Initial commit: Elydora Open Source — self-hosted audit platform for AI agents

Full self-hosted port of the Elydora tamper-evident audit protocol:
- Hono API server with PostgreSQL, Redis, MinIO adapters
- Ed25519 signed operations, chain hashing, Merkle epoch rollups
- PBKDF2 password hashing, HMAC-SHA256 JWT, 5-role RBAC
- Next.js management console
- Node.js, Python, and Go SDKs
- Docker Compose for local deployment
- Helm chart for Kubernetes
- Comprehensive security hardening and audit fixes applied

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/generate-keys.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+# Generates an Ed25519 signing key and a random JWT secret for initial setup.
+# Requires: openssl
+set -e
+
+echo "=== Elydora Key Generation ==="
+echo ""
+
+# Generate Ed25519 private key and export as base64url
+SIGNING_KEY=$(openssl genpkey -algorithm ed25519 2>/dev/null \
+  | openssl pkcs8 -topk8 -nocrypt -outform DER 2>/dev/null \
+  | tail -c 32 \
+  | base64 \
+  | tr '+/' '-_' \
+  | tr -d '=\n')
+
+# Generate 32-byte random JWT secret as hex
+JWT_SECRET=$(openssl rand -hex 32)
+
+echo "Add these to your .env file:"
+echo ""
+echo "ELYDORA_SIGNING_KEY=${SIGNING_KEY}"
+echo "JWT_SECRET=${JWT_SECRET}"
+echo ""
+echo "WARNING: Store these values securely. Do not commit them to version control."

scripts/init-minio.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+# Creates the MinIO bucket for Elydora evidence storage.
+# Requires the MinIO client (mc) and the following env vars:
+#   MINIO_ENDPOINT, MINIO_ACCESS_KEY, MINIO_SECRET_KEY, MINIO_BUCKET
+set -e
+
+: "${MINIO_ENDPOINT:=http://localhost:9000}"
+: "${MINIO_ACCESS_KEY:=elydora}"
+: "${MINIO_SECRET_KEY:=elydora-minio-secret-change-me}"
+: "${MINIO_BUCKET:=elydora-evidence}"
+
+mc alias set elydora "${MINIO_ENDPOINT}" "${MINIO_ACCESS_KEY}" "${MINIO_SECRET_KEY}"
+mc mb --ignore-existing "elydora/${MINIO_BUCKET}"
+echo "Bucket '${MINIO_BUCKET}' is ready."