Phase 13: integrations (research folder, git, Prometheus, signed webhooks)

Adds the integration layer that turns external sources into provenance-tagged
observations without ever executing what it reads.

- research folder poller: os.OpenRoot, text allowlist, binary/archive/symlink
  rejection, content fingerprints, duplicate tracking
- git poller: bare shallow mirror with hooks disabled and ext protocol refused,
  commit observations, co-change pairs
- Prometheus poller: threshold crossings and relative-change detection
- webhooks: HMAC over timestamp.body, +/-300s window, replay cache, 256 KiB cap,
  per-IP rate limit; refused entirely without a secret
- capabilities read_metrics (allow) and repository.read (ask), scoped to the
  invoking mind's integrations
- migrations 0013, API, UI pages, noemactl integrations, docs/integrations.md

This commit is contained in:

Andy Dixon

2026-06-29 21:04:50 +01:00

parent b35dbe0299

commit 89edbb7c06

26 changed files with 2391 additions and 7 deletions

									
										migrations/0013_integrations.down.sql
									
		+3
		
												View File
												
				@@ -0,0 +1,3 @@

				DROP TABLE IF EXISTS ingested_documents;

				DROP TABLE IF EXISTS integration_runs;

				DROP TABLE IF EXISTS integrations;