atlas
91fdf96a67
docs: drop harness systemd settings; swarm-nats-auth: refuse the hive's shared agent client ...
Docs (review on #4948 ): the harness's restart settings are not useful to
a reader, so the `Restart`/`RestartSec` bullet in docs/turn-loop and the
"30 seconds later, no start limit" wording in docs/swarm are removed.
What stays is the behaviour: the harness exits and comes back until the
queue accepts it.
Grant: with the harness's shared-client fallback gone, nothing presents
the hive's shared agent client (`hive-<hive>-agent`) to the queue;
swarm-logs uses that OIDC client over HTTP only. swarm-nats-auth now
refuses it outright instead of granting the configured
`$SWARM.term.{hive}.>` / `$SWARM.agent-state.{hive}.>` publish and its
`_INBOX.client.<id>.>` subscribe, so an agent holding it can no longer
publish as a sibling. The agent arm still runs before the hive arm, so
that id never falls through to its hive's grant.
Removed with it: the `--agent-publish-subject` flag and its two uses in
swarm-nats.nix, `Policy`'s agent subject list, and
swarm-queue-client's `client_inbox_prefix`. The module-eval now asserts
the flag is absent; the policy tests assert the refusal and that the
hive itself is still admitted.
2026-10-04 22:24:51 +02:00
forge: external forge accounts live in swarm bao; the agent fetches them itself
2026-10-01 18:05:33 +02:00
github swarm bao: address argus review on #4892
2026-10-02 17:54:45 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
hive-matrix-mcp: read the main account's token from the store too
2026-09-25 08:31:01 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
hive-agent: the swarm queue connection is required; retry, then exit
2026-10-04 22:24:51 +02:00
module-eval: pin a claude agent's subagent store identity
2026-10-03 01:34:01 +02:00
hive-priv: create agent socket dirs on start; drop hyperhive-agents.conf
2026-09-27 18:55:33 +02:00
bao: serve the browser UI to admins via a loopback-only listener
2026-09-28 19:31:02 +02:00
ops: update option pointer after hive-matrix split
2026-10-01 13:00:25 +02:00
hive-tls: issue the gateway leaf from bao with a per-hive identity
2026-10-04 19:45:14 +02:00
swarm-otel: ship the whole host journal, drop user sessions after it
2026-09-30 23:01:49 +02:00
swarm-otel: ship the whole host journal, drop user sessions after it
2026-09-30 23:01:49 +02:00
swarm options: no swarm.* value depends on a deploy option or this host's hive
2026-10-04 18:13:47 +02:00
hive-forge: a first authelia login creates the forge account
2026-09-25 08:29:56 +02:00
swarm-bao: stamp collector's service.name as "bao"
2026-09-25 08:30:25 +02:00
swarm-bao: give the store's collector an explicit self-telemetry port
2026-09-23 18:04:33 +02:00
hive-gateway: no hive-domain vhost on a host without a hive
2026-10-04 19:45:14 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
matrix apiUrl: default to https on the gateway vhost
2026-10-04 18:31:24 +02:00
hive-tls: issue the gateway leaf from bao with a per-hive identity
2026-10-04 19:45:14 +02:00
docs: drop harness systemd settings; swarm-nats-auth: refuse the hive's shared agent client
2026-10-04 22:24:51 +02:00
swarm-controller: read the queue client secret from the store, drop the file
2026-09-28 19:01:05 +02:00
bao: OIDC login to the browser UI via authelia, as a metadata-only viewer
2026-09-28 19:56:38 +02:00
swarm-otel: ship the whole host journal, drop user sessions after it
2026-09-30 23:01:49 +02:00
swarm-bao: refuse a remote reader that named seven of the eight leaves
2026-09-23 10:11:42 +02:00
hive-gateway: no hive-domain vhost on a host without a hive
2026-10-04 19:45:14 +02:00
91fdf96a67