Skip to content

Commit 176b801

Browse files
authored
conductor(setup): Add conductor setup files (#103)
1 parent 49800af commit 176b801

13 files changed

Lines changed: 576 additions & 0 deletions

File tree

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# General Code Style Principles
2+
3+
This document outlines general coding principles that apply across all languages and frameworks used in this project.
4+
5+
## Readability
6+
- Code should be easy to read and understand by humans.
7+
- Avoid overly clever or obscure constructs.
8+
9+
## Consistency
10+
- Follow existing patterns in the codebase.
11+
- Maintain consistent formatting, naming, and structure.
12+
13+
## Simplicity
14+
- Prefer simple solutions over complex ones.
15+
- Break down complex problems into smaller, manageable parts.
16+
17+
## Maintainability
18+
- Write code that is easy to modify and extend.
19+
- Minimize dependencies and coupling.
20+
21+
## Documentation
22+
- Document *why* something is done, not just *what*.
23+
- Keep documentation up-to-date with code changes.

conductor/code_styleguides/go.md

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# Effective Go Style Guide Summary
2+
3+
This document summarizes key rules and best practices from the official "Effective Go" guide for writing idiomatic Go code.
4+
5+
## 1. Formatting
6+
- **`gofmt`:** All Go code **must** be formatted with `gofmt` (or `go fmt`). This is a non-negotiable, automated standard.
7+
- **Indentation:** Use tabs for indentation (`gofmt` handles this).
8+
- **Line Length:** Go has no strict line length limit. Let `gofmt` handle line wrapping.
9+
10+
## 2. Naming
11+
- **`MixedCaps`:** Use `MixedCaps` or `mixedCaps` for multi-word names. Do not use underscores.
12+
- **Exported vs. Unexported:** Names starting with an uppercase letter are exported (public). Names starting with a lowercase letter are not exported (private).
13+
- **Package Names:** Short, concise, single-word, lowercase names.
14+
- **Getters:** Do not name getters with a `Get` prefix. A getter for a field named `owner` should be named `Owner()`.
15+
- **Interface Names:** One-method interfaces are named by the method name plus an `-er` suffix (e.g., `Reader`, `Writer`).
16+
17+
## 3. Control Structures
18+
- **`if`:** No parentheses around the condition. Braces are mandatory. Can include an initialization statement (e.g., `if err := file.Chmod(0664); err != nil`).
19+
- **`for`:** Go's only looping construct. Unifies `for` and `while`. Use `for...range` to iterate over slices, maps, strings, and channels.
20+
- **`switch`:** More general than in C. Cases do not fall through by default (use `fallthrough` explicitly). Can be used without an expression to function as a cleaner `if-else-if` chain.
21+
22+
## 4. Functions
23+
- **Multiple Returns:** Functions can return multiple values. This is the standard way to return a result and an error (e.g., `value, err`).
24+
- **Named Result Parameters:** Return parameters can be named. This can make code clearer and more concise.
25+
- **`defer`:** Schedules a function call to be run immediately before the function executing `defer` returns. Use it for cleanup tasks like closing files.
26+
27+
## 5. Data
28+
- **`new` vs. `make`:**
29+
- `new(T)`: Allocates memory for a new item of type `T`, zeroes it, and returns a pointer (`*T`).
30+
- `make(T, ...)`: Creates and initializes slices, maps, and channels only. Returns an initialized value of type `T` (not a pointer).
31+
- **Slices:** The preferred way to work with sequences. They are more flexible than arrays.
32+
- **Maps:** Use the "comma ok" idiom to check for the existence of a key: `value, ok := myMap[key]`.
33+
34+
## 6. Interfaces
35+
- **Implicit Implementation:** A type implements an interface by implementing its methods. No `implements` keyword is needed.
36+
- **Small Interfaces:** Prefer many small interfaces over one large one. The standard library is full of single-method interfaces (e.g., `io.Reader`).
37+
38+
## 7. Concurrency
39+
- **Share Memory By Communicating:** This is the core philosophy. Do not communicate by sharing memory; instead, share memory by communicating.
40+
- **Goroutines:** Lightweight, concurrently executing functions. Start one with the `go` keyword.
41+
- **Channels:** Typed conduits for communication between goroutines. Use `make` to create them.
42+
43+
## 8. Errors
44+
- **`error` type:** The built-in `error` interface is the standard way to handle errors.
45+
- **Explicit Error Handling:** Do not discard errors with the blank identifier (`_`). Check for errors explicitly.
46+
- **`panic`:** Reserved for truly exceptional, unrecoverable situations. Generally, libraries should not panic.
47+
48+
*Source: [Effective Go](https://go.dev/doc/effective_go)*

conductor/index.md

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Project Context
2+
3+
## Definition
4+
- [Product Definition](./product.md)
5+
- [Product Guidelines](./product-guidelines.md)
6+
- [Tech Stack](./tech-stack.md)
7+
8+
## Workflow
9+
- [Workflow](./workflow.md)
10+
- [Code Style Guides](./code_styleguides/)
11+
12+
## Management
13+
- [Tracks Registry](./tracks.md)
14+
- [Tracks Directory](./tracks/)

conductor/product-guidelines.md

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Product Guidelines: Secrets
2+
3+
## UX Principles
4+
- **Security-First Defaults:** All default configurations prioritize the highest security settings. Convenience never overrides system integrity.
5+
- **High-Visibility Feedback:** Both CLI and API provide immediate, unambiguous feedback for all operations. Success/failure states are clearly indicated with actionable context.
6+
- **Simplified Setup Experience:** Minimize "day-zero" friction. The system is designed to be operational with minimal required configuration, using sensible defaults where security isn't compromised.
7+
8+
## Error Handling & Messaging
9+
- **Concise & Safe Tone:** Error messages are direct and technical. They must never leak internal system state, sensitive credentials, or detailed stack traces to the end-user.
10+
- **Remediation-Oriented:** Where possible, provide clear next steps for the user to resolve the error without compromising security.
11+
12+
## Engineering Standards
13+
- **Modular Clean Architecture:** Strict adherence to the architecture defined in the `internal/` directory (Domain, Usecase, Service, Repository, HTTP). Cross-layer leaks are prohibited.
14+
- **Test-Driven Development Culture:** Every new feature or bug fix MUST be accompanied by relevant unit and integration tests. No code is merged without verified test coverage.
15+
- **Security-Focused CI/CD:** Mandatory security scanning (`gosec`, `govulncheck`) and linting (`golangci-lint`) on every commit. Vulnerabilities are treated as blockers.
16+
17+
## API & Interface Design
18+
- **URL-Based Versioning:** All API endpoints are versioned in the URL path (e.g., `/v1/secrets`). Breaking changes require a new major version.
19+
- **RESTful Consistency:** Standard HTTP methods (GET, POST, PUT, DELETE) and status codes are used consistently across all resources.
20+
- **Unified Response Format:** All API responses follow a standardized envelope structure to ensure predictability for client integrations.
21+
22+
## Documentation Style (Extended from docs-style-guide.md)
23+
- **Action-Oriented:** Documentation prioritizes "how-to" guides and practical examples over theoretical explanations.
24+
- **Copy-Safe Examples:** All examples use clearly synthetic values (e.g., `<client-id>`, `example.com`) to prevent accidental leaks.

conductor/product.md

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Initial Concept
2+
3+
A lightweight secrets manager designed for simplicity and security. It provides envelope encryption, transit encryption, API authentication, and cryptographic audit logs. Inspired by HashiCorp Vault, it focuses on ease of use and deployment for modern application stacks.
4+
5+
# Product Definition: Secrets
6+
7+
## Core Mission
8+
To provide a secure, developer-friendly, and lightweight secrets management platform that ensures the confidentiality, integrity, and availability of application secrets through modern cryptographic practices.
9+
10+
## Target Audience
11+
- **Developers:** Who need simple, high-performance APIs for secret retrieval and encryption services (EaaS).
12+
- **Security Compliance Teams:** Who require tamper-resistant audit trails for compliance audits (PCI-DSS, SOC2).
13+
14+
## Core Features
15+
- **Secret Management (Storage):** Versioned, envelope-encrypted storage with support for arbitrary key-value pairs.
16+
- **Transit Engine (EaaS):** On-the-fly encryption/decryption of application data without database storage.
17+
- **Tokenization Engine:** Format-preserving tokens for sensitive data types like credit card numbers.
18+
- **Audit Logs:** HMAC-signed audit trails capturing every access attempt and policy evaluation.
19+
- **KMS Integration:** Native support for AWS KMS, Google Cloud KMS, Azure Key Vault, and HashiCorp Vault.
20+
21+
## Strategic Priorities
22+
- **v1.0.0 Stability:** Achieving an API freeze and production-ready stability for mission-critical deployments.
23+
- **PCI-DSS Alignment:** Ensuring the cryptographic model and audit trails meet the requirements for handling payment card data.
24+
- **Kubernetes-Native Deployment:** Optimized Docker images and Helm-ready configurations for cloud-native orchestration.
25+
26+
## Success Metrics
27+
- **Performance:** Sub-millisecond latency for secret retrieval and transit encryption operations.
28+
- **Reliability:** 99.9% availability for key retrieval services.
29+
- **Security:** Zero unauthenticated or unauthorized access to secret material.

conductor/setup_state.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"last_successful_step": "3.3_initial_track_generated"}

conductor/tech-stack.md

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# Tech Stack: Secrets
2+
3+
## Core Technologies
4+
- **Language:** [Go](https://go.dev/) (v1.26.0+) - Chosen for its high concurrency, strong typing, and performance.
5+
- **Web Framework:** [Gin](https://github.com/gin-gonic/gin) - A high-performance HTTP web framework with a fast HTTP router and custom middleware support.
6+
- **CLI Framework:** [urfave/cli/v3](https://github.com/urfave/cli) - A library for building command-line applications in Go.
7+
8+
## Data Persistence
9+
- **PostgreSQL:** Primary relational database for production environments. Supported via `lib/pq`.
10+
- **MySQL:** Alternative relational database support for broader infrastructure compatibility. Supported via `go-sql-driver/mysql`.
11+
- **Migrations:** [golang-migrate/migrate](https://github.com/golang-migrate/migrate) - Versioned database migrations for both PostgreSQL and MySQL.
12+
13+
## Cryptography & Security
14+
- **Envelope Encryption:** [gocloud.dev/secrets](https://gocloud.dev/howto/secrets/) - Abstracted access to various KMS providers for root-of-trust encryption.
15+
- **Password Hashing:** [go-pwdhash](https://github.com/allisson/go-pwdhash) - Argon2id hashing for secure storage of client secrets and passwords.
16+
- **Audit Signing:** HMAC-SHA256 for tamper-evident cryptographic audit logs.
17+
18+
## KMS Providers (Native Support)
19+
- **Google Cloud KMS**
20+
- **AWS KMS**
21+
- **Azure Key Vault**
22+
- **HashiCorp Vault** (via transit engine)
23+
24+
## Observability & Monitoring
25+
- **OpenTelemetry:** Native instrumentation for metrics using `go.opentelemetry.io/otel`.
26+
- **Prometheus Export:** Standardized metrics endpoints compatible with Prometheus scrapers.
27+
28+
## Testing & Quality Assurance
29+
- **Unit Testing:** [Testify](https://github.com/stretchr/testify) for assertions and mocks.
30+
- **Database Mocking:** [go-sqlmock](https://github.com/DATA-DOG/go-sqlmock) for repository-level unit tests.
31+
- **Static Analysis:** [golangci-lint](https://golangci-lint.run/) with `gosec` and `govulncheck` for security scanning.

conductor/tracks.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Project Tracks
2+
3+
This file tracks all major tracks for the project. Each track has its own detailed plan in its respective folder.
4+
5+
---
6+
7+
- [ ] **Track: Implement Authenticated Encryption with Associated Data (AEAD) Context in Transit Engine**
8+
*Link: [./tracks/implement_aead_context_20260305/](./tracks/implement_aead_context_20260305/)*
Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Track implement_aead_context_20260305 Context
2+
3+
- [Specification](./spec.md)
4+
- [Implementation Plan](./plan.md)
5+
- [Metadata](./metadata.json)
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"track_id": "implement_aead_context_20260305",
3+
"type": "feature",
4+
"status": "new",
5+
"created_at": "2026-03-05T14:00:00Z",
6+
"updated_at": "2026-03-05T14:00:00Z",
7+
"description": "Implement Authenticated Encryption with Associated Data (AEAD) Context in Transit Engine to prevent ciphertext substitution attacks."
8+
}

0 commit comments

Comments
 (0)