The kvb-hub is a local review hub in a container bound to 127.0.0.1: one page, JSON APIs and an MCP endpoint for the operator's inbox, asks, decisions, staged-commit reviews, the radio stream, the agent graph, the worktree tree, push-to-talk and read-aloud radio (Piper, whisper.cpp) and an optional LLM command line. The hub is only a relay. The host executors in hub/client (the runner user service, the PermissionRequest hook and the approval CLI the commit skills call) verify a WebAuthn passkey signature against keys pinned outside every sandbox, refuse replays and fail closed. scripts/hub.sh with make hub-install, hub-check, hub-pin, hub-runner and hub-hook installs and checks the hub; hub-hook writes ~/.claude/settings.json after a backup. make watch-check shows a stuck watch hook. The new kvb-git-diff skill and the commit skills route reviews through the hub; the test_hub_* suites replace test_hub.py. Security review (kvb-think-criticize, three skeptics) fixed four holes: signed rules auto-approved chained shell commands; the client and LLM openers followed redirects, the LLM one with its bearer key; the worktree scan ran git fsmonitor and filter commands from agent-writable repos; compose set no memory, pids or health limits. Documented until core requirement 093, on the operator's word: the hub page is trusted while signing and pinning, local processes can forge the unsigned operator actions, and the container reads the host /tmp. Committed on the operator's word despite the gate: the passkey path is not yet verified live. Accepted MEDUSA false positives (137 findings on 115 lines, rows in security-accepted.jsonl): EXA002 x17, MEDUSA-MM-SCAN-058 x12, B603 x8, MEDUSA-FTSC-SCAN-089 x7, MEDUSA-PRIV-SCAN-762 x6, AIC-EXFIL-005 x5, EXA006 x5, MEDUSA-FTSCAN-231 x5, WEB-SSRF x5, MEDUSA-INF-SCAN-2057 x3, RH005 x3, TC001 x3, LO002 x2, MEDUSA-AEXP-SCAN-096 x2, MEDUSA-CGS-SCAN-028 x2, MEDUSA-INF-SCAN-1350 x2, MEDUSA-INF-SCAN-2369 x2, MEDUSA-INF-SCAN-2440 x2, MEDUSA-INF-SCAN-2638 x2, MLSC-SERIAL-002 x2, PL002 x2, PQC005 x2, SAST-PATH-001 x2, TC004 x2, TC005 x2, TC006 x2, TC007 x2, AA-146, EXA007, FINE-050, GB-ENCODE-001, GB-ENCODE-003, MEDUSA-CGS-SCAN-029, MEDUSA-CGS-SCAN-103, MEDUSA-DP-SCAN-1034, MEDUSA-DP-SCAN-1916, MEDUSA-DP-SCAN-954, MEDUSA-EXF26-TOOL-004, MEDUSA-FT-TRIGGER-005, MEDUSA-INF-SCAN-2206, MEDUSA-INF-SCAN-2457, MEDUSA-INF-WEB-003, MEDUSA-INFRA-SCAN-030, MEDUSA-MP-SCAN-1135, MEDUSA-RLHF-POISON-002, MEDUSA-RT-SCAN-006, MM-ENCODE-001, MP-124, PQC001, PQC002, PQC006, RP001, TC009, TC010, WEB-FLASK-004. 🎯 Fix: 80 % 💥 Break: 4 % 💸 Cost: 129 % ⏱️ Time: – 🛡️ Security: 100 % 💰 Value: ? 🏆 Score: 60 🚦 Gate: ⛔ fix 80 % < 90; cost 129 % > 100: ask the operator before the commit ``` /home/kevinveenbirkenbach/Repositories/github.com/kevinveenbirkenbach/skills/.worktrees/feature/kvb-hub ``` Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
218 lines
14 KiB
Python
218 lines
14 KiB
Python
from __future__ import annotations
|
|
|
|
import json
|
|
import time
|
|
import unittest
|
|
from unittest import mock
|
|
|
|
from hub_case import HubCase
|
|
from hub_engines import OPERATOR_VOICE, VOICES
|
|
from hub_support import ASK
|
|
from kvb_hub import council, engines, exchange, phrasing, view
|
|
|
|
|
|
class TestHubState(HubCase):
|
|
def test_state_follows_the_time_window(self):
|
|
now = time.time()
|
|
self.write_council({"news.jsonl": self.jsonl([
|
|
{"ts": now - 10800, "from": "Old", "to": [], "text": "three hours"},
|
|
{"ts": now - 3600, "from": "Skills", "to": ["Docs"], "text": "one hour"},
|
|
{"ts": now - 60, "from": "Docs", "to": [], "text": "a minute"},
|
|
])})
|
|
self.request("feat: fresh", "")
|
|
self.create_ask(ASK)
|
|
default = self.snapshot()
|
|
self.assertEqual([row["text"] for row in default["radio"]], ["three hours", "one hour", "a minute"])
|
|
self.assertAlmostEqual(default["first"], now - 10800, delta=1)
|
|
status, _, body = self.get(f"/api/state?from={now - 7200}&to={now - 1800}")
|
|
self.assertEqual(status, 200, body)
|
|
past = json.loads(body)
|
|
self.assertEqual([row["text"] for row in past["radio"]], ["one hour"])
|
|
self.assertEqual((past["since"], past["until"]), (now - 7200, now - 1800))
|
|
self.assertEqual((past["reviews"], past["asks"]), ([], []))
|
|
self.assertEqual({(edge["source"], edge["target"]) for edge in past["graph"]["edges"]}, {("name:Skills", "name:Docs")})
|
|
future = json.loads(self.get(f"/api/state?from=0&to={now + 86400}")[2])
|
|
self.assertLessEqual(future["until"], time.time())
|
|
self.assertEqual(len(future["radio"]), 3)
|
|
for query in (f"from={now}&to={now - 60}", "from=soon", "to=-1", "from=1&from=2", "from=nan"):
|
|
with self.subTest(query=query):
|
|
self.assertEqual(self.get(f"/api/state?{query}")[0], 400)
|
|
|
|
def test_get_never_changes_state(self):
|
|
review_id = self.request("feat: read only", "")
|
|
before = (self.state / "reviews.json").read_bytes()
|
|
for path, expected in (
|
|
("/", 200),
|
|
("/?approve=1", 200),
|
|
("/api/state", 200),
|
|
(f"/reviews/{review_id}/page", 200),
|
|
(f"/reviews/{review_id}/files", 200),
|
|
("/reviews/0123456789abcdef/files", 404),
|
|
(f"/reviews/{review_id}/approve", 405),
|
|
(f"/reviews/{review_id}/reject", 405),
|
|
(f"/api/reviews/{review_id}", 200),
|
|
("/api/reviews/0123456789abcdef", 404),
|
|
("/api/sign", 405),
|
|
("/api/rules/sign", 405),
|
|
("/mcp", 405),
|
|
("/api/tts", 405),
|
|
("/api/stt", 405),
|
|
("/reviews/0123456789abcdef/page", 404),
|
|
("/nope", 404),
|
|
):
|
|
with self.subTest(path=path):
|
|
status, _, _ = self.call("GET", path, None, self.guard(self.host))
|
|
self.assertEqual(status, expected)
|
|
self.assertEqual(self.call("GET", "/", None, {"Host": "evil.example"})[0], 403)
|
|
self.assertEqual((self.state / "reviews.json").read_bytes(), before)
|
|
self.assertEqual(self.status(review_id), "pending")
|
|
|
|
def test_state_is_empty_without_council_files(self):
|
|
empty = {"reviews": [], "operator": [], "register": [], "radio": [], "claims": [], "grants": []}
|
|
state = self.snapshot()
|
|
self.assertEqual({key: state[key] for key in empty}, empty)
|
|
self.assertEqual([(node["id"], node["kind"]) for node in state["graph"]["nodes"]], [("Operator", "operator"), ("name:Maintainer", "chair")])
|
|
self.assertEqual(state["graph"]["edges"], [])
|
|
self.index()
|
|
self.write_council({"rasci.json": "{not json", "queue-history.jsonl": "[" * 100000 + "\n", "work/x/claim.json": "[1]"})
|
|
(self.council / "news.jsonl").write_bytes(b"\xff\xfe" + b"[" * 100000 + b"\n")
|
|
state = self.snapshot()
|
|
self.assertEqual({key: state[key] for key in empty}, empty)
|
|
self.write_council({"rasci.json": "[1, 2]", "news.jsonl": "[" * 100000 + "\n"})
|
|
self.assertEqual(self.snapshot()["radio"], [])
|
|
self.index()
|
|
|
|
def test_state_filters_the_register_and_bounds_the_radio(self):
|
|
register = {
|
|
"operator/push-skills": {"title": "git-sign-push", "workdir": "/repo", "description": "needs the key", "check": "pushed", "status": "queued", "roles": {"Operator": "R", "One": "A"}},
|
|
"operator/old": {"title": "old command", "status": "done", "roles": {}},
|
|
"work/hub": {"title": "Build the hub", "status": "running", "worker": "One", "objective": "Reviews in the browser", "roles": {"One": "RA", "Two": "C"}, "key_results": [{"text": "a", "met": True}, {"text": "b", "met": False}]},
|
|
"work/finished": {"title": "Finished work", "status": "done", "roles": {}},
|
|
"work/stopped": {"title": "Stopped work", "status": "stopped", "roles": {}},
|
|
"work/bare": {"roles": {"Two": "R"}},
|
|
"broken": "not a row",
|
|
}
|
|
now = time.time()
|
|
rows = [{"ts": now - 100 + n, "from": "One", "to": [], "text": f"item {n:02d}"} for n in range(34)]
|
|
rows.append({"ts": now, "from": "Two", "to": [], "text": "disk full", "class": "mayday"})
|
|
lines = [json.dumps(row) for row in rows[:20]] + ["not json", json.dumps({"text": "no ts"})] + [json.dumps(row) for row in rows[20:]]
|
|
self.write_council({"rasci.json": register, "news.jsonl": "\n".join(lines) + "\n"})
|
|
with mock.patch.object(council, "RADIO_LIMIT", 30):
|
|
state = self.snapshot()
|
|
operator = state["operator"]
|
|
self.assertEqual([(row["task"], row["command"], row["why"], row["status"]) for row in operator], [("operator/push-skills", "git-sign-push", "needs the key", "queued")])
|
|
self.assertEqual([row["task"] for row in state["register"]], ["work/bare", "work/hub"])
|
|
hub = state["register"][1]
|
|
self.assertEqual((hub["title"], hub["responsible"], hub["accountable"], hub["met"], hub["total"]), ("Build the hub", "One", "One", 1, 2))
|
|
self.assertEqual(state["register"][0]["status"], "queued")
|
|
texts = [row["text"] for row in state["radio"]]
|
|
self.assertEqual(len(texts), 30)
|
|
self.assertEqual((texts[0], texts[-2], texts[-1]), ("item 05", "item 33", "disk full"))
|
|
self.assertEqual(state["radio"][-1]["class"], "mayday")
|
|
|
|
def test_state_collects_radio_claims_grants_and_the_graph(self):
|
|
now = time.time()
|
|
register = {
|
|
"operator/push": {"title": "git-sign-push", "workdir": "/repo", "status": "blocked", "roles": {"Operator": "R", "Skills session": "A"}},
|
|
"work/hub": {"title": "Build the hub", "status": "running", "worker": "Skills session", "workdir": "/repo/.worktrees/hub", "roles": {"Skills session": "R", "Maintainer": "A"}},
|
|
"work/sub": {"title": "Helper", "status": "running", "worker": "subagent general-purpose (default)", "roles": {"Skills": "A"}},
|
|
"work/old": {"title": "Old", "status": "done", "worker": "Ghost session", "roles": {}},
|
|
}
|
|
news = [
|
|
{"ts": now - 50, "from": "Skills session", "to": ["Maintainer"], "text": "ready"},
|
|
{"ts": now - 40, "from": "Skills", "to": ["Maintainer"], "text": "again", "class": "direct"},
|
|
{"ts": now - 30, "from": "Maintainer", "to": [], "text": "board"},
|
|
{"ts": now - 20, "from": "Docs", "to": [], "text": "MAYDAY disk full"},
|
|
{"ts": now - 10, "from": "Docs", "to": ["Skills"], "text": "PAN-PAN slow"},
|
|
{"ts": now - 5, "from": "Maintainer", "to": ["Skills", "Docs"], "text": "rotate", "class": "security"},
|
|
{"ts": now - 2 * 86400, "from": "Old", "to": [], "text": "too old"},
|
|
]
|
|
claim = {"office": "work/hub", "session": "s1", "runtime": "claude", "name": "Skills", "since": "2026-11-05T10:00:00+00:00", "beat": now, "work": "build the hub"}
|
|
gate = {"office": "cluster/gate", "session": "s2", "runtime": "codex", "name": "Gatekeeper", "since": "2026-11-05T09:00:00+00:00", "beat": now, "work": "gate"}
|
|
history = [
|
|
{"id": "q1", "kind": "gate", "signature": "make test", "workdir": "/repo/.worktrees/hub/sub", "start": now - 15, "end": now - 5, "exit": 0, "minutes": 0.2},
|
|
{"id": "q2", "kind": "deploy", "signature": "make deploy", "workdir": "/elsewhere", "start": now - 15, "end": now - 5, "exit": 0, "minutes": 0.2},
|
|
{"id": "q3", "kind": "gate", "signature": "make test", "workdir": "/repo/.worktrees/hub", "start": now - 2 * 86400, "end": now - 2 * 86400 + 60, "exit": 0, "minutes": 1},
|
|
]
|
|
self.write_council({
|
|
"rasci.json": register,
|
|
"news.jsonl": self.jsonl(news),
|
|
"work/hub/claim.json": claim,
|
|
"cluster/gate/claim.json": gate,
|
|
"work/broken/claim.json": "not json",
|
|
"queue-history.jsonl": self.jsonl(history),
|
|
})
|
|
state = self.snapshot()
|
|
self.assertEqual(
|
|
set(state),
|
|
{
|
|
"now", "since", "until", "first", "alarm_since", "reviews", "asks", "decisions", "messages", "operator",
|
|
"register", "priority", "radio", "claims", "grants", "night", "silence", "graph",
|
|
"inbox", "pending", "rules", "approvers", "jobs", "views", "llm", "people", "settings", "media", "speech",
|
|
},
|
|
)
|
|
self.assertEqual([row["speech"] for row in state["radio"]], [
|
|
"Maintainer, Maintainer, this is Skills, ready, over",
|
|
"Maintainer, Maintainer, this is Skills, again, over",
|
|
"all stations, this is Maintainer, board, out",
|
|
"MAYDAY MAYDAY MAYDAY, this is Docs Docs Docs, disk full, over",
|
|
"PAN-PAN PAN-PAN PAN-PAN, all stations, this is Docs, slow, over",
|
|
"SECURITE SECURITE SECURITE, all stations, this is Maintainer, rotate, over",
|
|
])
|
|
speech = self.httpd.hub.speech
|
|
self.assertEqual([row["voice"] for row in state["radio"]], [speech.voice_of(row["source"]) for row in state["radio"]])
|
|
self.assertTrue(all(row["voice"] in VOICES and row["voice"] != OPERATOR_VOICE for row in state["radio"]))
|
|
self.assertEqual(state["speech"], {
|
|
"tts": True, "stt": True, "voices": len(VOICES), "operator": OPERATOR_VOICE, "sample": "all stations, this is Operator, radio check, out",
|
|
"limit": phrasing.SPEECH_LIMIT, "rate": engines.STT_RATE, "seconds": engines.STT_SECONDS,
|
|
})
|
|
self.assertAlmostEqual(state["now"] - state["since"], view.RADIO_WINDOW)
|
|
self.assertEqual((state["night"], state["silence"], state["priority"]), ("day", None, ["Skills session", "subagent general-purpose (default)"]))
|
|
radio = [(row["from"], row["to"], row["class"], row["text"]) for row in state["radio"]]
|
|
self.assertEqual(radio, [
|
|
("Skills", ["Maintainer"], "direct", "ready"),
|
|
("Skills", ["Maintainer"], "direct", "again"),
|
|
("Maintainer", [], "broadcast", "board"),
|
|
("Docs", [], "mayday", "MAYDAY disk full"),
|
|
("Docs", ["Skills"], "pan-pan", "PAN-PAN slow"),
|
|
("Maintainer", ["Skills", "Docs"], "security", "rotate"),
|
|
])
|
|
self.assertEqual([(row["office"], row["agent"], row["runtime"]) for row in state["claims"]], [("cluster/gate", "Gatekeeper", "codex"), ("work/hub", "Skills", "claude")])
|
|
self.assertEqual([(row["to"], row["kind"], row["id"]) for row in state["grants"]], [("Skills", "gate", "q1")])
|
|
self.assertEqual([row["task"] for row in state["operator"]], ["operator/push"])
|
|
nodes = {node["id"]: node for node in state["graph"]["nodes"]}
|
|
moon = "subagent general-purpose (default) @ s1"
|
|
self.assertEqual(list(nodes), ["Operator", "name:Maintainer", "name:Docs", "s2", "s1", moon])
|
|
self.assertEqual([nodes[key]["kind"] for key in nodes], ["operator", "chair", "session", "session", "session", "subagent"])
|
|
self.assertEqual([nodes[key]["label"] for key in nodes][:5], ["Operator", "Maintainer", "Docs", "Gatekeeper", "Skills"])
|
|
self.assertEqual((nodes[moon]["parent"], nodes[moon]["label"]), ("s1", "subagent general-purpose (default)"))
|
|
skills = [(task["task"], task["worker"], task["letters"]) for task in nodes["s1"]["tasks"]]
|
|
self.assertEqual(skills, [("operator/push", False, "A"), ("work/hub", True, "R"), ("work/sub", False, "A")])
|
|
self.assertEqual([(task["task"], task["letters"]) for task in nodes["Operator"]["tasks"]], [("operator/push", "R")])
|
|
self.assertEqual([task["task"] for task in nodes[moon]["tasks"]], ["work/sub"])
|
|
self.assertEqual([claim["office"] for claim in nodes["s1"]["claims"]], ["work/hub"])
|
|
self.assertEqual((state["people"]["s1"]["now"], state["radio"][0]["source"], state["grants"][0]["target"]), ("Skills", "s1", "s1"))
|
|
edges = {(edge["source"], edge["target"], edge["class"]): edge["count"] for edge in state["graph"]["edges"]}
|
|
self.assertEqual(edges, {
|
|
("name:Docs", "*", "mayday"): 1,
|
|
("name:Docs", "s1", "pan-pan"): 1,
|
|
("name:Maintainer", "*", "broadcast"): 1,
|
|
("name:Maintainer", "name:Docs", "security"): 1,
|
|
("name:Maintainer", "s1", "grant"): 1,
|
|
("name:Maintainer", "s1", "security"): 1,
|
|
("s1", "name:Maintainer", "direct"): 2,
|
|
})
|
|
|
|
def test_state_needs_the_host(self):
|
|
for host in ("evil.example", f"evil.example:{self.port}", "127.0.0.1:1"):
|
|
with self.subTest(host=host):
|
|
self.assertEqual(self.call("GET", "/api/state", None, {"Host": host})[0], 403)
|
|
status, headers, _ = self.get("/api/state")
|
|
self.assertEqual(status, 200)
|
|
self.assertEqual(headers["content-security-policy"], exchange.PLAIN_CSP)
|
|
self.assertEqual(self.call("POST", "/api/state", b"", self.guard(self.host))[0], 404)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|