vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix tracker-tag lint and vale prose reds on #4624

Browse source 
Rewrite two bare issue references (#4472, #4477) as self-standing
prose per check-issue-refs.sh's requirement — no markdown exemption,
hash-number tags are dead weight to a public forge-mirror reader.

Apply iris's vale fix to docs/agent-lifecycle/approvals.md (passive
voice, two contractions, one auto- hyphenation).
This commit is contained in:
atlas 2026-09-21 18:52:33 +02:00 • committed by mara
commit eec908bdb7
3 changed files with 7 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

10
docs/agent-lifecycle/approvals.md
View file

@ -511,16 +511,16 @@ host-side bind mounts via `set_nspawn_flags`:
An agent without the capability only has its direct children's config An agent without the capability only has its direct children's config
dirs. dirs.
⚠️ nspawn bind flags are baked at container start, so granting or ⚠️ nspawn bakes bind flags at container start, so granting or
revoking this capability does not change any mount until that agent's revoking this capability doesn't change any mount until that agent's
container is rebuilt/restarted. container is rebuilt/restarted.
The root agent gets the capability by default, seeded on its auto-deploy The root agent gets the capability by default, seeded on its autodeploy
path (`workers::auto_update::ensure_root_agent`) so the recovery mounts path (`workers::auto_update::ensure_root_agent`) so the recovery mounts
are there from its first container. That seed only fires while are there from its first container. That seed only fires while
`capabilities.json` has never been written: any grant or revoke through `capabilities.json` doesn't exist yet: any grant or revoke through
the dashboard creates the file, so a revoked root-agent grant stays the dashboard creates the file, so a revoked root-agent grant stays
revoked and is not re-applied on the next hive-c0re restart. revoked and isn't re-applied on the next hive-c0re restart.
Each proposed repo (`/agents/<n>/config/`) is pre-configured Each proposed repo (`/agents/<n>/config/`) is pre-configured
with `applied` as a git remote pointing at with `applied` as a git remote pointing at

2
hive-c0re/src/lifecycle/host_config.rs
View file

@ -334,7 +334,7 @@ async fn set_nspawn_flags(
// accident of how the set is computed. The grant used to hang off a // accident of how the set is computed. The grant used to hang off a
// `can_manage_top_level_agents` role and cover `top_level_agents()` // `can_manage_top_level_agents` role and cover `top_level_agents()`
// — i.e. `parent.is_none()` — which was "everything outside the // — i.e. `parent.is_none()` — which was "everything outside the
// hierarchy". With the hierarchy gone (#4472) every agent is // hierarchy". With that hierarchy removed, every agent is
// parentless, so that set *was* every agent anyway; the capability // parentless, so that set *was* every agent anyway; the capability
// now says so out loud instead of deriving it from a field that no // now says so out loud instead of deriving it from a field that no
// longer discriminates. // longer discriminates.

2
hive-c0re/src/workers/auto_update.rs
View file

@ -211,7 +211,7 @@ fn should_seed_manager_caps(store_written: bool) -> bool {
/// `topology::reconcile_roles` seeded `can_manage_top_level_agents` onto /// `topology::reconcile_roles` seeded `can_manage_top_level_agents` onto
/// `MANAGER_NAME` on every meta sync, and that role is what put the other /// `MANAGER_NAME` on every meta sync, and that role is what put the other
/// agents' state/config dirs, `/applied` and `/meta` into her nspawn binds. /// agents' state/config dirs, `/applied` and `/meta` into her nspawn binds.
/// #4477 collapsed the role into the capability, so without a seed here she /// Collapsing the role into the capability means that without a seed here she
/// loses those recovery mounts at her next container rebuild — silently, and /// loses those recovery mounts at her next container rebuild — silently, and
/// only then, because nspawn bakes bind flags at container start. /// only then, because nspawn bakes bind flags at container start.
/// ///