Initial import — snapshot from admin host /srv/gosec/gsc-ops-api

This repo had no version control prior to this commit. The import is a
straight snapshot of the working tree at 2026-05-03; the deployed
binary on fihelvop01 was being rebuilt from this source via `make
build` + scp into place, with no upstream review path.

The snapshot already includes one in-flight fix made on 2026-05-03 to
internal/service/persona.go:GetSelfModel — the handler queried
`source` and `strength` columns plus an `is_active = true` filter on
persona.persona_commitments, none of which exist on that table (its
shape is session-bound commitments with `status`, `commitment_meta`,
etc.). The query returned a 500 every time SynapseHub bootstrapped a
persona's self-model, dropping the IdentityConstraints / Commitments /
ConscienceStandards layer from the assembled prompt. The patched
query reads existing columns only (commitment_text, commitment_type),
filters on `status='active'`, and synthesises Source="learned" /
Strength=1.0 to keep the SelfModel response shape stable for callers.

Verified live: `GET /api/v1/personas/70f7cfd9-.../self-model` now
returns 200 with `{identityConstraints:[],commitments:[],
conscienceStandards:[]}` instead of 500.

Future changes go through PRs against this repo — no more bin-only
deploys.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/service/personal_agent.go

@@ -0,0 +1,78 @@
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/rs/zerolog"
+
+	"github.com/gosec/gsc-ops-api/pkg/types"
+)
+
+// PersonalAgentService handles personal agent config operations
+type PersonalAgentService struct {
+	pool   *pgxpool.Pool
+	logger zerolog.Logger
+}
+
+// NewPersonalAgentService creates a new personal agent service
+func NewPersonalAgentService(pool *pgxpool.Pool, logger zerolog.Logger) *PersonalAgentService {
+	return &PersonalAgentService{
+		pool:   pool,
+		logger: logger.With().Str("service", "personal_agent").Logger(),
+	}
+}
+
+// GetConfig gets a user's personal agent config
+func (s *PersonalAgentService) GetConfig(ctx context.Context, userID, tenantID uuid.UUID) (*types.UserAgentConfig, error) {
+	var c types.UserAgentConfig
+	var configBytes []byte
+	err := s.pool.QueryRow(ctx,
+		`SELECT id, user_id, tenant_id, config, created_at, updated_at
+		FROM admin.user_agent_configs WHERE user_id = $1 AND tenant_id = $2`,
+		userID, tenantID).
+		Scan(&c.ID, &c.UserID, &c.TenantID, &configBytes, &c.CreatedAt, &c.UpdatedAt)
+	if err != nil {
+		return nil, fmt.Errorf("not found: %w", err)
+	}
+	c.Config = json.RawMessage(configBytes)
+	return &c, nil
+}
+
+// UpsertConfig creates or updates a user's personal agent config
+func (s *PersonalAgentService) UpsertConfig(ctx context.Context, req *types.UserAgentConfigUpsert) (*types.UserAgentConfig, error) {
+	var c types.UserAgentConfig
+	var configBytes []byte
+	err := s.pool.QueryRow(ctx,
+		`INSERT INTO admin.user_agent_configs (user_id, tenant_id, config)
+		VALUES ($1, $2, $3)
+		ON CONFLICT (user_id, tenant_id) DO UPDATE
+		SET config = EXCLUDED.config, updated_at = NOW()
+		RETURNING id, user_id, tenant_id, config, created_at, updated_at`,
+		req.UserID, req.TenantID, req.Config).
+		Scan(&c.ID, &c.UserID, &c.TenantID, &configBytes, &c.CreatedAt, &c.UpdatedAt)
+	if err != nil {
+		return nil, fmt.Errorf("upsert failed: %w", err)
+	}
+	c.Config = json.RawMessage(configBytes)
+	s.logger.Info().Str("userId", req.UserID.String()).Str("tenantId", req.TenantID.String()).Msg("Upserted personal agent config")
+	return &c, nil
+}
+
+// DeleteConfig deletes a user's personal agent config
+func (s *PersonalAgentService) DeleteConfig(ctx context.Context, userID, tenantID uuid.UUID) error {
+	tag, err := s.pool.Exec(ctx,
+		`DELETE FROM admin.user_agent_configs WHERE user_id = $1 AND tenant_id = $2`,
+		userID, tenantID)
+	if err != nil {
+		return fmt.Errorf("delete failed: %w", err)
+	}
+	if tag.RowsAffected() == 0 {
+		return fmt.Errorf("config not found")
+	}
+	s.logger.Info().Str("userId", userID.String()).Str("tenantId", tenantID.String()).Msg("Deleted personal agent config")
+	return nil
+}