# Words no HIVE name may CONTAIN. The substring half of `./reserved-names.nix`.
#
# Separate because the two differ in every dimension: subject (hive names only
# vs hive AND agent), matcher (substring vs equality), and admission rule (a
# fixed segment of a COMPOSED identifier vs a value some component emits).
# Folding them would widen the other one — containment over `forge` refuses
# `forgeworks`, which names no failure.
[
  # `hive-<name>` — every hive's OIDC client id, and the string the queue's
  # auth-callout responder strips to decide which hive a connection is.
  "hive"
  # `hive-<name>-agent` — the client its agent containers present. A hive named
  # `foo-agent` mints exactly the id hive `foo`'s agents do.
  "agent"
  # Also an exact-match entry next door, for the collector's `<kind>/<owner>`
  # components. Here because it is the word this swarm composes identifiers
  # from everywhere.
  "swarm"
]