feat: add harness runner (scenario executor, alert receiver, action executor, judge, revert)

harness/proposals.go

@@ -0,0 +1,65 @@
+package main
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"time"
+)
+
+// POST /proposals: the AI VM registers a layer-2 proposal (design 6.5). Response carries the approval token that the
+// Discord approval hands back; approved=true in the body records the approval directly (used by tests and by the AI VM
+// after the button round-trip). Execution then goes through /actions/execute with that token.
+type ProposalRequest struct {
+	RunID      *string        `json:"run_id"`
+	ScenarioID *string        `json:"scenario_id"`
+	ActionID   string         `json:"action_id"`
+	Target     map[string]any `json:"target"`
+	Diagnosis  map[string]any `json:"diagnosis"`
+	Approved   bool           `json:"approved"`
+	ApprovedBy string         `json:"approved_by"`
+	TTLSeconds int            `json:"ttl_seconds"`
+}
+
+func (a *App) handleProposal(w http.ResponseWriter, r *http.Request) {
+	var req ProposalRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeErr(w, 400, err)
+		return
+	}
+	if catalogEntry(req.ActionID) == nil {
+		writeErr(w, 400, errors.New("action_id not in the catalogue"))
+		return
+	}
+	if cur := a.runs.current(); cur != nil && req.RunID == nil {
+		req.RunID = &cur.RunID
+		if cur.ScenarioID != "" {
+			req.ScenarioID = &cur.ScenarioID
+		}
+	}
+	ttl := 15 * time.Minute // design 2.1: no approval within 15 minutes -> layer 3
+	if req.TTLSeconds > 0 {
+		ttl = time.Duration(req.TTLSeconds) * time.Second
+	}
+	b := make([]byte, 24)
+	_, _ = rand.Read(b)
+	token := "apr-" + hex.EncodeToString(b)
+	if err := a.store.InsertProposal(r.Context(), token, req.RunID, req.ScenarioID, req.ActionID, req.Target, ttl); err != nil {
+		writeErr(w, 500, err)
+		return
+	}
+	a.store.Event(r.Context(), req.RunID, req.ScenarioID, "proposal", "ai", map[string]any{"action_id": req.ActionID, "target": req.Target, "diagnosis": req.Diagnosis, "token_suffix": token[len(token)-6:]})
+	if req.Approved {
+		by := req.ApprovedBy
+		if by == "" {
+			by = "unspecified"
+		}
+		_ = a.store.ApproveProposal(r.Context(), token, by)
+		a.store.Event(r.Context(), req.RunID, req.ScenarioID, "approval", by, map[string]any{"action_id": req.ActionID, "token_suffix": token[len(token)-6:]})
+	}
+	writeJSON(w, 201, map[string]any{"token": token, "expires_in_s": ttl.Seconds(), "approved": req.Approved})
+}
+
+// POST /proposals/{token}/approve is not needed while the AI VM marks approval itself; kept out to keep the surface small.