vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity
hyperhive/docs/tools
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
atlas e2da5509ae swarm-ci-runner: run the forge CI runner as a swarm service 
The CI runner was a hive deploy module: hive-ci.nix ran it beside the
forge, and hive-c0re registered it through the forge's admin API with
the `core` token, writing the registration token through hive-priv. It
could only run on the forge's host, and it kept an admin-scoped forge
token on a hive.

Now the runner is a swarm service:

- swarm-ci-runner.nix runs it in a `swarm-ci-runner` container on the
  host that sets deploy.ci-runner.enable, reaching the forge by name.
  It needs neither the forge nor a hive there.
- swarm-controller reads the forge's runner registration token with its
  own admin token and writes it to swarm/services/ci-runner/
  registration-token whenever it differs from what it last wrote. Its
  grant on that path is create/update only.
- The runner's own leaf (CN swarm-ci-runner, role and policy of the same
  name) reads that one path. swarm-bao-ci-runner.service fetches it into
  the runner's EnvironmentFile and restarts the runner on a change.
- A pre-start step removes .runner when the daemon's journal since its
  last start holds Forgejo's "unregistered runner" refusal (the daemon
  exits 1 when its startup Declare gets it), or when .runner names
  another forge address; upstream's pre-start step then registers again.

Removed from the hive side: hive-ci.nix and deploy.forgejo.ci.*,
forge/ci_runner.rs, PrivRequest::RegisterCiRunner and its handler and
ReadWritePaths entry, InfraContainer::Ci with hivectl's --ci and the
dashboard's hive-ci journal entry, HYPERHIVE_FORGE_CI_ENABLED, and
read:admin,write:admin from CORE_TOKEN_SCOPES: nothing else in hive-c0re
calls /api/v1/admin/*. The old ci options, under both swarm.forge.ci and
deploy.forgejo.ci, now fail evaluation naming deploy.ci-runner.

The forge's half of the old ci.enable, the actions/checkout mirror and
DEFAULT_ACTIONS_URL = self, is deploy.forgejo.actionsFromSelf.

Closes #4954
2026-10-05 13:55:37 +02:00
..
bash.md docs: drop statements about absent things, state current behaviour 2026-10-02 11:43:10 +02:00
forge-cli.md forge: external forge accounts live in swarm bao; the agent fetches them itself 2026-10-01 18:05:33 +02:00
forge.md docs: state current behaviour without change-log wording 2026-10-02 11:43:10 +02:00
hivectl-cli.md swarm-ci-runner: run the forge CI runner as a swarm service 2026-10-05 13:55:37 +02:00
hivectl.md docs: config changes are operator merges on the forge 2026-10-02 23:13:04 +02:00
matrix.md hive-matrix-mcp: fix list_rooms/list_invites docs to say room_id, not id 2026-10-04 20:40:15 +02:00
README.md docs: scheduled prompts are swarm-level; the hive page is a read-only list 2026-10-04 21:23:31 +02:00
subagent.md docs: state current behaviour (wake path, subagent todo) 2026-10-02 11:43:10 +02:00
swarm-logs-cli.md docs: gate write-good.Passive on CI 2026-09-20 16:24:11 +02:00
swarmctl-cli.md swarm: named scheduled prompts for one or more agents, fired in each agent 2026-10-04 17:24:57 +02:00

README.md

Tools

hivectl is your tool — the operator's own host CLI. Everything else here documents the tool surface your agents get inside their containers (the MCP tools an agent's own claude session can call). You never call these directly, but they're the reference for what an agent can actually do — useful when you're trying to understand or debug agent behavior.

For the operator

  • hivectl — the curated guide: provisioning forge and matrix accounts, gateway htpasswd management, container lifecycle shortcuts, interactive agent shell access.
  • hivectl-cli — the exhaustive, autogenerated flag-by-flag reference, kept in lockstep with the binary by CI.

For the swarm operator

  • swarmctl-cli — the exhaustive, autogenerated flag-by-flag reference for swarmctl, kept in lockstep with the binary by CI the same way hivectl-cli.md is. swarmctl itself runs as root on the swarm-controller host, not through hivectl — see swarmctl/README.md for why. Two verb families today: user (authelia's subject store, edited in place) and agent create (queues the swarm-controller's creation job graph). No curated guide yet; add one here if/when that grows.

What your agents can do

  • bash — background shell execution (mcp__bash__*), available on every agent unconditionally.
  • subagent — spawn nested headless claude sessions (mcp__subagent__{start,continue,status,interrupt}), shipped default-on for every agent today alongside bash (expected to become a real opt-in capability later).
  • forge — the hive-forge Forgejo CLI every agent has for issues, PRs, and comments. Not an MCP tool — a binary agents shell out to instead of ad-hoc curl.
  • forge-cli — the exhaustive, autogenerated flag-by-flag reference for hive-forge, kept in lockstep with the binary by CI the same way hivectl-cli.md is.
  • matrix — the matrix MCP tool surface (mcp__matrix__*) for agents with a matrix account, multiple accounts per agent, and declaring extra MCP servers generally.