Omar SobhandClaude Fable 5
add4f79fed
Full-depth rename per the approved plan; the 'claw' product vocabulary (claws, /claws routes, clawId, Claw Chat) stays — it is now the brand. - Display brand: Clawmates (manifest, titles, hero, login/rail logo 'clawmates'); default host app.clawmates.work; registry ghcr.io/clawmates - Crates tc-* -> cm-* (16 crates + all imports); binaries clawmates-server/broker/bundler; images clawmates/*; env prefix CLAWMATES_* (+ CM_TEST_DATABASE_URL / CM_LIVE_LLM); config clawmates.toml; helm chart deploy/helm/clawmates with clawmates-* resources; db names clawmates*; sockets /run/clawmates; cookie cm_session; kind cluster clawmates-test; seccomp node profile clawmates-agent-profile.json - All 9 Playwright brand assertions updated in lockstep; historical spec document left untouched as the only remaining 'TeamClaw' - Local env migrated: dev pg clawmates-dev-pg/clawmates_dev, shared test server clawmates-test-pg, kind cluster recreated with image + profile, compose images rebuilt under clawmates/* Verified end to end: 161 Rust + 68 frontend tests, 29 Playwright journeys, 4 live kind tests, helm/install/LOC/placeholder gates, and the clean-room install rehearsal serving the clawmates login page from a signed bundle of the rebuilt images. Co-Authored-By: Claude Fable 5 <[email protected]>
62 lines
2.3 KiB
Rust
62 lines
2.3 KiB
Rust
use serde::{Deserialize, Serialize};
|
|
|
|
/// The six action categories that always require human approval before an
|
|
/// agent may execute them (spec §15, acceptance-blocking).
|
|
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
|
|
#[serde(rename_all = "snake_case")]
|
|
pub enum GatedCategory {
|
|
/// Outbound messages and emails leaving the workspace.
|
|
OutboundMessage,
|
|
/// Sharing keys, secrets, or credentials.
|
|
SecretSharing,
|
|
/// Access, permission, or sharing changes.
|
|
AccessChange,
|
|
/// Financial transactions and credit purchases.
|
|
FinancialTransaction,
|
|
/// File deletion.
|
|
FileDeletion,
|
|
/// Granting or extending external-infrastructure access.
|
|
InfraAccessGrant,
|
|
}
|
|
|
|
impl GatedCategory {
|
|
/// Every gated category, in spec order. The safety layer iterates this
|
|
/// to prove exhaustive coverage in tests.
|
|
pub const ALL: [GatedCategory; 6] = [
|
|
GatedCategory::OutboundMessage,
|
|
GatedCategory::SecretSharing,
|
|
GatedCategory::AccessChange,
|
|
GatedCategory::FinancialTransaction,
|
|
GatedCategory::FileDeletion,
|
|
GatedCategory::InfraAccessGrant,
|
|
];
|
|
|
|
/// Storage form matching the `approvals.category` CHECK constraint.
|
|
pub fn as_str(&self) -> &'static str {
|
|
match self {
|
|
GatedCategory::OutboundMessage => "outbound_message",
|
|
GatedCategory::SecretSharing => "secret_sharing",
|
|
GatedCategory::AccessChange => "access_change",
|
|
GatedCategory::FinancialTransaction => "financial_transaction",
|
|
GatedCategory::FileDeletion => "file_deletion",
|
|
GatedCategory::InfraAccessGrant => "infra_access_grant",
|
|
}
|
|
}
|
|
}
|
|
|
|
impl std::str::FromStr for GatedCategory {
|
|
type Err = String;
|
|
|
|
fn from_str(s: &str) -> Result<Self, Self::Err> {
|
|
match s {
|
|
"outbound_message" => Ok(GatedCategory::OutboundMessage),
|
|
"secret_sharing" => Ok(GatedCategory::SecretSharing),
|
|
"access_change" => Ok(GatedCategory::AccessChange),
|
|
"financial_transaction" => Ok(GatedCategory::FinancialTransaction),
|
|
"file_deletion" => Ok(GatedCategory::FileDeletion),
|
|
"infra_access_grant" => Ok(GatedCategory::InfraAccessGrant),
|
|
other => Err(format!("unknown gated category: {other}")),
|
|
}
|
|
}
|
|
}
|