move the review classifier, agent login and inference types into swarm-wire

AGENTS.md

@@ -139,7 +139,7 @@ Swarm-level:
 - **`swarm-queue-client/`** — the one authenticated connect to the swarm
   NATS queue.
 - **`swarm-wire/`** — serde-only request and reply contracts services
-  exchange over the queue (builder, claude login), so naming one links
+  exchange over the queue (builder, claude login, review classifier, agent inference and login), so naming one links
   neither the queue client nor the store client.
 - **`swarm-nats-auth/`** — NATS auth-callout responder; without it the
   queue is fail-closed and admits nobody.

Cargo.lock

@@ -1692,6 +1692,7 @@ dependencies = [
  "swarm-agent-verify",
  "swarm-queue-client",
  "swarm-secret-client",
+ "swarm-wire",
  "tempfile",
  "tokio",
  "tokio-stream",
@@ -2060,6 +2061,7 @@ dependencies = [
  "swarm-agent-verify",
  "swarm-queue-client",
  "swarm-secret-client",
+ "swarm-wire",
  "tokio",
  "tracing",
  "tracing-subscriber",
@@ -5035,10 +5037,10 @@ dependencies = [
  "serde_json",
  "strum",
  "swarm-secret-client",
+ "swarm-wire",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
- "utoipa",
 ]
 
 [[package]]
@@ -5058,6 +5060,7 @@ dependencies = [
  "serde_json",
  "swarm-queue-client",
  "swarm-secret-client",
+ "swarm-wire",
  "tempfile",
  "tokio",
  "tracing",
@@ -5089,6 +5092,7 @@ version = "0.1.0"
 dependencies = [
  "serde",
  "serde_json",
+ "utoipa",
 ]
 
 [[package]]

docs/swarm/review-classifier.md

@@ -251,7 +251,7 @@ runtime's key by hand in the secret store
 
 The per-agent equivalent is [`inference.md`](inference.md), where the
 controller writes model and effort to a queue KV bucket
-(`swarm-queue-client/src/agent_inference.rs`) and each agent reads its own
+(`swarm-wire/src/agent_inference.rs`) and each agent reads its own
 key.
 
 ### The service account

frontend/packages/agent/src/types.ts

@@ -4,7 +4,7 @@
 // today, and the frontend only ever reads a handful of these fields.
 // Extend as more of the page gets rebuilt against real data.
 
-// Mirrors `swarm_queue_client::agent_inference::Source`.
+// Mirrors `swarm_wire::agent_inference::Source`.
 export type InferenceSource = "swarm" | "agent_nix" | "local_file" | "default";
 
 export interface AgentState {

frontend/packages/swarm-ui/src/agent/terminal/useSwarmAgentStateStream.ts

@@ -26,7 +26,7 @@ export interface TokenUsage {
   cache_creation_input_tokens?: number;
 }
 
-// `swarm_queue_client::agent_inference::Source`.
+// `swarm_wire::agent_inference::Source`.
 export type InferenceSource = "swarm" | "agent_nix" | "local_file" | "default";
 
 // Mirrors `hive_agent::swarm_agent_state::AgentStateMsg` field-for-field

hive-agent/Cargo.toml

@@ -54,6 +54,7 @@ swarm-queue-client = { workspace = true, features = [
 ] }
 # The spelling of the token the queue connection presents.
 swarm-agent-verify.workspace = true
+swarm-wire.workspace = true
 # This agent's own queue secret, read from the store under its own certificate.
 swarm-secret-client.workspace = true
 # The directory an AGENTS.md edit is applied in, and the file it is written

hive-agent/src/events.rs

@@ -16,7 +16,7 @@ use chrono::Utc;
 use hive_claude::TokenUsage;
 use rusqlite::{Connection, params};
 use serde::{Deserialize, Serialize};
-use swarm_queue_client::agent_inference::Source;
+use swarm_wire::agent_inference::Source;
 use tokio::sync::broadcast;
 
 use crate::harness_state::{

hive-agent/src/harness_state.rs

@@ -6,7 +6,7 @@
 
 use std::path::PathBuf;
 
-use swarm_queue_client::agent_inference::Source;
+use swarm_wire::agent_inference::Source;
 
 /// Path to the `hyperhive-model` file. The harness only reads it, as the
 /// fallback in [`local_model`]. Overridable via `HYPERHIVE_MODEL_FILE` for

hive-agent/src/swarm_agent_state.rs

@@ -33,9 +33,9 @@ use serde::Serialize;
 use tokio::sync::broadcast;
 use tokio::time::{Interval, MissedTickBehavior};
 
-use swarm_queue_client::agent_inference::Effective;
-use swarm_queue_client::agent_login::Login;
 use swarm_queue_client::wanted::AgentState;
+use swarm_wire::agent_inference::Effective;
+use swarm_wire::agent_login::Login;
 
 use crate::events::{Bus, BusEvent, LiveEvent, TurnState};
 use crate::login::LoginState;
@@ -337,8 +337,8 @@ mod tests {
     use crate::events::{BusEvent, LiveEvent, TurnState};
     use crate::login::LoginState;
     use std::sync::Mutex;
-    use swarm_queue_client::agent_inference::{Effective, Source};
     use swarm_queue_client::wanted::AgentState;
+    use swarm_wire::agent_inference::{Effective, Source};
     use tokio::sync::broadcast;
     use tokio::time::{Duration, Instant};
 
@@ -495,7 +495,7 @@ mod tests {
                 ..msg()
             })
             .expect("serialises");
-            let decoded: swarm_queue_client::agent_login::Login =
+            let decoded: swarm_wire::agent_login::Login =
                 serde_json::from_slice(&bytes).expect("decodes");
             assert_eq!(
                 decoded.needs_login,

hive-agent/src/swarm_inference.rs

@@ -24,7 +24,8 @@
 
 use std::time::Duration;
 
-use swarm_queue_client::agent_inference::{AgentInference, Effort, Read, Source, read_own};
+use swarm_queue_client::agent_inference::{Read, read_own};
+use swarm_wire::agent_inference::{AgentInference, Effort, Source};
 
 use crate::events::Bus;
 use crate::harness_state::{configured_effort, configured_model, local_effort, local_model};

hive-agent/src/web_ui/state.rs

@@ -2,7 +2,7 @@
 
 use axum::extract::State;
 use serde::Serialize;
-use swarm_queue_client::agent_inference::Source;
+use swarm_wire::agent_inference::Source;
 
 use crate::login::LoginState;
 use crate::login_session::drop_if_finished;

hive-subagent-mcp/Cargo.toml

@@ -36,6 +36,7 @@ swarm-queue-client = { workspace = true, features = [
 ] }
 # The spelling of the token the queue connection presents.
 swarm-agent-verify.workspace = true
+swarm-wire.workspace = true
 # The agent's own queue credential, read under its store identity.
 swarm-secret-client.workspace = true
 tokio.workspace = true

hive-subagent-mcp/src/session.rs

@@ -99,7 +99,7 @@ use hive_runtime::{
     AcpCommand, AcpRuntime, PermissionAsk, PermissionPolicy, Runtime as _, RuntimeSpec, TurnStop,
 };
 use hive_sh4re::permissions::Permission;
-use swarm_queue_client::agent_inference::AgentInference;
+use swarm_wire::agent_inference::AgentInference;
 use tokio::sync::oneshot;
 
 use crate::swarm_term::Output;

hive-subagent-mcp/src/swarm_models.rs

@@ -27,8 +27,9 @@ use std::sync::{Arc, OnceLock};
 use std::time::Duration;
 
 use hive_sh4re::permissions::Permission;
-use swarm_queue_client::agent_inference::{self, AgentInference, read_own};
+use swarm_queue_client::agent_inference::{self, read_own};
 use swarm_queue_client::agent_permissions::{self, HIVE_COPY_PATH, HiveCopy};
+use swarm_wire::agent_inference::AgentInference;
 
 use crate::swarm_term::{Target, connect};
 

nix/host-modules/swarm-nats.nix

@@ -902,7 +902,7 @@ in
                 # so it would cover every agent's) and no `$KV` write.
                 "--agent-token-publish-subject ${lib.escapeShellArg "\$\$JS.API.DIRECT.GET.KV_agent-schedules.\$\$KV.agent-schedules.{agent}"}"
                 # Its own key of the `agent-inference` KV bucket
-                # (`swarm_queue_client::agent_inference`), on the same terms.
+                # (`swarm_wire::agent_inference`), on the same terms.
                 "--agent-token-publish-subject ${lib.escapeShellArg "\$\$JS.API.DIRECT.GET.KV_agent-inference.\$\$KV.agent-inference.{agent}"}"
                 # Its own key of the `agent-permissions` KV bucket
                 # (`swarm_queue_client::agent_permissions`), on the same terms:

swarm-controller/Cargo.toml

@@ -104,22 +104,21 @@ swarm-controller-api = { workspace = true, features = ["schema"] }
 # config the crate spells.
 # `agent-term`: likewise every agent's terminal stream, plus the consumer it
 # replays that stream through.
-# `schema`: the review classifier try-out API serves the shapes the queue
-# carries.
 swarm-queue-client = { workspace = true, features = [
   "kv",
   "agent-permissions",
   "subagent-term",
   "agent-term",
-  "schema",
 ] }
 # `matrix_account.rs` writes the credential this daemon's route accepts. Same
 # crate the hive reads it back with, which is the point: the path, the field
 # name and the object's shape are agreements between the two ends, and a
 # second spelling here would be a store this hive could not read.
 swarm-secret-client.workspace = true
-# The builder and claude login subjects, requests and replies it sends.
+# The builder, claude login and review classifier subjects, requests and
-swarm-wire.workspace = true
+# replies it sends. `schema`: the review classifier try-out API serves the
+# same shapes, so they derive `ToSchema`.
+swarm-wire = { workspace = true, features = ["schema"] }
 # The appservice calls `matrix_account::agent_token` mints agents' accounts
 # with — shared with `swarm-matrix-ctl`, which pins the same device id.
 swarm-matrix-client.workspace = true

swarm-controller/src/agent_login.rs

@@ -12,7 +12,7 @@ use std::sync::{Arc, Mutex, PoisonError};
 use std::time::Duration;
 
 use futures_util::StreamExt as _;
-use swarm_queue_client::agent_login::Login;
+use swarm_wire::agent_login::Login;
 
 /// The latest login flag each agent reported, by agent.
 #[derive(Debug, Default)]

swarm-controller/src/archetypes.rs

@@ -195,7 +195,7 @@ pub(crate) struct ArchetypeView {
     /// As `PUT /api/agents/{name}/inference` takes them.
     #[serde(skip_serializing_if = "Option::is_none")]
     #[schema(value_type = Option<Object>)]
-    inference: Option<swarm_queue_client::agent_inference::AgentInference>,
+    inference: Option<swarm_wire::agent_inference::AgentInference>,
 }
 
 /// One archetype a source declared and this daemon refused.

swarm-controller/src/forge.rs

@@ -41,8 +41,8 @@ use std::sync::{Arc, OnceLock};
 use utoipa::ToSchema;
 
 use crate::webhook::DeliveryKind;
-use swarm_queue_client::review_classifier::Commit;
 use swarm_secret_client::stored_secret::StoredSecret;
+use swarm_wire::review_classifier::Commit;
 
 pub mod agent_token;
 mod api;

swarm-controller/src/inference.rs

@@ -3,7 +3,7 @@
 //! running on.
 //!
 //! Each agent's settings are one value under its own key of `agent-inference`
-//! (`swarm_queue_client::agent_inference`), which this daemon alone writes.
+//! (`swarm_wire::agent_inference`), which this daemon alone writes.
 //! The agent reads its key and applies each set field over its local value;
 //! an unset field leaves the local value in force.
 //!
@@ -23,7 +23,8 @@ use axum::http::StatusCode;
 use futures_util::StreamExt as _;
 use problem_details::ProblemDetails;
 use serde::{Deserialize, Serialize};
-use swarm_queue_client::agent_inference::{self, AgentInference, Effective, Effort, Source};
+use swarm_queue_client::agent_inference;
+use swarm_wire::agent_inference::{AgentInference, Effective, Effort, Source};
 use utoipa::ToSchema;
 
 use crate::routes::{AppState, error_problem, wanted_error_status};