2 Commits

Author	SHA1	Message	Date
dtoro	ec119566fd	scratch matrix approval notifier, add chat-native MCP approval tools ... Removes the entire Matrix-based notifier (internal/notifier/) that polled for pending approvals, sent Matrix alerts, and checked for reaction-based approve/deny. Approval decisions now work on any chat platform (Hermes desktop, Telegram, Discord, WhatsApp, CLI) via two new MCP tools: - list_approvals — query pending/recent approvals by status or entity - decide_approval — approve/deny via same API endpoint as UI + nomos Config fields removed: MatrixHomeserver, MatrixUserID, MatrixToken, MatrixRoomID, ApprovalHMACSecret. Docker notifier: service removed. Approval HMAC token generation removed (unused by code). The existing chat-assent path in nomos (cmd/nomos/assent.go) and the control-room Approve button keep working unchanged — both call the shared POST /api/v1/approvals/{id}/decision endpoint.	2026-08-15 20:56:28 +02:00
dtoro	fa79c1ea25	0.28.0 — operational hardening (plan D1–D5): CI deploy gate, versioned images, rate limiting, resource limits, health probes ... D1: deploy.sh CI gate — read-only SHA via git ls-remote, Gitea commit-status poll, portable mkdir deploy lock (macOS, no flock), TOCTOU guard, token passed via curl --config - (not argv), graceful misconfig tolerance. D2: version-tagged images — OIKOS_VERSION=v$VERSION, keep-last-3 prune derived from 'docker compose config --images'; VERSION read after pull. D3: per-IP rate limiting — new internal/httpapi/ratelimit.go (x/time/rate), rightmost-XFF, /healthz exempt, ctx-driven sweep; disabled by default. D4: mem_limit/cpus on all 10 compose services. D5: staleness-aware health probes — new internal/health package wired into scheduler (:8093) and notifier (:8094); nomos already had :8092. Two /review passes hardened the deploy lock, TOCTOU guard, token hygiene, and XFF handling.	2026-08-08 21:31:16 +02:00