vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: catch up post-#658/#604/#660 + add operator hivectl section (#124)

Browse source
This commit is contained in:
damocles 2026-05-31 09:39:12 +02:00
commit fcb5fae345
6 changed files with 44 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/security.md
View file

@ -18,8 +18,12 @@ any file in the container that the nixbld user can read.
**What is NOT exposed**:
- `/root/.claude/` — mode `0700`, owned by root. nixbld users cannot read it.
- `/state/forge-token` — written at mode `0600` by `hive-c0re/src/forge.rs`.
- `/home/<name>/.claude/` — mode `0700`, owned by the per-agent
user `<name>` (post-#658 — was `/root/.claude` owned by root
pre-#658). nixbld users cannot read it.
- `$HYPERHIVE_STATE_DIR/forge-token` (= `/agents/<name>/state/forge-token`)
— written at mode `0600` by `hive-c0re/src/forge.rs` and chowned to the
per-agent uid:gid by `lifecycle::chown_to_agent` (post-#673/#678).
nixbld users cannot read it.
**Policy**: all credential files written to agent state directories MUST be mode