ScobleClaw monorepo
Find a file
hermes 39b21dcda5 feat(opa): Layered judge L0 — OPA deployment + 4 Rego policies (eng#40)
Deploys openpolicyagent/opa:0.68.0 as a single-replica ClusterIP
service in the scobleclaw namespace, with a ConfigMap-mounted
policy bundle under /policies.

Policies (package scobleclaw):
  _lib.rego            shared deny rules (external email, forgejo
                       write outside marcus/engineering, payment
                       kamelets) + helpers (is_external_email,
                       is_payment_kamelet, is_forgejo_write_outside_allowed)
  main-agent.rego      10-kamelet allowlist for main-agent
  demo-concierge.rego  read-only 4-kamelet allowlist
  demo-watchdog.rego   4-kamelet allowlist (ob1 + discord)

L0 contract:
  POST /v1/data/scobleclaw/allow      -> {allow: bool}
  POST /v1/data/scobleclaw/needs_l1   -> {needs_l1: bool}
  POST /v1/data/scobleclaw/deny       -> [reason, ...]

Verified end-to-end against the running OPA pod:
  allow=true  for main-agent + kamelet:source/forgejo-search
  deny=[reason] for external email, forgejo write to stranger/not-mine,
               payment kamelet (stripe-charge), demo-concierge forgejo-create
  needs_l1=true for unknown kamelet (e.g. some-new-kamelet) on main-agent
  needs_l1=false for payment kamelet (L1 cannot override L0 deny)

Out of scope (separate tickets): judge-integration Camel-K binding,
llm-classifier-integration (L1), discord-escalation-integration (L2),
audit-sink OPA log tailing.
2026-06-08 16:36:37 -07:00
docs JUDGE-ARCH: Formalize actor-judge authorization layer 2026-05-23 19:31:30 -07:00
kubeclaw feat(pkg/floxenv): add Flox environment lifecycle management package 2026-05-29 23:40:22 -07:00
pkg/floxenv feat(pkg/floxenv): add Flox environment lifecycle management package 2026-05-29 23:40:22 -07:00
pool-manager feat(pool-manager): add /healthz handler for k8s liveness/readiness probes (#56) 2026-06-07 07:21:34 -07:00
scoble-policy feat(opa): Layered judge L0 — OPA deployment + 4 Rego policies (eng#40) 2026-06-08 16:36:37 -07:00
.gitignore feat(pkg/floxenv): add Flox environment lifecycle management package 2026-05-29 23:40:22 -07:00
coach-pattern-analysis.md Coach pattern analysis: root cause analysis of recurring 5/10 repetitive behavior critiques 2026-05-23 19:27:14 -07:00
go.mod feat(pkg/floxenv): add Flox environment lifecycle management package 2026-05-29 23:40:22 -07:00
README.md feat(pkg/floxenv): add Flox environment lifecycle management package 2026-05-29 23:40:22 -07:00

floxenv

Go package for managing Flox environment lifecycles via flox activate --detach.

Features

  • Activate — start a Flox environment and return an envID + PID.
  • Deactivate — graceful shutdown with SIGTERM then SIGKILL after a 10-second grace period.
  • IsAlive — lightweight, non-privileged process-existence check using zero-signal delivery.
  • Dev-mode stub — transparently falls back to a long-running shell command when flox is not installed (or when FLOXENV_DEV_MODE=1 is set), useful for CI and local development.

Installation

go get github.com/marcus/scobleclaw/pkg/floxenv

Usage

package main

import (
    "fmt"
    "log"

    "github.com/marcus/scobleclaw/pkg/floxenv"
)

func main() {
    r := floxenv.NewRegistry()

    envID, pid, err := r.Activate("/path/to/env/.flox/env/manifest.toml")
    if err != nil {
        log.Fatal(err)
    }
    fmt.Printf("activated %s (pid %d)\n", envID, pid)

    // later …
    if err := r.Deactivate(envID, pid); err != nil {
        log.Fatal(err)
    }
}

Dev mode

When the flox binary is absent, or when FLOXENV_DEV_MODE=1 is set in the environment, the package runs a lightweight stub that forks a shell sleep process instead of invoking flox activate. This keeps dependent tests green in environments where Flox is not available.

Running tests

Unit tests (uses the dev-mode stub):

go test ./pkg/floxenv

Integration tests (requires a working Flox installation):

go test -tags=integration ./pkg/floxenv

API

Function Signature Description
NewRegistry () *Registry Create a new registry, auto-detecting dev mode.
(*Registry) Activate (manifestPath string) (envID string, pid int, err error) Activate a Flox environment.
(*Registry) Deactivate (envID string, pid int) error Shutdown an active environment.
IsAlive (pid int) bool Non-privileged process existence check.
(*Registry) List () []Info Snapshot of tracked environments.

License

MIT