type Message.from as Ident

hive-sh4re/src/lib.rs

@@ -155,7 +155,7 @@ pub struct ReminderStats {
 /// A logical message between agents.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Message {
-    pub from: String,
+    pub from: Ident,
     pub to: String,
     pub body: String,
     /// Optional broker row-id of the message this is a reply to.
@@ -442,6 +442,25 @@ pub const CHILDREN_RECIPIENT: &str = "<children>";
 /// Manager harness recognises this and parses the body as a `HelperEvent`.
 pub const SYSTEM_SENDER: &str = "system";
 
+/// Parse `s` as a [`Ident`] for use as `Message.from`, falling back to
+/// [`SYSTEM_SENDER`] on the (should-be-unreachable) case that `s` isn't
+/// ident-shaped. `Message.from` is always either a fixed sentinel literal
+/// (`SYSTEM_SENDER`, `OPERATOR_RECIPIENT`, `"scheduled"`, …) or an
+/// already-registered agent's own name reaching this point through
+/// hive-c0re's internal dispatch — never arbitrary external input — so
+/// this is a defensive fallback for a programming-bug case, not a
+/// validation gate.
+///
+/// # Panics
+///
+/// Never, unless [`SYSTEM_SENDER`] itself stops being ident-shaped (which
+/// would also be a programming bug, caught by `hive-types`' own tests).
+#[must_use]
+pub fn trusted_sender(s: &str) -> Ident {
+    Ident::parse(s)
+        .unwrap_or_else(|_| Ident::parse(SYSTEM_SENDER).expect("SYSTEM_SENDER is a valid Ident"))
+}
+
 /// Out-of-band events the host-side daemon pushes to the manager's inbox.
 /// Serialised as JSON in `Message::body` (sender = `SYSTEM_SENDER`).
 /// Per-variant triggers + the optional `sha`/`tag` semantics live in