0f7b403803
A new swarm service, swarm-notify-router, in its own container on the host
that sets deploy.notify-router.enable (defaulted on by allSwarmServices where
the host has the router's store leaf, like the claude login minter).
- swarm-controller registers instance-wide hooks for `issues` +
`issue_assign` and `pull_request` + `pull_request_assign`, updates the
event list of a hook already registered with fewer (leaving its active flag as it is), and keeps each
verified body unchanged in the SWARM_EVENTS stream on
$SWARM.events.forge.<X-Forgejo-Event-Type>, deduped by X-Forgejo-Delivery.
A delivery the stream did not keep answers 503.
- swarm-notify-router drains its durable consumer on that stream, runs its
flows (source -> match -> todo sink, stored as nodes plus edges and checked
to be a tree) and queues each op on $SWARM.router.todo.<agent> in the
work-queue stream ROUTER_TODOS. Built-in flows: assigned, unassigned (same
key, rewritten) and closed (prefix-clears every holder's router todos). A
per-issue snapshot in its notify-router-state bucket holds the last
assignees and the todo holders; only agents in the agent-status bucket get
ops, and an assignee that was not one is left out of the snapshot so the
next assign event retries it. After the first event that must be retried,
the rest of the batch is nakked so redelivery keeps stream order.
- hive-agent creates its own durable consumer todo-<agent> and applies each
op to its todo store as subsystem `router`, then acks; a refused op stops
the rest of its batch the same way. The store's (subsystem, key) dedup
makes a redelivery harmless. New Todos::clear_prefix.
- swarm-nats-auth: a --notify-router-client arm; the controller may publish
$SWARM.events.forge.*; each agent gets three {agent} templates (extended
consumer create whose filter the server checks, MSG.NEXT, ACK).
- Credentials: a notify-router store leaf minted by glue-bao-tls, a
swarm-notify-router bao policy (read on its own queue client secret), an
authelia machine client, the secret publisher entry, a journal forwarder
route. No manual step.
hive-forge-notify is unchanged, so agents also still get forge's own
notifications.
Refs #5571
87 lines
3 KiB
TOML
87 lines
3 KiB
TOML
[package]
|
|
name = "hive-agent"
|
|
edition.workspace = true
|
|
version.workspace = true
|
|
readme = "README.md"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
anyhow.workspace = true
|
|
# Named directly for the client type the publishers hold, and for `jetstream`,
|
|
# which the icon publisher's acked write needs. The connect and the credential
|
|
# handling live in `swarm-queue-client` below.
|
|
async-nats = { workspace = true, features = ["jetstream"] }
|
|
axum.workspace = true
|
|
backon.workspace = true
|
|
chrono.workspace = true
|
|
reqwest.workspace = true
|
|
hyper.workspace = true
|
|
hyper-util.workspace = true
|
|
http-body-util.workspace = true
|
|
futures-util = "0.3"
|
|
clap.workspace = true
|
|
hive-claude.workspace = true
|
|
hive-runtime.workspace = true
|
|
hive-agent-sock.workspace = true
|
|
hive-core-agent-sock.workspace = true
|
|
hive-log.workspace = true
|
|
hive-sh4re.workspace = true
|
|
hive-sock-client.workspace = true
|
|
hive-types.workspace = true
|
|
libc.workspace = true
|
|
opentelemetry.workspace = true
|
|
opentelemetry_sdk.workspace = true
|
|
opentelemetry-otlp.workspace = true
|
|
rmcp.workspace = true
|
|
rusqlite.workspace = true
|
|
schemars.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
# The git blob id of AGENTS.md, the revision an edit from the swarm names.
|
|
sha1 = "0.10"
|
|
# `agent-schedules`, `agent-inference` and `operator-profiles`: the schedule
|
|
# ticker and the inference poller each read their own key, and the prompt
|
|
# renderer the operator list, with one direct get.
|
|
# `router-todo`: the consumer that drains the notification router's todo ops
|
|
# for this agent.
|
|
# `kv`/`notices` name buckets and streams this harness opens neither end of,
|
|
# and the terminal publisher is a plain core-subject publish.
|
|
swarm-queue-client = { workspace = true, features = [
|
|
"agent-schedules",
|
|
"agent-inference",
|
|
"agent-permissions",
|
|
"agents-md-initial",
|
|
"operator-profiles",
|
|
"router-todo",
|
|
] }
|
|
# The spelling of the token the queue connection presents.
|
|
swarm-agent-verify.workspace = true
|
|
swarm-wire.workspace = true
|
|
# This agent's own queue secret, read from the store under its own certificate.
|
|
swarm-secret-client.workspace = true
|
|
# The directory an AGENTS.md edit is applied in, and the file it is written
|
|
# through.
|
|
tempfile = "3"
|
|
tokio.workspace = true
|
|
tokio-stream.workspace = true
|
|
tower-http.workspace = true
|
|
tracing.workspace = true
|
|
|
|
# `test-util` for `#[tokio::test(start_paused = true)]`: `swarm_agent_state`'s
|
|
# refresh test waits out its one-minute interval on paused time.
|
|
[dev-dependencies]
|
|
tokio = { workspace = true, features = ["test-util"] }
|
|
# A WebSocket client for the screen relay teardown test; the same version
|
|
# axum's `ws` feature already pulls in.
|
|
tokio-tungstenite = "0.29"
|
|
tower = { version = "0.5", features = ["util"] }
|
|
# A layer that captures `swarm_queue`'s exhausted-connect log event in a test.
|
|
tracing-subscriber.workspace = true
|
|
|
|
# Single harness serve-loop binary: `hive-agent` (from `src/main.rs`).
|
|
# The sibling MCP server is its own bin crate now (`hive-agent-mcp`).
|
|
# Privilege boundary is enforced server-side at the socket (tool
|
|
# groups / manager surface).
|
|
# See `docs/turn-loop/README.md::Harness binary shape`.
|