vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm builder: the all-swarm-services switch turns it on, like every other swarm service

Browse source 
deploy.builder.enable defaults on under deploy.allSwarmServices (mkDefault),
where the host has the builder's store identity pair, as for the review
classifier. An explicit false still wins.
This commit is contained in:
atlas 2026-10-14 22:33:57 +02:00 • committed by mara
commit d24dbaeadf
7 changed files with 68 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

3
docs/trust-boundary/security.md
View file

@ -133,7 +133,8 @@ checkpoints**, not about sandboxing the agent from its own tools:
scheduled prompts are operator-only, set at swarm level
(see [`schedules.md`](../swarm/schedules.md)).
Before that merge, the swarm builder evaluates an unmerged config PR
off-hive, on any host that sets `deploy.builder.enable`: it builds the
off-hive, on any host that sets `deploy.builder.enable` (the
all-swarm-services switch defaults it on): it builds the
PR's head with a read-only forge token, in its own netns, as an untrusted
client of its host's nix daemon (see [`builder.md`](../swarm/builder.md)).