Initial import — snapshot from admin host /srv/gosec/gsc-ops-api

This repo had no version control prior to this commit. The import is a
straight snapshot of the working tree at 2026-05-03; the deployed
binary on fihelvop01 was being rebuilt from this source via `make
build` + scp into place, with no upstream review path.

The snapshot already includes one in-flight fix made on 2026-05-03 to
internal/service/persona.go:GetSelfModel — the handler queried
`source` and `strength` columns plus an `is_active = true` filter on
persona.persona_commitments, none of which exist on that table (its
shape is session-bound commitments with `status`, `commitment_meta`,
etc.). The query returned a 500 every time SynapseHub bootstrapped a
persona's self-model, dropping the IdentityConstraints / Commitments /
ConscienceStandards layer from the assembled prompt. The patched
query reads existing columns only (commitment_text, commitment_type),
filters on `status='active'`, and synthesises Source="learned" /
Strength=1.0 to keep the SelfModel response shape stable for callers.

Verified live: `GET /api/v1/personas/70f7cfd9-.../self-model` now
returns 200 with `{identityConstraints:[],commitments:[],
conscienceStandards:[]}` instead of 500.

Future changes go through PRs against this repo — no more bin-only
deploys.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

configs/config.yaml

@@ -0,0 +1,89 @@
+server:
+  host: "0.0.0.0"
+  port: 8443
+  readTimeout: 30s
+  writeTimeout: 30s
+
+database:
+  host: "172.17.3.14"
+  port: 5432
+  database: "gsc_core"
+  sslMode: "disable"
+  maxConns: 10
+  minConns: 2
+
+databases:
+  core:
+    host: "172.17.3.14"
+    port: 5432
+    database: "gsc_core"
+    sslMode: "disable"
+    maxConns: 10
+    minConns: 2
+  pbx:
+    host: "172.17.3.14"
+    port: 5432
+    database: "gsc_pbx"
+    sslMode: "disable"
+    maxConns: 10
+    minConns: 2
+  voice_agent:
+    host: "172.17.3.14"
+    port: 5432
+    database: "gsc_ai_core"
+    schema: "voice_agent"
+    sslMode: "disable"
+    maxConns: 5
+    minConns: 1
+  persona:
+    host: "172.17.3.14"
+    port: 5432
+    database: "gsc_ai_core"
+    schema: "persona"
+    sslMode: "disable"
+    maxConns: 5
+    minConns: 1
+
+tls:
+  certFile: "/etc/gsc-ops-api/tls/server.crt"
+  keyFile: "/etc/gsc-ops-api/tls/server.key"
+  caFile: "/etc/gsc-ops-api/tls/ca.crt"
+
+ldap:
+  servers:
+    - "ldaps://fihelvid01.gosec.auth:636"
+    - "ldaps://fihelvid02.gosec.auth:636"
+  baseDn: "dc=gosec,dc=auth"
+  poolSize: 10
+  useTls: true
+  caFile: "/etc/pki/tls/certs/ca-bundle.crt"
+
+powerdns:
+  baseUrl: "http://172.17.3.16:8081"
+  serverId: "localhost"
+
+ejbca:
+  baseUrl: "https://172.17.3.41:8443"
+  certFile: "/etc/gsc-ops-api/tls/ejbca-client.crt"
+  keyFile: "/etc/gsc-ops-api/tls/ejbca-client.key"
+  caFile: "/etc/gsc-ops-api/tls/ca.crt"
+
+hockeypuck:
+  servers:
+    - "http://172.16.1.21:11371"
+    - "http://172.16.1.22:11371"
+    - "http://172.16.1.23:11371"
+
+infisical:
+  host: "https://denbgvsc01.gosec.internal"
+  projectId: "c150d657-2efc-4649-b51c-29cc71e72dee"
+  environment: "prod"
+  tokenFile: "/etc/gsc-ops-api/.infisical"
+  secretPath: "/"
+
+auth:
+  apiKeys: []
+
+logging:
+  level: "info"
+  format: "json"