vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

move the builder and claude login wire contracts into swarm-wire

Browse source
This commit is contained in:
atlas 2026-10-18 07:27:43 +02:00 • committed by mara
commit 0c3d128de1
23 changed files with 224 additions and 81 deletions
Download patch file Download diff file Expand all files Collapse all files

3
AGENTS.md
View file

@ -138,6 +138,9 @@ Swarm-level:
with **no identity** and a TLS failure that names no cause.
- **`swarm-queue-client/`** — the one authenticated connect to the swarm
NATS queue.
- **`swarm-wire/`** — serde-only request and reply contracts services
exchange over the queue (builder, claude login), so naming one links
neither the queue client nor the store client.
- **`swarm-nats-auth/`** — NATS auth-callout responder; without it the
queue is fail-closed and admits nobody.
- **`swarm-agent-verify/`** — checks a `swarm-agent.<agent>.<secret>`

12
Cargo.lock generated
View file

@ -4811,6 +4811,7 @@ dependencies = [
"serde_json",
"swarm-queue-client",
"swarm-secret-client",
"swarm-wire",
"tokio",
"tracing",
]
@ -4846,6 +4847,7 @@ dependencies = [
"serde_json",
"swarm-queue-client",
"swarm-secret-client",
"swarm-wire",
"tokio",
"tracing",
]
@ -4889,6 +4891,7 @@ dependencies = [
"swarm-matrix-client",
"swarm-queue-client",
"swarm-secret-client",
"swarm-wire",
"tempfile",
"tokio",
"tower",
@ -5010,6 +5013,7 @@ dependencies = [
"swarm-agent-verify",
"swarm-queue-client",
"swarm-secret-client",
"swarm-wire",
"tokio",
"tracing",
"tracing-subscriber",
@ -5076,6 +5080,14 @@ dependencies = [
"vaultrs",
]
[[package]]
name = "swarm-wire"
version = "0.1.0"
dependencies = [
"serde",
"serde_json",
]
[[package]]
name = "swarmctl"
version = "0.1.0"

2
Cargo.toml
View file

@ -43,6 +43,7 @@ members = [
"swarm-logs-auth",
"swarm-metrics-auth",
"swarm-secret-client",
"swarm-wire",
"swarmctl",
]
@ -118,6 +119,7 @@ swarm-controller-api = { path = "swarm-controller-api" }
swarm-matrix-client = { path = "swarm-matrix-client" }
swarm-queue-client = { path = "swarm-queue-client" }
swarm-secret-client = { path = "swarm-secret-client" }
swarm-wire = { path = "swarm-wire" }
thiserror = "2"
vaultrs = "0.8"
# vaultrs's transport crates. Direct dependencies because one endpoint is

3
swarm-builder/Cargo.toml
View file

@ -15,10 +15,11 @@ async-nats.workspace = true
futures-util.workspace = true
hive-log.workspace = true
serde_json.workspace = true
# The build subject and the shapes the controller sends and reads back.
swarm-queue-client.workspace = true
# The forge token and queue client secret paths, and the store login.
swarm-secret-client.workspace = true
# The build subject and the shapes the controller sends and reads back.
swarm-wire.workspace = true
tokio.workspace = true
tracing.workspace = true

4
swarm-builder/src/archetypes.rs
View file

@ -9,7 +9,7 @@ use std::path::PathBuf;
use std::process::Stdio;
use std::time::Duration;
use swarm_queue_client::builder::ArchetypesReply;
use swarm_wire::builder::ArchetypesReply;
/// What every evaluation is run with, fixed at start.
pub struct Evaluator {
@ -105,7 +105,7 @@ mod tests {
nix: PathBuf::from("nix"),
hyperhive: "/nix/store/h-source".to_owned(),
nixpkgs: "/nix/store/n-source".to_owned(),
deadline: swarm_queue_client::builder::ARCHETYPES_DEADLINE,
deadline: swarm_wire::builder::ARCHETYPES_DEADLINE,
}
}

16
swarm-builder/src/main.rs
View file

@ -1,11 +1,11 @@
//! The swarm builder's build service.
//!
//! Connects to the swarm queue as its own OIDC client, takes build requests
//! from swarm-controller on [`swarm_queue_client::builder::SUBJECT`], builds
//! from swarm-controller on [`swarm_wire::builder::SUBJECT`], builds
//! each agent config at its commit, answers on the request's reply subject,
//! and logs one line per build. It writes nothing to the forge: the
//! controller turns the reply into a commit status. It also answers
//! [`swarm_queue_client::builder::ARCHETYPES_SUBJECT`] with the agent
//! [`swarm_wire::builder::ARCHETYPES_SUBJECT`] with the agent
//! archetypes its hyperhive source declares, which the controller stores.
//!
//! The store identity comes from the `BAO_*` environment. The queue client
@ -19,13 +19,13 @@ use std::time::Duration;
use anyhow::{Context, Result, anyhow, bail};
use futures_util::StreamExt as _;
use swarm_queue_client::builder::{
ARCHETYPES_DEADLINE, ARCHETYPES_SUBJECT, BUILD_DEADLINE, BuildAgent, QUEUE_GROUP,
REPLY_DEADLINE, Reply, SUBJECT,
};
use swarm_queue_client::{ClientSecret, QueueConfig};
use swarm_secret_client::forge::Credential;
use swarm_secret_client::stored_secret::StoredSecret;
use swarm_wire::builder::{
ARCHETYPES_DEADLINE, ARCHETYPES_SUBJECT, BUILD_DEADLINE, BuildAgent, QUEUE_GROUP,
REPLY_DEADLINE, Reply, SUBJECT,
};
mod archetypes;
mod nix_build;
@ -168,10 +168,10 @@ async fn answer_evaluations(
};
let reply = evaluator.eval().await;
match &reply {
swarm_queue_client::builder::ArchetypesReply::Evaluated { archetypes, .. } => {
swarm_wire::builder::ArchetypesReply::Evaluated { archetypes, .. } => {
tracing::info!(count = archetypes.len(), "archetypes evaluated");
}
swarm_queue_client::builder::ArchetypesReply::Failed { error_tail } => {
swarm_wire::builder::ArchetypesReply::Failed { error_tail } => {
tracing::warn!(%error_tail, "archetype evaluation failed");
}
}

4
swarm-builder/src/nix_build.rs
View file

@ -16,7 +16,7 @@ use std::path::PathBuf;
use std::process::Stdio;
use std::time::Duration;
use swarm_queue_client::builder::{BuildAgent, Reply};
use swarm_wire::builder::{BuildAgent, Reply};
use tokio::io::AsyncReadExt as _;
/// The most of `nix`'s stderr a failed build's reply carries, from its end.
@ -293,7 +293,7 @@ pub(crate) fn tail(stderr: &str, status: std::process::ExitStatus) -> String {
#[cfg(test)]
mod tests {
use super::*;
use swarm_queue_client::builder::BUILD_DEADLINE;
use swarm_wire::builder::BUILD_DEADLINE;
fn job() -> BuildAgent {
BuildAgent {

2
swarm-claude-login/Cargo.toml
View file

@ -21,6 +21,8 @@ hive-types.workspace = true
swarm-queue-client.workspace = true
# The credentials and queue client secret paths, and the store login.
swarm-secret-client.workspace = true
# The login subject and the requests and replies it carries.
swarm-wire.workspace = true
tokio.workspace = true
tracing.workspace = true

2
swarm-claude-login/src/login.rs
View file

@ -14,8 +14,8 @@ use std::process::Stdio;
use std::sync::Arc;
use std::time::Duration;
use swarm_queue_client::claude_login::Reply;
use swarm_secret_client::claude_login::Credentials;
use swarm_wire::claude_login::Reply;
use tokio::io::{AsyncBufReadExt as _, AsyncRead, AsyncWriteExt as _, BufReader};
use tokio::process::{Child, ChildStdin, Command};
use tokio::sync::{Mutex, watch};

6
swarm-claude-login/src/main.rs
View file

@ -2,7 +2,7 @@
//!
//! Connects to the swarm queue as its own OIDC client, takes an operator's
//! login steps from swarm-controller on
//! [`swarm_queue_client::claude_login::SUBJECT`], runs `claude auth login`
//! [`swarm_wire::claude_login::SUBJECT`], runs `claude auth login`
//! for the agent named ([`login`]), and writes the credentials it produces to
//! that agent's store leaf, a new version over any stored before. The agent's
//! harness takes a version newer than the one it last installed.
@ -16,10 +16,10 @@ use std::sync::Arc;
use anyhow::{Context, Result, bail};
use futures_util::StreamExt as _;
use swarm_queue_client::claude_login::{Reply, Request, SESSION_DEADLINE, STEP_DEADLINE, SUBJECT};
use swarm_queue_client::{ClientSecret, QueueConfig};
use swarm_secret_client::claude_login::{Credentials, client_secret_path, credentials_path};
use swarm_secret_client::stored_secret::StoredSecret;
use swarm_wire::claude_login::{Reply, Request, SESSION_DEADLINE, STEP_DEADLINE, SUBJECT};
mod login;
@ -190,7 +190,7 @@ mod tests {
use std::sync::Arc;
use std::time::Duration;
use swarm_queue_client::claude_login::{Reply, Request};
use swarm_wire::claude_login::{Reply, Request};
use super::{handle, login};

2
swarm-controller/Cargo.toml
View file

@ -118,6 +118,8 @@ swarm-queue-client = { workspace = true, features = [
# name and the object's shape are agreements between the two ends, and a
# second spelling here would be a store this hive could not read.
swarm-secret-client.workspace = true
# The builder and claude login subjects, requests and replies it sends.
swarm-wire.workspace = true
# The appservice calls `matrix_account::agent_token` mints agents' accounts
# with — shared with `swarm-matrix-ctl`, which pins the same device id.
swarm-matrix-client.workspace = true

4
swarm-controller/src/archetypes.rs
View file

@ -16,7 +16,7 @@ use hive_sh4re::permissions::Permission;
use problem_details::ProblemDetails;
use serde::{Deserialize, Serialize};
use swarm_queue_client::archetypes::{ArchetypeMeta, BUILTIN_SOURCE, SourceRecord};
use swarm_queue_client::builder::{
use swarm_wire::builder::{
ARCHETYPES_DEADLINE, ARCHETYPES_SUBJECT, ArchetypesReply, EvalArchetypes,
};
use utoipa::ToSchema;
@ -361,7 +361,7 @@ mod tests {
let mut requests = builder
.queue_subscribe(
ARCHETYPES_SUBJECT,
swarm_queue_client::builder::QUEUE_GROUP.to_owned(),
swarm_wire::builder::QUEUE_GROUP.to_owned(),
)
.await
.expect("subscribe");

4
swarm-controller/src/builder.rs
View file

@ -16,7 +16,7 @@ use std::future::Future;
use forgejo_api::structs::CommitStatusState;
use hive_jobq::scheduler::Outcome;
use swarm_queue_client::builder::{BuildAgent, REPLY_DEADLINE, Reply, SUBJECT};
use swarm_wire::builder::{BuildAgent, REPLY_DEADLINE, Reply, SUBJECT};
use crate::agent_renewal::unix_now;
use crate::forge::{self, CONFIG_ORG};
@ -534,7 +534,7 @@ mod tests {
let builder = nats.client().await;
let mut requests = builder
.queue_subscribe(SUBJECT, swarm_queue_client::builder::QUEUE_GROUP.to_owned())
.queue_subscribe(SUBJECT, swarm_wire::builder::QUEUE_GROUP.to_owned())
.await
.expect("subscribe");
// A message the builder sends itself and receives back proves the

4
swarm-controller/src/claude_login.rs
View file

@ -21,7 +21,7 @@ use axum::extract::{Path, State};
use axum::http::{HeaderMap, StatusCode};
use problem_details::ProblemDetails;
use serde::{Deserialize, Serialize};
use swarm_queue_client::claude_login::{REPLY_DEADLINE, Reply, Request, SUBJECT};
use swarm_wire::claude_login::{REPLY_DEADLINE, Reply, Request, SUBJECT};
use utoipa::ToSchema;
use crate::{AppState, error_problem};
@ -243,7 +243,7 @@ mod tests {
use std::sync::Mutex;
use axum::http::StatusCode;
use swarm_queue_client::claude_login::{Reply, Request};
use swarm_wire::claude_login::{Reply, Request};
use super::{LoginSink, relay};

2
swarm-controller/src/main.rs
View file

@ -601,7 +601,7 @@ async fn build_agent(
rev: String,
pr: u64,
) -> hive_jobq::scheduler::Outcome {
let job = swarm_queue_client::builder::BuildAgent { agent, rev, pr };
let job = swarm_wire::builder::BuildAgent { agent, rev, pr };
let builds = builder::runs::Builds::Live(deps.queue.clone());
let link_base = std::env::var(PUBLIC_URL_ENV).ok();
builder::run(

2
swarm-nats-auth/Cargo.toml
View file

@ -33,6 +33,8 @@ swarm-queue-client = { workspace = true, features = ["notices"] }
# credentials `swarm-agent-verify` checks a presented token against.
swarm-secret-client.workspace = true
swarm-agent-verify.workspace = true
# The builder and login subjects it grants.
swarm-wire.workspace = true
tokio.workspace = true
tracing.workspace = true
tracing-subscriber.workspace = true

26
swarm-nats-auth/src/policy.rs
View file

@ -281,11 +281,11 @@ impl Policy {
Permissions {
publish: vec![Self::inbox(client_id)],
subscribe: Some(vec![
swarm_queue_client::builder::SUBJECT.to_owned(),
swarm_queue_client::builder::ARCHETYPES_SUBJECT.to_owned(),
swarm_wire::builder::SUBJECT.to_owned(),
swarm_wire::builder::ARCHETYPES_SUBJECT.to_owned(),
Self::inbox(client_id),
]),
responses: Some(swarm_queue_client::builder::REPLY_DEADLINE),
responses: Some(swarm_wire::builder::REPLY_DEADLINE),
}
}
@ -296,10 +296,10 @@ impl Policy {
Permissions {
publish: vec![Self::inbox(client_id)],
subscribe: Some(vec![
swarm_queue_client::claude_login::SUBJECT.to_owned(),
swarm_wire::claude_login::SUBJECT.to_owned(),
Self::inbox(client_id),
]),
responses: Some(swarm_queue_client::claude_login::REPLY_DEADLINE),
responses: Some(swarm_wire::claude_login::REPLY_DEADLINE),
}
}
@ -661,11 +661,11 @@ impl Policy {
// back on this client's inbox, which it already subscribes to.
swarm_queue_client::review_classifier::SUBJECT.to_owned(),
// A build of an agent config, sent as a request the same way.
swarm_queue_client::builder::SUBJECT.to_owned(),
swarm_wire::builder::SUBJECT.to_owned(),
// An archetype evaluation, sent as a request the same way.
swarm_queue_client::builder::ARCHETYPES_SUBJECT.to_owned(),
swarm_wire::builder::ARCHETYPES_SUBJECT.to_owned(),
// An operator's claude login step, sent as a request the same way.
swarm_queue_client::claude_login::SUBJECT.to_owned(),
swarm_wire::claude_login::SUBJECT.to_owned(),
// The wanted-state buckets — one per hive, all created and written
// by this single client.
//
@ -1532,8 +1532,8 @@ mod tests {
#[test]
fn the_builder_hears_its_subject_and_inbox_only_and_answers_by_reply() {
use swarm_queue_client::builder::{ARCHETYPES_SUBJECT, REPLY_DEADLINE, SUBJECT};
use swarm_queue_client::client_inbox_prefix;
use swarm_wire::builder::{ARCHETYPES_SUBJECT, REPLY_DEADLINE, SUBJECT};
let p = policy()
.with_builders(vec![BUILDER.to_owned()])
@ -1562,7 +1562,7 @@ mod tests {
#[test]
fn only_the_reader_may_send_a_build() {
use swarm_queue_client::builder::{ARCHETYPES_SUBJECT, SUBJECT};
use swarm_wire::builder::{ARCHETYPES_SUBJECT, SUBJECT};
let p = with_classifier().with_builders(vec![BUILDER.to_owned()]);
let reader = p.permissions("swarm-controller").expect("the reader");
@ -1589,8 +1589,8 @@ mod tests {
#[test]
fn the_claude_login_minter_hears_its_subject_and_inbox_only_and_answers_by_reply() {
use swarm_queue_client::claude_login::{REPLY_DEADLINE, SUBJECT};
use swarm_queue_client::client_inbox_prefix;
use swarm_wire::claude_login::{REPLY_DEADLINE, SUBJECT};
let p = policy()
.with_claude_logins(vec![CLAUDE_LOGIN.to_owned()])
@ -1602,7 +1602,7 @@ mod tests {
for refused in [
">".to_owned(),
"$SWARM.>".to_owned(),
swarm_queue_client::builder::SUBJECT.to_owned(),
swarm_wire::builder::SUBJECT.to_owned(),
reply(&client_inbox_prefix("swarm-controller")),
] {
assert!(
@ -1618,7 +1618,7 @@ mod tests {
#[test]
fn only_the_reader_may_send_a_login_step() {
use swarm_queue_client::claude_login::SUBJECT;
use swarm_wire::claude_login::SUBJECT;
let p = with_classifier()
.with_builders(vec![BUILDER.to_owned()])

2
swarm-queue-client/src/archetypes.rs
View file

@ -4,7 +4,7 @@
//!
//! **swarm-controller is the only writer and the only reader.** The swarm
//! builder evaluates the source and answers on
//! [`crate::builder::ARCHETYPES_SUBJECT`]; the controller checks each
//! `swarm_wire::builder::ARCHETYPES_SUBJECT`; the controller checks each
//! archetype's settings the way `POST /api/agents` checks them and writes the
//! result here, so the create screen lists archetypes from a value that a
//! create would accept.

7
swarm-queue-client/src/lib.rs
View file

@ -494,13 +494,6 @@ pub mod review_classifier;
mod startup_read;
pub use startup_read::read_with_startup_retry;
/// The builder's build subject and the request and reply it carries.
pub mod builder;
/// The claude login minter's subject and the requests and replies it
/// carries.
pub mod claude_login;
/// Only the fields this needs; authelia returns several.
#[derive(serde::Deserialize)]
struct TokenResponse {

11
swarm-wire/Cargo.toml Normal file
View file

@ -0,0 +1,11 @@
[package]
name = "swarm-wire"
version.workspace = true
edition.workspace = true
[dependencies]
serde.workspace = true
serde_json.workspace = true
[lints]
workspace = true

111
swarm-queue-client/src/builder.rs → swarm-wire/src/builder.rs
View file

@ -82,40 +82,97 @@ pub enum ArchetypesReply {
#[cfg(test)]
mod tests {
use serde_json::json;
use super::*;
#[test]
fn the_wire_tags_the_reply_by_state() {
let json = serde_json::to_value(Reply::Built {
out_path: "/nix/store/x".to_owned(),
})
.expect("encodes");
assert_eq!(json["state"], "built");
assert_eq!(json["out_path"], "/nix/store/x");
let json = serde_json::to_value(Reply::Failed {
error_tail: "e".to_owned(),
})
.expect("encodes");
assert_eq!(json["state"], "failed");
fn the_build_request_serializes_as_pinned() {
let req = BuildAgent {
agent: "atlas".to_owned(),
rev: "abc".to_owned(),
pr: 7,
};
let value = serde_json::to_value(&req).expect("encodes");
assert_eq!(value, json!({"agent": "atlas", "rev": "abc", "pr": 7}));
assert_eq!(
serde_json::from_value::<BuildAgent>(value).expect("decodes"),
req
);
}
#[test]
fn the_reply_serializes_as_pinned() {
for (reply, wire) in [
(
Reply::Built {
out_path: "/nix/store/x".to_owned(),
},
json!({"state": "built", "out_path": "/nix/store/x"}),
),
(
Reply::Failed {
error_tail: "e".to_owned(),
},
json!({"state": "failed", "error_tail": "e"}),
),
] {
assert_eq!(serde_json::to_value(&reply).expect("encodes"), wire);
assert_eq!(
serde_json::from_value::<Reply>(wire).expect("decodes"),
reply
);
}
}
#[test]
fn the_archetypes_request_and_reply_serialize_as_pinned() {
let req = EvalArchetypes::default();
let value = serde_json::to_value(&req).expect("encodes");
assert_eq!(value, json!({}));
assert_eq!(
serde_json::from_value::<EvalArchetypes>(value).expect("decodes"),
req
);
let mut archetypes = serde_json::Map::new();
archetypes.insert("coder".to_owned(), json!({"description": "d"}));
for (reply, wire) in [
(
ArchetypesReply::Evaluated {
source: "/nix/store/h".to_owned(),
archetypes,
},
json!({
"state": "evaluated",
"source": "/nix/store/h",
"archetypes": {"coder": {"description": "d"}},
}),
),
(
ArchetypesReply::Failed {
error_tail: "e".to_owned(),
},
json!({"state": "failed", "error_tail": "e"}),
),
] {
assert_eq!(serde_json::to_value(&reply).expect("encodes"), wire);
assert_eq!(
serde_json::from_value::<ArchetypesReply>(wire).expect("decodes"),
reply
);
}
}
#[test]
fn the_subjects_are_pinned() {
assert_eq!(SUBJECT, "$SWARM.builder.build");
assert_eq!(ARCHETYPES_SUBJECT, "$SWARM.builder.archetypes");
assert_eq!(QUEUE_GROUP, "builder");
}
#[test]
fn the_reply_deadline_outlasts_the_build() {
assert!(REPLY_DEADLINE > BUILD_DEADLINE);
}
#[test]
fn the_archetypes_reply_is_tagged_by_state() {
let json = serde_json::to_value(ArchetypesReply::Evaluated {
source: "/nix/store/h".to_owned(),
archetypes: serde_json::Map::new(),
})
.expect("encodes");
assert_eq!(json["state"], "evaluated");
let json = serde_json::to_value(ArchetypesReply::Failed {
error_tail: "e".to_owned(),
})
.expect("encodes");
assert_eq!(json["state"], "failed");
}
}

69
swarm-queue-client/src/claude_login.rs → swarm-wire/src/claude_login.rs
View file

@ -71,19 +71,68 @@ pub enum Reply {
#[cfg(test)]
mod tests {
use serde_json::json;
use super::*;
#[test]
fn the_wire_tags_the_request_by_step_and_the_reply_by_state() {
let json = serde_json::to_value(Request::Code {
agent: "atlas".to_owned(),
code: "c".to_owned(),
})
.expect("encodes");
assert_eq!(json["step"], "code");
assert_eq!(json["agent"], "atlas");
let json = serde_json::to_value(Reply::Stored).expect("encodes");
assert_eq!(json["state"], "stored");
fn the_request_serializes_as_pinned() {
for (req, wire) in [
(
Request::Start {
agent: "atlas".to_owned(),
operator: "mara".to_owned(),
},
json!({"step": "start", "agent": "atlas", "operator": "mara"}),
),
(
Request::Code {
agent: "atlas".to_owned(),
code: "c".to_owned(),
},
json!({"step": "code", "agent": "atlas", "code": "c"}),
),
(
Request::Cancel {
agent: "atlas".to_owned(),
},
json!({"step": "cancel", "agent": "atlas"}),
),
] {
assert_eq!(serde_json::to_value(&req).expect("encodes"), wire);
assert!(serde_json::from_value::<Request>(wire).expect("decodes") == req);
}
}
#[test]
fn the_reply_serializes_as_pinned() {
for (reply, wire) in [
(
Reply::Started {
url: "https://u".to_owned(),
},
json!({"state": "started", "url": "https://u"}),
),
(Reply::Stored, json!({"state": "stored"})),
(Reply::Cancelled, json!({"state": "cancelled"})),
(
Reply::Failed {
error: "e".to_owned(),
},
json!({"state": "failed", "error": "e"}),
),
] {
assert_eq!(serde_json::to_value(&reply).expect("encodes"), wire);
assert_eq!(
serde_json::from_value::<Reply>(wire).expect("decodes"),
reply
);
}
}
#[test]
fn the_subject_is_pinned() {
assert_eq!(SUBJECT, "$SWARM.claude-login.request");
}
#[test]

9
swarm-wire/src/lib.rs Normal file
View file

@ -0,0 +1,9 @@
//! The request and reply shapes swarm services exchange over the queue: the
//! subjects, their deadlines and the serde types that travel each way.
//!
//! Serde only, with no queue client and no secret-store client. A crate that
//! names a contract (the sender, the answerer, the auth-callout responder that
//! grants the subject) depends on this one without linking either.
pub mod builder;
pub mod claude_login;