27932ec631
One list, in nix/reserved-names.nix, handed to everything that needs it as HIVE_RESERVED_NAMES. Keeping it current becomes a config change rather than a rebuild, and hive names and agent names -- one namespace going forward -- are checked against the same file: swarm-otel.nix's hand-written reservedOwners is gone. Whitespace-separated rather than JSON, deliberately, unlike the structured env vars beside it. Every entry is an Ident ([a-z0-9-]), so whitespace cannot occur inside a name and the encoding is provably lossless; JSON would mean either a parser dependency in a crate whose purpose is to have none, or a copy of the parse in every consumer. An UNSET variable is not "nothing is reserved". Both creation sites log an error and return a warning saying the check did not run, so a misconfigured deployment says so instead of silently accepting every name. A blank value folds into unset: nix always renders a non-empty list, so present-but-empty is a rendering fault, not a declaration. Two guards whose subject moved out of their own file now assert their own case is still in it, because a guard that can be retired by an edit elsewhere is not a guard: - swarm-otel.nix asserts reserved-names.nix still contains its swarmTierName. - hive-sh4re's sentinel drift test PANICS when the variable is missing rather than skipping -- a drift test that quietly does nothing still reports green. checks.nix and devshell.nix both export it so CI and a local cargo test agree. Verified as a pair: with the variable set, 8 tests pass; with it unset, exactly the 4 drift tests fail and the unrelated ones still pass.
67 lines
3.2 KiB
Nix
67 lines
3.2 KiB
Nix
# The one blacklist: names no agent and no hive may take.
|
|
#
|
|
# Nix owns this list and hands it to the Rust side as an environment variable
|
|
# (`HIVE_RESERVED_NAMES`), so keeping it current is a config change rather than
|
|
# a rebuild of a binary. Read by:
|
|
#
|
|
# - `host-modules/hive-c0re/environment.nix` -> the env var, for the
|
|
# `request_init_config` path every hive uses
|
|
# - `host-modules/swarm-controller.nix` -> the same var, for the
|
|
# swarm-level `create_agent` path
|
|
# - `host-modules/swarm-otel.nix` -> its `<owner>` assertion, so
|
|
# a hive name and an agent name are checked against ONE list
|
|
# - `nix/checks.nix` -> exported into `cargo test`,
|
|
# which is what keeps the message layer's sentinels from drifting away
|
|
# from this file
|
|
#
|
|
# A plain nix file rather than a module option because two of those readers are
|
|
# flake-level (`checks.nix`) and cannot see a NixOS option.
|
|
#
|
|
# ⚠️ Agent names and hive names are ONE namespace going forward (mara, 2026-08-27:
|
|
# "agent and hive names live in the swarm level going forward"). Adding a name
|
|
# here forbids it for both. That is the point: two lists is how they drift.
|
|
#
|
|
# ⚠️ Every entry must be a value some component actually PRODUCES as a message
|
|
# `from`/`to`, or a component name the collector builds pipelines from — not a
|
|
# word that merely looked risky. A name in here that nothing emits is a refusal
|
|
# with no failure behind it.
|
|
[
|
|
# ---- message-layer senders -------------------------------------------
|
|
# The human at the dashboard: a broker recipient (the T4LK box sends
|
|
# `{from: "operator", ...}`) and the fallback attribution for an answered
|
|
# question.
|
|
"operator"
|
|
# Helper events (`approval_resolved`, `container_crash`, ...) — the sender an
|
|
# agent is told to treat as hyperhive itself rather than as a peer.
|
|
# `hive_sh4re::manager::SYSTEM_SENDER`.
|
|
"system"
|
|
# A due self-scheduled reminder arrives as its own sender, so a wake I asked
|
|
# for last week is distinguishable from a peer message.
|
|
"reminder"
|
|
# Forge notification wakes, delivered by the notify daemon.
|
|
"forge"
|
|
# A scheduled prompt firing, pushed as a trusted sender.
|
|
"scheduled"
|
|
# Three synthetic wakes the harness itself produces: an in-container todo,
|
|
# the follow-up turn after a self-requested compaction, and the single flush
|
|
# turn before a graceful stop.
|
|
"todo"
|
|
"compact"
|
|
"graceful-stop"
|
|
|
|
# ---- swarm-tier component owners -------------------------------------
|
|
# The swarm collector names its components `<kind>/<owner>` and uses the hive
|
|
# name as the owner, so a hive called `swarm` would silently replace the
|
|
# swarm tier's own pipelines and lose its own — it would keep accepting
|
|
# pushes into a pipeline that routes nowhere. Previously enforced only
|
|
# against hive names, in `swarm-otel.nix`'s own `reservedOwners`.
|
|
"swarm"
|
|
]
|
|
# Deliberately absent, and both are load-bearing omissions:
|
|
#
|
|
# `<parent>` / `<children>` — routing recipients the ident charset already
|
|
# rejects, so no name can ever equal them; listing them would imply a guard
|
|
# that never fires.
|
|
#
|
|
# `ruth` — a real agent, not a literal. A second agent wanting that name is a
|
|
# name that is TAKEN, which the roster answers, not this list.
|