| Filename | Latest commit message | Latest commit date |
|---|---|---|
97fb76ce99
hive-matrix-daemon now learns which external matrix accounts it has from the swarm secret store, under the agent's own certificate, and the hive push chain for matrix is gone. The daemon lists swarm/agents/<agent>/matrix/ (the `list` its policy grants on its own metadata subtree), reads each account's homeserver from its credential, and brings the accounts up with their tokens from the store. Every two minutes it lists again and exits with 75 when the set of linked accounts changed; the unit restarts on 75 without counting a failure. A listed name whose credential reads as absent is skipped and logged once. At start it removes the matrix-token-<a> / matrix-account-<a>.json pairs a hive delivered (a sidecar marks a pair as delivered; a declared tokenFile keeps its token). Removed: CredentialNotice and the $SWARM.credential.* subject and NATS grant, the controller's publish and its queue precondition on the PUT route, hive-c0re's credential subscription arm and workers/credential.rs, priv_client::write_agent_matrix_token, hive-priv's WriteAgentMatrixToken and its helpers, and the daemon's state-dir account discovery. Kept: WriteAgentGithubToken and the external-forge path (WriteAgentExtraForgeAccount, extra_forges.rs) are untouched, and a declared matrixAccounts tokenFile is still read when the store has no token for that account. Refs #4348 |
||
| .. | ||
| src | ||
| Cargo.toml | ||
| README.md | ||
hive-priv-sock
Wire types for the hive-priv privileged-helper socket
(/run/hive/priv.sock) — the contract between hive-priv (the root helper,
server) and hive-c0re (client, via its priv_client).
Why it's its own crate
Split out of hive-sh4re so hive-priv — a root-privileged binary —
depends on just this narrow protocol crate instead of the much larger
daemon-shared crate. Two wins: fewer dependencies in a root process's supply
chain, and a small, self-contained interface makes the privilege boundary this
crate encodes easier to audit. Mirrors hive-host-sock's split for the host
admin socket.
Shape
Serde-derived request/response types only — no server or client logic. Both
sides import them so the shapes stay in sync. See docs/trust-boundary/boundary.md +
docs/trust-boundary/security.md for the privilege boundary these types sit on, and
hive-priv/README for the helper itself.