p2.4: restricted workspace for permitted callers
guardian-star context is allowed only when the authenticated caller is in permit_restricted and mapped to that workspace. Fleet callers remapped to it still refuse. CLI client.toml: SIFT_CLIENT, then $HERMES_HOME/sift, then ~/.config.
This commit is contained in:
+9
-6
@@ -46,8 +46,8 @@ Out: `search` (P3), URL→content fetch cache (P4), knowledge graph. (Digest + c
|
||||
3. Digest latency p50 ≤ 20 s with Dixie otherwise idle.
|
||||
4. **Guardian unaffected**: during a burst of 10 concurrent digests, a guardian-shaped probe
|
||||
(`max_tokens` 16, thinking off) has p90 ≤ 5 s. (This is the criterion that matters most.)
|
||||
5. `context` never reaches `guardian-star`: unit test + a live request with a caller mapped
|
||||
to it is refused.
|
||||
5. Restricted workspace: fleet caller mapped to `guardian-star` is refused; only
|
||||
`permit_restricted` callers whose mapped workspace is that name get context.
|
||||
6. `--recover` returns a snapshot (with `snapshot_at`) for a bot-walled URL that has a Wayback
|
||||
copy.
|
||||
|
||||
@@ -101,9 +101,11 @@ invalidates; context not stored; eviction under size cap; corrupt DB → warn an
|
||||
list of messages with `content, created_at, peer_id, session_id, workspace_id, token_count`
|
||||
(verified 2026-09-22). Timeout 3 s; failure → `warnings`, empty `context`, never an error.
|
||||
- `ws` = the caller's workspace from `keys.toml`. **Config allowlist of workspaces**
|
||||
(`context.workspaces = ["hermes-fleet"]`); anything else → no context + WARN. **Hard-coded
|
||||
refusal of `guardian-star`** in code (not just config) with a test — that workspace is
|
||||
compartmentalised and must never be read by sift.
|
||||
(`context.workspaces`); anything else → no context + WARN. **Restricted workspace
|
||||
`guardian-star`**: allowed only when the authenticated caller is in
|
||||
`context.permit_restricted` *and* that caller's mapped workspace is `guardian-star`.
|
||||
A fleet caller remapped to it is still refused (tested). Workspace is never taken
|
||||
from the request.
|
||||
- Query: the question if given, else title + top 3 headings.
|
||||
- Return trimmed items: `{peer, content (≤300 chars), created_at, session}`; label clearly
|
||||
as prior fleet knowledge, not page content.
|
||||
@@ -156,7 +158,8 @@ digest_ms fallback`. Never log page content, questions longer than 80 chars, or
|
||||
falls back immediately; a waiter past `queue_wait` falls back), context cancel propagates
|
||||
(fake server observes the disconnect).
|
||||
- Chunk selection: document order restored, token budget respected, no-question path.
|
||||
- Context: allowlist, `guardian-star` refused even if configured, 3 s timeout → warning.
|
||||
- Context: allowlist, restricted workspace refused for unpermitted callers even if
|
||||
allowlisted, permitted caller succeeds, 3 s timeout → warning.
|
||||
- Recover: Wayback JSON parsing (available/unavailable), `id_` rewrite, fake-success fixtures
|
||||
(meta-refresh to original, "Just a moment", tiny body), archive.today rotation on 429,
|
||||
redirect-to-private inside an archive response still blocked (guard).
|
||||
|
||||
+5
-4
@@ -35,7 +35,7 @@ attached**, using local models, so that:
|
||||
| Brave API key | orion `/var/lib/searx/secret.env` (`BRAVE_API_KEY`, 0640 root:searx) | verified working on **LLM Context** `GET /res/v1/llm/context?q=…` → 200, `grounding` + `sources` |
|
||||
| Local LLM | Dixie `http://dixie.scylla-hammerhead.ts.net:11434/v1`, model `ornith-1.5-9b-uncensored` | Qwen3.5-family thinking model, 8 slots / 96k shared KV. Per-request `chat_template_kwargs: {enable_thinking: false}` works. Shared with Honcho + three agents' guardians — budget calls. |
|
||||
| Embedder | same router, model `honcho-embed` (Qwen3-Embedding-0.6B, 1024-dim) | ≤2048 tokens per input on Dixie; chunk below that |
|
||||
| Honcho | rift `http://rift.scylla-hammerhead.ts.net:8000`, workspace `hermes-fleet` | `POST /v3/workspaces/{ws}/search {query, filters?, limit}` = embedding/hybrid retrieval, no LLM call. **Never** query `guardian-star` from sift. |
|
||||
| Honcho | rift `http://rift.scylla-hammerhead.ts.net:8000`, workspace `hermes-fleet` | `POST /v3/workspaces/{ws}/search {query, filters?, limit}` = embedding/hybrid retrieval, no LLM call. Restricted workspace `guardian-star` only for a caller in `permit_restricted` whose mapped workspace is that name. |
|
||||
| Hermes Firecrawl provider | `plugins/web/firecrawl/provider.py` | self-hosted via `FIRECRAWL_API_URL` (+ optional `FIRECRAWL_API_KEY`) — see §4.1 |
|
||||
|
||||
Fleet Hermes versions differ (talos 0.19.0 uses the Firecrawl SDK; straylight 0.21.x posts raw
|
||||
@@ -220,8 +220,9 @@ other callers; sift must enforce independently.
|
||||
measured quality/latency. Timeout 45 s → fall back to `clean`.
|
||||
9. **Context** (if `context`): derive 3–6 key terms (from the digest or title+headings), call
|
||||
Honcho `POST /v3/workspaces/<caller-workspace>/search {query, limit: 5}`; return trimmed
|
||||
hits. Caller → workspace mapping is static config; default `hermes-fleet`;
|
||||
**`guardian-star` is never reachable from sift** unless Kyle explicitly configures it.
|
||||
hits. Caller → workspace mapping is static config; default `hermes-fleet`.
|
||||
Restricted workspace `guardian-star` only if the caller is in `permit_restricted`
|
||||
and mapped to it.
|
||||
10. **Cache**: key = normalised final URL; store clean content + hash + headers-derived TTL
|
||||
(default 24 h, max 7 d; `no-store` honoured). Serve cache on hit, mark `cached: true`.
|
||||
11. **Log** one line per request (caller, host of URL, status, bytes, tokens, guard verdict) —
|
||||
@@ -272,7 +273,7 @@ tests + one live `web_extract`).
|
||||
|---|---|---|
|
||||
| **P0** skeleton | repo, flake, NixOS module, Makefile (+ `dist/sift.service`), `/healthz`, URL guard + exhaustive unit tests (table of private/tailnet/rebinding/redirect cases incl. `http://100.95.252.120:8000`, `http://dixie:11434`, `http://[fd7a:115c:a1e0::1]`, decimal/octal IPs, redirect-to-private) | tests green; Claude security review of the guard passes |
|
||||
| **P1** clean fetch | `/v2/scrape` (html/json/text → clean), limits, auth, logging; `sift` CLI client (`fetch --mode clean`, `--jq`) + `skill/SKILL.md` installed on hosts; deployed on orion; talos wired | `web_extract` works on talos; contract tests pass for 0.19 and 0.21; guard blocks verified live from talos |
|
||||
| **P2** digest + context | `/v1/fetch` modes, Dixie digest (thinking on vs off measured), Honcho search context, token metrics | on 50 real fetches: median `returned/raw` ≤ 0.2 with spot-checked quality; p90 latency ≤ 30 s with digest; no guardian-star access possible |
|
||||
| **P2** digest + context | `/v1/fetch` modes, Dixie digest (thinking on vs off measured), Honcho search context, token metrics | on 50 real fetches: median `returned/raw` ≤ 0.2 with spot-checked quality; p90 latency ≤ 30 s with digest; restricted workspace only for permit_restricted callers |
|
||||
| **P3** search | `/v2/search` + `/v1/search`: SearXNG + Brave LLM Context, dedupe, honcho-embed rerank | search quality spot-check vs SearXNG alone; cost per query known |
|
||||
| **P4** cache + provenance | SQLite cache with TTL; optional provenance (if Kyle approves) | cache hit rate reported; repeat fetches served locally |
|
||||
|
||||
|
||||
Reference in New Issue
Block a user