hive-c0re/src/auto_update.rs

@@ -164,33 +164,12 @@ pub async fn rebuild_agent(
     result
 }
 
-/// Whether this hive is "ruthless" — running with no root/manager agent at
-/// all (no ruth). When true, hive-c0re skips the root-agent create/start
-/// sweep entirely. Controlled by the host option
-/// `services.hyperhive.ruthless`, threaded in via the `HYPERHIVE_RUTHLESS`
-/// env var. Defaults to `false` when the var is unset (back-compat: the
-/// root agent was always auto-managed before this opt-out existed); only
-/// an explicit `true` / `1` / `yes` enables ruthless mode.
-fn ruthless() -> bool {
-    match std::env::var("HYPERHIVE_RUTHLESS") {
-        Ok(v) => matches!(v.trim().to_ascii_lowercase().as_str(), "true" | "1" | "yes"),
-        Err(_) => false,
-    }
-}
-
 /// Auto-create the manager container on startup if it isn't already there.
 /// hive-c0re manages the manager end-to-end: operators no longer declare
 /// `containers.h-ruth` in their host NixOS config. Bypasses the approval
-/// queue — the root/manager is auto-managed by default. Operators who
+/// queue — the root/manager is auto-managed by default (an operator opt-out
-/// don't want a root agent at all set `services.hyperhive.ruthless = true`,
+/// is a separate host setting). Idempotent.
-/// which short-circuits this whole function. Idempotent.
 pub async fn ensure_root_agent(coord: &Arc<Coordinator>) -> Result<()> {
-    if ruthless() {
-        tracing::info!(
-            "ruthless mode (services.hyperhive.ruthless = true) - skipping root agent create/start"
-        );
-        return Ok(());
-    }
     let existing = lifecycle::list().await.unwrap_or_default();
     let current_rev = current_flake_rev(&coord.hyperhive_flake);
     if existing
@@ -222,10 +201,9 @@ pub async fn ensure_root_agent(coord: &Arc<Coordinator>) -> Result<()> {
         // install) is brought back up here: the startup sweep's rebuild only
         // restarts a container that was already running, so without this it
         // stays down until a manual `nixos-container start`. The sub-agent
-        // `was_running` guard is intentionally left untouched. (Operators
+        // `was_running` guard is intentionally left untouched. (An operator
-        // opt out of this whole auto-management with
+        // opt-out of this whole auto-management is tracked as a separate
-        // `services.hyperhive.ruthless = true`, gated at the top of
+        // host setting.)
-        // this function.)
         if !lifecycle::is_running(MANAGER_NAME).await {
             tracing::info!("manager container present but not running — starting");
             if let Err(e) = lifecycle::start(MANAGER_NAME).await {

nix/modules/hive-c0re.nix

@@ -187,25 +187,6 @@ in
     '';
   };
 
-  # Whether this hive runs "ruthless" — with no root/manager agent at all.
-  # When true, hive-c0re skips the root-agent auto-management sweep (create
-  # if missing, restart if present-but-stopped). Some hives don't want a
-  # root agent at all — see issue tracker "scope concept: special agents".
-  options.services.hyperhive.ruthless = lib.mkOption {
-    type = lib.types.bool;
-    default = false;
-    example = true;
-    description = ''
-      Run this hive "ruthless" — with no root (manager) agent at all (no
-      ruth). When `true`, hive-c0re skips the root-agent auto-management
-      sweep entirely (it otherwise creates the root agent's container when
-      missing and restarts it when present but stopped). Defaults to
-      `false` (the historical behaviour — the root agent is auto-managed
-      as required infrastructure). Exposed to hive-c0re as
-      `HYPERHIVE_RUTHLESS`.
-    '';
-  };
-
   # Hive-wide OTEL stats export. Set ONCE here at host level; the
   # meta-flake renderer (`hive-c0re/src/meta.rs::otel_config`) reads the
   # HYPERHIVE_OTEL_* env exported below off hive-c0re's unit and injects
@@ -892,10 +873,6 @@ in
         # prompts). `hive_sh4re::assets::*` reads paths underneath.
         # `forge.rs` reads the avatar PNGs from here on startup.
         HIVE_ASSETS_DIR = "${cfg.assets}/share/hyperhive";
-        # Whether this hive runs ruthless — no root/manager agent at all
-        # (`auto_update::ensure_root_agent`). Default false = historical
-        # behaviour (root auto-managed); true makes the sweep a no-op.
-        HYPERHIVE_RUTHLESS = lib.boolToString config.services.hyperhive.ruthless;
       }
       // lib.optionalAttrs (config.services.hyperhive.domain != null) {
         # Identity env vars threaded into c0re's own service env and