swarm-builder: give the check flake the hive's docs source

The builder's hyperhive input is the docs-stripped flake source, so an
agent config with docs.enable = true failed to evaluate: docs.source
defaults to reference-docs, built from the missing docs/. Pass the host's
c0re.hyperhiveDocs as a hyperhive-docs input and set docs.source from it,
as the hive's meta flake does.

Fixes #5411

nix/builder/check-flake/flake.nix

@@ -1,6 +1,8 @@
 # The swarm builder's build check: one agent config on hyperhive's agent base,
 # composed the way a hive's meta flake composes it, minus the values a hive
-# adds (its CA, docs source, claude-code path and ports).
+# adds (its CA, claude-code path and ports). The docs source is set the way the
+# meta flake sets it: `hyperhive`'s source has no `docs/`, so the default
+# `docs.source` fails to evaluate.
 #
 # Every input is replaced at build time with `--override-input`
 # (swarm-builder/src/nix_build.rs), so the URLs below are never fetched and
@@ -12,15 +14,25 @@
     nixpkgs.url = "flake:nixpkgs";
     hyperhive.url = "flake:hyperhive";
     hyperhive.inputs.nixpkgs.follows = "nixpkgs";
+    hyperhive-docs.url = "flake:hyperhive-docs";
+    hyperhive-docs.flake = false;
     agent.url = "flake:agent";
   };
 
   outputs =
-    { hyperhive, agent, ... }:
+    {
+      hyperhive,
+      hyperhive-docs,
+      agent,
+      ...
+    }:
     {
       packages.x86_64-linux.check =
         (hyperhive.nixosConfigurations.agent-base.extendModules {
-          modules = [ agent.nixosModules.default ];
+          modules = [
+            agent.nixosModules.default
+            { services.hyperhive.agent.docs.source = hyperhive-docs.outPath; }
+          ];
         }).config.system.build.toplevel;
     };
 }

nix/host-modules/swarm-builder.nix

@@ -89,10 +89,11 @@ let
   # The `nix` the host daemon runs, so client and daemon speak one protocol.
   nix = config.nix.package;
 
-  # Strings, not paths: both are already store paths, and the flake reference
-  # the daemon passes must be the same one a hive's meta flake names.
+  # Strings, not paths: all three are already store paths, and the flake
+  # references the daemon passes must be the ones a hive's meta flake names.
   hyperhiveFlake = hyperhiveCfg.c0re.hyperhiveFlake;
   nixpkgsFlake = hyperhiveCfg.c0re.nixpkgsFlake;
+  docsFlake = hyperhiveCfg.c0re.hyperhiveDocs;
 
   privateNetwork = true;
 in
@@ -253,6 +254,7 @@ in
               SWARM_BUILDER_CHECK_FLAKE = "${../builder/check-flake}";
               SWARM_BUILDER_HYPERHIVE_FLAKE = hyperhiveFlake;
               SWARM_BUILDER_NIXPKGS_FLAKE = nixpkgsFlake;
+              SWARM_BUILDER_HYPERHIVE_DOCS_FLAKE = docsFlake;
               SWARM_BUILDER_FORGE_URL = "https://${forgeCfg.domain}";
               SWARM_BUILDER_CONFIG_ORG = "agent-configs";
             }

nix/module-eval/builder.nix

@@ -49,6 +49,30 @@ let
   svc = inner.systemd.services.swarm-builder;
   env = svc.environment;
 
+  # The check flake on the inputs the builder's unit names, called as
+  # `nix build` calls it. `hyperhive` is entered through the filtered source's
+  # own `flake.nix`, so its agent base sees the tree without `docs/` that a
+  # real build gets; `self`'s own agent base would find `docs/` here.
+  builderCheck =
+    agentModule:
+    let
+      src = env.SWARM_BUILDER_HYPERHIVE_FLAKE;
+      hyperhive = (import "${src}/flake.nix").outputs (
+        self.inputs
+        // {
+          self = hyperhive // {
+            outPath = src;
+            inherit (self) inputs;
+          };
+        }
+      );
+    in
+    ((import "${env.SWARM_BUILDER_CHECK_FLAKE}/flake.nix").outputs {
+      inherit hyperhive;
+      hyperhive-docs.outPath = env.SWARM_BUILDER_HYPERHIVE_DOCS_FLAKE;
+      agent.nixosModules.default = agentModule;
+    }).packages.x86_64-linux.check;
+
   cases = [
     {
       name = "the swarm builder's container exists only where its host enables it";
@@ -113,9 +137,10 @@ let
     {
       # The check builds on the sources a hive on this host would render into
       # its meta flake, so a green check means the same base.
-      name = "the builder builds on the hyperhive and nixpkgs this host's hives use";
+      name = "the builder builds on the hyperhive, docs and nixpkgs this host's hives use";
       ok =
         env.SWARM_BUILDER_HYPERHIVE_FLAKE == withBuilder.services.hyperhive.c0re.hyperhiveFlake
+        && env.SWARM_BUILDER_HYPERHIVE_DOCS_FLAKE == withBuilder.services.hyperhive.c0re.hyperhiveDocs
         && env.SWARM_BUILDER_NIXPKGS_FLAKE == withBuilder.services.hyperhive.c0re.nixpkgsFlake
         && lib.hasSuffix "-check-flake" env.SWARM_BUILDER_CHECK_FLAKE
         && env.SWARM_BUILDER_CONFIG_ORG == "agent-configs"
@@ -150,6 +175,18 @@ let
         && lib.elem "execution" reviewer
         && !(lib.elem "meta" reviewer);
     }
+    {
+      # `docs.enable` reads `docs.source`, whose default builds from the
+      # `docs/` the `hyperhive` source has none of; an eval error there fails
+      # this whole group.
+      name = "the builder's check evaluates a config with the reference docs on";
+      ok =
+        lib.hasSuffix ".drv"
+          (builderCheck {
+            services.hyperhive.agent.user.name = "a1";
+            services.hyperhive.agent.docs.enable = true;
+          }).drvPath;
+    }
     {
       # The responder denies a client id it does not know, and a NATS denial
       # arrives as a timeout.