Phase 4: manager socket + manager_server with privileged tool surface

hive-sh4re/src/lib.rs

@@ -94,3 +94,33 @@ pub enum AgentResponse {
     /// `Recv` found nothing pending.
     Empty,
 }
+
+// -----------------------------------------------------------------------------
+// Manager socket — /run/hyperhive/manager/mcp.sock on the host, bind-mounted
+// into the manager container at /run/hive/mcp.sock.
+// -----------------------------------------------------------------------------
+
+/// Logical name the broker uses for the manager.
+pub const MANAGER_AGENT: &str = "manager";
+
+/// Requests on the manager socket. Manager has the agent surface (send/recv)
+/// plus privileged lifecycle verbs.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(tag = "cmd", rename_all = "snake_case")]
+pub enum ManagerRequest {
+    Send { to: String, body: String },
+    Recv,
+    /// Spawn a sub-agent. Phase 5 will gate this on user approval.
+    Spawn { name: String },
+    /// Stop a sub-agent (graceful).
+    Kill { name: String },
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum ManagerResponse {
+    Ok,
+    Err { message: String },
+    Message { from: String, body: String },
+    Empty,
+}