feat(#2006): rename manageRootAgent option to ruthless (invert sense)

hive-c0re/src/auto_update.rs

@@ -164,12 +164,33 @@ pub async fn rebuild_agent(
     result
 }
 
+/// Whether this hive is "ruthless" — running with no root/manager agent at
+/// all (no ruth). When true, hive-c0re skips the root-agent create/start
+/// sweep entirely. Controlled by the host option
+/// `services.hyperhive.ruthless`, threaded in via the `HYPERHIVE_RUTHLESS`
+/// env var. Defaults to `false` when the var is unset (back-compat: the
+/// root agent was always auto-managed before this opt-out existed); only
+/// an explicit `true` / `1` / `yes` enables ruthless mode.
+fn ruthless() -> bool {
+    match std::env::var("HYPERHIVE_RUTHLESS") {
+        Ok(v) => matches!(v.trim().to_ascii_lowercase().as_str(), "true" | "1" | "yes"),
+        Err(_) => false,
+    }
+}
+
 /// Auto-create the manager container on startup if it isn't already there.
 /// hive-c0re manages the manager end-to-end: operators no longer declare
 /// `containers.h-ruth` in their host NixOS config. Bypasses the approval
-/// queue — the root/manager is auto-managed by default (an operator opt-out
-/// is a separate host setting). Idempotent.
+/// queue — the root/manager is auto-managed by default. Operators who
+/// don't want a root agent at all set `services.hyperhive.ruthless = true`,
+/// which short-circuits this whole function. Idempotent.
 pub async fn ensure_root_agent(coord: &Arc<Coordinator>) -> Result<()> {
+    if ruthless() {
+        tracing::info!(
+            "ruthless mode (services.hyperhive.ruthless = true) - skipping root agent create/start"
+        );
+        return Ok(());
+    }
     let existing = lifecycle::list().await.unwrap_or_default();
     let current_rev = current_flake_rev(&coord.hyperhive_flake);
     if existing
@@ -201,9 +222,10 @@ pub async fn ensure_root_agent(coord: &Arc<Coordinator>) -> Result<()> {
         // install) is brought back up here: the startup sweep's rebuild only
         // restarts a container that was already running, so without this it
         // stays down until a manual `nixos-container start`. The sub-agent
-        // `was_running` guard is intentionally left untouched. (An operator
-        // opt-out of this whole auto-management is tracked as a separate
-        // host setting.)
+        // `was_running` guard is intentionally left untouched. (Operators
+        // opt out of this whole auto-management with
+        // `services.hyperhive.ruthless = true`, gated at the top of
+        // this function.)
         if !lifecycle::is_running(MANAGER_NAME).await {
             tracing::info!("manager container present but not running — starting");
             if let Err(e) = lifecycle::start(MANAGER_NAME).await {

nix/modules/hive-c0re.nix

@@ -187,6 +187,25 @@ in
     '';
   };
 
+  # Whether this hive runs "ruthless" — with no root/manager agent at all.
+  # When true, hive-c0re skips the root-agent auto-management sweep (create
+  # if missing, restart if present-but-stopped). Some hives don't want a
+  # root agent at all — see issue tracker "scope concept: special agents".
+  options.services.hyperhive.ruthless = lib.mkOption {
+    type = lib.types.bool;
+    default = false;
+    example = true;
+    description = ''
+      Run this hive "ruthless" — with no root (manager) agent at all (no
+      ruth). When `true`, hive-c0re skips the root-agent auto-management
+      sweep entirely (it otherwise creates the root agent's container when
+      missing and restarts it when present but stopped). Defaults to
+      `false` (the historical behaviour — the root agent is auto-managed
+      as required infrastructure). Exposed to hive-c0re as
+      `HYPERHIVE_RUTHLESS`.
+    '';
+  };
+
   # Hive-wide OTEL stats export. Set ONCE here at host level; the
   # meta-flake renderer (`hive-c0re/src/meta.rs::otel_config`) reads the
   # HYPERHIVE_OTEL_* env exported below off hive-c0re's unit and injects
@@ -873,6 +892,10 @@ in
         # prompts). `hive_sh4re::assets::*` reads paths underneath.
         # `forge.rs` reads the avatar PNGs from here on startup.
         HIVE_ASSETS_DIR = "${cfg.assets}/share/hyperhive";
+        # Whether this hive runs ruthless — no root/manager agent at all
+        # (`auto_update::ensure_root_agent`). Default false = historical
+        # behaviour (root auto-managed); true makes the sweep a no-op.
+        HYPERHIVE_RUTHLESS = lib.boolToString config.services.hyperhive.ruthless;
       }
       // lib.optionalAttrs (config.services.hyperhive.domain != null) {
         # Identity env vars threaded into c0re's own service env and