vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

say that the backend env leaf and file are agent-writable, and why that is accepted

Browse source
This commit is contained in:
atlas 2026-10-27 22:12:52 +01:00
commit be3a3af093
1 changed files with 22 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/turn-loop/config.md
View file

@ -305,7 +305,11 @@ The file lives in the agent's bind-mounted **harness** dir, not `state/`
— `harness/` survives container rebuilds exactly like `state/` does, but
(unlike `state/`) is never bind-mounted into a parent agent's container
(see `docs/agent-lifecycle/persistence.md`'s "Parent access to child state"), so an API
key placed here is reachable by nothing but this agent and the host.
key placed here is reachable by nothing but this agent and the host. The
file doesn't stay root-owned, though: the container's activation chowns the
whole harness dir to the agent, so after the next boot the file is agent-owned
whatever owner you installed it with, and the agent can rewrite it. That holds
until the swarm secret store replaces the file.
<!-- vale write-good.Passive = NO -->