From f9feb93cedfa94026fd7942b57cfbff3eaadc057 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Fri, 2 Oct 2026 23:34:27 +0200
Subject: [PATCH] module-eval: pin a claude agent's subagent store identity

The subagent daemon gets the agent's store identity on every agent with a
store, whatever its runtime. The case pinned only the two ACP arms; it now
covers the claude runtime too, and checks BAO_CLIENT_CERT/KEY as well.
---
 nix/module-eval/agent-runtime.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/nix/module-eval/agent-runtime.nix b/nix/module-eval/agent-runtime.nix
index 66629f66..6fca89be 100644
--- a/nix/module-eval/agent-runtime.nix
+++ b/nix/module-eval/agent-runtime.nix
@@ -54,6 +54,12 @@ let
     };
   opencode = opencodeWith { };
   opencodeBao = opencodeWith { bao.addr = "https://bao.t.local:8200"; };
+  claudeBao = agentWith {
+    services.hyperhive.agent = {
+      runtime = "claude";
+      bao.addr = "https://bao.t.local:8200";
+    };
+  };
   acpBao = agentWith {
     services.hyperhive.agent = {
       runtime = "acp";
@@ -107,8 +113,11 @@ let
             ]
             && u.environment.HIVE_AGENT_NAME == "a1"
             && u.environment.BAO_ADDR == "https://bao.t.local:8200"
+            && u.environment.BAO_CLIENT_CERT == "%d/hive-agent-bao-cert"
+            && u.environment.BAO_CLIENT_KEY == "%d/hive-agent-bao-key"
           )
           [
+            (subagent claudeBao)
             (subagent acpBao)
             (subagent opencodeBao)
           ];