feat: add signed synthetic CPU ML foundation

.env.production.example

@@ -11,11 +11,18 @@ LOCAL_DATABASE_URL=postgresql://ndsep_user:CHANGE_ME_STRONG_PASSWORD@postgres:54
 NDSEP_PG_URL=postgresql://ndsep_user:CHANGE_ME_STRONG_PASSWORD@postgres:5432/ndsep_db?sslmode=require
 
 # ── Redis ────────────────────────────────────────────────────
+# Production requires a private TLS endpoint. Do not use redis:// or disable certificate verification.
 REDIS_PASSWORD=CHANGE_ME_REDIS_PASSWORD
-REDIS_URL=redis://:CHANGE_ME_REDIS_PASSWORD@redis:6379
+REDIS_URL=rediss://:CHANGE_ME_REDIS_PASSWORD@redis-tls.internal:6380
+REDIS_TLS=true
+REDIS_TLS_CA_PATH=/run/secrets/redis-ca.crt
+REDIS_TLS_REJECT_UNAUTHORIZED=true
 
 # ── Auth / JWT ───────────────────────────────────────────────
 JWT_SECRET=CHANGE_ME_AT_LEAST_32_CHARS_RANDOM_STRING
+API_KEY_SALT=CHANGE_ME_AT_LEAST_32_CHARS_RANDOM_STRING
+WEBHOOK_SIGNING_SECRET=CHANGE_ME_AT_LEAST_32_CHARS_RANDOM_STRING
+WORKER_EVENT_HMAC_SECRET=CHANGE_ME_AT_LEAST_32_CHARS_RANDOM_STRING
 VITE_APP_ID=your-manus-app-id
 OAUTH_SERVER_URL=https://api.manus.im
 VITE_OAUTH_PORTAL_URL=https://manus.im
@@ -59,9 +66,9 @@ TEMPORAL_ADDRESS=temporal:7233
 TEMPORAL_NAMESPACE=ndsep
 
 # ── Keycloak (IAM) ───────────────────────────────────────────
-# Internal issuer URL used by API services; the public hostname below is
-# required for browser redirects and must be covered by the Caddy certificate.
-KEYCLOAK_URL=http://keycloak:8080
+# Both service and issuer URLs must use TLS in production. The issuer hostname
+# must match the Keycloak token `iss` claim and be covered by the Caddy certificate.
+KEYCLOAK_URL=https://keycloak.internal:8443
 KEYCLOAK_ISSUER_URL=https://sso.ndsep.nitda.gov.ng
 KEYCLOAK_REALM=ndsep
 KEYCLOAK_CLIENT_ID=ndsep-platform
@@ -72,22 +79,26 @@ KEYCLOAK_ADMIN_USER=CHANGE_ME_NONDEFAULT_ADMIN_USER
 KEYCLOAK_ADMIN_PASSWORD=CHANGE_ME_STRONG_KEYCLOAK_ADMIN_PASSWORD
 
 # ── Permify (Fine-Grained Authorization) ─────────────────────
-PERMIFY_URL=http://permify:3476
+PERMIFY_ENABLED=true
+PERMIFY_URL=https://permify.internal:3476
+PERMIFY_AUTH_TOKEN=CHANGE_ME_AT_LEAST_32_CHARS_RANDOM_STRING
 
 # ── TigerBeetle (Financial Ledger) ───────────────────────────
 TIGERBEETLE_ADDRESS=tigerbeetle:3001
 TIGERBEETLE_CLUSTER_ID=0
 
 # ── OpenSearch (Full-Text Search) ────────────────────────────
-OPENSEARCH_URL=http://opensearch:9200
-OPENSEARCH_USER=admin
-OPENSEARCH_PASS=CHANGE_ME
+# Set explicitly to true only after a TLS endpoint and non-placeholder credentials exist.
+OPENSEARCH_ENABLED=true
+OPENSEARCH_URL=https://opensearch.internal:9200
+OPENSEARCH_USER=CHANGE_ME_NONDEFAULT_OPENSEARCH_USER
+OPENSEARCH_PASS=CHANGE_ME_STRONG_OPENSEARCH_PASSWORD
 
 # ── Public Edge / APISIX (API Gateway) ───────────────────────
 # Caddy is the only service bound to public 80/443. Do not expose APISIX 9080,
 # 9443, or 9180 on the host.
 NDSEP_PUBLIC_HOST=ndsep.nitda.gov.ng
-APISIX_ADMIN_URL=http://apisix:9180
+APISIX_ADMIN_URL=https://apisix-admin.internal:9180
 APISIX_ADMIN_KEY=CHANGE_ME_32_PLUS_CHAR_RANDOM_ADMIN_KEY
 
 # ── Dapr (Sidecar Runtime) ───────────────────────────────────
@@ -113,13 +124,35 @@ OPENAPPSEC_OPERATOR_EMAIL=security-operations@ndsep.nitda.gov.ng
 OPENAPPSEC_AGENT_TOKEN=
 
 # ── Lakehouse (Data Lake) ────────────────────────────────────
+# Keep disabled unless the HTTPS catalog and non-default object-storage credentials
+# have been provisioned through an approved secret manager.
+LAKEHOUSE_ENABLED=false
+LAKEHOUSE_CATALOG_URL=https://lakehouse-catalog.internal:8181
+LAKEHOUSE_S3_ACCESS_KEY=CHANGE_ME_AT_LEAST_16_CHARS
+LAKEHOUSE_S3_SECRET_KEY=CHANGE_ME_AT_LEAST_16_CHARS
 ICEBERG_CATALOG_URL=http://iceberg-rest:8181
 
 # ── CORS ──────────────────────────────────────────────────────
 CORS_ORIGINS=https://ndsep.nitda.gov.ng,https://app.ndsep.ng
 
 # ── Security ─────────────────────────────────────────────────
 ENABLE_DEMO_LOGIN=false
+# Keep disabled unless an approved SMS provider key and accountable recipient are configured.
+TERMII_ENABLED=false
+TERMII_API_KEY=CHANGE_ME
+NDPC_PHONE_NUMBER=+2348012345679
+# Required by production Compose; load only from an approved secret manager.
+SLACK_WEBHOOK_URL=https://hooks.slack.com/services/CHANGE_ME
+PAGERDUTY_INTEGRATION_KEY=CHANGE_ME
+NITDA_COMPLIANCE_EMAIL=security-operations@example.ng
+PLATFORM_URL=https://ndsep.example.ng
+SMTP_HOST=smtp.example.ng:587
+SMTP_FROM=ndsep-alerts@example.ng
+NETBOX_TOKEN=CHANGE_ME_AT_LEAST_32_CHARS_RANDOM_STRING
+RANGER_URL=https://ranger.internal:6080
+RANGER_ADMIN_USER=CHANGE_ME_NONDEFAULT_RANGER_USER
+RANGER_ADMIN_PASS=CHANGE_ME_STRONG_RANGER_PASSWORD
+EVIDENCE_SIGNING_KEY=CHANGE_ME_SECRET_MANAGER_REFERENCE_OR_KEY_MATERIAL
 
 # ── Field-Level Encryption (AES-256-GCM) ─────────────────────
 # Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

.github/CODEOWNERS

@@ -0,0 +1,43 @@
+# NDSEP security and production-release ownership
+#
+# The protected production branch must require code-owner review and at least
+# two independent approvals. This file routes the security-sensitive paths to
+# the repository owner until an authorized administrator replaces or augments
+# it with managed security, platform, and compliance teams.
+#
+# This file does not grant access or replace GitHub branch/environment rules.
+# It is intentionally source-controlled so review routing is auditable.
+
+# Dependency-exception governance and scheduled enforcement
+/.github/security/pnpm-audit-exceptions.json @munisp
+/PNPM_AUDIT_EXCEPTION_POLICY.md @munisp
+/scripts/ci/assert-pnpm-audit.mjs @munisp
+/scripts/ci/weekly-pnpm-exception-audit.mjs @munisp
+/.github/workflows/security-gate.yml @munisp
+/.github/workflows/weekly-exception-governance-audit.yml @munisp
+
+# Release artifact, container, and production startup controls
+/Dockerfile @munisp
+/docker-compose.production.yml @munisp
+/Makefile @munisp
+/scripts/security/ @munisp
+/.github/workflows/ci.yml @munisp
+/.github/workflows/emergency-candidate-preflight.yml @munisp
+/.github/workflows/digest-bound-emergency-release.yml @munisp
+/.github/security/break-glass-authorization-policy.json @munisp
+/.github/security/break-glass-alert-delivery-policy.json @munisp
+/scripts/ci/verify-break-glass-authorization.mjs @munisp
+/scripts/ci/generate-break-glass-evidence.mjs @munisp
+/scripts/ci/verify-break-glass-evidence.mjs @munisp
+/scripts/ci/publish-break-glass-alerts.mjs @munisp
+/.env.production.example @munisp
+
+# Authorization, identity, and policy enforcement
+/server/envValidation.ts @munisp
+/server/workerEventAuth.ts @munisp
+/server/middlewareExtensions.ts @munisp
+/server/opensearchConfig.ts @munisp
+/server/keycloak.ts @munisp
+/server/keycloakAuth.ts @munisp
+/infra/opa/ @munisp
+/orchestration/keycloak/ @munisp

.github/security/break-glass-alert-delivery-policy.json

@@ -0,0 +1,15 @@
+{
+  "schemaVersion": "ndsep.break-glass-alert-delivery-policy.v1",
+  "policyId": "ndsep-production-break-glass-alert-delivery",
+  "repository": "munisp/ndsep",
+  "environment": "production-release",
+  "enabled": false,
+  "allowedSiemModes": [
+    "splunk-hec",
+    "elastic"
+  ],
+  "pagerDutyEndpoint": "https://events.pagerduty.com/v2/enqueue",
+  "attestationRequired": true,
+  "externalImmutableRetentionRequired": true,
+  "noReadinessCredit": true
+}

.github/security/break-glass-authorization-policy.json

@@ -0,0 +1,23 @@
+{
+  "schemaVersion": "ndsep.break-glass-authorization-policy.v1",
+  "policyId": "ndsep-production-break-glass",
+  "repository": "munisp/ndsep",
+  "environment": "production-release",
+  "enabled": false,
+  "maximumAuthorizationMinutes": 60,
+  "requiredIssueLabels": [
+    "incident",
+    "break-glass"
+  ],
+  "roles": {
+    "incident_commander": {
+      "allowedLogins": []
+    },
+    "release_authority": {
+      "allowedLogins": []
+    },
+    "database_authority": {
+      "allowedLogins": []
+    }
+  }
+}