Initial import — snapshot from admin host /srv/gosec/gsc-ops-api

This repo had no version control prior to this commit. The import is a
straight snapshot of the working tree at 2026-05-03; the deployed
binary on fihelvop01 was being rebuilt from this source via `make
build` + scp into place, with no upstream review path.

The snapshot already includes one in-flight fix made on 2026-05-03 to
internal/service/persona.go:GetSelfModel — the handler queried
`source` and `strength` columns plus an `is_active = true` filter on
persona.persona_commitments, none of which exist on that table (its
shape is session-bound commitments with `status`, `commitment_meta`,
etc.). The query returned a 500 every time SynapseHub bootstrapped a
persona's self-model, dropping the IdentityConstraints / Commitments /
ConscienceStandards layer from the assembled prompt. The patched
query reads existing columns only (commitment_text, commitment_type),
filters on `status='active'`, and synthesises Source="learned" /
Strength=1.0 to keep the SelfModel response shape stable for callers.

Verified live: `GET /api/v1/personas/70f7cfd9-.../self-model` now
returns 200 with `{identityConstraints:[],commitments:[],
conscienceStandards:[]}` instead of 500.

Future changes go through PRs against this repo — no more bin-only
deploys.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/client/kamailio.go

@@ -0,0 +1,125 @@
+package client
+
+import (
+	"fmt"
+	"sync"
+
+	"github.com/rs/zerolog"
+	"golang.org/x/crypto/ssh"
+)
+
+// KamailioClient manages SSH connections to Kamailio servers for kamcmd
+type KamailioClient struct {
+	servers []string
+	sshUser string
+	sshKey  []byte
+	logger  zerolog.Logger
+}
+
+// NewKamailioClient creates a new Kamailio management client
+func NewKamailioClient(servers []string, sshUser string, sshKey []byte, logger zerolog.Logger) *KamailioClient {
+	return &KamailioClient{
+		servers: servers,
+		sshUser: sshUser,
+		sshKey:  sshKey,
+		logger:  logger.With().Str("client", "kamailio").Logger(),
+	}
+}
+
+// ReloadDispatcher reloads the dispatcher module on all Kamailio servers
+func (c *KamailioClient) ReloadDispatcher() []ServerResult {
+	return c.runOnAll("kamcmd dispatcher.reload")
+}
+
+// ReloadPermissions reloads address permissions on all Kamailio servers
+func (c *KamailioClient) ReloadPermissions() []ServerResult {
+	return c.runOnAll("kamcmd permissions.addressReload")
+}
+
+// ReloadAll reloads dispatcher and permissions on all servers
+func (c *KamailioClient) ReloadAll() []ServerResult {
+	results := make([]ServerResult, 0, len(c.servers)*2)
+	r1 := c.ReloadDispatcher()
+	r2 := c.ReloadPermissions()
+	results = append(results, r1...)
+	results = append(results, r2...)
+	return results
+}
+
+// runOnAll executes a command on all Kamailio servers in parallel
+func (c *KamailioClient) runOnAll(command string) []ServerResult {
+	var wg sync.WaitGroup
+	results := make([]ServerResult, len(c.servers))
+
+	for i, srv := range c.servers {
+		wg.Add(1)
+		go func(idx int, host string) {
+			defer wg.Done()
+			results[idx] = c.execSSH(host, command)
+		}(i, srv)
+	}
+
+	wg.Wait()
+	return results
+}
+
+// execSSH connects via SSH and executes a command
+func (c *KamailioClient) execSSH(host, command string) ServerResult {
+	result := ServerResult{Host: host}
+
+	signer, err := ssh.ParsePrivateKey(c.sshKey)
+	if err != nil {
+		result.Error = fmt.Sprintf("failed to parse SSH key: %v", err)
+		return result
+	}
+
+	config := &ssh.ClientConfig{
+		User: c.sshUser,
+		Auth: []ssh.AuthMethod{
+			ssh.PublicKeys(signer),
+		},
+		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
+	}
+
+	client, err := ssh.Dial("tcp", host+":22", config)
+	if err != nil {
+		result.Error = fmt.Sprintf("SSH connection failed: %v", err)
+		c.logger.Warn().Str("host", host).Err(err).Msg("Kamailio SSH connection failed")
+		return result
+	}
+	defer client.Close()
+
+	session, err := client.NewSession()
+	if err != nil {
+		result.Error = fmt.Sprintf("SSH session failed: %v", err)
+		return result
+	}
+	defer session.Close()
+
+	output, err := session.CombinedOutput(command)
+	if err != nil {
+		result.Error = fmt.Sprintf("command failed: %v, output: %s", err, string(output))
+		return result
+	}
+
+	result.Success = true
+	result.Output = string(output)
+	c.logger.Debug().Str("host", host).Str("command", command).Msg("Kamailio command executed")
+	return result
+}
+
+// Health checks SSH connectivity to all Kamailio servers
+func (c *KamailioClient) Health() error {
+	for _, srv := range c.servers {
+		r := c.execSSH(srv, "kamcmd core.uptime")
+		if !r.Success {
+			return fmt.Errorf("kamailio %s: %s", srv, r.Error)
+		}
+	}
+	return nil
+}
+
+// Servers returns the configured server list
+func (c *KamailioClient) Servers() []string {
+	return c.servers
+}