feat(inference): select Hive runtime profiles

What changed

This adds runtime-selected Hive inference profiles so admins can retarget Hive’s own model-backed workflows from Ops instead of changing launch-time environment configuration.

• Added Hive inference and embedding roles to inference profiles, with database constraints that keep each role assigned to at most one profile.
• Added encrypted Hive-owned tokens for those roles, including refresh/reuse behavior and authentication checks that reject role tokens after a profile no longer owns the role.
• Updated Hive.Agents to prefer the selected Hive inference profile through /inference/v1, while keeping HIVE_LLM_* as the fallback when no profile is selected.
• Added the Ops profile actions control for assigning Hive inference or embedding usage, editing the profile, and toggling the profile state.
• Seeded local development data with sample Hive inference and embedding profiles plus usage history.

Why

Hive’s agentic workflows previously depended on deployment-time large language model configuration. That made retargeting expensive operationally and kept Hive’s own usage outside the same gateway accounting used by repository clients. Selecting a normal profile for Hive lets operators move the model at runtime, reuse the existing gateway, and see usage and cost attributed to the chosen profile.

Approach

The selected profile is still a standard model gateway profile. When a profile is marked for Hive inference or embeddings, Hive ensures a role-scoped internal token, stores the token value encrypted, and uses the OpenAI-compatible gateway with the stable model name openai:<profile-name>. Moving the role to another profile clears the old role holder, so stale Hive-owned tokens stop authenticating for that role.

The dashboard keeps role assignment as a page action rather than form state. The profile detail page uses Noora’s button dropdown pattern so role changes sit alongside other operational actions without adding checkbox-only configuration fields.

Impact

Existing deployments keep working with HIVE_LLM_API_KEY, HIVE_LLM_MODEL, and HIVE_LLM_BASE_URL until an admin selects a Hive inference profile. The migration adds role fields and encrypted token storage, plus concurrent indexes for the one-profile-per-role constraints.

Validation

• mix ecto.reset
• mix compile --warnings-as-errors
• mix test test/hive/agents_test.exs test/hive/inference_test.exs test/hive_web/live/ops_live/inference_test.exs with 37 passing tests
• mix test with 818 passing tests

🤖 Generated with GPT-5.5 via OpenCode

No GitHub comments yet.