| Filename | Latest commit message | Latest commit date |
|---|---|---|
b68a8ef290
swarm-secret-publish and its path unit now run inside authelia's container, beside the mint, and read each client secret at the path authelia writes it. The host unit and host path unit, which read the secrets through the container's root on the host, are gone, and so is deploy.authelia.hostClientSecretDir, which only they read. The publisher keeps its store identity, the secret-publisher leaf. The host hands the leaf and the store's CA into the container as nspawn system credentials, and the unit loads them; where this host mints the leaf, the container waits for swarm-bao-pki. Authelia does not wait for the publisher, which retries every 30 seconds while the store is down. The container also runs the journal forwarder the other service containers run, pushing to a receiver of its own on the swarm collector (serviceProducers swarm-authelia) as a new machine OIDC client (swarm.authelia.otel.clientId) that authelia registers for itself and the publisher carries to the store. The fetch unit reads it back under the publisher's leaf, also handed to it as a system credential, so the swarm-secret-publisher policy gains read on that one leaf; its stanza keeps create and update, which the exact path would otherwise take from the services/* prefix. Without the leaf the forwarder is off. The container drops --link-journal=host, and the host collector stops reading it. The services' "nothing at <path>" errors name the publisher in authelia's container. |
||
| .. | ||
| src | ||
| tests | ||
| Cargo.toml | ||
| README.md | ||
swarm-review-classifier
The review classifier's try-out service, in the swarm-review-classifier
container on the host that sets deploy.review-classifier.enable. The
design is docs/swarm/review-classifier.md.
swarm-controller reads a PR (its head commit, its commits and its diff) and sends it, with the operator's classifications, as a request on the queue. This service asks a small model one classification at a time and answers with the result table and the overall verdict. It writes nothing to the forge and holds no forge credential.
What a run is
- The shared context first: a system prompt, the PR's commits with their full
messages, and the diff with lockfiles collapsed as
hive-forge diffdoes. Every classification's prompt starts with the same bytes, andclaudegets that part as a content block of its own, with a cache breakpoint at its end. - One
claude --printper classification, with no session, no tools (--tools ""), no MCP server, its own empty directory andANTHROPIC_API_KEYin its environment only. - An answer is a JSON object with a verdict, a certainty and a reason; the
prompt asks for a reason under 350 characters, and the classifier truncates one over the 500 cap to 499 plus
…. A failed run, a timeout or an answer that doesn't validate leaves that row without a verdict, and it doesn't count. An answer that doesn't validate is asked for once more first, with a reminder to reply with the JSON object alone, within the same three minutes. - A run with no API key, or with no classification answered, fails as a whole: the caller sees an error, never a verdict.
Credentials
The container holds one credential: its own store certificate, which nspawn hands in at start without a copy on disk. With it the service reads its queue client secret at start and the API key at every run, so a key written or removed in the store takes effect on the next run. Its store role reads exactly those two paths.