2 commits

Author	SHA1	Message	Date
rcourtman	d5c7a3494b	chore: remove deprecated Pulse+ agent metrics and add audit log rotation docs ... Removed all legacy Pulse+ agent metrics infrastructure (cloud-relay) which has been fully replaced by the new docker agent and temperature agent implementations. Changes: - Remove cloud-relay directory and all related binaries (relay, relay-linux, etc.) - Remove Pulse+ documentation (AGENT_METRICS_IMPLEMENTATION.md, AGENT_METRICS_SETUP.md) - Clean up pulse-relay references in workflows and release checklist - Add audit log rotation documentation for sensor proxy hash-chained logs - Update .gitignore to remove cloud-relay/ entry The new docker and temp agents remain fully functional and unaffected by this cleanup.	2025-10-20 15:13:38 +00:00
rcourtman	524f42cc28	security: complete Phase 1 sensor proxy hardening ... Implements comprehensive security hardening for pulse-sensor-proxy: - Privilege drop from root to unprivileged user (UID 995) - Hash-chained tamper-evident audit logging with remote forwarding - Per-UID rate limiting (0.2 QPS, burst 2) with concurrency caps - Enhanced command validation with 10+ attack pattern tests - Fuzz testing (7M+ executions, 0 crashes) - SSH hardening, AppArmor/seccomp profiles, operational runbooks All 27 Phase 1 tasks complete. Ready for production deployment.	2025-10-20 15:13:37 +00:00