job_queue: submit boot-time forge/matrix/webhook/knowledge sweeps as DAG nodes

hive-c0re/src/job_queue/exec.rs

@@ -148,10 +148,76 @@ pub(super) async fn run_node(
         // `Finishing` so the nodes under it start. What they declare stays held
         // until their whole subtree settles.
         NodeKind::DeployWindow { .. } | NodeKind::AgentWindow { .. } => Ok(()),
+        NodeKind::ForgeSweep => run_forge_sweep().await,
+        NodeKind::MatrixSweep => run_matrix_sweep().await,
+        NodeKind::WebhookRegister => run_webhook_register().await,
+        NodeKind::KnowledgePull => run_knowledge_pull(coord).await,
     };
     (builder, result)
 }
 
+/// Boot-time forge user/token sweep as a DAG node — see
+/// [`NodeKind::ForgeSweep`]. `forge::ensure_all` already does its own
+/// per-step error handling and boot-warning banners internally (it's
+/// best-effort by design), so this wrapper has nothing left to report;
+/// it exists purely to make the sweep a visible unit of work.
+async fn run_forge_sweep() -> Result<()> {
+    crate::forge::ensure_all().await;
+    Ok(())
+}
+
+/// Boot-time matrix user/space sweep as a DAG node — see
+/// [`NodeKind::MatrixSweep`]. Reports failure as the node's own error so a
+/// failed boot sweep is visible on the dashboard; the debounced
+/// `sweep_health`-driven warning banner is a separate concern owned by the
+/// periodic loop in `main.rs`, unaffected by this node's own outcome.
+async fn run_matrix_sweep() -> Result<()> {
+    if crate::matrix::ensure_all().await {
+        Ok(())
+    } else {
+        anyhow::bail!("matrix ensure_all: one or more agents failed sync (see logs)")
+    }
+}
+
+/// Boot-time Forgejo webhook registration as a DAG node — see
+/// [`NodeKind::WebhookRegister`]. Mirrors the guard chain the
+/// `tokio::spawn` block it replaced used: no-op (not an error) when the
+/// HMAC secret, core token, or hive domain aren't available yet.
+async fn run_webhook_register() -> Result<()> {
+    let Ok(webhook_secret) = crate::webhook_secret::load_or_generate() else {
+        tracing::debug!("webhook secret unavailable; skipping hook registration");
+        return Ok(());
+    };
+    let Some(token) = crate::forge::core_token() else {
+        return Ok(());
+    };
+    let domain = std::env::var("HYPERHIVE_HIVE_DOMAIN")
+        .ok()
+        .filter(|v| !v.is_empty());
+    let Some(domain) = domain else {
+        tracing::debug!("HYPERHIVE_HIVE_DOMAIN unset; skipping webhook registration");
+        return Ok(());
+    };
+    if let Err(e) =
+        crate::workers::knowledge::ensure_webhook(&token, &domain, &webhook_secret).await
+    {
+        tracing::warn!(error = ?e, "knowledge: ensure_webhook failed");
+    }
+    if let Err(e) = crate::forge::ensure_config_pr_webhook(&token, &domain, &webhook_secret).await {
+        tracing::warn!(error = ?e, "forge: ensure_config_pr_webhook failed");
+    }
+    Ok(())
+}
+
+/// Boot-time `/knowledge` pull as a DAG node — see
+/// [`NodeKind::KnowledgePull`]. Unlike the `main.rs` periodic loop's
+/// startup call, a failure here is *not* swallowed to debug level: the node
+/// exists so a failed boot pull is visible on the dashboard rather than
+/// only in the journal.
+async fn run_knowledge_pull(coord: &Arc<Coordinator>) -> Result<()> {
+    crate::workers::knowledge::pull(coord).await
+}
+
 /// Resolve the DAG's approval row the way this node's own `outcome` says.
 ///
 /// Nothing is inspected: a template emits one of these per outcome, each edged to