vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

archetypes: reviewer holds execution so it can run hive-forge and git

Browse source 
The reviewer now has messaging, inbox and execution. execution is what
gives an agent the bash server, without which it cannot run hive-forge
or git to read a PR and post a review. meta is dropped: get_agent_meta
is not part of reviewing a PR.

Refs #5386
This commit is contained in:
atlas 2026-10-17 00:38:13 +02:00 • committed by mara
commit 0382c65386
3 changed files with 11 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

10
docs/swarm/archetypes.md
View file

@ -13,9 +13,9 @@ fields as the form shows them. Nothing records which archetype you picked.
The hyperhive flake ships these: The hyperhive flake ships these:
| archetype | what it sets | | archetype | what it sets |
| ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| `reviewer` | permissions `messaging`, `meta`, `inbox`: the default set without `execution`. It has no shell, so it can't run `hive-forge`, `git` or any command. | | `reviewer` | permissions `messaging`, `inbox`, `execution`: the default set without `meta`. With `execution` it can run `hive-forge`, `git` and other commands. |
## Where an archetype comes from ## Where an archetype comes from
@ -26,7 +26,7 @@ hyperhiveArchetypes.reviewer = {
module = { }; module = { };
meta = { meta = {
description = "Reviews what it is sent."; description = "Reviews what it is sent.";
permissions = [ "messaging" "meta" "inbox" ]; permissions = [ "messaging" "inbox" "execution" ];
limits = { memory_max = "4G"; }; limits = { memory_max = "4G"; };
inference = { effort = "high"; }; inference = { effort = "high"; };
}; };
@ -79,7 +79,7 @@ The stored value:
"archetypes": { "archetypes": {
"reviewer": { "reviewer": {
"description": "…", "description": "…",
"permissions": ["messaging", "meta", "inbox"] "permissions": ["messaging", "inbox", "execution"]
} }
}, },
"refused": { "broken": "limits: …" } "refused": { "broken": "limits: …" }

4
nix/archetypes/default.nix
View file

@ -9,11 +9,11 @@
reviewer = { reviewer = {
module = { }; module = { };
meta = { meta = {
description = "Reviews what it is sent. No shell: it holds the default permissions minus execution, so it cannot run hive-forge, git or any other command."; description = "Reviews pull requests and replies. It can run hive-forge and git (execution), and holds messaging and inbox; it has no get_agent_meta (meta).";
permissions = [ permissions = [
"messaging" "messaging"
"meta"
"inbox" "inbox"
"execution"
]; ];
}; };
}; };

6
nix/module-eval/builder.nix
View file

@ -126,7 +126,7 @@ let
# output and prints it as JSON. A derivation or a path in `meta` would # output and prints it as JSON. A derivation or a path in `meta` would
# make that evaluation build or copy something; a function would not # make that evaluation build or copy something; a function would not
# print at all. # print at all.
name = "the built-in archetypes carry a module and a meta of plain data, and reviewer has no shell"; name = "the built-in archetypes carry a module and a meta of plain data, and reviewer can run commands";
ok = ok =
let let
plain = plain =
@ -146,7 +146,9 @@ let
lib.all (a: a ? module && a.meta.description != "") (lib.attrValues archetypes) lib.all (a: a ? module && a.meta.description != "") (lib.attrValues archetypes)
&& plain metas && plain metas
&& lib.elem "messaging" reviewer && lib.elem "messaging" reviewer
&& !(lib.elem "execution" reviewer); && lib.elem "inbox" reviewer
&& lib.elem "execution" reviewer
&& !(lib.elem "meta" reviewer);
} }
{ {
# The responder denies a client id it does not know, and a NATS denial # The responder denies a client id it does not know, and a NATS denial