89 Commits

Include renames

Author	SHA1	Message	Date
admin	6784f42696	Merge main into fix/prod-truth-20260922 (syntetiska mutation-fixturer behållna; main:s nyare evidens-tidsstämpel)	2026-10-30 17:13:47 +01:00
Claude CodeandClaude Sonnet 5.5	d5539ac638	fix(ci): stamp live-ClickHouse seed events relative to now (30-day raw-event TTL expired the fixed 2026-09 timestamps) ... Root cause of red integration job on main/#173/#174: opt_analytics_event has TTL event_time + 30 DAY; seeds dated 2026-09-01 expired on 2026-10-01 so tenant-isolation reads returned 0 rows. Same time bomb latent in 3 sibling suites. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-02 18:38:23 +02:00
admin	1c87b82e70	feat(import): ImportDispatchPolicy (DES1GN ADR D3 §31) — ett objekt, en sanning ... - lib/import-dispatch-policy.ts: maxInlineRows=500 (inline-tak, oförändrat kontrakt), maxRows=5000 (N0D-dispatch-signal), maxBytes=1_000_000 (bytes, UTF-8), format-allowlist ['csv']; ren evaluateImportDispatch() med deterministisk precedens format > bytes > rows - route: taken härstammar från policyn; bytes-koll (ersätter chars); rows > maxRows -> 413 n0d_dispatch_required med hint {capability_id: 0pt.import_execute, job_type: 0pt.import_execute_job, status: UNVERIFIED} (descriptor-gate stängd: aldrig tyst trunkering, aldrig tyst dispatch) - tester: 9 nya (verdict per kombination inkl. gränsvärden 500/501/5000/5001, bytes-gräns, allowlist, precedens; route-koppling 200/413/413) — 21/21 gröna i sviten; full N0D-worker-integration markeras UNVERIFIED	2026-09-30 21:48:16 +02:00
admin	04813c34b0	feat(collab): order-anteckningar — @siax/collaboration-kernelns första produktkonsument (spår C) ... Kernel 0.3.0 används som capability, inte som paket-dekor: - lib/order-notes-store.ts: varje note ÄR en CollaborationOperation; nextLamportClock för nya klockor, mergeOperationLog/compareOperations för deterministisk listning; optimistisk version -> 409 vid stale skrivning. - lib/order-notes-client.ts: kernel-CollaborationTransport över host-API; offline = medvetet no-op + varning (ingen tyst förlust), 409 -> ConflictError. - app/api/admin/order-notes: requireRouteAuth (fail-closed 401), server-authoritative tenant-guard (403), AUD0-audit via hostens klient. - app/admin/notes: admin-yta med offline-växel, konflikt-banner + reload. - sql/016_order_notes.sql: persistens (DB-tabell, version + Lamport-klocka). Tester: API (happy/conflict 409/empty/400/401/403/404), klient-adapter (offline no-op utan fetch, 409-mappning, presence), SSR-render. 18 nya test.	2026-09-30 17:07:21 +02:00
admin	c1648c04a7	feat(orders): CSV-import admin-yta — första riktiga ImportWizard-värden (C8) ... Symmetrisk mot våg 3.4 CSV-export: POST /api/orders/import (validate | dry_run | execute) + /admin/import som renderar @siax/ui ImportWizard (0.14.0) över @siax/import-export runtime (0.2.0). - Servern är enda auktoritet: RFC4180-parse (ingen eval), omvalidering via frysta @siax/contracts-kerneln (validateRows) + hostregler, exekvering genom BEFINTLIG orderlogik (createOrder, tenant-guardad). - Fail-closed: 401 utan principal, 400 okänd header, 413 vid radtak (500), per-rad-atomsäkra inserts — felrad kan aldrig skada OK-rader. - Partiell import: OK-rader skapas, felrader rapporteras per rad (row/field/code). AUD0-audit via 0pts enda producer-boundary (durable outbox under DATABASE_URL). - Reload-persistens: efter execute läses /api/orders om och de nya raderna listas på sidan. - Tester: 12 route-test (happy, partial, auth fail-closed, tak, no-write validate, header, quoting, rad-fel mitt i batch) + 3 SSR-render-test av ImportWizard över runtime-storen. - Deps: @siax/ui ^0.14.0, @siax/charts ^0.5.0, @siax/import-export ^0.2.0; pnpm-overrides till contracts 0.10.0 / import-export 0.2.0 (ui 0.14.0 deklarerar 0.11.0/0.2.1 som ännu ej publicerats).	2026-09-30 15:36:02 +02:00
admin	0386d82c49	fix(health): engine-kollen ärlig (not_configured när URL saknas) + EVIDENCE-docs mot Coolify-verkligheten	2026-09-30 10:08:25 +02:00
admin	c3582838aa	feat(orders): kanonisk statusmaskin + guardad DB-constraint (ADR-0002, C3)	2026-09-29 21:15:35 +02:00
admin	bc76ebc5e5	feat(orders): CSV-export-endpoint — export-kernelns första adoption (våg 3.4)	2026-09-29 17:01:13 +02:00
admin	a2377215e7	feat(admin): InboxList — orderkön som universal inkorg (våg 3.3-adoption) ... Servern projicerar öppna ordrar (draft/quoted/in_production/review) på universal-inbox-konvolverna via createInboxItem (buildOrderInboxItem i lib/order-flow, ADR-0001-mönstret: policy/resolution i serverlagret). Admin renderar InboxList (@siax/ui 0.11.1) ovanpå orderkön — resolve- aktionen gateras genom advance_action-state (available krävs). Terminala statusar ger ingen post. tests/order-flow 6/6; full svit 1144/1144; build ✓.	2026-09-29 16:10:10 +02:00
admin	5ffd41a461	fix(lint): odoo-bills-adapter AUD0-body — disable med skäl (CI-fynd)	2026-09-29 13:27:31 +02:00
admin	e24f8e8af4	fix(lint): typa AUD0-ingest-body i external-writeback-testet (CI-fynd)	2026-09-29 13:17:00 +02:00
admin	3279fa0533	fix(lint): eslint-undantag på rätt rader — json:any i graph-adapter + require-fixtures ... eslint-disable-next-line gällde nästa rad; json:any-linen behövde eget undantag. npm run lint: 0 errors (8→0). 1141/1141.	2026-09-29 12:50:06 +02:00
admin	1b6140a16a	fix(lint): rotfelsa ärvd lint-skuld — graph-adapter + p0-tester (blockerade #128) ... Parallellsessions-merge lämnade 12 eslint-errors på main (no-explicit-any i graph-mailbox-adapter + 2 p0-tester). Graph-JSON:n är genuint ostrukturerad — medveten, avgränsad eslint-undantag med skäl (DoD §13); p0-testerna typade med Record/cast. Lint 0 errors; tsc grön; 1141/1141.	2026-09-29 12:31:34 +02:00
admin	a49bc148fc	feat(admin): authz-pilot — server-renderad advance-resolution + ActionGate (ADR-0001) ... GET /api/orders returnerar per order frozen advance_action (resolveAction ur lib/order-flow); admin renderar via ActionGate — policy i serverlagret, presentation i klienten (DoD §21). Terminala/okända statusar → read_only med varför-text i stället för missvisande 'klar'. tests/order-flow.test.ts 3/3; full svit 1138 godkända; typecheck grön.	2026-09-29 12:21:02 +02:00
Claude CodeandClaude Sonnet 5	07158099ee	feat(ingestion): VehIQ OLTP -> ClickHouse watermark extractor (P070) ... Implements Simon's specified pattern (dealer_stock_entry/deal -> watermark/updated_at -> 0pt ingestion -> ClickHouse) as a P061 connector pair (PostgresWatermarkConnector, PostgresKeyedLookupConnector) plugged into the existing P062 IngestionRunner, writing to opt_dataset_projection via SiaxAnalyticsEngine.ingestProjection. Built here, not in admin/vehiq: that repo's own ADR-0035 (decisions 1/2/10, CI-enforced by validate_engine_firewall.py) forbids VehIQ code from ever holding a ClickHouse credential or hammering OLTP directly for analytics. See docs/P070_VEHIQ_OLTP_EXTRACTOR.md for the full rationale. Also corrects a real schema mismatch found while building this: production has no generic `updated_at` on any of the three target tables (verified live, read-only, 2026-09-25). dealer_stock_entry/deal use listed_at/ created_at as insert-time watermarks instead (documented caveat: in-place updates are not caught without a schema change); app.listing has no timestamp column at all and is deliberately not covered yet. Vehicle dimension lookup is narrow by construction: keyed on exactly the vehicle_id set referenced by the batch just read, never a scan of the 98M-row vehiq.vehicle table (connector-level validate() refuses that table by name; runner-level tests assert the query only ever touches referenced IDs). Verified: fixture-backed connector/runner tests (watermark+limit, same-timestamp tie at a page boundary, crash/resume, empty-table case, narrow-lookup query-count assertions) + a real disposable Postgres container (caught two real Date-handling bugs fixtures could not) + a read-only proof against actual production (server10, vehiq-db): the extractor's exact SQL returns zero rows, no error, confirming it is safe to schedule with zero current effect. .gitea/workflows/vehiq-oltp-ingest.yml is present, cron-scheduled, and defaults to VEHIQ_INGEST_MODE=preview (read-only, never writes) with no secrets configured — safe to merge with zero production effect until explicitly activated per the doc's "what activating this requires". Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-25 19:11:15 +02:00
Claude	0062edbec3	fix(readiness): /api/ready svarade 200 med en död motor i produktion ... Mätt live 2026-09-25 mot produktionsdeployen (0pt.app / api.0pt.app, container shxd6lepxuxfsjsp0ath3z1g-172514162615 på server6, uppe 17,9 h, Docker-status "healthy" hela tiden): GET /api/health -> HTTP/1.1 200 OK {"ok":false,"service":"0pt-web","db":"ok","queue":"not_configured", "engine":"error","stripe":"not_configured", "detail":{"engine":"This operation was aborted"}} GET /api/ready -> HTTP/1.1 200 OK {"ready":true,"service":"0pt-web","db":"ok","engine":"error",...} ENGINE_URL pekade på http://0pt-engine:8000. Mätt inifrån containern: `getent hosts 0pt-engine` ger ingen post, och det finns ingen sådan container på någon av server5-11. Ett direktanrop mot motorn misslyckas efter ~5 s (DNS). Datamotorn — 0pt:s hela produkt — var alltså BORTA, och samtliga signaler ovanför den var gröna: Docker healthy, /api/health 200, /api/ready 200. `ok:false` i en 200-kropp är ingen signal. Ingenting i kedjan läser kroppar; allt läser statuskoder och exitkoder. isReady skilde tidigare bara på "db ok". Den skillnad som saknades är inte konfigurerad-vs-ej-konfigurerad utan FRÅNVARANDE-vs-TRASIG: * not_configured / not_integrated -> fortsatt ready. 0pt är byggt för att kunna köra utan motor, Stripe och kö (se .env.example). * error -> INTE ready. Statusen "error" betyder att någon medvetet konfigurerade beroendet och att en riktig round trip mot det just misslyckades. Det är inte längre en valfri integration. Ändrar ingenting i driften i dag: container-HEALTHCHECK pekar på /api/health (liveness) och Dockerfilen säger uttryckligen att en readiness-probe inte ska peka dit. Den här ändringen gör bara att den ärliga ytan faktiskt blir ärlig, så en yttre övervakning kan använda den. Regressionstest tillagt; verifierat att det FALLER mot den gamla isReady (1 failed | 18 passed) och passerar mot den nya (24 passed över health-checks/ready/health). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-25 13:34:42 +02:00
Claude Code	dc5c0eebf1	fix(doctor): point doctor + test at siax.repo.v3.json (legacy manifest raderades i 64e63cd) + operationalState running enligt live-evidens ... Pre-existing main-breakage: FAS 36-drift-konsolideringen (64e63cd) tog bort siax.repo.json men doctor och siax-doctor.test laest den fortfarande -> ENOENT i quality-jobbet. Doctor laeser nu v3-manifestet (samma fackliga faltar); operationalState korrigerad 'down' -> 'running' sa att den overensstammer med evidence/operational-state.json (live-proba 2026-09-22). Doctor 0/55 failures.	2026-09-23 17:01:08 +02:00
Claude Code	dd4731aa3c	feat(decision): Jev ER auto-match shadow (0PT_DECISION_ER_SHADOW) ... Shadow-eval av D0 auto-match: D0-tröskeln förblir auktoritet, kvaliteten mäts fire-and-forget mot siax-decision (:4600, decisionId 0pt.er.auto_match). Gate 0PT_DECISION_ER_SHADOW=1 (OFF by default). Fail-closed: gate-off/fel/ABSTAINED påverkar aldrig det deterministiska svaret; decision-planen loggar inbyggt (AUD0). - packages/decision: erAutoMatchShadow + erAutoMatchShadowEnabled - src/er/comparePair: void erAutoMatchShadow(...).catch(() => null) - tests/p0/decision-er-shadow.test.ts: gate-off/on, POST-body, DECIDED/ABSTAINED, fetch-fel, fire-and-forget-wire (16 nya tester)	2026-09-23 16:53:55 +02:00
Claude Code	fc1a62bb81	feat: decision-plane wiring — ER-pair decision.match tie-break (@siax/0pt-decision) ... - packages/decision: erMatchDecision (0pt.er.pair_match mot siax-decision :4600) - comparePair async + borderline-band (±0.05 av review_threshold) → decision.match (D1 advisory) — deterministisk status GÄLLER om decision abstainar - OPT_DECISION_ER_ENABLED=1-gate (off tills kalibrering) - tests async-anpassade (await generateCandidates/rejects.toThrowError) - typecheck: 13 fel = pre-existing extraction-route (main-paritet), 0 nya fel - tester: 1108 passed | 184 skipped	2026-09-23 00:15:27 +02:00
admin	655a71ebd7	feat(HSP-085): migration-studio — T01 ej importerbart döljs EJ ur nämnaren (ratio = importable/total), T02 session-resume med tenant-check + checkpoint + resolved conflicts, T03 coverage-claim SCOPED (aldrig komplett M365-ersättning), 8 tester	2026-09-22 22:18:01 +02:00
admin	d01efe29e2	test(GOV-06): mutation-fixturerna bygger på den historiska down+402/404-posten SYNTEISKT — inte repots nuvarande evidens (som med rätta är running+200 sedan flottan-cutovern; testerna ska aldrig flippa när verkligheten flippar)	2026-09-22 21:23:38 +02:00
admin	8f7a064177	fix(doctor-tests): GOV-06-tester uppdaterade till running-truth (0pt#96:s prod-truth-fix; down+402/404 var den föråldrade paret; ok:false-next-to-200 är nu negativa-fallet)	2026-09-22 21:11:33 +02:00
admin	85b0e6cd72	feat(HSP-084): cutover — T01 detectDualWriters (båda aktiva = STOPPAD), T02 handleLateSourceChanges (carry eller stopp, aldrig tyst förlorad), T03 buildRollbackPlan (targetWritesCarriedBack + käll-writer återaktiveras + konsistensverifiering), 8 tester	2026-09-22 21:00:19 +02:00
admin	37ffd5bd94	feat(HSP-067): exit-manifest — T01 open formats only (portabel till icke-SIAX-mål), T02 notice-krav följer tillåtna artefakter, T03 nonExportable EXPLIKIT med skäl (aldrig tyst utelämnat), 7 tester	2026-09-22 20:46:58 +02:00
admin	45dd7dc6e2	feat(HSP-067): exit-manifest — T01 open formats only (portabel till icke-SIAX-mål), T02 notice-krav följer tillåtna artefakter, T03 nonExportable EXPLIKIT med skäl (aldrig tyst utelämnat), 7 tester	2026-09-22 20:14:20 +02:00
admin	57d5ff36fe	feat(HSP-083): migration-runner — InMemoryCheckpointStore (T02 cursor commit EFTER durable target-ack), idempotent-sink replay-säkerhet (T01 krasch → replay räknad, inga dubbletter), T03 VERIFIED kräver per-partition content-hash (count-only = UNVERIFIED), 6 tester	2026-09-22 16:55:08 +02:00
admin	23d05d9379	feat(HSP-082): migration-mapping — decideEntityMerge (T01 identiska namn EJ ihopslagna utan bevis), transformRecord (T02 åäö byte-exakt + UTC-normalisering med original-offset), aclBlockingCheck (T03 saknad ACL-mappning BLOCKERANDE), 10 tester	2026-09-22 15:37:35 +02:00
admin	c1c7a33d65	feat(HSP-081): discovery-inventory — inventory-report (T01 write-scoped sources EXCLUDED från inventeringen, T02 persondata REDACTED till referenser rekursivt, T03 otillgängliga källor = okända med real fel — aldrig tyst droppade), 6 tester	2026-09-22 15:05:29 +02:00
admin	c7fd9d45a2	fix(prod): map SiaxError in the 7 legacy money routes — DEPENDENCY_UNAVAILABLE/503 instead of opaque 500 (0pt#53) ... getSqlForDurableStore throws SiaxError(DEPENDENCY_UNAVAILABLE, httpStatus 503, retryable) when a money-bearing store would fall back to an in-memory Map in a production runtime (the durable-store guard). The /api/0pt/* surface already maps it via src/http/siax-error-response.ts; the seven legacy routes outside the middleware matcher did not — the documented 503 leaked as Next's opaque 500 with no body. - app/api/siax-error-mapping.ts: shared isSiaxError + siaxErrorResponseForLegacy - orders (POST/GET), orders/[id] (GET/PATCH), subscriptions (GET/POST), payments/deposit, payments/release, admin/metrics: try/catch -> mapper, each route's own typed error contract preserved (idempotency conflict 409 etc.) - webhooks/stripe: store outage -> 503 received:false reason:store_unavailable so Stripe's delivery retry path stays open (never a silent received:true) - tests/api/legacy-routes-siax-error-mapping.test.ts: pins the 503 + body	2026-09-22 04:33:57 +02:00
siax-bot	a049096d4a	Merge pull request 'feat(X-737): Synthetic Data Factory (0pt dataset-truth + INF0-generering)' (#77) from feat/x737-synthetic-factory into main	2026-09-21 11:14:41 +00:00
admin	8411f9759e	feat(X-737): Synthetic Data Factory — sampling→synthesis (INF0-port)→PII/privacy (fail-closed före publish)→quality→dedupe→contamination→deterministisk train/val/test-split; provenance per rad (policy+model+source+sha256). 5/5 tester	2026-09-21 13:07:54 +02:00
admin	422380d0ed	test(BTI): DAT-04/05 dataset version acceptance tests ... - DAT-05-A1: monotonic versions, immutability - DAT-04-A2: estimated schema_version in manifest - 1054 tests green	2026-09-18 01:41:55 +02:00
admin	a1557b2a7d	feat(payments): bind orders to verified tenant and buyer	2026-09-15 19:53:58 +02:00
admin	cecc2bc637	fix(payments): authenticate order detail and deposit checkout	2026-09-15 19:09:53 +02:00
admin	7ce92827c0	fix: close demo payment bypass and guard order transitions	2026-09-15 18:52:23 +02:00
admin	ae190fa60d	fix: advance orders only after matching paid Stripe events	2026-09-15 18:15:42 +02:00
admin	8911709931	fix: do not acknowledge unverified Stripe webhooks	2026-09-15 18:08:13 +02:00
Simon AxelssonandClaude Opus 5	8ebc90ffa3	fix(security,repo-honesty): real security headers + a doctor that checks truth, not presence ... Two defects of the same kind: the repo asserted things about itself that were not true, and nothing in it could tell. A. CHANGELOG.md claimed CSP/HSTS/X-Frame-Options since 2026-08. `main` contained none of it -- a repo-wide grep for `content-security-policy|strict-transport-security|x-frame-options` matched exactly one file, CHANGELOG.md itself. The only header on 0pt.app was Vercel's own HSTS default, which does not survive the move to Coolify/Traefik that siax.config.json and .gitea/workflows/cd.yml are already pointed at. - next.config.mjs: `headers()` on `/(.*)` with CSP (frame-ancestors 'none', base-uri 'self', object-src 'none', form-action 'self'), HSTS, X-Frame-Options DENY, X-Content-Type-Options, Referrer-Policy, Permissions-Policy; plus poweredByHeader: false. Same idiom as sax3l/siax-io's next.config.mjs. - Carve-outs re-derived against THIS tree, not inherited: the stale `ci/security-headers-and-scanning` branch (8d2ff73, 142 commits behind) carried a `form-action https://checkout.stripe.com` allowance justified by a redirect that is actually `window.location.href`, which form-action does not govern -- dropped rather than kept as decorative permission. frame-src is derived from NOCODB_BASE_URL/METABASE_SITE_URL, the same env the components/embed.tsx iframe is configured from, so wiring that component up cannot be silently blanked by this header (the failure sax3l/siax-io recorded as SIO-013). 'unsafe-eval' is dev-only. - tests/security/security-headers.test.ts: blocking regression gate inside `pnpm run test`, i.e. the required "CI (SIAX Cloud) / quality" context. Asserts against expectations written out in the test, not imported from the config. Proven to fail: removing X-Frame-Options -> `pnpm run test` exits 1; weakening frame-ancestors to 'self' -> exits 1. B. scripts/siax-doctor.mjs validated that siax.repo.json fields were PRESENT, never what they said. Measured on this tree: operationalState "running" (false) and "down" (true) both gave 40/40, exit 0, byte-identical output. - Value checks (enums, git.siax.io const, fleet node pattern, bare-hostname form), cross-file consistency (declared prod hostnames must appear in this repo's own siax.config.json / contracts/openapi.yaml, and vice versa), and GOV-06 substantiation: operationalState must be backed by a dated probe record in evidence/operational-state.json that agrees with it. Liveness is not knowable offline; whether a liveness CLAIM is backed is. Offline, deterministic, no network -- CI can never go red for want of an internet connection. - `--live` (opt-in) probes the declared hosts for real and checks the headers on the wire; `--write-evidence` refreshes the record. Not wired into CI on purpose. - tests/repo/siax-doctor.test.ts runs the doctor inside `pnpm run test` and asserts the negative cases against fixture trees (SIAX_DOCTOR_ROOT), so the "cannot fail" defect cannot come back. C. CHANGELOG.md is now true. The header claim stands; the four claims it was bundled with (Trivy --exit-code 1, gitleaks, SHA-pinned actions, SBOM + license artifacts) are still false on main and are listed as not implemented instead of left asserted. All four live in .gitea/workflows/**, a protected path on this repo, so they need an authorised workflow change. Nothing under .gitea/workflows/** or .gitignore is touched. Verified: pnpm run typecheck exit 0; pnpm run test exit 0 (74 files / 965 tests passed, up from 72/945); pnpm run build exit 0 and the built .next/routes-manifest.json carries all six headers; node scripts/siax-doctor.mjs 55/55 exit 0; --live 57/57 exit 0. eslint on the new files exit 0 (repo lint is advisory and its 17 pre-existing problems are unchanged). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-15 02:43:32 +02:00
adminandClaude Sonnet 5	d41f30535b	fix(test): replay full migration chain in source-registry realinfra test ... tests/p0/source-registry-postgres.realinfra.test.ts only applied sql/002_source_registry.sql before running assertions. sql/007_ingestion_plane.sql later added opt_sources.owner_id, and src/repositories/postgres-source-repository.ts's INSERT has named that column ever since -- but nothing caught the drift because SOURCE_REGISTRY_TEST_DATABASE_URL is never set in CI (.gitea/workflows/ci.yml has no job that sets it), so this suite has silently skipped in every CI run. Verified against a real disposable Postgres 16 container: before this fix, all 7 tests failed with `column "owner_id" of relation "opt_sources" does not exist`; after replaying every sql/*.sql file in order (same pattern already used by tests/analytics/analytics-domain-postgres.realinfra.test.ts), all 7 pass. Found while auditing 0pt's Analytics/BI layer (MetricFlow/Cube/ClickHouse/ Trino/DuckDB) and standing up real Postgres/ClickHouse containers to verify those claims for real; this bug is adjacent (source registry, not analytics) but was directly encountered and is a small, safe, test-only fix. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-15 02:40:52 +02:00
admin	17bd1b40a0	feat(0pt): record legitimate-interest stance — B2B contacts, company-linked only ... Recorded decision (Simon 2026-08-31): personal data may be stored under legitimate interest ONLY as business contacts bound to a company/org entity. Gate enforces it: legitimate_interest requires purpose=business_contact and entity_linked_only=true; recordStored() requires entity_id (orgnr/rgs/LEI, hashed) and refuses person-only rows. +1 test; suite 167 pass | 1 skip; typecheck clean.	2026-09-15 02:40:52 +02:00
admin	12080fc517	feat(0pt): PII-Gate GDPR-guardrail for personal-data sources (fail-closed) ... PiiGateService makes any future personal-data source (ratsit.se and other directory domains) technically GDPR-OK before the first byte is stored: - recorded legal basis (art. 6) with basis_ref evidence, no policy => fail-closed - data minimisation via field allowlist (art. 5(1)(c)) - storage limitation + enforceRetention purge (art. 5(1)(e)) - sha256-only identity keys + log redaction (art. 25/32) - accessStatement / erase subject-rights surfaces (art. 15/17) - robots/rate confirmation required for web+api sources; no stealth/bypass - audit trail via AUD0 at risk L3 (0pt.pii_*) - gate enabled by default in SourceQueryService 10 new tests; full suite 166 pass | 1 skip; typecheck (blocking gate) clean.	2026-09-15 02:40:52 +02:00
adminandClaude Sonnet 5	4caf122129	fix(security): add SSRF guard to Fabric/OneLake adapter's sqlEndpoint ... connection_config.sqlEndpoint on POST /api/0pt/sources/{sourceId}/query was passed straight from the request body to the mssql TDS driver as the outbound connection target, with only its http(s):// scheme stripped — no hostname allowlist or private/loopback/link-local/cloud-metadata guard. This route already requires a Zitadel bearer token + tenant match (P014 tenant guard), so this was not anonymously exploitable, but it is the exact SSRF shape found and exploited-in-principle elsewhere in this estate tonight (press0), so it's worth closing as defense-in-depth. Adds src/lib/security/ssrf-guard.ts: resolves the endpoint's hostname and rejects any address in a private/loopback/link-local/cloud-metadata/ unspecified range (RFC1918, 127.0.0.0/8, 169.254.0.0/16 incl. the 169.254.169.254 metadata address, ::1, fc00::/7, fe80::/10, IPv4-mapped IPv6), failing closed on DNS resolution errors. The range-check logic is ported 1:1 from press0's src/lib/security/ssrf-guard.ts built the same night for the same bug class against a fetch()-based URL there; this module's surface differs because sqlEndpoint is a bare host[:port], not a fetchable URL. The DNS lookup is injectable (mirrors this adapter's existing fetchImpl pattern) so tests are hermetic. FabricOneLakeAdapter.getPool() now calls the guard before loadDriver()/ getToken()/opening the TDS pool, so a blocked target never reaches a real outbound connection attempt or spends an AAD token exchange. Tests: new tests/p0/fabric-onelake-ssrf-guard.test.ts unit-tests the guard module directly (range boundaries, IPv4-mapped-IPv6 bypass attempt, fail-closed on DNS failure/empty answer). New adapter-level tests in tests/p0/fabric-onelake-adapter.test.ts prove (a) a private-IP-resolving sqlEndpoint is rejected before fetch/connect is ever called, (b) a literal loopback sqlEndpoint is rejected the same way, and (c) a normal external Fabric hostname still passes the guard and completes the query — the guard doesn't false-block legitimate targets. Existing adapter tests are updated to inject a deterministic DNS resolver so they stay hermetic instead of depending on real DNS. Full suite: 997 passed, 0 failed, 184 skipped (self-skipping realinfra tests with no live backend this run). typecheck and lint clean on all touched files. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-11 02:18:23 +02:00
adminandClaude Opus 5	db868f4bdf	fix(prod): close legacy storage fallbacks in orders/subscriptions/blobs ... The `resolveStoreMode` kill switch (Master-DoD §3/§10) covered the newer `src/repositories/*` stores but not two older paths, both of which are live production execution paths today. 1. LEGACY NEXT.JS STORES. `lib/orders-store.ts` and `lib/subscriptions-store.ts` predate `src/platform/dependency-mode.ts` and called `getSql()` directly, silently falling back to module-global `Map`s when no database is configured. For orders, payments and subscriptions that is not a degraded mode, it is invisible loss of money-bearing state: the API returns 201 and the row evaporates on the next restart or on any other replica. The live 0pt deployment (Coolify app 54) runs NODE_ENV=production with DATABASE_URL, POSTGRES_URL and POSTGRES_PRISMA_URL all unset — so this is the behavior in production right now, across 7 API routes. These now go through `getSqlForDurableStore()`, which reuses the SAME `resolveStoreMode` decision every `src/repositories/*` store already uses rather than re-implementing a second production check. The reuse is load-bearing: `isProductionRuntime` deliberately exempts `NEXT_PHASE=phase-production-build`, because `next build` runs page-data collection under NODE_ENV=production while serving nothing. A naive `process.env.NODE_ENV === "production"` test here would have failed the BUILD instead of protecting a request path. 2. LOCALBLOBSTORE. It writes document bytes to a container-local disk while `document-capture-service` registers an artifact pointer claiming the bytes are stored — durable object storage silently swapped for ephemeral disk. It is the default blob store for both the capture and extraction services. In production it now raises DEPENDENCY_UNAVAILABLE (capability blocked: no ST0RE bytes path exists yet) instead of fabricating success. Asserted per-operation, not in the constructor, so merely wiring the services is not fatal — only actually persisting or reading bytes is. Evidence: full suite 956 passed / 184 skipped, typecheck clean, dependency-cruiser 0 errors, lint identical to main's pre-existing baseline (17 problems, none in changed files). Both guards asserted in both directions and mutation-tested: bypassing resolveStoreMode -> 2 failed; dropping the write assert -> 2 failed; dropping the read assert -> 1 failed; all restored -> 8 passed. 7 non-test call sites. DEPLOYMENT NOTE: merging changes no runtime (no Gitea webhook exists on any repo; deploys are manual). Deploying this build REQUIRES provisioning DATABASE_URL for 0pt first, or the order/subscription routes will correctly return DEPENDENCY_UNAVAILABLE instead of silently accepting orders into memory. That provisioning is a Simon action. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-09 17:38:51 +02:00
admin	2d34cb1629	feat(P-001, P-002): 0pt→N0D quality delegation + internal OpenAPI	2026-09-08 22:38:47 +02:00
admin	3edc56dcdb	fix: slutgranskning av dataset/search/ER-ytorna + STATUS-sanning ... Slutgate inför merge (per fortsättningsplan): Kontrakt: CreateDatasetVersionInput.artifact_refs → readonly string[] (anropare får skicka 'as const'; servicen muterar aldrig); postgres.js tx.array() får muterbar kopia vid INSERT. Testkorrigeringar (stale mot starkare implementation — aldrig svagare): - entity-resolution-http: request(body, undefined) triggade default-param och skickade GILTIGT token → 200. Tomt token = 'utan token' → 401 fail-closed. - entity-resolution: /two records/ → /between 2 and 5000/ (bounds-aware validering) - search-service: omformat purpose-filter-test + NY negativ kontroll — rebuild avvisar dokument utan purpose_tags (fail closed, generation discarded) - dataset-postgres.realinfra: sätter DATABASE_URL i setup så den durabla AUD0-outboxen aktiveras (testet ljög annars om durabilitet) — 5/5 mot live Postgres STATUS.md: AUD0-klient + lineage-rader (outbox nu real-infra testad), gap-listan (persistence/routes/outbox stängda, exakt vad som återstår), P065 STÄNGD med closure-record (thin adapter, v3-semantik, hard-negative transitivitet, fail-closed 401 — 4/4 planpunkter verifierade). Verifierat: typecheck EXIT 0 · 945/945 unit · 5/5 real-Postgres · next build EXIT 0	2026-09-07 19:31:22 +02:00
admin	ed1abc4cd4	test: prove search definitions survive restart across Postgres and OpenSearch	2026-09-07 18:12:50 +02:00
admin	d45eb74772	test(er): cover country-qualified stable identifiers	2026-09-07 18:09:46 +02:00
admin	7e2b5304b7	test(er): pin review-only fuzzy company boundary	2026-09-07 18:08:24 +02:00
admin	851e43d8db	test: prove dataset registry and versions against real Postgres	2026-09-07 18:05:15 +02:00
admin	6a687212a1	test: pin lineage queued-vs-emitted semantics	2026-09-07 17:59:20 +02:00