Jason Staack 3ab9f27d49 feat(03-01): implement config snapshot subscriber with dedup and encryption ...

- NATS subscriber for config.snapshot.> on DEVICE_EVENTS stream
- Dedup by SHA256 hash against latest snapshot per device
- OpenBao Transit encryption before INSERT (plaintext never stored)
- Malformed/orphan messages acked and discarded safely
- Transit failure causes nak for NATS retry
- Prometheus metrics: ingested, dedup_skipped, errors, duration
- All 6 unit tests pass

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-12 21:47:07 -05:00

8.3 KiB

Raw Blame History

View Raw