refactor: rename SPIFFE_DEMO prefix to DOCSCLAW and fix workspace path (#95)

* refactor: rename SPIFFE_DEMO prefix to DOCSCLAW and fix workspace path

Replace all SPIFFE_DEMO-era naming artifacts with the current project
identity, and fix the default workspace path to be container-safe.

Breaking changes:
- Env var prefix SPIFFE_DEMO_* → DOCSCLAW_* (e.g. DOCSCLAW_OTEL_ENABLED)
- Config path /etc/spiffe-demo/ → /etc/docsclaw/
- Prometheus metric namespace spiffe_demo → docsclaw (all 7 metrics)
- Logger env var SPIFFE_DEMO_LOG_FORMAT → DOCSCLAW_LOG_FORMAT

Workspace fixes:
- Default workspace /tmp/agent-workspace → /workspace (safe with
  readOnlyRootFilesystem: true in container hardening)
- System prompt now includes workspace path so the LLM writes files
  to the correct location instead of guessing /tmp
- Deployment manifests updated: volume mount at /workspace,
  agent-config.yaml workspace field updated to /workspace

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Pavel Anni <panni@redhat.com>

* fix: complete workspace path rename to /workspace across all assets

Address review feedback on PR #95: the initial commit renamed the
default workspace in serve.go and the two primary deploy manifests,
but left /tmp/agent-workspace in all other user-facing assets.

Changes:
- containers/Containerfile.security: create /workspace (same 65532:0
  owner, 775 mode); point TRIVY_CACHE_DIR and GRYPE_DB_CACHE_DIR
  to /workspace/.cache/* so scanner databases land on the writable
  emptyDir volume rather than the read-only image layer
- demo/batch/{finance,hr,security}: agent-config.yaml, deployment.yaml,
  deployment-template.yaml, and *-config.yaml batch run configs
- demo/batch/dashboard/k8s.go: volume mount path
- examples/{nps-explorer,skill-playground}: configmap + deployment
- docs/demo/{hr-analyst,skill-discovery-test,executive-assistant}.yaml
- README.md, docs/agent-config-guide.md (field reference default),
  site/getting-started.html
- testdata/research-agent/agent-config.yaml
- internal/workspace/workspace.go: update traversal-guard comment
  example from /tmp/agent to /workspace/agent

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Pavel Anni <panni@redhat.com>

* refactor: extract defaultWorkspace constant in serve.go

Replace the /workspace literal with a package-level constant so the
fallback value and the system prompt injection are defined in one place
and cannot drift independently.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Pavel Anni <panni@redhat.com>

---------

Signed-off-by: Pavel Anni <panni@redhat.com>

Author: pavelanni

README.md

@@ -167,7 +167,7 @@ tools:
     allowed_hosts:    # SSRF protection (empty = all allowed)
       - go.dev
       - kubernetes.io
-  workspace: /tmp/agent-workspace  # read_file/write_file root
+  workspace: /workspace  # read_file/write_file root
 
 loop:
   max_iterations: 10  # Max tool-use rounds before giving up

containers/Containerfile.security

@@ -118,13 +118,13 @@ COPY --from=tools /tools/grype      /usr/local/bin/grype
 COPY --from=tools /tools/syft       /usr/local/bin/syft
 COPY --from=tools /tools/cosign     /usr/local/bin/cosign
 
-RUN mkdir -p /tmp/agent-workspace \
-    && chown 65532:0 /tmp/agent-workspace \
-    && chmod 775 /tmp/agent-workspace
+RUN mkdir -p /workspace \
+    && chown 65532:0 /workspace \
+    && chmod 775 /workspace
 
 # Trivy and grype need writable cache directories
-ENV TRIVY_CACHE_DIR=/tmp/agent-workspace/.cache/trivy
-ENV GRYPE_DB_CACHE_DIR=/tmp/agent-workspace/.cache/grype
+ENV TRIVY_CACHE_DIR=/workspace/.cache/trivy
+ENV GRYPE_DB_CACHE_DIR=/workspace/.cache/grype
 
 USER 65532
 

demo/batch/dashboard/k8s.go

@@ -568,7 +568,7 @@ func buildDeploymentJSON(name, namespace, configMap, docServiceURL string, llmTi
 						},
 						"volumeMounts": []map[string]any{
 							{"name": "agent-config", "mountPath": "/config/agent", "readOnly": true},
-							{"name": "workspace", "mountPath": "/tmp/agent-workspace"},
+							{"name": "workspace", "mountPath": "/workspace"},
 						},
 						"securityContext": map[string]any{
 							"allowPrivilegeEscalation": false,

demo/batch/finance/agent-config.yaml

@@ -1,7 +1,7 @@
 tools:
   allowed:
     - fetch_document
-  workspace: /tmp/agent-workspace
+  workspace: /workspace
 
 loop:
   max_iterations: 15

demo/batch/finance/deployment-template.yaml

@@ -61,7 +61,7 @@ spec:
               mountPath: /config/agent
               readOnly: true
             - name: workspace
-              mountPath: /tmp/agent-workspace
+              mountPath: /workspace
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:

demo/batch/finance/deployment.yaml

@@ -59,7 +59,7 @@ data:
     tools:
       allowed:
         - fetch_document
-      workspace: /tmp/agent-workspace
+      workspace: /workspace
     loop:
       max_iterations: 15
 
@@ -136,7 +136,7 @@ spec:
               mountPath: /config/agent
               readOnly: true
             - name: workspace
-              mountPath: /tmp/agent-workspace
+              mountPath: /workspace
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:

demo/batch/finance/finance-analyst-config.yaml

@@ -0,0 +1,75 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: finance-analyst-config
+  labels:
+    app: finance-analyst
+data:
+  system-prompt.txt: |
+    You are a procurement analyst specializing in invoice
+    verification and contract compliance. You compare invoices
+    against contracted rates to identify anomalies.
+
+    Document ID conventions:
+    - Contracts: DOC-CTR-V001, DOC-CTR-V002, etc.
+    - Invoices: DOC-INV-{vendor}-{period}, e.g. DOC-INV-V003-2026-01
+      The vendor code (V001, V002, ...) matches between a contract
+      and its invoices. Each contract lists its invoice IDs in the
+      "RELATED INVOICES" section — use those exact IDs.
+
+    When given a contract to analyze, you must:
+
+    1. Fetch the contract document.
+    2. Read the "RELATED INVOICES" section to get the invoice IDs.
+    3. Fetch each invoice by its exact document ID.
+    4. Compare each invoice line item against the contract's
+      agreed rates.
+    5. Identify anomalies: rate deviations, duplicate charges,
+      line items not in the contract, unusual patterns.
+
+    Your response should be a structured anomaly report in markdown
+    format:
+
+    ## Rate Deviations
+    - Vendor: ... | Invoice: ... | Line item: ...
+      Contracted rate: $X | Invoiced rate: $Y | Deviation: Z%
+
+    ## Duplicate Charges
+    - Vendor: ... | Invoice: ... | Amount: $X | Appears in: ...
+
+    ## Uncontracted Line Items
+    - Vendor: ... | Invoice: ... | Line item: ...
+      (not found in contract)
+
+    ## Unusual Patterns
+    - Vendor: ... | Observation: ...
+
+    ## Summary
+    - Invoices reviewed: N
+    - Total anomalies found: N
+    - Estimated overcharge: $X
+    - Vendors requiring follow-up: ...
+
+    Be precise with dollar amounts and percentages. Reference
+    specific invoice numbers and contract sections.
+
+  agent-config.yaml: |
+    tools:
+      allowed:
+        - fetch_document
+      workspace: /workspace
+    loop:
+      max_iterations: 15
+
+  agent-card.json: |
+    {
+      "name": "finance-analyst",
+      "description": "Detects invoice anomalies against contracts",
+      "version": "1.0.0",
+      "protocolVersion": "0.3.0",
+      "url": "http://finance-analyst:8000",
+      "skills": [],
+      "capabilities": {},
+      "defaultInputModes": ["application/json"],
+      "defaultOutputModes": ["text/plain"]
+    }

demo/batch/hr/agent-config.yaml

@@ -1,7 +1,7 @@
 tools:
   allowed:
     - fetch_document
-  workspace: /tmp/agent-workspace
+  workspace: /workspace
 
 loop:
   max_iterations: 25

demo/batch/hr/deployment.yaml

@@ -48,7 +48,7 @@ data:
     tools:
       allowed:
         - fetch_document
-      workspace: /tmp/agent-workspace
+      workspace: /workspace
     loop:
       max_iterations: 25
 
@@ -124,7 +124,7 @@ spec:
               mountPath: /config/agent
               readOnly: true
             - name: workspace
-              mountPath: /tmp/agent-workspace
+              mountPath: /workspace
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:

demo/batch/hr/hr-screener-config.yaml

@@ -0,0 +1,65 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: hr-screener-config
+  labels:
+    app: hr-screener
+data:
+  system-prompt.txt: |
+    You are an HR analyst specializing in resume screening for
+    technology companies. You evaluate candidates against job
+    requirements with consistent, fair scoring criteria.
+
+    When given a job description and resumes to evaluate, you must:
+
+    1. Fetch the job description document using the context
+       document ID provided.
+    2. Fetch each resume document using the document IDs provided.
+    3. Score each candidate on a scale of 1-10 based on alignment
+       with the job requirements.
+    4. Return your evaluation as a JSON array.
+
+    Scoring rubric:
+    - 9-10: Exceeds all requirements, strong hire signal
+    - 7-8: Meets most requirements, some preferred qualifications
+    - 5-6: Meets minimum requirements, gaps in preferred areas
+    - 3-4: Partially qualified, significant gaps
+    - 1-2: Does not meet minimum requirements
+
+    Your response MUST be a JSON array with this exact structure:
+
+    [
+      {
+        "document_id": "DOC-R001",
+        "candidate_name": "Full Name",
+        "score": 8,
+        "strengths": "Brief summary of strengths",
+        "weaknesses": "Brief summary of gaps",
+        "recommendation": "Strong hire / Hire / Maybe / Pass"
+      }
+    ]
+
+    Be objective. Evaluate based on evidence in the resume, not
+    assumptions. If information is missing, note it as a gap
+    rather than inferring.
+
+  agent-config.yaml: |
+    tools:
+      allowed:
+        - fetch_document
+      workspace: /workspace
+    loop:
+      max_iterations: 25
+
+  agent-card.json: |
+    {
+      "name": "hr-resume-screener",
+      "description": "Screens resumes against job requirements",
+      "version": "1.0.0",
+      "protocolVersion": "1.0.0",
+      "url": "http://hr-worker:8000",
+      "skills": [],
+      "capabilities": {},
+      "defaultInputModes": ["application/json"],
+      "defaultOutputModes": ["text/plain"]
+    }