kyle/sift
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

p2.4: restricted workspace for permitted callers

Browse Source 
guardian-star context is allowed only when the authenticated caller is in
permit_restricted and mapped to that workspace. Fleet callers remapped to it
still refuse. CLI client.toml: SIFT_CLIENT, then $HERMES_HOME/sift, then ~/.config.
This commit is contained in:
kyle
2026-09-23 08:33:58 -07:00
parent 14eb7808ce
commit e36da19f57
10 changed files with 159 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/PLAN.md
+5 -4
View File
@@ -35,7 +35,7 @@ attached**, using local models, so that:
| Brave API key | orion `/var/lib/searx/secret.env` (`BRAVE_API_KEY`, 0640 root:searx) | verified working on **LLM Context** `GET /res/v1/llm/context?q=…` → 200, `grounding` + `sources` |
| Local LLM | Dixie `http://dixie.scylla-hammerhead.ts.net:11434/v1`, model `ornith-1.5-9b-uncensored` | Qwen3.5-family thinking model, 8 slots / 96k shared KV. Per-request `chat_template_kwargs: {enable_thinking: false}` works. Shared with Honcho + three agents' guardians — budget calls. |
| Embedder | same router, model `honcho-embed` (Qwen3-Embedding-0.6B, 1024-dim) | ≤2048 tokens per input on Dixie; chunk below that |
| Honcho | rift `http://rift.scylla-hammerhead.ts.net:8000`, workspace `hermes-fleet` | `POST /v3/workspaces/{ws}/search {query, filters?, limit}` = embedding/hybrid retrieval, no LLM call. **Never** query `guardian-star` from sift. |
| Honcho | rift `http://rift.scylla-hammerhead.ts.net:8000`, workspace `hermes-fleet` | `POST /v3/workspaces/{ws}/search {query, filters?, limit}` = embedding/hybrid retrieval, no LLM call. Restricted workspace `guardian-star` only for a caller in `permit_restricted` whose mapped workspace is that name. |
| Hermes Firecrawl provider | `plugins/web/firecrawl/provider.py` | self-hosted via `FIRECRAWL_API_URL` (+ optional `FIRECRAWL_API_KEY`) — see §4.1 |
Fleet Hermes versions differ (talos 0.19.0 uses the Firecrawl SDK; straylight 0.21.x posts raw
@@ -220,8 +220,9 @@ other callers; sift must enforce independently.
measured quality/latency. Timeout 45 s → fall back to `clean`.
9. **Context** (if `context`): derive 3–6 key terms (from the digest or title+headings), call
Honcho `POST /v3/workspaces/<caller-workspace>/search {query, limit: 5}`; return trimmed
hits. Caller → workspace mapping is static config; default `hermes-fleet`;
**`guardian-star` is never reachable from sift** unless Kyle explicitly configures it.
hits. Caller → workspace mapping is static config; default `hermes-fleet`.
Restricted workspace `guardian-star` only if the caller is in `permit_restricted`
and mapped to it.
10. **Cache**: key = normalised final URL; store clean content + hash + headers-derived TTL
(default 24 h, max 7 d; `no-store` honoured). Serve cache on hit, mark `cached: true`.
11. **Log** one line per request (caller, host of URL, status, bytes, tokens, guard verdict) —
@@ -272,7 +273,7 @@ tests + one live `web_extract`).
|---|---|---|
| **P0** skeleton | repo, flake, NixOS module, Makefile (+ `dist/sift.service`), `/healthz`, URL guard + exhaustive unit tests (table of private/tailnet/rebinding/redirect cases incl. `http://100.95.252.120:8000`, `http://dixie:11434`, `http://[fd7a:115c:a1e0::1]`, decimal/octal IPs, redirect-to-private) | tests green; Claude security review of the guard passes |
| **P1** clean fetch | `/v2/scrape` (html/json/text → clean), limits, auth, logging; `sift` CLI client (`fetch --mode clean`, `--jq`) + `skill/SKILL.md` installed on hosts; deployed on orion; talos wired | `web_extract` works on talos; contract tests pass for 0.19 and 0.21; guard blocks verified live from talos |
| **P2** digest + context | `/v1/fetch` modes, Dixie digest (thinking on vs off measured), Honcho search context, token metrics | on 50 real fetches: median `returned/raw` ≤ 0.2 with spot-checked quality; p90 latency ≤ 30 s with digest; no guardian-star access possible |
| **P2** digest + context | `/v1/fetch` modes, Dixie digest (thinking on vs off measured), Honcho search context, token metrics | on 50 real fetches: median `returned/raw` ≤ 0.2 with spot-checked quality; p90 latency ≤ 30 s with digest; restricted workspace only for permit_restricted callers |
| **P3** search | `/v2/search` + `/v1/search`: SearXNG + Brave LLM Context, dedupe, honcho-embed rerank | search quality spot-check vs SearXNG alone; cost per query known |
| **P4** cache + provenance | SQLite cache with TTL; optional provenance (if Kyle approves) | cache hit rate reported; repeat fetches served locally |