Initial commit: Agent Governance System Phase 8

Phase 8 Production Hardening with complete governance infrastructure:

- Vault integration with tiered policies (T0-T4)
- DragonflyDB state management
- SQLite audit ledger
- Pipeline DSL and templates
- Promotion/revocation engine
- Checkpoint system for session persistence
- Health manager and circuit breaker for fault tolerance
- GitHub/Slack integrations
- Architectural test pipeline with bug watcher, suggestion engine, council review
- Multi-agent chaos testing framework

Test Results:
- Governance tests: 68/68 passing
- E2E workflow: 16/16 passing
- Phase 2 Vault: 14/14 passing
- Integration tests: 27/27 passing

Coverage: 57.6% average across 12 phases

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

sandbox/terraform/README.md

@@ -0,0 +1,32 @@
+# Terraform
+
+> Terraform sandbox and examples
+
+## Overview
+
+This directory contains terraform sandbox and examples.
+
+## Key Files
+
+| File | Description |
+|------|-------------|
+| *No files yet* | |
+
+## Interfaces / APIs
+
+*Document any APIs, CLI commands, or interfaces here.*
+
+## Status
+
+** Not Started**
+
+See [STATUS.md](./STATUS.md) for detailed progress tracking.
+
+## Architecture Reference
+
+Part of the [Agent Governance System](/opt/agent-governance/docs/ARCHITECTURE.md).
+
+Parent: [Sandbox](..)
+
+---
+*Last updated: 2026-01-23 23:25:09 UTC*

sandbox/terraform/STATUS.md

@@ -0,0 +1,30 @@
+# Status: Terraform
+
+## Current Phase
+
+** NOT STARTED**
+
+## Tasks
+
+| Status | Task | Updated |
+|--------|------|---------|
+| ☐ | *No tasks defined* | - |
+
+## Dependencies
+
+*No external dependencies.*
+
+## Issues / Blockers
+
+*No current issues or blockers.*
+
+## Activity Log
+
+### 2026-01-23 23:25:09 UTC
+- **Phase**: NOT STARTED
+- **Action**: Initialized
+- **Details**: Status tracking initialized for this directory.
+
+
+---
+*Last updated: 2026-01-23 23:25:09 UTC*

sandbox/terraform/docker-service/README.md

@@ -0,0 +1,32 @@
+# Docker Service
+
+> Terraform sandbox and examples - docker-service submodule
+
+## Overview
+
+This directory contains terraform sandbox and examples - docker-service submodule.
+
+## Key Files
+
+| File | Description |
+|------|-------------|
+| *No files yet* | |
+
+## Interfaces / APIs
+
+*Document any APIs, CLI commands, or interfaces here.*
+
+## Status
+
+** Not Started**
+
+See [STATUS.md](./STATUS.md) for detailed progress tracking.
+
+## Architecture Reference
+
+Part of the [Agent Governance System](/opt/agent-governance/docs/ARCHITECTURE.md).
+
+Parent: [Terraform](..)
+
+---
+*Last updated: 2026-01-23 23:25:09 UTC*

sandbox/terraform/docker-service/STATUS.md

@@ -0,0 +1,30 @@
+# Status: Docker Service
+
+## Current Phase
+
+** NOT STARTED**
+
+## Tasks
+
+| Status | Task | Updated |
+|--------|------|---------|
+| ☐ | *No tasks defined* | - |
+
+## Dependencies
+
+*No external dependencies.*
+
+## Issues / Blockers
+
+*No current issues or blockers.*
+
+## Activity Log
+
+### 2026-01-23 23:25:09 UTC
+- **Phase**: NOT STARTED
+- **Action**: Initialized
+- **Details**: Status tracking initialized for this directory.
+
+
+---
+*Last updated: 2026-01-23 23:25:09 UTC*

sandbox/terraform/docker-service/main.tf

@@ -0,0 +1,150 @@
+# Terraform Configuration: Docker Service Deployment
+# ===================================================
+# This configuration manages Docker containers on localhost.
+# Designed for Tier 1+ agents to deploy services.
+#
+# For Tier 0 agents: Plan only (terraform plan)
+#
+# Usage:
+#   terraform init
+#   terraform plan -var="service_name=myapp" -var="image=nginx:alpine"
+#   terraform apply  # Tier 1+ only
+
+terraform {
+  required_providers {
+    docker = {
+      source  = "kreuzwerker/docker"
+      version = "~> 3.0"
+    }
+  }
+}
+
+provider "docker" {
+  host = "unix:///var/run/docker.sock"
+}
+
+# Variables
+variable "service_name" {
+  description = "Name of the service/container"
+  type        = string
+  default     = "tf-managed-service"
+}
+
+variable "image" {
+  description = "Docker image to deploy"
+  type        = string
+  default     = "nginx:alpine"
+}
+
+variable "internal_port" {
+  description = "Container internal port"
+  type        = number
+  default     = 80
+}
+
+variable "external_port" {
+  description = "Host external port"
+  type        = number
+  default     = 8090
+}
+
+variable "network_name" {
+  description = "Docker network to attach"
+  type        = string
+  default     = "spark-net"
+}
+
+variable "environment" {
+  description = "Environment variables for the container"
+  type        = map(string)
+  default     = {}
+}
+
+variable "labels" {
+  description = "Labels to apply to the container"
+  type        = map(string)
+  default = {
+    "managed-by" = "terraform"
+    "agent-tier" = "1"
+  }
+}
+
+# Data source to reference existing network
+data "docker_network" "main" {
+  name = var.network_name
+}
+
+# Pull the image
+resource "docker_image" "service" {
+  name         = var.image
+  keep_locally = true
+}
+
+# Create the container
+resource "docker_container" "service" {
+  name  = var.service_name
+  image = docker_image.service.image_id
+
+  ports {
+    internal = var.internal_port
+    external = var.external_port
+  }
+
+  networks_advanced {
+    name = data.docker_network.main.name
+  }
+
+  restart = "unless-stopped"
+
+  dynamic "env" {
+    for_each = var.environment
+    content {
+      key   = env.key
+      value = env.value
+    }
+  }
+
+  labels {
+    label = "managed-by"
+    value = "terraform"
+  }
+
+  labels {
+    label = "service-name"
+    value = var.service_name
+  }
+
+  # Health check
+  healthcheck {
+    test         = ["CMD", "wget", "-q", "--spider", "http://localhost:${var.internal_port}/"]
+    interval     = "30s"
+    timeout      = "10s"
+    retries      = 3
+    start_period = "10s"
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+# Outputs
+output "container_id" {
+  description = "The ID of the deployed container"
+  value       = docker_container.service.id
+}
+
+output "container_name" {
+  description = "The name of the deployed container"
+  value       = docker_container.service.name
+}
+
+output "service_url" {
+  description = "URL to access the service"
+  value       = "http://localhost:${var.external_port}"
+}
+
+output "network" {
+  description = "Network the container is attached to"
+  value       = var.network_name
+}