atlas
868c6cf96c
drop the shared hive agent login ...
Every agent now connects to the queue and reads logs with its own secret
from the store (#5181 ), so the per-hive `hive-<h>-agent` OIDC client has
no reader left. Remove it end to end:
- hive-c0re no longer forwards `hive-queue-agent-{secret,client-id}` into
containers, and no longer forwards HIVE_AGENT_OIDC_TOKEN_ENDPOINT; the
agent module that loaded them (nix/agent-modules/queue.nix) is gone, its
options refused with a removal message.
- The host reader (glue-queue-agent-credential.nix, swarm-bao-queue-agent),
its store role and policy unit (swarm-bao-queue-agent-policy), its PKI
leaf and the deploy.bao.queueAgent* / queue.agentCredentialDir options
are gone; the options are refused with a removal message.
- authelia mints no `hive-<h>-agent` client, and swarm-secret-publish no
longer writes swarm/hives/<h>/queue/agent.
- swarm-secret-client drops queue::agent_client_path / queue::Credential.
- HIVE_AGENT_NATS_URL is now gated on the agents' queue address alone.
The log store's authelia check stays for operators. swarm-nats-auth still
refuses a `-agent` client id; that refusal and `agentClientSuffix` are left
for a follow-up.
Refs #4459
Refs #4765
2026-10-24 14:00:26 +02:00
drop the shared hive agent login
2026-10-24 14:00:26 +02:00
drop port-collision checks against swarm.otel.telemetryPort
2026-10-24 13:35:17 +02:00
every hive runs its otel collector, and agents export to it by default
2026-10-19 18:35:17 +02:00
tls: a CA root change no longer restarts the store or bounces containers
2026-10-21 22:00:13 +02:00
swarm-grafana /dashboards
rename claude.md to agents.md for agents and the repo
2026-10-18 02:33:06 +02:00
bao: disable the unused approle auth method, declaratively
2026-09-28 22:58:36 +02:00
drop the shared hive agent login
2026-10-24 14:00:26 +02:00
drop the shared hive agent login
2026-10-24 14:00:26 +02:00
drop the shared hive agent login
2026-10-24 14:00:26 +02:00
every hive runs its otel collector, and agents export to it by default
2026-10-19 18:35:17 +02:00
drop the shared hive agent login
2026-10-24 14:00:26 +02:00
bao: OIDC login to the browser UI via authelia, as a metadata-only viewer
2026-09-28 19:56:38 +02:00
swarm-builder, swarm-claude-login, swarm-review-classifier: forward each container's journal to the swarm collector
2026-10-16 09:10:04 +02:00
push ci run metrics to victoriametrics, with a grafana board
2026-10-16 20:43:11 +02:00
swarm-ci-runner, swarm-grafana, swarm-victorialogs: forward each container's journal to the swarm collector
2026-10-16 11:22:51 +02:00
swarm-builder, swarm-claude-login, swarm-review-classifier: forward each container's journal to the swarm collector
2026-10-16 09:10:04 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
glue-controller-env: the controller always exports otlp to the swarm's collector
2026-10-17 16:33:52 +02:00
swarm-controller: get its otlp pushes past the collector, log failures
2026-10-17 09:44:33 +02:00
glue: forge's controller-dependent settings move out of the forge module
2026-10-13 22:14:28 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
hive-forge, hive-matrix: forward each container's journal to the swarm collector
2026-10-16 13:50:23 +02:00
nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
2026-09-26 01:19:49 +02:00
swarm-ci-runner, swarm-grafana, swarm-victorialogs: forward each container's journal to the swarm collector
2026-10-16 11:22:51 +02:00
every hive runs its otel collector, and agents export to it by default
2026-10-19 18:35:17 +02:00
hive-tls: the gateway leaf uses the services-issuer identity, not a hive's
2026-10-06 14:54:07 +02:00
agents fetch the hive CA from bao at boot instead of the meta flake embedding it
2026-10-19 20:15:13 +02:00
swarm-logs-auth: check agent tokens on the log store's query route
2026-10-13 08:38:05 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
move the hive's vhosts and matrix discovery out of the gateway
2026-10-17 15:07:33 +02:00
swarm: OIDC clients registered wherever authelia runs; nats + matrix secrets from bao
2026-10-05 09:58:02 +02:00
hive-forge, hive-matrix: forward each container's journal to the swarm collector
2026-10-16 13:50:23 +02:00
add swarm-metrics, an agent CLI for the metrics store
2026-10-17 10:10:17 +02:00
swarm-nats: the auth responder's store identity path is its own, not the hive's
2026-10-06 10:04:30 +02:00
swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
2026-10-06 12:04:48 +02:00
swarm-nats: forward the queue container's journal to the swarm collector
2026-10-16 09:08:21 +02:00
glue: nats firewall on the wireguard interface moves out of the nats module
2026-10-14 10:15:19 +02:00
agents get a todo when assigned to an issue or PR, rewritten when unassigned and cleared on close
2026-10-22 07:28:53 +02:00
swarm-builder, swarm-claude-login, swarm-review-classifier: forward each container's journal to the swarm collector
2026-10-16 09:10:04 +02:00
swarm-authelia: run the secret publisher and a journal forwarder inside the container
2026-10-17 00:28:16 +02:00
swarm-authelia: run the secret publisher and a journal forwarder inside the container
2026-10-17 00:28:16 +02:00
ops: update option pointers after grafana/bao split
2026-10-01 09:53:04 +02:00
ops: update option pointers after otel split
2026-10-01 13:00:40 +02:00
swarm-ci-runner, swarm-grafana, swarm-victorialogs: forward each container's journal to the swarm collector
2026-10-16 11:22:51 +02:00
swarm-victoriametrics: forward the container's journal to the swarm collector
2026-10-16 14:47:31 +02:00
drop option renames and removals older than two weeks
2026-10-16 22:04:57 +02:00
swarm-authelia: run the secret publisher and a journal forwarder inside the container
2026-10-17 00:28:16 +02:00
every hive runs its otel collector, and agents export to it by default
2026-10-19 18:35:17 +02:00
publish operators' forge-profile pronouns to kv and list them in the agent prompt
2026-10-17 13:10:05 +02:00
hive-priv: lock personality, deny realtime, kernel logs and module loading
2026-10-16 16:06:49 +02:00
tls: a CA root change no longer restarts the store or bounces containers
2026-10-21 22:00:13 +02:00
drop option renames and removals older than two weeks
2026-10-16 22:04:57 +02:00
hyperhive: make the values the meta-flake render reads swarm-wide
2026-10-17 13:43:16 +02:00
swarm-nats: take the callout issuer and user keys from the store
2026-10-06 14:53:33 +02:00
nats-callout-removed: remove the container's OIDC secret copy here, ungated
2026-10-06 15:25:29 +02:00
drop port-collision checks against swarm.otel.telemetryPort
2026-10-24 13:35:17 +02:00
swarm-ui: apply the operator's stylix theme, same as the dashboard already does
2026-08-24 14:28:25 +02:00
drop the shared hive agent login
2026-10-24 14:00:26 +02:00
drop the shared hive agent login
2026-10-24 14:00:26 +02:00
drop port-collision checks against swarm.otel.telemetryPort
2026-10-24 13:35:17 +02:00
drop the shared hive agent login
2026-10-24 14:00:26 +02:00
the meta flake takes docs from the pinned hyperhive input
2026-10-18 20:09:14 +02:00
trust the swarm services ca in swarm-ci-metrics
2026-10-17 23:28:03 +02:00
swarm-ci-runner, swarm-grafana, swarm-victorialogs: forward each container's journal to the swarm collector
2026-10-16 11:22:51 +02:00
move dashboardPort, claudeCodePackage and extraResourceAttributes to deploy.hive-controller
2026-10-17 13:43:16 +02:00
swarm-controller: chgrp the runtime dir in ExecStartPost, ExecStart's setup undid the ExecStartPre one
2026-10-18 15:32:35 +02:00
swarm-ci-runner, swarm-grafana, swarm-victorialogs: forward each container's journal to the swarm collector
2026-10-16 11:22:51 +02:00
drop the shared hive agent login
2026-10-24 14:00:26 +02:00
drop port-collision checks against swarm.otel.telemetryPort
2026-10-24 13:35:17 +02:00
drop the shared hive agent login
2026-10-24 14:00:26 +02:00
agents get a todo when assigned to an issue or PR, rewritten when unassigned and cleared on close
2026-10-22 07:28:53 +02:00
swarm-otel: run in its own network namespace, receivers on unix sockets
2026-10-24 12:11:24 +02:00
drop the shared hive agent login
2026-10-24 14:00:26 +02:00
agents get a todo when assigned to an issue or PR, rewritten when unassigned and cleared on close
2026-10-22 07:28:53 +02:00
every hive runs its otel collector, and agents export to it by default
2026-10-19 18:35:17 +02:00
drop the shared hive agent login
2026-10-24 14:00:26 +02:00
snapshot store: bound the transfer on both ends
2026-10-16 11:45:58 +02:00
move the hive's vhosts and matrix discovery out of the gateway
2026-10-17 15:07:33 +02:00
swarm-ci-runner, swarm-grafana, swarm-victorialogs: forward each container's journal to the swarm collector
2026-10-16 11:22:51 +02:00
drop port-collision checks against swarm.otel.telemetryPort
2026-10-24 13:35:17 +02:00
swarm-victoriametrics: forward the container's journal to the swarm collector
2026-10-16 14:47:31 +02:00
victorialogs and victoriametrics: own the package for each auth responder they run
2026-10-17 18:38:25 +02:00
swarm options: no swarm.* value depends on a deploy option or this host's hive
2026-10-04 18:13:47 +02:00
drop the shared hive agent login
2026-10-24 14:00:26 +02:00
868c6cf96c