315 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
admin	cecc2bc637	fix(payments): authenticate order detail and deposit checkout	2026-09-15 19:09:53 +02:00
admin	c7f8b3f651	docs: gate 0pt cutover on buyer-bound live payments	2026-09-15 18:53:35 +02:00
admin	7ce92827c0	fix: close demo payment bypass and guard order transitions	2026-09-15 18:52:23 +02:00
admin	ae190fa60d	fix: advance orders only after matching paid Stripe events	2026-09-15 18:15:42 +02:00
admin	8911709931	fix: do not acknowledge unverified Stripe webhooks	2026-09-15 18:08:13 +02:00
siax-ci	7555f3d504	chore(release-chain): evidence for sha-946baef8434d [skip ci]	2026-09-15 13:26:03 +00:00
admin	946baef843	fix(deps): js-yaml 4.3.0 -> 4.3.2 (CVE-2026-84375 HIGH, DoS i YAML — transitive via des1gn-m0-vågen; trivy-gaten blockerade annars main)	2026-09-15 15:24:56 +02:00
siax-ci	fb45e369cf	chore(release-chain): evidence for sha-0b53c4bfd5c6 [skip ci]	2026-09-15 13:12:49 +00:00
admin	0b53c4bfd5	fix(deps): lockfile för des1gn-m0-mergen — @siax/ui 0.4.1 saknades i pnpm-lock (parallellsessionens merge tog package.json utan lås-regenerering; ERR_PNPM_OUTDATED_LOCKFILE bröt quality/integration/release-chain)	2026-09-15 15:11:52 +02:00
admin	18d57a1e99	Merge remote-tracking branch 'origin/feat/des1gn-m0'	2026-09-15 15:00:47 +02:00
siax-ci	f6977c4742	chore(release-chain): evidence for sha-7f3df904b741 [skip ci]	2026-09-15 12:51:13 +00:00
admin	7f3df904b7	ci: re-trigger (integration dog på runner-glitch: OCI chdir /workspace — stale-runner-mönstret, rerun räcker)	2026-09-15 14:49:41 +02:00
siax-ci	8e5fa88b54	chore(release-chain): evidence for sha-6a125e10ccc3 [skip ci]	2026-09-15 12:39:15 +00:00
admin	6a125e10cc	ci(release-chain): re-trigger — siax-ci-identiteten fullt verifierad (release-ci-team authorize=write via DB; API:felt vägrar skriva permission-fältet; registry-push PUSH_OK som siax-ci)	2026-09-15 14:36:26 +02:00
admin	b383464795	ci(release-chain): re-trigger efter DELETE+PUT-sekretesrotation (PUT skriver ej över existerande Gitea-secrets — känd bugg)	2026-09-15 14:08:14 +02:00
admin	101dea83ae	ci(release-chain): verifierar den dedikerade identiteten siax-ci (REGISTRY_USER/TOKEN + SIAX_CI_TOKEN roterade från interim admin-token; org-team release-ci + repo-collaborator write)	2026-09-15 13:56:17 +02:00
siax-ci	fcfd6bca1e	M0: DES1GN-distribution — @siax/ui 0.4.1 + @siax/config + kanonisk import-kedja ... Token-VÄRDEN ägs av @siax/ui; token→Tailwind-mappningen ägs av @siax/config. Ingen in-repo token-kopia (M0-kontraktet). Bygg-CSS verifierad: SIAX-purple (#5326cc = oklch 0.45) + Inter + text-accent utility genererad.	2026-09-15 12:51:47 +02:00
siax-ci	508a2f34de	chore(release-chain): evidence for sha-8be11b6485d3 [skip ci]	2026-09-15 03:45:04 +00:00
admin	8be11b6485	fix(deps): package.json postcss-specifier ^8.5.28 (renovate PR#63:s package.json del glömdes i lockfile-merge-committen — lock:en pekar redan på ^8.5.28/8.5.28)	2026-09-15 05:43:13 +02:00
admin	38bf3520cd	Merge PR #63 (renovate: postcss 8.5.28) — lockfile semantiskt löst (main:s autoprefixer 10.5.5 + postcss uppdaterad i range), frozen-lockfile grön	2026-09-15 05:24:14 +02:00
siax-ci	2417954536	chore(release-chain): evidence for sha-a285c2f45f78 [skip ci]	2026-09-15 03:22:20 +00:00
admin	a285c2f45f	Merge PR #62 (renovate: autoprefixer 10.5.5)	2026-09-15 05:20:27 +02:00
siax-ci	9d51e021ed	chore(release-chain): evidence for sha-570352eb80d2 [skip ci]	2026-09-15 03:17:55 +00:00
admin	094d6e87e0	Merge branch 'main' into renovate/dev-dependencies-(non-major)	2026-09-15 03:17:49 +00:00
admin	dd28b52e49	Merge branch 'main' into renovate/autoprefixer-10.x-lockfile	2026-09-15 03:17:38 +00:00
admin	570352eb80	Merge pull request 'chore(deps): update dependency @types/react-dom to v19.2.7' (#61) from renovate/react-monorepo into main	2026-09-15 03:16:47 +00:00
Renovate	d8835d6e21	chore(deps): update dependency postcss to v8.5.28	2026-09-15 03:01:21 +00:00
Renovate	08b057f08e	chore(deps): update dependency autoprefixer to v10.5.5	2026-09-15 03:01:15 +00:00
Renovate	53e2d39ce7	chore(deps): update dependency @types/react-dom to v19.2.7	2026-09-15 03:01:09 +00:00
siax-ci	92edfe668c	chore(release-chain): evidence for sha-90ca9d6ec08b [skip ci]	2026-09-15 02:56:55 +00:00
admin	90ca9d6ec0	ci: re-trigger release+cd efter gate-retry-fixen (PR#60 mergad) — forväntan: signatur-fast-racet overlevs av retryen, cosign-verify GRÖN, Coolify-redeploy authoriserad av verifierad digest	2026-09-15 04:56:26 +02:00
admin	3ad992961d	Merge pull request 'fix(cd): signed-artifact-gate får retry på "no signatures found" (sign-racet mätt live)' (#60) from fix/cd-gate-verify-retry into main	2026-09-15 02:55:41 +00:00
admin	5669a0e9e7	fix(cd): gate får retry på 'no signatures found' — 8-sekunders-racet mellan release.yml:s push och cosign-sign mät live 2026-09-15 (pull 02:36:45, verify-fail 02:37:03, sign fast 02:37:11); hård fail kvar för äkta verify-fel	2026-09-15 04:50:53 +02:00
siax-ci	8de7e379e0	chore(release-chain): evidence for sha-2265dbb9a7cf [skip ci]	2026-09-15 02:37:09 +00:00
admin	2265dbb9a7	ci(release-chain): re-trigger #2 — REGISTRY/SIAX_CI_TOKEN tillbaka på admin-identitet (siax-bots ci-approvers-team har permission none -> 401 pa registry-push; dedikerad registry-user = rotationsobjekt) + push-whitelist klar	2026-09-15 04:36:37 +02:00
admin	745d22437c	ci(release-chain): re-trigger efter sekretesfix (SIAX_CI_TOKEN/REGISTRY -> siax-bot; push-whitelist admin+ci-approvers) — förra runen: steg 0-11 grön (bygg/push/SBOM/cosign-sign+verify), endast evidence-push nekad av protection	2026-09-15 04:21:37 +02:00
admin	00e69518de	Merge branch 'main' of https://git.siax.io/sax3l/0pt	2026-09-15 04:21:37 +02:00
admin	b1311678ac	Merge pull request 'feat(release-chain): bygg→push→SBOM→cosign-sign→verify + signed-artifact-gate i cd.yml (kl0ud/st0re-mönstret)' (#59) from fix/wire-signed-digest-to-deploy into main	2026-09-15 02:05:11 +00:00
admin	2ea63f46d1	Merge branch 'main' into fix/wire-signed-digest-to-deploy	2026-09-15 02:01:42 +00:00
admin	c7b429e999	Merge release-chain (från fix/wire-signed-digest-to-deploy): release.yml (bygg→push→SBOM→cosign-sign→verify→evidence-commit) + signed-artifact-gate i cd.yml + cosign.pub (nytt nyckelpar 2026-09-15; private i COSIGN_PRIVATE_KEY + Infisical /0pt/)	2026-09-15 03:58:10 +02:00
admin	a403424f47	fix(release-chain): cosign.pub = nyckelparet som sätts i repo-secrets (genererat 2026-09-15; det offline-genererade paret från 09-14 saknas i den här sessionen — nytt par, private-del går endast till repo-secret COSIGN_PRIVATE_KEY + Infisical)	2026-09-15 03:55:59 +02:00
admin	d637f41669	Merge PR #58 (engine: fail-closed X-Internal-Token-gate + commit-kedja i services/api)	2026-09-15 03:45:28 +02:00
admin	ff11216813	feat(engine): fail-closed X-Internal-Token-gate + commit-kedja (GIT_SHA) i services/api ... - X-Internal-Token skickades av edgen men verifierades ALDRIG — gate som raw-ASGI-middleware: INTERNAL_TOKEN satt => alla routes utom /health kräver exakt token, 401 (constant-time) annars. Ospecificerad token = inert (dev). - Dockerfile: ARG GIT_SHA + OCI-label + /health.reporting revision - compose var redan skriven för INTERNAL_TOKEN — motorn hade bara aldrig deployats med den - tester: tests/test_internal_token_gate.py (3: off/public/401-pass) — hela services/api-sviten 62 passed, 2 skipped (dokumenterade known-gaps), 0 fail	2026-09-15 03:38:43 +02:00
admin	201653a8e9	Merge PR #57 (operational-state evidence 2026-09-15)	2026-09-15 03:17:10 +02:00
admin	31671beb46	docs(evidence): färska prober 2026-09-15 — runtime healthy i SIAX Cloud (health ok/ready 200/headers live, edge-DB 60 tabeller), 0pt.app fortfarande Vercel 402 (DNS-cutover = Simon-punkt); operationalState förblir ärligt 'down'	2026-09-15 03:13:28 +02:00
admin	59018443de	Merge PR #56 (prod-merge-pass): PII-Gate GDPR-guardrail + realinfra-migration-test + security headers & repo-honesty doctor (omsluter PR #44)	2026-09-15 02:50:13 +02:00
Simon AxelssonandClaude Opus 5	8ebc90ffa3	fix(security,repo-honesty): real security headers + a doctor that checks truth, not presence ... Two defects of the same kind: the repo asserted things about itself that were not true, and nothing in it could tell. A. CHANGELOG.md claimed CSP/HSTS/X-Frame-Options since 2026-08. `main` contained none of it -- a repo-wide grep for `content-security-policy|strict-transport-security|x-frame-options` matched exactly one file, CHANGELOG.md itself. The only header on 0pt.app was Vercel's own HSTS default, which does not survive the move to Coolify/Traefik that siax.config.json and .gitea/workflows/cd.yml are already pointed at. - next.config.mjs: `headers()` on `/(.*)` with CSP (frame-ancestors 'none', base-uri 'self', object-src 'none', form-action 'self'), HSTS, X-Frame-Options DENY, X-Content-Type-Options, Referrer-Policy, Permissions-Policy; plus poweredByHeader: false. Same idiom as sax3l/siax-io's next.config.mjs. - Carve-outs re-derived against THIS tree, not inherited: the stale `ci/security-headers-and-scanning` branch (8d2ff73, 142 commits behind) carried a `form-action https://checkout.stripe.com` allowance justified by a redirect that is actually `window.location.href`, which form-action does not govern -- dropped rather than kept as decorative permission. frame-src is derived from NOCODB_BASE_URL/METABASE_SITE_URL, the same env the components/embed.tsx iframe is configured from, so wiring that component up cannot be silently blanked by this header (the failure sax3l/siax-io recorded as SIO-013). 'unsafe-eval' is dev-only. - tests/security/security-headers.test.ts: blocking regression gate inside `pnpm run test`, i.e. the required "CI (SIAX Cloud) / quality" context. Asserts against expectations written out in the test, not imported from the config. Proven to fail: removing X-Frame-Options -> `pnpm run test` exits 1; weakening frame-ancestors to 'self' -> exits 1. B. scripts/siax-doctor.mjs validated that siax.repo.json fields were PRESENT, never what they said. Measured on this tree: operationalState "running" (false) and "down" (true) both gave 40/40, exit 0, byte-identical output. - Value checks (enums, git.siax.io const, fleet node pattern, bare-hostname form), cross-file consistency (declared prod hostnames must appear in this repo's own siax.config.json / contracts/openapi.yaml, and vice versa), and GOV-06 substantiation: operationalState must be backed by a dated probe record in evidence/operational-state.json that agrees with it. Liveness is not knowable offline; whether a liveness CLAIM is backed is. Offline, deterministic, no network -- CI can never go red for want of an internet connection. - `--live` (opt-in) probes the declared hosts for real and checks the headers on the wire; `--write-evidence` refreshes the record. Not wired into CI on purpose. - tests/repo/siax-doctor.test.ts runs the doctor inside `pnpm run test` and asserts the negative cases against fixture trees (SIAX_DOCTOR_ROOT), so the "cannot fail" defect cannot come back. C. CHANGELOG.md is now true. The header claim stands; the four claims it was bundled with (Trivy --exit-code 1, gitleaks, SHA-pinned actions, SBOM + license artifacts) are still false on main and are listed as not implemented instead of left asserted. All four live in .gitea/workflows/**, a protected path on this repo, so they need an authorised workflow change. Nothing under .gitea/workflows/** or .gitignore is touched. Verified: pnpm run typecheck exit 0; pnpm run test exit 0 (74 files / 965 tests passed, up from 72/945); pnpm run build exit 0 and the built .next/routes-manifest.json carries all six headers; node scripts/siax-doctor.mjs 55/55 exit 0; --live 57/57 exit 0. eslint on the new files exit 0 (repo lint is advisory and its 17 pre-existing problems are unchanged). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-15 02:43:32 +02:00
adminandClaude Sonnet 5	d41f30535b	fix(test): replay full migration chain in source-registry realinfra test ... tests/p0/source-registry-postgres.realinfra.test.ts only applied sql/002_source_registry.sql before running assertions. sql/007_ingestion_plane.sql later added opt_sources.owner_id, and src/repositories/postgres-source-repository.ts's INSERT has named that column ever since -- but nothing caught the drift because SOURCE_REGISTRY_TEST_DATABASE_URL is never set in CI (.gitea/workflows/ci.yml has no job that sets it), so this suite has silently skipped in every CI run. Verified against a real disposable Postgres 16 container: before this fix, all 7 tests failed with `column "owner_id" of relation "opt_sources" does not exist`; after replaying every sql/*.sql file in order (same pattern already used by tests/analytics/analytics-domain-postgres.realinfra.test.ts), all 7 pass. Found while auditing 0pt's Analytics/BI layer (MetricFlow/Cube/ClickHouse/ Trino/DuckDB) and standing up real Postgres/ClickHouse containers to verify those claims for real; this bug is adjacent (source registry, not analytics) but was directly encountered and is a small, safe, test-only fix. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-15 02:40:52 +02:00
admin	17bd1b40a0	feat(0pt): record legitimate-interest stance — B2B contacts, company-linked only ... Recorded decision (Simon 2026-08-31): personal data may be stored under legitimate interest ONLY as business contacts bound to a company/org entity. Gate enforces it: legitimate_interest requires purpose=business_contact and entity_linked_only=true; recordStored() requires entity_id (orgnr/rgs/LEI, hashed) and refuses person-only rows. +1 test; suite 167 pass | 1 skip; typecheck clean.	2026-09-15 02:40:52 +02:00
admin	12080fc517	feat(0pt): PII-Gate GDPR-guardrail for personal-data sources (fail-closed) ... PiiGateService makes any future personal-data source (ratsit.se and other directory domains) technically GDPR-OK before the first byte is stored: - recorded legal basis (art. 6) with basis_ref evidence, no policy => fail-closed - data minimisation via field allowlist (art. 5(1)(c)) - storage limitation + enforceRetention purge (art. 5(1)(e)) - sha256-only identity keys + log redaction (art. 25/32) - accessStatement / erase subject-rights surfaces (art. 15/17) - robots/rate confirmation required for web+api sources; no stealth/bypass - audit trail via AUD0 at risk L3 (0pt.pii_*) - gate enabled by default in SourceQueryService 10 new tests; full suite 166 pass | 1 skip; typecheck (blocking gate) clean.	2026-09-15 02:40:52 +02:00