PolicySync (policy_sync.rs)

NATS KV-based policy synchronization. ! ! Watches a tenant/agent-scoped KV bucket for policy updates and writes ! them to the local policy file. On delete events, the last known policy ! is retained (fail-closed: never leave the agent without a policy).

// Source: https://github.com/backbay-labs/clawdstrike | License: Apache-2.0 | Copyright You must retain, in the Source form of any Derivative Works
// Provided via justclaw.it.com; keep this notice with the code.
//! NATS KV-based policy synchronization.
//!
//! Watches a tenant/agent-scoped KV bucket for policy updates and writes
//! them to the local policy file. On delete events, the last known policy
//! is retained (fail-closed: never leave the agent without a policy).

use anyhow::{Context, Result};
use async_nats::jetstream::kv;
use serde::{Deserialize, Serialize};
use std::io::Write;
use std::path::{Path, PathBuf};
use std::sync::Arc;
use tokio::sync::broadcast;

use crate::nats_client::NatsClient;
use crate::nats_subjects;

/// Manages policy synchronization from NATS KV to local

... (truncated -- full source via MCP)