Rebrand: TeamClaw -> Clawmates (clawmates.work)

Full-depth rename per the approved plan; the 'claw' product vocabulary (claws, /claws routes, clawId, Claw Chat) stays — it is now the brand. - Display brand: Clawmates (manifest, titles, hero, login/rail logo 'clawmates'); default host app.clawmates.work; registry ghcr.io/clawmates - Crates tc-* -> cm-* (16 crates + all imports); binaries clawmates-server/broker/bundler; images clawmates/*; env prefix CLAWMATES_* (+ CM_TEST_DATABASE_URL / CM_LIVE_LLM); config clawmates.toml; helm chart deploy/helm/clawmates with clawmates-* resources; db names clawmates*; sockets /run/clawmates; cookie cm_session; kind cluster clawmates-test; seccomp node profile clawmates-agent-profile.json - All 9 Playwright brand assertions updated in lockstep; historical spec document left untouched as the only remaining 'TeamClaw' - Local env migrated: dev pg clawmates-dev-pg/clawmates_dev, shared test server clawmates-test-pg, kind cluster recreated with image + profile, compose images rebuilt under clawmates/* Verified end to end: 161 Rust + 68 frontend tests, 29 Playwright journeys, 4 live kind tests, helm/install/LOC/placeholder gates, and the clean-room install rehearsal serving the clawmates login page from a signed bundle of the rebuilt images. Co-Authored-By: Claude Fable 5 <[email protected]>
2026-06-10 12:31:25 -05:00
parent 8046853feb
commit add4f79fed
209 changed files with 1429 additions and 1422 deletions
@@ -0,0 +1,73 @@
+//! Envelope encryption: ChaCha20-Poly1305 under a master key. Air-gapped
+//! installs use a generated key file (backed up by the operator); a KMS
+//! key source slots in behind the same seal/open surface for cloud.
+
+use std::path::Path;
+
+use chacha20poly1305::aead::{Aead, AeadCore, KeyInit, OsRng};
+use chacha20poly1305::{ChaCha20Poly1305, Key, Nonce};
+
+use crate::BrokerError;
+
+/// A sealed (encrypted + authenticated) value.
+#[derive(Debug, Clone)]
+pub struct Sealed {
+    pub ciphertext: Vec<u8>,
+    pub nonce: Vec<u8>,
+}
+
+/// Master key loaded from a hex-encoded 32-byte file, mode 0600.
+pub struct FileKey {
+    cipher: ChaCha20Poly1305,
+}
+
+impl FileKey {
+    /// Generates a fresh key file (done once by `clawmates-admin init`).
+    pub fn generate(path: &Path) -> Result<(), BrokerError> {
+        let key = ChaCha20Poly1305::generate_key(&mut OsRng);
+        std::fs::write(path, hex::encode(key)).map_err(|e| BrokerError::Io(e.to_string()))?;
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o600))
+                .map_err(|e| BrokerError::Io(e.to_string()))?;
+        }
+        Ok(())
+    }
+
+    pub fn load(path: &Path) -> Result<FileKey, BrokerError> {
+        let encoded = std::fs::read_to_string(path).map_err(|e| BrokerError::Io(e.to_string()))?;
+        let bytes = hex::decode(encoded.trim())
+            .map_err(|e| BrokerError::Crypto(format!("key file is not hex: {e}")))?;
+        if bytes.len() != 32 {
+            return Err(BrokerError::Crypto(format!(
+                "key must be 32 bytes, found {}",
+                bytes.len()
+            )));
+        }
+        Ok(FileKey {
+            cipher: ChaCha20Poly1305::new(Key::from_slice(&bytes)),
+        })
+    }
+
+    pub fn seal(&self, plaintext: &[u8]) -> Result<Sealed, BrokerError> {
+        let nonce = ChaCha20Poly1305::generate_nonce(&mut OsRng);
+        let ciphertext = self
+            .cipher
+            .encrypt(&nonce, plaintext)
+            .map_err(|e| BrokerError::Crypto(e.to_string()))?;
+        Ok(Sealed {
+            ciphertext,
+            nonce: nonce.to_vec(),
+        })
+    }
+
+    pub fn open(&self, sealed: &Sealed) -> Result<Vec<u8>, BrokerError> {
+        if sealed.nonce.len() != 12 {
+            return Err(BrokerError::Crypto("nonce must be 12 bytes".into()));
+        }
+        self.cipher
+            .decrypt(Nonce::from_slice(&sealed.nonce), sealed.ciphertext.as_ref())
+            .map_err(|_| BrokerError::Crypto("decryption failed (tampered or wrong key)".into()))
+    }
+}