Work / Nexus / Changelog / Day 16

Day 16 Build 4 min

Day 16: Factory Reviews in the Approvals Queue

Gateway ingests factory-agents high/critical review webhooks, merges them with Athena OPAR approvals for Console, and documents ADR 0009 F2. Partial progress on the deferred typed-approvals Build — not Property 8, not persistence.

Calendar Day 16 is a Document brief: write a Suricata rule for something Athena generated. That needs labeled traffic we still have not run end-to-end (Day 14 Use is open). What landed Sep 1 in core-nexus is a different Build — the factory human gate wiring ADR 0009 promised.

Webhook → Approvals

POST /api/v1/factory/reviews accepts review payloads from nebucloud/factory-agents when risk_max is high or critical. Lower risk returns accepted: false without enqueueing.

Auth is a shared secret: NEXUS_GW_FACTORY_WEBHOOK_TOKEN via Authorization: Bearer or X-Factory-Webhook-Token. Missing config returns 503; bad token returns 401.

Factory records get factory-{id} keys, map to Console-shaped rows (proposedTool: factory-agents / review, source: factory, optional checkRunUrl), and live in an in-memory store for now.

Merged queue

GET /api/v1/approvals pulls factory pending rows first, then athena-agents. If Athena is down but factory rows exist, the list still returns. Results merge and sort by submittedAt ascending — oldest pending first.

POST /api/v1/approvals/{id}/decision routes factory-* ids locally (404 not found, 409 not pending) and proxies everything else to athena-agents (502 on upstream failure).

Four Gateway tests cover webhook create, low-risk reject, merge, and factory approve.

Console

Approvals empty-state copy now mentions factory review findings alongside OPAR needs_review actions. No new panel — the existing queue shape already fits.

ADR 0009

F2 is marked live: Check Run POST in factory-agents plus gateway webhook for Console Approvals. F1 kiln-verify and F3 coding agent remain future.

Parallel (not this day)

ADR 0010 proposes a shared LLM serving plane with kvcached — proposed only, no deploy.

What I am not claiming

  • Deferred Day 12 Build is not done: no models/approvals.py, no ApprovalAction contract, no Hypothesis Property 8
  • Factory approvals are in-memory — restart clears them; not production persistence
  • Day 14/15 Use briefs still open (SOC baseline, Console ↔ nexus-tui correlation)
  • Day 16 Suricata rule brief still open until Athena traffic exists to pattern-match
  • athena-agents SSE (retire Day 9 bridge) still deferred

Next

Either run Day 14 Use for real, finish the typed Athena approvals contract, or — once traffic exists — the Day 16 Suricata Document brief.