Files
skills/hub/kvb_hub/ledger.py
T
Kevin Veen-BirkenbachandClaude Opus 5.5 8ba45efd04 feat(hub): kvb-hub review hub with passkey-signed approvals
The kvb-hub is a local review hub in a container bound to 127.0.0.1: one page, JSON APIs and an MCP endpoint for the operator's inbox, asks, decisions, staged-commit reviews, the radio stream, the agent graph, the worktree tree, push-to-talk and read-aloud radio (Piper, whisper.cpp) and an optional LLM command line. The hub is only a relay. The host executors in hub/client (the runner user service, the PermissionRequest hook and the approval CLI the commit skills call) verify a WebAuthn passkey signature against keys pinned outside every sandbox, refuse replays and fail closed. scripts/hub.sh with make hub-install, hub-check, hub-pin, hub-runner and hub-hook installs and checks the hub; hub-hook writes ~/.claude/settings.json after a backup. make watch-check shows a stuck watch hook. The new kvb-git-diff skill and the commit skills route reviews through the hub; the test_hub_* suites replace test_hub.py.

Security review (kvb-think-criticize, three skeptics) fixed four holes: signed rules auto-approved chained shell commands; the client and LLM openers followed redirects, the LLM one with its bearer key; the worktree scan ran git fsmonitor and filter commands from agent-writable repos; compose set no memory, pids or health limits. Documented until core requirement 093, on the operator's word: the hub page is trusted while signing and pinning, local processes can forge the unsigned operator actions, and the container reads the host /tmp. Committed on the operator's word despite the gate: the passkey path is not yet verified live.

Accepted MEDUSA false positives (137 findings on 115 lines, rows in security-accepted.jsonl): EXA002 x17, MEDUSA-MM-SCAN-058 x12, B603 x8, MEDUSA-FTSC-SCAN-089 x7, MEDUSA-PRIV-SCAN-762 x6, AIC-EXFIL-005 x5, EXA006 x5, MEDUSA-FTSCAN-231 x5, WEB-SSRF x5, MEDUSA-INF-SCAN-2057 x3, RH005 x3, TC001 x3, LO002 x2, MEDUSA-AEXP-SCAN-096 x2, MEDUSA-CGS-SCAN-028 x2, MEDUSA-INF-SCAN-1350 x2, MEDUSA-INF-SCAN-2369 x2, MEDUSA-INF-SCAN-2440 x2, MEDUSA-INF-SCAN-2638 x2, MLSC-SERIAL-002 x2, PL002 x2, PQC005 x2, SAST-PATH-001 x2, TC004 x2, TC005 x2, TC006 x2, TC007 x2, AA-146, EXA007, FINE-050, GB-ENCODE-001, GB-ENCODE-003, MEDUSA-CGS-SCAN-029, MEDUSA-CGS-SCAN-103, MEDUSA-DP-SCAN-1034, MEDUSA-DP-SCAN-1916, MEDUSA-DP-SCAN-954, MEDUSA-EXF26-TOOL-004, MEDUSA-FT-TRIGGER-005, MEDUSA-INF-SCAN-2206, MEDUSA-INF-SCAN-2457, MEDUSA-INF-WEB-003, MEDUSA-INFRA-SCAN-030, MEDUSA-MP-SCAN-1135, MEDUSA-RLHF-POISON-002, MEDUSA-RT-SCAN-006, MM-ENCODE-001, MP-124, PQC001, PQC002, PQC006, RP001, TC009, TC010, WEB-FLASK-004.

🎯 Fix: 80 %
💥 Break: 4 %
💸 Cost: 129 %
⏱️ Time: –
🛡️ Security: 100 %
💰 Value: ?
🏆 Score: 60
🚦 Gate: ⛔ fix 80 % < 90; cost 129 % > 100: ask the operator before the commit

```
/home/kevinveenbirkenbach/Repositories/github.com/kevinveenbirkenbach/skills/.worktrees/feature/kvb-hub
```

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 18:46:40 +00:00

124 lines
4.5 KiB
Python

from __future__ import annotations
import json
import secrets
import threading
from pathlib import Path
from .records import read_json, stamp, write_atomic
class Ledger:
def __init__(self, file: Path) -> None:
self.file = file
self.changed = threading.Condition()
self.items: dict[str, dict] = {}
if file.is_file():
self.items = json.loads(file.read_text(encoding="utf-8"))
def fresh(self) -> str:
with self.changed:
item_id = secrets.token_hex(8)
while item_id in self.items:
item_id = secrets.token_hex(8)
return item_id
def write(self, items: dict[str, dict]) -> None:
write_atomic(self.file, json.dumps(items, indent=1, sort_keys=True).encode("utf-8"))
self.items = items
def insert(self, item_id: str, fields: dict) -> dict:
with self.changed:
record = {**fields, "id": item_id, "created": stamp()}
self.write({**self.items, item_id: record})
return dict(record)
def add(self, fields: dict) -> dict:
with self.changed:
return self.insert(self.fresh(), fields)
def get(self, item_id: str) -> dict | None:
with self.changed:
record = self.items.get(item_id)
return None if record is None else dict(record)
def listed(self) -> list[dict]:
with self.changed:
records = [dict(record) for record in self.items.values()]
return sorted(records, key=lambda record: (record["created"], record["id"]))
def pending(self) -> list[dict]:
return [record for record in self.listed() if record.get("status") == "pending"]
def transition(self, item_id: str, before: str, changes: dict) -> tuple[dict | None, bool]:
with self.changed:
record = self.items.get(item_id)
if record is None:
return None, False
if record.get("status") != before:
return dict(record), False
updated = {**record, **changes}
self.write({**self.items, item_id: updated})
self.changed.notify_all()
return dict(updated), True
def decide(self, item_id: str, changes: dict) -> tuple[dict | None, bool]:
return self.transition(item_id, "pending", {**changes, "decided": stamp()})
def change(self, item_id: str, changes: dict) -> dict | None:
with self.changed:
record = self.items.get(item_id)
if record is None:
return None
updated = {**record, **changes}
self.write({**self.items, item_id: updated})
return dict(updated)
def remove(self, item_id: str) -> bool:
with self.changed:
if item_id not in self.items:
return False
self.write({key: value for key, value in self.items.items() if key != item_id})
return True
def wait(self, item_id: str, timeout: float) -> dict | None:
with self.changed:
if item_id not in self.items:
return None
self.changed.wait_for(lambda: self.items[item_id].get("status") != "pending", timeout)
return dict(self.items[item_id])
class Reviews(Ledger):
def __init__(self, state: Path) -> None:
super().__init__(state / "reviews.json")
self.pages = state / "pages"
self.pages.mkdir(exist_ok=True)
def stored(self, review_id: str, suffix: str) -> Path:
return self.pages / f"{review_id}{suffix}"
def submit(self, fields: dict[str, str], page: bytes, files: list[dict]) -> dict:
with self.changed:
review_id = self.fresh()
write_atomic(self.stored(review_id, ".html"), page)
write_atomic(self.stored(review_id, ".json"), json.dumps({"files": files}).encode("utf-8"))
return self.insert(review_id, {**fields, "files": len(files), "status": "pending", "decided": None})
class Marks:
def __init__(self, file: Path) -> None:
self.file = file
self.lock = threading.Lock()
data = read_json(file)
self.items: dict[str, dict] = data if isinstance(data, dict) else {}
def put(self, key: str, mark: dict) -> None:
with self.lock:
self.items = {**self.items, key: mark}
write_atomic(self.file, json.dumps(self.items, sort_keys=True).encode("utf-8"))
def get(self, key: str) -> dict:
with self.lock:
return dict(self.items.get(key, {"until": 0.0, "pinned": False}))