Module kv 

NATS KV bucket name + key helpers (spec §2.3.2).

NATS KV bucket names must be domain-safe ASCII (a-z, A-Z, 0-9, _, -), so the spec’s dotted names (script.current, script.status) are flattened to underscore form here.

Constants

BUCKET_AGENTS_STATE

BUCKET_AGENT_CONFIG

BUCKET_AGENT_GROUPS

BUCKET_JOBS

Job catalog (v0.15) — operator-registered Manifests, keyed by manifest.id. Schedules and ad-hoc kanade run --job-id ... look jobs up here; the wire never round-trips an inline Manifest body through a Schedule again. Editing a job in-place retroactively changes what future schedule fires deploy.

BUCKET_JOBS_YAML

Parallel “operator source-of-truth YAML” stores keyed identically to BUCKET_JOBS / BUCKET_SCHEDULES. The agent / scheduler / projector all keep reading the JSON KVs above — these buckets exist only so the SPA’s YAML editor can round-trip operator comments + script indentation + block-scalar style exactly.

BUCKET_SCHEDULES

BUCKET_SCHEDULES_YAML

BUCKET_SCRIPT_CURRENT

BUCKET_SCRIPT_STATUS

KEY_AGENT_CONFIG_GLOBAL

Sprint 6 layered-config keys inside BUCKET_AGENT_CONFIG:

KEY_AGENT_TARGET_VERSION

Key inside BUCKET_AGENT_CONFIG carrying the broadcast target version. Agents watch this key and self-update when their running version drifts.

OBJECT_AGENT_RELEASES

Object Store bucket holding raw agent binaries (one object per version, e.g. 0.2.0 → file bytes).

OBJECT_APP_PACKAGES

Object Store holding generic application packages — anything the agent / kitting scripts pull down + install on endpoints. First consumer is the kanade-client app, but the bucket is intentionally generic: third-party installers (Webex, Teams, custom MSI bundles), upgrade scripts, configuration archives, etc. all live here.

OBJECT_RESULT_OUTPUT

Object Store holding overflow stdout / stderr blobs for the ExecResult wire kind (#227). The default NATS max_payload is 1 MB; a result whose stdout / stderr exceeds it would reject the publish and pin the agent’s outbox in a reconnect loop. The agent uploads any stdout / stderr larger than STDOUT_INLINE_THRESHOLD (256 KB, picked at 1/4 of the default max_payload so the rest of the ExecResult fields fit alongside) into this bucket and replaces the inline field with crate::wire::ExecResult::stdout_object / stderr_object pointers. Backend’s results projector derefs the pointers before INSERT so downstream consumers (SQLite, SPA Activity, inventory projector) see the full text the same way they always have.

OBJECT_SCRIPTS

Object Store holding manifest script bodies referenced by Execute::script_object (SPEC §2.4.1’s alternative to inline script: / repo-local script_file:). Per yukimemi/kanade issue #210, this is the “Plan B 4-bucket layout” sibling of app_packages — separated because scripts have a different lifecycle than installer binaries:

PREFIX_AGENT_CONFIG_GROUPS

PREFIX_AGENT_CONFIG_PCS

SCRIPT_STATUS_ACTIVE

SCRIPT_STATUS_REVOKED

STDOUT_INLINE_THRESHOLD

Inline threshold for ExecResult.stdout / .stderr. Larger payloads overflow into OBJECT_RESULT_OUTPUT. 256 KB = 1/4 of the NATS default max_payload (1 MB) so the rest of the ExecResult JSON (request_id, exec_id, etc.) easily fits below the publish-reject ceiling.

STREAM_AUDIT

STREAM_EVENTS

STREAM_EXEC

STREAM_INVENTORY

STREAM_OBS_EVENTS

JetStream stream backing the per-PC observability event pipeline (Issue #246). Distinct from STREAM_EVENTS (in-flight script lifecycle) — STREAM_OBS_EVENTS carries the timeline data the SPA’s Events page consumes: sign-in/out, power on/off, sleep/ resume, agent milestones, diagnostic bundle pointers. The agent publishes on obs.<pc_id> (see crate::subject::obs) and this stream catches everything matching crate::subject::OBS_FILTER so a backend that boots after the agent doesn’t miss any already-emitted events.

STREAM_RESULTS

Functions

agent_config_group_key

agent_config_pc_key

parse_agent_config_group_key

Inverse of agent_config_group_key — returns the bare group name if key carries the groups-scope prefix, else None.

parse_agent_config_pc_key

Inverse of agent_config_pc_key.