dtoro/oikos
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

feat: Phase 4 governance/execution slice — PolicyService + ExecutionService

Browse Source 
classifyAndGate's decision pipeline moves to core: PolicyService runs the
full gate order (classify + transport escalation, plan-first, syntax,
host-only/host-lxc, VM QGA preflight, dedup, approval-flood, window
routing) over ports.GovernanceStore; ExecutionService records and
dispatches (auto-run via ssh.CommandExecutor + TargetResolver, queue via
ExecutionRecorder) with one converged path for run/docker_exec. Gating
matrix test added (risk x window x declared risk -> outcome); pair
coverage 95.6%.

Bug fix surfaced by the matrix: the flag-space syntax regex was inverted
— it refused valid 'tail -n 3' and missed the actual 'head - n' typo.
Fixed to match dash-space-value only.

Remaining Phase 4 items tracked in the plan: ApprovalService.Decide
convergence, execlog fold, execworker poller. VERSION 0.35.0.
This commit is contained in:
David Toro
2026-08-16 09:48:26 +02:00
parent 60c0432d8b
commit 7c9f4ec79f
19 changed files with 1748 additions and 725 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
plans/2026-08-15-hexagonal-architecture.md
View File

@@ -1,7 +1,7 @@
# Hexagonal architecture for Oikos — design and phased refactor plan
**Date:** 2026-08-15
**Status:** In Progress — Phases 0–7 shipped (Phase 7 landed 2026-08-16: SeedService/SecretsService + ProvisioningService/Provisioner, CLI rewired). Phase 8 (nomos internal cleanup) not started. Phase 9 partially done (docs + version bump landed with the earlier commits; the ExecutionService/PolicyService ≥90% coverage gates and gating-matrix test, and the governance/execution slice they depend on, are still open — the shipped "Phase 4/5/6" commits converged entities, relationships, observation, signals, knowledge, and learning, not the §5 Phase-4 governance slice).
**Status:** In Progress — Phases 0–7 shipped plus the Phase 4 governance/execution slice (2026-08-16: PolicyService + ExecutionService extracted from classifyAndGate with the gating-matrix test, ≥90% coverage gate met at 95.6%; also fixed the inverted flag-space regex that refused valid `tail -n` commands). Phase 8 (nomos internal cleanup) not started. Phase 9 remainder: ApprovalService.Decide convergence (httpapi approvals handler still holds the HMAC/window logic), execlog fold into the events adapter, execworker poller over ExecutionService, final depguard audit, archive.
**Scope:** All Go code (`cmd/oikos`, `cmd/nomos`, `cmd/webhook`) and the UI
split. One hexagon covers the oikos backend; nomos is an external agent
client that gets an internal cleanup (Phase 8) but stays outside the core.