Watch

History

Repository files (latest commit first)
Filename	Latest commit message	Latest commit date
atlas 3202cde704 nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable `services.hyperhive.enable` and `services.hyperhive.c0re.enable` are gone. One switch, `services.hyperhive.deploy.hive-controller.enable` (default false, as the old toggle was), now gates hive-c0re and hive-priv. Both old paths are `mkRenamedOptionModule` shims in deploy.nix, so a host config that still sets either evaluates as before and gets a rename warning. Every other read of the old toggle is resolved, including the 29 made through the `hyperhiveCfg`/`hiveCfg` aliases: - Dropped: each swarm service and its glue keeps only its own deploy toggle (authelia, bao and its PKI glue, grafana, victorialogs, victoriametrics, the secret publisher, swarm-ca, the OIDC client rows, the controller/nats/matrix-ctl/publisher/services-issuer identities), the forge, and the `domain` deprecation warning. - To deploy.hive-controller.enable: the queue-agent credential reader and its assertion, which feed hive-c0re and write under its state dir, plus their policy-order entry; the network identity assertions; hive-tls's two writes into hive-c0re's environment. - hive-tls runs where the gateway runs self-signed (`gateway.enable && useSelfSigned`), not on every host. - The matrix appservice-token reader and its assertion stay on `deploy.matrix.enable` plus their client-identity checks. They read deploy.matrix's token file and registration script; their deploy.bao inputs are the client-half options a hive sets to read a store it does not run, so gating on deploy.bao.enable would drop the tested remote-reader case. - The `hiveName` assertion moves from hive-network.nix to hyperhive.nix and fires wherever the hive, the store or the homeserver runs: each turns the name into an identifier with no fallback. On a host with `deploy.allSwarmServices` and no hive, the documented services-host recipe, authelia, bao, grafana, victorialogs, victoriametrics, the OIDC client rows and the hive CA now render; before, the old toggle being off left them out. Refs #4500		2026-09-26 01:19:49 +02:00
..
agent-lifecycle	docs: agents' matrix accounts come from the swarm	2026-09-25 08:31:01 +02:00
crates	check-issue-refs: catch full forge issue URLs too, drop internal links from docs entirely	2026-09-09 21:15:28 +02:00
getting-started	docs: agents' matrix accounts come from the swarm	2026-09-25 08:31:01 +02:00
integrations	swarm-controller: own the swarm-wide forge objects; hive-c0re stops creating them	2026-09-25 08:36:05 +02:00
networking	nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable	2026-09-26 01:19:49 +02:00
process	agents: pull the forge token from bao; drop tea-login	2026-09-24 17:48:53 +02:00
scheduler	swarm-controller: own the swarm-wide forge objects; hive-c0re stops creating them	2026-09-25 08:36:05 +02:00
swarm	nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable	2026-09-26 01:19:49 +02:00
tools	docs: agents' matrix accounts come from the swarm	2026-09-25 08:31:01 +02:00
trust-boundary	docs: the swarm mints agent forge tokens; hive-c0re and tea-login no longer do	2026-09-24 17:48:53 +02:00
turn-loop	agents: pull the forge token from bao; drop tea-login	2026-09-24 17:48:53 +02:00
web-ui	docs: describe the flat container list, not a dormant tree	2026-09-21 22:56:56 +02:00
README.md	docs: retire the agent hierarchy from every page that described it	2026-09-21 22:08:47 +02:00

README.md

hyperhive docs

Depth reference for hyperhive — the substrate, not the pitch (that's the top-level README / website). Every page here stands alone; pick the one matching your task rather than reading top to bottom. For the autogenerated NixOS options reference (every services.hyperhive.* / hyperhive.* option, host and agent), see the options site instead — this tree is prose, that one's generated straight from the module declarations.

Getting started

Bringing a fresh hive online? → getting-started/setup.md (first-run hivectl bootstrap).
What does the dashboard look like, and how do I use it? → web-ui/ — the operator-facing starting point; its own sub-pages (shape, dashboard, agent, css-vars, terminal-rendering) go deeper into implementation.
What tools does an agent (or the operator) have available? → tools/ — hivectl (yours) plus every agent's MCP tool surface (bash, forge, lifecycle, matrix, scheduling).

Agent lifecycle

How do config changes flow from manager to operator to container? → agent-lifecycle/approvals.md (approval kinds, approval state machine, flake.lock validation).
What state survives destroy / purge / restart? → agent-lifecycle/persistence.md.
Who can do what to whom — the agent roster and privilege? → agent-lifecycle/agent-hierarchy.md.
How does claude get its prompt, and what tools does it have? → turn-loop/ — the loop, binary shape, turn outcomes; sub-pages: claude-invocation, config, mcp.

Trust boundary & security

What's the operator/agent trust boundary? What's a capability? → trust-boundary/boundary.md.
Agent trust model, prompt-injection threat model, credential isolation? → trust-boundary/security.md.

Accounts & integrations

How do per-agent forge accounts work? What does forge_notify poll, and how does it format wake messages? → integrations/forge.md (the hive's own Forgejo); tools/forge.md for the hive-forge CLI verbs agents actually call.
How does the matrix-tuwunel container work? Multiple accounts per agent? → integrations/matrix.md (the homeserver); tools/matrix.md for the MCP tool surface and services.hyperhive.agent.matrixAccounts.
How do I give an agent a GitHub account (gh + git push)? how's the PAT injected? → integrations/github.md (operator content up top; the gh/git-push + notification-poller mechanics are in a collapsed "Implementation" section at the bottom).
What's /knowledge? How does the hive-wide knowledge repo sync, and how do I contribute a document? → integrations/knowledge.md.
What does hivectl do? Provisioning, gateway users, container shells? → tools/hivectl.md (the curated guide); tools/hivectl-cli.md for the exhaustive, autogenerated flag reference.

Networking & swarms

What nginx vhosts does the gateway serve? How does matrix discovery work? → networking/gateway.md.
How does DNS resolution work in agent containers? What's the bridge network for? → networking/network.md.
How do I connect two hives into a swarm? → swarm/ (peer hives, TLS trust).
Where do agent snapshots go? How does the swarm's btrfs receive endpoint authenticate a pushing hive? → networking/snapshot-store.md.
Who mints each credential, who reads it, and how does it rotate — and where's that shape headed? → swarm/credentials.md (current state, target state, and the progressive-enhancement rule); swarm/secrets.md for where each file lives today.

Scheduler, CI, observability

what's the job queue, as a general idea (not hive-c0re specifics)? → scheduler/jobq.md — operator-facing, no implementation detail.
How does the rebuild queue work? What are the concrete step kinds, queue sources, scheduler internals? → scheduler/coordinator.md.
How does the CI runner work? What's the autoregistration flow? → scheduler/ci.md.
How do I export Claude Code metrics (tokens, cost, tool calls) to Prometheus/Grafana? → scheduler/observability.md.

Crate reference

What does a specific Rust crate do, on its own terms? → crates/ — every workspace crate's own README.md, one level up from source; the crate itself is still the source of truth, this is just a walkable mirror.

Process & conventions

Naming, commit style, wire protocol, the data-async pattern? → process/conventions.md.
Why does the nspawn flag look like that? → process/gotchas.md (bind mounts, conf flags, other NixOS/nspawn quirks).
What does a PR review verdict actually gate? → process/pr-review-gate.md.