Rebrand: TeamClaw -> Clawmates (clawmates.work)

Full-depth rename per the approved plan; the 'claw' product vocabulary (claws, /claws routes, clawId, Claw Chat) stays — it is now the brand. - Display brand: Clawmates (manifest, titles, hero, login/rail logo 'clawmates'); default host app.clawmates.work; registry ghcr.io/clawmates - Crates tc-* -> cm-* (16 crates + all imports); binaries clawmates-server/broker/bundler; images clawmates/*; env prefix CLAWMATES_* (+ CM_TEST_DATABASE_URL / CM_LIVE_LLM); config clawmates.toml; helm chart deploy/helm/clawmates with clawmates-* resources; db names clawmates*; sockets /run/clawmates; cookie cm_session; kind cluster clawmates-test; seccomp node profile clawmates-agent-profile.json - All 9 Playwright brand assertions updated in lockstep; historical spec document left untouched as the only remaining 'TeamClaw' - Local env migrated: dev pg clawmates-dev-pg/clawmates_dev, shared test server clawmates-test-pg, kind cluster recreated with image + profile, compose images rebuilt under clawmates/* Verified end to end: 161 Rust + 68 frontend tests, 29 Playwright journeys, 4 live kind tests, helm/install/LOC/placeholder gates, and the clean-room install rehearsal serving the clawmates login page from a signed bundle of the rebuilt images. Co-Authored-By: Claude Fable 5 <[email protected]>
2026-06-10 12:31:25 -05:00
parent 8046853feb
commit add4f79fed
209 changed files with 1429 additions and 1422 deletions
@@ -0,0 +1,15 @@
+[package]
+name = "clawmates-broker"
+version = "0.1.0"
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+publish.workspace = true
+
+[dependencies]
+cm-db = { path = "../../cm-db" }
+cm-secrets = { path = "../../cm-secrets" }
+tokio = { workspace = true }
+
+[lints]
+workspace = true
@@ -0,0 +1,57 @@
+//! The secret broker daemon (spec §15). Runs as its own process; only the
+//! server process can reach its socket — agent sandboxes have no route to
+//! it by construction.
+//!
+//! Configuration (environment):
+//! - `CLAWMATES_DATABASE__URL`   Postgres connection string (required)
+//! - `CLAWMATES_BROKER_SOCKET`   unix socket path (default /tmp/clawmates-broker.sock)
+//! - `CLAWMATES_BROKER_KEY_FILE` master key file; generated on first boot
+
+use std::path::PathBuf;
+use std::process::ExitCode;
+
+use cm_secrets::{BrokerServer, FileKey};
+
+#[tokio::main]
+async fn main() -> ExitCode {
+    match run().await {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(message) => {
+            eprintln!("clawmates-broker: {message}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+async fn run() -> Result<(), String> {
+    let database_url = std::env::var("CLAWMATES_DATABASE__URL")
+        .map_err(|_| "CLAWMATES_DATABASE__URL is required")?;
+    let socket_path = PathBuf::from(
+        std::env::var("CLAWMATES_BROKER_SOCKET")
+            .unwrap_or_else(|_| "/tmp/clawmates-broker.sock".into()),
+    );
+    let key_path = PathBuf::from(
+        std::env::var("CLAWMATES_BROKER_KEY_FILE")
+            .unwrap_or_else(|_| "/etc/clawmates/broker.key".into()),
+    );
+
+    if !key_path.exists() {
+        FileKey::generate(&key_path).map_err(|e| format!("key generation failed: {e}"))?;
+        println!(
+            "clawmates-broker: generated master key at {} — BACK IT UP; \
+             secrets are unrecoverable without it",
+            key_path.display()
+        );
+    }
+    let key = FileKey::load(&key_path).map_err(|e| format!("key load failed: {e}"))?;
+
+    let pool = cm_db::connect(&database_url, 5)
+        .await
+        .map_err(|e| format!("database connection failed: {e}"))?;
+
+    println!("clawmates-broker listening on {}", socket_path.display());
+    BrokerServer::new(pool, key, socket_path)
+        .serve()
+        .await
+        .map_err(|e| format!("broker failed: {e}"))
+}