add a per-agent egress log mode

docs/networking/network.md

@@ -289,6 +289,22 @@ host. It never decrypts TLS, so it holds no signing key. It caches nothing.
   restricted. Agents must not start sending credentials until every hive runs
   the `hive-c0re` that writes it, or a legacy agent loses general internet.
 
+- **Log mode.** The operator can put an agent in `log` mode in the swarm UI.
+  Its record keeps `unrestricted_internet` at `false` and adds
+  `internet_log: true`, so a `hive-c0re` that doesn't know the field still
+  enforces the list. For such an agent `hive-c0re` adds to `agent-allow.conf`,
+  after the allow rules for every agent's own names,
+  `http_access allow <user> !allowed_dst log_mark`, where `log_mark` is an
+  `annotate_transaction` ACL that sets `would_deny=1`. The rule comes last in
+  the include, so every destination deny and `deny !authed` before it still
+  applies, and a name the agent may reach never carries the mark. A request the
+  rule lets through gets a second log line,
+  `would_deny user=<agent> method=<m> host=<h> port=<p> result=<r>`, from the
+  `would_denied` `access_log` in `hive-squid.nix`; the usual request line keeps
+  its format. Only the operator changes the mode: nothing moves an agent to
+  `restricted` after a time or a count. The self-check's users aren't agents,
+  so `deny-canary.invalid` stays a 403.
+
 - **Base list.** `services.hyperhive.deploy.hive-controller.squid.baseAllowedDomains` is open to every
   authenticated user, whatever its flag: what the agent harness needs off the
   swarm. The default is the hosts Claude Code requires
@@ -384,7 +400,8 @@ host. It never decrypts TLS, so it holds no signing key. It caches nothing.
 - **Logs.** One syslog line per request reaches the journal as
   `squid.service`, and `services.hyperhive.otel.journalUnits` forwards that
   unit and the self-check's to the swarm's log store. A refusal shows as `TCP_DENIED/403` with the
-  client's source address.
+  client's source address. A request that a `log`-mode agent's rule let
+  through also logs a `would_deny` line (see _Log mode_).
 - **Self-check.** `squid-selfcheck.timer` runs `squid-selfcheck.service`
   every minute from the bridge IP, logging in as `selfcheck.squid`: `CONNECT`
   to `services.hyperhive.deploy.hive-controller.squid.selfcheck.canary` (default: `cache.nixos.org`,

docs/process/conventions.md

@@ -325,6 +325,14 @@ the agent's squid policy: [the egress proxy](../networking/network.md#egress-pro
 lets an unrestricted agent's credential reach any destination, and holds the
 others to the base list and the allow-list. An agent sends its credential once it has fetched it, from its next start.
 
+**Log mode** — `internet_log` is a second boolean, meaningful only beside an
+explicit `unrestricted_internet: false`; read the pair with
+`swarm_queue_client::agent_permissions::internet_mode`. A `PUT` that sets
+`unrestricted_internet` without `internet_log` turns it off, the route refuses
+`internet_log: true` unless the stored or requested flag is `false`, and a
+`DELETE` keeps it. A hive that doesn't read the field sees `false` and enforces
+the list. The proxy's handling is under _Log mode_ in [the egress proxy](../networking/network.md#egress-proxy-squid).
+
 **How a change applies** —
 - The agent's harness reads its own key every 10 seconds and builds every
   turn's `--tools`, `--allowedTools` and MCP config from the last value, so a

docs/swarm/ui.md

@@ -583,11 +583,16 @@ refuses, for example, a percentage with a leading zero. The dialog shows the
 refusal's reason under the fields and leaves them as you typed them.
 
 Below the list, **internet** shows whether the agent's traffic may leave the
-host unfiltered: `unrestricted`, `restricted`, or `unrestricted (legacy)` when
-the swarm never set the flag, which counts as on. The **restrict** or
-**allow unrestricted** badge flips it with a `PUT` that carries the stored
-permission list along with the flag, because a `PUT` without the list resets a
-stored list to the default. An agent with no stored list sends the flag alone.
+host unfiltered: `unrestricted`, `restricted`, `log`, or `unrestricted (legacy)`
+when the swarm never set the flag, which counts as on. `log` is `restricted`
+that allows what the list would refuse and logs each such request as
+`would_deny`; it stays until you change it. The badges for the other two
+modes (**allow unrestricted**, **log**, **restrict**) set the mode with a
+`PUT` that carries the stored permission list along with the flags, because a
+`PUT` without the list resets a stored list to the default. An agent with no
+stored list sends the flags alone. `log` sends `unrestricted_internet: false`
+with `internet_log: true`; the other two leave `internet_log` out, which ends
+logging.
 The hive's egress proxy applies the flag to each agent's proxy credential (see
 [the egress proxy](../networking/network.md#egress-proxy-squid)). An agent sends its
 credential from its next start after it has fetched it, so a flag change applies