swarm: named scheduled prompts for one or more agents, fired in each agent

swarm-controller keeps every scheduled prompt (id, name, agents, body,
anchor, interval, paused) as one document under one key of a new
`schedule-definitions` KV bucket, so each change is a single
compare-and-set and a prompt exists for all of its agents or none. It
writes each agent's key of a new `agent-schedules` bucket as the prompts
naming that agent, without names or other agents, after every change and
on a one-minute reconcile pass. It is the only writer of both, behind
GET/POST /api/schedules and PATCH/DELETE /api/schedules/{id}.
`swarmctl schedule add|list|edit|pause|resume|rm` drives those routes over
the controller socket.

An agent's own queue credential is granted one more subject, the direct
get of its own key in `agent-schedules`. A KV watch is not granted: its
consumer create subject carries no key, so it would cover every agent's.

hive-agent's new schedule ticker reads that key every 10 seconds and fires
due slots as the same `schedule:<id>` todo hive-c0re's worker pushes. Fire
times are anchor + k*interval; the last fired slot per schedule id is kept
in the state db, so a body edit or list refresh never moves or refires a
slot, downtime fires the latest missed slot once, a restart refires
nothing, a one-shot fires once, and paused slots are skipped.

Refs #4914

swarm-nats-auth/src/main.rs

@@ -363,12 +363,14 @@ mod tests {
             "$KV.agent-icons.{agent}",
             "--agent-token-publish-subject",
             "$SWARM.term.{agent}.sub.>",
+            "--agent-token-publish-subject",
+            "$JS.API.DIRECT.GET.KV_agent-schedules.$KV.agent-schedules.{agent}",
             "--store-cert-role",
             "swarm-nats-auth",
         ])
         .expect("the unit's own argument vector must parse");
         assert_eq!(args.agent_client_suffix, "-agent");
-        assert_eq!(args.agent_token_publish_subjects.len(), 4);
+        assert_eq!(args.agent_token_publish_subjects.len(), 5);
     }
 
     /// The control for the case above: an ordinary value parses through the

swarm-nats-auth/src/policy.rs

@@ -1290,6 +1290,77 @@ mod tests {
         );
     }
 
+    /// The schedule template as `swarm-nats.nix` spells it reads one key: the
+    /// agent's own. It covers no other agent's key, no other stream or bucket,
+    /// and no way to open, watch or write the bucket. The hive's shared agent
+    /// client gets none of it.
+    #[test]
+    fn an_agent_may_read_only_its_own_schedule_key() {
+        use swarm_queue_client::agent_schedules::{
+            BUCKET, STREAM, direct_get_subject, key_subject,
+        };
+
+        let p = policy_with_agent_subject()
+            .with_agent_token_subjects(vec![
+                "$JS.API.DIRECT.GET.KV_agent-schedules.$KV.agent-schedules.{agent}".to_owned(),
+            ])
+            .expect("a per-agent template is valid");
+        let atlas = p.agent_token_permissions("atlas").expect("configured");
+        assert_eq!(atlas.publish, vec![direct_get_subject("atlas")]);
+        // Control: argus's own expansion is a different subject, so atlas
+        // lacking it is the grant being scoped, not the template being empty.
+        let argus = p.agent_token_permissions("argus").expect("configured");
+        assert_eq!(argus.publish, vec![direct_get_subject("argus")]);
+        assert!(!atlas.publish.contains(&direct_get_subject("argus")));
+
+        let covers = |grant: &str, subject: &str| {
+            let g: Vec<&str> = grant.split('.').collect();
+            let s: Vec<&str> = subject.split('.').collect();
+            for (i, t) in g.iter().enumerate() {
+                match *t {
+                    ">" => return s.len() > i,
+                    "*" if i < s.len() => {}
+                    t if s.get(i) == Some(&t) => {}
+                    _ => return false,
+                }
+            }
+            g.len() == s.len()
+        };
+        for refused in [
+            direct_get_subject("argus"),
+            format!("$JS.API.DIRECT.GET.{STREAM}"),
+            format!("$JS.API.STREAM.INFO.{STREAM}"),
+            format!("$JS.API.STREAM.CREATE.{STREAM}"),
+            format!("$JS.API.STREAM.DELETE.{STREAM}"),
+            format!("$JS.API.STREAM.MSG.GET.{STREAM}"),
+            format!("$JS.API.CONSUMER.CREATE.{STREAM}"),
+            format!(
+                "$JS.API.CONSUMER.CREATE.{STREAM}.w.{}",
+                key_subject("atlas")
+            ),
+            key_subject("atlas"),
+            key_subject("argus"),
+            "$JS.API.DIRECT.GET.KV_agent-icons.$KV.agent-icons.atlas".to_owned(),
+            "$JS.API.DIRECT.GET.KV_hive-wanted-alpha.$KV.hive-wanted-alpha.alpha".to_owned(),
+            "$JS.API.INFO".to_owned(),
+        ] {
+            assert!(
+                !atlas.publish.iter().any(|g| covers(g, &refused)),
+                "atlas's grant covers {refused}"
+            );
+        }
+        // Control: the matcher does match, so the refusals above are not
+        // vacuous.
+        assert!(covers(&atlas.publish[0], &direct_get_subject("atlas")));
+        assert!(covers("$KV.*.>", &key_subject("argus")));
+
+        let shared = p.permissions("hive-alpha-agent").expect("alpha's agents");
+        assert!(
+            !shared.publish.iter().any(|s| s.contains(BUCKET)),
+            "the hive's shared agent client got a schedule subject: {shared:?}"
+        );
+    }
+
     #[test]
     fn an_agent_token_subject_without_the_placeholder_is_refused() {
         let err = policy()