Repository navigation
Crew: automatic setup, open workspaces, deletion, agents that work on the server, @agent, a Crew tasks model and cluster-aware context - #406
Merged
Conversation
…ing (OW-10, OW-11)
run.create accepts remote_access "full" only with a remote root, remote execution and a private provider, stores it on the run (serialized only when full, so older journals replay byte for byte) and echoes it. run.remote_scope adds access, owner_id and channel_id, and the broker advertises remote_access_v1 after presence_v1.
…or (OW-6, OW-7) The bridge answers bridge.hello and bridge.probe itself and never forwards a bridge.* frame. A scope with access "full" goes to the new remote_full module: remote.shell and remote.execute run as the member through the login shell under a __crew-run supervisor (owner-keyed job records in ~/.local/state/biorouter-crew/jobs, detach, timeout, cancel by process group), file operations take absolute, ~/ or work-folder paths, and remote.fetch_blob and remote.share_file move attachments on a second broker connection in the background. Folder mode is unchanged except that a kernel below Landlock ABI 3 is refused up front. New verbs: probe, doctor and --version --output-format json. An answer too large for a frame is now refused under its ID instead of ending the bridge.
Implements the broker half of OW-1 to OW-5, OW-8 and wide runs from docs/crew/design/open-workspaces-and-automatic-setup.md: - Workspace.governance (managed by default, stored only when open) and workspace.set_governance, host and person only. - Under open governance every active member renames, archives, invites, adds and removes people (never a channel's owner), joins teams and channels on their own (team.join, channel.join) and admits joiners; additions no longer move the policy epoch, and admission, team.create and channel.create put everyone where they belong. The snapshot lists joinable teams and channels. - channel.delete and team.delete remove live state with map removals only, files after the commit, and leave messages unreadable in place; workspace.delete commits a tombstone, refuses everything but hello, and erases only the broker's own files after 30 seconds. biorouter-crew delete does the same offline. - workspace.context.set/get with a revision check, at most 64 KiB, readable by every member and agent. - run.create accepts up to 100 source channels. - Capabilities open_governance_v1, delete_v1, workspace_context_v1 and wide_runs_v1 after presence_v1, and the remote-folder refusal now says where the folder is set.
…nd /task (OW-10)
…document open_governance_contract: managed rules refuse what open rules allow (renames, archives, invitations, direct adds, removals, joins, admitting joiners), host-only actions stay the host's, admission and creation put everyone where they belong, additions keep agent grants running while removals end them, joinable lists, 100-source runs, the reworded remote-folder refusal, capability order, and no worker grant can do any of it. delete_contract: channel and team deletion remove state and attachment files, keep messages unreadable, replay after a restart and never patch the messages array; who may delete under each governance; the workspace tombstone refuses everything but hello; the erase removes only broker files; a half-erased directory never reopens; the offline delete refuses a running broker and the wrong ID; a real broker erases itself after the grace period (Linux, ordinary user). workspace_context_contract: who writes it, revision conflicts, size and character rules, share accounting, and worker reads.
…t document Method table rows for the open rules and the eight new methods, the capabilities appended after presence_v1, new Governance, Deleting and Workspace context document sections, the offline delete command, hello and status in the deleted state, 100-source runs, the worker allowlist, the reworded remote-folder refusal, headroom and share lists, and the durability paragraph's account of what deletion removes and what stays in the journal.
…orage wait The supervisor checks for a recorded cancel before it starts the command and on every poll, so a cancel that raced the start is honored. remote.hash stops at 1 GiB, since the relay waits for it. The probe asks every filesystem at once within one shared five-second bound, and skips the single files a container bind-mounts under /etc.
…and CLI packages (OW-9)
… and context for agents (OW-4..OW-9, OW-12)
…-access, ask and defaults
…agent access levels
…laude/crew-auto-setup
…o claude/crew-auto-setup # Conflicts: # crates/biorouter-crew/src/broker.rs # crates/biorouter-crew/src/main.rs
…claude/crew-auto-setup
…on, setup access and storage, CLI, UI) and update the Crew manual
…ibe them in the design contract, and keep the keepalive fake's hello reply free of a fork
…haviour change, so the too_many_lines baseline holds
…es not state it twice
…e idle or offline The broker leaves a tombstone naming the workspace in its runtime directory when it erases a deleted workspace; a member's bridge that finds no broker but that tombstone answers workspace_deleted; the daemon records it from that answer and from a hello that says deleted, stops redialling, and answers crew_workspace_deleted (409 on connect).
…d port as the invitation's login Only an alias Crew can connect through qualifies (no RemoteCommand, no own ProxyCommand or delegated credentials that the connection preflight refuses); a typed login, port or jump host still wins.
…w join sets it up, and say how to turn access on after joining
…what open workspaces do in the welcome and let-in copy
… who was offline learns the host deleted the workspace
…channel notice, a Deleted by host status, the remove confirmation, and no Reconnect
…spawn_serve_daemon, declared_public_url), with no behaviour change
mentions_status read 429 in a model name's hex suffix (deepseek-r1:8b-75faa429a979...) as a rate limit, so a refusal was classified transient and retried; this made an Ollama test flaky on CI. A code must now stand apart from letters as well as digits.
… Crew's unix-only probe and full-access modules from the console census
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this does
Crew on a shared Linux server, set up and used with nothing but your server login. The design contract is
docs/crew/design/open-workspaces-and-automatic-setup.md(OW-1 to OW-12); the manual in
docs/crew/is updated to match andscripts/check-crew-manual.mjspasses.service in the daemon, shared by the GUI and
biorouter crew setup | host | doctor, probes the server,sends the broker over SSH, checks its SHA-256, installs it atomically (keeping
.previous), signs inthrough the Sign in window when the server asks for a password or code, starts or joins the workspace,
makes the work folder and drafts the workspace context. A host whose
~/.localis writable by others istold which folders and how to fix it, or
--fix-permissionsdoes it.teams and channels and add people, and joiners are added to every team and channel. The host can switch
to managed.
#generalis deleted only with its team.folder (needs Landlock ABI 3, so not on Ubuntu 22.04's 5.15 kernel), or "as me on the server": commands
run in the member's own account through their own bridge, with their login shell, network and tools,
detached jobs, and
remote.fetch_blob/remote.share_fileto move channel files to and from theserver. Members get it by default, so nobody who does not own a channel is blocked.
and the CLI. A deleted workspace erases only the files its broker created; members are told, connected,
idle or offline (a tombstone in the broker's runtime directory), and can only remove it.
@agent,/agentand/taskin the Crew composer start a task in thechannel, and
biorouter crew askdoes the same from a terminal.biorouter crew defaults.biorouter-crew probe(machine, scheduler or none, modules, conda, containers, languages, storage); anymember can edit it, and every member's agent reads it before running work.
How it was tested
cargo test -p biorouter-crew(with and without default features, includingthe Linux-only delete and full-access contracts in a Linux container),
-p biorouter --lib crew::,-p biorouter-server --lib crew,-p biorouter-cli --lib, vitest forsrc/components/crew,lint:check,format:check,clippy-lint.sh(no newtoo_many_linesentries), the retired-name guardand the manual checker with its mutant suite.
leo.ucsf.eduwith two real accounts (one key, one password through an askpass script), inboth directions and in two desktop windows: host, join, auto-join, member-managed channels and teams,
messages, upload/list/download, each member's agent fetching the other's file, computing on the server
and sharing a result back, conda, network, a detached job read by a follow-up task, context edits by a
member, governance both ways, Browse channels, the Crew tasks model reaching the composer, and deleting
channels, teams and workspaces with connected, idle and offline members.
Known limits and follow-ups
lasts as long as the broker's runtime directory under
/tmp.crew joinon a connection that never connected gives it setup's default access (full, announced),even if the person chose Off before it ever connected; no saved field tells the two apart.
too_many_linesgate does not count tests.🤖 Generated with Claude Code