11 Commits

Include renames

Author	SHA1	Message	Date
admin	a1557b2a7d	feat(payments): bind orders to verified tenant and buyer	2026-09-15 19:53:58 +02:00
admin	cecc2bc637	fix(payments): authenticate order detail and deposit checkout	2026-09-15 19:09:53 +02:00
admin	7ce92827c0	fix: close demo payment bypass and guard order transitions	2026-09-15 18:52:23 +02:00
admin	ae190fa60d	fix: advance orders only after matching paid Stripe events	2026-09-15 18:15:42 +02:00
admin	8911709931	fix: do not acknowledge unverified Stripe webhooks	2026-09-15 18:08:13 +02:00
admin	77e5137c9a	Merge pull request 'docs+chore: repo hygiene -- v2.0 manifests, ADRs, changelog, doctor, guides' (#20) from docs/repo-hygiene-v2-standard into main	2026-08-11 12:32:19 +00:00
admin	328f8a46cb	docs+chore: repo hygiene -- v2.0 manifests, ADRs, changelog, doctor, guides ... BACKLOG P1-1: siax.repo.json/siax.config.json rewritten to be schema-valid against sax3l/siax-standard's actual v2.0 schemas (lifecycle, operationalState, gitHost, domains-as-objects, consumedBy, children, contracts -- validated with jsonschema, not just eyeballed). config.json restructured to the real deploy-descriptor shape (framework/build/start/ port/healthcheck/environments) instead of duplicating repo.json's identity fields, which the schema doesn't allow. BACKLOG P1-2: 3 ADRs for decisions already made and evidenced elsewhere in this repo (Coolify-not-Vercel, Zitadel-not-NextAuth, Iceberg-format pointer to n0d ADR-0030) -- retroactive documentation, not new decisions. The Stripe/Revolut and services/scrapers/* questions are explicitly NOT written as ADRs here; both are account-owner-gated or actively under review elsewhere (see docs/architecture/decisions/README.md). BACKLOG P1-3: CHANGELOG.md from real git log history (no tags/releases exist yet -- this doesn't invent version numbers that were never cut). BACKLOG P1-19: `pnpm siax:doctor` (scripts/siax-doctor.mjs, AGENT-04) -- zero-dependency, checks required files + manifest shape, prints control-IDs. .devcontainer/devcontainer.json (DX-03). compose.dev.yaml (DX-02 -- UNVERIFIED, no Docker available in this environment to smoke-test, flagged in the file itself). All 4 prompts + the index rewritten to AGENT-03 shape (goal/context/prerequisites/scope/contract/acceptance-criteria/ control-ID/forbidden-actions). BACKLOG P1-20: docs/architecture/ARCHITECTURE.md migrated to the v2.0 9-heading template -- new §5 "Ytor och paritet" (capability x API/CLI/MCP/console coverage table, grounded in the same registry facts docs/02-architecture.md already established), §6-9 renumbered from the old §5-8 (all internal cross-references fixed, CLAUDE.md's own §-numbers left untouched). docs/api/ added (points at contracts/openapi.yaml as the one SSOT instead of duplicating it as drift-prone prose). BACKLOG P1-21: packages/schemas now has a real package.json (was loose JSON files with no package -- pnpm-workspace.yaml's packages/* glob matched an empty package). Verified `pnpm install --frozen-lockfile` and the full typecheck/test/build suite still pass with 2 real workspace projects. apps/ restructuring explicitly NOT attempted (BACKLOG's own effort estimate is "L" / large -- moving the whole app tree is a bigger, riskier change than belongs in this pass). Import-boundary check added via dependency-cruiser (ARK-14) -- installed for real, config tested against this codebase (179 modules, 310 deps, 0 violations), wired as `pnpm run deps:check` (advisory, not yet a CI gate). BACKLOG P2-5: docs/02-architecture.md's "Hosting" section marked SUPERSEDED (the Vercel plan was superseded by the Coolify deploy.target flip, 2026-08-09 -- ADR-0001). README.md/.env.example were checked and are already accurately framed (live-on-Vercel vs. config-target-is-Coolify) -- not touched. BACKLOG P3-5: 2 stale github.com/sax3l/0pt/pull/3 links removed (the PR merged long ago, .env.example is real and current) -- docs/09-build-plan.md, docs/08-infrastructure.md. The "two diverged remotes, unresolved which is canonical" language elsewhere (CLAUDE.md, AGENTS.md, SECURITY.md, etc.) is deliberately NOT touched -- that's a live, correctly-flagged, account-owner- owned open question per the Gitea-exclusivity mandate, not a stale link. BACKLOG P6 (19 items): concrete artifacts for the ones that are actually a file (.editorconfig, dependency-cruiser, deprecation policy, K8s reference manifest, .actrc, Makefile, ONBOARDING.md); docs/guides/P6-GUIDES.md for the rest (CLI-13, DOC-18, UI-30, IAM-19, PAY-11, AI-18, OBS-21, TEST-20, NET-19, SCALE-13, OSS-10, AGENT-13) -- each grounded in this repo's actual code/gaps, not generic advice. NOT attempted (out of this task's scope, noted for the record): - P2-1 (cl0ud app-registry.ts mismatch) -- lives in a different repo (sax3l/cl0ud), not cloned/authorized for this task's single-repo PR flow. - The CI "doctor step" half of P1-15 -- deliberately left out of this PR's .gitea/workflows/ci.yml to avoid a 3-way merge conflict with ci/security-headers-and-scanning, which already restructured that file; add it as a follow-up once that PR merges. This branch was authored independently of, but shares docs/architecture/ ARCHITECTURE.md and docs/slo.md with, fix/honest-health-check and ci/security-headers-and-scanning -- expect a small, normal merge conflict if this is rebased after either of those merge first (both already rebased cleanly against each other and against main as of this commit).	2026-08-11 14:18:00 +02:00
admin	a88ad04867	fix(health): report real per-dependency status instead of hardcoded ok:true ... BACKLOG P0-3: /api/health only ever checked *presence* of DATABASE_URL/ REDIS_URL and always returned ok:true regardless of whether anything was reachable -- ARCHITECTURE.md's own words, "an uptime monitor watching HTTP 200 would show green for a dying instance". lib/health-checks.ts adds real dependency probes: - db: a live `select 1` round trip (not just DATABASE_URL presence) - engine: a real HTTP call to the FastAPI engine's own GET /health - stripe: Stripe's documented lightweight balance.retrieve() liveness call - queue: honestly reports "not_integrated" when REDIS_URL is set but unused -- no Redis client is wired anywhere in this repo, so reporting "ok" would fabricate a check that doesn't exist /api/health stays a liveness check (always 200 while the process can respond; the body's `ok` field is the honest signal). New GET /api/ready fails closed with 503 when the load-bearing dependency (db) isn't both configured and reachable -- the "no /ready route" gap. contracts/openapi.yaml, docs/architecture/ARCHITECTURE.md, and docs/slo.md updated to match. 17 new unit tests (dependency-injected fakes, no real network/DB) + 5 route-level tests.	2026-08-11 13:49:23 +02:00
admin	d2b5ec8e4f	docs(compliance): FAS 0-5 - inventory, relations, OSS, golden standard, backlog + repo classification (siax.repo.json)	2026-08-10 04:03:40 +02:00
adminandClaude Sonnet 5	ad042d825f	fix(deploy): declare Coolify as the deploy target, not Vercel ... siax.config.json declared deploy.target: "vercel", which conflicts with the SIAX Cloud platform pattern every sibling OS repo (n0d, st0re, aud0) follows: a Dockerfile "for Coolify" (already present in this repo) plus a .gitea/workflows/deploy.yml that POSTs a restart to a Coolify app UUID. Investigated before changing anything: - 0pt.app is confirmed live on Vercel (Server: Vercel, 200 OK) but its own /api/health reports db/queue "not_configured", and POSTing to /api/orders creates an order that is not durably persisted (in-memory store only, per this repo's own docs/08-infrastructure.md and docs/architecture/ ARCHITECTURE.md, both independently verified live 2026-07-19 / 2026-08-07, and reconfirmed live again today). It's a fully-built marketing/demo surface with no real backend behind it -- not a live product serving real customer data. Safe to change deploy config without a cutover plan. - Dockerfile already exists and is already written "for Coolify" (node:24- alpine multistage, non-root, /api/health healthcheck) -- no changes needed there. - No .gitea/workflows/deploy.yml existed. Added one following the exact pattern used by n0d and st0re (POST /api/v1/deploy?uuid=...&force=false with COOLIFY_TOKEN). No Coolify app has been provisioned for 0pt yet, so the app UUID is a literal placeholder and the workflow fails loudly by design until a real app + token are in place -- this does not silently ship a broken deploy config. This changes only this repo's declared *intent*. It does NOT touch the live Vercel deployment, delete the Vercel project, or move any traffic -- that cutover (provision Coolify app -> verify -> DNS -> decommission Vercel) is a separate, larger decision. README and ARCHITECTURE.md updated to state this plainly rather than let them contradict the new config. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-09 12:36:24 +02:00
Claude (SIAX platform session)	bb58617540	docs(standard): add code-verified ARCHITECTURE.md + siax.config.json (S1-S7) ... Brings 0pt to the SIAX repo standard. README, LICENSE (proprietary, correct for this repo), Dockerfile and .gitea/workflows/ci.yml already existed and are left untouched; no .github/workflows exists. The architecture document was written by reading the code (entrypoints, routes, services, migrations, Dockerfile, env, tests) and by probing the live 0pt.app instance -- not from the templates. It therefore contradicts the existing docs in several places, deliberately: * /api/0pt/* answers ANONYMOUSLY in production (live-verified 2026-08-07): GET https://0pt.app/api/0pt returns 200 with no token, and 200 with a deliberately invalid one. The deployment is current (the newer lakehouse routes are present), so middleware.ts is simply not running. README lines 49-52 and merge 6531384 claim the opposite. Root cause UNKNOWN -- flagged, not guessed. * No handler reads x-0pt-verified-tenant. middleware.ts sets it; nothing else in the repo reads it. Every /api/0pt/* handler takes tenant_id from the request body/query instead, so tenant isolation is not implemented. * Everything outside /api/0pt/* has no auth at all (matcher scope), including GET /api/admin/metrics and GET /api/orders (both live-verified 200 anon) and POST /api/payments/{id}/release, which flips an order to "delivered" regardless of payment. * CL0UD policy client is fail-open and AUD0 audit is a silent no-op when their URLs are unset, with no production guard -- unlike AUTH_ENFORCE, which has one. * connections/db-grant documents AES-GCM encryption it does not implement. * The FastAPI engine (services/api) has zero authentication despite lib/engine.ts sending X-Internal-Token. * services/scrapers/waf_bypass.py (FlareSolverr, Tor, cloudscraper, proxy pool, undetected browser, fake identities) plus flaresolverr/tor-proxy in services/infra/docker-compose.data-stack.yml directly contradict CLAUDE.md §1 and the README's compliance claim. Left in place -- deletion is a Simon decision, recorded as open question 2. * Production has NO database (live /api/health reports db:not_configured) and the whole /api/0pt/* capability layer is per-module in-memory Maps, so state does not survive a cold start and is not even shared between route modules. siax.config.json deviates from the template on two fields, on purpose: deploy.target is "vercel" (live-verified Server: Vercel header), not "coolify", and designSystem is null because @siax/ui is not a dependency here. Both deviations are documented in ARCHITECTURE.md §5 and §8. Docs-only change. No code, CI, LICENSE or workflow files were modified.	2026-08-07 21:48:35 +02:00