From c20496604c709a63676479cc5280c2edbe02623d Mon Sep 17 00:00:00 2001 From: iris Date: Mon, 7 Sep 2026 14:29:59 +0200 Subject: [PATCH] fix Microsoft.Quotes vale findings - move punctuation inside quotes Moved 27 instances of periods and commas from outside closing quote marks to inside, following American-style punctuation placement. Changes span across ~15 documentation files including integration, process, scheduler, trust-boundary, and web-ui docs. --- docs/integrations/matrix.md | 2 +- docs/process/conventions.md | 4 ++-- docs/process/gotchas.md | 2 +- docs/process/pr-review-gate.md | 4 ++-- docs/scheduler/coordinator.md | 2 +- docs/scheduler/observability.md | 2 +- docs/swarm/ca.md | 2 +- docs/swarm/sso.md | 2 +- docs/swarm/ui.md | 6 +++--- docs/tools/forge.md | 2 +- docs/trust-boundary/boundary.md | 2 +- docs/trust-boundary/security.md | 10 +++++----- docs/turn-loop/claude-invocation.md | 2 +- docs/turn-loop/config.md | 2 +- docs/web-ui/dashboard.md | 6 +++--- docs/web-ui/shape.md | 4 ++-- 16 files changed, 27 insertions(+), 27 deletions(-) diff --git a/docs/integrations/matrix.md b/docs/integrations/matrix.md index cbeb25ab..df30f75b 100644 --- a/docs/integrations/matrix.md +++ b/docs/integrations/matrix.md @@ -278,7 +278,7 @@ Two subtle details worth knowing before touching either derivation: needs to hit `buildFlutterApplication`'s pub-get output (`.dart_tool/` in the build CWD). Walking up from a read-only `$src/` store path finds no `.dart_tool/` and errors with - "Couldn't resolve the package 'matrix'". + "Couldn't resolve the package 'matrix'." Drop both derivations when nixpkgs's flutter builder grows worker + emcc support upstream. diff --git a/docs/process/conventions.md b/docs/process/conventions.md index e590e86f..2bf20aa5 100644 --- a/docs/process/conventions.md +++ b/docs/process/conventions.md @@ -331,7 +331,7 @@ clear them. `/var/lib/hyperhive/meta/tool-groups.json` (hive-c0re-owned, committed to the meta repo alongside `topology.json`). Format: `{ "alice": ["messaging", "meta", "inbox", "lifecycle"], "bob": ["messaging", "meta", "inbox"] }`. An absent entry -means "use role default". Tool permissions are intentionally NOT configurable +means "use role default." Tool permissions are intentionally NOT configurable from `agent.nix` — that file goes through the manager's approval flow, so letting it declare its own groups would let the manager grant itself any tool by submitting a config commit, bypassing the operator gate. @@ -369,7 +369,7 @@ that allows the underlying resource access. **Config storage** — per-agent capabilities live in `/var/lib/hyperhive/meta/capabilities.json` alongside `tool-groups.json`. Format: `{ "atlas": ["read_host_journal"], "ruth": ["manage_root_agent"] }`. -An absent entry means "no extra capabilities". `render_flake` in `meta.rs` +An absent entry means "no extra capabilities." `render_flake` in `meta.rs` reads this file and injects `HIVE_CAPABILITIES` (comma-separated `snake_case` names) into each agent's systemd service env; absent entries emit no env var so agents without capabilities don't trigger a spurious rebuild. diff --git a/docs/process/gotchas.md b/docs/process/gotchas.md index 0f35f42b..5fd34c52 100644 --- a/docs/process/gotchas.md +++ b/docs/process/gotchas.md @@ -439,7 +439,7 @@ connects to the compositor at `127.0.0.1:`. desktop-shell shows its click-to-unlock screen — useless for an agent desktop viewed over `/screen`. `idle-time=0` updates the idle timer with a 0ms delay, which - `wl_event_source_timer_update` treats as "disarm", so the + `wl_event_source_timer_update` treats as "disarm," so the compositor never goes idle and never locks. ## Nix docs pipeline diff --git a/docs/process/pr-review-gate.md b/docs/process/pr-review-gate.md index 4ece00a7..c3ead59d 100644 --- a/docs/process/pr-review-gate.md +++ b/docs/process/pr-review-gate.md @@ -6,7 +6,7 @@ human review that already happened. ## The gate has (up to) three parts, and they're per-repo settings -Whether a PR can merge, and what counts toward "can", is configured +Whether a PR can merge, and what counts toward "can," is configured per repo in its branch-protection settings — not a fact true of every hive or every repo. The pieces a repo _can_ require: @@ -59,7 +59,7 @@ comment before approving; a stray style nit isn't the same category. Where a repo dismisses stale approvals on a new commit, a review you already gave stops counting the moment a follow-up commit lands — even -one whose message reads as trivial ("just a wording fix", "just +one whose message reads as trivial ("just a wording fix," "just trimming comments"). Re-diff and re-verify before submitting a fresh verdict; don't take a small-sounding commit message as an accurate description of the diff. diff --git a/docs/scheduler/coordinator.md b/docs/scheduler/coordinator.md index c701e894..9eece2ff 100644 --- a/docs/scheduler/coordinator.md +++ b/docs/scheduler/coordinator.md @@ -192,7 +192,7 @@ rides the queue through that power layer, so intent, lease serialization, and crash-watch suppression can't drift per surface; the only direct starts left are the root-agent bootstrap and infra containers (no lease, no harness). Cancelling a still-queued power DAG reverts `wanted` to the -observed state — a cancel means "don't do it", not "do it later". Agents +observed state — a cancel means "don't do it," not "do it later." Agents without a row are seeded from observed state on first touch (running ⇒ `Up`); destroy removes the row. diff --git a/docs/scheduler/observability.md b/docs/scheduler/observability.md index 57c2f327..31546a10 100644 --- a/docs/scheduler/observability.md +++ b/docs/scheduler/observability.md @@ -274,7 +274,7 @@ recorded (every turn, always). Everything above is measured **per agent**, tagged with the hive it runs in. These three are measured per **hive**, and carry no `agent` label — so a hive that hosts no agents still reports, and "this hive is quiet" is -distinguishable from "this hive is gone". Select them with +distinguishable from "this hive is gone." Select them with `{hive!="",agent=""}`. | Metric | Unit | Kind | Meaning | diff --git a/docs/swarm/ca.md b/docs/swarm/ca.md index e174a8d3..668e8c33 100644 --- a/docs/swarm/ca.md +++ b/docs/swarm/ca.md @@ -25,7 +25,7 @@ something a host assumes. Turn it on for an all-on-one-host deployment and the hierarchy costs no configuration. It defaults from `services.hyperhive.deploy.singleHostSwarm`, the single -switch that says "this box is the whole deployment". +switch that says "this box is the whole deployment." **A hive given neither artifact keeps the self-signed CA it has always had.** It serves TLS exactly as before and isn't part of a diff --git a/docs/swarm/sso.md b/docs/swarm/sso.md index 6eca8579..795f3c6f 100644 --- a/docs/swarm/sso.md +++ b/docs/swarm/sso.md @@ -124,7 +124,7 @@ nixos-container refuses to start a container whose bind source is missing, and this secret doesn't exist until authelia's first boot has run. Binding it would make the service wait on a file that waits on a container that starts after it — on a fresh hive, a permanent stall -presenting as "the forge is broken", several layers from its cause. +presenting as "the forge is broken," several layers from its cause. ### 2. Swarm-managed services diff --git a/docs/swarm/ui.md b/docs/swarm/ui.md index d98f15c1..e35d3537 100644 --- a/docs/swarm/ui.md +++ b/docs/swarm/ui.md @@ -28,7 +28,7 @@ reader and to a certificate — so there is no separate option to pin. ## 🔑 You must be in the `admins` group -**This is the step that separates "protected" from "locked out".** The +**This is the step that separates "protected" from "locked out."** The vhost's `auth_request` asks authelia _"is there a session"_; the rule that makes it mean _"is this an operator"_ is an `access_control` entry requiring `group:admins`. An account without that group authenticates @@ -46,13 +46,13 @@ would have meant those accounts silently failing a check they were supposed to pass. An account created without any group needs re-adding with the flag — -`swarmctl` reads the existing entry out of `users.yml`, so the group is +`swarmctl` reads the existing entry out of `users.yml,` so the group is what changes. Why a group and not a list of usernames: agents are getting authelia accounts of their own (matrix SSO), and _authenticated_ would then include every agent in the hive. The group is the only thing standing -between "an operator's page" and "anyone with a session". +between "an operator's page" and "anyone with a session." ## What it costs to be reachable diff --git a/docs/tools/forge.md b/docs/tools/forge.md index 480a03a9..b50784d8 100644 --- a/docs/tools/forge.md +++ b/docs/tools/forge.md @@ -151,7 +151,7 @@ distinct output shape — pick by what you need: Rule of thumb: **`view` first** when you're about to act on a thread (it shows everything and clears the unread guard so your follow-up `comment` isn't rejected); the JSON verbs (`issue`/`pr`) when a script needs one -field; `pr-status` when the only question is "can I merge it". +field; `pr-status` when the only question is "can I merge it." ### Contributing to a read-only repo (`clone` + `pr-create --agit`) diff --git a/docs/trust-boundary/boundary.md b/docs/trust-boundary/boundary.md index d059962d..91c15605 100644 --- a/docs/trust-boundary/boundary.md +++ b/docs/trust-boundary/boundary.md @@ -105,7 +105,7 @@ group**, which is why its mode is what it's: | `hive-c0re` | dials `agent.sock` (todo wakes) | traverse | | the gateway's nginx | dials `web.sock` | traverse | -The last two land in "other", so the dir is **`0751`, owned by the +The last two land in "other," so the dir is **`0751`, owned by the agent's container uid/gid** — `o=--x` is traverse without listing, and both sockets are `0666`, which is all a dialer needs. diff --git a/docs/trust-boundary/security.md b/docs/trust-boundary/security.md index df348787..b843cbce 100644 --- a/docs/trust-boundary/security.md +++ b/docs/trust-boundary/security.md @@ -6,7 +6,7 @@ The sections below document specific mechanisms (the state-file endpoint, nixbld isolation, privilege separation). This section frames the model they serve: **what hyperhive defends, what it deliberately doesn't, and where the operator is accepting risk.** It's the reference for "is it safe to give an -agent capability X?". +agent capability X?." ### The trust boundary is the container, not credential storage @@ -23,8 +23,8 @@ state-file endpoint stops one agent proxying another's files. Those harden the boundary; they don't sandbox the agent from itself.) The corollary: **don't reason about security as "can the agent be stopped from -touching its credentials". Reason about it as "what's the blast radius if this -agent does the worst possible thing with everything it can reach".** +touching its credentials." Reason about it as "what's the blast radius if this +agent does the worst possible thing with everything it can reach."** ### Scoped tokens bound the blast radius @@ -36,7 +36,7 @@ Each agent gets its own scoped credentials, never shared: So a compromised/confused agent's reach on the forge or matrix is bounded by _its own_ account's scope, not the swarm's. This is the main thing standing -between "one agent does something dumb" and "the whole hive is affected". +between "one agent does something dumb" and "the whole hive is affected." **Identity vs. secret (matrix).** The scoping is on the _secret_, not the _identity_: an agent's matrix **token** is private to its own account, but its @@ -83,7 +83,7 @@ accepting**. The rule of thumb: If an agent can deploy to prod, you are accepting the risk of a dropped production database (via injection or plain error). If that's unacceptable, the answer is _don't grant the capability_ — not "grant it and hope the -sandbox holds", because there is no sandbox between an agent and the tools you +sandbox holds," because there is no sandbox between an agent and the tools you handed it. ### No autosandboxing of external tokens diff --git a/docs/turn-loop/claude-invocation.md b/docs/turn-loop/claude-invocation.md index 4355263a..b1a583ca 100644 --- a/docs/turn-loop/claude-invocation.md +++ b/docs/turn-loop/claude-invocation.md @@ -213,7 +213,7 @@ the embedded MCP server. Whenever hive-c0re starts / restarts / rebuilds a container, it also drops a `system` message into the agent's inbox via `Coordinator::kick_agent` — a one-line "you were just (re)started, -check /state/ for your notes, your session is intact". The +check /state/ for your notes, your session is intact." The next turn picks it up like any other inbox message. ## On-boot files diff --git a/docs/turn-loop/config.md b/docs/turn-loop/config.md index 61bd3d81..a1129cbb 100644 --- a/docs/turn-loop/config.md +++ b/docs/turn-loop/config.md @@ -258,7 +258,7 @@ is a no-op without the other: checking `~/.claude/` (`hive_agent::login::using_api_key`, reads `HIVE_USE_API_KEY`), and the fact is stamped into the consolidated harness state file so the operator dashboard also stops reading this - agent's empty `~/.claude/` as "needs login". An api-key agent that hits + agent's empty `~/.claude/` as "needs login." An api-key agent that hits a real 401 (the key itself is bad) still surfaces `needs_login` — only the boot-time "have I ever logged in" check is bypassed, not the auth-failure path. diff --git a/docs/web-ui/dashboard.md b/docs/web-ui/dashboard.md index d824c90e..a99088d2 100644 --- a/docs/web-ui/dashboard.md +++ b/docs/web-ui/dashboard.md @@ -323,7 +323,7 @@ and `user_id` are backfilled from the matrix daemon's `matrix-accounts.json` snapshot — a host-visible file the daemon **force-rewrites every ~30s** (a heartbeat), so `as_of_unix` (the snapshot mtime) advances while the daemon is alive and a *stalled* value -genuinely means "stopped publishing", not just "old snapshot". An account +genuinely means "stopped publishing," not just "old snapshot." An account with a token but absent from the snapshot reports `live: false`. The status dot renders these states: @@ -332,7 +332,7 @@ The status dot renders these states: - **dim green** — `live` but `as_of_unix` hasn't advanced in > ~90s (3 missed heartbeats) while the container is *not* down: the daemon stopped publishing, so the snapshot's `live` is no longer trustworthy (likely - dead/wedged). Labelled "online · no heartbeat". + dead/wedged). Labelled "online · no heartbeat." - **amber** — `live` but the container is **down** (a stopped container ⟹ a dead daemon, so the snapshot is stale); also the `token_present && !live` "provisioned but offline" case. @@ -741,7 +741,7 @@ A full-height **square agent icon** (5em, capped) on the left. The icon is the **selection toggle**: click (or Enter/Space) adds/removes the agent from the selection set; `aria-pressed` reflects the state; the tooltip says "select … for bulk actions" or "deselect … (or press -Esc to clear all)". The `` points at `/icon`; load failure +Esc to clear all)." The `` points at `/icon`; load failure falls back to the dimmed hyperhive mark (`/favicon.svg`). The card body sits to the right with three stacked lines (`assets/swarm.js::renderContainers`). diff --git a/docs/web-ui/shape.md b/docs/web-ui/shape.md index c5b22136..32be9aa2 100644 --- a/docs/web-ui/shape.md +++ b/docs/web-ui/shape.md @@ -128,7 +128,7 @@ regardless, for example message-bearing tool_use, are unaffected either way). **Sticky-bottom + snap animation.** `stickToBottom` is the operator's intent: true means "keep snapping to bottom on every -mutation", false means "I scrolled up, leave me alone". The flag +mutation," false means "I scrolled up, leave me alone." The flag flips when a scroll event lands further than `NEAR_BOTTOM_PX = 48` from the bottom. New rows then either snap to bottom (when sticky) or bump the unseen-count and surface the "↓ N new" pill. The snap @@ -146,7 +146,7 @@ rather than land short. **Mid-animation scroll-event guard.** The scroll handler's `isNearBottom` check would flip `stickToBottom` false mid-snap as the smooth animation eases through positions that are technically -"not near bottom yet", which would strand the operator partway. A +"not near bottom yet," which would strand the operator partway. A `smoothScrollingUntil` timestamp gates the scroll handler — set to the animation end + ~80ms headroom, re-armed on each fresh snap. Programmatic `scrollTop` writes (the animation's per-frame update)