P2 complete: Docker sandbox with kernel assertions + secret broker

tc-sandbox:
- SandboxSpec/SandboxDriver + DockerDriver (bollard): uid 10001, cap-drop
  ALL, no-new-privileges, embedded seccomp deny profile (unshare/ptrace/
  bpf/keyctl/mount/...), read-only rootfs with tmpfs /tmp + /home/agent,
  network=none, mem/cpu/pids limits
- agent-base image: non-root, all setuid binaries stripped
- 6 kernel-level assertion tests probing from INSIDE real containers:
  uid + CapEff==0, rootfs read-only, seccomp EPERM on unshare, zero
  traffic-carrying interfaces + failed egress connect, no setuid +
  NoNewPrivs=1, lifecycle

tc-secrets:
- ChaCha20-Poly1305 envelope encryption under a FileKey (generated 0600,
  AEAD tamper detection tested); secrets table ciphertext-at-rest
- teamclaw-broker daemon: length-prefixed JSON over a unix socket; no
  protocol operation ever returns plaintext; InvokeHttp independently
  consumes the single-use execution grant against Postgres BEFORE touching
  any credential, then performs the call itself with the secret injected
- Tests over the real socket + real Postgres + a real local HTTP receiver:
  encrypted at rest, pending approval refused, approved call carries the
  bearer token exactly once, grant replay refused, non-http URLs rejected

116 Rust + 61 frontend tests + 14 E2E journeys green.

Co-Authored-By: Claude Fable 5 <[email protected]>

crates/bins/teamclaw-broker/Cargo.toml

@@ -0,0 +1,15 @@
+[package]
+name = "teamclaw-broker"
+version = "0.1.0"
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+publish.workspace = true
+
+[dependencies]
+tc-db = { path = "../../tc-db" }
+tc-secrets = { path = "../../tc-secrets" }
+tokio = { workspace = true }
+
+[lints]
+workspace = true

crates/bins/teamclaw-broker/src/main.rs

@@ -0,0 +1,57 @@
+//! The secret broker daemon (spec §15). Runs as its own process; only the
+//! server process can reach its socket — agent sandboxes have no route to
+//! it by construction.
+//!
+//! Configuration (environment):
+//! - `TEAMCLAW_DATABASE__URL`   Postgres connection string (required)
+//! - `TEAMCLAW_BROKER_SOCKET`   unix socket path (default /tmp/teamclaw-broker.sock)
+//! - `TEAMCLAW_BROKER_KEY_FILE` master key file; generated on first boot
+
+use std::path::PathBuf;
+use std::process::ExitCode;
+
+use tc_secrets::{BrokerServer, FileKey};
+
+#[tokio::main]
+async fn main() -> ExitCode {
+    match run().await {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(message) => {
+            eprintln!("teamclaw-broker: {message}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+async fn run() -> Result<(), String> {
+    let database_url = std::env::var("TEAMCLAW_DATABASE__URL")
+        .map_err(|_| "TEAMCLAW_DATABASE__URL is required")?;
+    let socket_path = PathBuf::from(
+        std::env::var("TEAMCLAW_BROKER_SOCKET")
+            .unwrap_or_else(|_| "/tmp/teamclaw-broker.sock".into()),
+    );
+    let key_path = PathBuf::from(
+        std::env::var("TEAMCLAW_BROKER_KEY_FILE")
+            .unwrap_or_else(|_| "/etc/teamclaw/broker.key".into()),
+    );
+
+    if !key_path.exists() {
+        FileKey::generate(&key_path).map_err(|e| format!("key generation failed: {e}"))?;
+        println!(
+            "teamclaw-broker: generated master key at {} — BACK IT UP; \
+             secrets are unrecoverable without it",
+            key_path.display()
+        );
+    }
+    let key = FileKey::load(&key_path).map_err(|e| format!("key load failed: {e}"))?;
+
+    let pool = tc_db::connect(&database_url, 5)
+        .await
+        .map_err(|e| format!("database connection failed: {e}"))?;
+
+    println!("teamclaw-broker listening on {}", socket_path.display());
+    BrokerServer::new(pool, key, socket_path)
+        .serve()
+        .await
+        .map_err(|e| format!("broker failed: {e}"))
+}