112 Commits

Include renames

Author	SHA1	Message	Date
SIAX Agent	b97ad0b2f4	fix(auth): bind internal-service tenant authority to server config ... The first revision of this fix copied a CLIENT header (X-0pt-Internal-Tenant) or a single INTERNAL_TENANT_ID into x-0pt-verified-tenant. That is not an authorization source: any holder of the shared internal token could still name any tenant, leaving the original cross-tenant write reachable through a different header. - INTERNAL_SERVICE_TENANTS (server env) is now the only tenant authority for the X-Internal-Token principal; empty => no authority (fail closed, 403). - Middleware strips inbound x-0pt-verified-{tenant,sub} and the service scope header on every path, including the dev escape hatch. - x-0pt-verified-service-tenants carries the allowlist; the tenant guard checks membership and denies anything outside it. - POST /api/0pt/quality/bridge-run now runs the same tenant guard as canonical/facts (it auto-provisions tenant-scoped rules). - 16 new regression tests; auth + cross-tenant + canonical + bridge suites 87/87; tsc --noEmit clean.	2026-11-07 15:32:51 +01:00
admin	6ca6e8e0a6	feat(idempotency): operation-scope binding for upload identity ... Per the reap-use mandate: 'identical file + different instruction' is a DIFFERENT operation. bindOperationToUploadIdentity() folds instruction, field contract, model, data class and export format into the DOC0-compatible upload filename so the durable fingerprint covers every result-affecting input. The bytes' SHA-256 stays stable; DOC0 still receives the caller's x-idempotency-key (its own idempotency, its own contract). Classification: STANDARDIZE/0pt-owned (upstream DOC0 untouched).	2026-11-06 10:29:59 +01:00
admin	c46ebbf810	feat(0pt): canonical-fact machine route + renumber migration to 022 (#484)	2026-11-05 19:16:13 +00:00
admin	03cdb7815e	feat(0pt): canonical structured observations — entities, facts, relations (#480)	2026-11-05 17:53:34 +00:00
admin	063206d8b0	feat(auth): adopt @siax/auth-zitadel canonical claim normalizer	2026-11-04 02:23:21 +01:00
admin	92eb78ba0a	fix(upload): an idempotent retry returns the same verified receipt ... A client retry with the same idempotency key replayed the journal and got 'outcome_unknown' even when the first upload had succeeded, because the verified DOC0 receipt was never persisted. Store document/version/checksum/ stage on the attempt (sql/021) and return it on replay; only a missing receipt falls back to observation. No second POST, no duplicate document.	2026-11-03 00:35:32 +01:00
admin	dade37ee05	feat(credits): one-time trial grant so the ledger runs in production ... - Ledger accepts kind='grant' (a server-owned balance grant, not a payment). - OPT_TRIAL_CREDITS=N grants N credits once per tenant (idempotent key trial:<tenant>) on balance/structure, so reserve -> settle is exercised before any customer purchase. - sql/020 extends the kind constraint (re-runnable). - Tests for the grant helper; full suite 1345 passed.	2026-11-02 22:05:06 +01:00
admin	c4a7b83f61	feat(auth): central Keycloak portal-trust (KEYCLOAK_ISSUER/audience/azp)	2026-11-02 18:45:40 +01:00
admin	c7187368de	fix(workbench): accept a JSON-number decimal and deliver the source's exact string ... The local model returns 12500.00 as a JSON number, which the contract rejects as a non-string decimal. A numeric value now matches a source span numerically and the delivered value is rewritten to that span's decimal string (12500.00), so precision is preserved instead of rounded. Exact string equality is still required for string decimals, and ambiguous formats still go to review.	2026-11-02 18:07:52 +01:00
admin	8b571cf2f4	fix(decision-ollama): use Ollama's native JSON mode without thinking ... The 9B model spent its whole 4000-token budget on reasoning and came back model_incomplete. Call /api/chat with format=json, think=false and num_predict, and read prompt_eval_count/eval_count/done_reason. Structured extraction no longer needs chain-of-thought.	2026-11-02 17:51:09 +01:00
admin	6c4f1998dc	feat(workbench): locale-aware decimal/date evidence without an AI dependency ... A source span now supports a decimal ('12 500,00' -> '12500.00') or a date ('14/10/2026' -> '2026-10-14') when the reading is unambiguous. Ambiguous formats (01/02/2026, 1,234) still go to review. Evidence derivation scans the source for typed candidates, so the local decision-server model only has to return values, not UTF-16 offsets.	2026-11-02 17:39:31 +01:00
admin	c33d88f0ea	fix(workbench): tolerate flat or fenced JSON from a small local model ... The decision-server model sometimes returns {field: value} or wraps the JSON in a markdown fence. Accept both, while still requiring every value to be an exact, unique substring of the source before it can be validated.	2026-11-02 17:18:34 +01:00
admin	525bf6b9a0	feat(workbench): use the decision server's local model while the AI API is on hold ... - DecisionOllamaGatewayClient calls the self-hosted Ollama on server-decision-01 (tailnet HTTP only for loopback/RFC1918/100.64-127), keeps the same local admission and reports providerKind=local. - createInf0Gateway prefers it over INF0/LiteLLM when configured. - Evidence is computed deterministically from values when a small model omits offsets; a value must occur exactly once in the source or the result goes to review. This makes a 9B local model usable without weakening verification. Tests: 4 new gateway cases + 2 evidence-derivation cases; full typecheck green.	2026-11-02 17:09:42 +01:00
admin	48dff2078e	fix(admission): zero maximumCredits means pilot mode, not a missing reservation ... The structure route ran the model with maximumCredits=1 and no reservation when credits were off, so admission returned reservation_required and the route answered 502. Admission now requires a reservation only when maximumCredits>0. Verified against the live stack: DOC0 segments -> LiteLLM/Ollama (inf0-valuation) -> evidence validation -> needs_review (no export).	2026-11-02 16:42:01 +01:00
admin	e93db5fc1f	fix(doc0): call DOC0 as the granted service actor ... DOC0 denies an x-actor-id that the service identity has no actor_grant for, so every upload/structure call from 0pt failed with DOC0_ACCESS_DENIED and became outcome_unknown. The journal and project authorization keep the verified end-user actor; only the DOC0 request acts as the service (DOC0_SERVICE_ACTOR_ID).	2026-11-02 16:17:29 +01:00
admin	e3c4bc28c3	feat(workbench): live LiteLLM gateway adapter + explicit project grants ... - createInf0Gateway prefers the live OpenAI-compatible LiteLLM gateway and falls back to the native INF0 surface; admission stays local and fail-closed. - Project authorization: OpenFGA when configured, otherwise a validated server-owned OPT_PROJECT_GRANTS list (deny by default). - Tests for the gateway adapter, the factory and grants.	2026-11-02 14:50:50 +01:00
admin	b3239487b7	feat(document-workbench): wire customer upload, structuring, credits and readiness ... - POST /api/0pt/documents/upload: real multipart bytes into DOC0 through the durable attempt journal and the existing coordinator; verified tenant/actor only, project authorization fail-closed. - POST /api/0pt/documents/structure: DOC0 segments -> INF0 -> evidence-bound validation -> optional JSON/CSV export, with credit reserve/settle. - Credits: balance, server-owned price book, Stripe Checkout and idempotent webhook reconciliation via a Stripe re-read of session + payment intent. - /portal/dokument and /portal/krediter: SIAX-styled workspace. - @siax/access: universal, framework-neutral OpenFGA project relationship primitive reusable by DOC0/N0D/other products. - Readiness: real Redis PING probe instead of presence-only; queue is now a live dependency when configured. - Dockerfile: copy every workspace manifest so --frozen-lockfile works. - Format/build hygiene: .prettierignore, .worktrees ignored, valid manifest YAML.	2026-11-02 14:46:10 +01:00
admin	d56ccbb542	feat: validate and export evidenced document batches	2026-11-02 08:37:11 +01:00
admin	c1244a298c	fix: bind DOC0 upload receipts to original request	2026-11-02 08:24:18 +01:00
admin	243c45c0f2	Merge pull request 'Enforce tenant isolation for document credit storage' (#422) from codex/credit-ledger-tenant-rls into main	2026-11-02 06:41:36 +00:00
admin	0f734297ce	fix: enforce tenant isolation on credit storage	2026-11-02 07:39:35 +01:00
admin	da5a7f403e	fix: bind model results to immutable evidence and policy	2026-11-02 07:34:47 +01:00
admin	ce41d601f7	feat: coordinate journaled document upload attempts	2026-11-02 07:17:32 +01:00
admin	47e0264571	fix: stabilize DOC0 upload fingerprint metadata	2026-11-02 06:52:50 +01:00
admin	cf37a66d35	feat: persist scoped document upload attempts	2026-11-02 03:48:13 +01:00
admin	f79853d156	feat: inspect document upload journal from 0pt	2026-11-02 03:06:56 +01:00
admin	eec8cb2396	feat: validate source-backed decimals and dates	2026-11-02 02:20:54 +01:00
admin	4d56a1dd62	fix: reconcile uncertain document uploads	2026-11-02 02:17:55 +01:00
admin	70b92e2fea	fix: secure document upload transport	2026-11-02 02:09:45 +01:00
admin	daa0a2415f	feat: add evidence-checked document exports	2026-11-02 02:03:48 +01:00
admin	bd1c20edb2	feat: add guarded document workbench foundations	2026-11-02 01:26:36 +01:00
admin	3279fa0533	fix(lint): eslint-undantag på rätt rader — json:any i graph-adapter + require-fixtures ... eslint-disable-next-line gällde nästa rad; json:any-linen behövde eget undantag. npm run lint: 0 errors (8→0). 1141/1141.	2026-09-29 12:50:06 +02:00
admin	1b6140a16a	fix(lint): rotfelsa ärvd lint-skuld — graph-adapter + p0-tester (blockerade #128) ... Parallellsessions-merge lämnade 12 eslint-errors på main (no-explicit-any i graph-mailbox-adapter + 2 p0-tester). Graph-JSON:n är genuint ostrukturerad — medveten, avgränsad eslint-undantag med skäl (DoD §13); p0-testerna typade med Record/cast. Lint 0 errors; tsc grön; 1141/1141.	2026-09-29 12:31:34 +02:00
Claude CodeandClaude Sonnet 5	07158099ee	feat(ingestion): VehIQ OLTP -> ClickHouse watermark extractor (P070) ... Implements Simon's specified pattern (dealer_stock_entry/deal -> watermark/updated_at -> 0pt ingestion -> ClickHouse) as a P061 connector pair (PostgresWatermarkConnector, PostgresKeyedLookupConnector) plugged into the existing P062 IngestionRunner, writing to opt_dataset_projection via SiaxAnalyticsEngine.ingestProjection. Built here, not in admin/vehiq: that repo's own ADR-0035 (decisions 1/2/10, CI-enforced by validate_engine_firewall.py) forbids VehIQ code from ever holding a ClickHouse credential or hammering OLTP directly for analytics. See docs/P070_VEHIQ_OLTP_EXTRACTOR.md for the full rationale. Also corrects a real schema mismatch found while building this: production has no generic `updated_at` on any of the three target tables (verified live, read-only, 2026-09-25). dealer_stock_entry/deal use listed_at/ created_at as insert-time watermarks instead (documented caveat: in-place updates are not caught without a schema change); app.listing has no timestamp column at all and is deliberately not covered yet. Vehicle dimension lookup is narrow by construction: keyed on exactly the vehicle_id set referenced by the batch just read, never a scan of the 98M-row vehiq.vehicle table (connector-level validate() refuses that table by name; runner-level tests assert the query only ever touches referenced IDs). Verified: fixture-backed connector/runner tests (watermark+limit, same-timestamp tie at a page boundary, crash/resume, empty-table case, narrow-lookup query-count assertions) + a real disposable Postgres container (caught two real Date-handling bugs fixtures could not) + a read-only proof against actual production (server10, vehiq-db): the extractor's exact SQL returns zero rows, no error, confirming it is safe to schedule with zero current effect. .gitea/workflows/vehiq-oltp-ingest.yml is present, cron-scheduled, and defaults to VEHIQ_INGEST_MODE=preview (read-only, never writes) with no secrets configured — safe to merge with zero production effect until explicitly activated per the doc's "what activating this requires". Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-25 19:11:15 +02:00
Claude Code	dd4731aa3c	feat(decision): Jev ER auto-match shadow (0PT_DECISION_ER_SHADOW) ... Shadow-eval av D0 auto-match: D0-tröskeln förblir auktoritet, kvaliteten mäts fire-and-forget mot siax-decision (:4600, decisionId 0pt.er.auto_match). Gate 0PT_DECISION_ER_SHADOW=1 (OFF by default). Fail-closed: gate-off/fel/ABSTAINED påverkar aldrig det deterministiska svaret; decision-planen loggar inbyggt (AUD0). - packages/decision: erAutoMatchShadow + erAutoMatchShadowEnabled - src/er/comparePair: void erAutoMatchShadow(...).catch(() => null) - tests/p0/decision-er-shadow.test.ts: gate-off/on, POST-body, DECIDED/ABSTAINED, fetch-fel, fire-and-forget-wire (16 nya tester)	2026-09-23 16:53:55 +02:00
admin	f3658e2577	fix(FAS 36): ER-decision-importen via workspace-paketet @siax/0pt-decision (relativ path utanför root bröt Turbopack-builden — pre-existerande bugg från fc1a62b, exponerad av färsk pnpm-install i worktree)	2026-09-23 03:07:57 +02:00
Claude Code	fc1a62bb81	feat: decision-plane wiring — ER-pair decision.match tie-break (@siax/0pt-decision) ... - packages/decision: erMatchDecision (0pt.er.pair_match mot siax-decision :4600) - comparePair async + borderline-band (±0.05 av review_threshold) → decision.match (D1 advisory) — deterministisk status GÄLLER om decision abstainar - OPT_DECISION_ER_ENABLED=1-gate (off tills kalibrering) - tests async-anpassade (await generateCandidates/rejects.toThrowError) - typecheck: 13 fel = pre-existing extraction-route (main-paritet), 0 nya fel - tester: 1108 passed | 184 skipped	2026-09-23 00:15:27 +02:00
admin	655a71ebd7	feat(HSP-085): migration-studio — T01 ej importerbart döljs EJ ur nämnaren (ratio = importable/total), T02 session-resume med tenant-check + checkpoint + resolved conflicts, T03 coverage-claim SCOPED (aldrig komplett M365-ersättning), 8 tester	2026-09-22 22:18:01 +02:00
admin	85b0e6cd72	feat(HSP-084): cutover — T01 detectDualWriters (båda aktiva = STOPPAD), T02 handleLateSourceChanges (carry eller stopp, aldrig tyst förlorad), T03 buildRollbackPlan (targetWritesCarriedBack + käll-writer återaktiveras + konsistensverifiering), 8 tester	2026-09-22 21:00:19 +02:00
admin	45dd7dc6e2	feat(HSP-067): exit-manifest — T01 open formats only (portabel till icke-SIAX-mål), T02 notice-krav följer tillåtna artefakter, T03 nonExportable EXPLIKIT med skäl (aldrig tyst utelämnat), 7 tester	2026-09-22 20:14:20 +02:00
admin	57d5ff36fe	feat(HSP-083): migration-runner — InMemoryCheckpointStore (T02 cursor commit EFTER durable target-ack), idempotent-sink replay-säkerhet (T01 krasch → replay räknad, inga dubbletter), T03 VERIFIED kräver per-partition content-hash (count-only = UNVERIFIED), 6 tester	2026-09-22 16:55:08 +02:00
admin	23d05d9379	feat(HSP-082): migration-mapping — decideEntityMerge (T01 identiska namn EJ ihopslagna utan bevis), transformRecord (T02 åäö byte-exakt + UTC-normalisering med original-offset), aclBlockingCheck (T03 saknad ACL-mappning BLOCKERANDE), 10 tester	2026-09-22 15:37:35 +02:00
admin	c1c7a33d65	feat(HSP-081): discovery-inventory — inventory-report (T01 write-scoped sources EXCLUDED från inventeringen, T02 persondata REDACTED till referenser rekursivt, T03 otillgängliga källor = okända med real fel — aldrig tyst droppade), 6 tester	2026-09-22 15:05:29 +02:00
siax-bot	a049096d4a	Merge pull request 'feat(X-737): Synthetic Data Factory (0pt dataset-truth + INF0-generering)' (#77) from feat/x737-synthetic-factory into main	2026-09-21 11:14:41 +00:00
admin	8411f9759e	feat(X-737): Synthetic Data Factory — sampling→synthesis (INF0-port)→PII/privacy (fail-closed före publish)→quality→dedupe→contamination→deterministisk train/val/test-split; provenance per rad (policy+model+source+sha256). 5/5 tester	2026-09-21 13:07:54 +02:00
admin	a1557b2a7d	feat(payments): bind orders to verified tenant and buyer	2026-09-15 19:53:58 +02:00
admin	17bd1b40a0	feat(0pt): record legitimate-interest stance — B2B contacts, company-linked only ... Recorded decision (Simon 2026-08-31): personal data may be stored under legitimate interest ONLY as business contacts bound to a company/org entity. Gate enforces it: legitimate_interest requires purpose=business_contact and entity_linked_only=true; recordStored() requires entity_id (orgnr/rgs/LEI, hashed) and refuses person-only rows. +1 test; suite 167 pass | 1 skip; typecheck clean.	2026-09-15 02:40:52 +02:00
admin	12080fc517	feat(0pt): PII-Gate GDPR-guardrail for personal-data sources (fail-closed) ... PiiGateService makes any future personal-data source (ratsit.se and other directory domains) technically GDPR-OK before the first byte is stored: - recorded legal basis (art. 6) with basis_ref evidence, no policy => fail-closed - data minimisation via field allowlist (art. 5(1)(c)) - storage limitation + enforceRetention purge (art. 5(1)(e)) - sha256-only identity keys + log redaction (art. 25/32) - accessStatement / erase subject-rights surfaces (art. 15/17) - robots/rate confirmation required for web+api sources; no stealth/bypass - audit trail via AUD0 at risk L3 (0pt.pii_*) - gate enabled by default in SourceQueryService 10 new tests; full suite 166 pass | 1 skip; typecheck (blocking gate) clean.	2026-09-15 02:40:52 +02:00
adminandClaude Sonnet 5	4caf122129	fix(security): add SSRF guard to Fabric/OneLake adapter's sqlEndpoint ... connection_config.sqlEndpoint on POST /api/0pt/sources/{sourceId}/query was passed straight from the request body to the mssql TDS driver as the outbound connection target, with only its http(s):// scheme stripped — no hostname allowlist or private/loopback/link-local/cloud-metadata guard. This route already requires a Zitadel bearer token + tenant match (P014 tenant guard), so this was not anonymously exploitable, but it is the exact SSRF shape found and exploited-in-principle elsewhere in this estate tonight (press0), so it's worth closing as defense-in-depth. Adds src/lib/security/ssrf-guard.ts: resolves the endpoint's hostname and rejects any address in a private/loopback/link-local/cloud-metadata/ unspecified range (RFC1918, 127.0.0.0/8, 169.254.0.0/16 incl. the 169.254.169.254 metadata address, ::1, fc00::/7, fe80::/10, IPv4-mapped IPv6), failing closed on DNS resolution errors. The range-check logic is ported 1:1 from press0's src/lib/security/ssrf-guard.ts built the same night for the same bug class against a fetch()-based URL there; this module's surface differs because sqlEndpoint is a bare host[:port], not a fetchable URL. The DNS lookup is injectable (mirrors this adapter's existing fetchImpl pattern) so tests are hermetic. FabricOneLakeAdapter.getPool() now calls the guard before loadDriver()/ getToken()/opening the TDS pool, so a blocked target never reaches a real outbound connection attempt or spends an AAD token exchange. Tests: new tests/p0/fabric-onelake-ssrf-guard.test.ts unit-tests the guard module directly (range boundaries, IPv4-mapped-IPv6 bypass attempt, fail-closed on DNS failure/empty answer). New adapter-level tests in tests/p0/fabric-onelake-adapter.test.ts prove (a) a private-IP-resolving sqlEndpoint is rejected before fetch/connect is ever called, (b) a literal loopback sqlEndpoint is rejected the same way, and (c) a normal external Fabric hostname still passes the guard and completes the query — the guard doesn't false-block legitimate targets. Existing adapter tests are updated to inject a deterministic DNS resolver so they stay hermetic instead of depending on real DNS. Full suite: 997 passed, 0 failed, 184 skipped (self-skipping realinfra tests with no live backend this run). typecheck and lint clean on all touched files. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-11 02:18:23 +02:00
adminandClaude Opus 5	db868f4bdf	fix(prod): close legacy storage fallbacks in orders/subscriptions/blobs ... The `resolveStoreMode` kill switch (Master-DoD §3/§10) covered the newer `src/repositories/*` stores but not two older paths, both of which are live production execution paths today. 1. LEGACY NEXT.JS STORES. `lib/orders-store.ts` and `lib/subscriptions-store.ts` predate `src/platform/dependency-mode.ts` and called `getSql()` directly, silently falling back to module-global `Map`s when no database is configured. For orders, payments and subscriptions that is not a degraded mode, it is invisible loss of money-bearing state: the API returns 201 and the row evaporates on the next restart or on any other replica. The live 0pt deployment (Coolify app 54) runs NODE_ENV=production with DATABASE_URL, POSTGRES_URL and POSTGRES_PRISMA_URL all unset — so this is the behavior in production right now, across 7 API routes. These now go through `getSqlForDurableStore()`, which reuses the SAME `resolveStoreMode` decision every `src/repositories/*` store already uses rather than re-implementing a second production check. The reuse is load-bearing: `isProductionRuntime` deliberately exempts `NEXT_PHASE=phase-production-build`, because `next build` runs page-data collection under NODE_ENV=production while serving nothing. A naive `process.env.NODE_ENV === "production"` test here would have failed the BUILD instead of protecting a request path. 2. LOCALBLOBSTORE. It writes document bytes to a container-local disk while `document-capture-service` registers an artifact pointer claiming the bytes are stored — durable object storage silently swapped for ephemeral disk. It is the default blob store for both the capture and extraction services. In production it now raises DEPENDENCY_UNAVAILABLE (capability blocked: no ST0RE bytes path exists yet) instead of fabricating success. Asserted per-operation, not in the constructor, so merely wiring the services is not fatal — only actually persisting or reading bytes is. Evidence: full suite 956 passed / 184 skipped, typecheck clean, dependency-cruiser 0 errors, lint identical to main's pre-existing baseline (17 problems, none in changed files). Both guards asserted in both directions and mutation-tested: bypassing resolveStoreMode -> 2 failed; dropping the write assert -> 2 failed; dropping the read assert -> 1 failed; all restored -> 8 passed. 7 non-test call sites. DEPLOYMENT NOTE: merging changes no runtime (no Gitea webhook exists on any repo; deploys are manual). Deploying this build REQUIRES provisioning DATABASE_URL for 0pt first, or the order/subscription routes will correctly return DEPENDENCY_UNAVAILABLE instead of silently accepting orders into memory. That provisioning is a Simon action. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-09 17:38:51 +02:00