sock
6c95933775
docs(security): ci netns, knowledge .git tmpfs, matrix id/secret split ...
Security fixes landed without updating the security-model docs; bring them
current as present-tense invariants:
- security.md: matrix identities are public / cross-agent-readable via
GetAgentMeta while the token stays private; name validation extends to
GetAgentMeta; the nix-build blast radius has a network dimension (hive-ci
netns) alongside the 0600 token policy.
- boundary.md: the core dashboard /api has no app-layer auth — protection is
the gateway plus network isolation; stated as a standing invariant.
- ci.md: hive-ci runs in its own private netns behind the bridge, reaches the
forge via the gateway, and cannot reach host-loopback (dashboard/forge port).
- knowledge.md: /knowledge excludes .git via tmpfs so the core token in
.git/config isn't readable by agents.
Refs #2308 , #2310 , #2313 .
2026-07-10 19:17:17 +02:00
regen docs/tools/hivectl-cli.md with updated hivectl help text
2026-07-10 13:49:54 +02:00
refactor(hive-ag3nt): split hive bin into hive-agent / hive-agent-mcp / hive-agent-wake
2026-07-06 23:48:05 +02:00
web_ui: support unix:<path> upstreams in extraWebProxies
2026-07-10 12:53:09 +02:00
refactor(hive-ag3nt): split hive bin into hive-agent / hive-agent-mcp / hive-agent-wake
2026-07-06 23:48:05 +02:00
refactor(hive-c0re): group src-root files into submodules
2026-07-06 22:38:47 +02:00
docs(security): ci netns, knowledge .git tmpfs, matrix id/secret split
2026-07-10 19:17:17 +02:00
docs(security): ci netns, knowledge .git tmpfs, matrix id/secret split
2026-07-10 19:17:17 +02:00
refactor(mcp): split claude launch-config layer into mcp_config.rs
2026-07-05 22:24:46 +02:00
refactor(hive-c0re): group src-root files into submodules
2026-07-06 22:38:47 +02:00
docs(forge): note forgejo-api client + remaining raw-HTTP surfaces
2026-07-07 09:25:51 +02:00
docs(gateway): remove stale TCP loopback fallback section
2026-07-04 22:42:56 +02:00
docs(gotchas): document nix fmt failure in git worktrees
2026-07-04 20:50:50 +02:00
docs(security): ci netns, knowledge .git tmpfs, matrix id/secret split
2026-07-10 19:17:17 +02:00
chore(docs,nix): fix stale 'localhost via shared netns' claims in forge/matrix
2026-07-04 22:54:38 +02:00
docs(network): fix stale '(shared netns)' in bridge firewall table row
2026-07-04 21:18:57 +02:00
docs(observability): document OTEL configuration options
2026-07-04 13:17:42 +02:00
refactor(hive-c0re): group src-root files into submodules
2026-07-06 22:38:47 +02:00
docs(security): ci netns, knowledge .git tmpfs, matrix id/secret split
2026-07-10 19:17:17 +02:00
docs( #2012 ): add first-run setup guide + link from index
2026-06-27 20:02:15 +02:00
feat( #1997 ): add prettier markdown formatter to treefmt
2026-07-02 23:33:11 +02:00
fix(terminal-rendering): move fmtToolUse table after numbered list
2026-07-04 18:56:59 +02:00
feat( #2109 ): harness-side idle watchdog to bail on anthropic api stall storms
2026-07-07 22:45:18 +02:00
docs(web-ui): update reading path to point at terminal-rendering.md
2026-07-04 18:06:55 +02:00
6c95933775