From f0ddbe49d0a2a74824e998b2b8029982c2d6959d Mon Sep 17 00:00:00 2001 From: damocles Date: Sun, 13 Sep 2026 16:14:11 +0200 Subject: [PATCH] hive-c0re: pull each meta-update cascade agent's own config-repo main MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit mara (hyperhive#4271): "whatever is on main is trusted and should be pulled. dont make it periodic, just add it to the meta update when choosing the agent." A meta-input bump previously rebuilt every affected agent against whatever applied/ was already locked to. Normally current, but silently stale forever if a past deploy failed and nothing since retried it — the manual meta-input trigger never special-cased that either, since nothing wired it to check the config repo's live main at all. run_meta_lock now relocks each cascade agent's own input alongside the originally-requested ones, against the input's declared source (the forge URL) rather than the local applied/ mirror prepare_deploy uses for a reviewed deploy — there's no PR to review on this path, so nothing to gate. One combined lock_update call for the whole cascade: simpler than per-agent isolation, at the cost of one broken/unreachable agent repo failing the whole cascade relock rather than just that agent (the separate top-level input bump above it is unaffected). Known gap, not fixed here: applied/'s own main/deployed/* tags never advance from this path, only a real MergeConfigPr deploy does that — so the audit trail stays as accurate as today, it just stops being what actually got built. --- hive-c0re/src/job_queue/exec.rs | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/hive-c0re/src/job_queue/exec.rs b/hive-c0re/src/job_queue/exec.rs index 740b3c15..067684a5 100644 --- a/hive-c0re/src/job_queue/exec.rs +++ b/hive-c0re/src/job_queue/exec.rs @@ -548,6 +548,23 @@ async fn run_meta_lock( Some(list) => list, None => meta_update_cascade_agents(inputs).await, }; + // Pull each cascade agent's own input too — an agent's config-repo main + // is trusted, so a meta-input bump is a reasonable place to also catch + // it up. Without this, a meta-input bump rebuilds every affected agent + // against whatever `applied/` + // already happened to be locked to — normally current, but silently + // stale forever if a past deploy failed and nothing since retried it. + // Relocks against each agent's *declared* input (the forge URL, not the + // local `applied/` mirror `prepare_deploy` uses for a reviewed + // deploy) — this path has no PR to review, so there's nothing to gate. + // One combined call, not per-agent: simpler, at the cost of one + // unreachable/broken agent repo failing the whole cascade relock rather + // than just that agent. + if !cascade.is_empty() { + let agent_inputs: Vec = + cascade.iter().map(|name| format!("agent-{name}")).collect(); + crate::meta::lock_update(&agent_inputs).await?; + } // Grow one rebuild subgraph per affected agent into *this* meta-update // DAG (rooted on this `MetaLock`, so they build against the post-bump // lock), rather than fanning out child DAGs. `relock = false` — the