Initial import — snapshot from admin host /srv/gosec/gsc-ops-api

This repo had no version control prior to this commit. The import is a
straight snapshot of the working tree at 2026-05-03; the deployed
binary on fihelvop01 was being rebuilt from this source via `make
build` + scp into place, with no upstream review path.

The snapshot already includes one in-flight fix made on 2026-05-03 to
internal/service/persona.go:GetSelfModel — the handler queried
`source` and `strength` columns plus an `is_active = true` filter on
persona.persona_commitments, none of which exist on that table (its
shape is session-bound commitments with `status`, `commitment_meta`,
etc.). The query returned a 500 every time SynapseHub bootstrapped a
persona's self-model, dropping the IdentityConstraints / Commitments /
ConscienceStandards layer from the assembled prompt. The patched
query reads existing columns only (commitment_text, commitment_type),
filters on `status='active'`, and synthesises Source="learned" /
Strength=1.0 to keep the SelfModel response shape stable for callers.

Verified live: `GET /api/v1/personas/70f7cfd9-.../self-model` now
returns 200 with `{identityConstraints:[],commitments:[],
conscienceStandards:[]}` instead of 500.

Future changes go through PRs against this repo — no more bin-only
deploys.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/handler/health.go

@@ -0,0 +1,94 @@
+package handler
+
+import (
+	"context"
+	"time"
+
+	"github.com/gofiber/fiber/v2"
+
+	"github.com/gosec/gsc-ops-api/internal/client"
+	"github.com/gosec/gsc-ops-api/internal/database"
+	"github.com/gosec/gsc-ops-api/internal/middleware"
+	"github.com/gosec/gsc-ops-api/pkg/types"
+)
+
+// HealthHandler handles health check endpoints
+type HealthHandler struct {
+	db      *database.DB
+	ldap    *client.LDAPClient
+	pdns    *client.PowerDNSClient
+	carddav *client.CardDAVClient
+}
+
+// NewHealthHandler creates a new health handler
+func NewHealthHandler(db *database.DB, ldap *client.LDAPClient, pdns *client.PowerDNSClient, carddav *client.CardDAVClient) *HealthHandler {
+	return &HealthHandler{db: db, ldap: ldap, pdns: pdns, carddav: carddav}
+}
+
+// Liveness returns 200 if the server is running
+func (h *HealthHandler) Liveness(c *fiber.Ctx) error {
+	return c.JSON(types.NewDataResponse(fiber.Map{
+		"status": "ok",
+		"time":   time.Now().UTC(),
+	}, middleware.GetRequestID(c)))
+}
+
+// Readiness checks all backend dependencies
+func (h *HealthHandler) Readiness(c *fiber.Ctx) error {
+	ctx, cancel := context.WithTimeout(c.Context(), 5*time.Second)
+	defer cancel()
+
+	checks := make(map[string]string)
+	allOK := true
+
+	// Database
+	if err := h.db.Health(ctx); err != nil {
+		checks["database"] = "error: " + err.Error()
+		allOK = false
+	} else {
+		checks["database"] = "ok"
+	}
+
+	// LDAP
+	if h.ldap != nil {
+		if err := h.ldap.Health(); err != nil {
+			checks["ldap"] = "error: " + err.Error()
+			allOK = false
+		} else {
+			checks["ldap"] = "ok"
+		}
+	}
+
+	// PowerDNS
+	if h.pdns != nil {
+		if err := h.pdns.Health(); err != nil {
+			checks["powerdns"] = "error: " + err.Error()
+			allOK = false
+		} else {
+			checks["powerdns"] = "ok"
+		}
+	}
+
+	// CardDAV
+	if h.carddav != nil {
+		if err := h.carddav.Health(ctx); err != nil {
+			checks["carddav"] = "error: " + err.Error()
+			allOK = false
+		} else {
+			checks["carddav"] = "ok"
+		}
+	}
+
+	status := "ok"
+	httpStatus := fiber.StatusOK
+	if !allOK {
+		status = "degraded"
+		httpStatus = fiber.StatusServiceUnavailable
+	}
+
+	return c.Status(httpStatus).JSON(types.NewDataResponse(fiber.Map{
+		"status": status,
+		"checks": checks,
+		"time":   time.Now().UTC(),
+	}, middleware.GetRequestID(c)))
+}