project: add /api/v1/projects aggregation; sessions: add ?cwd= filter
- session.ListFilter gains Cwd *string; List appends working_dir = ?
clause between Host and Since in fixed order (parameterised, column
name is a literal)
- session.Handler reads ?cwd= and threads it to filter.Cwd; empty
string treated as absent, consistent with other optional filters
- new package internal/domain/project:
- Repository.List groups sessions by non-NULL working_dir in a single
SQL round-trip; correlated subquery picks top_tool with tie-broken
by tool ASC; Hosts/Tools deduped and sorted in Go after
GROUP_CONCAT
- Handler mounts GET /projects; resolveScope/clampLimit/clampOffset
duplicated from session handler; ?owner= admin gating identical
- server.Server gains Projects *project.Handler inject field; mounted
in /api/v1 Route block
- main.go and e2e test register projectRepo + projectHnd with steward
feat(cmd): wire server with /healthz /readyz /metrics + authed /api/v1
Phase 9 of lethe-server: thin main.go that loads config, registers every
steward asset, and orchestrates Inject -> Init -> Start -> wait -> Stop ->
Destroy. Compensates for the Phase 4 finding (steward.Manager does not
unwind on Init failure) by tracking destroyer-implementing assets in a
parallel slice and invoking Destroy in reverse registration order with a
per-call timeout when Init or Start fails.
Server.Start now opens its TCP listener synchronously and exposes the
bound address via Addr(), so the e2e smoke can bind to 127.0.0.1:0 and
discover the kernel-assigned port.
Adds an end-to-end smoke test that drives the real steward graph
(in-memory SQLite, real loopback listener, forward-auth) through ingest +
sessions list/detail for two users with the same composite session key,
proving owner isolation reaches all the way through the trust boundary.
Deletes internal/platform/health/steward_unwind_test.go: the canary's
purpose was to surface the unwind gap so Phase 9 could compensate, which
it now does.
README updated with consolidated curl quickstart (forward-auth + OIDC
bearer variants), trust-chain diagram and the proxy-must-strip-Remote-*
spoofing note, response-shape documentation for the API surface, and an
operational notes section covering health, metrics, lifecycle and logs.