353cdd9264
hive-c0re stats the two files `swarm-bao-queue-agent` lands and forwards them into every agent container as systemd credentials, and the harness resolves a `QueueConfig` out of them at boot. Nothing connects yet. A credential and not a bind mount, and the mode is what forces it: the secret is root:0600 and the harness runs as the unprivileged agent user, so a bind would deliver a file that user cannot open. nspawn's `--load-credential` is read by the container manager as root and re-exposed under the consuming unit's own `User=`. hive-c0re never reads the bytes either way, which is just as well — it runs as `hive-core`. Absent files stay legal and become visible rather than silent: the publisher lives on the authelia host and mints on its first boot, so "nothing at that path" is the ordinary early state of a swarm. c0re forwards nothing and logs why; the harness logs that it has no queue. The client id comes out of the delivered file rather than being rebuilt from `hiveName` in nix, which is the agreement `swarm-secret-client` states. `QueueConfig::from_env` wants it as a value, so the harness reads the file itself — assigning the variable instead would need `std::env::set_var` in a process that has already spawned threads. Refs #3805
50 lines
1.4 KiB
TOML
50 lines
1.4 KiB
TOML
[package]
|
|
name = "hive-agent"
|
|
edition.workspace = true
|
|
version.workspace = true
|
|
readme = "README.md"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
anyhow.workspace = true
|
|
axum.workspace = true
|
|
chrono.workspace = true
|
|
reqwest.workspace = true
|
|
hyper.workspace = true
|
|
hyper-util.workspace = true
|
|
http-body-util.workspace = true
|
|
futures-util = "0.3"
|
|
clap.workspace = true
|
|
hive-claude.workspace = true
|
|
hive-agent-sock.workspace = true
|
|
hive-core-agent-sock.workspace = true
|
|
hive-sh4re.workspace = true
|
|
hive-sock-client.workspace = true
|
|
libc.workspace = true
|
|
opentelemetry.workspace = true
|
|
opentelemetry_sdk.workspace = true
|
|
opentelemetry-otlp.workspace = true
|
|
rmcp.workspace = true
|
|
rusqlite.workspace = true
|
|
schemars.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
# Bare: `kv`/`notices` name buckets and streams this harness opens neither
|
|
# end of. All it wants from the crate is `QueueConfig` and, next, a connect.
|
|
swarm-queue-client.workspace = true
|
|
tokio.workspace = true
|
|
tokio-stream.workspace = true
|
|
tower-http.workspace = true
|
|
tracing.workspace = true
|
|
tracing-subscriber.workspace = true
|
|
|
|
[dev-dependencies]
|
|
tempfile = "3"
|
|
|
|
# Single harness serve-loop binary: `hive-agent` (from `src/main.rs`).
|
|
# The sibling MCP server is its own bin crate now (`hive-agent-mcp`).
|
|
# Privilege boundary is enforced server-side at the socket (tool
|
|
# groups / manager surface).
|
|
# See `docs/turn-loop/README.md::Harness binary shape`.
|