refactor(#2352): move hivectl-shared layout consts to hive-host-sock

hive-host-sock/src/lib.rs

@@ -6,9 +6,51 @@
 //! payload types it references (`Approval`, `AgentStatusRow`, `jobs::DagView`)
 //! stay in `hive-sh4re`.
 
+use std::path::PathBuf;
+
 use hive_sh4re::{AgentStatusRow, Approval, jobs};
 use serde::{Deserialize, Serialize};
 
+// ── Shared hive layout facts ──────────────────────────────────────────────
+// Paths + names both the `hive-c0re` daemon and the host-side `hivectl` CLI
+// must agree on. Homed here (the protocol crate both sides already depend on)
+// so a standalone `hivectl` can reach them without linking the whole daemon
+// crate. `hive-c0re`'s `paths` / `lifecycle` modules re-export these, staying
+// the daemon's single-source facade for its own callsites.
+
+/// Default host admin socket (`/run/hyperhive/host.sock`). Used as the
+/// `--socket` / `--host-socket` clap `default_value` in the daemon and
+/// `hivectl`.
+pub const HOST_SOCKET: &str = "/run/hyperhive/host.sock";
+
+/// `agents/` — per-agent persistent state root (one subdir per agent,
+/// bind-mounted into each container as `/agents/<name>`).
+// nix: agent container bind-mount source (harness modules / agent.nix template) — must match.
+// priv-sock: `hive_priv_sock::AGENT_STATE_ROOT` is the same value and must stay in sync;
+//        the privsep boundary prevents importing across the crate.
+pub const AGENTS_ROOT: &str = "/var/lib/hyperhive/agents";
+
+/// `agents/<name>` — one agent's persistent state root.
+#[must_use]
+pub fn agent_state_dir(name: &str) -> PathBuf {
+    PathBuf::from(AGENTS_ROOT).join(name)
+}
+
+/// `gateway/gateway.htpasswd` — nginx basic-auth credential store for the
+/// operator dashboard vhost. `hivectl`'s `--htpasswd-file` clap default.
+// nix: read by the gateway container's nginx (hive-gateway.nix) — must match.
+pub const GATEWAY_HTPASSWD: &str = "/var/lib/hyperhive/gateway/gateway.htpasswd";
+
+/// nspawn machine-name prefix for agent containers (`h-<name>`). A single
+/// `starts_with(AGENT_PREFIX)` filter enumerates managed containers.
+pub const AGENT_PREFIX: &str = "h-";
+
+/// Map an agent's logical name to its nspawn machine name (`h-<name>`).
+#[must_use]
+pub fn container_name(name: &str) -> String {
+    format!("{AGENT_PREFIX}{name}")
+}
+
 /// Requests on the host admin socket.
 ///
 /// Wire format: one JSON object per line.