vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

say that the backend env leaf and file are agent-writable, and why that is accepted

Browse source
This commit is contained in:
atlas 2026-10-27 22:12:52 +01:00
commit be3a3af093
1 changed files with 22 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

6
nix/agent-modules/backend-env.nix
View file

@ -18,6 +18,12 @@
# systemd lets a later file override an earlier one, so the store's value wins
# when there is one, and the file carries the agent when the store is down.
#
# The leaf's create grant cannot constrain content, so while the leaf is empty
# the agent's own process can also create it with any text, and the store's
# value then wins over the file. That is no wider than the file the agent
# already owns: `./user.nix`'s `heal_own_dir` chowns the harness dir to the
# agent at every activation, a gap the issue tracker has an open bug for.
#
# The unit runs as root because the file is root-owned `0600` where an operator
# placed it. Root can still read the agent's `0400` store identity.
{