Files
skills/tests/test_hub_voice.py
T
Kevin Veen-BirkenbachandClaude Opus 5.5 8ba45efd04 feat(hub): kvb-hub review hub with passkey-signed approvals
The kvb-hub is a local review hub in a container bound to 127.0.0.1: one page, JSON APIs and an MCP endpoint for the operator's inbox, asks, decisions, staged-commit reviews, the radio stream, the agent graph, the worktree tree, push-to-talk and read-aloud radio (Piper, whisper.cpp) and an optional LLM command line. The hub is only a relay. The host executors in hub/client (the runner user service, the PermissionRequest hook and the approval CLI the commit skills call) verify a WebAuthn passkey signature against keys pinned outside every sandbox, refuse replays and fail closed. scripts/hub.sh with make hub-install, hub-check, hub-pin, hub-runner and hub-hook installs and checks the hub; hub-hook writes ~/.claude/settings.json after a backup. make watch-check shows a stuck watch hook. The new kvb-git-diff skill and the commit skills route reviews through the hub; the test_hub_* suites replace test_hub.py.

Security review (kvb-think-criticize, three skeptics) fixed four holes: signed rules auto-approved chained shell commands; the client and LLM openers followed redirects, the LLM one with its bearer key; the worktree scan ran git fsmonitor and filter commands from agent-writable repos; compose set no memory, pids or health limits. Documented until core requirement 093, on the operator's word: the hub page is trusted while signing and pinning, local processes can forge the unsigned operator actions, and the container reads the host /tmp. Committed on the operator's word despite the gate: the passkey path is not yet verified live.

Accepted MEDUSA false positives (137 findings on 115 lines, rows in security-accepted.jsonl): EXA002 x17, MEDUSA-MM-SCAN-058 x12, B603 x8, MEDUSA-FTSC-SCAN-089 x7, MEDUSA-PRIV-SCAN-762 x6, AIC-EXFIL-005 x5, EXA006 x5, MEDUSA-FTSCAN-231 x5, WEB-SSRF x5, MEDUSA-INF-SCAN-2057 x3, RH005 x3, TC001 x3, LO002 x2, MEDUSA-AEXP-SCAN-096 x2, MEDUSA-CGS-SCAN-028 x2, MEDUSA-INF-SCAN-1350 x2, MEDUSA-INF-SCAN-2369 x2, MEDUSA-INF-SCAN-2440 x2, MEDUSA-INF-SCAN-2638 x2, MLSC-SERIAL-002 x2, PL002 x2, PQC005 x2, SAST-PATH-001 x2, TC004 x2, TC005 x2, TC006 x2, TC007 x2, AA-146, EXA007, FINE-050, GB-ENCODE-001, GB-ENCODE-003, MEDUSA-CGS-SCAN-029, MEDUSA-CGS-SCAN-103, MEDUSA-DP-SCAN-1034, MEDUSA-DP-SCAN-1916, MEDUSA-DP-SCAN-954, MEDUSA-EXF26-TOOL-004, MEDUSA-FT-TRIGGER-005, MEDUSA-INF-SCAN-2206, MEDUSA-INF-SCAN-2457, MEDUSA-INF-WEB-003, MEDUSA-INFRA-SCAN-030, MEDUSA-MP-SCAN-1135, MEDUSA-RLHF-POISON-002, MEDUSA-RT-SCAN-006, MM-ENCODE-001, MP-124, PQC001, PQC002, PQC006, RP001, TC009, TC010, WEB-FLASK-004.

🎯 Fix: 80 %
💥 Break: 4 %
💸 Cost: 129 %
⏱️ Time: –
🛡️ Security: 100 %
💰 Value: ?
🏆 Score: 60
🚦 Gate: ⛔ fix 80 % < 90; cost 129 % > 100: ask the operator before the commit

```
/home/kevinveenbirkenbach/Repositories/github.com/kevinveenbirkenbach/skills/.worktrees/feature/kvb-hub
```

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 18:46:40 +00:00

90 lines
4.1 KiB
Python

from __future__ import annotations
import base64
import io
import json
import struct
import subprocess
import unittest
import wave
from hub_support import VOICE
from kvb_hub import engines, settings
VOICE_PROBE = """
const V = require(process.argv[1]);
const settings = JSON.parse(process.argv[2]);
const rows = [
{class: "mayday", to: [], source: "s1", speech: "m", voice: "v"},
{class: "pan-pan", to: ["Operator"], source: "s1", speech: "p", voice: "v"},
{class: "security", to: [], source: "s2", speech: "s", voice: "v"},
{class: "direct", to: ["Operator"], source: "s2", speech: "d", voice: "v"},
{class: "direct", to: ["Docs"], source: "s3", speech: "o", voice: "v"},
{class: "broadcast", to: [], source: "s3", speech: "b", voice: "v"},
{class: "broadcast", to: [], source: "s3", speech: "", voice: "v"},
];
const filters = [
{on: false, classes: ["broadcast", "direct", "security", "pan-pan", "mayday"], muted: []},
{on: true, classes: ["mayday"], muted: ["s1"]},
{on: true, classes: ["direct", "mayday"], muted: ["s2"]},
{on: true, classes: ["broadcast", "direct", "security", "pan-pan", "mayday"], muted: []},
];
let pending = [];
for (const cls of ["broadcast", "direct", "security", "mayday", "broadcast", "pan-pan", "mayday", "direct"]) {
pending = V.enqueue(pending, {cls, text: `${cls}-${pending.length}`}, 6);
}
console.log(JSON.stringify({
tones: rows.map((row) => V.toneOf(row, "Operator")),
spoken: filters.map((filter) => rows.map((row) => V.speakable(row, filter))),
queue: pending.map((item) => item.cls),
loud: settings.map((one) => Object.fromEntries(["mayday", "review", "direct", "radio"].map((tone) => [tone, V.loudness(tone, one)]))),
frames: [V.frames(1.5, 16000, 120), V.frames(130, 16000, 120), V.frames(0, 16000, 120)],
wav: Buffer.from(V.wav(Float32Array.from([0, 0.5, -0.5, 1, -1, 2, -2]), 16000)).toString("base64"),
}));
"""
class TestVoiceModule(unittest.TestCase):
@classmethod
def setUpClass(cls):
quiet = {name: {"on": False, "volume": 0.1} for name in settings.TONES}
cls.settings = [
settings.SETTINGS,
{**settings.SETTINGS, "music": {"on": True, "volume": 1.0}, "sounds": quiet},
{**settings.SETTINGS, "sounds": {**settings.SETTINGS["sounds"], "mayday": {"on": True, "volume": 0.0}, "radio": {"on": True, "volume": 0.8}}},
]
command = ["node", "-e", VOICE_PROBE, str(VOICE), json.dumps(cls.settings)]
done = subprocess.run(command, capture_output=True, text=True, timeout=60, check=True)
cls.data = json.loads(done.stdout)
def test_urgency_picks_the_tone_and_mayday_is_never_quieter(self):
self.assertEqual(self.data["tones"], ["mayday", "mayday", "direct", "direct", "radio", "radio", "radio"])
self.assertEqual(len(self.data["loud"]), len(self.settings))
for loud in self.data["loud"]:
with self.subTest(loud=loud):
self.assertEqual(loud["mayday"], max(loud.values()))
self.assertEqual([loud["mayday"] for loud in self.data["loud"]], [0.9, 1.0, 0.8])
def test_the_radio_filter_picks_classes_and_stations(self):
self.assertEqual(self.data["spoken"], [
[False] * 7,
[True, False, False, False, False, False, False],
[True, False, False, False, True, False, False],
[True, True, True, True, True, True, False],
])
def test_the_queue_puts_alarms_first_and_drops_routine_traffic(self):
self.assertEqual(self.data["queue"], ["mayday", "mayday", "pan-pan", "security", "broadcast", "direct"])
def test_the_recording_is_encoded_as_16_khz_mono_pcm(self):
body = base64.b64decode(self.data["wav"])
self.assertEqual(engines.wav_seconds(body), 7 / engines.STT_RATE)
with wave.open(io.BytesIO(body)) as reader:
self.assertEqual((reader.getnchannels(), reader.getsampwidth(), reader.getframerate(), reader.getnframes()), (1, 2, 16000, 7))
self.assertEqual(struct.unpack("<7h", reader.readframes(7)), (0, 16383, -16384, 32767, -32768, 32767, -32768))
self.assertEqual(self.data["frames"], [24000, 16000 * 120, 0])
if __name__ == "__main__":
unittest.main()