gtiandClaude Sonnet 5
8d6122c096
One universal Windows Agent package per version (agent_releases: version/ platform/architecture/sha256/status DRAFT|PUBLISHED|REVOKED; the binary lives on a local release-storage volume, never in PostgreSQL). An operator creates a pending installation (agent_enrollments) from Agents / Servidores -> + Nova instalação, then either downloads it directly or generates a one-time HTTPS link (short TTL, single use). Either path streams the package plus a freshly minted enrollment.json whose token is never written to storage in plaintext, only its SHA-256 hash. On the client host, gti-agent.ps1 install-auto verifies the bundle's SHA-256, refuses a non- HTTPS Hub, enrolls via POST /v1/agents/enroll (deleting the enrollment token immediately after, success or failure), writes an ACL-restricted .env with the newly issued permanent Agent token, and registers the Windows Service without starting it (Firebird stays unconfigured on purpose). Idempotent, replay-proof, rate-limited per IP, fully audited, never logs a secret. Migration 0022_agent_releases_enrollment (verified fresh-DB == upgrade-from-0021 by pg_dump diff). GTI_FISCAL_VERSION/AGENT_VERSION bumped to 1.1.0 as the single source of truth across code, packages, the release manifest and every published AgentRelease row. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
GTI Fiscal Agent 1.0.0-rc1 - pacote Windows ========================================== Arquitetura: Hub central --HTTPS--> Agent Windows --local--> Firebird do SGV. O Hub nunca acessa o Firebird. Este pacote NAO contem segredos (token do Agent e senha do Firebird sao informados localmente). Requisitos no host do cliente: Python 3.12 (64 bits) no PATH, cliente Firebird (fbclient.dll, o mesmo do SGV), acesso HTTPS ao Hub, uma conta Firebird somente leitura. Passo a passo (PowerShell como Administrador, dentro desta pasta): .\gti-agent.ps1 install cria o venv, instala as dependencias, registra o servico "GTIFiscalAgent" (nao inicia) .\gti-agent.ps1 configure (ou: configure -FromTemplate .\pilot-construcao.env.example) grava o .env local com ACL restrita .\gti-agent.ps1 preflight PREFLIGHT=PASS|FAIL e os bloqueios, se houver .\gti-agent.ps1 start so inicia se o preflight passar .\gti-agent.ps1 status | stop | restart | uninstall [-Purge] Modo do piloto: FISCAL_MODE=DRY_RUN e FIREBIRD_WRITES=0. Nesse modo o Agent e tecnicamente incapaz de escrever no Firebird. Detalhes: docs/PILOT_DEPLOYMENT.md e docs/OPERATIONS.md do repositorio.