Initial import — snapshot from admin host /srv/gosec/gsc-ops-api

This repo had no version control prior to this commit. The import is a
straight snapshot of the working tree at 2026-05-03; the deployed
binary on fihelvop01 was being rebuilt from this source via `make
build` + scp into place, with no upstream review path.

The snapshot already includes one in-flight fix made on 2026-05-03 to
internal/service/persona.go:GetSelfModel — the handler queried
`source` and `strength` columns plus an `is_active = true` filter on
persona.persona_commitments, none of which exist on that table (its
shape is session-bound commitments with `status`, `commitment_meta`,
etc.). The query returned a 500 every time SynapseHub bootstrapped a
persona's self-model, dropping the IdentityConstraints / Commitments /
ConscienceStandards layer from the assembled prompt. The patched
query reads existing columns only (commitment_text, commitment_type),
filters on `status='active'`, and synthesises Source="learned" /
Strength=1.0 to keep the SelfModel response shape stable for callers.

Verified live: `GET /api/v1/personas/70f7cfd9-.../self-model` now
returns 200 with `{identityConstraints:[],commitments:[],
conscienceStandards:[]}` instead of 500.

Future changes go through PRs against this repo — no more bin-only
deploys.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/handler/dns_records.go

@@ -0,0 +1,167 @@
+package handler
+
+import (
+	"github.com/gofiber/fiber/v2"
+
+	"github.com/gosec/gsc-ops-api/internal/middleware"
+	"github.com/gosec/gsc-ops-api/internal/service"
+	"github.com/gosec/gsc-ops-api/pkg/types"
+)
+
+// DNSRecordHandler handles DNS record endpoints
+type DNSRecordHandler struct {
+	svc *service.DNSService
+}
+
+// NewDNSRecordHandler creates a new DNS record handler
+func NewDNSRecordHandler(svc *service.DNSService) *DNSRecordHandler {
+	return &DNSRecordHandler{svc: svc}
+}
+
+// List handles GET /api/v1/dns/zones/:zoneId/records
+func (h *DNSRecordHandler) List(c *fiber.Ctx) error {
+	reqID := middleware.GetRequestID(c)
+	zoneID := c.Params("zoneId")
+
+	records, err := h.svc.ListRecords(zoneID)
+	if err != nil {
+		apiErr := types.NewInternal(err.Error())
+		return c.Status(apiErr.Status).JSON(types.NewErrorResponse(apiErr, reqID))
+	}
+
+	return c.JSON(types.NewDataResponse(records, reqID))
+}
+
+// Create handles POST /api/v1/dns/zones/:zoneId/records
+func (h *DNSRecordHandler) Create(c *fiber.Ctx) error {
+	reqID := middleware.GetRequestID(c)
+	zoneID := c.Params("zoneId")
+
+	var changes []types.DNSRecordChange
+	if err := c.BodyParser(&changes); err != nil {
+		// Try single change
+		var single types.DNSRecordChange
+		if err2 := c.BodyParser(&single); err2 != nil {
+			apiErr := types.NewBadRequest("Invalid request body: " + err.Error())
+			return c.Status(apiErr.Status).JSON(types.NewErrorResponse(apiErr, reqID))
+		}
+		changes = []types.DNSRecordChange{single}
+	}
+
+	// Set changetype to REPLACE for creates
+	for i := range changes {
+		if changes[i].ChangeType == "" {
+			changes[i].ChangeType = "REPLACE"
+		}
+	}
+
+	if err := h.svc.ChangeRecords(zoneID, changes); err != nil {
+		apiErr := types.NewInternal(err.Error())
+		return c.Status(apiErr.Status).JSON(types.NewErrorResponse(apiErr, reqID))
+	}
+
+	return c.Status(fiber.StatusCreated).JSON(types.NewDataResponse(fiber.Map{
+		"zoneId":  zoneID,
+		"changes": len(changes),
+	}, reqID))
+}
+
+// Replace handles PUT /api/v1/dns/zones/:zoneId/records
+func (h *DNSRecordHandler) Replace(c *fiber.Ctx) error {
+	reqID := middleware.GetRequestID(c)
+	zoneID := c.Params("zoneId")
+
+	var changes []types.DNSRecordChange
+	if err := c.BodyParser(&changes); err != nil {
+		apiErr := types.NewBadRequest("Invalid request body: " + err.Error())
+		return c.Status(apiErr.Status).JSON(types.NewErrorResponse(apiErr, reqID))
+	}
+
+	for i := range changes {
+		changes[i].ChangeType = "REPLACE"
+	}
+
+	if err := h.svc.ChangeRecords(zoneID, changes); err != nil {
+		apiErr := types.NewInternal(err.Error())
+		return c.Status(apiErr.Status).JSON(types.NewErrorResponse(apiErr, reqID))
+	}
+
+	return c.JSON(types.NewDataResponse(fiber.Map{
+		"zoneId":   zoneID,
+		"replaced": len(changes),
+	}, reqID))
+}
+
+// Delete handles DELETE /api/v1/dns/zones/:zoneId/records
+func (h *DNSRecordHandler) Delete(c *fiber.Ctx) error {
+	reqID := middleware.GetRequestID(c)
+	zoneID := c.Params("zoneId")
+
+	var changes []types.DNSRecordChange
+	if err := c.BodyParser(&changes); err != nil {
+		apiErr := types.NewBadRequest("Invalid request body: " + err.Error())
+		return c.Status(apiErr.Status).JSON(types.NewErrorResponse(apiErr, reqID))
+	}
+
+	for i := range changes {
+		changes[i].ChangeType = "DELETE"
+	}
+
+	if err := h.svc.ChangeRecords(zoneID, changes); err != nil {
+		apiErr := types.NewInternal(err.Error())
+		return c.Status(apiErr.Status).JSON(types.NewErrorResponse(apiErr, reqID))
+	}
+
+	return c.JSON(types.NewDataResponse(fiber.Map{
+		"zoneId":  zoneID,
+		"deleted": len(changes),
+	}, reqID))
+}
+
+// DomainSetup handles POST /api/v1/dns/domains/setup
+func (h *DNSRecordHandler) DomainSetup(c *fiber.Ctx) error {
+	reqID := middleware.GetRequestID(c)
+
+	var req types.DomainSetup
+	if err := c.BodyParser(&req); err != nil {
+		apiErr := types.NewBadRequest("Invalid request body: " + err.Error())
+		return c.Status(apiErr.Status).JSON(types.NewErrorResponse(apiErr, reqID))
+	}
+
+	if req.Domain == "" {
+		apiErr := types.NewValidation("domain is required")
+		return c.Status(apiErr.Status).JSON(types.NewErrorResponse(apiErr, reqID))
+	}
+
+	zone, err := h.svc.SetupDomain(&req)
+	if err != nil {
+		apiErr := types.NewInternal(err.Error())
+		return c.Status(apiErr.Status).JSON(types.NewErrorResponse(apiErr, reqID))
+	}
+
+	return c.Status(fiber.StatusCreated).JSON(types.NewDataResponse(zone, reqID))
+}
+
+// DomainVerify handles POST /api/v1/dns/domains/verify
+func (h *DNSRecordHandler) DomainVerify(c *fiber.Ctx) error {
+	reqID := middleware.GetRequestID(c)
+
+	var req types.DomainVerify
+	if err := c.BodyParser(&req); err != nil {
+		apiErr := types.NewBadRequest("Invalid request body: " + err.Error())
+		return c.Status(apiErr.Status).JSON(types.NewErrorResponse(apiErr, reqID))
+	}
+
+	if req.Domain == "" {
+		apiErr := types.NewValidation("domain is required")
+		return c.Status(apiErr.Status).JSON(types.NewErrorResponse(apiErr, reqID))
+	}
+
+	result, err := h.svc.VerifyDomain(req.Domain)
+	if err != nil {
+		apiErr := types.NewInternal(err.Error())
+		return c.Status(apiErr.Status).JSON(types.NewErrorResponse(apiErr, reqID))
+	}
+
+	return c.JSON(types.NewDataResponse(result, reqID))
+}