atlas
642be57678
swarm: narrow the revoke grant to the queue leaf, not the whole agent prefix ...
revoke_queue_credential only ever deletes swarm/agents/<agent>/queue
(agent_queue_path + a literal "queue" suffix), never anything else
under an agent's prefix. secret/metadata/swarm/agents/+/queue matches
that exactly — `+` is bao's single-segment glob, the same form
swarm-nats-auth's read grant already uses for the data-side path.
Also rewords the module-eval test's stale note about a read/list grant
handing a "write-only principal" the version history: the controller
has held read on secret/data/swarm/agents/* since the mint-and-verify
read-before-write change, so it was never write-only on that path.
2026-09-28 23:46:17 +02:00
module-eval: pin the agent forge-token fetch and tea-login's removal
2026-09-24 17:48:53 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
hive-matrix-mcp: read the main account's token from the store too
2026-09-25 08:31:01 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
agent: fetch this agent's own swarm-queue credential from the store
2026-09-21 20:44:52 +02:00
hive-priv: create agent socket dirs on start; drop hyperhive-agents.conf
2026-09-27 18:55:33 +02:00
bao: serve the browser UI to admins via a loopback-only listener
2026-09-28 19:31:02 +02:00
swarm-controller: read the queue client secret from the store, drop the file
2026-09-28 19:01:05 +02:00
swarm: narrow the revoke grant to the queue leaf, not the whole agent prefix
2026-09-28 23:46:17 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
bao: serve the browser UI to admins via a loopback-only listener
2026-09-28 19:31:02 +02:00
swarm-controller: read the queue client secret from the store, drop the file
2026-09-28 19:01:05 +02:00
hive-forge: a first authelia login creates the forge account
2026-09-25 08:29:56 +02:00
swarm-bao: stamp collector's service.name as "bao"
2026-09-25 08:30:25 +02:00
swarm-bao: give the store's collector an explicit self-telemetry port
2026-09-23 18:04:33 +02:00
swarm-bao: write every swarm-* grant as a bao granter, not with a 24h token
2026-09-27 22:57:46 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
swarm-bao: write every swarm-* grant as a bao granter, not with a 24h token
2026-09-27 22:57:46 +02:00
swarm: let an agent publish its own icon
2026-09-28 13:47:37 +02:00
swarm-controller: read the queue client secret from the store, drop the file
2026-09-28 19:01:05 +02:00
bao: OIDC login to the browser UI via authelia, as a metadata-only viewer
2026-09-28 19:56:38 +02:00
swarm-bao: write every swarm-* grant as a bao granter, not with a 24h token
2026-09-27 22:57:46 +02:00
swarm-bao: refuse a remote reader that named seven of the eight leaves
2026-09-23 10:11:42 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
642be57678