All three area:ops pillars are now complete: network isolation is
always on (private netns, no shared-netns mode), the gateway is live,
and hive-c0re runs as the unprivileged hive-core user.
- Rewrite the intro to say the boundary is enforced, not aspirational
- Update 'Why network isolation is the load-bearing step' section to
use past tense for the shared-netns world and note completion
- Mark network isolation as Complete in the sequencing list
The two-phase network rollout (bridge-first, then isolateContainers) is
complete. Both options are now deprecated no-ops — isolation is always on.
Update the doc to reflect current state:
- Drop the phased-rollout intro ('off by default during rollout') and the
v1/v2 comparison table; keep a brief historical note
- Remove 'Why ship before netns isolation' section (rollout is done)
- Update configuration example: network.enable is no longer needed
- Merge firewall description into a single table (80/443 always open)
- Remove 'Prerequisites before flipping on' and 'Migration behaviour'
subsections (isolation was a one-time flip; no longer a toggle)
- Simplify resolver wiring: hive-priv always drops the marker; remove
'only when isolated' conditional framing
The test's invalid-values list included "low" which was valid before
this PR but is now a legitimate effort level. Replace with "lowest"
(still invalid) so the test keeps its coverage without false-failing.
claude --effort now accepts low, medium, high, xhigh, max.
Expand EFFORT_LEVELS from 3 to 5, update NixOS enum + description,
and fix the stale doc comment in web_ui.rs.
Closes#2220
Agents cannot create repos directly via their forge token (no Create
scope; push-to-create disabled). Document the two paths:
- mcp__hyperhive__create_repo (forge tool group): creates under agents/
org via hive-c0re, adds write-collaborator access, enables branch
protection. The standard agent path.
- hive-forge repo-create / repo-add-collaborator (CLI): use the agent's
own token; repo lands under agent's user account or org.
The 'Privileged tools (by tool group)' section listed execution,
lifecycle/approvals, scheduling/diagnostics, capability-gated, and
matrix but was missing:
- forge (create_repo) — the only agent path to create a repo under the
agents/ org; direct token creation is disabled for agents. Opt-in,
not in any default preset.
- web_tools — enables Claude built-in WebFetch/WebSearch tools. Off by
default. The tool whitelist section already mentioned these but the
group was absent from the privileged-tools list.
The prettier markdown formatter (8406a452) converted a prose '+' into
a markdown list marker '-', splitting 'fires a wake...and the exit code
+ last stdout lines' into a dangling incomplete sentence followed by an
orphaned list item. Rewrite the sentence to avoid the pattern entirely.
open_dm(user_id) resolves (find-or-create) the DM room and returns
its room id without sending anything. It is the counterpart to
send_dm for cases where you need a room id to pass to a room-based
tool such as send_file or send_message.
The tool was present in hive-matrix-mcp (mcp.rs, handlers.rs,
protocol.rs) and the terminal-rendering icon table but was missing
from the tools/matrix.md reference doc.
The heading was inserted between items 3 and 4, breaking GFM ordered
list numbering (Forgejo renders items 4+ restarting at 1). Move the
subsection to after item 5 and update the in-prose reference to use
an anchor link instead of 'see table below'.
Replace the sparse 3-line prose description of fmtToolUse with a full
reference table covering every tool case added over the past several
PRs. Adds a new subsection listing the short-name convention (* suffix),
all Claude built-ins (Read/Write/Edit/Glob/Grep/Bash/TodoWrite), the
full hyperhive MCP surface (recv/send/ask/answer/remind/set_status/
get_loose_ends/get_agent_meta/cancel_loose_end/ack_until/kill/restart/
start/update/get_logs/get_host_journal/request_apply_commit/
request_init_config/request_update_meta_inputs), all scheduling tools
(list_schedules/cancel_schedule/fire_schedule_now/edit_schedule/
request_schedule_prompt — added in the previous PR), bash MCP tools
(run/status/kill), and matrix MCP tools (send_message/send_dm/
send_reply/send_reaction/read_room/mark_read/join_room/open_dm/
invite_user/download_file).
The docs evaluation referenced self.nixosConfigurations.agent-base and
self.nixosModules.default — both tied to self's full flake store path.
Every commit produces a new self hash (even when only Rust or frontend
files change), so docs drvs change on every commit and the remote
builder (muede-pc2) must rebuild them from scratch each time.
Fix: use builtins.path on the nix/ directory with
builtins.unsafeDiscardStringContext to produce a content-addressed store
path (nixSrc) that only changes when .nix files change. Evaluate both
hostEval and agentEval from nixSrc using stub package args (pkgs.emptyFile /
pkgs.emptyDirectory) instead of self.overlays.default, which avoids
pulling in the Rust and frontend build closures.
Now docs drvs only change when a .nix file changes. PRs that touch only
Rust or frontend code hit the remote builder cache instead of forcing a
rebuild. Closes the disk-pressure-induced CI failure loop on muede-pc2.
Forge URLs in transformOptions updated to prepend nix/ prefix correctly
(nixSrc is a copy of nix/, so stripped paths need nix/ re-added).
Wraps check-issue-refs.sh and check-comment-blocks.sh so a push that
would fail the tracker-tag or comment-block CI jobs is caught locally
before it reaches the remote — eliminating the fix-and-repush round-trip.
Install once per clone:
ln -sf ../../scripts/pre-push .git/hooks/pre-push
Also adds a one-liner hint to CLAUDE.md so it surfaces in every
agent's context at session start.
Three references to the effort level set in docs/web-ui/agent.md still
listed the old three-item set (medium/high/xhigh). Update all three to
match the expanded set added by PR 2221: low/medium/high/xhigh/max.
Closes#2220 (docs side).
Empty arrays are truthy in JS so 'if (input.targets_add)' would emit
'+0 tgt' for an explicit []. Add .length guard so zero-element lists
are silently skipped — consistent with fmtArgsGeneric's [N] handling.
The MCP schema defaults both fields to null, making this theoretical,
but the guard is cleaner.
Scheduling tools and the two remaining request_* tools fell through to
fmtArgsGeneric. They already had appropriate icons (⏱️ / 📦) but the
arg display was multi-field verbose.
New fmtToolUse cases:
- request_init_config: 'request_init_config* iris'
- request_update_meta_inputs: 'request_update_meta_inputs* [nixpkgs, …]'
(or 'all' when inputs list is empty)
- list_schedules: 'list_schedules*()' (no args, explicit)
- cancel_schedule: 'cancel_schedule* #42 all' or '#42 [iris, dmatrix]'
- fire_schedule_now: 'fire_schedule_now* #42'
- edit_schedule: 'edit_schedule* #42 · body · interval · +2 tgt'
(lists which fields are being changed, not their values)
- request_schedule_prompt: 'request_schedule_prompt* → iris at 14:00Z +3600s'
Closes#2201
The 'How does the per-agent terminal render tool calls?' reading path
was pointing only at web-ui/agent.md. terminal-rendering.md is the
authoritative reference (added recently with the full row taxonomy
table). Update the pointer to send readers there first, with a
note that web-ui/agent.md has the high-level summary.
The 'system' bullet was stale — it only mentioned the drop list
(init/result/rate_limit_event) and omitted the five specific handlers
added recently: plugin_install (muted note), commands_changed
(expandable details), compact_boundary (compact summary note),
thinking_tokens (in-place counter), and the generic catch-all.
Expand the bullet to cover the full dispatch shape, and add a
cross-reference to docs/terminal-rendering.md which has the
authoritative row taxonomy table and full dispatch walkthrough.
The selection bar's M0V3 action uses two different endpoints:
- single agent: POST /api/topology/set-parent (form-encoded)
- multiple agents: POST /api/topology/set-parent-bulk (JSON array)
The previous text said 'POSTs to /api/topology/set-parent ... once
per selected agent' — wrong on both counts for multi-agent moves.
The bulk endpoint lands all moves in one topology.json commit.
The option was only mentioned in passing in the system-prompt render
section. Add a proper ### section (following the pattern of Agent icon,
user.passwordlessSudo, etc.) with the nix snippet, default, effect on
$HIVE_DOCS_DIR + system prompt, and a note on the narrow docs flake
input that avoids full container rebuilds on doc edits.
After the fix in c708f698, POSTs no longer always return 200 — they use
semantic status codes: 400 for bad input, 409 for retryable state
conflicts (turn in flight, hive-c0re busy), 500 only for genuine failures.
Update the preamble to the Per-agent endpoints section to reflect this.
hive-c0re never writes outside its StateDirectory + RuntimeDirectory:
- /etc writes (nixos-containers) go through hive-priv, not c0re
- /etc/hyperhive/serve.json is read-only at startup (written by the
NixOS activation script, not by the daemon)
- nix builds delegate to hive-priv via the privileged Unix socket;
hive-c0re itself never invokes nix directly
So strict is safe: systemd keeps /var/lib/hyperhive (StateDirectory)
and /run/hyperhive (RuntimeDirectory) writable; everything else is
read-only, shrinking the writable attack surface to exactly what the
service needs.
Add docs/observability.md covering all services.hyperhive.otel.*
options: enable, endpoint, protocol, headersCredential,
extraResourceAttributes, debug (new in cb0a66147a), and
metricIntervalMs.
Includes:
- Built-in OTEL_RESOURCE_ATTRIBUTES labels (service.name, agent, hive, swarm)
- Cumulative temporality note (avoids Prometheus DELTA drop)
- Network note for host-side collectors on non-standard ports,
cross-referencing docs/network.md exposeHostPorts
Also:
- CLAUDE.md: add reading-path entry for the new doc
- docs/network.md: link the OTEL mention to observability.md
Closes no issue — gap found during doc sweep.
The renderer dispatch section only mentioned recv and Bash as fmtToolUse
examples. Update the description to cover the full range: matrix tools,
remind, scheduling, and the fmtArgsGeneric fallback.
join_room and open_dm shared a fall-through case with
(fmtRoom(input.room) || fmtUser(input.user_id) || '?'). fmtRoom()
returns the string '?' when input.room is undefined — truthy — so
the fmtUser() fallback was never reached and open_dm always displayed
'open_dm* ?'.
Split into two separate cases: join_room reads input.room, open_dm
reads input.user_id. Both degrade to '?' via fmtRoom/fmtUser's own
null guard.
mcp__matrix__send_message now has a specific fmtToolUse case and no
longer falls through to fmtArgsGeneric. Update the prose to reflect
that common tools have specific cases.
Root contexts (systemd services running as root, PID 1) default to
store=auto which resolves to the LOCAL nix store — bypassing the host
daemon, its remote builders (muede-pc2), and any prebuilt derivation
outputs already in the shared store. This causes spurious full
rebuilds of agent toplevels that the host already built and cached.
Two changes:
harness-base.nix:
- Add systemd.globalEnvironment.NIX_REMOTE = "daemon" — sets
DefaultEnvironment in systemd.conf so every unit in the container
inherits NIX_REMOTE=daemon. Non-root contexts already default to
the daemon socket; this only matters for root services that would
otherwise use the local store.
- Add NIX_REMOTE = "daemon" to environment.variables so interactive
shells also have it set (redundant with /etc/profile.d/nix-daemon.sh
but explicit and profile-agnostic).
hive-c0re.nix (hive-priv service):
- Add NIX_REMOTE = "daemon" to the service environment. hive-priv
runs as root and invokes nixos-container update + nix prebuild; these
must route through the host daemon so they see the shared store and
remote builders, not a private local store.
The sandbox-fallback = true in harness-base.nix is kept as a belt-
and-suspenders fallback but becomes a no-op for the common case once
nix routes through the daemon (the daemon builds on the host where
sandboxing works).
ProtectSystem=full makes /usr, /etc, and /boot read-only. Safe for
hive-c0re because it never writes to those paths directly:
- /etc writes (e.g. /etc/nixos-containers) go through hive-priv
- /etc/hyperhive/serve.json reads are read-only
- All runtime writes go to StateDirectory (/var/lib/hyperhive) and
RuntimeDirectory (/run/hyperhive), which remain writable under full
ProtectSystem=strict (everything read-only) is still deferred — it
requires auditing ReadWritePaths for every nix path c0re touches.
RestrictAddressFamilies deferred pending a watched deploy.
Also tightens the comment block to not mention a numbered issue.
hive-c0re runs as the unprivileged hive-core user and delegates all
privileged operations to hive-priv via a Unix socket. Add the subset of
systemd sandboxing directives that are provably safe without a watched
deploy (no ProtectSystem / RestrictAddressFamilies, which require mapping
the full set of filesystem/network paths first):
- NoNewPrivileges: already unprivileged; no setuid/capability escalation
- PrivateTmp: nix subprocesses use StateDirectory temp paths, not /tmp
- ProtectHome: HOME is /var/lib/hyperhive (StateDirectory), not /home/*
- ProtectKernelTunables: no sysctl writes needed
- ProtectKernelLogs: logs via systemd-journal group, not /dev/kmsg
- ProtectControlGroups: cgroup writes go through hive-priv, not c0re
- RestrictNamespaces: namespace creation goes through hive-priv
- LockPersonality: no personality changes needed
- RestrictRealtime: no real-time scheduling
Follows the same pattern as hive-priv (PrivateTmp + ProtectHome already
present there). Deferred: ProtectSystem=strict + ReadWritePaths +
RestrictAddressFamilies — those need a watched deploy per the #1845 plan
since getting the ReadWritePaths wrong silently breaks runtime I/O.
Previously, serveConfig was a pkgs.writeText store path embedded in
ExecStart. Any repo edit (gateway.nix, frontend, unrelated nix modules)
changes hyperhiveFlakeSource → serveConfig hash → ExecStart → systemd
restarts hive-c0re → StartupSweep → every agent rebuilt unnecessarily.
Fix: write the JSON to /etc/hyperhive/serve.json via environment.etc
(a managed /etc symlink to the store-path content). ExecStart now
references the stable /etc path, changing only when cfg.package (the
hive-c0re binary) changes. Unrelated module edits no longer bounce c0re
or trigger a cascade agent rebuild.
hive-c0re still restarts — and triggers the sweep — when its binary
changes, which is the correct invariant: a new release legitimately
needs to resync all agents with updated harness modules.
`mcp__hyperhive__remind` calls previously rendered as the generic
`fmtArgsGeneric` output — with a multi-field input that showed
`message: "..." · delay_seconds: 300`, burying the message after
a verbose field name.
New format: `remind* +5m "check on PR..."` (or `at HH:MMZ` for
absolute timestamps). The timing renders first so it's scannable
at a glance, followed by the first 60 chars of the message body.
Works for all three input shapes: delay_seconds, at_unix_timestamp,
and file_path-only (shows the path as the preview).
After the SW4RM and Y3R C4LL extractions from tabs.js (PRs merged
earlier), several docs still pointed at `assets/tabs.js::fn`. Update
them to the authoritative module:
- dashboard.md: renderContainers, buildAgentTree → swarm.js
renderApprovals → call.js
renderPeerHives → swarm.js
- shape.md: generic "tabs.js render function" → "domain module"
- conventions.md: clarify async-form listener lives in tabs.js (dashboard)
AND app.js (per-agent UI)
Several MCP tools appeared with the generic wrench icon (🔧) making
them hard to identify in the scrollback. fmtToolUse also lacked
specific formatters for some frequently-used tools, falling through
to fmtArgsGeneric.
Icons added:
- ack_until → ✅ (mark-as-read semantics)
- get_logs → 📜 (log viewer)
- get_host_journal → 📜 (journal reader)
fmtToolUse cases added:
- ack_until → "ack_until* ≤N" (message-id bound)
- get_logs → "get_logs* <agent> [NL]"
- get_host_journal → "get_host_journal* <container|unit> [/grep/] [NL]"
- restart/start/update → "restart* <name>" etc. (previously used
fmtArgsGeneric; now match kill's pattern)
Closes#2188.
The renderer dispatch section was missing entries for three system
subtypes that now have specific renderers (added in the preceding
commits on this branch). Update the row taxonomy table and the
numbered dispatch description to cover all four system-subtype
handlers (thinking_tokens was already documented; 1b–1e are new).
