feat(#791): add request_init_config + request_apply_commit to AgentServer (topology-scoped)

hive-ag3nt/prompts/system.md

@@ -45,6 +45,8 @@ Tools (hyperhive surface):
 - `mcp__hyperhive__restart(name)` — *(requires `lifecycle` tool group)* restart a direct child sub-agent (stop + start). The server enforces topology: the call is rejected unless `name` is a direct child of yours per `topology.json`. No approval required.
 - `mcp__hyperhive__kill(name)` — *(requires `lifecycle` tool group)* stop a direct child sub-agent (graceful). Direct children only — server enforces topology. State dir kept; recreating reuses prior config + credentials. No approval required.
 - `mcp__hyperhive__update(name)` — *(requires `lifecycle` tool group)* rebuild a direct child sub-agent: re-applies the current hyperhive flake + agent.nix and restarts it. Direct children only — server enforces topology. No approval required. Idempotent.
+- `mcp__hyperhive__request_init_config(name, description?)` — *(requires `approvals` tool group)* initialise a brand-new direct child agent's proposed config repo. Queues an `InitConfig` approval; on approval hive-c0re seeds `/agents/<name>/config/agent.nix`. `name` must be a direct child in the topology tree — server enforces. Fails if the config repo already exists (use `request_apply_commit` instead).
+- `mcp__hyperhive__request_apply_commit(agent, commit_ref, description?)` — *(requires `approvals` tool group)* submit a config commit for a direct child agent, queued for operator approval. `agent` must be a direct child in the topology tree — server enforces. `commit_ref` must be a 7-40 char hex sha (not a branch/tag name). On approval hive-c0re rebuilds the container with the pinned commit.
 
 Need new packages, env vars, or other NixOS config for yourself? You can't edit your own config directly — message the manager (recipient `root`) describing what you need + why. The manager evaluates the request (it doesn't rubber-stamp), edits `/agents/{label}/config/agent.nix` on your behalf, commits, and submits an approval that the operator can accept on the dashboard; on approve hive-c0re rebuilds your container with the new config.
 

hive-ag3nt/src/mcp.rs

@@ -1047,6 +1047,83 @@ impl AgentServer {
         })
         .await
     }
+
+    // IMPORTANT: this tool is only available when the `approvals` tool group
+    // is configured for the agent (`HIVE_TOOL_GROUPS` contains `approvals`).
+    // hive-c0re performs a topology check server-side: only direct children
+    // of the calling agent are accepted; all other names are rejected.
+    #[tool(
+        description = "Initialise a brand-new direct child agent's proposed config repo and \
+            queue an `InitConfig` approval for the operator to review. Requires the `approvals` \
+            tool group. `name` must be a direct child of this agent in the topology tree. \
+            Fails if a config repo for that child already exists — use `request_apply_commit` \
+            to update an existing agent's config. On approval hive-c0re seeds \
+            `/agents/<name>/config/agent.nix` with the default template so you can \
+            customise it and then call `request_apply_commit` with the commit sha."
+    )]
+    async fn request_init_config(
+        &self,
+        Parameters(args): Parameters<RequestInitConfigArgs>,
+    ) -> String {
+        let log = format!("{args:?}");
+        let name = args.name.clone();
+        run_tool_envelope("request_init_config", log, async move {
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::AgentRequest::RequestInitConfig {
+                    name: args.name,
+                    description: args.description,
+                })
+                .await;
+            annotate_retries(
+                format_ack(
+                    resp,
+                    "request_init_config",
+                    format!("init_config approval queued for {name}"),
+                ),
+                retries,
+            )
+        })
+        .await
+    }
+
+    // IMPORTANT: this tool is only available when the `approvals` tool group
+    // is configured for the agent (`HIVE_TOOL_GROUPS` contains `approvals`).
+    // hive-c0re performs a topology check server-side: only direct children
+    // of the calling agent are accepted; all other names are rejected.
+    #[tool(
+        description = "Submit a config change for a direct child agent, queued for operator \
+            approval. Requires the `approvals` tool group. `agent` must be a direct child \
+            of this agent in the topology tree. Pass a commit sha (7-40 hex chars, full or \
+            short) from that agent's proposed config repo — branch/tag names like `main` are \
+            rejected, the approval pins the exact commit. On approval hive-c0re rebuilds \
+            the container with the new config."
+    )]
+    async fn request_apply_commit(
+        &self,
+        Parameters(args): Parameters<RequestApplyCommitArgs>,
+    ) -> String {
+        let log = format!("{args:?}");
+        let agent = args.agent.clone();
+        let commit_ref = args.commit_ref.clone();
+        run_tool_envelope("request_apply_commit", log, async move {
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::AgentRequest::RequestApplyCommit {
+                    agent: args.agent,
+                    commit_ref: args.commit_ref,
+                    description: args.description,
+                })
+                .await;
+            annotate_retries(
+                format_ack(
+                    resp,
+                    "request_apply_commit",
+                    format!("apply approval queued for {agent} @ {commit_ref}"),
+                ),
+                retries,
+            )
+        })
+        .await
+    }
 }
 
 #[tool_handler(