345 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
admin	d272e52ba0	fix(db): subscriptions.created_at — migration 014 reparerar GET /api/subscriptions (42703 mätt live) ... lib/subscriptions-store.ts listSubscriptions() SELECT:ar created_at men sql/001_init.sql definierade aldrig kolumnen — GET /api/subscriptions har alltså ALWAYS brutit mot Postgres i prod (42703 errorMissingColumn, mätt live mot 0pt.app 2026-09-22: 500). Kolumnen är nu ADD:ad live på 0pt-edge-postgres (idempotent IF NOT EXISTS); denna migration gör ändringen reproducerbar. GET svarar nu 200 [].	2026-09-22 05:33:13 +02:00
admin	2ae1fad1f5	Merge pull request 'fix(prod): map SiaxError in the 7 legacy money routes — DEPENDENCY_UNAVAILABLE/503 instead of opaque 500' (#81) from fix/legacy-routes-siax-error-mapping into main	2026-09-22 02:41:55 +00:00
admin	c7fd9d45a2	fix(prod): map SiaxError in the 7 legacy money routes — DEPENDENCY_UNAVAILABLE/503 instead of opaque 500 (0pt#53) ... getSqlForDurableStore throws SiaxError(DEPENDENCY_UNAVAILABLE, httpStatus 503, retryable) when a money-bearing store would fall back to an in-memory Map in a production runtime (the durable-store guard). The /api/0pt/* surface already maps it via src/http/siax-error-response.ts; the seven legacy routes outside the middleware matcher did not — the documented 503 leaked as Next's opaque 500 with no body. - app/api/siax-error-mapping.ts: shared isSiaxError + siaxErrorResponseForLegacy - orders (POST/GET), orders/[id] (GET/PATCH), subscriptions (GET/POST), payments/deposit, payments/release, admin/metrics: try/catch -> mapper, each route's own typed error contract preserved (idempotency conflict 409 etc.) - webhooks/stripe: store outage -> 503 received:false reason:store_unavailable so Stripe's delivery retry path stays open (never a silent received:true) - tests/api/legacy-routes-siax-error-mapping.test.ts: pins the 503 + body	2026-09-22 04:33:57 +02:00
admin	1d381f670f	Merge pull request 'chore(release): re-pin siax-templates G17 hook pin 7725498 -> a401880' (#80) from fix/templates-pin-bump-2026-09-22 into main	2026-09-22 02:12:48 +00:00
admin	ab0f5a0c5a	chore(release): re-pin siax-templates G17 hook pin 7725498 -> a401880 ... Templates main moved 12 commits (PAY-35 module, ui-consumer lockfile, recovery wave, X-708 profiles, deps). Verified: diff between pins contains ZERO changes under ci/v2/reference-hooks/ (the G17 contract implementation), so the bump is behaviour-neutral for the gate. release.yml SIAX_TEMPLATES_PINNED_SHA and .siax/hook-pins.json templateRef bumped together per the pin file's own reSyncInstructions.	2026-09-22 04:08:05 +02:00
admin	d7dda986c7	Merge pull request 'chore(estate): capability-post owner = repo-namn "0pt"' (#79) from fix/cap-owner-repo-name into main	2026-09-21 21:41:57 +00:00
admin	3ad3f1ac96	chore(estate): capability-post owner = repo-namn "0pt" (schema siax.capability + doctor CAP-RECORD-OWNER, 19 poster)	2026-09-21 23:21:54 +02:00
admin	3a02a37f7a	Merge pull request 'chore(capabilities): RW-005b — risk-assignment (0pt)' (#78) from chore/risk-assign-2026-09-21 into main	2026-09-21 19:57:24 +00:00
Claude Code	67d40c7713	chore(capabilities): RW-005b — risk-assignment (0pt) ... Regeldriven tilldelning per RAG-003-RISK-TAXONOMY: L2=läsande, L3=mutation, L4=major/senior-approval, L5=legal/finansiell. PII per domän (fin0/pay0=high, konsument=medium, system=low/none). Konservativ L5/high-skeletten ersatt.	2026-09-21 21:52:25 +02:00
admin	c9955d74f4	Merge pull request 'docs: fix AGENTS.md push claim + protected-paths gap (enable_push is false, not true)' (#74) from docs/agents-branch-protection-drift-fix into main	2026-09-21 19:47:16 +00:00
admin	7421d5fe58	Merge branch 'main' into docs/agents-branch-protection-drift-fix	2026-09-21 19:24:52 +00:00
siax-bot	a049096d4a	Merge pull request 'feat(X-737): Synthetic Data Factory (0pt dataset-truth + INF0-generering)' (#77) from feat/x737-synthetic-factory into main	2026-09-21 11:14:41 +00:00
admin	8411f9759e	feat(X-737): Synthetic Data Factory — sampling→synthesis (INF0-port)→PII/privacy (fail-closed före publish)→quality→dedupe→contamination→deterministisk train/val/test-split; provenance per rad (policy+model+source+sha256). 5/5 tester	2026-09-21 13:07:54 +02:00
admin	b8c92de617	Merge pull request 'chore(capabilities): RW-005 — capability-/surface-poster (surfaces-fasen)' (#76) from chore/capability-surfaces-2026-09-21 into main	2026-09-21 10:20:58 +00:00
admin	5fef70484a	chore(capabilities): RW-005 — siax.capability-poster (konservativ default L5/high, risk-assignment pending) + detekterade siax.surface-poster ... - surfaces detekterade ur filsystemet (openapi/bin/mcp-sdk/next/n0d-job/sdk-signaturer) - siax.surface: capabilityId+kind+entrypoint (authRequired=true per plattformspolicy) - risk-assignment = repoägarens domänbedömning (RW-005b, siax-standard REMAINING_WORK) - genererat av siax-standard packages/estate/bin/generate-capability-surfaces.mjs	2026-09-21 12:13:54 +02:00
admin	8e758887dc	Merge pull request 'chore(recovery): P005-reparationsvåg — verifierad backup-, restore- och licens-evidens' (#75) from chore/recovery-records-2026-09-21 into main	2026-09-20 23:44:30 +00:00
admin	85c632cd5b	ci: retrigger (flaky infra, main grön)	2026-09-21 01:41:21 +02:00
admin	82500997a5	chore(recovery): P005-reparationsvåg — verifierad backup-policy, restore-drill (klon från server8-backup, fsck+SHA-parity ok) och licensbedömning per ADR-024 ... - siax.backup: daglig replikering server8 + restic offsite (lastRunAt 2026-09-21T01:10:27+02:00) - siax.restore-evidence: 36/36 repon drillade mot backup (f46865d7) - siax.license-assessment + manifest: LicenseRef-SIAX-Proprietary/MIT godkänd per ADR-024	2026-09-21 01:14:01 +02:00
adminandClaude Sonnet 5	754dcc201f	docs: correct AGENTS.md branch-protection prose to match live config ... Rewrite the branch-protection / protected-paths section of AGENTS.md to state the verified-live Gitea branch_protections values instead of stale prose. No behavior change. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-20 23:55:46 +02:00
admin	f46865d71a	Merge pull request 'chore(release): bump siax-templates pin after deliberate review' (#73) from fix/siax-templates-pin-bump into main	2026-09-18 02:04:25 +00:00
admin	1ed035327d	chore(release): pin siax-templates to 7725498 (deliberate re-review) ... Gate files (lib/pinned-tools.sh, G17.sh) unchanged between 384e350 and 7725498 — diff is template/dep updates only (web-app, worker deps, otel bootstrap, HSP docs). Verified before bumping the pin.	2026-09-18 03:58:48 +02:00
admin	99ab6619f2	Merge pull request 'BTI promptpack: contracts + tests (godkänd av Simon)' (#72) from feat/bti-promptpack-2026-09-17 into main	2026-09-18 00:31:57 +00:00
admin	422380d0ed	test(BTI): DAT-04/05 dataset version acceptance tests ... - DAT-05-A1: monotonic versions, immutability - DAT-04-A2: estimated schema_version in manifest - 1054 tests green	2026-09-18 01:41:55 +02:00
admin	2e75b54717	Merge pull request #65	2026-09-17 00:00:33 +02:00
admin	203eafb34b	Merge pull request #66	2026-09-17 00:00:25 +02:00
siax-bot	b0aad9001e	Merge pull request 'feat(payments): verified tenant-owned 0pt orders' (#69) from feat/payment-order-ownership-wave49 into fix/stripe-webhook-no-ack-without-secret-wave47	2026-09-15 19:04:04 +00:00
admin	a1557b2a7d	feat(payments): bind orders to verified tenant and buyer	2026-09-15 19:53:58 +02:00
admin	f976f36530	fix(ci): avoid duplicate live integration jobs on branch push	2026-09-15 19:35:25 +02:00
admin	cecc2bc637	fix(payments): authenticate order detail and deposit checkout	2026-09-15 19:09:53 +02:00
admin	c7f8b3f651	docs: gate 0pt cutover on buyer-bound live payments	2026-09-15 18:53:35 +02:00
admin	7ce92827c0	fix: close demo payment bypass and guard order transitions	2026-09-15 18:52:23 +02:00
admin	ae190fa60d	fix: advance orders only after matching paid Stripe events	2026-09-15 18:15:42 +02:00
admin	8911709931	fix: do not acknowledge unverified Stripe webhooks	2026-09-15 18:08:13 +02:00
adminandClaude Sonnet 5	a69861a005	fix(ci): do not replace 0pt's committed cosign.pub with a throwaway key ... The previous commit on this branch incorrectly overwrote this repo's real cosign.pub with a keypair generated purely for local G17 verification, then deleted the matching private key without any handoff -- permanently orphaning that committed public key (ECDSA key generation is not reversible) while the PR description inaccurately claimed the private key had been "handed to Simon out of band". Neither was true: no handoff happened, and there was no way to know whether Simon already held a private key matching the ORIGINAL cosign.pub offline (the "NOT YET SET" secret gap the old release.yml documented is about the CI secret, not proof no such key exists anywhere). Reverts cosign.pub to its original committed value and corrects .siax/hooks/README.md accordingly. Local verification of the new G17 gate (SBOM/scan/attest/verify/evidence, see the PR description) used a separate throwaway keypair that never touched this repo's committed key material -- the production keypair decision is left to Simon, same as the old gate already left it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-15 17:12:21 +02:00
adminandClaude Sonnet 5	a3df134caf	feat(ci): migrate signed-deploy gate to siax-templates G17 reference (ADR-W16-003) ... 0pt's own "P007 pattern" release chain (added 2026-09-14) genuinely failed the ADR-W16-003 promotion bar an audit (2026-09-15) checked it against: syft/cosign installed via curl + a freshly-refetched checksums file (not a pinned, out-of-band-verified digest), no vulnerability scan of the built digest at all, cosign signed only the bare digest (no in-toto/SLSA statement, no source-SHA/build-identity/environment/SBOM-hash binding, no scoped key identity), and evidence committed straight back into this same mutable repo (siax/production-evidence/*.json, siax/source-bundles/*.json -- nine such commits already existed in this repo's history, deleted in this change). Delegates every bar item (1-7: pinned-tool install, SBOM, blocking vuln scan, in-toto attestation, scoped-key signing, pubkey verification, AUD0/ST0RE evidence storage) to sax3l/siax-templates' real, reviewed G17 reference implementation (PR #51, merged, pinned at 384e35060b91ea78ec045e14af114abf5d5eb23b), checked out at CI runtime via the SIAX_CI_TOKEN org secret this repo already had wired for a different cross-repo write -- picked over a vendored copy (the mechanism st0re/cl0ud/ api0 used) because 0pt has no prior vendoring convention anywhere in this repo. Matches aud0/h0st's own migrations for the same reason. See .siax/hooks/README.md for the full composition-mechanism rationale. .siax/hooks/G17.sh is the adapter: owns only 0pt-specific values (image repo, key identity, and a license-allowlist policy measured against 0pt's own real SBOM -- 280 components, one genuine new finding this pass caught that the old gate never checked at all: gcompat's NCSA license, triaged and allowed as the real OS-substrate license it is). cd.yml's own real signed-artifact wait/verify gate (predates this migration, genuinely 0pt-specific -- polls the registry for release.yml's artifact, verifies before triggering Coolify) is KEPT, updated from `cosign verify` (bare digest) to `cosign verify-attestation --type ...` to match the new attestation format `cosign attest` produces. A fresh cosign keypair was generated for this migration -- the previously committed cosign.pub had no corresponding private-key secret ever provisioned on this repo (the old release.yml's own comment confirms: "NOT YET SET on sax3l/0pt as of this writing"), so there was no real existing key material to carry forward. G20 (live-digest-equality) deliberately NOT wired in this pass: 0pt has no Coolify application provisioned and no /version endpoint for it to poll against -- see .siax/hooks/README.md "G20 -- deliberately not wired yet" for what would need to exist first. Verified for real during this migration (see PR description for the full evidence): a real image built from this repo's own Dockerfile, pushed to a local registry, SBOM'd (syft), scanned (trivy, 0 CRITICAL/HIGH findings), DSSE-attested (cosign attest) and verified (cosign verify-attestation) against the new cosign.pub, submitted to a mock AUD0 server enforcing the real eventInputSchema contract, plus three real tamper-rejection negative controls (wrong key, wrong predicate type, never-attested digest) against this exact artifact, plus the reference implementation's own 29/29-assertion selftest (including a real live check against production api.aud0.siax.io). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-15 17:09:38 +02:00
siax-ci	7555f3d504	chore(release-chain): evidence for sha-946baef8434d [skip ci]	2026-09-15 13:26:03 +00:00
admin	946baef843	fix(deps): js-yaml 4.3.0 -> 4.3.2 (CVE-2026-84375 HIGH, DoS i YAML — transitive via des1gn-m0-vågen; trivy-gaten blockerade annars main)	2026-09-15 15:24:56 +02:00
siax-ci	fb45e369cf	chore(release-chain): evidence for sha-0b53c4bfd5c6 [skip ci]	2026-09-15 13:12:49 +00:00
admin	0b53c4bfd5	fix(deps): lockfile för des1gn-m0-mergen — @siax/ui 0.4.1 saknades i pnpm-lock (parallellsessionens merge tog package.json utan lås-regenerering; ERR_PNPM_OUTDATED_LOCKFILE bröt quality/integration/release-chain)	2026-09-15 15:11:52 +02:00
admin	18d57a1e99	Merge remote-tracking branch 'origin/feat/des1gn-m0'	2026-09-15 15:00:47 +02:00
siax-ci	f6977c4742	chore(release-chain): evidence for sha-7f3df904b741 [skip ci]	2026-09-15 12:51:13 +00:00
admin	7f3df904b7	ci: re-trigger (integration dog på runner-glitch: OCI chdir /workspace — stale-runner-mönstret, rerun räcker)	2026-09-15 14:49:41 +02:00
siax-ci	8e5fa88b54	chore(release-chain): evidence for sha-6a125e10ccc3 [skip ci]	2026-09-15 12:39:15 +00:00
admin	6a125e10cc	ci(release-chain): re-trigger — siax-ci-identiteten fullt verifierad (release-ci-team authorize=write via DB; API:felt vägrar skriva permission-fältet; registry-push PUSH_OK som siax-ci)	2026-09-15 14:36:26 +02:00
admin	b383464795	ci(release-chain): re-trigger efter DELETE+PUT-sekretesrotation (PUT skriver ej över existerande Gitea-secrets — känd bugg)	2026-09-15 14:08:14 +02:00
admin	101dea83ae	ci(release-chain): verifierar den dedikerade identiteten siax-ci (REGISTRY_USER/TOKEN + SIAX_CI_TOKEN roterade från interim admin-token; org-team release-ci + repo-collaborator write)	2026-09-15 13:56:17 +02:00
siax-ci	fcfd6bca1e	M0: DES1GN-distribution — @siax/ui 0.4.1 + @siax/config + kanonisk import-kedja ... Token-VÄRDEN ägs av @siax/ui; token→Tailwind-mappningen ägs av @siax/config. Ingen in-repo token-kopia (M0-kontraktet). Bygg-CSS verifierad: SIAX-purple (#5326cc = oklch 0.45) + Inter + text-accent utility genererad.	2026-09-15 12:51:47 +02:00
siax-ci	508a2f34de	chore(release-chain): evidence for sha-8be11b6485d3 [skip ci]	2026-09-15 03:45:04 +00:00
admin	8be11b6485	fix(deps): package.json postcss-specifier ^8.5.28 (renovate PR#63:s package.json del glömdes i lockfile-merge-committen — lock:en pekar redan på ^8.5.28/8.5.28)	2026-09-15 05:43:13 +02:00
admin	38bf3520cd	Merge PR #63 (renovate: postcss 8.5.28) — lockfile semantiskt löst (main:s autoprefixer 10.5.5 + postcss uppdaterad i range), frozen-lockfile grön	2026-09-15 05:24:14 +02:00