atlas
868c6cf96c
drop the shared hive agent login ...
Every agent now connects to the queue and reads logs with its own secret
from the store (#5181 ), so the per-hive `hive-<h>-agent` OIDC client has
no reader left. Remove it end to end:
- hive-c0re no longer forwards `hive-queue-agent-{secret,client-id}` into
containers, and no longer forwards HIVE_AGENT_OIDC_TOKEN_ENDPOINT; the
agent module that loaded them (nix/agent-modules/queue.nix) is gone, its
options refused with a removal message.
- The host reader (glue-queue-agent-credential.nix, swarm-bao-queue-agent),
its store role and policy unit (swarm-bao-queue-agent-policy), its PKI
leaf and the deploy.bao.queueAgent* / queue.agentCredentialDir options
are gone; the options are refused with a removal message.
- authelia mints no `hive-<h>-agent` client, and swarm-secret-publish no
longer writes swarm/hives/<h>/queue/agent.
- swarm-secret-client drops queue::agent_client_path / queue::Credential.
- HIVE_AGENT_NATS_URL is now gated on the agents' queue address alone.
The log store's authelia check stays for operators. swarm-nats-auth still
refuses a `-agent` client id; that refusal and `agentClientSuffix` are left
for a follow-up.
Refs #4459
Refs #4765
2026-10-24 14:00:26 +02:00
agents fetch the hive CA from bao at boot instead of the meta flake embedding it
2026-10-19 20:15:13 +02:00
module-eval: restore seven zero-cost literal-pin cases
2026-10-17 08:00:29 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
subagent, bash: run each subagent run and bash task in its own cgroup
2026-10-13 12:25:27 +02:00
hand agents the dashboard port, pinned claude and otel labels at container start
2026-10-22 07:11:46 +02:00
module-eval: drop 18 redundant cases and merge assertion-only hosts
2026-10-17 08:00:29 +02:00
drop the shared hive agent login
2026-10-24 14:00:26 +02:00
module-eval: drop 18 redundant cases and merge assertion-only hosts
2026-10-17 08:00:29 +02:00
module-eval: restore seven zero-cost literal-pin cases
2026-10-17 08:00:29 +02:00
hive-tls owns the per-host list of locally fronted service domains
2026-10-17 23:26:53 +02:00
module-eval: drop 18 redundant cases and merge assertion-only hosts
2026-10-17 08:00:29 +02:00
drop the shared hive agent login
2026-10-24 14:00:26 +02:00
drop the shared hive agent login
2026-10-24 14:00:26 +02:00
every hive runs its otel collector, and agents export to it by default
2026-10-19 18:35:17 +02:00
the meta flake takes docs from the pinned hyperhive input
2026-10-18 20:09:14 +02:00
trust the swarm services ca in swarm-ci-metrics
2026-10-17 23:28:03 +02:00
drop the shared hive agent login
2026-10-24 14:00:26 +02:00
drop option renames and removals older than two weeks
2026-10-16 22:04:57 +02:00
hive-c0re: hive warnings reach the operator as metrics and alerts, not a banner
2026-10-21 17:52:53 +02:00
every hive runs its otel collector, and agents export to it by default
2026-10-19 18:35:17 +02:00
tls: a CA root change no longer restarts the store or bounces containers
2026-10-21 22:00:13 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
every hive runs its otel collector, and agents export to it by default
2026-10-19 18:35:17 +02:00
drop the shared hive agent login
2026-10-24 14:00:26 +02:00
drop the shared hive agent login
2026-10-24 14:00:26 +02:00
drop port-collision checks against swarm.otel.telemetryPort
2026-10-24 13:35:17 +02:00
drop the shared hive agent login
2026-10-24 14:00:26 +02:00
drop the shared hive agent login
2026-10-24 14:00:26 +02:00
every hive runs its otel collector, and agents export to it by default
2026-10-19 18:35:17 +02:00
module-eval: restore seven zero-cost literal-pin cases
2026-10-17 08:00:29 +02:00
swarm-otel: the upstream export is a swarm-otel deploy option
2026-10-21 10:25:26 +02:00
swarm-authelia: run in its own network namespace
2026-10-21 22:10:23 +02:00
module-eval: four containers left on the host netns
2026-10-24 12:11:24 +02:00
868c6cf96c