b072fbf4d6
A swarm-ci-metrics host unit on a 5-minute timer lists every forge repo's Actions runs as the new read-only ci-metrics account and pushes each finished run's duration and queue wait over OTLP, stamped at the run's stop time. The first pass backfills from run 1. swarm-controller mints the account's token into bao and keeps a ci-metrics team with read on the Actions unit in every organisation. Closes #5376
106 lines
4.5 KiB
Nix
106 lines
4.5 KiB
Nix
# The one blacklist: names no agent and no hive may take.
|
|
#
|
|
# Nix owns this list and hands it to the Rust side as an environment variable
|
|
# (`HIVE_RESERVED_NAMES`), so keeping it current is a config change rather than
|
|
# a rebuild of a binary. Read by:
|
|
#
|
|
# - `host-modules/swarm-controller.nix` -> the env var, for the
|
|
# swarm-level `create_agent` path — the only name check that runs today
|
|
# - `host-modules/hive-c0re/environment.nix` -> the same var. hive-c0re
|
|
# creates no agent, so nothing reads it there now; still handed over so a
|
|
# future host-side path is wired by construction, not by remembering to.
|
|
# - `host-modules/swarm-otel.nix` -> its `<owner>` assertion, so
|
|
# a hive name and an agent name are checked against ONE list
|
|
# - `nix/checks.nix` -> exported into `cargo test`,
|
|
# which keeps the message layer's sentinels from drifting from this file
|
|
#
|
|
# A plain nix file rather than a module option because two of those readers are
|
|
# flake-level (`checks.nix`) and cannot see a NixOS option.
|
|
#
|
|
# ⚠️ Agent names and hive names are ONE namespace going forward (mara, 2026-08-27:
|
|
# "agent and hive names live in the swarm level going forward"). Adding a name
|
|
# here forbids it for both. That is the point: two lists is how they drift.
|
|
#
|
|
# ⚠️ Every entry must be a value some component actually PRODUCES as a message
|
|
# `from`/`to`, a component name the collector builds pipelines from, or a forge
|
|
# username the forge refuses or a swarm service owns — not a word that merely
|
|
# looked risky. A name nothing emits or refuses is a refusal with no failure.
|
|
#
|
|
# ⚠️ Matched by EQUALITY. Words forbidden *inside* a hive name live in
|
|
# `./reserved-hive-fragments.nix` — read its header before merging the two.
|
|
[
|
|
# ---- message-layer senders -------------------------------------------
|
|
# The human at the dashboard: the sender of operator-authored messages
|
|
# (`{from: "operator", ...}`) and the fallback attribution for an answered
|
|
# question.
|
|
"operator"
|
|
# Helper events (`container_crash`, `needs_update`) — the sender an
|
|
# agent is told to treat as hyperhive itself rather than as a peer.
|
|
# `hive_sh4re::manager::SYSTEM_SENDER`.
|
|
"system"
|
|
# A due self-scheduled reminder arrives as its own sender, so a wake I asked
|
|
# for last week is distinguishable from a peer message.
|
|
"reminder"
|
|
# Forge notification wakes, delivered by the notify daemon.
|
|
"forge"
|
|
# A scheduled prompt firing, pushed as a trusted sender.
|
|
"scheduled"
|
|
# Three synthetic wakes the harness itself produces: an in-container todo,
|
|
# the follow-up turn after a self-requested compaction, and the single flush
|
|
# turn before a graceful stop.
|
|
"todo"
|
|
"compact"
|
|
"graceful-stop"
|
|
|
|
# ---- swarm-tier component owners -------------------------------------
|
|
# The swarm collector names its components `<kind>/<owner>` and uses the hive
|
|
# name as the owner, so a hive called `swarm` would silently replace the
|
|
# swarm tier's own pipelines and lose its own — it would keep accepting
|
|
# pushes into a pipeline that routes nowhere. `swarm-otel.nix` asserts
|
|
# this name stays in the list, since its own `reservedOwners` reads it.
|
|
"swarm"
|
|
|
|
# ---- usernames the forge refuses -------------------------------------
|
|
# Every agent becomes a Forgejo user of the same name, and Forgejo answers
|
|
# these with a 422 one node into provisioning: `reservedUsernames` in
|
|
# Forgejo v16.0.5 `models/user/user.go:639-680`, and the bare `-` that
|
|
# `models/repo/repo.go:67` also refuses as a repo name. Forgejo's shape
|
|
# rules are not literals and live in `hive_types::forge_username_violation`.
|
|
# Its entries containing `.` or `_` are left out: `[a-z0-9-]` cannot spell them.
|
|
"-"
|
|
"admin"
|
|
"api"
|
|
"assets"
|
|
"attachments"
|
|
"avatar"
|
|
"avatars"
|
|
"captcha"
|
|
"explore"
|
|
"forgejo-actions"
|
|
"ghost"
|
|
"gitea-actions"
|
|
"issues"
|
|
"login"
|
|
"metrics"
|
|
"milestones"
|
|
"notifications"
|
|
"org"
|
|
"pulls"
|
|
"repo"
|
|
"repo-avatars"
|
|
"user"
|
|
"v2"
|
|
|
|
# ---- forge accounts swarm-controller owns ----------------------------
|
|
# Service accounts it creates under these logins (`forge::builder_account`,
|
|
# `forge::classifier_account`, `forge::ci_metrics_account`). An agent of the
|
|
# same name would be refused one node into provisioning, and would keep the
|
|
# service from its token.
|
|
"builder"
|
|
"review-classifier"
|
|
"ci-metrics"
|
|
]
|
|
# Deliberately absent, and it is a load-bearing omission:
|
|
#
|
|
# `ruth` — a real agent, not a literal. A second agent wanting that name is a
|
|
# name that is TAKEN, which the roster answers, not this list.
|