f862354e43
An agent's capabilities move from the hive's meta repo
(`meta/capabilities.json`, injected as `HIVE_CAPABILITIES`) into the
`capabilities` field of its key in a new `agent-permissions` KV bucket,
which swarm-controller alone writes.
- swarm-queue-client: `agent_permissions` (bucket, key, `AgentPermissions`,
direct-get read, the import subject and its wire types).
- swarm-controller: creates the bucket at start; `GET|PUT|DELETE
/api/agents/{name}/permissions` (deny_unknown_fields and unknown
capability ⇒ 422, duplicate ⇒ 400, agent must be declared by a hive);
answers each hive's one-shot import, writing a key only where there is
none and only for agents that hive's wanted state declares.
- swarmctl: `agent permissions get|set|clear`.
- swarm-nats-auth: a hive reads every key of the bucket and sends its
import on its own subject; the controller subscribes to the imports and
may answer them (`responses`).
- hive-c0re: reads each of its agents' keys every 30s into
/var/lib/hyperhive/swarm-agent-permissions.json and restarts an agent,
gracefully, when its capabilities change. Unset is the compiled-in
default (ruth: manage_root_agent; everyone else: none). A failed read
keeps the stored value. On first boot it seeds that file from
meta/capabilities.json, sends the grants to the controller, and deletes
the file once the controller answers.
Deleted: the capabilities.json reader/writer, `HIVE_CAPABILITIES` in the
rendered meta flake, ruth's capability seed, the capabilities half of the
permissions rebuild job (`PermPayload::Capabilities`/`Combined`), the
dashboard's capabilities table and `capabilities_changed` event, and the
now-unused `Capability::description`.
Part of #5170.
99 lines
4.9 KiB
TOML
99 lines
4.9 KiB
TOML
[package]
|
|
name = "swarm-queue-client"
|
|
version.workspace = true
|
|
readme = "README.md"
|
|
edition.workspace = true
|
|
|
|
[features]
|
|
# OFF by default, and that default is the point: the auth-callout responder
|
|
# consumes this crate for the connect alone and speaks neither `jetstream`
|
|
# nor `kv`. A consumer that needs the status bucket says so in its own
|
|
# Cargo.toml, so the requirement stays visible where it is incurred.
|
|
#
|
|
# What is behind the flag is deliberately narrow - the *name and shape* of
|
|
# one bucket two crates open from opposite ends (`src/status.rs`), not a
|
|
# general "KV support" surface. The crate's job still ends at a connected
|
|
# client; the exception exists because an agreement between two crates has
|
|
# to live in one of them, and neither end of that bucket is senior to the
|
|
# other.
|
|
kv = ["async-nats/kv"]
|
|
# 🩸 `jetstream` is NOT in async-nats's default feature set here — the
|
|
# workspace-level dependency turns default features off entirely (see
|
|
# root `Cargo.toml`: `server_2_14`/`nkeys`/`ring` only). `kv` above works
|
|
# standalone only because async-nats's own `kv` feature pulls `jetstream`
|
|
# in transitively; `notices.rs` uses `async_nats::jetstream` directly and
|
|
# needs the same request explicitly, or it only compiles by accident when
|
|
# something else in the same build happens to also enable `kv` (which is
|
|
# exactly how this went unnoticed: `cargo test` at the workspace level
|
|
# unifies features across every crate being built, so `hive-c0re`'s own
|
|
# `kv` request silently carried `notices.rs` until a single-crate
|
|
# `cargo check -p swarm-nats-auth` — no `kv` anywhere in that build —
|
|
# surfaced it as `cannot find jetstream in async_nats`).
|
|
notices = ["async-nats/jetstream"]
|
|
# `subagent_term::open_or_create`, for swarm-controller, which creates every
|
|
# agent's subagent stream. Explicit for the same reason as `notices`.
|
|
subagent-term = ["async-nats/jetstream"]
|
|
# `agent_term::open_or_create` and the replay consumer, for swarm-controller,
|
|
# which creates every agent's terminal stream and replays it to swarm-ui.
|
|
# Explicit for the same reason as `notices`.
|
|
agent-term = ["async-nats/jetstream"]
|
|
# `agent_schedules::read_own`, for the agent harness, which reads its own
|
|
# schedule key without opening the bucket. Explicit for the same reason as
|
|
# `notices`.
|
|
agent-schedules = ["async-nats/jetstream"]
|
|
# `agent_inference::read_own`, for the agent harness, which reads its own
|
|
# inference key the same way. Explicit for the same reason as `notices`.
|
|
agent-inference = ["async-nats/jetstream"]
|
|
# `ToSchema` on the review classifier's shared types, for swarm-controller,
|
|
# whose HTTP API serves the same shapes the queue carries.
|
|
schema = ["dep:utoipa"]
|
|
# `agent_limits::read`, for hive-c0re, which reads the key of each agent it
|
|
# runs the same way. Explicit for the same reason as `notices`.
|
|
agent-limits = ["async-nats/jetstream"]
|
|
# `agent_permissions::AgentPermissions` and `read`, for hive-c0re and
|
|
# swarm-controller. Pulls `hive-sh4re` for the `Capability` names, so the
|
|
# crates that only need the bucket name do not link it.
|
|
agent-permissions = ["dep:hive-sh4re", "async-nats/jetstream"]
|
|
|
|
[dependencies]
|
|
# Bare (no `kv`/`jetstream`) unless a consumer opts into the `kv` feature
|
|
# above - the connect itself needs none of them.
|
|
async-nats.workspace = true
|
|
# `Shared`, so every caller refused while a secret re-read runs waits on that
|
|
# one read (`stored_secret`).
|
|
futures-util.workspace = true
|
|
hive-sh4re = { workspace = true, optional = true }
|
|
# `blocking` on top of the workspace default (`form`/`json`/`rustls`) —
|
|
# `mint_token_for_blocking` needs `reqwest::blocking::Client` for a caller
|
|
# with no tokio reactor to `.await` an async request on (an OTLP exporter's
|
|
# `HttpClient` impl, see that function's doc). Declared here rather than
|
|
# left to arrive transitively from a consumer that happens to pull in
|
|
# `reqwest`'s blocking feature some other way — this crate already has a
|
|
# recorded case of exactly that kind of accidental compile (see the `kv`
|
|
# feature's comment above), and `cargo check -p swarm-queue-client` alone
|
|
# must not depend on what else is in the build.
|
|
reqwest = { workspace = true, features = ["blocking"] }
|
|
rustls.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
strum.workspace = true
|
|
# A library, so its errors are a matchable enum rather than an opaque
|
|
# `anyhow::Error`. The binaries that consume this keep anyhow; `?` converts.
|
|
thiserror.workspace = true
|
|
tokio.workspace = true
|
|
tracing.workspace = true
|
|
utoipa = { workspace = true, optional = true }
|
|
|
|
[dev-dependencies]
|
|
# A loopback stand-in token endpoint for the client secret re-read tests.
|
|
axum.workspace = true
|
|
data-encoding.workspace = true
|
|
# `test-util` for `#[tokio::test(start_paused = true)]`: the re-read backoff
|
|
# tests run on paused time.
|
|
tokio = { workspace = true, features = ["test-util"] }
|
|
# Capturing what a re-read logs, to check it names the client and never the
|
|
# secret.
|
|
tracing-subscriber.workspace = true
|
|
|
|
[lints]
|
|
workspace = true
|