- server-warnings banner: was described as disk-pressure-only; it's now
a push-based registry with multiple producers (forge/CI boot
failures, agent-state warnings), and shown on more standalone pages
than listed
- browser tab title: actual default/format is "hyperhive // h1ve-c0re",
not "hive / c0re"
- SW4RM container tree: ContainerView.parent comes from
agent_config/topology.rs, not the ambiguous dashboard/topology.rs
(which only holds set-parent endpoints)
- T00L GR0UPS: tool-group enumeration was missing "forge"; root agent's
default (MANAGER_DEFAULT) is not literally "all groups" -- it excludes
forge and web_tools
- ST4TS moved to its own /stats.html page a while back; section still
called it a dashboard tab
- P33RS is a headline block within the SW4RM tab, not its own tab --
contradicted the doc's own chrome-header description
- active model badge: reads hyperhive-harness.json's active_model
field, not a bare harness/hyperhive-model file
- themed dialogs: modal.js lives in the shared package
(@hive/shared/modal.js), and themedToast takes (message, opts) not
a single options object
- graceful stop: backend uses a Signal/Drain job-queue node pair, not
a "GracefulStop" transient kind; hivectl flag is `stop --graceful`,
not a bare `--graceful`
- container_state_changed event: named a nonexistent
auto_update::rebuild_agent as an emit site; actual sites are
actions::approve and the job queue's own node execution
Verified against hive-c0re/src (dashboard/, stats/, job_queue/,
container_view.rs), hive-sh4re/src/permissions.rs, and the dashboard
frontend package (tabs.js, stats.js, swarm.js, builds.js, modal.js).
No structural/prose changes beyond what the fact corrections required.
Verified against hive-agent/src/paths.rs: harness-internal files
(hyperhive-events.sqlite, hyperhive-turn-stats.sqlite, hyperhive-model)
live in the separate harness dir, specifically kept out of the
agent-visible state dir.
Verified against hive-sh4re/src/manager.rs and docs/approvals.md: only
ApprovalResolved/ContainerCrash/NeedsUpdate/QuestionAsked/QuestionAnswered
are HelperEvents delivered as inbox messages. spawned/rebuilt/killed/
destroyed/needs_login/logged_in/config_ready aren't HelperEvent variants
at all — they deliver via Coordinator::push_todo/push_todo_submitter
(the in-container todo socket), not the broker inbox.
Verified against hive-c0re/src/agent_config/topology.rs: there is no
parent_of function; <parent> sentinel resolution happens in
topology::resolve_recipient.
Verified against nix/agent-modules/claude-settings.nix (claudeMarketplaces
and claudePlugins defaults both gained a second entry — the hive's own
claude-plugins marketplace and base@hyperhive plugin — that the doc never
picked up) and hive-agent/src/web_ui/state.rs (dashboardLinks is read by
the harness's own per-agent web UI, not hive-c0re / the operator
dashboard).
Verified against Cargo.lock (rmcp resolves to 2.2.0, Cargo.toml pins
"2") and hive-core-agent-sock/src/lib.rs (the Wake variant lives on
Request there; hive_sh4re::AgentRequest doesn't exist).
Verified against hive-agent/src/harness_state.rs (context_window_tokens
lives there, only imported into events.rs) and hive-agent/src/paths.rs
(config_dir() defaults to /run/hive-config, deliberately separate from
/run/hive/ which holds the per-agent socket).
Verified against hive-agent/src/main.rs and hive-core-agent-sock/src/lib.rs:
there is no AgentRequest/AgentResponse or ManagerRequest/ManagerResponse
alias anywhere in the tree — hive-agent uses hive_core_agent_sock's
unified Request/Response enum directly.
Verified against hive-c0re/src/lifecycle/host_config.rs (function lives
in the host_config submodule, not bare lifecycle::) and
nix/host-modules/hive-matrix.nix (the working Accept-header SPA
fallback lives there, serving fluffychat at the vhost root /index.html,
not a /matrix/ path prefix in a nonexistent hive-gateway.nix).
hive-c0re/src/dashboard.rs became a module directory
(hive-c0re/src/dashboard/) a while back; three more references to it
as a single file survived the #3281 sweep (conventions.md x2,
web-ui/shape.md's StateSnapshot pointer). Same bug class the sweep
was hunting for, argus caught it in review.
Two follow-ups the per-file sweep workers flagged but couldn't fix
themselves (either not their assignment, or not visible from their
worktree):
- web-ui/dashboard.md's P33RS tab named dashboard.rs, which no longer
exists (hive-c0re/src/dashboard/ is a module dir now); the function
moved to state_snapshot.rs.
- approvals.md and conventions.md used hive_ag3nt:: as a Rust
module-path prefix. hive-agent is a bin-only crate (no lib target),
so that prefix never resolved to anything; also fixed the
hive-ag3nt/prompts/system.md path to the real hive-agent/prompts/.
All three verified directly against the current source tree, not
guessed.
The comment said "It parses; it does not prove a sample arrives",
which understates the gap in the direction that matters: it reads as
if a green build proves the collector *starts* and only runtime
delivery is unverified.
Measured while probing ingest-auth options for #3283: `otelcol
validate` ACCEPTS a receiver naming an auth extension that is absent
from the build, and the collector then dies at startup with `Failed
to start component`. So the check does not prove this config starts
at all.
Comment-only; no evaluated config changes.
Refs #3283.
Retention so a reader can ask what a hive last said without anyone
keeping a second copy. The container is ephemeral = false, so the store
survives a restart with no bind mount, and losing it degrades to the
true answer (nothing known) rather than a stale one.
The per-account grant is the part that is easy to miss: the server
option gives the SERVER JetStream, and an account gets it only from its
own. Measured against a running 2.14.1 with this exact two-account
shape - global-only makes kv operations fail 10039 while the server
starts cleanly and logs Starting JetStream, so no rendering check can
see it. Deliberately not granted to the callout account: the responder
mints credentials and has no business holding stream state.
argus on #3280: the receiver has no auth extension - the nixpkgs module
passes settings straight through and nothing wires one on - so
'unauthenticated to a bridge address' means reachable from an agent
container, not presents a credential. The firewall is the whole access
control.
Consequence, stated because it is a choice rather than an oversight:
any agent can push arbitrary OTLP and the collector forwards it under
the operator's credential, including data smuggled out in resource
attributes. That is a different risk from the one the collector fixes,
and strictly smaller than what preceded it - before, every agent held
the credential itself and could do all of that plus use the token
anywhere else. The collector removes the token and keeps the pipe.
Same principle this PR already applies to the availability trade: state
it where the reader is, rather than let it be discovered.
The headersCredential section still said hive-c0re forwards the file
into each agent container - that is exactly the behaviour this change
removes, so the doc contradicted the code rather than merely lagging
it. Same for the collector section, which presented the two paths the
change collapses.
Also drops the dangling collector.enable reference in the network
section.
mara: 'there should only be the one via otel-collector'. Collapses
collector.enable away - enabling otel runs the collector, and agents
always export to it.
The argument for it is the same one the collector exists for: as long
as the direct path stays selectable, the credential-in-settings.json
hole stays selectable. An option that can reintroduce a hole is a hole
with extra steps. HYPERHIVE_OTEL_HEADERS_CREDENTIAL is now never
forwarded to containers at all rather than conditionally.
Two consequences, both deliberate:
- the enable option's own promise changes. It said each harness exports
directly so telemetry survives anything host-side being down; that is
now false for every hive rather than for opted-in ones. Stated in the
option text rather than left for a reader to discover.
- the collector-requires-headersCredential assertion is gone. It was
correct only under the shape it was written for: when the collector
was opt-in FOR the credential, opting in without one was pure
indirection. With one path it isn't - an upstream needing no auth
header is legitimate, and the assertion would have rejected it. The
upstream header block is now omitted entirely in that case, rather
than rendering an ${env:...} reference nothing sets.
