e2da5509ae
The CI runner was a hive deploy module: hive-ci.nix ran it beside the forge, and hive-c0re registered it through the forge's admin API with the `core` token, writing the registration token through hive-priv. It could only run on the forge's host, and it kept an admin-scoped forge token on a hive. Now the runner is a swarm service: - swarm-ci-runner.nix runs it in a `swarm-ci-runner` container on the host that sets deploy.ci-runner.enable, reaching the forge by name. It needs neither the forge nor a hive there. - swarm-controller reads the forge's runner registration token with its own admin token and writes it to swarm/services/ci-runner/ registration-token whenever it differs from what it last wrote. Its grant on that path is create/update only. - The runner's own leaf (CN swarm-ci-runner, role and policy of the same name) reads that one path. swarm-bao-ci-runner.service fetches it into the runner's EnvironmentFile and restarts the runner on a change. - A pre-start step removes .runner when the daemon's journal since its last start holds Forgejo's "unregistered runner" refusal (the daemon exits 1 when its startup Declare gets it), or when .runner names another forge address; upstream's pre-start step then registers again. Removed from the hive side: hive-ci.nix and deploy.forgejo.ci.*, forge/ci_runner.rs, PrivRequest::RegisterCiRunner and its handler and ReadWritePaths entry, InfraContainer::Ci with hivectl's --ci and the dashboard's hive-ci journal entry, HYPERHIVE_FORGE_CI_ENABLED, and read:admin,write:admin from CORE_TOKEN_SCOPES: nothing else in hive-c0re calls /api/v1/admin/*. The old ci options, under both swarm.forge.ci and deploy.forgejo.ci, now fail evaluation naming deploy.ci-runner. The forge's half of the old ci.enable, the actions/checkout mirror and DEFAULT_ACTIONS_URL = self, is deploy.forgejo.actionsFromSelf. Closes #4954
84 lines
3.4 KiB
HTML
84 lines
3.4 KiB
HTML
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
<title>hyperhive // C0R3</title>
|
|
<link rel="icon" type="image/svg+xml" href="/favicon.svg" />
|
|
<link rel="stylesheet" href="/static/colors.css" />
|
|
<link rel="stylesheet" href="/static/theme.css" />
|
|
<link rel="stylesheet" href="/static/common.css" />
|
|
<link rel="stylesheet" href="/static/core.css" />
|
|
</head>
|
|
<body class="core-shell">
|
|
<!-- C0R3: the host/coordinator surface. Standalone page (served at
|
|
/core.html) carved out of the dashboard's old SYST3M tab so the
|
|
dashboard tab strip stays lean. Same minimal chrome as
|
|
/logs.html — a `← home` back-link to the H0M3 hub + a
|
|
<hive-tab-strip> sub-tab nav. Two sub-tabs: kept state (tombstones)
|
|
and container load. Rebuild queue + meta inputs have moved to
|
|
/builds.html (the build lifecycle hub). Default tab: K3PT ST4T3.
|
|
The section <div> ids (tombstones-section, container-load-section)
|
|
match what core.js's renderers target. Hive infra containers
|
|
(`hive-forge`, `hive-gateway`, `hive-matrix`) have no
|
|
dashboard panel — `hivectl stop`/`start`/`restart` is the only
|
|
control surface. -->
|
|
<header class="page-header">
|
|
<a class="page-back" href="/">← home</a>
|
|
<hive-tab-strip
|
|
class="hive-tabbar core-tabbar"
|
|
id="core-tabbar"
|
|
prefix="core"
|
|
role="tablist"
|
|
></hive-tab-strip>
|
|
</header>
|
|
|
|
<main class="core-main">
|
|
<!-- K3PT ST4T3: tombstoned-agent kept state + stale permission entries.
|
|
tombstones-section shows destroyed agents (purge button).
|
|
tombstones-stale-perms is lazy-loaded on tab activation and shows
|
|
agents with explicit capability/tool-group entries but no live
|
|
container (typically renamed/deleted agents whose JSON entries
|
|
persisted). Each stale entry gets a "✕ clear perms" button. -->
|
|
<section
|
|
class="core-pane"
|
|
id="core-pane-kept"
|
|
data-tab-pane="kept"
|
|
role="tabpanel"
|
|
aria-labelledby="core-tab-kept"
|
|
>
|
|
<p class="meta">
|
|
kept state from previously tombstoned agents — recreating an agent
|
|
with the same name reuses it.
|
|
</p>
|
|
<div id="tombstones-section">
|
|
<p class="meta">loading…</p>
|
|
</div>
|
|
<div id="tombstones-stale-perms"></div>
|
|
</section>
|
|
|
|
<!-- C0NT41N3R L04D: live cpu + memory per agent container, from
|
|
cgroup v2 on the host. Polled only while this sub-tab is active. -->
|
|
<section
|
|
class="core-pane"
|
|
id="core-pane-load"
|
|
data-tab-pane="load"
|
|
role="tabpanel"
|
|
aria-labelledby="core-tab-load"
|
|
>
|
|
<p class="meta">
|
|
live cpu + memory per agent container, from cgroup v2 on the host. cpu
|
|
is % of total host capacity (all cores), sampled over ~200ms each
|
|
refresh; polled every 5s while this tab is open. network is omitted on
|
|
purpose — agents share the host netns, so there is no per-container
|
|
counter (see <code>docs/networking/network.md</code>).
|
|
</p>
|
|
<div id="container-load-section">
|
|
<p class="meta">loading…</p>
|
|
</div>
|
|
</section>
|
|
</main>
|
|
|
|
<script type="module" src="/static/core.js" defer></script>
|
|
</body>
|
|
</html>
|