add a per-agent nix builds mode, host or none, carried like privateUsers

hive-priv-sock/src/lib.rs

@@ -10,6 +10,7 @@
 //! audit. No server/client implementation lives here, only the wire
 //! contract (mirrors `hive-host-sock`'s split for the host admin socket).
 
+use hive_types::NixBuilds;
 use serde::{Deserialize, Serialize};
 
 /// Default socket path for the privileged helper.
@@ -350,6 +351,16 @@ pub enum PrivRequest {
         /// agent as it is: namespaced if hive-priv moved its data, else not.
         #[serde(default)]
         private_users: Option<bool>,
+        /// Whether the container may reach the host's nix-daemon, as the
+        /// swarm builder recorded the agent's `services.hyperhive.agent.nixBuilds`.
+        /// `Some(NixBuilds::Disabled)` has hive-priv shadow the daemon socket
+        /// directory with an empty tmpfs. `None`, which is what a hive-c0re
+        /// without the field or without a readable record sends, keeps the
+        /// agent as the last write left it, so a swarm outage never turns an
+        /// agent's host builds on. An agent never written before gets the
+        /// host daemon.
+        #[serde(default)]
+        nix_builds: Option<NixBuilds>,
     },
 
     /// Create the agent's socket dir `/run/hive-agent/<name>` as `0751
@@ -718,6 +729,8 @@ pub enum PrivEvent {
 
 #[cfg(test)]
 mod tests {
+    use hive_types::NixBuilds;
+
     use super::{InfraContainer, PrivRequest, valid_closure_path, valid_meta_rev};
 
     /// A request from a hive-c0re that predates the field decodes with the
@@ -746,6 +759,42 @@ mod tests {
             assert_eq!(private_users, want);
         }
     }
+    /// The nix-builds mode is optional on the wire: a request from a hive-c0re
+    /// that predates the field reads as `None`, the field round-trips, and a
+    /// mode this build does not know reads as the one that builds nothing.
+    #[test]
+    fn nix_builds_is_optional_on_the_wire() {
+        let request = |extra: Option<(&str, serde_json::Value)>| {
+            let mut wire = serde_json::json!({
+                "op": "write_nspawn_flags",
+                "container": "h-iris",
+                "binds": [],
+                "isolation": {"bridge": "hive0", "gateway_ip": "10.42.0.1"},
+            });
+            if let Some((key, value)) = extra {
+                wire[key] = value;
+            }
+            let PrivRequest::WriteNspawnFlags { nix_builds, .. } =
+                serde_json::from_value(wire).expect("decodes")
+            else {
+                panic!("variant");
+            };
+            nix_builds
+        };
+        assert_eq!(request(None), None);
+        for (spelling, want) in [
+            ("host", NixBuilds::Host),
+            ("none", NixBuilds::Disabled),
+            ("container", NixBuilds::Disabled),
+        ] {
+            assert_eq!(
+                request(Some(("nix_builds", spelling.into()))),
+                Some(want),
+                "{spelling}"
+            );
+        }
+    }
+
     #[test]
     fn infra_control_names_no_c0re_or_swarm_service() {
         // Neither the daemon nor the swarm's forge and matrix have a