vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

archetypes: reviewer holds execution so it can run hive-forge and git

Browse source 
The reviewer now has messaging, inbox and execution. execution is what
gives an agent the bash server, without which it cannot run hive-forge
or git to read a PR and post a review. meta is dropped: get_agent_meta
is not part of reviewing a PR.

Refs #5386
This commit is contained in:
atlas 2026-10-17 00:38:13 +02:00 • committed by mara
commit 0382c65386
3 changed files with 11 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/swarm/archetypes.md
View file

@ -14,8 +14,8 @@ fields as the form shows them. Nothing records which archetype you picked.
The hyperhive flake ships these:
| archetype | what it sets |
| ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| `reviewer` | permissions `messaging`, `meta`, `inbox`: the default set without `execution`. It has no shell, so it can't run `hive-forge`, `git` or any command. |
| ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| `reviewer` | permissions `messaging`, `inbox`, `execution`: the default set without `meta`. With `execution` it can run `hive-forge`, `git` and other commands. |
## Where an archetype comes from
@ -26,7 +26,7 @@ hyperhiveArchetypes.reviewer = {
module = { };
meta = {
description = "Reviews what it is sent.";
permissions = [ "messaging" "meta" "inbox" ];
permissions = [ "messaging" "inbox" "execution" ];
limits = { memory_max = "4G"; };
inference = { effort = "high"; };
};
@ -79,7 +79,7 @@ The stored value:
"archetypes": {
"reviewer": {
"description": "…",
"permissions": ["messaging", "meta", "inbox"]
"permissions": ["messaging", "inbox", "execution"]
}
},
"refused": { "broken": "limits: …" }

4
nix/archetypes/default.nix
View file

@ -9,11 +9,11 @@
reviewer = {
module = { };
meta = {
description = "Reviews what it is sent. No shell: it holds the default permissions minus execution, so it cannot run hive-forge, git or any other command.";
description = "Reviews pull requests and replies. It can run hive-forge and git (execution), and holds messaging and inbox; it has no get_agent_meta (meta).";
permissions = [
"messaging"
"meta"
"inbox"
"execution"
];
};
};

6
nix/module-eval/builder.nix
View file

@ -126,7 +126,7 @@ let
# output and prints it as JSON. A derivation or a path in `meta` would
# make that evaluation build or copy something; a function would not
# print at all.
name = "the built-in archetypes carry a module and a meta of plain data, and reviewer has no shell";
name = "the built-in archetypes carry a module and a meta of plain data, and reviewer can run commands";
ok =
let
plain =
@ -146,7 +146,9 @@ let
lib.all (a: a ? module && a.meta.description != "") (lib.attrValues archetypes)
&& plain metas
&& lib.elem "messaging" reviewer
&& !(lib.elem "execution" reviewer);
&& lib.elem "inbox" reviewer
&& lib.elem "execution" reviewer
&& !(lib.elem "meta" reviewer);
}
{
# The responder denies a client id it does not know, and a NATS denial