kyle
3687636ed7
Digest, chunk-embed, and question-embed keys include fleet|restricted so a fleet caller cannot observe a restricted cache hit. Digest.Run takes the class from permit_restricted. A permit_restricted caller whose keys.toml workspace is not guardian-star is refused at Search (no Honcho request) and flagged at serve start and keys reload. docs: P3 restricted callers search like the fleet; cache/logs isolate.
sift
LLM-oriented fetch and search for the Hermes fleet: fetch a resource and get it back cleaned, compact, and with useful context attached — using local models (Dixie), SearXNG and Brave on orion, and Honcho for retrieval.
Status: P1 clean fetch (/v2/scrape, /v1/fetch, CLI, auth). See docs/PLAN.md and docs/P1.md.
Build
Makefile is the source of truth for flags (CGO_ENABLED=0, -trimpath, -s -w -X main.version=).
make build # bin/sift
make test # go test -race ./...
make lint # go vet, and staticcheck if installed
make install # PREFIX=/usr/local; example config in /etc/sift/
nix build # packages.sift, same ldflags
nix flake check # make test lint
The service does not assume Nix store paths. Non-Nix hosts: make install plus dist/sift.service.