Implement phase 1 foundations

project-docs/status/phase-0-open-issues.md

@@ -0,0 +1,8 @@
+# Phase 0 Open Issues
+
+- Add UI authentication before exposing beyond a trusted private network.
+- Validate the Loki + Promtail setup against actual Portainer/Docker hosts.
+- Decide alert channels: email, ntfy, Gotify, Discord, Matrix, SMS, or another destination.
+- Decide which remediation actions are allowed. Candidates: send webhook, restart Portainer service, scale service, pause updater, open issue, or run a tightly allowlisted command.
+- AI analysis provider is intentionally unset. Any external AI/cloud provider requires explicit approval and prompt/log redaction design.
+- Add real alert delivery, retry behavior, deduplication, silences, and escalation policies.

project-docs/status/phase-0-summary.md

@@ -0,0 +1,16 @@
+# Phase 0 Summary
+
+Created initial `log-guardian` scaffold.
+
+Included:
+
+- Go HTTP service with health endpoint and basic web UI.
+- Local JSON-backed rule, alert-channel, and incident storage.
+- Loki query client for LogQL range queries.
+- Rule engine with thresholds and incident creation.
+- No-op analyzer interface for future AI agent analysis.
+- Dry-run remediation action runner scaffold.
+- Alert dispatcher scaffold that logs alert intent only.
+- Dockerfile, Portainer stack, Loki + Promtail starter compose, example environment, Makefile, CI workflow, and phase artifacts.
+
+Phase 0 does not certify production alerting or remediation.

project-docs/status/phase-0-test-results.md

@@ -0,0 +1,19 @@
+# Phase 0 Test Results
+
+Validation run from `/data/code/log-guardian` after scaffold creation.
+
+Passed:
+
+```sh
+gofmt -w cmd internal
+go test ./...
+make validate-structure
+make go-fmt
+make docker-build
+```
+
+Evidence:
+
+- `go test ./...` passed for all packages, including `internal/analysis` and `internal/store` tests.
+- `make validate-structure` printed `Structure validation passed`.
+- Docker image built successfully as `gitea.wayfinderak.com/wayfinderak/log-guardian:local`.

project-docs/status/phase-1-open-issues.md

@@ -0,0 +1,10 @@
+# Phase 1 Open Issues
+
+- Live deployment validation is still required against production Portainer, remote Loki, and self-hosted ntfy.
+- Loki topology is not finalized: single-binary vs scalable deployment, exact MinIO/NAS capacity, and retention settings need confirmation.
+- Promtail/Grafana Alloy labels must be discovered on the real Docker/Portainer hosts.
+- Gotify, generic webhook, and SMTP channels are scaffolded but not implemented for real delivery.
+- Alert channel secrets are currently stored in the local JSON config if entered through the UI; mounted secret-file/env references should be considered for stronger secret handling.
+- Ollama provider is implemented as local-only and opt-in, but the final model and runtime deployment still need validation.
+- No destructive remediation is implemented; Portainer restart and allowlisted command actions are dry-run evidence only.
+- The UI supports create/replace workflows but does not yet provide polished edit forms for existing rules/channels.

project-docs/status/phase-1-summary.md

@@ -0,0 +1,16 @@
+# Phase 1 Summary
+
+Implemented Phase 1 foundations for production use:
+
+- Basic auth protects UI/API routes; `/healthz` remains unauthenticated.
+- Loki diagnostics endpoints were added for labels, label values, and limited query testing.
+- Rules now support per-rule cooldowns with default `1h` and duplicate incident suppression.
+- Alert channels are configurable in the UI.
+- Real self-hosted ntfy delivery is implemented with test-send support.
+- Gotify, generic webhook, and SMTP channel types are represented as scaffolded options.
+- Incidents can record alert delivery results and remediation dry-run evidence.
+- Remediation action runner supports guarded dry-run evidence for generic webhook, Portainer restart, allowlisted command, and recommendation actions.
+- Local-only Ollama analysis support was added and remains disabled by default.
+- Secret handling was improved for alert channel token preservation and display masking.
+
+Phase 1 production rollout still requires live validation against the user's remote Loki and self-hosted ntfy deployments.

project-docs/status/phase-1-test-results.md

@@ -0,0 +1,37 @@
+# Phase 1 Test Results
+
+Validation run from `/data/code/log-guardian` after Phase 1 implementation.
+
+Passed:
+
+```sh
+gofmt -w cmd internal
+go test ./...
+make validate-structure
+make go-fmt
+make go-test
+make docker-build
+```
+
+Docker image built successfully as:
+
+```text
+gitea.wayfinderak.com/wayfinderak/log-guardian:local
+```
+
+Unit/integration-style tests added:
+
+- Basic auth middleware protects UI routes and leaves `/healthz` unauthenticated.
+- Store defaults include rule cooldown and alert channel secret-preserving updates.
+- Loki client label, label-value, and query-range behavior uses `httptest` fixtures.
+- ntfy dispatcher delivery uses an `httptest` fixture.
+- Rule engine suppresses duplicate incidents during cooldown.
+
+Pending live production validation before Phase 1 can be called operationally complete:
+
+- Remote Loki connectivity and label discovery.
+- Remote Loki LogQL query validation.
+- Self-hosted ntfy test notification received.
+- Rule-generated ntfy alert received.
+- Remediation dry-run evidence captured from a real rule.
+- Security/privacy review of logs, prompts, secrets, alert tokens, and action permissions.