ScobleClaw monorepo
Deploys openpolicyagent/opa:0.68.0 as a single-replica ClusterIP
service in the scobleclaw namespace, with a ConfigMap-mounted
policy bundle under /policies.
Policies (package scobleclaw):
_lib.rego shared deny rules (external email, forgejo
write outside marcus/engineering, payment
kamelets) + helpers (is_external_email,
is_payment_kamelet, is_forgejo_write_outside_allowed)
main-agent.rego 10-kamelet allowlist for main-agent
demo-concierge.rego read-only 4-kamelet allowlist
demo-watchdog.rego 4-kamelet allowlist (ob1 + discord)
L0 contract:
POST /v1/data/scobleclaw/allow -> {allow: bool}
POST /v1/data/scobleclaw/needs_l1 -> {needs_l1: bool}
POST /v1/data/scobleclaw/deny -> [reason, ...]
Verified end-to-end against the running OPA pod:
allow=true for main-agent + kamelet:source/forgejo-search
deny=[reason] for external email, forgejo write to stranger/not-mine,
payment kamelet (stripe-charge), demo-concierge forgejo-create
needs_l1=true for unknown kamelet (e.g. some-new-kamelet) on main-agent
needs_l1=false for payment kamelet (L1 cannot override L0 deny)
Out of scope (separate tickets): judge-integration Camel-K binding,
llm-classifier-integration (L1), discord-escalation-integration (L2),
audit-sink OPA log tailing.
|
||
|---|---|---|
| docs | ||
| kubeclaw | ||
| pkg/floxenv | ||
| pool-manager | ||
| scoble-policy | ||
| .gitignore | ||
| coach-pattern-analysis.md | ||
| go.mod | ||
| README.md | ||
floxenv
Go package for managing Flox environment lifecycles via flox activate --detach.
Features
- Activate — start a Flox environment and return an
envID+ PID. - Deactivate — graceful shutdown with
SIGTERMthenSIGKILLafter a 10-second grace period. - IsAlive — lightweight, non-privileged process-existence check using zero-signal delivery.
- Dev-mode stub — transparently falls back to a long-running shell command when
floxis not installed (or whenFLOXENV_DEV_MODE=1is set), useful for CI and local development.
Installation
go get github.com/marcus/scobleclaw/pkg/floxenv
Usage
package main
import (
"fmt"
"log"
"github.com/marcus/scobleclaw/pkg/floxenv"
)
func main() {
r := floxenv.NewRegistry()
envID, pid, err := r.Activate("/path/to/env/.flox/env/manifest.toml")
if err != nil {
log.Fatal(err)
}
fmt.Printf("activated %s (pid %d)\n", envID, pid)
// later …
if err := r.Deactivate(envID, pid); err != nil {
log.Fatal(err)
}
}
Dev mode
When the flox binary is absent, or when FLOXENV_DEV_MODE=1 is set in the environment, the package runs a lightweight stub that forks a shell sleep process instead of invoking flox activate. This keeps dependent tests green in environments where Flox is not available.
Running tests
Unit tests (uses the dev-mode stub):
go test ./pkg/floxenv
Integration tests (requires a working Flox installation):
go test -tags=integration ./pkg/floxenv
API
| Function | Signature | Description |
|---|---|---|
NewRegistry |
() *Registry |
Create a new registry, auto-detecting dev mode. |
(*Registry) Activate |
(manifestPath string) (envID string, pid int, err error) |
Activate a Flox environment. |
(*Registry) Deactivate |
(envID string, pid int) error |
Shutdown an active environment. |
IsAlive |
(pid int) bool |
Non-privileged process existence check. |
(*Registry) List |
() []Info |
Snapshot of tracked environments. |
License
MIT