Runtime: drive topology turns on the Claude subscription via claude_cli

Switch the per-tenant runtime to ZeroClaw's new native `claude_cli` model
provider (added in the zeroclaw repo): every agent turn spawns `claude -p`
headless, authed by CLAUDE_CODE_OAUTH_TOKEN — i.e. the Claude subscription, no
per-minute API TPM ceiling (the groq free tier 429'd multi-turn pipelines).

- Dockerfile: install the Claude Code CLI (@anthropic-ai/claude-code) into the
  runtime image.
- agent.config.example.toml: role-cast on model_provider = "claude_cli.default".
  NOTE: set the model via env (ZEROCLAW_providers__models__claude_cli__default__model)
  not the TOML sub-table, else resolve_default_model() reads empty -> NEEDS_ONBOARDING.
- .gitignore: token.key (local Claude OAuth token, never committed).

Validated live on gw-04: a 2-node researcher->writer pipeline ran via the
deployed POST /api/topologies/run -> claude_cli -> real claude turns; 2-step
RunRecord, cost_usd 0.0 (subscription), no rate limiting.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

.gitignore

@@ -10,3 +10,4 @@ frontend/test-results
 *.log
 .DS_Store
 data/
+token.key

deploy/clawmates-runtime/Dockerfile

@@ -20,8 +20,15 @@ RUN --mount=type=cache,id=cm-cargo-registry,target=/usr/local/cargo/registry,sha
     && cp target/release/zeroclaw /usr/local/bin/zeroclaw
 
 FROM debian:bookworm-slim
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
+# ca-certificates for TLS; nodejs+npm to install the Claude Code CLI, which the
-    && rm -rf /var/lib/apt/lists/*
+# zeroclaw `claude_cli` model provider spawns (`claude -p`) to drive turns on a
+# Claude subscription / CLAUDE_CODE_OAUTH_TOKEN — no per-minute API TPM ceiling.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates curl nodejs npm \
+    && npm install -g @anthropic-ai/claude-code \
+    && npm cache clean --force \
+    && apt-get purge -y npm && apt-get autoremove -y \
+    && rm -rf /var/lib/apt/lists/* /root/.npm
 COPY --from=build /usr/local/bin/zeroclaw /usr/local/bin/zeroclaw
 ENV HOME=/zeroclaw-data \
     ZEROCLAW_WORKSPACE=/zeroclaw-data/workspace \

deploy/clawmates-runtime/agent.config.example.toml

@@ -11,8 +11,13 @@
 [onboard_state]
 quickstart_completed = true
 
-[providers.models.groq.default]
+# Reasoning backend = the local Claude Code CLI (native `claude_cli` provider).
-model = "llama-3.3-70b-versatile"
+# The daemon spawns `claude -p --output-format json` per turn, authed by
+# CLAUDE_CODE_OAUTH_TOKEN (injected at runtime) — i.e. the Claude subscription,
+# no per-minute API TPM ceiling. Leave model unset to use the subscription
+# default; set e.g. model = "haiku" to force a model.
+[providers.models.claude_cli.default]
+model = "haiku"
 
 # §15 door (Step 1A): a tool-free profile — agents can only reason, no native
 # outbound tools. Step 1B adds an MCP client bundle (the Clawmates gated door),
@@ -27,24 +32,24 @@ excluded_tools = ["shell", "file_read", "file_write", "http_request", "browser",
 # ZEROCLAW_AGENT_MAP (e.g. "analyst=researcher"); `scout` is the default
 # fallback (ZEROCLAW_DEFAULT_AGENT) for any unmapped role.
 [agents.coordinator]
-model_provider = "groq.default"
+model_provider = "claude_cli.default"
 risk_profile = "toolfree"
 
 [agents.researcher]
-model_provider = "groq.default"
+model_provider = "claude_cli.default"
 risk_profile = "toolfree"
 
 [agents.writer]
-model_provider = "groq.default"
+model_provider = "claude_cli.default"
 risk_profile = "toolfree"
 
 [agents.worker]
-model_provider = "groq.default"
+model_provider = "claude_cli.default"
 risk_profile = "toolfree"
 
 # Default fallback alias for roles not present above.
 [agents.scout]
-model_provider = "groq.default"
+model_provider = "claude_cli.default"
 risk_profile = "toolfree"
 
 # Step 1B — the Clawmates §15 MCP door (uncomment + point at the MCP server):