319 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
admin	203eafb34b	Merge pull request #66	2026-09-17 00:00:25 +02:00
siax-bot	b0aad9001e	Merge pull request 'feat(payments): verified tenant-owned 0pt orders' (#69) from feat/payment-order-ownership-wave49 into fix/stripe-webhook-no-ack-without-secret-wave47	2026-09-15 19:04:04 +00:00
admin	a1557b2a7d	feat(payments): bind orders to verified tenant and buyer	2026-09-15 19:53:58 +02:00
admin	f976f36530	fix(ci): avoid duplicate live integration jobs on branch push	2026-09-15 19:35:25 +02:00
admin	cecc2bc637	fix(payments): authenticate order detail and deposit checkout	2026-09-15 19:09:53 +02:00
admin	c7f8b3f651	docs: gate 0pt cutover on buyer-bound live payments	2026-09-15 18:53:35 +02:00
admin	7ce92827c0	fix: close demo payment bypass and guard order transitions	2026-09-15 18:52:23 +02:00
admin	ae190fa60d	fix: advance orders only after matching paid Stripe events	2026-09-15 18:15:42 +02:00
admin	8911709931	fix: do not acknowledge unverified Stripe webhooks	2026-09-15 18:08:13 +02:00
siax-ci	7555f3d504	chore(release-chain): evidence for sha-946baef8434d [skip ci]	2026-09-15 13:26:03 +00:00
admin	946baef843	fix(deps): js-yaml 4.3.0 -> 4.3.2 (CVE-2026-84375 HIGH, DoS i YAML — transitive via des1gn-m0-vågen; trivy-gaten blockerade annars main)	2026-09-15 15:24:56 +02:00
siax-ci	fb45e369cf	chore(release-chain): evidence for sha-0b53c4bfd5c6 [skip ci]	2026-09-15 13:12:49 +00:00
admin	0b53c4bfd5	fix(deps): lockfile för des1gn-m0-mergen — @siax/ui 0.4.1 saknades i pnpm-lock (parallellsessionens merge tog package.json utan lås-regenerering; ERR_PNPM_OUTDATED_LOCKFILE bröt quality/integration/release-chain)	2026-09-15 15:11:52 +02:00
admin	18d57a1e99	Merge remote-tracking branch 'origin/feat/des1gn-m0'	2026-09-15 15:00:47 +02:00
siax-ci	f6977c4742	chore(release-chain): evidence for sha-7f3df904b741 [skip ci]	2026-09-15 12:51:13 +00:00
admin	7f3df904b7	ci: re-trigger (integration dog på runner-glitch: OCI chdir /workspace — stale-runner-mönstret, rerun räcker)	2026-09-15 14:49:41 +02:00
siax-ci	8e5fa88b54	chore(release-chain): evidence for sha-6a125e10ccc3 [skip ci]	2026-09-15 12:39:15 +00:00
admin	6a125e10cc	ci(release-chain): re-trigger — siax-ci-identiteten fullt verifierad (release-ci-team authorize=write via DB; API:felt vägrar skriva permission-fältet; registry-push PUSH_OK som siax-ci)	2026-09-15 14:36:26 +02:00
admin	b383464795	ci(release-chain): re-trigger efter DELETE+PUT-sekretesrotation (PUT skriver ej över existerande Gitea-secrets — känd bugg)	2026-09-15 14:08:14 +02:00
admin	101dea83ae	ci(release-chain): verifierar den dedikerade identiteten siax-ci (REGISTRY_USER/TOKEN + SIAX_CI_TOKEN roterade från interim admin-token; org-team release-ci + repo-collaborator write)	2026-09-15 13:56:17 +02:00
siax-ci	fcfd6bca1e	M0: DES1GN-distribution — @siax/ui 0.4.1 + @siax/config + kanonisk import-kedja ... Token-VÄRDEN ägs av @siax/ui; token→Tailwind-mappningen ägs av @siax/config. Ingen in-repo token-kopia (M0-kontraktet). Bygg-CSS verifierad: SIAX-purple (#5326cc = oklch 0.45) + Inter + text-accent utility genererad.	2026-09-15 12:51:47 +02:00
siax-ci	508a2f34de	chore(release-chain): evidence for sha-8be11b6485d3 [skip ci]	2026-09-15 03:45:04 +00:00
admin	8be11b6485	fix(deps): package.json postcss-specifier ^8.5.28 (renovate PR#63:s package.json del glömdes i lockfile-merge-committen — lock:en pekar redan på ^8.5.28/8.5.28)	2026-09-15 05:43:13 +02:00
admin	38bf3520cd	Merge PR #63 (renovate: postcss 8.5.28) — lockfile semantiskt löst (main:s autoprefixer 10.5.5 + postcss uppdaterad i range), frozen-lockfile grön	2026-09-15 05:24:14 +02:00
siax-ci	2417954536	chore(release-chain): evidence for sha-a285c2f45f78 [skip ci]	2026-09-15 03:22:20 +00:00
admin	a285c2f45f	Merge PR #62 (renovate: autoprefixer 10.5.5)	2026-09-15 05:20:27 +02:00
siax-ci	9d51e021ed	chore(release-chain): evidence for sha-570352eb80d2 [skip ci]	2026-09-15 03:17:55 +00:00
admin	094d6e87e0	Merge branch 'main' into renovate/dev-dependencies-(non-major)	2026-09-15 03:17:49 +00:00
admin	dd28b52e49	Merge branch 'main' into renovate/autoprefixer-10.x-lockfile	2026-09-15 03:17:38 +00:00
admin	570352eb80	Merge pull request 'chore(deps): update dependency @types/react-dom to v19.2.7' (#61) from renovate/react-monorepo into main	2026-09-15 03:16:47 +00:00
Renovate	d8835d6e21	chore(deps): update dependency postcss to v8.5.28	2026-09-15 03:01:21 +00:00
Renovate	08b057f08e	chore(deps): update dependency autoprefixer to v10.5.5	2026-09-15 03:01:15 +00:00
Renovate	53e2d39ce7	chore(deps): update dependency @types/react-dom to v19.2.7	2026-09-15 03:01:09 +00:00
siax-ci	92edfe668c	chore(release-chain): evidence for sha-90ca9d6ec08b [skip ci]	2026-09-15 02:56:55 +00:00
admin	90ca9d6ec0	ci: re-trigger release+cd efter gate-retry-fixen (PR#60 mergad) — forväntan: signatur-fast-racet overlevs av retryen, cosign-verify GRÖN, Coolify-redeploy authoriserad av verifierad digest	2026-09-15 04:56:26 +02:00
admin	3ad992961d	Merge pull request 'fix(cd): signed-artifact-gate får retry på "no signatures found" (sign-racet mätt live)' (#60) from fix/cd-gate-verify-retry into main	2026-09-15 02:55:41 +00:00
admin	5669a0e9e7	fix(cd): gate får retry på 'no signatures found' — 8-sekunders-racet mellan release.yml:s push och cosign-sign mät live 2026-09-15 (pull 02:36:45, verify-fail 02:37:03, sign fast 02:37:11); hård fail kvar för äkta verify-fel	2026-09-15 04:50:53 +02:00
siax-ci	8de7e379e0	chore(release-chain): evidence for sha-2265dbb9a7cf [skip ci]	2026-09-15 02:37:09 +00:00
admin	2265dbb9a7	ci(release-chain): re-trigger #2 — REGISTRY/SIAX_CI_TOKEN tillbaka på admin-identitet (siax-bots ci-approvers-team har permission none -> 401 pa registry-push; dedikerad registry-user = rotationsobjekt) + push-whitelist klar	2026-09-15 04:36:37 +02:00
admin	745d22437c	ci(release-chain): re-trigger efter sekretesfix (SIAX_CI_TOKEN/REGISTRY -> siax-bot; push-whitelist admin+ci-approvers) — förra runen: steg 0-11 grön (bygg/push/SBOM/cosign-sign+verify), endast evidence-push nekad av protection	2026-09-15 04:21:37 +02:00
admin	00e69518de	Merge branch 'main' of https://git.siax.io/sax3l/0pt	2026-09-15 04:21:37 +02:00
admin	b1311678ac	Merge pull request 'feat(release-chain): bygg→push→SBOM→cosign-sign→verify + signed-artifact-gate i cd.yml (kl0ud/st0re-mönstret)' (#59) from fix/wire-signed-digest-to-deploy into main	2026-09-15 02:05:11 +00:00
admin	2ea63f46d1	Merge branch 'main' into fix/wire-signed-digest-to-deploy	2026-09-15 02:01:42 +00:00
admin	c7b429e999	Merge release-chain (från fix/wire-signed-digest-to-deploy): release.yml (bygg→push→SBOM→cosign-sign→verify→evidence-commit) + signed-artifact-gate i cd.yml + cosign.pub (nytt nyckelpar 2026-09-15; private i COSIGN_PRIVATE_KEY + Infisical /0pt/)	2026-09-15 03:58:10 +02:00
admin	a403424f47	fix(release-chain): cosign.pub = nyckelparet som sätts i repo-secrets (genererat 2026-09-15; det offline-genererade paret från 09-14 saknas i den här sessionen — nytt par, private-del går endast till repo-secret COSIGN_PRIVATE_KEY + Infisical)	2026-09-15 03:55:59 +02:00
admin	d637f41669	Merge PR #58 (engine: fail-closed X-Internal-Token-gate + commit-kedja i services/api)	2026-09-15 03:45:28 +02:00
admin	ff11216813	feat(engine): fail-closed X-Internal-Token-gate + commit-kedja (GIT_SHA) i services/api ... - X-Internal-Token skickades av edgen men verifierades ALDRIG — gate som raw-ASGI-middleware: INTERNAL_TOKEN satt => alla routes utom /health kräver exakt token, 401 (constant-time) annars. Ospecificerad token = inert (dev). - Dockerfile: ARG GIT_SHA + OCI-label + /health.reporting revision - compose var redan skriven för INTERNAL_TOKEN — motorn hade bara aldrig deployats med den - tester: tests/test_internal_token_gate.py (3: off/public/401-pass) — hela services/api-sviten 62 passed, 2 skipped (dokumenterade known-gaps), 0 fail	2026-09-15 03:38:43 +02:00
admin	201653a8e9	Merge PR #57 (operational-state evidence 2026-09-15)	2026-09-15 03:17:10 +02:00
admin	31671beb46	docs(evidence): färska prober 2026-09-15 — runtime healthy i SIAX Cloud (health ok/ready 200/headers live, edge-DB 60 tabeller), 0pt.app fortfarande Vercel 402 (DNS-cutover = Simon-punkt); operationalState förblir ärligt 'down'	2026-09-15 03:13:28 +02:00
admin	59018443de	Merge PR #56 (prod-merge-pass): PII-Gate GDPR-guardrail + realinfra-migration-test + security headers & repo-honesty doctor (omsluter PR #44)	2026-09-15 02:50:13 +02:00