[williamloo-scale]

What and why

Adds the clock computer app (FD-5476). A computer env with apps = ["clock"] runs on its multi env gateway's clock: every process uses agent-env's libfaketime and the TLS shim, and a clock follower keeps the clock page in step with the gateway.

• The app (computers/envs/clock) builds the library and shim at compose from computers/clock, preloads them through /etc/ld.so.preload, and installs the follower. Its clock/v1 sync_time only reports what the follower last showed for a config id. That is also what makes the gateway count the computer as a follower.
• The follower (computers/clock/clock-follower, stdlib Python) runs as its own user, agentenv-clock, under a root loop (follow) that restarts it. It long-polls the gateway's /clock/watch, writes the clock page on each new version, anchors the page from the watch's four stamps the way NTP estimates an offset, and records its status.
• Security model: the session user can't write the page or the clock file, read the follower's config (and its token), or stop the follower. The follower and its loop force umask 022, because docker exec starts processes with umask 0000.
• The app's recipe/ holds per-file symlinks into computers/clock. These are the repo's first symlinks; a built wheel includes them as regular files, and hatchling skips a symlinked directory.

Core writes the follower's config and starts it, as root, in the next PR. Nothing here goes through the driver.

How it was tested

• Unit tests in tst/unit/env/envs/test_computer_clock.py cover the follower's offset, versions, config change, failures, missing config and umask, and the app's sync_time.
• End to end on local Docker in the stacked test PR.
• uv build --wheel: all 10 recipe files are in the wheel.

Notes

• The follower's read token is the computer's control token for now. feat(gateway)!: clock writes take the control token, a watch its computer's read token, and a waiting write names a computer that stopped watching (FD-5472) #634's per-computer tokens replace it, and this stack rebases once that merges.
• Docs to cover: composing the clock app, what the follower does, and the security model. The limits are agent-env's own servers on universe time, TLS stacks the shim doesn't reach, Chromium's time zone, and live sites at other dates.

Stack: this → sync → e2e → reset.

🤖 Generated with Claude Code

[williamloo-scale]

Closing: superseded by #649, which puts ubuntu-24.04 computers on the gateway's clock from the base image, with core configuring the follower at deploy and after a reset. FD-5477's remaining arm-time work (wait_followers_s and the refusals) stays with its assignee.