Summary

Plan C of 3 for issue #16. Stacked on #134 (Plan B sync engine), which is stacked on #133 (Plan A foundation). This PR finishes the core GitOps loop.

• Prune — migration 020 adds workflow_definitions.disabled_at and a git_repo_workflows join table. The sync engine records each seen workflow per repo, then disables any that disappeared when prune: true. Reappearing files clear disabled_at on the next sync. History preserved.
• Webhook receiver — POST /hooks/git/<repo-id> verifies HMAC-SHA256 via X-Hub-Signature-256, emits git.push.received, and fires SyncRepo in a goroutine so the provider gets its 202 fast. Body size capped at 1 MiB. Constant-time HMAC comparison.
• Manual flow — mantle repos plan <name> previews pending changes without writing; mantle repos apply <name> syncs on demand for auto_apply: false repos.
• Delete cleanup — repo.Store.Delete now removes the cloned working tree under <artifact>/git/<repo-id>/ when a repo is unregistered. DB ON DELETE CASCADE handles the join-table rows automatically.
• URL sanitization — sanitizeURL strips user:password@ from URLs in audit metadata and last_sync_error, so go-git errors echoing a clone URL can't leak inline credentials.
• mantle repos update — wires the existing Store.Update into a CLI subcommand for in-place edits.
• --webhook-secret flag on repos add and repos update so operators can arm HMAC verification without raw SQL.
• Audit events — git.sync.pruned, git.push.received.

What operators can do with A + B + C

• Register repos (CLI or git_sync.repos: in mantle.yaml)
• Run mantle serve — reconciler materializes config, poller syncs each enabled auto_apply: true repo at poll_interval
• Set up push webhooks (POST /hooks/git/<id> + X-Hub-Signature-256) for immediate syncs
• Preview (plan), manually apply (apply), or force-sync (sync) on any repo
• Delete a repo — DB row + cloned working tree + join-table rows all clean up
• Pruned workflows survive as disabled versions in history, ready to be re-enabled if the file reappears

This closes the core GitOps loop that issue #16 targets. Deferred to Plan D (future work, non-blocking): Prometheus metrics, REST API for repo CRUD, SSH key credential auth, live poller reconfig (new repos picked up without restart), k8s git-sync sidecar deployment docs, webhook_secret encryption at rest, prune-skip observability surfacing.

Pre-push review fixes (commit 0ca3f60)

Four reviewer agents ran before push (Technical Writer, Product Manager, Legal Compliance, Reality Checker). Consolidated fixes:

• Blocker: --webhook-secret flag added to repos add and repos update — operators can now arm HMAC verification through the CLI; the value is never printed to stdout (verified via test).
• Removed stray fmt.Println("ok") from the webhook test.
• Clarified the plan, apply, and update subcommand Long text; the parent repos Long now mentions all four sync-adjacent commands.
• Extended sanitizeURL wrapping to the last_sync_error path (pull-failed / discover-failed / aggregated failure summary) so the column surfaced by mantle repos status never displays a credentialed URL.

Test plan

• go test ./... in packages/engine — all packages green
• go test ./internal/repo/sync/ — 20 tests including prune, URL sanitization, PlanRepo
• go test ./internal/repo/ — 19 tests including GetByID, Delete cleanup, webhook_secret persistence
• go test ./internal/server/ — 3 new webhook tests (202 / 403 / 404)
• go test ./internal/cli/ — 10 repos tests including plan, apply, update, webhook-secret persistence
• go test ./internal/workflow/ — Disable/Reenable
• go build ./cmd/mantle && ./mantle repos --help — surfaces the full command set
• Manual: register a private repo with --webhook-secret, configure the webhook in GitHub, push a commit, verify immediate sync
• Manual: delete a repo, verify the clone directory is gone and git_repo_workflows rows are cascaded

Closes the GitOps core loop of #16. Plan D tracks remaining polish.

🤖 Generated with Claude Code