vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
hyperhive/hive-c0re
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
atlas b004ba3dc5 swarm: split the deploy subject per hive 
Per mara on the PR: *"split by hive. its not a security thing, just so
hives dont get messages they dont care about."*

She agreed with the finding and still wanted the split, which is the
part worth recording. I measured that a per-hive subject gives no
confidentiality — `sub` is unrestricted, so a hive that wanted another's
messages could subscribe to them — and concluded it bought nothing.
"Nothing" is a claim over every axis and I had checked one. The axis I
never priced: every hive in the swarm being woken by every other hive's
deploys.

So `deploy_subject(hive)` replaces the single literal, and the payload
drops `hive` to carry only the agent — the subject names the hive, and
two places stating one fact are free to disagree. The hive subscribes to
its own subject and no longer filters.

The grant is a wildcard rather than a subject per hive because the
responder has no roster: it cannot enumerate hives, and a grant that had
to track one would be a second place to get the list wrong — the same
argument `hive_name`'s doc makes about admission.

The negative test gets stronger rather than merely adapted. Splitting
the family makes "another hive's subject" and "its own" separate strings
for the first time, so it now asserts a hive reaches neither, nor the
wildcard.
2026-08-31 00:17:41 +02:00
..
src swarm: split the deploy subject per hive 2026-08-31 00:17:41 +02:00
Cargo.toml swarm-queue-based lifecycle notices, replacing push_todo(MANAGER_AGENT) 2026-08-24 14:34:37 +02:00
README.md docs/hive-c0re: fix ask/answer removal doc gaps argus caught on #3741 2026-08-30 03:02:31 +02:00

README.md

hive-c0re

The unprivileged host daemon (runs as hive-core). Owns the sqlite broker, the approval/reminder/schedule queues, the generic job-DAG queue, container lifecycle, gateway/forge/matrix provisioning, per-container stats, and the axum operator dashboard. Largest crate in the workspace — bin-only, no separate lib.

When to use it

Host-level, cross-container orchestration: spawning/rebuilding/ destroying agent containers, the approval flow, dashboard-visible state, provisioning per-agent forge/matrix/gateway accounts. Agent-side behavior (turn loop, MCP tools) lives in hive-agent/hive-agent-mcp instead — this daemon only talks to agents over the socket wire types in hive-sh4re.

Shape

Cohesive clusters live in directory submodules, each re-exported at the crate root (crate::broker::… keeps resolving regardless of which subdirectory a module actually lives in). One line each — read the module's own //! doc-comment for real detail, don't expect this file to track it:

  • dashboard/ — the operator dashboard (containers, approvals, schedules, logs, topology).
  • job_queue/ — the job-DAG queue + desired-state reconciliation (docs/coordinator.md).
  • lifecycle/ — nixos-container lifecycle + per-agent config flake generation.
  • stores/ — sqlite-backed stores (broker, queues, audit, power).
  • workers/ — background sweeps (crash watch, scheduled prompts, auto-update, knowledge sync).
  • agent_config/ — per-agent registries (tool groups, capabilities, resource limits, topology).
  • stats/ — dashboard metrics aggregation + OTEL export.
  • socket_server/ — the unix-socket request server shared by per-agent + manager sockets.
  • forge/ — optional Forgejo wiring (docs/forge.md).
  • coordinator.rs — top-level wiring for serve.
  • meta.rs, migrate.rs — the meta flake + schema/state migrations.
  • matrix.rs, gateway_nginx.rs, webhook_secret.rs, priv_client.rs — matrix provisioning, gateway vhosts, webhook secrets, and the hive-priv client respectively.

See the top-level CLAUDE.md/docs/ index for the full reading-path map.