mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-ui: set the review classifier's keys from the classifier settings

Browse source 
The classifier's Anthropic and ACP provider keys were written by hand in the
secret store's UI. The controller now stores them: GET
/api/review-classifier/keys says whether each is set and when it changed, and
PUT /api/review-classifier/keys/{runtime} writes one. No route answers a key.

The controller's store policy gains create and update on the two leaves with
no read of their values, and a metadata read for the set state. The swarm UI's
classifier settings card gets a key form beside the settings, saved apart
because it goes to the secret store.
This commit is contained in:
iris 2026-11-11 18:29:29 +01:00 • committed by mara
commit 6875a4f0f8
1 changed files with 628 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nix/module-eval/bao-grants.nix
View file

@ -1934,15 +1934,18 @@ let
# `forge::classifier_account` mints the review classifier's forge token
# and reads it back to decide on a re-mint and to post reviews. Pinned
# as the whole stanza, and spelled to the leaf, for the reason above.
name = "the controller's grant on the review classifier is its forge token alone";
name = "the controller's grant on the review classifier is its forge token, and a write-only inference key each";
ok =
let
s = baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
writeOnly = leaf: [
"path \"secret/data/swarm/services/review-classifier/${leaf}\" {\n capabilities = [\"create\", \"update\"]\n}"
"path \"secret/metadata/swarm/services/review-classifier/${leaf}\" {\n capabilities = [\"read\"]\n}"
];
in
lib.hasInfix "path \"secret/data/swarm/services/review-classifier/forge/token\" {\n capabilities = [\"create\", \"read\", \"update\"]\n}" s
&& !(lib.hasInfix "secret/data/swarm/services/review-classifier/*" s)
&& !(lib.hasInfix "secret/data/swarm/services/review-classifier/anthropic-api-key" s)
&& !(lib.hasInfix "secret/data/swarm/services/review-classifier/acp-provider" s);
&& lib.all (p: lib.hasInfix p s) (writeOnly "anthropic-api-key" ++ writeOnly "acp-provider")
&& !(lib.hasInfix "secret/data/swarm/services/review-classifier/*" s);
}
{
# The runner's role is the token's only reader. Its policy is that leaf