37 Commits

Author	SHA1	Message	Date
Max Mayfield	3be37d1293	Skip auth on /version endpoint (same as /health)	2026-03-02 13:54:46 +00:00
Max Mayfield	5bad2481ae	Add /version endpoint to all products + BUILD_SHA/BUILD_TIME in Dockerfiles	2026-03-02 13:53:15 +00:00
Max Mayfield	c4ec43cb76	Add CI build-push jobs targeting reg.dd0c.net with docker login + deploy	2026-03-02 13:48:10 +00:00
Max Mayfield	18d476f7a0	Target Nas runner (ubuntu-24.04) for build-push jobs — sandbox lacks Docker	2026-03-02 05:32:04 +00:00
Max Mayfield	2df0ce2fff	Trigger CI build+push to populate registry at 192.168.86.11:30095	2026-03-02 05:29:03 +00:00
Max Mayfield	4eda9d7be3	Add .dockerignore to all Node products (skip node_modules/dist/tests in build context)	2026-03-02 04:45:57 +00:00
Max Mayfield	81d03c1735	Fix tenant slug collision: append random hex suffix to prevent 23505 on duplicate tenant names	2026-03-01 22:36:21 +00:00
Max Mayfield	362c94af33	Fix Node Dockerfiles: npm ci --include=dev so tsc is available in builder stage	2026-03-01 19:31:44 +00:00
Max Mayfield	27a89ee2b7	Trigger CI with tsc fix	2026-03-01 06:56:00 +00:00
Max Mayfield	3e68e8871d	Trigger CI for P2-SaaS, P4, P5, P6	2026-03-01 06:52:14 +00:00
Max Mayfield	68140881e0	Trigger CI for P3-P6 Node products	2026-03-01 06:43:58 +00:00
Max Mayfield	6403e7a3bf	Move CI workflows to repo root .gitea/workflows/ (Gitea requires root location) ... - 6 per-product CI workflows with path filters - P1: Rust (cargo test + clippy + fmt) - P2: Go agent (go test + vet) + Node SaaS (tsc + npm test) - P3-P6: Node (npm ci + tsc + npm test) - Removed old per-product .gitea dirs (Gitea ignores non-root workflows)	2026-03-01 06:19:42 +00:00
Max Mayfield	4146f1c4d0	Fix TypeScript compilation errors across P3-P6 ... - jwt.sign: explicit SignOptions cast for expiresIn (all 4 products) - ioredis: use named import { Redis } instead of default (P4, P6) - P4 catalog/service: fix import paths for aws-scanner and github-scanner - P4 discovery: pass pool to ScheduledDiscovery constructor - P6 agent-bridge: add explicit types for Redis message callback params - All 4 Node products now compile cleanly with tsc --noEmit	2026-03-01 06:06:31 +00:00
Max Mayfield	cf4d1de9e7	Generate package-lock.json for all 4 Node products (required by npm ci in Dockerfiles)	2026-03-01 06:01:33 +00:00
Max Mayfield	6cd8c49881	Implement P4 scheduled discovery: wire AWS/GitHub scanners to catalog service ... - ScheduledDiscovery now instantiates real scanners and merges results via CatalogService - Records scan history (start/complete/errors) in scan_history table - Partial scan failures stage results instead of overwriting catalog	2026-03-01 04:16:01 +00:00
Max Mayfield	b10e88e14d	Implement staged update merge into services table (P4 discovery)	2026-03-01 04:13:39 +00:00
Max Mayfield	12ca955de5	Build dd0c marketing site: Astro + Tailwind, homepage + 6 product landing pages ... - Homepage: hero with terminal mock, product grid, how-it-works, pricing (free/pro/self-hosted), CTA - Product pages: route, drift, alert, portal, cost, run — each with features, install snippets, comparison tables - Dark theme matching dd0c brand (indigo primary, cyan accent, dark surfaces) - Astro static output for Cloudflare Pages deployment - SEO: OG tags, meta descriptions, semantic HTML	2026-03-01 04:12:37 +00:00
Max Mayfield	eec1df4c69	Implement P4 AWS scanner: ECS/Lambda/RDS discovery with tag-based ownership ... - ECS: list clusters → list services → describe → extract tags, capture task def + counts - Lambda: paginated list functions → list tags, capture runtime/memory/timeout - RDS: describe instances → list tags, capture engine/class/storage/multi-AZ - Owner resolution from aws tags (owner/team/Owner/Team) - Partial failure handling preserved (per-service try/catch)	2026-03-01 03:19:56 +00:00
Max Mayfield	5ee869b9d8	Implement auth: login/signup (scrypt), API key generation, shared migration ... - Login: email + password lookup, scrypt verify, JWT token - Signup: create tenant + owner user in transaction, slug generation - API key: dd0c_ prefix, SHA-256 hash (not bcrypt — faster for API key lookups), prefix index - Scrypt over bcrypt: zero native deps, Node.js built-in crypto - Auth routes skip JWT middleware (login/signup are public) - 002_auth.sql: users + api_keys tables with RLS, copied to all products - Synced auth middleware to P3/P4/P5/P6	2026-03-01 03:19:18 +00:00
Max Mayfield	bdaa732ce1	Implement TODO stubs: webhook secret lookup, alert→incident wiring, catalog upsert/stage ... - P3: getWebhookSecret() now queries DB; ingestAlert() creates/attaches incidents, auto-resolves on resolved status - P4: stageUpdates() writes to staged_updates table; upsertService() with ON CONFLICT; getService/updateOwner implemented	2026-03-01 03:18:05 +00:00
Max Mayfield	2c112b2fb1	Add vitest configs for P2-P6	2026-03-01 03:16:58 +00:00
Max Mayfield	2ceeac1a11	Add P2 SaaS CI, P4 scheduled discovery, P6 agent bridge (Redis pub/sub), Caddyfile ... - P2: Gitea Actions CI for SaaS backend (separate from Go agent CI) - P4: ScheduledDiscovery with Redis distributed lock to prevent concurrent scans - P6: AgentBridge — Redis pub/sub for SaaS↔agent communication (approvals + step results) - Caddyfile: self-hosted reverse proxy with auto-TLS for all 6 products	2026-03-01 03:16:33 +00:00
Max Mayfield	bbbea3519e	Add unit tests for P2 SaaS, P3 notifications, P4 search, P5 ingestion, P6 API ... - P2: nonce validation, severity levels, RLS withTenant - P3: notification dispatcher severity gating, Slack Block Kit emoji mapping - P4: Meilisearch fallback, service CRUD validation, staged update actions - P5: cost ingestion validation, snooze range, optimistic locking - P6: runbook API validation, approval decisions, execution status machine, Slack signature	2026-03-01 03:15:31 +00:00
Max Mayfield	3326d9a714	Add .gitignore files for P2-P6	2026-03-01 03:14:37 +00:00
Max Mayfield	f2e0a32cc7	Wire auth middleware into all products, add docker-compose and init-db script ... - Auth middleware (JWT + API key + RBAC) copied into P3/P4/P5/P6 - All server entry points now register auth hooks + auth routes - Webhook and Slack endpoints skip JWT auth (use HMAC/signature) - docker-compose.yml: shared Postgres + Redis + Meilisearch, all 4 Node products as services - init-db.sh: creates per-product databases and runs migrations - P1 (Rust) and P2 (Go agent) run standalone, not in compose	2026-03-01 03:10:35 +00:00
Max Mayfield	2bbaa1efde	Add missing configs: CI workflows, tsconfigs, data layers for P4/P5/P6	2026-03-01 03:07:33 +00:00
Max Mayfield	a17527dfa4	Flesh out dd0c/portal: service CRUD, discovery API, Meilisearch search, data layer ... - Service API: list (filtered by type/owner/lifecycle/tier), detail, upsert, delete, ownership summary - Discovery API: trigger AWS/GitHub scans, scan history, staged update review (apply/reject) - Search: Meilisearch full-text with PG ILIKE fallback, reindex endpoint - Data layer: withTenant() RLS wrapper, Zod config with MEILI_URL/MEILI_KEY - Fastify server entry point	2026-03-01 03:05:55 +00:00
Max Mayfield	23db74b306	Scaffold dd0c/portal: AWS+GitHub discovery, catalog service, ownership resolution ... - AWS scanner: ECS/Lambda/RDS discovery with partial failure handling - GitHub scanner: CODEOWNERS parsing, commit-based heuristic ownership, rate limit resilience - Catalog service: ownership resolution (config > codeowners > aws-tag > heuristic), staged updates for partial scans - Ownership tests: 6 cases covering full priority chain - PostgreSQL schema with RLS: services, staged_updates, scan_history, free tier (50 services) - Fly.io config, Dockerfile	2026-03-01 02:51:02 +00:00
Max Mayfield	72a0f26a7b	Add BMad review epic addendums for all 6 products ... Per-product surgical additions to existing epics (not cross-cutting): - P1 route: 8pts (key redaction, SSE billing, token math, CI runner) - P2 drift: 12pts (mTLS revocation, state lock recovery, pgmq visibility, RLS leak, entropy scrubber) - P3 alert: 10pts (HMAC replay, claim-check, out-of-order correlation, free tier, tenant isolation) - P4 portal: 9pts (partial scan recovery, ownership conflicts, Meilisearch rebuild, VCR freshness, free tier) - P5 cost: 7pts (concurrent baselines, remediation RBAC, Clock interface, property tests, Redis fallback) - P6 run: 15pts (shell AST parsing, canary suite, intervention TTL, streaming audit, crypto signatures) Total: 61 story points across 30 new stories	2026-03-01 02:27:55 +00:00
Max Mayfield	d038cd9c5c	Implement BMad Must-Have Before Launch fixes for all 6 products ... P1: API key redaction, SSE billing leak, token math edge cases, CI runner config P2: mTLS revocation lockout, terraform state lock recovery, RLS pool leak, entropy scrubber, pgmq visibility P3: HMAC replay prevention, cross-tenant negative tests, correlation window edge cases, SQS claim-check, free tier P4: Discovery partial failure recovery, ownership conflict integration test, VCR freshness CI, Meilisearch rebuild, Cmd+K latency P5: Concurrent baseline conflicts, remediation RBAC, Clock interface for governance, 10K property-based runs, Redis panic fallback P6: Cryptographic agent update signatures, streaming audit logs with WAL, shell AST parsing (mvdan/sh), intervention deadlock TTL, canary suite CI gate	2026-03-01 02:14:04 +00:00
Max Mayfield	9cc5aeaa03	BMad code reviews for P4 (portal) and P5 (cost) — manual ... P4: Discovery reliability flagged as existential risk, VCR cassette staleness, ownership conflict race condition, Step Functions→cron gap P5: Concurrent baseline update risk, remediation RBAC gap, pricing staleness, property-based tests need 10K runs, Clock interface needed for governance	2026-03-01 02:06:06 +00:00
Max Mayfield	b7cce013ed	Phase 3: BDD acceptance specs for P4 (portal) — partial ... P4: 1,177 lines (subagent still running, may have more output pending) All 6 products now have acceptance specs committed.	2026-03-01 02:01:04 +00:00
Max Mayfield	c3bafa238a	Add dual-mode deployment addendums for all 6 products ... P1 route: 16 pts (template, full docker-compose + install script) P2 drift: 17 pts (pgmq, local CA for mTLS) P3 alert: 19 pts (Lambda→Fastify, DynamoDB→PG JSONB) P4 portal: 18 pts (Step Functions→cron, Aurora→PG+pgvector) P5 cost: 19 pts (EventBridge→agent/polling, DynamoDB→PG JSONB) P6 run: 15 pts (easiest — already PG-native, no AWS deps in core) Total self-hosted effort: ~104 story points across all 6 products	2026-03-01 02:00:00 +00:00
Max Mayfield	03bfe931fc	Implement review remediation + PLG analytics SDK ... - All 6 test architectures patched with Section 11 addendums - P5 (cost) fully rewritten from 232 to ~600 lines - PLG brainstorm + party mode advisory board results - Analytics SDK v2 (PostHog Cloud, Zod strict, Lambda-safe) - Analytics tests v2 (safeParse, no , no timestamp, no PII) - Addresses all Gemini review findings across P1-P6	2026-03-01 01:42:49 +00:00
Max Mayfield	2fe0ed856e	Add Gemini TDD reviews for all 6 products ... P1, P2, P3, P4, P6 reviewed by Gemini subagents. P5 reviewed manually (Gemini credential errors). All reviews flag coverage gaps, anti-patterns, and Transparent Factory tenet gaps.	2026-03-01 00:29:24 +00:00
Max Mayfield	1101fef096	Update test architectures for P3, P4, P5	2026-02-28 23:33:07 +00:00
Max Mayfield	5ee95d8b13	dd0c: full product research pipeline - 6 products, 8 phases each ... Products: route, drift, alert, portal, cost, run Phases: brainstorm, design-thinking, innovation-strategy, party-mode, product-brief, architecture, epics (incl. Epic 10 TF compliance), test-architecture (TDD strategy) Brand strategy and market research included.	2026-02-28 17:35:02 +00:00