3 commits

Author	SHA256	Message	Date
Tyler J King	e3fb2a9a58	refactor(ceremony-engine): use GovernanceEnvelope for merkle leaves ... PipelineMerge, SchematicPublish, and GitOpsSync ceremony merkle leaves are now the canonical_hash() of a GovernanceEnvelope, binding git ref + governance metadata into a single auditable 32-byte hash. Uses the resolution's resolved_at timestamp for deterministic envelope construction. Non-git ceremony types (MutationIntent, Custom) unchanged. Signed-off-by: Tyler King <tking@guildhouse.dev>	2026-04-12 12:13:53 -04:00
Tyler J King	3d5e5485ec	refactor(ceremony-engine): bind git commit hash into canonical_bytes ... PipelineMerge ceremony resolutions now include the git commit SHA in their canonical form, binding the Quartermaster merkle leaf to git's merkle tree. SchematicPublish includes tree_hash, GitOpsSync includes target_revision. Non-git ceremony types (MutationIntent, Custom) unchanged — canonical_bytes still returns proof_hash alone. See cid-reconciliation-audit.md Site 8. Signed-off-by: Tyler King <tking@guildhouse.dev>	2026-04-12 07:54:01 -04:00
Tyler King	b1865a0627	initial: bascule v0.1.0 ... Bascule shell runtime workspace — governed shell access layer for Substrate/Guildhouse FFC deployments. Crates: - bascule-agent: node agent with SSH server + command filtering - bascule-core: audit, grant engine, ceremony types, session - bascule-filter-core: log line filtering (stdio protocol) - bascule-gateway: OIDC auth, session management, SAT validation - bascule-node-agent: k8s DaemonSet agent (pod watcher, BPF manager) - bascule-proto: protobuf definitions - bascule-shell: governed SSH shell (commands, elevation, REPL) - bascule-tail: chronicle log tail + fanout - ceremony-engine: ceremony lifecycle (6 types + request/resolution) 172 tests passing. Implements SBS-SPEC-0001 shell model. Reference impl for SPEC-SHELLOPS-0001 Layer 1 (root shell).	2026-03-18 16:40:48 -04:00