gate each deploy on a swarm build of the agent from internal/meta

swarm-queue-client/src/agent_closures.rs

@@ -0,0 +1,19 @@
+//! The connection side of the per-agent closure KV bucket. The bucket's names
+//! and stored type are `swarm_wire::agent_closures`.
+
+/// Open the closures bucket for writing, creating it if nothing has yet.
+///
+/// **Controller-side only.** `history: 1`: a reader wants the latest build.
+#[cfg(feature = "kv")]
+pub async fn open_or_create(
+    client: &async_nats::Client,
+) -> Result<async_nats::jetstream::kv::Store, crate::Error> {
+    let js = async_nats::jetstream::new(client.clone());
+    crate::kv::open_or_create(
+        &js,
+        swarm_wire::agent_closures::BUCKET,
+        "agent-closures",
+        "The latest system closure the swarm builder built for each agent".to_owned(),
+    )
+    .await
+}

swarm-queue-client/src/lib.rs

@@ -250,6 +250,11 @@ pub mod operator_profiles;
 /// `agent-archetype`.
 pub mod agent_archetype;
 
+/// Opening the bucket swarm-controller records each agent's latest built
+/// system closure in. The names and the stored type are
+/// `swarm_wire::agent_closures`; writing needs `kv`.
+pub mod agent_closures;
+
 /// The bucket swarm-controller keeps the evaluated agent archetypes in — one
 /// key per source flake. The names and the stored type are unconditional;
 /// opening needs `kv`.