archetypes: prefill the create form from flake-declared agent archetypes

A flake declares agent archetypes in its `hyperhiveArchetypes` output,
`<name> = { module; meta; }`. The hyperhive flake ships `reviewer`
(default permissions without `execution`).

swarm-builder answers `$SWARM.builder.archetypes` with the `meta` of
every archetype its own hyperhive source declares. swarm-controller asks
once the queue connects and every 10 minutes, checks each archetype as
`POST /api/agents` checks its settings, and stores the result in the
`agent-archetypes` KV bucket when it changed. `GET /api/archetypes`
serves it, and the create form's archetype select prefills permissions,
resource caps and inference from it.

The agent created is an ordinary agent with its own config repo; the
archetype's module is not applied yet.

Refs #5386

swarm-builder/src/main.rs

@@ -4,7 +4,9 @@
 //! from swarm-controller on [`swarm_queue_client::builder::SUBJECT`], builds
 //! each agent config at its commit, answers on the request's reply subject,
 //! and logs one line per build. It writes nothing to the forge: the
-//! controller turns the reply into a commit status.
+//! controller turns the reply into a commit status. It also answers
+//! [`swarm_queue_client::builder::ARCHETYPES_SUBJECT`] with the agent
+//! archetypes its hyperhive source declares, which the controller stores.
 //!
 //! The store identity comes from the `BAO_*` environment. The queue client
 //! secret is read at start and again when authelia refuses it, the forge token
@@ -15,11 +17,15 @@ use std::sync::Arc;
 
 use anyhow::{Context, Result, bail};
 use futures_util::StreamExt as _;
-use swarm_queue_client::builder::{BUILD_DEADLINE, BuildAgent, QUEUE_GROUP, Reply, SUBJECT};
+use swarm_queue_client::builder::{
+    ARCHETYPES_DEADLINE, ARCHETYPES_SUBJECT, BUILD_DEADLINE, BuildAgent, QUEUE_GROUP, Reply,
+    SUBJECT,
+};
 use swarm_queue_client::stored_secret::StoredSecret;
 use swarm_queue_client::{ClientSecret, QueueConfig};
 use swarm_secret_client::forge::Credential;
 
+mod archetypes;
 mod nix_build;
 
 /// The cert-auth role this service logs in to the store as. `swarm-bao.nix`
@@ -52,6 +58,12 @@ async fn main() -> Result<()> {
             client_secret(&client_id)
         })
         .await?;
+    let evaluator = archetypes::Evaluator {
+        nix: builder.nix.clone(),
+        hyperhive: builder.hyperhive.clone(),
+        nixpkgs: builder.nixpkgs.clone(),
+        deadline: ARCHETYPES_DEADLINE,
+    };
     let reread_id = client_id.clone();
     let secret = StoredSecret::new(client_id.clone(), secret, move || {
         let client_id = reread_id.clone();
@@ -72,6 +84,12 @@ async fn main() -> Result<()> {
         .await
         .with_context(|| format!("subscribing to {SUBJECT}"))?;
     tracing::info!(subject = SUBJECT, "builder: awaiting builds");
+    let evaluations = queue
+        .queue_subscribe(ARCHETYPES_SUBJECT, QUEUE_GROUP.to_owned())
+        .await
+        .with_context(|| format!("subscribing to {ARCHETYPES_SUBJECT}"))?;
+    // Outside the build slot below: a list refresh does not wait on a build.
+    tokio::spawn(answer_evaluations(evaluations, queue.clone(), evaluator));
 
     // One build at a time. swarm-controller already sends one at a time; this
     // holds the bound for any request it did not serialise.
@@ -103,6 +121,39 @@ async fn main() -> Result<()> {
     bail!("the subscription to {SUBJECT} ended")
 }
 
+/// Answer every archetype evaluation request, one at a time, with the
+/// evaluation's result.
+async fn answer_evaluations(
+    mut requests: async_nats::Subscriber,
+    queue: async_nats::Client,
+    evaluator: archetypes::Evaluator,
+) {
+    while let Some(msg) = requests.next().await {
+        let Some(reply_to) = msg.reply.clone() else {
+            tracing::warn!("an archetype evaluation arrived with no reply subject; dropping it");
+            continue;
+        };
+        let reply = evaluator.eval().await;
+        match &reply {
+            swarm_queue_client::builder::ArchetypesReply::Evaluated { archetypes, .. } => {
+                tracing::info!(count = archetypes.len(), "archetypes evaluated");
+            }
+            swarm_queue_client::builder::ArchetypesReply::Failed { error_tail } => {
+                tracing::warn!(%error_tail, "archetype evaluation failed");
+            }
+        }
+        match serde_json::to_vec(&reply) {
+            Ok(body) => {
+                if let Err(e) = queue.publish(reply_to, body.into()).await {
+                    tracing::warn!(error = %e, "publishing an evaluation's reply failed");
+                }
+            }
+            Err(e) => tracing::warn!(error = %e, "encoding an evaluation's reply failed"),
+        }
+    }
+    tracing::error!("the subscription to {ARCHETYPES_SUBJECT} ended");
+}
+
 /// Decode one request, build it and log the build.
 async fn handle(payload: &[u8], builder: &nix_build::Builder) -> Reply {
     let job: BuildAgent = match serde_json::from_slice(payload) {