add a per-agent nix builds mode, host or none, carried like privateUsers

hive-types/src/lib.rs

@@ -1,4 +1,4 @@
-//! Foundational shared types for the hyperhive workspace: [`Ident`], [`Permission`],
+//! Foundational shared types for the hyperhive workspace: [`Ident`], [`Permission`], [`NixBuilds`],
 //! the [`term_msg`] row markers and the [`review`] rule.
 //!
 //! A zero-dependency (bar `serde`) leaf crate so every wire-type crate
@@ -7,8 +7,10 @@
 //! and get serde-validated parsing at the socket boundary for free — with
 //! no cross-crate coupling and without growing `hive-sh4re`.
 
+mod nix_builds;
 mod permission;
 
+pub use nix_builds::NixBuilds;
 pub use permission::{Permission, deserialize_known};
 
 pub mod review;

hive-types/src/nix_builds.rs

@@ -0,0 +1,58 @@
+//! How an agent's nix builds run: [`NixBuilds`].
+//!
+//! Lives in this leaf crate because the same value is read by the swarm
+//! builder's reply, the closure record, `hive-c0re` and the `hive-priv` wire.
+
+use serde::{Deserialize, Serialize};
+
+/// Where an agent's nix builds run, as `services.hyperhive.agent.nixBuilds`
+/// sets it. Stored by its option spelling.
+///
+/// A spelling this build does not know reads as [`NixBuilds::Disabled`], so a
+/// record written by a newer swarm never fails to decode. An agent that asked
+/// for a mode this build lacks therefore gets no builds, never builds on the
+/// host daemon outside its limits.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
+pub enum NixBuilds {
+    /// Builds go to the host's nix-daemon, which runs them outside the agent
+    /// container's CPU and memory caps. The default.
+    #[default]
+    #[serde(rename = "host")]
+    Host,
+    /// The container cannot reach the host's nix-daemon, so it builds nothing.
+    #[serde(rename = "none", other)]
+    Disabled,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::NixBuilds;
+
+    #[test]
+    fn the_spellings_are_pinned() {
+        for (value, wire) in [(NixBuilds::Host, "host"), (NixBuilds::Disabled, "none")] {
+            assert_eq!(serde_json::to_value(value).expect("encodes"), wire);
+            assert_eq!(
+                serde_json::from_value::<NixBuilds>(serde_json::json!(wire)).expect("decodes"),
+                value
+            );
+        }
+    }
+
+    #[test]
+    fn the_default_is_the_host_daemon() {
+        assert_eq!(NixBuilds::default(), NixBuilds::Host);
+    }
+
+    /// A mode a newer swarm writes decodes, and as the one that builds nothing.
+    #[test]
+    fn an_unknown_spelling_reads_as_disabled() {
+        for unknown in ["container", "", "HOST"] {
+            assert_eq!(
+                serde_json::from_value::<NixBuilds>(serde_json::json!(unknown)).expect("decodes"),
+                NixBuilds::Disabled,
+                "{unknown:?}"
+            );
+        }
+    }
+}