3 Commits

Include renames

Author	SHA1	Message	Date
cayce	6ddf76983b	regla permanente de secretos: test anti-patrones + hook de journald ... Nueva regla del operador (2026-10-31): los ficheros de secretos solo se inspeccionan con herramientas que no muestran valores (jq keys, grep -c, stat). Prohibido cat/grep -r sobre .env y volcar errores con DSN. - tests/test_no_credential_patterns.py: 3 tests — DSN con credencial literal fuera de placeholders, nsec bech32 versionado, tokens hex de 64 chars fuera de tests/. - scripts/check-credential-leaks.sh: hook que falla si journald reciente contiene DSN con contraseña o nsec (redactando el valor en la salida). Sin timer propio (no autorizado); ejecutar manual o desde cron del operador. Contexto: la rotación del rol hardcap y el DSN filtrado a journald por el test del gate (corregido; la credencial filtrada ya está rotada).	2026-10-31 18:00:26 +00:00
cayce	90e6cfcc19	fix: address external audit — criticals 1-5 + mediums ... Critical 1 (approval forgery): audit_log is now hash-chained (prev_hash/entry_hash, verify_audit_chain); executor approve REQUIRES a BIP-340 signature over sha256(cayce-ops:approve:<id>) when CAYCE_OPS_OPERATOR_PUBKEY is set; deploy/roles.sql ships least-privilege per-daemon DB roles. Critical 2 (threading dead): sends create real OUTBOUND rows (own Message-ID, In-Reply-To -> inbound); inbound message_id never overwritten; maild compose adds the first-contact path; _match_proposal falls back to inbound chains. Critical 3 (duplicate sends): per-message transactions in send path — SMTP failure on message N no longer resurrects 1..N-1; failures audited (send_failed) and the row stays queued. Critical 4 (classifier): negated approvals (cannot accept / not approved / not accepting) classify REJECTION at 0.95 before the bare-keyword rule; LLM prompt braces escaped (.format no longer KeyError into silent fallback). Critical 5 (systemd): every daemon has a run subcommand (maild run = poll+send, publisher run = publish-due, monitor run = build); deploy README documents the separate daily publisher plan timer. Mediums: approved_hash binds drafts/captions to the approved text (edited text refuses to send/publish until re-approved); risk_score renamed match_score (migration 0002) and auto-approve orders HIGHEST relevance first; compose binds postgres to 127.0.0.1; IMAP marks \\Seen only after commit (fetch returns (num, raw), mark post-commit); disabled channels are terminal (ContentStatus.SKIPPED) and publish failures burn a bounded attempt budget before abandonment; make hooks installs the pre-push gate. tests: 12 new — 56 total, all green; ruff 0 findings; gitleaks clean.	2026-10-19 23:06:29 +00:00
cayce	34a5f331ac	skeleton: package, schema, config, CLI, alembic, CI, deploy, docs ... - cayceops core: env-only config (CAYCE_OPS_*), engine/session, ORM models with state machines (proposal/mail/content) and audited writes - provider-agnostic LLM interface (null provider default, stdlib openai-compat) - Typer CLI with lazy component loading (scanner/executor/maild/publisher/monitor) - alembic 0001 initial schema; sqlite-portable JSON columns - tests: 7 passing on throwaway sqlite; fixtures invented, never real data - ci: ruff + alembic smoke + pytest + gitleaks(full history) in .gitea/workflows + .github/workflows; local gate = make check - deploy: docker-compose (postgres 16) + hardened systemd units/timers - docs: DECISIONS D1-D9; README project (grant text retired)	2026-10-19 21:35:50 +00:00