From f2efb69132ccfe83240782da6c9827d42621ecc3 Mon Sep 17 00:00:00 2001 From: iris Date: Tue, 26 May 2026 00:52:14 +0200 Subject: [PATCH] c0re: lift manager-stop guard in dashboard post_kill (#443) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #446 (agent selection + bulk actions) already merged, which removed the per-card R3ST4RT/ST0P/etc buttons entirely. So the frontend half of the original #445 (lift the c.is_manager gate around the per-card stop button) is now redundant — there ARE no per-card buttons left, and the selection bar's ST0P button is already manager-aware. What remains and what this commit ships: the host-side guard in `dashboard.rs::post_kill` that rejects stop on the manager with "kill: refusing to stop the manager". Removed. Rationale: hive-c0re owns the dashboard server, so stopping the manager has no dashboard disruption. Per-agent approvals submitted by other sub-agents still process through the host-side approval queue without the manager up, and operator-driven meta-input updates work from the dashboard either way. The MCP-surface self-kill guard in `manager_server.rs::ManagerRequest::Kill` stays in place: a manager calling Kill on its own container is self-suicide mid-call, not a legitimate operator action; the guard prevents that footgun. Destroy / purge guards (`actions.rs:578` — "refusing to destroy the manager") stay in place; mara's ask was specifically about stop, and destroying the manager is a much bigger blast radius. --- hive-c0re/src/dashboard.rs | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/hive-c0re/src/dashboard.rs b/hive-c0re/src/dashboard.rs index 9871fc54..4f28b01f 100644 --- a/hive-c0re/src/dashboard.rs +++ b/hive-c0re/src/dashboard.rs @@ -1684,10 +1684,16 @@ where } async fn post_kill(State(state): State, AxumPath(name): AxumPath) -> Response { - let logical = strip_container_prefix(&name); - if logical == lifecycle::MANAGER_NAME { - return error_response("kill: refusing to stop the manager"); - } + // #443: manager is stoppable from the dashboard like any other + // agent. The host's dashboard server keeps running (it's + // hive-c0re, not the manager container), per-agent approvals + // submitted by other sub-agents still process through the + // host-side approval queue without the manager up, and + // operator-driven meta-input updates work from the dashboard + // either way. The MCP-surface self-kill guard in + // `manager_server.rs::ManagerRequest::Kill` stays in place: a + // manager calling Kill on its own container is self-suicide + // mid-call, not a legitimate operator action. lifecycle_action( &state, &name,