hive-subagent-mcp: check subagent models against the swarm's subagent_models

A `start` or `continue` naming a `model` now reads this agent's key in the
`agent-inference` bucket and, when `subagent_models` is set, checks the
model against that list instead of HIVE_AVAILABLE_MODELS (agent.nix
`availableModels`). An unset field, an absent key or an absent bucket
keeps today's check. A read that fails or takes over 2 s falls back to
HIVE_AVAILABLE_MODELS with a warning, so a subagent start never waits on
the queue. A call without a `model` is not checked and does not read.

The read uses the agent's own queue credential through swarm_term's
connect, and the one direct-get subject the agent is granted in that
bucket. The refusal names the list and that it came from the swarm.

Refs #5034 (S5)

hive-subagent-mcp/src/session.rs

@@ -386,6 +386,9 @@ pub struct State {
     /// Where every subagent's output lines go up to the swarm, when this
     /// agent can publish there ([`State::publishing_to`]).
     term: Option<crate::swarm_term::Publisher>,
+    /// Where the swarm's `subagent_models` for this agent is read from, when
+    /// this agent can read it ([`State::reading_models_from`]).
+    models: Option<crate::swarm_models::Reader>,
 }
 
 /// Which opaque URL segment belongs to which session — the whole of a
@@ -439,6 +442,7 @@ impl State {
             signal_tokens: Mutex::new(SignalTokens::default()),
             runtime: SubagentRuntime::Claude,
             term: None,
+            models: None,
         }
     }
 
@@ -449,6 +453,27 @@ impl State {
         self
     }
 
+    /// Check every named `model` against the swarm's `subagent_models` as
+    /// `models` reads it, where the swarm sets one.
+    #[must_use]
+    pub fn reading_models_from(mut self, models: Option<crate::swarm_models::Reader>) -> Self {
+        self.models = models;
+        self
+    }
+
+    /// Refuse a `model` outside the list in effect for this agent (see
+    /// `check_model`). The swarm key is read only for a named model.
+    async fn allow_model(&self, model: Option<&str>) -> anyhow::Result<()> {
+        if model.is_none() {
+            return Ok(());
+        }
+        let read = match &self.models {
+            Some(reader) => Some(reader.read().await),
+            None => None,
+        };
+        check_model(model, &model_list(read, available_models()))
+    }
+
     /// Run every subagent on `runtime` — the daemon passes the parent
     /// agent's, read from its environment at startup. On ACP this resolves
     /// the harness dir, which only exists inside a container.
@@ -918,28 +943,69 @@ fn available_models() -> Option<String> {
     std::env::var(AVAILABLE_MODELS_ENV).ok()
 }
 
+/// The list a named `model` is checked against.
+#[derive(Debug, PartialEq, Eq)]
+enum ModelList {
+    /// The swarm's `subagent_models` for this agent.
+    Swarm(Vec<String>),
+    /// [`AVAILABLE_MODELS_ENV`]; `None` when the var is absent.
+    Local(Option<String>),
+}
+
+/// The swarm's list when it sets one, else `local`. `read` is `None` when
+/// this daemon has no swarm queue to read from; a failed read is logged and
+/// falls back to `local`.
+fn model_list(read: Option<crate::swarm_models::Read>, local: Option<String>) -> ModelList {
+    use crate::swarm_models::Read;
+    match read {
+        Some(Read::Set(models)) => ModelList::Swarm(models),
+        Some(Read::Failed(error)) => {
+            tracing::warn!(
+                %error,
+                "reading this agent's subagent_models from the swarm failed; checking against \
+                 {AVAILABLE_MODELS_ENV}"
+            );
+            ModelList::Local(local)
+        }
+        Some(Read::Unset) | None => ModelList::Local(local),
+    }
+}
+
 /// Refuse a `model` the operator hasn't made available to this agent.
 ///
 /// Default-open on purpose: this is a safety rail, not a security boundary,
-/// so an absent `allowed` (or one naming nothing) restricts nothing and an
+/// so an absent list (or one naming nothing) restricts nothing and an
 /// agent deployed before this gate existed keeps working unchanged. A `None`
 /// model isn't a choice of model either — it lets claude fall back to its own
 /// default — so there is nothing to check.
 ///
 /// # Errors
 ///
-/// A named model absent from `allowed`; the message names it and every
-/// permitted one, since it is all the caller sees.
-fn check_model(model: Option<&str>, allowed: Option<&str>) -> anyhow::Result<()> {
-    let (Some(model), Some(allowed)) = (model, allowed) else {
+/// A named model absent from `list`; the message names it, every permitted
+/// one and where the list came from, since it is all the caller sees.
+fn check_model(model: Option<&str>, list: &ModelList) -> anyhow::Result<()> {
+    let Some(model) = model else {
         return Ok(());
     };
-    // Same split/trim/skip-empty rules as `ToolGroup::parse_list`.
-    let allowed: Vec<&str> = allowed
-        .split(',')
-        .map(str::trim)
-        .filter(|token| !token.is_empty())
-        .collect();
+    let (allowed, source): (Vec<&str>, &str) = match list {
+        ModelList::Swarm(models) => (
+            models
+                .iter()
+                .map(|m| m.trim())
+                .filter(|m| !m.is_empty())
+                .collect(),
+            "the swarm's subagent_models for this agent",
+        ),
+        ModelList::Local(None) => return Ok(()),
+        // Same split/trim/skip-empty rules as `ToolGroup::parse_list`.
+        ModelList::Local(Some(env)) => (
+            env.split(',')
+                .map(str::trim)
+                .filter(|token| !token.is_empty())
+                .collect(),
+            AVAILABLE_MODELS_ENV,
+        ),
+    };
     if allowed.is_empty()
         || allowed
             .iter()
@@ -948,7 +1014,7 @@ fn check_model(model: Option<&str>, allowed: Option<&str>) -> anyhow::Result<()>
         return Ok(());
     }
     anyhow::bail!(
-        "model `{model}` is not available to this agent — {AVAILABLE_MODELS_ENV} permits: {}",
+        "model `{model}` is not available to this agent — {source} permits: {}",
         allowed.join(", ")
     );
 }
@@ -1207,10 +1273,10 @@ pub struct StartRequest {
 /// case is the only one that can happen *after* commit-to-run, and it's
 /// exactly why nothing is registered in `running` until spawn actually
 /// succeeds.
-pub fn start(state: &Arc<State>, req: StartRequest) -> anyhow::Result<String> {
+pub async fn start(state: &Arc<State>, req: StartRequest) -> anyhow::Result<String> {
     let name = req.name.as_str();
     validate_name(name)?;
-    check_model(req.model.as_deref(), available_models().as_deref())?;
+    state.allow_model(req.model.as_deref()).await?;
     // Before `reserve`, so a role this agent does not have costs the caller
     // an error and nothing else: no name claimed, no session archived, no
     // process spawned.
@@ -1388,7 +1454,7 @@ pub async fn continue_(
     dir: Option<&str>,
 ) -> anyhow::Result<String> {
     validate_name(name)?;
-    check_model(model.as_deref(), available_models().as_deref())?;
+    state.allow_model(model.as_deref()).await?;
     if !state.reserve(name) {
         anyhow::bail!(
             "subagent `{name}` is already running — use `interrupt` first if you meant to redirect it"
@@ -2626,15 +2692,17 @@ mod tests {
         assert!(err.to_string().contains("task instructions"), "{err}");
     }
 
-    #[test]
-    fn a_start_naming_an_unknown_role_errors_and_reserves_nothing() {
+    #[tokio::test]
+    async fn a_start_naming_an_unknown_role_errors_and_reserves_nothing() {
         // The error path end to end: the refusal happens before anything is
         // claimed, so an unknown role costs a message and nothing else —
         // no reservation to release, no archived prior session, no spawn.
         let state = Arc::new(State::new(PathBuf::from("/dev/null"), signal_url()));
         let mut req = start_request("unknown-role-run");
         req.role = Some("no-such-role-ships-anywhere".to_owned());
-        let err = start(&state, req).expect_err("a role this agent lacks must refuse the start");
+        let err = start(&state, req)
+            .await
+            .expect_err("a role this agent lacks must refuse the start");
         assert!(
             err.to_string().contains("no-such-role-ships-anywhere"),
             "the refusal names the role that was asked for: {err}"
@@ -2646,12 +2714,14 @@ mod tests {
         );
     }
 
-    #[test]
-    fn a_start_naming_an_unusable_role_refuses_before_touching_the_filesystem() {
+    #[tokio::test]
+    async fn a_start_naming_an_unusable_role_refuses_before_touching_the_filesystem() {
         let state = Arc::new(State::new(PathBuf::from("/dev/null"), signal_url()));
         let mut req = start_request("bad-role-name");
         req.role = Some("../../etc/passwd".to_owned());
-        let err = start(&state, req).expect_err("a role name that is not an identifier refuses");
+        let err = start(&state, req)
+            .await
+            .expect_err("a role name that is not an identifier refuses");
         assert!(err.to_string().contains("invalid role name"), "{err}");
         assert_eq!(state.occupancy("bad-role-name"), None);
     }
@@ -2809,8 +2879,8 @@ mod tests {
         );
     }
 
-    #[test]
-    fn start_does_not_corrupt_the_remembered_dir_when_the_name_is_already_running() {
+    #[tokio::test]
+    async fn start_does_not_corrupt_the_remembered_dir_when_the_name_is_already_running() {
         // The exact scenario argus caught in review: a rejected concurrent
         // `start` used to commit its `dir` before the reservation check
         // refused it, corrupting what a later bare `continue` would resolve
@@ -2829,7 +2899,8 @@ mod tests {
                 dir: Some("/tmp/rejected".to_owned()),
                 ..start_request("dup")
             },
-        );
+        )
+        .await;
         assert!(
             result.is_err(),
             "a name already reserved must be refused, not spawned"
@@ -4000,8 +4071,8 @@ mod tests {
         );
     }
 
-    #[test]
-    fn a_fresh_start_inherits_nothing_from_the_run_before_it() {
+    #[tokio::test]
+    async fn a_fresh_start_inherits_nothing_from_the_run_before_it() {
         // `start` archives the prior session precisely so this is a fresh
         // start; a leftover stop reason or report path would make the new run
         // report the old one's ending, into the old one's file.
@@ -4009,7 +4080,7 @@ mod tests {
         state.record_stop("n", StopReason::NeedHelp("old block".to_owned()));
         state.set_report_file("n", Some("/tmp/old-report.md"));
         state.reserve("n");
-        let refused = start(&state, start_request("n"));
+        let refused = start(&state, start_request("n")).await;
         assert!(refused.is_err(), "the reserved name is refused as before");
 
         // The same clearing `start` does once it owns the name.
@@ -4139,22 +4210,22 @@ mod tests {
 
     #[test]
     fn an_unset_model_whitelist_allows_any_model() {
-        assert!(check_model(Some("opus"), None).is_ok());
+        assert!(check_model(Some("opus"), &local(None)).is_ok());
     }
 
     #[test]
     fn an_unset_model_whitelist_allows_an_omitted_model() {
-        assert!(check_model(None, None).is_ok());
+        assert!(check_model(None, &local(None)).is_ok());
     }
 
     #[test]
     fn a_listed_model_is_allowed() {
-        assert!(check_model(Some("sonnet"), Some("haiku,sonnet,opus")).is_ok());
+        assert!(check_model(Some("sonnet"), &local(Some("haiku,sonnet,opus"))).is_ok());
     }
 
     #[test]
     fn an_unlisted_model_is_rejected_naming_what_is_permitted() {
-        let err = check_model(Some("opus"), Some("haiku,sonnet"))
+        let err = check_model(Some("opus"), &local(Some("haiku,sonnet")))
             .expect_err("a model outside the list must be refused")
             .to_string();
         assert!(
@@ -4167,7 +4238,7 @@ mod tests {
     #[test]
     fn a_set_whitelist_still_allows_an_omitted_model() {
         assert!(
-            check_model(None, Some("haiku")).is_ok(),
+            check_model(None, &local(Some("haiku"))).is_ok(),
             "omitting `model` lets claude pick its own default — it is not a \
              choice of model, so there is nothing to gate"
         );
@@ -4175,14 +4246,111 @@ mod tests {
 
     #[test]
     fn whitespace_and_empty_entries_are_ignored() {
-        assert!(check_model(Some("sonnet"), Some(" haiku , sonnet ,, ")).is_ok());
-        assert!(check_model(Some("opus"), Some(" haiku , sonnet ,, ")).is_err());
+        assert!(check_model(Some("sonnet"), &local(Some(" haiku , sonnet ,, "))).is_ok());
+        assert!(check_model(Some("opus"), &local(Some(" haiku , sonnet ,, "))).is_err());
         assert!(
-            check_model(Some("opus"), Some("  ,, ")).is_ok(),
+            check_model(Some("opus"), &local(Some("  ,, "))).is_ok(),
             "a var naming nothing restricts nothing — default open"
         );
     }
 
+    fn local(env: Option<&str>) -> ModelList {
+        ModelList::Local(env.map(str::to_owned))
+    }
+
+    fn swarm(models: &[&str]) -> crate::swarm_models::Read {
+        crate::swarm_models::Read::Set(models.iter().map(|m| (*m).to_owned()).collect())
+    }
+
+    /// The swarm's list replaces the local one, so it can widen it as well
+    /// as narrow it.
+    #[test]
+    fn a_swarm_list_replaces_the_local_one() {
+        let env = || Some("haiku,sonnet".to_owned());
+        let list = model_list(Some(swarm(&["opus"])), env());
+        assert_eq!(list, ModelList::Swarm(vec!["opus".to_owned()]));
+        assert!(check_model(Some("opus"), &list).is_ok());
+        assert!(check_model(Some("sonnet"), &list).is_err());
+    }
+
+    #[test]
+    fn without_a_swarm_list_the_local_one_applies() {
+        let env = || Some("haiku,sonnet".to_owned());
+        for read in [None, Some(crate::swarm_models::Read::Unset)] {
+            assert_eq!(model_list(read, env()), local(Some("haiku,sonnet")));
+        }
+        assert_eq!(
+            model_list(Some(crate::swarm_models::Read::Unset), None),
+            local(None)
+        );
+    }
+
+    #[test]
+    fn a_failed_read_falls_back_to_the_local_list_and_warns() {
+        let logs = CapturedLogs::default();
+        let subscriber = tracing_subscriber::fmt()
+            .with_writer(logs.clone())
+            .with_ansi(false)
+            .finish();
+        let list = tracing::subscriber::with_default(subscriber, || {
+            model_list(
+                Some(crate::swarm_models::Read::Failed("no answer".to_owned())),
+                Some("haiku".to_owned()),
+            )
+        });
+        assert_eq!(list, local(Some("haiku")));
+        let logged = logs.text();
+        assert!(
+            logged.contains("WARN") && logged.contains("no answer"),
+            "the fallback is logged as a warning with the cause: {logged}"
+        );
+    }
+
+    #[test]
+    fn a_model_outside_the_swarm_list_is_refused_naming_the_list_and_its_source() {
+        let list = model_list(Some(swarm(&["haiku", "sonnet"])), Some("opus".to_owned()));
+        let err = check_model(Some("opus"), &list)
+            .expect_err("a model outside the swarm's list must be refused")
+            .to_string();
+        assert!(
+            err.contains("opus")
+                && err.contains("haiku, sonnet")
+                && err.contains("swarm's subagent_models"),
+            "{err}"
+        );
+        assert!(
+            check_model(None, &list).is_ok(),
+            "an omitted model is not checked against the swarm's list either"
+        );
+    }
+
+    /// A `tracing` writer whose output a test can read back.
+    #[derive(Clone, Default)]
+    struct CapturedLogs(Arc<Mutex<Vec<u8>>>);
+
+    impl CapturedLogs {
+        fn text(&self) -> String {
+            String::from_utf8_lossy(&self.0.lock().unwrap()).into_owned()
+        }
+    }
+
+    impl std::io::Write for CapturedLogs {
+        fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
+            self.0.lock().unwrap().extend_from_slice(buf);
+            Ok(buf.len())
+        }
+        fn flush(&mut self) -> std::io::Result<()> {
+            Ok(())
+        }
+    }
+
+    impl<'a> tracing_subscriber::fmt::MakeWriter<'a> for CapturedLogs {
+        type Writer = Self;
+        fn make_writer(&'a self) -> Self::Writer {
+            self.clone()
+        }
+    }
+
     /// An ACP agent in plain `sh`, after `hive-runtime`'s own test agent. It
     /// has one session, `s1`, appends every method it is sent to
     /// `<log>.methods` and every `session/prompt` line to `<log>`, and