vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

hive-c0re: drop the subtree check from the scheduling verbs

Browse source 
The topology predicate `is_descendant_of` gated the four schedule-
managing verbs: a caller could only name a schedule owned by an agent at
or below itself in `topology.json`. Those gates now permit any requester,
so the predicate, its pure `_in` form and the `schedule_authorized`
wrapper built on it are gone rather than left returning a constant. The
other two wrappers went earlier with the verbs they served —
`require_descendant` with the lifecycle MCP verbs in 87970a8c, and
`resolve_agent_state_target` with `get_loose_ends`'s agent parameter.

`require_group(agent, "scheduling", ...)` is untouched and still fires at
dispatch for every one of the five scheduling verbs, so holding the tool
group remains the gate; what goes is the ownership restriction layered on
top of it.

The three schedule-mutating verbs keep their row lookup as a plain
existence check, so a caller naming a schedule that does not exist still
gets `not found` rather than a message from deeper in the cancel path.
`list_schedules` stops filtering per row: it would only have hidden rows
the requester may act on anyway.

Error messages, tool descriptions and docs that described the subtree
relation are reworded — a refusal message naming a topology that no
longer decides anything is worse than none.

The six `is_descendant_of_in` unit tests go with the function they test;
the permit behaviour they leave unasserted is picked up by the next
commit.

Refs #4472
This commit is contained in:
atlas 2026-09-17 19:27:15 +02:00 • committed by mara
commit 4121e11d87
8 changed files with 67 additions and 277 deletions
Download patch file Download diff file Expand all files Collapse all files

118
hive-c0re/src/agent_config/topology.rs
View file

@ -16,17 +16,17 @@
//! ## Graph representation
//!
//! The on-disk format stays as a flat JSON map `name → parent | null`
//! (small, git-diffable). In-memory, heavy algorithms (descendant checks,
//! cycle detection) use a [`petgraph`] directed graph where each edge runs
//! (small, git-diffable). In-memory, cycle detection uses a [`petgraph`]
//! directed graph where each edge runs
//! **parent → child**. This replaces the ad-hoc bounded walks that existed
//! before: petgraph's `has_path_connecting` / `is_cyclic_directed`
//! are correct for graphs of any depth (no 32-hop ceiling) and well-tested.
//! before: petgraph's `is_cyclic_directed`
//! is correct for graphs of any depth (no 32-hop ceiling) and well-tested.
//! The graph is built on demand from the flat map; it is not cached across
//! calls (the map is small and disk I/O dominates anyway).
use std::collections::BTreeMap;
use petgraph::algo::{has_path_connecting, is_cyclic_directed};
use petgraph::algo::is_cyclic_directed;
use petgraph::graph::{DiGraph, NodeIndex};
use std::path::PathBuf;
@ -141,27 +141,10 @@ pub fn resolve_recipient_in(
}
}
/// True when `candidate` is `ancestor` or any descendant of
/// `ancestor` per the current on-disk topology.
///
/// Delegates to [`is_descendant_of_in`] on the result of [`read`] so
/// the algorithm is the same petgraph BFS used everywhere else. No
/// depth limit — the 32-hop bounded walk this replaced was correct for
/// any plausible hive but carried a latent ceiling; this has none.
///
/// Used by the cancel-authorization checks in `socket_server` to enforce
/// "managers can cancel anything their subtree owns."
#[must_use]
pub fn is_descendant_of(candidate: &str, ancestor: &str) -> bool {
is_descendant_of_in(&read(), candidate, ancestor)
}
/// Build an in-memory petgraph directed graph from the topology map.
///
/// Edges run **parent → child** so that:
/// - `children_of(name)` = outgoing neighbours of `name`'s node
/// - `is_descendant_of(candidate, ancestor)` = path exists from `ancestor`
/// to `candidate` via `has_path_connecting`
/// - cycle detection = `is_cyclic_directed` after a speculative edge insert
///
/// Returns the graph and a `BTreeMap<name → NodeIndex>` for O(log n)
@ -191,28 +174,6 @@ fn build_graph(
(graph, idx)
}
/// Return true when `candidate` is a descendant of `ancestor` in the
/// given topology map. Uses petgraph BFS/DFS (`has_path_connecting`)
/// — no depth limit and no manually bounded walk. Pure; no disk I/O.
///
/// Same semantics as the disk-reading [`is_descendant_of`]: a node is
/// considered a descendant of itself (`candidate == ancestor` → true).
#[must_use]
pub fn is_descendant_of_in(
topo: &BTreeMap<String, Option<String>>,
candidate: &str,
ancestor: &str,
) -> bool {
if candidate == ancestor {
return true;
}
let (graph, idx) = build_graph(topo);
let (Some(&anc_ni), Some(&cand_ni)) = (idx.get(ancestor), idx.get(candidate)) else {
return false;
};
has_path_connecting(&graph, anc_ni, cand_ni, None)
}
/// Persist the topology map. Sorted JSON output (`BTreeMap` is sorted by
/// key) keeps git diffs minimal across re-writes. Best-effort —
/// returns an `io::Error` so callers can decide whether a failure
@ -742,75 +703,6 @@ mod tests {
assert!(top_level_agents_in(&topo).is_empty());
}
// -----------------------------------------------------------------------
// is_descendant_of_in tests (petgraph-backed; pure / no disk I/O)
// -----------------------------------------------------------------------
#[test]
fn is_descendant_of_in_self_is_true() {
let topo = topo_three_level();
assert!(is_descendant_of_in(&topo, "alice", "alice"));
assert!(is_descendant_of_in(
&topo,
crate::lifecycle::MANAGER_NAME,
crate::lifecycle::MANAGER_NAME
));
}
#[test]
fn is_descendant_of_in_direct_child() {
let topo = topo_three_level();
// alice is a direct child of manager.
assert!(is_descendant_of_in(
&topo,
"alice",
crate::lifecycle::MANAGER_NAME
));
}
#[test]
fn is_descendant_of_in_grandchild() {
let topo = topo_three_level();
// bob is manager → alice → bob; should be reachable from manager.
assert!(is_descendant_of_in(
&topo,
"bob",
crate::lifecycle::MANAGER_NAME
));
assert!(is_descendant_of_in(
&topo,
"carol",
crate::lifecycle::MANAGER_NAME
));
}
#[test]
fn is_descendant_of_in_parent_not_descendant_of_child() {
let topo = topo_three_level();
// alice is NOT a descendant of bob (alice is bob's grandparent).
assert!(!is_descendant_of_in(&topo, "alice", "bob"));
assert!(!is_descendant_of_in(
&topo,
crate::lifecycle::MANAGER_NAME,
"alice"
));
}
#[test]
fn is_descendant_of_in_sibling_is_not_descendant() {
let topo = topo_three_level();
// bob and carol are siblings under alice; neither descends from the other.
assert!(!is_descendant_of_in(&topo, "bob", "carol"));
assert!(!is_descendant_of_in(&topo, "carol", "bob"));
}
#[test]
fn is_descendant_of_in_unknown_is_false() {
let topo = topo_three_level();
assert!(!is_descendant_of_in(&topo, "nobody", "alice"));
assert!(!is_descendant_of_in(&topo, "alice", "nobody"));
}
// -----------------------------------------------------------------------
// Roles tests (no disk I/O — use the pure `has_role_in` / in-memory maps)
// -----------------------------------------------------------------------

15
hive-c0re/src/socket_server/mod.rs
View file

@ -4,10 +4,10 @@
//! you are `foo`; the manager socket simply serves as `ruth`. There is no
//! privilege flag — both transports run the same [`serve`] / [`dispatch`]
//! code, and authority derives uniformly from the caller's identity:
//! topology (`is_descendant_of`) for subtree-relational verbs, capabilities
//! for hive-wide queries, and tool-group membership for the orchestration
//! verbs. `ruth` reaches every agent only as a consequence of being the
//! topology root, not via any hardcoded name match.
//! capabilities for the hive-wide queries and tool-group membership for the
//! orchestration verbs. An agent-targeting verb may name any agent, so `ruth`
//! reaches every agent exactly the way every other agent does, not via any
//! hardcoded name match.
use std::path::{Path, PathBuf};
use std::sync::Arc;
@ -87,10 +87,9 @@ pub fn start(agent: &str, socket_path: &Path, coord: Arc<Coordinator>) -> Result
/// Bind + serve the manager socket. This is now **pure transport**: it grants
/// no authority of its own — it just serves requests as `agent = MANAGER_AGENT`
/// ("ruth"), and ruth's reach comes entirely from being the topology root
/// (`is_descendant_of` covers every agent) plus the capabilities / tool-groups
/// it holds, identical to connecting on a per-agent socket — ruth uses the
/// standard per-agent runtime dir + socket, with no dedicated helpers.
/// ("ruth"), and ruth's reach comes entirely from the capabilities /
/// tool-groups it holds, identical to connecting on a per-agent socket — ruth
/// uses the standard per-agent runtime dir + socket, with no dedicated helpers.
pub fn start_manager(coord: Arc<Coordinator>) -> Result<()> {
use std::os::unix::fs::PermissionsExt as _;
let dir = crate::paths::agent_runtime_dir(crate::lifecycle::MANAGER_NAME);

166
hive-c0re/src/socket_server/schedules.rs
View file

@ -1,6 +1,6 @@
//! Scheduled-prompt request handlers (`ListSchedules` /
//! `RequestSchedulePrompt` / `CancelSchedule` / `EditSchedule` /
//! `FireScheduleNow`), their shared ownership check, and the
//! `FireScheduleNow`) and the
//! schedule-to-wire mapping reused by the dashboard
//! (`schedule_to_wire_public` / `filter_ghost_schedule_targets`).
@ -10,20 +10,15 @@ use hive_core_agent_sock::Response;
use crate::coordinator::Coordinator;
/// `ListSchedules` — snapshot the scheduled prompts `requester` is
/// authorized to see: its own schedules, ones owned by an agent in its
/// subtree, or (for the operator) everything. Uses the same
/// `schedule_authorized` rule `CancelSchedule`/`EditSchedule`/
/// `FireScheduleNow` already enforce, applied here as a per-row filter
/// instead of a hard reject.
/// `ListSchedules` — snapshot every scheduled prompt. Ownership no longer
/// narrows the view: `CancelSchedule`/`EditSchedule`/`FireScheduleNow` accept
/// any requester, so filtering the listing would only hide rows the requester
/// can act on anyway.
pub(super) fn handle_list_schedules(coord: &Arc<Coordinator>, requester: &str) -> Response {
tracing::debug!(%requester, "list schedules");
match coord.scheduled_prompts.list() {
Ok(schedules) => Response::Schedules {
schedules: schedules
.into_iter()
.filter(|s| schedule_authorized(requester, &s.owner))
.map(schedule_to_wire)
.collect(),
schedules: schedules.into_iter().map(schedule_to_wire).collect(),
},
Err(e) => Response::Err {
message: format!("list scheduled prompts: {e:#}"),
@ -108,39 +103,20 @@ pub(super) fn handle_request_schedule_prompt(
Response::Ok
}
/// Cancel a schedule (whole or per-target). Manager-surface
/// authorization: a manager can cancel its own schedules + any
/// schedule whose owner is one of its sub-agents (topology-walked).
/// The operator surface bypasses this and can cancel anything;
/// agents reaching this path through the manager get the
/// topology-scoped check.
/// Cancel a schedule (whole or per-target). Any requester may cancel any
/// schedule, whoever owns it.
pub(super) fn handle_cancel_schedule(
coord: &Arc<Coordinator>,
requester: &str,
schedule_id: i64,
targets: Option<&[String]>,
) -> Response {
let schedule = match coord.scheduled_prompts.get(schedule_id) {
Ok(Some(s)) => s,
Ok(None) => {
return Response::Err {
message: format!("schedule {schedule_id} not found"),
};
}
Err(e) => {
return Response::Err {
message: format!("read schedule {schedule_id}: {e:#}"),
};
}
};
if !schedule_authorized(requester, &schedule.owner) {
return Response::Err {
message: format!(
"not authorized: {requester} cannot cancel schedule owned by {owner}",
owner = schedule.owner
),
};
// Existence check only — it buys the caller a clean "not found" instead
// of whatever the cancel itself would say about an absent row.
if let Some(err) = require_schedule(coord, schedule_id) {
return err;
}
tracing::info!(%requester, %schedule_id, "cancel schedule");
let result = match targets {
Some(list) if !list.is_empty() => coord
.scheduled_prompts
@ -160,37 +136,18 @@ pub(super) fn handle_cancel_schedule(
}
}
/// Authorize + dispatch a `FireScheduleNow` request from the
/// manager surface. Same ownership rules as `CancelSchedule`:
/// requester can fire its own schedules + any owned by an agent
/// in its subtree. The actual fan-out lives in
/// Dispatch a `FireScheduleNow` request. Same rule as `CancelSchedule`: any
/// requester, any schedule. The actual fan-out lives in
/// `scheduled_prompts_worker::fire_now`.
pub(super) async fn handle_fire_schedule_now(
coord: &Arc<Coordinator>,
requester: &str,
schedule_id: i64,
) -> Response {
let schedule = match coord.scheduled_prompts.get(schedule_id) {
Ok(Some(s)) => s,
Ok(None) => {
return Response::Err {
message: format!("schedule {schedule_id} not found"),
};
}
Err(e) => {
return Response::Err {
message: format!("read schedule {schedule_id}: {e:#}"),
};
}
};
if !schedule_authorized(requester, &schedule.owner) {
return Response::Err {
message: format!(
"not authorized: {requester} cannot fire schedule owned by {owner}",
owner = schedule.owner
),
};
if let Some(err) = require_schedule(coord, schedule_id) {
return err;
}
tracing::info!(%requester, %schedule_id, "fire schedule now");
// MCP fire_schedule_now stays no-reset (cadence intact); the
// reset-timer option is a dashboard-dialog affordance.
match crate::scheduled_prompts_worker::fire_now(coord, schedule_id, false).await {
@ -222,13 +179,11 @@ pub(super) struct EditSchedulePatch {
pub(super) targets_remove: Option<Vec<String>>,
}
/// Authorize + dispatch a `EditSchedule` patch. Same ownership
/// rules as `CancelSchedule` — the manager can edit
/// schedules it owns + any owned by an agent in its subtree.
/// Forwards the partial payload to
/// Dispatch an `EditSchedule` patch. Same rule as `CancelSchedule`: any
/// requester, any schedule. Forwards the partial payload to
/// `ScheduledPrompts::update` which enforces the cancelled-row /
/// zero-interval validation. Returns `Ok` on a clean update;
/// `Err` with the underlying message on any auth / validation
/// `Err` with the underlying message on any validation
/// failure so the dashboard can surface it verbatim.
pub(super) fn handle_edit_schedule(
coord: &Arc<Coordinator>,
@ -244,27 +199,10 @@ pub(super) fn handle_edit_schedule(
targets_add,
targets_remove,
} = patch;
let schedule = match coord.scheduled_prompts.get(schedule_id) {
Ok(Some(s)) => s,
Ok(None) => {
return Response::Err {
message: format!("schedule {schedule_id} not found"),
};
}
Err(e) => {
return Response::Err {
message: format!("read schedule {schedule_id}: {e:#}"),
};
}
};
if !schedule_authorized(requester, &schedule.owner) {
return Response::Err {
message: format!(
"not authorized: {requester} cannot edit schedule owned by {owner}",
owner = schedule.owner
),
};
if let Some(err) = require_schedule(coord, schedule_id) {
return err;
}
tracing::info!(%requester, %schedule_id, "edit schedule");
let patch = crate::scheduled_prompts::UpdateSchedule {
body,
description,
@ -284,23 +222,19 @@ pub(super) fn handle_edit_schedule(
}
}
/// Permission check shared by the whole scheduling surface: `requester`
/// can act on a schedule it owns, on one owned by an agent in its
/// subtree (delegated to topology — see `crate::topology::is_descendant_of`),
/// or, as the operator, on anything. `CancelSchedule`/`EditSchedule`/
/// `FireScheduleNow` apply it as a hard reject; `ListSchedules` applies
/// it as a per-row filter.
fn schedule_authorized(requester: &str, owner: &str) -> bool {
if requester == owner {
return true;
/// Shared existence guard for the three schedule-mutating verbs: `None` when
/// the row is there, `Some(Err)` to short-circuit when it isn't or the read
/// failed. Not a permission check — any requester may act on any schedule.
fn require_schedule(coord: &Arc<Coordinator>, schedule_id: i64) -> Option<Response> {
match coord.scheduled_prompts.get(schedule_id) {
Ok(Some(_)) => None,
Ok(None) => Some(Response::Err {
message: format!("schedule {schedule_id} not found"),
}),
Err(e) => Some(Response::Err {
message: format!("read schedule {schedule_id}: {e:#}"),
}),
}
if requester == hive_sh4re::manager::OPERATOR_RECIPIENT {
return true;
}
// Manager can act on anything owned by an agent in its subtree. For
// the current single-manager topology that covers everything, but
// the check stays correct as the tree grows.
crate::topology::is_descendant_of(owner, requester)
}
/// Map a `scheduled_prompts::Schedule` to its public wire shape.
@ -396,32 +330,6 @@ mod tests {
}
}
#[test]
fn schedule_authorized_self_is_true() {
// Disk-free branch — never reaches `is_descendant_of`.
assert!(schedule_authorized("iris", "iris"));
}
#[test]
fn schedule_authorized_operator_is_true() {
// Disk-free branch — never reaches `is_descendant_of`.
assert!(schedule_authorized(
hive_sh4re::manager::OPERATOR_RECIPIENT,
"iris"
));
}
#[test]
fn schedule_authorized_unrelated_requester_is_false() {
// Control: neither self nor operator, and no on-disk topology in
// a test sandbox connects these two names — pins that the
// predicate isn't accidentally stuck at `true`.
assert!(!schedule_authorized(
"definitely-not-the-owner",
"also-not-the-requester"
));
}
#[test]
fn ghost_filter_drops_dead_agents_keeps_live() {
let live: std::collections::HashSet<String> = ["iris".to_owned(), "damocles".to_owned()]