basicstack/ProofedMesh
SHA256
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
36 commits 1 branch 0 tags 5.6 MiB
Commit graph

36 commits

This branch
This branch
All branches
Author SHA256 Message Date
CTO
2e44147a71 services: add attest-reconciler Go service (periodic worker re-signs per_diem_rates rows without rate_change_attestation_ref via Signer+TLog, 11/11 go tests pass, go vet clean)
All checks were successful
validate / JSON Schema (ajv) (push) Successful in 19s
Details
validate / Go (vet + test) (push) Successful in 19s
Details
validate / Rego (opa fmt + opa test) (push) Successful in 14s
Details 
- services/attest-reconciler/ as its own go.mod (admin-api internal/ is not importable; shared code gets extracted when a 3rd consumer appears).
- Scheduler accepts "@every <dur>" or a bare Go duration; context-cancellation stops the loop cleanly.
- Store client defines PendingRateStore + Postgres skeleton for SELECT ... WHERE rate_change_attestation_ref IS NULL.
- Orchestrator + HTTPSigner + tlog.HTTPSubmitter mirror admin-api byte-for-byte so the TLog idempotency key collides on resubmits (kein Doppelsignieren).
- Prometheus text-format /metrics endpoint, dependency-free: attest_reconciler_dirty_rows_total, _reconciliation_attempts_total, _reconciliation_failures_total, _idempotent_noop_total.
- Tests with fake store + fake signer + fake submitter cover: happy path, already-attested rows are NOT re-signed, TLog idempotency across ticks, TLog-down failure path, pre-cancelled ctx.
- Top-level README reflects the new service; CI auto-discovers services/*/go.mod so no workflow change needed.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-10-25 18:06:36 +00:00
CTO (Paperclip)
be3ac9cdb8 admin-api: Pocket-ID client_credentials TokenSource with OIDC discovery + cache (replaces StaticToken in prod)
All checks were successful
validate / JSON Schema (ajv) (push) Successful in 20s
Details
validate / Go (vet + test) (push) Successful in 19s
Details
validate / Rego (opa fmt + opa test) (push) Successful in 13s
Details 
* services/admin-api/internal/attest/pocket_id_token_source.go — attest.TokenSource impl: OIDC discovery via /.well-known/openid-configuration, HTTP Basic client_credentials grant, mutex-guarded in-memory token cache with configurable RefreshLeeway (default 30s = "verwirft bei exp-30s" from DEV-602).
* services/admin-api/internal/attest/pocket_id_token_source_test.go — 10 subtests against an httptest OIDC mock: happy path, cache hold, exp-30s refresh boundary, optional scope/audience, bad creds (401), missing config, discovery failures, non-positive expires_in, type-conformance.
* services/admin-api/cmd/admin-api/main.go — buildTokenSource(): -bearer flag wins (dev), else -oidc-issuer + POCKET_ID_CLIENT_ID + POCKET_ID_CLIENT_SECRET env → PocketIDTokenSource (prod); hard-fail at startup if issuer is set but credentials are missing. New flags -pocket-id-scope / -pocket-id-audience for the client_credentials request.
* services/admin-api/README.md — split inbound/outbound Pocket-ID auth, document the admin-api OIDC client registration (UI + API), new flags, env vars, prod bootstrap example.

36/36 go tests pass, go vet clean.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-10-25 18:04:00 +00:00
CTO Agent
d9fa1c55b9 services: add signing-service (real Ed25519 DSSE, in-memory keyring, AllowAll+Static validators as DEV; OpenBao/OPA/Pocket-ID as stubs). Interop with admin-api attest.HTTPSigner verified: 19 Go-Tests + end-to-end content_hash equality.
All checks were successful
validate / Rego (opa fmt + opa test) (push) Successful in 14s
Details
validate / JSON Schema (ajv) (push) Successful in 19s
Details
validate / Go (vet + test) (push) Successful in 18s
Details
2026-10-25 18:02:44 +00:00
CTO Agent
ca62108f70 admin-api: wire Signer+TLog into Create/Retire handlers; on tlog outage row stays attestation-pending (26/26 tests pass, go vet clean)
All checks were successful
validate / Rego (opa fmt + opa test) (push) Successful in 13s
Details
validate / JSON Schema (ajv) (push) Successful in 20s
Details
validate / Go (vet + test) (push) Successful in 19s
Details
2026-10-25 17:51:53 +00:00
CTO Agent
cacdf7e286 attest+tlog: ADR-0005 Signing/TLog API contract, HTTP clients + orchestrator in admin-api (go vet clean, 11 new tests pass)
Some checks failed
validate / Rego (opa fmt + opa test) (push) Successful in 13s
Details
validate / JSON Schema (ajv) (push) Has been cancelled
Details
validate / Go (vet + test) (push) Has been cancelled
Details
2026-10-25 17:51:33 +00:00
CTO Agent
e3698de492 ci: fix Go job — golang:1.23-trixie does not exist on Docker Hub, use golang:1.23-alpine3.21 (git 2.47+, sha256-capable)
All checks were successful
validate / Rego (opa fmt + opa test) (push) Successful in 13s
Details
validate / JSON Schema (ajv) (push) Successful in 20s
Details
validate / Go (vet + test) (push) Successful in 21s
Details
2026-10-25 17:30:18 +00:00
CTO Agent
eeaceb07ed ci+readme: add Go CI job (golang:1.23-trixie, vet + test for every services/**/go.mod); README reflects db/, admin-api, go-test commands
Some checks failed
validate / Rego (opa fmt + opa test) (push) Successful in 13s
Details
validate / Go (vet + test) (push) Failing after 1s
Details
validate / JSON Schema (ajv) (push) Successful in 20s
Details
2026-10-25 17:28:32 +00:00
CTO Agent
65514559dc services: add admin-api Go service (per-diem rates CRUD, in-memory + Postgres stub store, HTML templates, 13/13 go tests pass, go vet clean)
Some checks failed
validate / Rego (opa fmt + opa test) (push) Successful in 12s
Details
validate / JSON Schema (ajv) (push) Has been cancelled
Details
2026-10-25 17:28:14 +00:00
CTO Agent
d56f918c69 db: add ADR-0004 (golang-migrate), db/ layout, 0001_per_diem_rates migration (up+down) with EXCLUDE constraint and immutability trigger
Some checks failed
validate / Rego (opa fmt + opa test) (push) Has been cancelled
Details
validate / JSON Schema (ajv) (push) Has been cancelled
Details
2026-10-25 17:28:00 +00:00
CTO Agent
3f466dfae8 services: add per-diem-calculator Go skeleton (deterministic compute core + 5 unit tests, HTTP wire stubbed); README reflects new layout
All checks were successful
validate / Rego (opa fmt + opa test) (push) Successful in 11s
Details
validate / JSON Schema (ajv) (push) Successful in 18s
Details
2026-10-25 17:07:55 +00:00
CTO Agent
c0472691c8 policies: add receipts + per_diem_rates data-source policies, per_diem transformation policy, extend expense.rego for v1.2.0 (54/54 tests pass)
Some checks failed
validate / Rego (opa fmt + opa test) (push) Successful in 12s
Details
validate / JSON Schema (ajv) (push) Has been cancelled
Details
2026-10-25 17:07:38 +00:00
CTO Agent
27c45b356a schemas: add ds/receipts v1.0.0, ds/per_diem v1.0.0, expense.canonical v1.2.0, sink.db.expense v1.2.0 (+ examples)
Some checks failed
validate / Rego (opa fmt + opa test) (push) Successful in 12s
Details
validate / JSON Schema (ajv) (push) Has been cancelled
Details
2026-10-25 17:07:20 +00:00
CTO Agent
95e50aff7d docs(architecture): add 4.7 receipts flow (ds:receipts, PII-store, hash binding) and 6.2 deterministic rules example (ds:per-diem-rates, compute-agent, no LLM on numeric path)
All checks were successful
validate / Rego (opa fmt + opa test) (push) Successful in 12s
Details
validate / JSON Schema (ajv) (push) Successful in 17s
Details
2026-10-25 16:50:34 +00:00
CTO Agent
2181225022 docs(architecture): add section 7.2a for per-line project allocations (expense.canonical v1.1.0)
All checks were successful
validate / Rego (opa fmt + opa test) (push) Successful in 13s
Details
validate / JSON Schema (ajv) (push) Successful in 16s
Details
2026-10-25 16:20:38 +00:00
CTO Agent
5d309e16c1 policies+ci: v1.1.0 allocation support — expense.rego enforces per-item sum invariant, 5 new tests (25/25 pass), CI validates examples per schema version
All checks were successful
validate / Rego (opa fmt + opa test) (push) Successful in 12s
Details
validate / JSON Schema (ajv) (push) Successful in 16s
Details
2026-10-25 16:19:37 +00:00
CTO Agent
81e5f334b5 schemas: add expense.canonical v1.1.0 and sink.db.expense v1.1.0 — per-line project allocations (percentage or absolute)
Some checks failed
validate / Rego (opa fmt + opa test) (push) Successful in 12s
Details
validate / JSON Schema (ajv) (push) Has been cancelled
Details
2026-10-25 16:19:21 +00:00
CTO Agent
36aa391e59 ci: POSIX-safe example-validation loop (trixie-slim sh is dash, no shopt)
All checks were successful
validate / Rego (opa fmt + opa test) (push) Successful in 13s
Details
validate / JSON Schema (ajv) (push) Successful in 17s
Details
2026-10-25 15:41:18 +00:00
CTO Agent
23594e1f9b ci: skip actions/checkout — do manual git clone (checkout does git init without --object-format=sha256)
Some checks failed
validate / Rego (opa fmt + opa test) (push) Successful in 12s
Details
validate / JSON Schema (ajv) (push) Failing after 15s
Details
2026-10-25 15:40:01 +00:00
CTO Agent
0a3ae36bf1 ci: run jobs in Debian trixie (git 2.47+) — sha256 git object format needs git >= 2.42
Some checks failed
validate / Rego (opa fmt + opa test) (push) Failing after 13s
Details
validate / JSON Schema (ajv) (push) Failing after 46s
Details
2026-10-25 15:36:59 +00:00
CTO Agent
1d4eccb6d3 ci: use fetch-depth 0 — Forgejo repo has sha256 object format, checkout cannot fetch by raw SHA
Some checks failed
validate / Rego (opa fmt + opa test) (push) Failing after 30s
Details
validate / JSON Schema (ajv) (push) Failing after 35s
Details
2026-10-25 15:33:02 +00:00
CTO Agent
81bc32e9c3 ci: make workflow robust — apt-get curl pre-step, local ajv install, OPA to user HOME, no setup-node reliance
Some checks failed
validate / Rego (opa fmt + opa test) (push) Failing after 24s
Details
validate / JSON Schema (ajv) (push) Failing after 28s
Details
2026-10-25 15:30:57 +00:00
CTO Agent
baa8b61021 docs(README): link policies/ and CI workflow; add local validation snippets
Some checks failed
validate / JSON Schema (ajv) (push) Failing after 29s
Details
validate / Rego (opa fmt + opa test) (push) Failing after 26s
Details
2026-10-25 15:28:50 +00:00
CTO Agent
961102ca6f ci: add Forgejo Actions workflow — JSON Schema (ajv) + Rego (opa fmt + opa test)
Some checks failed
validate / JSON Schema (ajv) (push) Has been cancelled
Details
validate / Rego (opa fmt + opa test) (push) Has been cancelled
Details
2026-10-25 15:28:19 +00:00
CTO Agent
e721073767 policies: add Rego skeletons for transformations, sink expense_db_app, and ds expense_db_app (20/20 opa test pass, rego.v1) 2026-10-25 15:28:12 +00:00
CTO Agent
71259de4c8 docs(README): link schemas/ and docs/adr/ in repo layout and entry points 2026-10-25 15:11:47 +00:00
CTO Agent
a9c853f881 docs(adr): add ADR template and ADR-0001..0003 (DB-App scope, session scope tokens, PII retention) 2026-10-25 15:11:23 +00:00
CTO Agent
30939b777a schemas: add expense.canonical, ds.expense.project_assignment, sink.db.expense (all v1.0.0) with README 2026-10-25 15:11:10 +00:00
CTO Agent
989140ee88 docs(architecture): clarify PII-Store is a role, not a product; add dedicated section 8.4 with technology choice 2026-10-25 14:57:00 +00:00
CTO Agent
fddce4d0fb docs(architecture): add parallel read path (Data Sources, Query Attestations, Session Scope Tokens); make own DB-App the first rollout 2026-10-25 14:41:18 +00:00
CTO Agent
7205fa2e98 docs(README): reflect sink generalization — ERP is one of many possible sinks 2026-10-25 14:12:11 +00:00
CTO Agent
9f89f9fb6b docs(architecture): generalize sink concept — SAP is one of many sinks, add sink adapter contract 2026-10-25 14:11:34 +00:00
CTO Agent
7de9cbc6ec docs: README points to V1.1 as active architecture, V1.0 archived 2026-10-25 11:02:33 +00:00
CTO Agent
1d5950d32c docs(architecture): add V1.1 — Pocket-ID only, PII separation, Trillian, Content Binding, Replay 2026-10-25 11:02:04 +00:00
CTO Agent
6400f28bf0 docs(architecture): add trusted agent/SAP messaging architecture V1.0 2026-10-25 10:15:41 +00:00
CTO Agent
872d75b5ec docs: initial README for ProofedMesh architecture base 2026-10-25 10:15:34 +00:00
forgejoadmin
a99e57718a Initial commit 2026-10-25 10:13:26 +00:00