hyperhive: make the values the meta-flake render reads swarm-wide
Five host options whose values hive-c0re renders into every agent's build move under services.hyperhive.swarm, so the swarm states each of them once instead of every hive carrying its own copy: c0re.dashboardPort -> swarm.dashboardPort c0re.claudeCodePackage -> swarm.claudeCodePackage github.enable -> swarm.github.enable otel.collector.port -> swarm.hiveOtel.collectorPort otel.extraResourceAttributes -> swarm.hiveOtel.extraResourceAttributes Every old path is a mkRenamedOptionModule alias, so a host that sets one keeps its value and gets an eval warning naming the new path. Types and defaults are unchanged, so the rendered meta flake, serve.json and hive-c0re's environment are the same as before on a host that sets none of them. The readers move with them: serve.json and its gc-root assertion, the hive-c0re environment, the hive collector's listen address and bridge port, the swarm collector's port-collision assertion, and the claude-login and review-classifier containers' claude pin. The swarm-services-switch fixture sets the swarm path and now also checks that serve.json carries the pinned claude. Part of #4857 (slice 2).
This commit is contained in:
atlas
mara
parent
af7114eb49
commit
fc32f57481
25 changed files with 189 additions and 138 deletions
|
|
@ -3,17 +3,29 @@
|
|||
# `nixosModules.default` wires to its own outputs (they carry no
|
||||
# in-module defaults; see ../../../flake.nix). The read-only
|
||||
# `servedFrontend` option lives in ./theme.nix with the stylix wiring
|
||||
# that computes it.
|
||||
# that computes it. The swarm-wide values the meta-flake render hands
|
||||
# every agent are declared here too, under `services.hyperhive.swarm`.
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
renamedToSwarm =
|
||||
name:
|
||||
lib.mkRenamedOptionModule
|
||||
[ "services" "hyperhive" "c0re" name ]
|
||||
[ "services" "hyperhive" "swarm" name ];
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
(lib.mkRemovedOptionModule [ "services" "hyperhive" "c0re" "managerToplevel" ] ''
|
||||
Every agent, ruth included, builds from `agentBaseToplevel`. Remove this definition.
|
||||
'')
|
||||
]
|
||||
++ map renamedToSwarm [
|
||||
"claudeCodePackage"
|
||||
"dashboardPort"
|
||||
];
|
||||
|
||||
options.services.hyperhive.c0re = {
|
||||
|
|
@ -119,56 +131,6 @@
|
|||
of the host's channel.
|
||||
'';
|
||||
};
|
||||
claudeCodePackage = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.package;
|
||||
default = null;
|
||||
example = lib.literalExpression "inputs.nixpkgs-unstable.legacyPackages.x86_64-linux.claude-code";
|
||||
description = ''
|
||||
The `claude-code` build every agent runs, or `null` (the
|
||||
default) to leave each agent on the `claude-code` from its own
|
||||
nixpkgs — i.e. whatever `nixpkgsFlake` resolves to.
|
||||
|
||||
This is the one binary the whole hive is built around, and it
|
||||
moves fast enough that a release channel routinely trails
|
||||
unstable by weeks on it. An agent cannot fix that for itself:
|
||||
agents evaluate against the single nixpkgs hive-c0re injects,
|
||||
so an `agent.nix` has no other tree to reach for. Set this from
|
||||
a second nixpkgs in the host flake and every agent follows,
|
||||
without moving the nixpkgs the rest of the container is built
|
||||
from.
|
||||
|
||||
What travels into the container is the **store path**, not the
|
||||
derivation: agents share the host's `/nix/store`, so the binary
|
||||
and its full closure are already reachable there — nothing
|
||||
needs rebuilding or copying. hive-c0re writes the path into
|
||||
each agent's generated flake as a plain string literal (a bare
|
||||
path fed to `lib.types.package` would run `builtins.storePath`,
|
||||
which is illegal under pure evaluation) and the agent module
|
||||
puts its `bin/` on the harness's PATH.
|
||||
|
||||
The flip side of a plain string is that nothing in the agent's
|
||||
own closure refers to it, so the container cannot keep it
|
||||
alive. The **host** does that instead: this package is
|
||||
interpolated into `/etc/hyperhive/serve.json`, which puts it in
|
||||
the host's system closure — so it is gc-rooted by the running
|
||||
generation for exactly as long as that generation is the one
|
||||
the agents were rendered from. The cost is that
|
||||
`nix-collect-garbage` cannot reclaim an old `claude-code` until
|
||||
every agent has been rebuilt past it and the old generations
|
||||
are gone.
|
||||
|
||||
The swarm's `swarm-claude-login` and `swarm-review-classifier`
|
||||
containers, where this host runs them, follow the same pin and
|
||||
keep their own nixpkgs' `claude-code` when it is `null`. They are
|
||||
not agents, so pinning an older build for an agent-side
|
||||
regression pins them too.
|
||||
'';
|
||||
};
|
||||
dashboardPort = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 7000;
|
||||
description = "TCP port the hive-c0re dashboard listens on.";
|
||||
};
|
||||
preBuildAgentTemplates = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
|
|
@ -377,4 +339,59 @@
|
|||
'';
|
||||
};
|
||||
};
|
||||
|
||||
# What every agent in the swarm is handed through the meta-flake render,
|
||||
# whichever hive builds it. Swarm-wide so that no hive's agents differ.
|
||||
options.services.hyperhive.swarm = {
|
||||
claudeCodePackage = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.package;
|
||||
default = null;
|
||||
example = lib.literalExpression "inputs.nixpkgs-unstable.legacyPackages.x86_64-linux.claude-code";
|
||||
description = ''
|
||||
The `claude-code` build every agent runs, or `null` (the
|
||||
default) to leave each agent on the `claude-code` from its own
|
||||
nixpkgs — i.e. whatever `c0re.nixpkgsFlake` resolves to.
|
||||
|
||||
This is the one binary the whole swarm is built around, and it
|
||||
moves fast enough that a release channel routinely trails
|
||||
unstable by weeks on it. An agent cannot fix that for itself:
|
||||
agents evaluate against the single nixpkgs hive-c0re injects,
|
||||
so an `agent.nix` has no other tree to reach for. Set this from
|
||||
a second nixpkgs in the host flake and every agent follows,
|
||||
without moving the nixpkgs the rest of the container is built
|
||||
from.
|
||||
|
||||
What travels into the container is the **store path**, not the
|
||||
derivation: agents share the host's `/nix/store`, so the binary
|
||||
and its full closure are already reachable there — nothing
|
||||
needs rebuilding or copying. hive-c0re writes the path into
|
||||
each agent's generated flake as a plain string literal (a bare
|
||||
path fed to `lib.types.package` would run `builtins.storePath`,
|
||||
which is illegal under pure evaluation) and the agent module
|
||||
puts its `bin/` on the harness's PATH.
|
||||
|
||||
The flip side of a plain string is that nothing in the agent's
|
||||
own closure refers to it, so the container cannot keep it
|
||||
alive. The **host** does that instead: this package is
|
||||
interpolated into `/etc/hyperhive/serve.json`, which puts it in
|
||||
the host's system closure — so it is gc-rooted by the running
|
||||
generation for exactly as long as that generation is the one
|
||||
the agents were rendered from. The cost is that
|
||||
`nix-collect-garbage` cannot reclaim an old `claude-code` until
|
||||
every agent has been rebuilt past it and the old generations
|
||||
are gone.
|
||||
|
||||
The swarm's `swarm-claude-login` and `swarm-review-classifier`
|
||||
containers, where this host runs them, follow the same pin and
|
||||
keep their own nixpkgs' `claude-code` when it is `null`. They are
|
||||
not agents, so pinning an older build for an agent-side
|
||||
regression pins them too.
|
||||
'';
|
||||
};
|
||||
dashboardPort = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 7000;
|
||||
description = "TCP port every hive's hive-c0re dashboard listens on.";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue