atlas
57955a6c53
agents: hand over the kept drop-in's cap, warn at boot without one ...
When hive-c0re can't read resource-limits.json and a limits drop-in
already exists, it keeps the drop-in, but it wrote no memory cap file. A
container whose runtime dir had no file yet (hive-c0re upgraded, /run
not cleared) then started with no heap ceiling and no subagent
MemoryHigh=, silently. `stage_limits` now writes the file on every
call: from the new limits, or from the last `MemoryMax=` in the kept
drop-in (`infinity` when it has none or can't be read).
A missing or malformed cap file at boot is no longer silent. The
generators run before the container's journal and an nspawn container
has no /dev/kmsg, so a oneshot `hyperhive-memory-cap-check.service`
logs a warning naming the path. The agent then runs with no JSC heap
ceiling and no subagent MemoryHigh=; the container's MemoryMax= still
applies.
module-eval-agent-memory gains a case pinning how the ceiling reaches
claude: `hive-agent` and `hive-subagent-daemon` neither set nor unset
BUN_JSC_forceRAMSize, both generators and the check unit are installed.
Part of #5081 (slice S0-2).
2026-10-12 10:59:12 +02:00
agents: swap the agent's bao leaf in with one rename
2026-10-11 10:00:43 +02:00
agents: swap the agent's bao leaf in with one rename
2026-10-11 10:00:43 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
module-eval: accept the agent's live bao pair as a store path
2026-10-11 10:00:43 +02:00
agents: hand over the kept drop-in's cap, warn at boot without one
2026-10-12 10:59:12 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
agents: swap the agent's bao leaf in with one rename
2026-10-11 10:00:43 +02:00
agents: swap the agent's bao leaf in with one rename
2026-10-11 10:00:43 +02:00
module-eval: agent-user test asserts the heal_own_dir form
2026-10-09 11:30:30 +02:00
matrix: drop the per-hive appservice and its unused token
2026-10-05 07:48:17 +02:00
swarm-controller reads its forge token from the store, not a host file
2026-10-08 13:25:47 +02:00
forge: fetch the OIDC client secret from bao instead of a host-side copy
2026-10-10 14:07:31 +02:00
nix: the hive's leaf does not read every secret in the store
2026-10-12 01:37:46 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
swarmctl: log in with the operator's own SSO account and reach the controller through the swarm domain
2026-10-12 01:25:58 +02:00
forge: fetch the OIDC client secret from bao instead of a host-side copy
2026-10-10 14:07:31 +02:00
agents: remove send(operator) and the operator inbox; alert on turn failures
2026-10-12 08:50:06 +02:00
module-eval/hive-otel: pin the fetch reviving a start-limited collector
2026-10-10 01:22:32 +02:00
hive-tls: the root fetch presents the hive identity, as on main
2026-10-06 14:54:07 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
module-eval: set the hive-controller option only in tests that need a hive
2026-10-05 09:58:13 +02:00
module-eval: set the hive-controller option only in tests that need a hive
2026-10-05 09:58:13 +02:00
swarm-controller reads its forge token from the store, not a host file
2026-10-08 13:25:47 +02:00
hive telemetry collector: fetch its OIDC secret from the store under the hive's own leaf
2026-10-10 01:10:31 +02:00
module-eval/nats-tls: evaluate the no-URL leaf fixture with hive-c0re on
2026-10-10 01:05:33 +02:00
swarm-secret-publish: drop RemainAfterExit so the path unit re-runs it
2026-10-10 14:08:43 +02:00
nix: follow-ups from the service/deploy split
2026-10-05 19:12:46 +02:00
hive-tls: a gateway host without the services-issuer pair evaluates and goes red at runtime
2026-10-06 14:54:07 +02:00
hive-forge: mirror actions/upload-artifact alongside actions/checkout
2026-10-09 10:40:28 +02:00
57955a6c53