Omar SobhandClaude Opus 5
a02e0cba69
The card shipped in e20b321 could not actually be used. Three things were
missing, each of which failed at a different distance from its cause.
**1. `default_team_template` was parsed and never read.** Every recipe declares
one; `WorkflowRecipe` carries the field; nothing consumed it. A mission created
from a card with no explicitly chosen team was rejected at LAUNCH with "no
team_id, no team_template_id, no config.phase_teams" — one step removed from the
real cause, which is that creation ignored the recipe. Create now resolves it
via `team_templates::get_by_key`, only when the caller named no team of any
kind, so an explicit choice still wins. A test asserts every shipped recipe
names a template that has a `templates/teams/<key>.toml`, because a mismatch
there produces an unlaunchable card.
**2. The harvest ran nowhere.** `harvest_for_mission` existed and nothing called
it. `on_launch` now runs it for `continuous_research` missions, before the
phases start, and threads the blob store through from `main` (the route already
had it on `AppState`; the scheduler needed it). Deliberately non-fatal: a
harvest that fails still starts the phases, because the phase is what reports
whether today was quiet or broken and those must stay distinguishable — but
never silent, so both outcomes log their counts.
**3. Nothing wrote the manifest.** `templates/teams/continuous_research.toml`
has pointed its reader role at `ContinuousResearch/<date>/harvest.jsonl` since it
was authored, and the file did not exist — agents aimed at a path nothing
produced. `run_to_vault` now writes it beside the notes and stages it, but only
for a mission-attributed run. `Harvest` carries the shelved `Paper`s to build
it; re-parsing the notes we had just written would have been a parse of our own
output and one more place for the two to drift.
Also: the blob root. `storage.data_dir` defaults to "./data" and the container's
cwd is `/`, so the server tried to create `/data` as uid 65532 and EVERY shelve
failed with "storage io: Permission denied". The image now creates
/var/lib/clawmates-blobs owned by 65532 so a mounted volume inherits it rather
than arriving root:root. Kept off /var/lib/clawmates-missions on purpose: that
tree is swept, and a paper shelved there would be deleted out from under its own
catalogue note.
Proven end to end on a real mission: 15 candidates, 2 already held, 13 shelved,
0 failed; branch auto-merged as additive-only; manifest on vault `main` with
every documented key. The "already held" counts are the seen-set deduping across
topics within a single run, which is the behaviour the whole design exists for.
The project brief now comes from the mission description — `phase_task_text`
already places it under BRIEF verbatim, so no new field was needed.
346 tests pass.
Co-Authored-By: Claude Opus 5 <[email protected]>
78 lines
4.1 KiB
Docker
78 lines
4.1 KiB
Docker
# clawmates-server: static musl build into distroless. The same image serves
|
|
# the air-gapped bundle and the cloud registry.
|
|
FROM rust:1.96-slim AS builder
|
|
ARG TARGETARCH
|
|
# git + cmake are needed for the clawhdf5 git dependency (fetched via the git
|
|
# CLI — libgit2 chokes on Gitea smart-HTTP) and its zlib-ng C build (cmake).
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends musl-tools git cmake make pkg-config \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
WORKDIR /src
|
|
COPY Cargo.toml Cargo.lock rust-toolchain.toml ./
|
|
COPY crates ./crates
|
|
COPY tools ./tools
|
|
COPY images/seccomp ./images/seccomp
|
|
COPY migrations ./migrations
|
|
COPY .sqlx ./.sqlx
|
|
# Install the musl target AFTER rust-toolchain.toml is in place, so rustup adds
|
|
# it to the toolchain the workspace pins (channel 1.96.0), not the base image's
|
|
# default. Doing this before the COPY installs into a toolchain cargo won't
|
|
# actually use, and the build then fails with E0463 (no core for musl).
|
|
RUN case "$TARGETARCH" in \
|
|
arm64) echo aarch64-unknown-linux-musl > /rust-target ;; \
|
|
*) echo x86_64-unknown-linux-musl > /rust-target ;; \
|
|
esac \
|
|
&& rustup target add "$(cat /rust-target)"
|
|
ENV SQLX_OFFLINE=true
|
|
# Fetch git deps with the system git (libgit2 fails against Gitea smart-HTTP);
|
|
# build the zlib-ng C dep with the musl cross compiler for the static target.
|
|
ENV CARGO_NET_GIT_FETCH_WITH_CLI=true \
|
|
CC_x86_64_unknown_linux_musl=musl-gcc \
|
|
CC_aarch64_unknown_linux_musl=musl-gcc
|
|
RUN for attempt in 1 2 3; do \
|
|
cargo build --release --target "$(cat /rust-target)" -p clawmates-server && break; \
|
|
rc=$?; \
|
|
echo "cargo build failed with exit $rc on attempt $attempt/3 — retrying in $((attempt*10))s"; \
|
|
sleep $((attempt*10)); \
|
|
done \
|
|
&& cp "target/$(cat /rust-target)/release/clawmates-server" /clawmates-server
|
|
|
|
FROM debian:12-slim
|
|
# git — required at runtime for research topic repo clones
|
|
# (routes/research_setup::ensure_repo_workspace shells out to `git clone`
|
|
# and `git ls-files`). The distroless variant we had here didn't include
|
|
# a git binary; every wizard-materialized research topic silently failed
|
|
# to clone until this change.
|
|
# ca-certificates — required by `git clone` over HTTPS.
|
|
#
|
|
# NO chromium. It was here for the Slice 6 mission PDF renderer, which is gone:
|
|
# every call site passes `render_pdf: false` (markdown is the deliverable), and
|
|
# NOTHING reads the CHROMIUM_BIN this image used to set — the only Chromium in
|
|
# the platform is `browser.goto`, which runs it inside the agent's dedicated
|
|
# egress-enabled BROWSER container (cm-runtime/src/tools/browser.rs), never
|
|
# here. It cost **758 MB of an 875 MB image**: chromium + fonts-liberation were
|
|
# 87% of the server image, shipped on every deploy, every registry push, and
|
|
# every air-gapped bundle.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends git ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& useradd -u 65532 -M -s /usr/sbin/nologin nonroot
|
|
COPY --from=builder /clawmates-server /usr/local/bin/clawmates-server
|
|
# Builtin templates (team + workflow). Loader upserts them on boot.
|
|
COPY templates /etc/clawmates/templates
|
|
COPY skills /etc/clawmates/skills
|
|
# Normalize perms: the source dirs may arrive mode 700 (e.g. rsync -a
|
|
# preserving a developer's local dir perms), which would leave the
|
|
# nonroot runtime user unable to read them and silently skip the builtin
|
|
# skills/team-template seed. a+rX = dirs traversable, files readable.
|
|
RUN chmod -R a+rX /etc/clawmates/templates /etc/clawmates/skills
|
|
# Blob-store root, created and owned by the runtime user BEFORE the volume is
|
|
# attached. A docker named volume mounted over a path that does not exist in the
|
|
# image is created root:root, and the server runs as 65532 — so every shelve
|
|
# failed with "storage io: Permission denied" and no PDF could ever be stored.
|
|
# Creating it here means the volume inherits this ownership on first mount, so a
|
|
# fresh deployment works without a manual chown.
|
|
RUN mkdir -p /var/lib/clawmates-blobs && chown 65532:65532 /var/lib/clawmates-blobs
|
|
USER 65532
|
|
ENTRYPOINT ["/usr/local/bin/clawmates-server"]
|