test/agent-configs/alice.git\"" "expected the agent input to point at the local applied mirror ({want}):\n{out}"
),
"expected the agent input to point at the forge config repo:\n{out}"
); );
assert!( assert!(
!out.contains("agent-alice.url = \"git+file://"), !out.contains("git+http"),
"the local applied/<n> path must no longer be the persistent input:\n{out}" "no forge git+http URL must remain in the rendered flake:\n{out}"
); );
} }
@ -1783,7 +1774,6 @@ mod tests {
"she/her", "she/her",
&std::collections::HashMap::new(), &std::collections::HashMap::new(),
&[sample_spec("alice", false, 9001)], &[sample_spec("alice", false, 9001)],
"http://forge.test",
) )
}; };
@ -1866,7 +1856,6 @@ mod tests {
"she/her", "she/her",
&std::collections::HashMap::new(), &std::collections::HashMap::new(),
&[sample_spec("alice", false, 9001)], &[sample_spec("alice", false, 9001)],
"http://forge.test",
) )
}; };
unsafe { unsafe {
@ -1951,7 +1940,6 @@ mod tests {
"she/her", "she/her",
&std::collections::HashMap::new(), &std::collections::HashMap::new(),
&[sample_spec("alice", false, 9001)], &[sample_spec("alice", false, 9001)],
"http://forge.test",
) )
}; };
unsafe { unsafe {