| Filename | Latest commit message | Latest commit date |
|---|---|---|
1b4e764e5c
The swarm settings gain `runtime` (`api-key`, the default, or `acp`) and an `acp` provider record: an https base URL, the provider's model, and its prices per million tokens. A PUT now changes only the fields its body names, so the settings form that sends model, effort and limit leaves the runtime alone; `null` clears `effort` or `acp`. The body stays strict, and the stored document keeps #5192's lenient read. The controller sends the runtime in each run request. On `acp` the classifier runs one prompt on a new `opencode acp` session per classification through hive-runtime's AcpRuntime, in a scratch directory, with a config rendered from the settings. opencode runs `read` and other tools without asking, so OPENCODE_PERMISSION {"*":"deny"} takes every tool away from the model, and a deny-all policy refuses any request on top. The title call, which resends the prompt, is turned off. The deadline cancels the turn, and a turn that does not end within 15s of that is dropped, which also covers an agent stuck before its prompt. The answer is the final assistant text, as ACP has no result event. The provider key is read per run from swarm/services/review-classifier/acp-provider, which the bao UI's admins login may create and update, and reaches opencode through AcpRuntime::with_provider_key and the trampoline's allowlist. Each ACP classification's cost is computed from the configured prices and the reported tokens, and added to hyperhive.review_classifier.cost.usage labelled repo, pr, model and currency. Part of #5096 |
||
| .. | ||
| src | ||
| tests | ||
| Cargo.toml | ||
| README.md | ||
swarm-review-classifier
The review classifier's try-out service, in the swarm-review-classifier
container on the host that sets deploy.review-classifier.enable. The
design is docs/swarm/review-classifier.md.
swarm-controller reads a PR (its head commit, its commits and its diff) and sends it, with the operator's classifications, as a request on the queue. This service asks a small model one classification at a time and answers with the result table and the overall verdict. It writes nothing to the forge and holds no forge credential.
What a run is
- The shared context first: a system prompt, the PR's commits with their full
messages, and the diff with lockfiles collapsed as
hive-forge diffdoes. Every classification's prompt starts with the same bytes. - One
claude --printper classification, with no session, no tools (--tools ""), no MCP server, its own empty directory andANTHROPIC_API_KEYin its environment only. - An answer is a JSON object with a verdict, a certainty and a reason; the
classifier truncates a reason over 500 characters to 499 plus
…. A failed run, a timeout or an answer that doesn't validate leaves that row without a verdict, and it doesn't count. - A run with no API key, or with no classification answered, fails as a whole: the caller sees an error, never a verdict.
Credentials
The container holds one credential: its own store certificate, which nspawn hands in at start without a copy on disk. With it the service reads its queue client secret at start and the API key at every run, so a key written or removed in the store takes effect on the next run. Its store role reads exactly those two paths.