From eb61660d350d001939a57632bc52a2063350d3b2 Mon Sep 17 00:00:00 2001 From: atlas Date: Tue, 9 Jun 2026 09:34:49 +0200 Subject: [PATCH] chore(nix): replace tracker tags with prose in nix comments MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Part of the tracker-tag cleanup: the hive convention is prose, not issue-tracker tags, in code. Reword the 21 tags in the nix tree (flake.nix + the hive-c0re/ci/gateway/network modules) to describe the thing they pointed at, preserving the context without the tag. Comment-only — no eval or logic change. Validated with nix fmt (no reformatting) and nix flake check --no-build (all checks evaluate clean); the full build check was skipped locally because the shared remote builder is degraded, so CI will exercise the build derivations once the runner recovers. --- flake.nix | 27 +++++++++++++-------------- nix/modules/hive-c0re.nix | 6 +++--- nix/modules/hive-ci.nix | 8 ++++---- nix/modules/hive-gateway.nix | 4 ++-- nix/modules/hive-network.nix | 4 ++-- 5 files changed, 24 insertions(+), 25 deletions(-) diff --git a/flake.nix b/flake.nix index 51048152..4b39a3fd 100644 --- a/flake.nix +++ b/flake.nix @@ -4,7 +4,7 @@ inputs = { nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05"; nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable"; - # Crane (replaces naersk #538). Stateless — no nixpkgs input to + # Crane (replaces the former naersk-based build). Stateless — no nixpkgs input to # follow; `crane.mkLib pkgs` returns the lib at whatever pkgs we # pass it (we use the project's pinned nixpkgs). crane.url = "github:ipetkov/crane"; @@ -51,7 +51,7 @@ # cares about" filter (Cargo.toml/Cargo.lock + *.rs). All # non-rust runtime assets — branding + the claude system # prompt template + claude-settings.json — live in the - # separate `hyperhive-assets` derivation (#555) and are + # separate `hyperhive-assets` derivation and are # loaded by the binaries at runtime from `$HIVE_ASSETS_DIR`. # The unit tests in `hive-ag3nt::prompt` read the same # `prompts/system.md` directly from the workspace tree at @@ -91,10 +91,10 @@ # sandbox. # `librsvg` used to live here for `hive-c0re/build.rs`'s # rsvg-convert call — that whole codepath moved into the - # `hyperhive-assets` derivation in #555, so the rust + # `hyperhive-assets` derivation, so the rust # derivation no longer needs the dependency. # `sqlite` required by matrix-sdk's `sqlite` feature - # (`hive-matrix-mcp` workspace member, #548 phase 3) — the + # (`hive-matrix-mcp` workspace member) — the # matrix-sdk-sqlite + rusqlite stack links against system # libsqlite3 by default. nativeBuildInputs = [ @@ -129,7 +129,7 @@ # prompt::tests` reads the production prompt template at test # runtime through `$HIVE_ASSETS_DIR`, so wiring the env var # into the build phase here would make the prompt's hash a - # build input of `default` (defeats #555's cache goal: a + # build input of `default` (defeats the asset-split cache goal: a # prompt edit would still bust the binary derivation, even # though no .rs file changed). Keeping tests in a separate # check derivation localises the asset-rebuild blast radius @@ -144,12 +144,12 @@ }; # Bundled browser assets — see ./nix/frontend.nix. Output is # $out/{dashboard,agent}/ which the Rust binaries serve via - # tower_http::ServeDir (wired up in Phase 4 of #273). + # tower_http::ServeDir. frontend = pkgs.callPackage ./nix/frontend.nix { branding-svg = ./branding/hyperhive.svg; }; # Static runtime assets the rust binaries read via - # `hive_sh4re::assets::*` (#555): branding/* + prompts/*, + # `hive_sh4re::assets::*`: branding/* + prompts/*, # plus the rendered agent-configs.png. Split out of the # rust derivation so a tweak to e.g. system.md doesn't bust # the cargo cache. Build input of the `cargo-test` check but @@ -164,7 +164,6 @@ # spawn dramatically because the heavy lifting (nixpkgs + # claude-code + hive-ag3nt binary) is already in the store # when the meta evaluator goes to build the container. - # Closes #97. # # nixosConfigurations are pinned to x86_64-linux (nixos- # containers only run native arch), so these toplevels are @@ -175,7 +174,7 @@ agent-base-toplevel = self.nixosConfigurations.agent-base.config.system.build.toplevel; ruth-toplevel = self.nixosConfigurations.ruth.config.system.build.toplevel; - # Auto-generated nix options reference for hyperhive (#616). + # Auto-generated nix options reference for hyperhive. # `docs` bundles host + agent pages into one tree; the split # outputs are useful when consumers only want one surface. # All three are pure markdown — no rust or frontend deps in @@ -196,7 +195,7 @@ # is applied (manager + agent containers both apply it via # `mkContainer` further down). hyperhive-frontend = self.packages.${prev.stdenv.hostPlatform.system}.frontend; - # Static runtime assets (#555). Exposed alongside the binary + # Static runtime assets. Exposed alongside the binary # so the harness module can wire $HIVE_ASSETS_DIR straight # to `${pkgs.hyperhive-assets}/share/hyperhive`. hyperhive-assets = self.packages.${prev.stdenv.hostPlatform.system}.assets; @@ -243,7 +242,7 @@ hyperhiveNixpkgsUnstable = "path:${nixpkgs-unstable}"; # Per-container toplevels — wired into `system.extraDependencies` # when `services.hyperhive.c0re.preBuildAgentTemplates` is on so the - # host system closure pre-fetches the heavy build inputs (#97). + # host system closure pre-fetches the heavy build inputs. # Defined only for x86_64-linux because nixosConfigurations are # hardcoded to that system; the option's default keeps the # extra deps gated so aarch64 hosts don't accidentally pull @@ -292,7 +291,7 @@ packages = with pkgs; [ cargo clippy - librsvg # rsvg-convert — hive-c0re/build.rs invokes it (#424) + librsvg # rsvg-convert — hive-c0re/build.rs invokes it pkg-config rust-analyzer rustc @@ -331,7 +330,7 @@ # group from that gate: pedantic is the "extra, opinionated" # group the clippy team grows freely, so denying it means # every toolchain bump that adds a new pedantic lint breaks CI - # with zero code changes (#1368). The `pedantic = warn` + # with zero code changes. The `pedantic = warn` # workspace lint (Cargo.toml) keeps it as advisory signal in # local `cargo clippy` — it just no longer blocks the build. # (`-A` rather than `-W` here: `-W clippy::pedantic` would @@ -361,7 +360,7 @@ cargoTestExtraArgs = "--workspace"; HIVE_ASSETS_DIR = "${self.packages.${system}.assets}/share/hyperhive"; }; - # Nix options docs evaluation (#616). Cheap: pulls in + # Nix options docs evaluation. Cheap: pulls in # `nixosOptionsDoc` + the host module's stub eval, no rust or # frontend deps. CI fails fast if a module change breaks # option declarations or the doc rendering. Reuses the diff --git a/nix/modules/hive-c0re.nix b/nix/modules/hive-c0re.nix index b5d3356a..3fc87ab3 100644 --- a/nix/modules/hive-c0re.nix +++ b/nix/modules/hive-c0re.nix @@ -458,7 +458,7 @@ in Pre-fetch the per-container system closures (agent-base + manager toplevels) into the host's /nix/store as part of this host's NixOS build, instead of letting the first agent spawn - do all the work. Closes #97. + do all the work. Enabling this adds roughly the full nixpkgs runtime closure + claude-code + the harness binary to your system closure size @@ -612,8 +612,8 @@ in pkgs.git ]; - # Pull the per-container toplevels into the host system closure - # (#97). `system.extraDependencies` adds paths to the system build + # Pull the per-container toplevels into the host system closure. + # `system.extraDependencies` adds paths to the system build # without referencing them at runtime — nixos-rebuild fetches / # builds them, they end up in /nix/store, and the first # nixos-container update + start for an agent has nothing left to diff --git a/nix/modules/hive-ci.nix b/nix/modules/hive-ci.nix index e8ab8d3d..d6b56fea 100644 --- a/nix/modules/hive-ci.nix +++ b/nix/modules/hive-ci.nix @@ -118,7 +118,7 @@ let # attempt for the full 60s loop, then exits with a misleading # "core token absent or forge unreachable" — masking the real cause. # Fail fast + loudly on 401/403 so the failure mode is legible and - # the operator/hive-c0re knows to re-mint forge-core-token (#1475). + # the operator/hive-c0re knows to re-mint forge-core-token. RESP=$(${pkgs.curl}/bin/curl -s -w $'\n%{http_code}' \ "$FORGE_URL/api/v1/admin/runners/registration-token" \ -H "Authorization: token $CORE_TOKEN" || printf '\n000') @@ -287,9 +287,9 @@ in # `nixos-container@…`. The earlier `nixos-container@hive-ci.service` # matched no real unit, so before/wantedBy/partOf were silent # no-ops — the partOf never bound, the oneshot stayed - # `active (exited)`, and the token was never refreshed on restart - # (a contributor to #1475). Confirmed against the live - # `container@hive-matrix.service` unit during the #1465 incident. + # `active (exited)`, and the token was never refreshed on restart. + # Confirmed against the live `container@hive-matrix.service` unit + # during the matrix-outage incident. partOf = [ "container@hive-ci.service" ]; serviceConfig = { Type = "oneshot"; diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix index efa3e776..faa75800 100644 --- a/nix/modules/hive-gateway.nix +++ b/nix/modules/hive-gateway.nix @@ -973,8 +973,8 @@ in # Hive authoritative records — answer queries for the # hive domain + its sub-domains with the bridge IP # (where nginx is reachable from container netns once - # #14 lands; today it's the host loopback alias and - # works in either shape). + # per-agent netns isolation lands; today it's the host + # loopback alias and works in either shape). # # The forge / matrix entries are redundant in the # common case where `forge.domain` / diff --git a/nix/modules/hive-network.nix b/nix/modules/hive-network.nix index 9c495b43..b20e7553 100644 --- a/nix/modules/hive-network.nix +++ b/nix/modules/hive-network.nix @@ -97,8 +97,8 @@ in default = false; example = true; description = '' - Flip agent containers from shared host netns to private netns - (#14). When true, each agent container gets a dedicated veth + Flip agent containers from shared host netns to private netns. + When true, each agent container gets a dedicated veth pair attached to `bridgeName` and a deterministic IP from the bridge subnet. The bridge (already up when `enable = true`) becomes the sole routed path between the host and agent