Scaffold dd0c/run: Rust agent (classifier, executor, audit) + TypeScript SaaS

- Rust agent: clap CLI, command classifier (read-only/modifying/destructive), executor with approval gates, audit log entries
- Classifier: pattern-based safety classification for shell, AWS, kubectl, terraform/tofu commands
- 6 Rust tests: read-only, destructive, modifying, empty, terraform apply, tofu destroy
- SaaS backend: Fastify server, runbook CRUD API, approval API, Slack interactive handler
- Slack integration: signature verification, block_actions for approve/reject buttons
- PostgreSQL schema with RLS: runbooks, executions, audit_entries (append-only), agents
- Dual Dockerfiles: Rust multi-stage (agent), Node multi-stage (SaaS)
- Gitea Actions CI: Rust test+clippy, Node typecheck+test
- Fly.io config for SaaS

products/06-runbook-automation/saas/src/api/approvals.ts

@@ -0,0 +1,33 @@
+import type { FastifyInstance } from 'fastify';
+import { z } from 'zod';
+import pino from 'pino';
+
+const logger = pino({ name: 'api-approvals' });
+
+const approvalDecisionSchema = z.object({
+  decision: z.enum(['approve', 'reject']),
+  reason: z.string().max(500).optional(),
+});
+
+export function registerApprovalRoutes(app: FastifyInstance) {
+  // List pending approvals for tenant
+  app.get('/api/v1/approvals', async (req, reply) => {
+    // TODO: SELECT from audit_entries WHERE status = 'awaiting_approval'
+    return { approvals: [] };
+  });
+
+  // Approve or reject a step
+  app.post('/api/v1/approvals/:stepId', async (req, reply) => {
+    const { stepId } = req.params as { stepId: string };
+    const body = approvalDecisionSchema.parse(req.body);
+
+    // TODO: Update audit entry, notify agent via WebSocket/Redis pub-sub
+    logger.info({ stepId, decision: body.decision }, 'Approval decision recorded');
+
+    return {
+      step_id: stepId,
+      decision: body.decision,
+      reason: body.reason,
+    };
+  });
+}

products/06-runbook-automation/saas/src/api/runbooks.ts

@@ -0,0 +1,73 @@
+import type { FastifyInstance } from 'fastify';
+import { z } from 'zod';
+import pino from 'pino';
+
+const logger = pino({ name: 'api-runbooks' });
+
+const createRunbookSchema = z.object({
+  name: z.string().min(1).max(200),
+  description: z.string().max(2000).optional(),
+  yaml_content: z.string().min(1),
+});
+
+const listQuerySchema = z.object({
+  page: z.coerce.number().min(1).default(1),
+  limit: z.coerce.number().min(1).max(100).default(20),
+  status: z.enum(['active', 'archived']).optional(),
+});
+
+export function registerRunbookRoutes(app: FastifyInstance) {
+  // List runbooks
+  app.get('/api/v1/runbooks', async (req, reply) => {
+    const query = listQuerySchema.parse(req.query);
+    // TODO: SELECT from runbooks with RLS tenant context
+    return { runbooks: [], page: query.page, limit: query.limit, total: 0 };
+  });
+
+  // Get single runbook
+  app.get('/api/v1/runbooks/:id', async (req, reply) => {
+    const { id } = req.params as { id: string };
+    // TODO: SELECT by id
+    return { runbook: null };
+  });
+
+  // Create runbook
+  app.post('/api/v1/runbooks', async (req, reply) => {
+    const body = createRunbookSchema.parse(req.body);
+    // TODO: INSERT into runbooks, parse YAML, validate steps
+    logger.info({ name: body.name }, 'Runbook created');
+    return reply.status(201).send({ id: 'placeholder', ...body });
+  });
+
+  // Trigger runbook execution
+  app.post('/api/v1/runbooks/:id/execute', async (req, reply) => {
+    const { id } = req.params as { id: string };
+    const body = z.object({
+      dry_run: z.boolean().default(false),
+      variables: z.record(z.string()).optional(),
+    }).parse(req.body ?? {});
+
+    // TODO: Create execution record, dispatch to agent via WebSocket/queue
+    logger.info({ runbookId: id, dryRun: body.dry_run }, 'Execution triggered');
+    return reply.status(202).send({
+      execution_id: 'placeholder',
+      runbook_id: id,
+      status: 'pending',
+      dry_run: body.dry_run,
+    });
+  });
+
+  // Get execution history
+  app.get('/api/v1/runbooks/:id/executions', async (req, reply) => {
+    const { id } = req.params as { id: string };
+    // TODO: SELECT from executions
+    return { executions: [] };
+  });
+
+  // Get execution detail (with step-by-step audit trail)
+  app.get('/api/v1/executions/:executionId', async (req, reply) => {
+    const { executionId } = req.params as { executionId: string };
+    // TODO: SELECT execution + JOIN audit_entries
+    return { execution: null, steps: [] };
+  });
+}