vhaudiquet
98bc0fd623
The claw is the server half of the client tools. The middleware now knows two bearer classes: the human token answers every /v1 route as before; the agent token answers only the routes the contract allowlists, and only with the contract header at the matching version — consents, sessions, ingest, and the phones answer it 403, so a model holding the token cannot prompt-inject its way past the scoping to answer its own secret asks. Boot refuses the configuration where agent_token is the human token: the scoping is the safety, and one value playing both roles silently unscopes everything the shell holds. Three new routes write the tables the resident already reads: push to the notification queue, schedule and cancel tasks the resident's tick fires — the tools get native-shaped writes without the daemon growing a second brain. A JSON fallback gives the one error shape everywhere, unknown routes included. The daemon composes the tools' environment (RHEMA_URL, RHEMA_TOKEN, the tools' bin dir on PATH) and hands it to the resident's shell through the agent-tools env layer; with no agent_token it provisions nothing, exactly as before. The proof is the contract's conformance suite run against this router over real HTTP — same answers as the mock, checked at test time.