16 Commits

Include renames

Author	SHA1	Message	Date
admin	c4a7b83f61	feat(auth): central Keycloak portal-trust (KEYCLOAK_ISSUER/audience/azp)	2026-11-02 18:45:40 +01:00
admin	525bf6b9a0	feat(workbench): use the decision server's local model while the AI API is on hold ... - DecisionOllamaGatewayClient calls the self-hosted Ollama on server-decision-01 (tailnet HTTP only for loopback/RFC1918/100.64-127), keeps the same local admission and reports providerKind=local. - createInf0Gateway prefers it over INF0/LiteLLM when configured. - Evidence is computed deterministically from values when a small model omits offsets; a value must occur exactly once in the source or the result goes to review. This makes a 9B local model usable without weakening verification. Tests: 4 new gateway cases + 2 evidence-derivation cases; full typecheck green.	2026-11-02 17:09:42 +01:00
admin	e93db5fc1f	fix(doc0): call DOC0 as the granted service actor ... DOC0 denies an x-actor-id that the service identity has no actor_grant for, so every upload/structure call from 0pt failed with DOC0_ACCESS_DENIED and became outcome_unknown. The journal and project authorization keep the verified end-user actor; only the DOC0 request acts as the service (DOC0_SERVICE_ACTOR_ID).	2026-11-02 16:17:29 +01:00
admin	023406c9b6	feat(auth): Zitadel OIDC login for the portal ... The portal had no way to obtain a verified principal: /api/0pt/* requires a Bearer token, but the browser only had the dev-only HMAC cookie. - GET /api/auth/login: Authorization Code + PKCE against Zitadel. - GET /api/auth/callback: code exchange, id_token verification (issuer, audience, nonce) and a signed session cookie with sub + tenant. - middleware accepts the signed session as a verified principal; Bearer wins. - dev login POST is refused in production. - Sign-in link in the portal shell.	2026-11-02 15:48:02 +01:00
admin	d12b8fa55f	feat(workbench): explicit pilot mode without a credit wallet ... OPT_CREDITS_MODE=off skips reserve/settle and reports credits:null, so the document flow can be piloted before prices are decided. It is never a silent fallback and purchases remain disabled.	2026-11-02 15:31:52 +01:00
admin	e3c4bc28c3	feat(workbench): live LiteLLM gateway adapter + explicit project grants ... - createInf0Gateway prefers the live OpenAI-compatible LiteLLM gateway and falls back to the native INF0 surface; admission stays local and fail-closed. - Project authorization: OpenFGA when configured, otherwise a validated server-owned OPT_PROJECT_GRANTS list (deny by default). - Tests for the gateway adapter, the factory and grants.	2026-11-02 14:50:50 +01:00
admin	b3239487b7	feat(document-workbench): wire customer upload, structuring, credits and readiness ... - POST /api/0pt/documents/upload: real multipart bytes into DOC0 through the durable attempt journal and the existing coordinator; verified tenant/actor only, project authorization fail-closed. - POST /api/0pt/documents/structure: DOC0 segments -> INF0 -> evidence-bound validation -> optional JSON/CSV export, with credit reserve/settle. - Credits: balance, server-owned price book, Stripe Checkout and idempotent webhook reconciliation via a Stripe re-read of session + payment intent. - /portal/dokument and /portal/krediter: SIAX-styled workspace. - @siax/access: universal, framework-neutral OpenFGA project relationship primitive reusable by DOC0/N0D/other products. - Readiness: real Redis PING probe instead of presence-only; queue is now a live dependency when configured. - Dockerfile: copy every workspace manifest so --frozen-lockfile works. - Format/build hygiene: .prettierignore, .worktrees ignored, valid manifest YAML.	2026-11-02 14:46:10 +01:00
Simon AxelssonandClaude Fable 5	c47e3b468e	test(integration)+ci+docs: live OpenSearch/ClickHouse suites, CI service containers, STATUS.md (§56) ... - tests/integration/: 10 tests against REAL OpenSearch 2.11 (tenant isolation, purpose/rights filters, generation rebuild/rollback, projection-disaster rebuild §68) + REAL ClickHouse 24.8 (tenant-isolated metric DSL, TTL schema, injection-surface refusals). Honest skip without env - and CI fails hard if the suites skip instead of running. - .gitea/workflows/ci.yml: new blocking 'integration' job with self-identifying service containers (st0re ci.yml's measured alias-collision discipline: run-unique cluster.name / credentials, getent-enumerated IP selection, no-match = hard fail). - STATUS.md: full 8-level Master-DoD classification per capability incl. the honest gaps blocking PRODUCTION_READY. - dependency-mode: NEXT_PHASE=phase-production-build is not a serving runtime (next build page-data collection must compile; guard re-arms at boot) - pinned by contract test. - docs/02-architecture.md: superseded the accurate-but-now-fixed 'every client runs against its mock' paragraph; .env.example: client URLs now actually read from env + new P0 backend vars. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-31 16:56:33 +02:00
admin	00a1b3997d	fix(env): NEXT_PUBLIC_API_URL -> live origin (api.0pt.app is dead) (#23) ... Co-authored-by: sax3l <simon@siax.io> Co-committed-by: sax3l <simon@siax.io>	2026-08-27 04:36:39 +00:00
admin	9888c0078c	feat(contract): OpenAPI 3.1 SSOT (orders/estimates/enrich/resolve/provenance) + AR-4 fixes (drop @vercel/analytics + next/font/google -> self-hosted fontsource) + repo hygiene	2026-08-10 04:10:30 +02:00
SIAX Ops	44e83ad1de	resolve: README adopts main (newer, fail-closed auth docs)	2026-08-09 11:30:18 +02:00
Claude (SIAX platform session)andClaude Opus 5	bcf285f057	merge: unify GitHub main into Gitea main (0pt) ... Merges github/main (6 commits: 17-bug audit fix, CI quality gate, .env.example + .gitignore fix, missing platform clients + registry services, docs accuracy overhaul) into gitea/main (8 commits: Iceberg write boundary + live ST0RE verification, lakehouse mapping routes, Waves 1-4 foundational hardening). 16 conflicts. Both sides had independently written the four src/clients/*.ts and the two registry services, so those are combined rather than picked: - st0re-client.ts: GitHub's endpoint wins on evidence. POST goes to /v1/st0re/artifacts/register, not /v1/st0re/artifacts -- verified in sax3l/st0re src/api/routes/artifacts.ts, where the bare path is a GET-only list route. Gitea's URL normalisation, error-body text and mock kept. - n0d-client.ts: field is `status`, not `state`, with N0D's real 13-state union -- verified in sax3l/n0d packages/schemas/n0d.job.schema.json, which says explicitly not to add "succeeded". Gitea's mock echo, URL normalisation and error-body text kept. - cl0ud-client.ts: Gitea's fail-closed HTTP normalisation kept (a 200 with no `decision` reads as "deny", not as a silent allow). GitHub's PolicyDecision/PolicyDecisionValue naming kept; PolicyResult retained as an alias. - aud0-client.ts: permissive union of both input types (optional payload/metadata/correlation_id), GitHub's echo return, Gitea's URL normalisation and error-body text, plus a JSON-parse fallback so a successful POST with an empty body does not throw. - dataset-service.ts / source-service.ts: GitHub's record/DTO split and event naming (0pt.source_created / 0pt.create_source, which the merged docs already reference) plus Gitea's name validation, description / created_by fields and actor_id derivation. List filters are the union. - lakehouse mapping routes: GitHub's shared lakehouse-mapping-registry singletons (without which every write 400'd "mapping not found") AND Gitea's Zod parseBody validation. Both, not either. - src/types/source.ts, src/types/dataset.ts: unions of both vocabularies; GitHub's `access` legal-sourcing field kept. - .env.example: GitHub's audited inventory plus Gitea's Zitadel / AUTH_ENFORCE block. - CLAUDE.md, docs/ICEBERG_WRITE_BOUNDARY.md: GitHub's corrections kept, Gitea's live-verification kept and marked as superseding the "would 400 outright" finding (Gitea had already added the required X-Tenant-Id/X-Actor-Id headers). - pnpm-lock.yaml: regenerated with pnpm 9.15.9, not merged. Also corrects CLAUDE.md's claim that the banned services/scrapers stack was "since removed" -- the removal PR is open, not merged, and this branch inherits that code from Gitea main. Nothing here resurrects, extends or re-wires any of it; services/scrapers/ is byte-identical to Gitea main. Verified on the merged tree: typecheck (src/ + tests/) clean; 17 test files, 121 passed, 1 skipped (the realinfra test skipping honestly on ST0RE HTTP 401), 0 failures. Gitea main baseline was the same 121/1; GitHub main baseline could not even `pnpm install` ("packages field missing or empty") -- Gitea's pnpm-workspace.yaml fix resolves that. Whole-repo `typecheck:app` reports 9 errors, an identical set to Gitea main's baseline, so it is advisory in both CI workflows rather than deleted. Lint: 16 problems, identical to Gitea baseline. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-28 12:38:01 +02:00
Claude (SIAX platform session)	1c1e2cb649	fix(auth): make the AUTH_ENFORCE default fail-closed on /api/0pt/* ... The auth seam read `process.env.AUTH_ENFORCE === 'true'`, so an absent env var meant NO authentication: any fresh container, local run, DR restore or redeploy that dropped the variable served /api/0pt/* anonymously, taking the tenant from the caller-supplied X-Tenant-Id header. 0pt.app is deployed and was answering anonymously (verified: an invalid Bearer token plus an arbitrary X-Tenant-Id returned 200), so this was a live hole, not latent. * authEnforced() now returns true unless AUTH_ENFORCE is explicitly "false" (trimmed, case-insensitive). Unset/empty/misspelled => ENFORCED. * assertAuthConfigSafe() throws AuthMisconfigurationError when NODE_ENV=production and enforcement resolved off, naming AUTH_ENFORCE. It runs at middleware module load (startup) and on the env-driven request path, so a production instance can neither boot nor serve a single unauthenticated request with auth switched off. * .env.example no longer teaches AUTH_ENFORCE=false; README's Deploy section states the fail-closed posture (no DEPLOY.md in this repo). * 7 new tests, incl. the regression case: with AUTH_ENFORCE unset and no `enforce` option, an unauthenticated request is rejected with 401. No test was inverted or deleted -- none asserted the open default; the three enforce:false cases now describe the explicit local-dev escape hatch. Tests: 121 passed / 1 skipped before, 128 passed / 1 skipped after. Typecheck and build clean; advisory lint unchanged (16 pre-existing problems). Scope: auth default only. The matcher still covers /api/0pt/* alone, and the handlers still take tenant_id from the query/body rather than the verified principal -- both described in the PR body, neither fixed here.	2026-07-27 13:28:24 +02:00
SIAX Foundation BotandClaude Opus 4.8	1d76d50f3d	feat(auth,foundation): Wave 2 flag-gated Zitadel JWT verify + validation + eslint + tests ... Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-25 14:32:34 +02:00
admin	89e180fc49	chore: add .env.example, fix .gitignore blanket .env* rule (#3) ... .env.example was referenced by README.md and required by docs/09-build-plan.md (Phase 0) but never existed in the repo. Root cause: .gitignore's `.env*` rule silently ignored it too, so `git add .env.example` was always a no-op even if someone created it locally. - Add .gitignore exception: `!.env.example`. - Add .env.example covering every process.env.* read found in this pass (grep-verified across app/, lib/, src/), organized by concern, each section marked "wired in code today" or "documented target, not yet read by code" per docs/08-infrastructure.md. No real values; matches repo convention. Excluded ODOO_BASE_URL: only appears inside a comment describing a past refactor away from module-level env reads, not an actual process.env read. pnpm test: 88 passed, 1 todo, 0 failures (13 files, tests/**/*.test.ts). tsc --noEmit: clean.	2026-07-22 18:48:58 +02:00
SIAX Foundation Bot	bd5e309851	chore(foundation): Wave 1 scaffolding — CI gate / Dockerfile / .env.example	2026-07-20 00:01:37 +02:00