.forgejo/workflows/ci.yml

@@ -1,7 +1,6 @@
 name: CI
 
 on:
-  # No `push` trigger, so nothing re-validates a merge commit on main — an accepted infra-load tradeoff mara signed off on, not an oversight.
   pull_request:
     branches: ["**"]
   # Lets `hive-forge ci-rerun` re-trigger CI via workflow-dispatch API

nix/host-modules/swarm-controller.nix

@@ -192,15 +192,6 @@ let
     SWARM_CONTROLLER_AUTH_BRIDGE_URL = deployCfg.swarm-controller.authBridgeUrl;
   };
 
-  # Swarm-wide default for `PUT .../matrix-accounts/{account}`'s own
-  # `homeserver` field, for a request that omits one. Same shape as
-  # `authBridgeEnv` above: genuinely optional, gated on the option
-  # resolving rather than assumed. Not read by anything yet — see the
-  # option's own description.
-  matrixHomeserverEnv = lib.optionalAttrs (deployCfg.swarm-controller.matrixHomeserverUrl != null) {
-    SWARM_CONTROLLER_MATRIX_HOMESERVER_URL = deployCfg.swarm-controller.matrixHomeserverUrl;
-  };
-
   # The swarm's own display name, for `GET /api/swarm` (swarm-ui's chrome).
   # Gated on the option resolving, not defaulted to an empty string: an
   # operator who never named the swarm gets `name: null` from the
@@ -529,24 +520,6 @@ in
       '';
     };
 
-    matrixHomeserverUrl = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      example = "https://matrix.example.org";
-      description = ''
-        Swarm-wide default homeserver for `PUT
-        .../matrix-accounts/{account}` requests that omit their own
-        `homeserver` — see that route's own doc comment
-        (`swarm-controller/src/matrix_account.rs`) for why the field is
-        optional in token mode and what omitting it currently resolves to.
-
-        `null` (the default) leaves that per-request resolution exactly as
-        it is today. **Not yet consulted by the route at all**: this option
-        only exists to carry the value in, ahead of the route being taught
-        to fall back to it.
-      '';
-    };
-
     baoClientCertFile = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
       default = null;
@@ -886,7 +859,6 @@ in
       // webhookEnv
       // authBridgeEnv
       // swarmNameEnv
-      // matrixHomeserverEnv
       // baoEnv
       // otelEnv;
     };

swarm-controller/src/main.rs

@@ -1621,22 +1621,6 @@ async fn main() -> Result<()> {
         }
     };
 
-    // Diagnostic only — `put_matrix_account` does not call this yet (see its
-    // own doc comment), so this cannot change any request's outcome. Logged
-    // so an operator can tell the config landed before the slice that
-    // consults it does.
-    if matrix_account::homeserver_or_configured_default(
-        None,
-        matrix_account::configured_default_homeserver(),
-    )
-    .is_none()
-    {
-        tracing::debug!(
-            "{}; matrix-account requests still need their own homeserver",
-            matrix_account::DEFAULT_HOMESERVER_ENV
-        );
-    }
-
     let config_prs = forge_client.clone().map(config_pr::spawn);
     let state_forge = keep_forge_for_state(forge_client, webhook_secret.clone());
 

swarm-controller/src/matrix_account.rs

@@ -35,41 +35,6 @@ fn default_mode() -> String {
     "token".to_owned()
 }
 
-/// Env var the controller's NixOS module sets from
-/// `services.hyperhive.deploy.swarm-controller.matrixHomeserverUrl` — the
-/// swarm-wide default `PutMatrixAccountRequest::homeserver` falls back to
-/// when a caller omits one. Read via [`configured_default_homeserver`], not
-/// directly — see that fn's doc.
-///
-/// Not yet consulted by [`put_matrix_account`]: `homeserver_or_configured_default`
-/// below exists for a later slice of this homeserver-default rollout to
-/// call; this one only wires the config through.
-pub(crate) const DEFAULT_HOMESERVER_ENV: &str = "SWARM_CONTROLLER_MATRIX_HOMESERVER_URL";
-
-/// `caller`'s own homeserver, or `default` when the caller left it unset.
-/// `caller` always wins — this only fills a gap it left, never replaces a
-/// value it gave.
-///
-/// Takes `default` as a plain parameter rather than reading
-/// [`DEFAULT_HOMESERVER_ENV`] itself: a caller wants that env read done once,
-/// at the edge (see [`configured_default_homeserver`]), and keeping this fn
-/// pure makes it testable without mutating shared process env — three tests
-/// doing exactly that raced each other under `cargo test`'s default
-/// parallelism in review.
-pub(crate) fn homeserver_or_configured_default(
-    caller: Option<String>,
-    default: Option<String>,
-) -> Option<String> {
-    caller.or(default)
-}
-
-/// Reads [`DEFAULT_HOMESERVER_ENV`] fresh each call — the one place this
-/// crate touches that env var, so [`homeserver_or_configured_default`] above
-/// can stay a pure function.
-pub(crate) fn configured_default_homeserver() -> Option<String> {
-    std::env::var(DEFAULT_HOMESERVER_ENV).ok()
-}
-
 /// The credential to store for one agent's external matrix account.
 ///
 /// No `Debug` derive — matching `hive-c0re::dashboard::matrix_accounts`'s
@@ -374,8 +339,8 @@ async fn matrix_password_login(
 #[cfg(test)]
 mod tests {
     use super::{
-        PutMatrixAccountRequest, homeserver_or_configured_default, is_reserved_account,
+        PutMatrixAccountRequest, is_reserved_account, password_fields, resolve_credential,
-        password_fields, resolve_credential, token_credential,
+        token_credential,
     };
 
     fn request(mode: &str) -> PutMatrixAccountRequest {
@@ -388,32 +353,6 @@ mod tests {
         }
     }
 
-    // `homeserver_or_configured_default` takes its default as a plain
-    // parameter rather than reading the env var itself, so these are pure
-    // — no process env mutation, and so no risk of racing each other (or
-    // any other test in the crate) under `cargo test`'s default parallelism.
-
-    #[test]
-    fn caller_supplied_homeserver_wins_even_with_a_default_configured() {
-        let result = homeserver_or_configured_default(
-            Some("https://caller.example.org".to_owned()),
-            Some("https://default.example.org".to_owned()),
-        );
-        assert_eq!(result.as_deref(), Some("https://caller.example.org"));
-    }
-
-    #[test]
-    fn falls_back_to_the_configured_default_when_the_caller_omits_one() {
-        let result =
-            homeserver_or_configured_default(None, Some("https://default.example.org".to_owned()));
-        assert_eq!(result.as_deref(), Some("https://default.example.org"));
-    }
-
-    #[test]
-    fn none_when_neither_caller_nor_default_is_set() {
-        assert_eq!(homeserver_or_configured_default(None, None), None);
-    }
-
     #[test]
     fn main_is_reserved_but_nothing_else_is() {
         assert!(is_reserved_account("main"));