475 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
admin	2ce59368d4	chore(deps): släpp pnpm-overrides — @siax/contracts ^0.11.1 + @siax/import-export ^0.2.2 + @siax/ui ^0.15.1 ... Overrides var kryckan så länge contracts 0.11.0/import-export 0.2.1 aldrig publicerats (release-infrastrukturbugg, DES1GN run 104822). Efter root-fixen (DES1GN #200) är 0.11.1/0.2.2 publika och ui 0.15.1 ships dem inline — overrides behövs inte längre. svit: 1187 passed · typecheck: OK · build: OK	2026-09-30 23:37:52 +02:00
admin	5def469190	Merge pull request 'fix(deps): patch HIGH/CRITICAL advisories (brace-expansion)' (#143) from fix/cve-lockfile-2026-09-30 into main	2026-09-30 20:52:27 +00:00
admin	c00e042399	Merge branch 'main' into fix/cve-lockfile-2026-09-30	2026-09-30 20:52:17 +00:00
admin	2419b76eb2	Merge pull request 'fix(manifest): provenRestore=true (restore-drill 2026-09-29)' (#146) from fix/prod-restore-2026-09-29 into main	2026-09-30 17:12:58 +00:00
admin	cf46fe6ac8	Merge branch 'main' into fix/prod-restore-2026-09-29	2026-09-30 17:12:49 +00:00
admin	8c562ad37b	Merge pull request 'fix(signing): cosign-pubkey + SBOM + deployment/env-poster (09b9cc80bf)' (#144) from fix/prod-evidence-2026-09-29 into main	2026-09-30 17:12:45 +00:00
admin	c4356e83c7	Merge branch 'main' into fix/prod-evidence-2026-09-29	2026-09-30 17:12:36 +00:00
Claude CodeandClaude Sonnet 5.5	08fbbf3595	fix(deps): next 16.3.4 -> 16.3.6 (CRITICAL GHSA-vcvr-r3jv-pc5j, next/og RCE) ... Same-minor bump of the exact-pinned direct dependency next (16.3.4 and 16.3.5 are affected by the remote code execution in next/og ImageResponse; fixed in 16.3.6, published 2026-09-22). package.json next 16.3.4 -> 16.3.6 (exact pin) pnpm-lock.yaml next + @next/env + 8 @next/swc-* platform packages -> 16.3.6, baseline-browser-mapping 2.11.21 -> 2.11.23 (next's own dep) package-lock.json next + @next/env + 8 @next/swc-* -> 16.3.6 (targeted edit; this legacy lockfile is already out of sync with package.json and npm cannot regenerate it because of the workspace:* protocol, so only the next entries were touched) No other dependency changed. pnpm install --frozen-lockfile, typecheck, check:contrast, vitest (1154 passed / 184 skipped), next build and eslint (0 errors) all pass on Node 22. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-09-30 17:45:23 +02:00
admin	4cd7d7a5e5	Merge pull request 'feat(collab): order-anteckningar — @siax/collaboration-kernelns första produktkonsument (spår C)' (#147) from feat/collab-adopt-20260930 into main	2026-09-30 15:18:54 +00:00
admin	cb018d9898	fix(types): states.tsx — styled-jsx-attribut bort (Next 16-typkedjan saknar jsx-prop); klasserna är namespaced, semantik oförändrad ... Rensar pre-existing typecheck-röd på main (blocks CI quality-jobbet).	2026-09-30 17:10:51 +02:00
admin	04813c34b0	feat(collab): order-anteckningar — @siax/collaboration-kernelns första produktkonsument (spår C) ... Kernel 0.3.0 används som capability, inte som paket-dekor: - lib/order-notes-store.ts: varje note ÄR en CollaborationOperation; nextLamportClock för nya klockor, mergeOperationLog/compareOperations för deterministisk listning; optimistisk version -> 409 vid stale skrivning. - lib/order-notes-client.ts: kernel-CollaborationTransport över host-API; offline = medvetet no-op + varning (ingen tyst förlust), 409 -> ConflictError. - app/api/admin/order-notes: requireRouteAuth (fail-closed 401), server-authoritative tenant-guard (403), AUD0-audit via hostens klient. - app/admin/notes: admin-yta med offline-växel, konflikt-banner + reload. - sql/016_order_notes.sql: persistens (DB-tabell, version + Lamport-klocka). Tester: API (happy/conflict 409/empty/400/401/403/404), klient-adapter (offline no-op utan fetch, 409-mappning, presence), SSR-render. 18 nya test.	2026-09-30 17:07:21 +02:00
admin	a32a64e91d	Merge pull request 'feat(orders): CSV-import admin-yta — första riktiga ImportWizard-värden (C8)' (#145) from feat/c8-import-wizard-20260930 into main	2026-09-30 13:41:30 +00:00
admin	c1648c04a7	feat(orders): CSV-import admin-yta — första riktiga ImportWizard-värden (C8) ... Symmetrisk mot våg 3.4 CSV-export: POST /api/orders/import (validate | dry_run | execute) + /admin/import som renderar @siax/ui ImportWizard (0.14.0) över @siax/import-export runtime (0.2.0). - Servern är enda auktoritet: RFC4180-parse (ingen eval), omvalidering via frysta @siax/contracts-kerneln (validateRows) + hostregler, exekvering genom BEFINTLIG orderlogik (createOrder, tenant-guardad). - Fail-closed: 401 utan principal, 400 okänd header, 413 vid radtak (500), per-rad-atomsäkra inserts — felrad kan aldrig skada OK-rader. - Partiell import: OK-rader skapas, felrader rapporteras per rad (row/field/code). AUD0-audit via 0pts enda producer-boundary (durable outbox under DATABASE_URL). - Reload-persistens: efter execute läses /api/orders om och de nya raderna listas på sidan. - Tester: 12 route-test (happy, partial, auth fail-closed, tak, no-write validate, header, quoting, rad-fel mitt i batch) + 3 SSR-render-test av ImportWizard över runtime-storen. - Deps: @siax/ui ^0.14.0, @siax/charts ^0.5.0, @siax/import-export ^0.2.0; pnpm-overrides till contracts 0.10.0 / import-export 0.2.0 (ui 0.14.0 deklarerar 0.11.0/0.2.1 som ännu ej publicerats).	2026-09-30 15:36:02 +02:00
siax-bot	c9a05be47e	fix(signing): cosign-pubkey + SBOM + deployment/env-poster för prod-imagen prod-09b9cc80bf	2026-09-30 15:06:41 +02:00
admin	09b9cc80bf	Merge pull request 'fix(manifest): provenRestore=true (restore-drill 2026-09-29)' (#142) from fix/prod-restore-2026-09-29 into main	2026-09-30 09:28:55 +00:00
admin	f44dd3e621	Merge branch 'main' into fix/prod-restore-2026-09-29	2026-09-30 09:28:46 +00:00
admin	286f636ca6	Merge pull request 'fix(signing): cosign-pubkey + SBOM + deployment/env-poster (24912b735f)' (#141) from fix/prod-evidence-2026-09-29 into main	2026-09-30 09:28:42 +00:00
admin	b0a3db79e7	Merge branch 'main' into fix/prod-evidence-2026-09-29	2026-09-30 09:28:34 +00:00
Claude CodeandClaude Sonnet 5.5	ab051b3bca	fix(deps): patch HIGH advisories in brace-expansion (pnpm-lock.yaml) ... Lockfile-only bump of the transitive dev dependency brace-expansion, within the ranges requested by its parents (minimatch@3 -> ^1.1.7, minimatch@10 -> ^5.x): brace-expansion 1.1.16 -> 1.1.21 brace-expansion 5.0.8 -> 5.0.12 Clears CVE-2026-102276, CVE-2026-102278, CVE-2026-69152 (HIGH, both lines), CVE-2026-14257 (HIGH, 1.1.x) and CVE-2026-102277 (MEDIUM). Resolves to the same versions/integrity hashes package-lock.json already pins. package.json is untouched; no direct dependency changed. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-09-30 11:23:48 +02:00
admin	5a165f3478	Merge pull request 'fix(health): engine-kollen ärlig (not_configured när URL saknas) + EVIDENCE-docs mot Coolify-verkligheten' (#140) from feat/health-evidence-20260930 into main	2026-09-30 08:45:27 +00:00
siax-bot	a8cb0149ea	fix(signing): cosign-pubkey + SBOM + deployment/env-poster för prod-imagen prod-24912b735f	2026-09-30 10:39:08 +02:00
admin	0386d82c49	fix(health): engine-kollen ärlig (not_configured när URL saknas) + EVIDENCE-docs mot Coolify-verkligheten	2026-09-30 10:08:25 +02:00
admin	24912b735f	Merge pull request 'fix(manifest): provenRestore=true (restore-drill 2026-09-29)' (#139) from fix/prod-restore-2026-09-29 into main	2026-09-30 05:21:40 +00:00
admin	18007ef0cb	Merge branch 'main' into fix/prod-restore-2026-09-29	2026-09-30 05:21:31 +00:00
admin	a8806c32aa	Merge pull request 'fix(signing): cosign-pubkey + SBOM + deployment/env-poster (9a14f65121)' (#138) from fix/prod-evidence-2026-09-29 into main	2026-09-30 05:21:27 +00:00
siax-bot	76a77eefac	fix(signing): cosign-pubkey + SBOM + deployment/env-poster för prod-imagen prod-9a14f65121	2026-09-30 06:35:33 +02:00
admin	9a14f65121	Merge pull request 'fix(manifest): provenRestore=true (restore-drill 2026-09-29)' (#137) from fix/prod-restore-2026-09-29 into main	2026-09-30 02:08:51 +00:00
admin	de7a706d7f	Merge branch 'main' into fix/prod-restore-2026-09-29	2026-09-30 02:08:42 +00:00
admin	51076ffe69	Merge pull request 'fix(signing): cosign-pubkey + SBOM + deployment/env-poster (3dcc46c064)' (#136) from fix/prod-evidence-2026-09-29 into main	2026-09-30 02:08:38 +00:00
siax-bot	9ca82443be	fix(signing): cosign-pubkey + SBOM + deployment/env-poster för prod-imagen prod-3dcc46c064	2026-09-30 03:22:05 +02:00
admin	3dcc46c064	Merge pull request 'docs: P1-5 korrigerad — 0pt.app verifierad kanonisk prod (falsk blocker)' (#135) from fix/p1-5-20260929 into main	2026-09-29 23:42:31 +00:00
admin	7a84899b37	docs: P1-5 korrigerad — 0pt.app verifierad kanonisk prod (falsk blocker)	2026-09-30 01:32:29 +02:00
admin	e7d5ee3574	Merge pull request 'feat(charts): recharts → @siax/charts — Product Firewall fullbordad i 0pt (våg 2.4)' (#134) from feat/charts-kernel-20260929 into main	2026-09-29 22:56:06 +00:00
admin	9d28b26490	feat(charts): recharts → @siax/charts — Product Firewall fullbordad i 0pt (våg 2.4)	2026-09-30 00:43:44 +02:00
admin	0b7bda840e	Merge pull request 'build: @siax/ui 0.12.0-kanarie — dist-läge, transpilePackages bort för ui [C1]' (#133) from feat/c1-canary-20260929 into main	2026-09-29 21:57:45 +00:00
admin	bcc5c7feb5	build: @siax/ui 0.12.0-kanarie — dist-läge, transpilePackages bort för ui [C1]	2026-09-29 23:20:31 +02:00
admin	b382e3b8ba	Merge pull request 'feat(orders): kanonisk statusmaskin + guardad DB-constraint (ADR-0002, C3)' (#132) from feat/order-state-machine-20260929 into main	2026-09-29 19:23:56 +00:00
admin	c3582838aa	feat(orders): kanonisk statusmaskin + guardad DB-constraint (ADR-0002, C3)	2026-09-29 21:15:35 +02:00
admin	43bc27703a	Merge pull request 'feat(orders): CSV-export-endpoint — export-kernelns första adoption (våg 3.4)' (#131) from feat/orders-export-20260929 into main	2026-09-29 16:20:31 +00:00
admin	bc76ebc5e5	feat(orders): CSV-export-endpoint — export-kernelns första adoption (våg 3.4)	2026-09-29 17:01:13 +02:00
admin	98c6ec459f	Merge pull request 'feat(admin): InboxList — orderkön som universal inkorg (våg 3.3-adoption)' (#130) from feat/inbox-pilot-20260929 into main	2026-09-29 14:20:10 +00:00
admin	a2377215e7	feat(admin): InboxList — orderkön som universal inkorg (våg 3.3-adoption) ... Servern projicerar öppna ordrar (draft/quoted/in_production/review) på universal-inbox-konvolverna via createInboxItem (buildOrderInboxItem i lib/order-flow, ADR-0001-mönstret: policy/resolution i serverlagret). Admin renderar InboxList (@siax/ui 0.11.1) ovanpå orderkön — resolve- aktionen gateras genom advance_action-state (available krävs). Terminala statusar ger ingen post. tests/order-flow 6/6; full svit 1144/1144; build ✓.	2026-09-29 16:10:10 +02:00
admin	3e122572b3	Merge pull request 'feat(admin): authz-pilot — server-renderad advance-resolution + ActionGate (ADR-0001)' (#128) from feat/authz-pilot-20260929 into main	2026-09-29 11:48:55 +00:00
admin	cc363a790f	fix(build): transpilePackages för @siax/* — Turbopack kan inte konsumera rå src/TS ... @siax/ui 0.11.1 exporterar src/index.ts (DES1GN-konventionen); Next/Turbopack kraschade med 'Unknown module type' i node_modules. transpilePackages för samtliga @siax/*-beroenden. pnpm build grön lokalt.	2026-09-29 13:39:16 +02:00
admin	5ffd41a461	fix(lint): odoo-bills-adapter AUD0-body — disable med skäl (CI-fynd)	2026-09-29 13:27:31 +02:00
admin	e24f8e8af4	fix(lint): typa AUD0-ingest-body i external-writeback-testet (CI-fynd)	2026-09-29 13:17:00 +02:00
admin	3279fa0533	fix(lint): eslint-undantag på rätt rader — json:any i graph-adapter + require-fixtures ... eslint-disable-next-line gällde nästa rad; json:any-linen behövde eget undantag. npm run lint: 0 errors (8→0). 1141/1141.	2026-09-29 12:50:06 +02:00
admin	1b6140a16a	fix(lint): rotfelsa ärvd lint-skuld — graph-adapter + p0-tester (blockerade #128) ... Parallellsessions-merge lämnade 12 eslint-errors på main (no-explicit-any i graph-mailbox-adapter + 2 p0-tester). Graph-JSON:n är genuint ostrukturerad — medveten, avgränsad eslint-undantag med skäl (DoD §13); p0-testerna typade med Record/cast. Lint 0 errors; tsc grön; 1141/1141.	2026-09-29 12:31:34 +02:00
admin	a49bc148fc	feat(admin): authz-pilot — server-renderad advance-resolution + ActionGate (ADR-0001) ... GET /api/orders returnerar per order frozen advance_action (resolveAction ur lib/order-flow); admin renderar via ActionGate — policy i serverlagret, presentation i klienten (DoD §21). Terminala/okända statusar → read_only med varför-text i stället för missvisande 'klar'. tests/order-flow.test.ts 3/3; full svit 1138 godkända; typecheck grön.	2026-09-29 12:21:02 +02:00
admin	f606c4a7d7	Merge pull request 'build: @siax/ui ^0.11.0 — kanonalignering (adoption-förberedelse)' (#127) from feat/ui-0.11-20260929 into main	2026-09-29 10:17:56 +00:00