The kvb-hub is a local review hub in a container bound to 127.0.0.1: one page, JSON APIs and an MCP endpoint for the operator's inbox, asks, decisions, staged-commit reviews, the radio stream, the agent graph, the worktree tree, push-to-talk and read-aloud radio (Piper, whisper.cpp) and an optional LLM command line. The hub is only a relay. The host executors in hub/client (the runner user service, the PermissionRequest hook and the approval CLI the commit skills call) verify a WebAuthn passkey signature against keys pinned outside every sandbox, refuse replays and fail closed. scripts/hub.sh with make hub-install, hub-check, hub-pin, hub-runner and hub-hook installs and checks the hub; hub-hook writes ~/.claude/settings.json after a backup. make watch-check shows a stuck watch hook. The new kvb-git-diff skill and the commit skills route reviews through the hub; the test_hub_* suites replace test_hub.py. Security review (kvb-think-criticize, three skeptics) fixed four holes: signed rules auto-approved chained shell commands; the client and LLM openers followed redirects, the LLM one with its bearer key; the worktree scan ran git fsmonitor and filter commands from agent-writable repos; compose set no memory, pids or health limits. Documented until core requirement 093, on the operator's word: the hub page is trusted while signing and pinning, local processes can forge the unsigned operator actions, and the container reads the host /tmp. Committed on the operator's word despite the gate: the passkey path is not yet verified live. Accepted MEDUSA false positives (137 findings on 115 lines, rows in security-accepted.jsonl): EXA002 x17, MEDUSA-MM-SCAN-058 x12, B603 x8, MEDUSA-FTSC-SCAN-089 x7, MEDUSA-PRIV-SCAN-762 x6, AIC-EXFIL-005 x5, EXA006 x5, MEDUSA-FTSCAN-231 x5, WEB-SSRF x5, MEDUSA-INF-SCAN-2057 x3, RH005 x3, TC001 x3, LO002 x2, MEDUSA-AEXP-SCAN-096 x2, MEDUSA-CGS-SCAN-028 x2, MEDUSA-INF-SCAN-1350 x2, MEDUSA-INF-SCAN-2369 x2, MEDUSA-INF-SCAN-2440 x2, MEDUSA-INF-SCAN-2638 x2, MLSC-SERIAL-002 x2, PL002 x2, PQC005 x2, SAST-PATH-001 x2, TC004 x2, TC005 x2, TC006 x2, TC007 x2, AA-146, EXA007, FINE-050, GB-ENCODE-001, GB-ENCODE-003, MEDUSA-CGS-SCAN-029, MEDUSA-CGS-SCAN-103, MEDUSA-DP-SCAN-1034, MEDUSA-DP-SCAN-1916, MEDUSA-DP-SCAN-954, MEDUSA-EXF26-TOOL-004, MEDUSA-FT-TRIGGER-005, MEDUSA-INF-SCAN-2206, MEDUSA-INF-SCAN-2457, MEDUSA-INF-WEB-003, MEDUSA-INFRA-SCAN-030, MEDUSA-MP-SCAN-1135, MEDUSA-RLHF-POISON-002, MEDUSA-RT-SCAN-006, MM-ENCODE-001, MP-124, PQC001, PQC002, PQC006, RP001, TC009, TC010, WEB-FLASK-004. 🎯 Fix: 80 % 💥 Break: 4 % 💸 Cost: 129 % ⏱️ Time: – 🛡️ Security: 100 % 💰 Value: ? 🏆 Score: 60 🚦 Gate: ⛔ fix 80 % < 90; cost 129 % > 100: ask the operator before the commit ``` /home/kevinveenbirkenbach/Repositories/github.com/kevinveenbirkenbach/skills/.worktrees/feature/kvb-hub ``` Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
90 lines
4.1 KiB
Python
90 lines
4.1 KiB
Python
from __future__ import annotations
|
|
|
|
import base64
|
|
import io
|
|
import json
|
|
import struct
|
|
import subprocess
|
|
import unittest
|
|
import wave
|
|
|
|
from hub_support import VOICE
|
|
from kvb_hub import engines, settings
|
|
|
|
VOICE_PROBE = """
|
|
const V = require(process.argv[1]);
|
|
const settings = JSON.parse(process.argv[2]);
|
|
const rows = [
|
|
{class: "mayday", to: [], source: "s1", speech: "m", voice: "v"},
|
|
{class: "pan-pan", to: ["Operator"], source: "s1", speech: "p", voice: "v"},
|
|
{class: "security", to: [], source: "s2", speech: "s", voice: "v"},
|
|
{class: "direct", to: ["Operator"], source: "s2", speech: "d", voice: "v"},
|
|
{class: "direct", to: ["Docs"], source: "s3", speech: "o", voice: "v"},
|
|
{class: "broadcast", to: [], source: "s3", speech: "b", voice: "v"},
|
|
{class: "broadcast", to: [], source: "s3", speech: "", voice: "v"},
|
|
];
|
|
const filters = [
|
|
{on: false, classes: ["broadcast", "direct", "security", "pan-pan", "mayday"], muted: []},
|
|
{on: true, classes: ["mayday"], muted: ["s1"]},
|
|
{on: true, classes: ["direct", "mayday"], muted: ["s2"]},
|
|
{on: true, classes: ["broadcast", "direct", "security", "pan-pan", "mayday"], muted: []},
|
|
];
|
|
let pending = [];
|
|
for (const cls of ["broadcast", "direct", "security", "mayday", "broadcast", "pan-pan", "mayday", "direct"]) {
|
|
pending = V.enqueue(pending, {cls, text: `${cls}-${pending.length}`}, 6);
|
|
}
|
|
console.log(JSON.stringify({
|
|
tones: rows.map((row) => V.toneOf(row, "Operator")),
|
|
spoken: filters.map((filter) => rows.map((row) => V.speakable(row, filter))),
|
|
queue: pending.map((item) => item.cls),
|
|
loud: settings.map((one) => Object.fromEntries(["mayday", "review", "direct", "radio"].map((tone) => [tone, V.loudness(tone, one)]))),
|
|
frames: [V.frames(1.5, 16000, 120), V.frames(130, 16000, 120), V.frames(0, 16000, 120)],
|
|
wav: Buffer.from(V.wav(Float32Array.from([0, 0.5, -0.5, 1, -1, 2, -2]), 16000)).toString("base64"),
|
|
}));
|
|
"""
|
|
|
|
|
|
class TestVoiceModule(unittest.TestCase):
|
|
@classmethod
|
|
def setUpClass(cls):
|
|
quiet = {name: {"on": False, "volume": 0.1} for name in settings.TONES}
|
|
cls.settings = [
|
|
settings.SETTINGS,
|
|
{**settings.SETTINGS, "music": {"on": True, "volume": 1.0}, "sounds": quiet},
|
|
{**settings.SETTINGS, "sounds": {**settings.SETTINGS["sounds"], "mayday": {"on": True, "volume": 0.0}, "radio": {"on": True, "volume": 0.8}}},
|
|
]
|
|
command = ["node", "-e", VOICE_PROBE, str(VOICE), json.dumps(cls.settings)]
|
|
done = subprocess.run(command, capture_output=True, text=True, timeout=60, check=True)
|
|
cls.data = json.loads(done.stdout)
|
|
|
|
def test_urgency_picks_the_tone_and_mayday_is_never_quieter(self):
|
|
self.assertEqual(self.data["tones"], ["mayday", "mayday", "direct", "direct", "radio", "radio", "radio"])
|
|
self.assertEqual(len(self.data["loud"]), len(self.settings))
|
|
for loud in self.data["loud"]:
|
|
with self.subTest(loud=loud):
|
|
self.assertEqual(loud["mayday"], max(loud.values()))
|
|
self.assertEqual([loud["mayday"] for loud in self.data["loud"]], [0.9, 1.0, 0.8])
|
|
|
|
def test_the_radio_filter_picks_classes_and_stations(self):
|
|
self.assertEqual(self.data["spoken"], [
|
|
[False] * 7,
|
|
[True, False, False, False, False, False, False],
|
|
[True, False, False, False, True, False, False],
|
|
[True, True, True, True, True, True, False],
|
|
])
|
|
|
|
def test_the_queue_puts_alarms_first_and_drops_routine_traffic(self):
|
|
self.assertEqual(self.data["queue"], ["mayday", "mayday", "pan-pan", "security", "broadcast", "direct"])
|
|
|
|
def test_the_recording_is_encoded_as_16_khz_mono_pcm(self):
|
|
body = base64.b64decode(self.data["wav"])
|
|
self.assertEqual(engines.wav_seconds(body), 7 / engines.STT_RATE)
|
|
with wave.open(io.BytesIO(body)) as reader:
|
|
self.assertEqual((reader.getnchannels(), reader.getsampwidth(), reader.getframerate(), reader.getnframes()), (1, 2, 16000, 7))
|
|
self.assertEqual(struct.unpack("<7h", reader.readframes(7)), (0, 16383, -16384, 32767, -32768, 32767, -32768))
|
|
self.assertEqual(self.data["frames"], [24000, 16000 * 120, 0])
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|