- server.py: add CHAT_WORKSPACE_DIR env var, set cwd to workspace
and use --permission-mode acceptEdits + append message in Claude invocations
- lib/generators.sh: add workspace bind mount and env var to compose generator
- nomad/jobs/chat.hcl: add workspace host volume (static source "chat-workspace"),
meta block + NOMAD_META_ env var, volume_mount — Nomad-compatible pattern
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add lightweight Nomad service jobs for the staging file server and
Claude chat UI. Key changes:
- nomad/jobs/staging.hcl: caddy:alpine file-server mounting docker/
as /srv/site (read-only), no Vault integration needed
- nomad/jobs/chat.hcl: custom disinto/chat:local image with sandbox
hardening (cap_drop ALL, tmpfs, pids_limit 128, security_opt),
Vault-templated OAuth secrets from kv/disinto/shared/chat
- nomad/client.hcl: add site-content host volume for staging
- vault/policies/service-chat.hcl + vault/roles.yaml: read-only
access to chat secrets via workload identity
- bin/disinto: wire staging+chat into build, deploy order, seed
mapping, summary, and service validation
- tests/disinto-init-nomad.bats: update known-services assertion
Fixes prior art issue where security_opt and pids_limit were placed
at task level instead of inside docker driver config block.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
