- X-Internal-Token skickades av edgen men verifierades ALDRIG — gate som
raw-ASGI-middleware: INTERNAL_TOKEN satt => alla routes utom /health kräver
exakt token, 401 (constant-time) annars. Ospecificerad token = inert (dev).
- Dockerfile: ARG GIT_SHA + OCI-label + /health.reporting revision
- compose var redan skriven för INTERNAL_TOKEN — motorn hade bara aldrig
deployats med den
- tester: tests/test_internal_token_gate.py (3: off/public/401-pass) — hela
services/api-sviten 62 passed, 2 skipped (dokumenterade known-gaps), 0 fail
FastAPI orchestrator (health/sources/estimates/orders/jobs per docs/04), adaptive router (compliant methods only, no bypass tiers), pipeline (sourcing->extraction->structuring/dedup->fusion->QA with per-field provenance, drops < confidence target), live connectors GLEIF/Brreg/Companies House (PRH/CVR/Bolagsverket gated to level-0 until terms verified). sources.yaml registry. infra/docker-compose + Caddyfile for the VPS. FlareSolverr/stealth/proxy/fake-account paths intentionally NOT carried over (CLAUDE.md §1). py_compile clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>