vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
2,112 commits 1 branch 0 tags 15 MiB
Commit graph hyperhive/docs/security.md
Author SHA1 Message Date
iris
80c33f5108 docs(security): drop redundant bootstrap-container allowlist entry 
The hive-priv container allowlist's explicit MANAGER_NAME allow is
redundant — the bootstrap container's name passes the generic
agent-name char validation anyway. Describe the allowlist as just the
agent-name convention + the sibling service containers.
 2026-06-23 14:48:10 +02:00
iris
ec5c7d49c4 docs: reframe stale 'the manager' as the root/bootstrap container (infra + web-ui) 
Port-range, network-isolation, state-dir, web-UI-port, priv allowlist,
and rebuild-source mentions now refer to the root/bootstrap container
rather than 'the manager' — no structural manager exists (root-ness is
topological). Real artifact names (the manager.nix template toplevel,
/run/hyperhive/manager/mcp.sock) are left as-is.
 2026-06-23 14:48:10 +02:00
iris
09e2ad326c fix: update PrivRequest table to match actual hive-sh4re::priv_proto variants 
Replace stale AddBindMount/RemoveBindMount/SetNetworkIsolation/ReloadGateway
entries with the actual current variants from hive-sh4re/src/priv_proto.rs:

- WriteNspawnFlags (replaces AddBindMount/RemoveBindMount/SetNetworkIsolation)
- WriteResourceLimits (new)
- RemoveServiceDropin (new)
- DaemonReload (new)
- ChownSocketDir / ChmodSocketDir (new)
- RunForgeAdmin (new)
- RestartMatrixDaemon (new)
- ReloadGatewayNginx (renamed from ReloadGateway)
 2026-06-05 18:40:44 +02:00
iris
28df69286d docs(security): document hive-priv privilege separation model 2026-06-05 18:40:44 +02:00
damocles
42fe3965de docs: move dashboard.rs security + bind rationale to docs (#715) 2026-06-01 11:38:42 +02:00
iris
5ca96b8c85 docs: scrub self-ref cookies across 5 files (#719 batch 2) 
All five files scrubbed to 0 issue-ref cookies. Most refs were
'(closes #NNN)' style attribution after closed work landed.

- docs/turn-loop.md: 6 → 0 (#598 unified binary, #419 auth-fail,
  #542 mtime resumption, #519 role markers, #442 spawn path,
  #474/#478 partial edit)
- docs/approvals.md: 5 → 0 (#317 flake validation, #250 withdraw,
  #441 rebuild-queue dispatch, #753 manager port hash, #425
  crash-watch grace)
- docs/terminal-rendering.md: 2 → 0 (#666 ask-operator inline)
- docs/conventions.md: 3 → 0 (#753 port hash, #692 parent
  sentinel, #486 reparenting)
- docs/security.md: 4 → 0 (#240 + #658 ×2 + #673/#678 attribution)

Combined with PR #810 (docs/web-ui.md 14→0), this PR closes the
small / medium files. Remaining: agent-hierarchy.md (13),
gotchas.md (13), persistence.md (13). gateway.md is atlas's lane.
 2026-05-31 15:39:09 +02:00
damocles
fcb5fae345 docs: catch up post-#658/#604/#660 + add operator hivectl section (#124) 2026-05-31 10:13:33 +02:00
damocles
6ca72074c4 docs: move sandbox threat model to docs/security.md, add code reference 2026-05-22 12:28:04 +02:00