atlas
2505008b83
swarm-secret-client: hives no longer read swarm/services/* ...
The hive policy rendered by policy::render granted every hive cert read
on secret/data/swarm/services/*, which holds each swarm service's OIDC
client secret. No reader of that tree authenticates with a hive cert:
grafana, the otel collector and the store forwarder each read with
their own leaf, and the bao UI's secret is read by the store's granter.
render() now emits two stanzas: swarm/agents/* and the hive's own
swarm/hives/<hive>/*. Kind::Service had no other caller and is removed.
Docs and comments that described the grant as a decision are rewritten
to the current state.
Closes #4960
2026-10-04 23:11:11 +02:00
forge: external forge accounts live in swarm bao; the agent fetches them itself
2026-10-01 18:05:33 +02:00
github swarm bao: address argus review on #4892
2026-10-02 17:54:45 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
hive-matrix-mcp: read the main account's token from the store too
2026-09-25 08:31:01 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
hive-agent: the swarm queue connection is required; retry, then exit
2026-10-04 22:24:51 +02:00
module-eval: pin a claude agent's subagent store identity
2026-10-03 01:34:01 +02:00
hive-priv: create agent socket dirs on start; drop hyperhive-agents.conf
2026-09-27 18:55:33 +02:00
bao: serve the browser UI to admins via a loopback-only listener
2026-09-28 19:31:02 +02:00
ops: update option pointer after hive-matrix split
2026-10-01 13:00:25 +02:00
swarm-secret-client: hives no longer read swarm/services/*
2026-10-04 23:11:11 +02:00
swarm-otel: ship the whole host journal, drop user sessions after it
2026-09-30 23:01:49 +02:00
swarm-otel: ship the whole host journal, drop user sessions after it
2026-09-30 23:01:49 +02:00
swarm options: no swarm.* value depends on a deploy option or this host's hive
2026-10-04 18:13:47 +02:00
hive-forge: a first authelia login creates the forge account
2026-09-25 08:29:56 +02:00
swarm-bao: stamp collector's service.name as "bao"
2026-09-25 08:30:25 +02:00
swarm-bao: give the store's collector an explicit self-telemetry port
2026-09-23 18:04:33 +02:00
hive-gateway: no hive-domain vhost on a host without a hive
2026-10-04 19:45:14 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
matrix apiUrl: default to https on the gateway vhost
2026-10-04 18:31:24 +02:00
hive-tls: issue the gateway leaf from bao with a per-hive identity
2026-10-04 19:45:14 +02:00
docs: drop harness systemd settings; swarm-nats-auth: refuse the hive's shared agent client
2026-10-04 22:24:51 +02:00
swarm-controller: read the queue client secret from the store, drop the file
2026-09-28 19:01:05 +02:00
swarm-secret-client: hives no longer read swarm/services/*
2026-10-04 23:11:11 +02:00
swarm-otel: ship the whole host journal, drop user sessions after it
2026-09-30 23:01:49 +02:00
swarm-bao: refuse a remote reader that named seven of the eight leaves
2026-09-23 10:11:42 +02:00
hive-gateway: no hive-domain vhost on a host without a hive
2026-10-04 19:45:14 +02:00
2505008b83