The kvb-hub is a local review hub in a container bound to 127.0.0.1: one page, JSON APIs and an MCP endpoint for the operator's inbox, asks, decisions, staged-commit reviews, the radio stream, the agent graph, the worktree tree, push-to-talk and read-aloud radio (Piper, whisper.cpp) and an optional LLM command line. The hub is only a relay. The host executors in hub/client (the runner user service, the PermissionRequest hook and the approval CLI the commit skills call) verify a WebAuthn passkey signature against keys pinned outside every sandbox, refuse replays and fail closed. scripts/hub.sh with make hub-install, hub-check, hub-pin, hub-runner and hub-hook installs and checks the hub; hub-hook writes ~/.claude/settings.json after a backup. make watch-check shows a stuck watch hook. The new kvb-git-diff skill and the commit skills route reviews through the hub; the test_hub_* suites replace test_hub.py. Security review (kvb-think-criticize, three skeptics) fixed four holes: signed rules auto-approved chained shell commands; the client and LLM openers followed redirects, the LLM one with its bearer key; the worktree scan ran git fsmonitor and filter commands from agent-writable repos; compose set no memory, pids or health limits. Documented until core requirement 093, on the operator's word: the hub page is trusted while signing and pinning, local processes can forge the unsigned operator actions, and the container reads the host /tmp. Committed on the operator's word despite the gate: the passkey path is not yet verified live. Accepted MEDUSA false positives (137 findings on 115 lines, rows in security-accepted.jsonl): EXA002 x17, MEDUSA-MM-SCAN-058 x12, B603 x8, MEDUSA-FTSC-SCAN-089 x7, MEDUSA-PRIV-SCAN-762 x6, AIC-EXFIL-005 x5, EXA006 x5, MEDUSA-FTSCAN-231 x5, WEB-SSRF x5, MEDUSA-INF-SCAN-2057 x3, RH005 x3, TC001 x3, LO002 x2, MEDUSA-AEXP-SCAN-096 x2, MEDUSA-CGS-SCAN-028 x2, MEDUSA-INF-SCAN-1350 x2, MEDUSA-INF-SCAN-2369 x2, MEDUSA-INF-SCAN-2440 x2, MEDUSA-INF-SCAN-2638 x2, MLSC-SERIAL-002 x2, PL002 x2, PQC005 x2, SAST-PATH-001 x2, TC004 x2, TC005 x2, TC006 x2, TC007 x2, AA-146, EXA007, FINE-050, GB-ENCODE-001, GB-ENCODE-003, MEDUSA-CGS-SCAN-029, MEDUSA-CGS-SCAN-103, MEDUSA-DP-SCAN-1034, MEDUSA-DP-SCAN-1916, MEDUSA-DP-SCAN-954, MEDUSA-EXF26-TOOL-004, MEDUSA-FT-TRIGGER-005, MEDUSA-INF-SCAN-2206, MEDUSA-INF-SCAN-2457, MEDUSA-INF-WEB-003, MEDUSA-INFRA-SCAN-030, MEDUSA-MP-SCAN-1135, MEDUSA-RLHF-POISON-002, MEDUSA-RT-SCAN-006, MM-ENCODE-001, MP-124, PQC001, PQC002, PQC006, RP001, TC009, TC010, WEB-FLASK-004. 🎯 Fix: 80 % 💥 Break: 4 % 💸 Cost: 129 % ⏱️ Time: – 🛡️ Security: 100 % 💰 Value: ? 🏆 Score: 60 🚦 Gate: ⛔ fix 80 % < 90; cost 129 % > 100: ask the operator before the commit ``` /home/kevinveenbirkenbach/Repositories/github.com/kevinveenbirkenbach/skills/.worktrees/feature/kvb-hub ``` Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
81 lines
3.7 KiB
Python
81 lines
3.7 KiB
Python
from __future__ import annotations
|
|
|
|
from collections import Counter
|
|
|
|
from .council import HUMAN, agent, ordered, subagent
|
|
from .names import Directory
|
|
from .orbits import affinity
|
|
from .records import shown
|
|
from .register import ENDED, parties, status_of
|
|
|
|
CHAIR = "Maintainer"
|
|
|
|
|
|
def parent_of(roles: dict[str, str], known: set[str], fallback: str) -> str:
|
|
for letter in "AR":
|
|
names = sorted(name for name, letters in roles.items() if letter in letters and name in known)
|
|
if names:
|
|
return names[0]
|
|
return fallback
|
|
|
|
|
|
def duties(name: str, task: str, row: dict, holders: dict[str, dict[str, dict]]) -> dict:
|
|
entry = {"task": task, "title": shown(row.get("title")), "status": status_of(row), "worker": False, "letters": ""}
|
|
return holders.setdefault(name, {}).setdefault(task, entry)
|
|
|
|
|
|
def edges(radio: list[dict], grant_rows: list[dict], chair: str) -> list[dict]:
|
|
counts: Counter[tuple[str, str, str]] = Counter()
|
|
for row in (row for row in radio if row["source"]):
|
|
for target in row["targets"] or ["*"]:
|
|
counts[(row["source"], target, row["class"])] += 1
|
|
for grant in grant_rows:
|
|
counts[(chair, grant["target"], "grant")] += 1
|
|
return [{"source": s, "target": t, "class": c, "count": n} for (s, t, c), n in sorted(counts.items())]
|
|
|
|
|
|
def graph(radio: list[dict], grant_rows: list[dict], tasks: dict[str, dict], claims: list[dict], end: float, directory: Directory) -> dict:
|
|
current = {task: row for task, row in sorted(tasks.items()) if status_of(row) not in ENDED}
|
|
chair = directory.key(CHAIR, end)
|
|
workers = {task: agent(row.get("worker")) for task, row in current.items()}
|
|
keys = {row["source"] for row in radio} | {key for row in radio for key in row["targets"]}
|
|
keys |= {claim["session"] for claim in claims if claim["agent"] and claim["session"] != "-"}
|
|
keys |= {directory.key(name, end) for name in workers.values() if not subagent(name)}
|
|
found = sorted(keys - {"", HUMAN, chair}, key=lambda key: (directory.label(key, end).lower(), key))
|
|
known = {chair, *found}
|
|
moons: dict[str, tuple[str, str]] = {}
|
|
holders: dict[str, dict[str, dict]] = {}
|
|
for task, row in current.items():
|
|
roles: dict[str, str] = {}
|
|
for name, letters in parties(row).items():
|
|
key = directory.key(name, end)
|
|
roles[key] = roles.get(key, "") + letters
|
|
worker = workers[task]
|
|
holder = directory.key(worker, end)
|
|
if subagent(worker):
|
|
parent = parent_of(roles, known, chair)
|
|
holder = f"{worker} @ {parent}"
|
|
moons[holder] = (parent, worker)
|
|
if holder:
|
|
duties(holder, task, row, holders)["worker"] = True
|
|
for key, letters in roles.items():
|
|
duties(key, task, row, holders)["letters"] += letters
|
|
plan = [(HUMAN, "operator", None, HUMAN), (chair, "chair", None, directory.label(chair, end))]
|
|
plan += [(key, "session", None, directory.label(key, end)) for key in found]
|
|
plan += [(moon, "subagent", *moons[moon]) for moon in ordered(set(moons))]
|
|
nodes = [
|
|
{
|
|
"id": key,
|
|
"kind": node_kind,
|
|
"parent": parent,
|
|
"label": label,
|
|
"names": directory.names(key) or [label],
|
|
"timeline": directory.timeline(key) or [{"name": label, "since": end}],
|
|
"tasks": list(holders.get(key, {}).values()),
|
|
"claims": [claim for claim in claims if claim["session"] == key],
|
|
}
|
|
for key, node_kind, parent, label in plan
|
|
]
|
|
layout = affinity(nodes, radio, tasks, claims, end, lambda name: directory.key(name, end))
|
|
return {"nodes": nodes, "edges": edges(radio, grant_rows, chair), "layout": layout}
|