iris
d39ad6c465
nix: the hive's leaf does not read every secret in the store ...
Six more comments and option descriptions across five modules said the hive's leaf or grant reads every secret in the store. It reads swarm/agents/* and swarm/hives/<hive>/* and nothing else, so they now say that, in the wording the clientCertFile option already used. Also the matrix-ctl check's label no longer calls the hive's leaf store-wide.
2026-10-12 01:37:46 +02:00
agents: swap the agent's bao leaf in with one rename
2026-10-11 10:00:43 +02:00
agents: swap the agent's bao leaf in with one rename
2026-10-11 10:00:43 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
module-eval: accept the agent's live bao pair as a store path
2026-10-11 10:00:43 +02:00
hive-bash-daemon: keep sibling tasks alive when one is OOM-killed
2026-10-07 18:18:15 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
agents: swap the agent's bao leaf in with one rename
2026-10-11 10:00:43 +02:00
agents: swap the agent's bao leaf in with one rename
2026-10-11 10:00:43 +02:00
module-eval: agent-user test asserts the heal_own_dir form
2026-10-09 11:30:30 +02:00
matrix: drop the per-hive appservice and its unused token
2026-10-05 07:48:17 +02:00
swarm-controller reads its forge token from the store, not a host file
2026-10-08 13:25:47 +02:00
forge: fetch the OIDC client secret from bao instead of a host-side copy
2026-10-10 14:07:31 +02:00
nix: the hive's leaf does not read every secret in the store
2026-10-12 01:37:46 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
swarmctl: log in with the operator's own SSO account and reach the controller through the swarm domain
2026-10-12 01:25:58 +02:00
forge: fetch the OIDC client secret from bao instead of a host-side copy
2026-10-10 14:07:31 +02:00
grafana: make socketDir readOnly and drop its rename alias
2026-10-12 00:11:05 +02:00
module-eval/hive-otel: pin the fetch reviving a start-limited collector
2026-10-10 01:22:32 +02:00
hive-tls: the root fetch presents the hive identity, as on main
2026-10-06 14:54:07 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
module-eval: set the hive-controller option only in tests that need a hive
2026-10-05 09:58:13 +02:00
module-eval: set the hive-controller option only in tests that need a hive
2026-10-05 09:58:13 +02:00
swarm-controller reads its forge token from the store, not a host file
2026-10-08 13:25:47 +02:00
hive telemetry collector: fetch its OIDC secret from the store under the hive's own leaf
2026-10-10 01:10:31 +02:00
module-eval/nats-tls: evaluate the no-URL leaf fixture with hive-c0re on
2026-10-10 01:05:33 +02:00
swarm-secret-publish: drop RemainAfterExit so the path unit re-runs it
2026-10-10 14:08:43 +02:00
nix: follow-ups from the service/deploy split
2026-10-05 19:12:46 +02:00
hive-tls: a gateway host without the services-issuer pair evaluates and goes red at runtime
2026-10-06 14:54:07 +02:00
hive-forge: mirror actions/upload-artifact alongside actions/checkout
2026-10-09 10:40:28 +02:00
d39ad6c465