derive an agent's backend hosts into the egress allow list at the controller

swarm-wire/src/egress_allow.rs

@@ -44,6 +44,12 @@ pub struct Entry {
     /// The agent this entry is for; absent means every agent in the swarm.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub agent: Option<String>,
+    /// The controller derived this entry from the agent's backend environment
+    /// and replaces it whenever that changes; an operator can neither add nor
+    /// remove one. A hive renders it like any other entry, and a reader that
+    /// predates the field ignores it.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub derived: bool,
 }
 
 /// The value under [`BUCKET`]/[`KEY`]. No `deny_unknown_fields`: a field a
@@ -222,10 +228,12 @@ mod tests {
                 Entry {
                     domain: "github.com".to_owned(),
                     agent: None,
+                    derived: false,
                 },
                 Entry {
                     domain: "crates.io".to_owned(),
                     agent: Some("atlas".to_owned()),
+                    derived: false,
                 },
             ],
         };
@@ -238,4 +246,23 @@ mod tests {
             AllowList::default()
         );
     }
+
+    /// A hive that predates `derived` decodes the entry through this same
+    /// tolerance: it keeps `domain` and `agent` and drops the rest.
+    #[test]
+    fn a_derived_entry_round_trips_and_an_entry_tolerates_fields_it_does_not_know() {
+        let derived = Entry {
+            domain: "llm.example.com".to_owned(),
+            agent: Some("atlas".to_owned()),
+            derived: true,
+        };
+        let wire = r#"{"domain":"llm.example.com","agent":"atlas","derived":true}"#;
+        assert_eq!(serde_json::to_string(&derived).unwrap(), wire);
+        assert_eq!(serde_json::from_str::<Entry>(wire).unwrap(), derived);
+        // Absent means a manual entry; an unknown field is dropped.
+        let manual: Entry =
+            serde_json::from_str(r#"{"domain":"a.io","agent":"atlas","later":1}"#).unwrap();
+        assert!(!manual.derived);
+        assert_eq!(manual.domain, "a.io");
+    }
 }