feat(daemon): remote admin socket protocol (roadmap-v0.6 F.2)#85
Merged
Conversation
Adds crustcore_daemon::admin — an authenticated operator control plane (status / detail / cancel / kill) over a length-prefixed framed socket. Pure protocol core: parse_admin_command, frame/try_deframe (bounded; a hostile length is rejected before allocating — invariant 11), authenticate (constant-length nonce compare; the startup nonce gates every command), and dispatch_admin which feeds the SAME owner-scoped request_cancel/request_kill path as Telegram (invariant 12). Operator-only, never model-facing (invariant 5). The real UnixListener (0600) / TCP-loopback bind is the #[ignore]d daemon_admin_live_socket_smoke (TODO(daemon-admin-live)), in runbook F.4. 6 new tests; daemon-only; zero nano impact. `cargo xtask verify` green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds serve_admin_connection<R: Read, W: Write>: the transport-agnostic admin serve step — read a framed nonce, authenticate, read a framed command, dispatch (owner-scoped), write the framed response — plus read_frame / write_frame (bounded, EOF-clean). CI-tested over in-memory Cursor/Vec buffers (status round-trip + wrong-nonce drop). Now the only #[ignore]d inch is the thin UnixListener/TCP accept loop that wraps serve_admin_connection per connection. 2 new tests; daemon-only; zero nano impact. `cargo xtask verify` green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Roadmap-v0.6 F.2 — an authenticated loopback/Unix socket so an operator (or a paired supervising agent) can query status and cancel/kill tasks without Telegram. New module
crustcore_daemon::admin— the pure protocol core:parse_admin_command—status/detail <id>/cancel <id>/kill <id>(dep-free text grammar; no JSON serializer linked into the daemon core).frame/try_deframe—[len: u32 LE][payload], bounded byMAX_ADMIN_FRAME(a hostile length is rejected before allocating — invariant 11).authenticate— constant-length nonce compare; the startup nonce (~/.crustcore/admin.nonce, 0600) must match before any command is honored.dispatch_admin— feeds the same owner-scopedrequest_cancel/request_killpath as Telegram (invariant 12); status/detail render a bounded snapshot.CI core vs live seam
#[ignore],TODO(daemon-admin-live)): the realUnixListener/TCP-loopback bind + framed socket round-trip —daemon_admin_live_socket_smoke, runbook §F.4.Trust boundary
Operator-only, never model-facing (invariant 5 — the model has no admin socket). Cancel/kill are owner-scoped, the exact gate Telegram uses (invariant 12). Everything bounded (invariant 11).
Tests run
cargo xtask verify— green (runbook-check: 29 ignored seams + 20 tags). Nano unchanged at 53.5% (daemon-only). Independent offmain.🤖 Generated with Claude Code