448 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
admin	de7a706d7f	Merge branch 'main' into fix/prod-restore-2026-09-29	2026-09-30 02:08:42 +00:00
admin	51076ffe69	Merge pull request 'fix(signing): cosign-pubkey + SBOM + deployment/env-poster (3dcc46c064)' (#136) from fix/prod-evidence-2026-09-29 into main	2026-09-30 02:08:38 +00:00
siax-bot	9ca82443be	fix(signing): cosign-pubkey + SBOM + deployment/env-poster för prod-imagen prod-3dcc46c064	2026-09-30 03:22:05 +02:00
admin	3dcc46c064	Merge pull request 'docs: P1-5 korrigerad — 0pt.app verifierad kanonisk prod (falsk blocker)' (#135) from fix/p1-5-20260929 into main	2026-09-29 23:42:31 +00:00
admin	7a84899b37	docs: P1-5 korrigerad — 0pt.app verifierad kanonisk prod (falsk blocker)	2026-09-30 01:32:29 +02:00
admin	e7d5ee3574	Merge pull request 'feat(charts): recharts → @siax/charts — Product Firewall fullbordad i 0pt (våg 2.4)' (#134) from feat/charts-kernel-20260929 into main	2026-09-29 22:56:06 +00:00
admin	9d28b26490	feat(charts): recharts → @siax/charts — Product Firewall fullbordad i 0pt (våg 2.4)	2026-09-30 00:43:44 +02:00
admin	0b7bda840e	Merge pull request 'build: @siax/ui 0.12.0-kanarie — dist-läge, transpilePackages bort för ui [C1]' (#133) from feat/c1-canary-20260929 into main	2026-09-29 21:57:45 +00:00
admin	bcc5c7feb5	build: @siax/ui 0.12.0-kanarie — dist-läge, transpilePackages bort för ui [C1]	2026-09-29 23:20:31 +02:00
admin	b382e3b8ba	Merge pull request 'feat(orders): kanonisk statusmaskin + guardad DB-constraint (ADR-0002, C3)' (#132) from feat/order-state-machine-20260929 into main	2026-09-29 19:23:56 +00:00
admin	c3582838aa	feat(orders): kanonisk statusmaskin + guardad DB-constraint (ADR-0002, C3)	2026-09-29 21:15:35 +02:00
admin	43bc27703a	Merge pull request 'feat(orders): CSV-export-endpoint — export-kernelns första adoption (våg 3.4)' (#131) from feat/orders-export-20260929 into main	2026-09-29 16:20:31 +00:00
admin	bc76ebc5e5	feat(orders): CSV-export-endpoint — export-kernelns första adoption (våg 3.4)	2026-09-29 17:01:13 +02:00
admin	98c6ec459f	Merge pull request 'feat(admin): InboxList — orderkön som universal inkorg (våg 3.3-adoption)' (#130) from feat/inbox-pilot-20260929 into main	2026-09-29 14:20:10 +00:00
admin	a2377215e7	feat(admin): InboxList — orderkön som universal inkorg (våg 3.3-adoption) ... Servern projicerar öppna ordrar (draft/quoted/in_production/review) på universal-inbox-konvolverna via createInboxItem (buildOrderInboxItem i lib/order-flow, ADR-0001-mönstret: policy/resolution i serverlagret). Admin renderar InboxList (@siax/ui 0.11.1) ovanpå orderkön — resolve- aktionen gateras genom advance_action-state (available krävs). Terminala statusar ger ingen post. tests/order-flow 6/6; full svit 1144/1144; build ✓.	2026-09-29 16:10:10 +02:00
admin	3e122572b3	Merge pull request 'feat(admin): authz-pilot — server-renderad advance-resolution + ActionGate (ADR-0001)' (#128) from feat/authz-pilot-20260929 into main	2026-09-29 11:48:55 +00:00
admin	cc363a790f	fix(build): transpilePackages för @siax/* — Turbopack kan inte konsumera rå src/TS ... @siax/ui 0.11.1 exporterar src/index.ts (DES1GN-konventionen); Next/Turbopack kraschade med 'Unknown module type' i node_modules. transpilePackages för samtliga @siax/*-beroenden. pnpm build grön lokalt.	2026-09-29 13:39:16 +02:00
admin	5ffd41a461	fix(lint): odoo-bills-adapter AUD0-body — disable med skäl (CI-fynd)	2026-09-29 13:27:31 +02:00
admin	e24f8e8af4	fix(lint): typa AUD0-ingest-body i external-writeback-testet (CI-fynd)	2026-09-29 13:17:00 +02:00
admin	3279fa0533	fix(lint): eslint-undantag på rätt rader — json:any i graph-adapter + require-fixtures ... eslint-disable-next-line gällde nästa rad; json:any-linen behövde eget undantag. npm run lint: 0 errors (8→0). 1141/1141.	2026-09-29 12:50:06 +02:00
admin	1b6140a16a	fix(lint): rotfelsa ärvd lint-skuld — graph-adapter + p0-tester (blockerade #128) ... Parallellsessions-merge lämnade 12 eslint-errors på main (no-explicit-any i graph-mailbox-adapter + 2 p0-tester). Graph-JSON:n är genuint ostrukturerad — medveten, avgränsad eslint-undantag med skäl (DoD §13); p0-testerna typade med Record/cast. Lint 0 errors; tsc grön; 1141/1141.	2026-09-29 12:31:34 +02:00
admin	a49bc148fc	feat(admin): authz-pilot — server-renderad advance-resolution + ActionGate (ADR-0001) ... GET /api/orders returnerar per order frozen advance_action (resolveAction ur lib/order-flow); admin renderar via ActionGate — policy i serverlagret, presentation i klienten (DoD §21). Terminala/okända statusar → read_only med varför-text i stället för missvisande 'klar'. tests/order-flow.test.ts 3/3; full svit 1138 godkända; typecheck grön.	2026-09-29 12:21:02 +02:00
admin	f606c4a7d7	Merge pull request 'build: @siax/ui ^0.11.0 — kanonalignering (adoption-förberedelse)' (#127) from feat/ui-0.11-20260929 into main	2026-09-29 10:17:56 +00:00
admin	bdca3c3305	build: @siax/ui ^0.11.0 — kanonalignering (adoption-förberedelse) ... 0.4.1 → 0.11.1 (låst): InboxList, ActionGate, authz-ux/entitlement-kontrakt nu tillgängliga för pilotkoppling. Full svit: 1138 godkända / 0 fel. ActionGate-piloten kräver först en permissions-resolutionsendpoint (requireOrderOwner är server-side; policy-input får inte hittas på — DoD §15) — designen står i minnet/PR-kommentaren.	2026-09-29 12:01:41 +02:00
admin	b2fcebe2b5	Merge pull request 'fix(manifest): provenRestore=true — styrkt av godkänd restore-evidens' (#126) from fix/provenrestore-manifest into main	2026-09-28 23:32:53 +00:00
siax-bot	8b338f8c07	fix(manifest): reliability.provenRestore=true — godkänd restore-evidens finns (re-0pt-2026-09-21), PROD-RESTORE-EVIDENCE-grinden kräver att manifestet gör anspråket	2026-09-29 01:29:50 +02:00
admin	9f34dd880c	Merge pull request 'build: kanoniska kernel-versioner — cmdk 1.1.1, sonner ^2.0.6 (våg 2)' (#125) from feat/kernel-version-locks-20260928 into main	2026-09-28 21:02:35 +00:00
admin	b205406ff6	build: kanoniska kernel-versioner — cmdk 1.1.1, sonner ^2.0.6 (våg 2) ... Alignar 0pt mot @siax/ui:s kanon (DES1GN #156): cmdk 1.0.4→1.1.1, sonner ^1.7.4→^2.0.6 (låst 2.0.8). Wrapper-API:erna (Toaster/toast, CommandMenu) är oförändrade. Full svit: 1138 godkända / 0 fel.	2026-09-28 22:33:02 +02:00
admin	b5a94c3dc5	Merge pull request 'feat(katalog): filter + sök + flikval i URL:en (URL state-konventionen)' (#124) from feat/katalog-urlstate-20260928 into main	2026-09-28 14:41:40 +00:00
admin	d3afc40ef4	feat(katalog): filter + sök + flikval i URL:en (kernel URL-state-konventionen) ... Live-auditen 2026-09-28 fann tre bryt: filter+sök försvann vid 'Tillbaka' från detaljsida, flikval saknade URL-state, brödsmulan ledde till startsida. - /katalog: q och filter kanoniskt i searchParams (debounce 250 ms på skrivtick, router.replace scroll:false) — Tillbaka återställer exakt vy, delad länk öppnar samma filtrering. Suspense-wrapper krävs av useSearchParams vid prerender. - /katalog/[id]: flikval i ?tab= (overview = parametern frånvarande — kanonisk URL), piltangentsnavigering oförändrad. - Brödsmulan länkar /katalog (inte /#katalog → startsida). Verifierat: blocking-gate typecheck med SAMMA 2 förbefintliga fel som main (noll nya), typecheck:app noll katalog-fel.	2026-09-28 15:54:11 +02:00
siax-ci	1ff689c7e7	Merge pull request 'chore(ci): koppla in SonarQube-analys mot självhostad sonar.siax.io' (#123) from chore/sonarqube-analysis into main	2026-09-28 09:35:32 +00:00
adminandClaude Sonnet 5	c9af814cbe	chore(ci): koppla in SonarQube-analys mot självhostad sonar.siax.io ... Lägger till en sonar-job i .gitea/workflows/ci.yml (körs endast vid push till main, Community Build saknar PR-analysläge) samt sonar-project.properties för repot 0pt. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-28 01:27:21 +02:00
admin	67ee239c84	Merge pull request 'ci: add missing timeout-minutes guards to hot-path jobs' (#122) from ci/timeout-guards-0pt-20260927 into main	2026-09-27 01:50:05 +00:00
Claude CodeandClaude Sonnet 5	4c47e151f3	chore(ci): add missing timeout-minutes guards to hot-path jobs ... Fleet-wide CI-speed pass: none of 0pt's push/pull_request-triggered workflow jobs capped their own runtime, so a hang (network stall, runaway process, stuck polling loop) burns a runner slot until Gitea's own default kicks in. Added job-level timeout-minutes sized to what each job actually does: cd.yml deploy 20 (bounded ~10min signed-artifact poll + setup) ci.yml quality 30 (typecheck/test/build) ci.yml integration 45 (multi-service: live OpenSearch + ClickHouse) ci.yml security 15 (single trivy fs scan) security.yml security 15 (single trivy fs scan) masterplan-lock.yml check 10 (single dependency-free shell check) release.yml release 45 (docker build/push + full G17 SBOM/scan/attest/verify chain) Deliberately NOT included in this PR: a concurrency: block for ci.yml/security.yml/masterplan-lock.yml's push+pull_request double- trigger. ci.yml's own `integration` job comment already documents, measured live (runs 28904/28906), that "Gitea currently ignores workflow concurrency" on this fleet, and the repo's real fix for the resulting double-run-on-shared-service-containers problem is the self-identifying-container pattern already in that job, not a concurrency group. Adding an inert concurrency: block here would give false confidence that the duplicate-run problem is handled when it measurably is not. Left for a follow-up decision once that fleet-wide finding is resolved. Part of a fleet-wide CI-speed pass (timeout-minutes audit). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-27 03:46:12 +02:00
admin	2d757435e4	Merge pull request 'fix(a11y): ta bort alfa-tonad textfärg — 82 kontrastöverträdelser (UI-09)' (#121) from fix/0pt-contrast-a11y-20260927 into main ... Merge pull request #121 from fix/0pt-contrast-a11y-20260927	2026-09-27 00:48:45 +00:00
SimonandClaude Opus 5	e3930aa633	fix(a11y): ta bort alfa-tonad textfärg — 82 kontrastöverträdelser (UI-09) ... axe-core 4.10.2 mot 0pt.app 2026-09-26: en enda regel, color-contrast, impact=serious, 82 noder. Estatets största enskilda a11y-defekt. Alla 82 har samma form: en Tailwind-alfamodifierare på en textfärg. Uppmätt WCAG 2.2-kontrast mot bägge temabakgrunderna i styles/globals.css: text-muted-foreground 4.73:1 ljust 7.63:1 mörkt GODKÄNT text-muted-foreground/70 2.71:1 4.20:1 faller text-muted-foreground/60 2.29:1 3.37:1 faller text-muted-foreground/50 1.96:1 2.67:1 faller text-muted-foreground/40 1.69:1 2.11:1 faller text-foreground/20 1.57:1 1.74:1 faller Den omodifierade token klarar AA i bägge teman, så åtgärden är helt enkelt att aldrig tona den. Elva textställen bytte till text-muted-foreground. Kopieringsknappen i app/portal går från 1.57:1 till 4.73:1 i viloläge och 19.79:1 vid hover — den föll även 1.4.11 för icke-textkomponenter. Toastens stängknapp klarade redan 1.4.11 (3.71:1) men blir 4.73:1. Kvar med alfa är endast den dekorativa masthead-siffran i app/bestall, som redan bär aria-hidden + select-none + pointer-events-none. Den är undantagen både av WCAG och av axe, och guarden nedan tillåter den på just den grunden. scripts/ci/check-text-contrast.mjs är en blockerande källkodsgrind i quality-jobbet. Den är avsiktligt inte en axe-körning: den fullständiga axe-jobb som UI-09 också begär kräver build + serve i CI och spåras separat. Tills det finns stoppar den här grinden regressionen vid den form som orsakade defekten. Refs: UI-09 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-27 01:27:28 +02:00
admin	9f52ceb1f7	Merge pull request 'feat(ingestion): VehIQ OLTP -> ClickHouse watermark extractor (P070)' (#117) from feat/vehiq-oltp-watermark-extractor into main	2026-09-26 21:58:35 +00:00
admin	6b733f7b9c	Merge branch 'main' into feat/vehiq-oltp-watermark-extractor	2026-09-26 21:55:35 +00:00
admin	b89b1e81de	Merge pull request 'fix(ci): check out the siax-templates pin directly instead of comparing main' (#120) from fix/templates-pin-0pt-20260926 into main	2026-09-26 18:47:55 +00:00
Claude CodeandClaude Opus 5	65ee88a01c	fix(ci): check out the siax-templates pin directly instead of comparing main ... The G17 gate cloned sax3l/siax-templates on the moving branch `main` and then required that clone's HEAD to equal SIAX_TEMPLATES_PINNED_SHA. Every merge in siax-templates -- including ones that touch nothing under ci/v2/reference-hooks -- therefore turned this repo's release chain red while nothing was actually unsafe (CD-03 / CI-RED-02). It is red right now: siax-templates main is at 6612f6ae, the pin is 09504e3a. The pin is still a real supply-chain control; what was wrong was tying it to someone else's branch tip. The step now fetches the pinned commit by SHA (shallow, no branch consulted) and checks it out detached, falling back to fetching the branches and taking the same commit out of them if the server refuses a by-SHA fetch. It fails closed on the thing that actually matters -- the reviewed commit no longer existing upstream -- and the post-checkout HEAD assertion is kept so the gate still proves what it ran. SIAX_TEMPLATES_REF is removed rather than left unused, so the moving-branch shape cannot quietly come back. The pin value itself is unchanged: commit 09504e3a is confirmed present in siax-templates (Gitea API, two commits behind main). Two comments that described the old "refuses to run if main moved" behaviour are corrected in the same change. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-26 20:07:29 +02:00
admin	ff7c5cdd66	Merge branch 'main' into feat/vehiq-oltp-watermark-extractor	2026-09-26 14:18:47 +00:00
admin	b982a1a643	Merge pull request 'fix(ci): bump SIAX_TEMPLATES_PINNED_SHA to reviewed siax-templates#138' (#119) from fix/g17-templates-pin-bump-138-20260926 into main	2026-09-26 12:56:13 +00:00
Claude Code	a2d6352e09	merge: bring in main to clear behind-base merge block	2026-09-26 14:51:49 +02:00
admin	125fc0ff66	Merge pull request 'fix(ci): re-pinna siax-templates 9a3a0aa → 09504e3a (granskad bump)' (#115) from fix/red-main-20260925-roda-mains into main	2026-09-26 12:45:09 +00:00
admin	65594902bd	Merge branch 'main' into fix/red-main-20260925-roda-mains	2026-09-26 12:07:11 +00:00
adminandClaude Sonnet 5	f4f660715b	fix(ci): bump SIAX_TEMPLATES_PINNED_SHA to reviewed siax-templates#138 (G17 evidence upload) ... siax-templates main advanced main..09504e3a5 (admin/siax-templates#138, merged, tested: 9 offline contract tests, G20 6/6, mutation harness 45/45, explicitly backward compatible / opt-in via G17_REQUIRE_ST0RE). The G17 release-chain gate in this repo was still pinned to the prior commit (9a3a0aa93c, 2026-09-24) and has been failing on every push to main since (refusing to run an unreviewed template version, by design) -- most recently blocking the release/deploy pipeline for #118. Reviewed the drift commit before bumping, per the gate own instructions ("re-review and update deliberately"). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-26 11:26:53 +00:00
admin	410339e697	feat(contract): add routing + normalization operationIds (ADR-027) (#118)	2026-09-26 11:19:43 +00:00
Claude CodeandClaude Sonnet 5	07158099ee	feat(ingestion): VehIQ OLTP -> ClickHouse watermark extractor (P070) ... Implements Simon's specified pattern (dealer_stock_entry/deal -> watermark/updated_at -> 0pt ingestion -> ClickHouse) as a P061 connector pair (PostgresWatermarkConnector, PostgresKeyedLookupConnector) plugged into the existing P062 IngestionRunner, writing to opt_dataset_projection via SiaxAnalyticsEngine.ingestProjection. Built here, not in admin/vehiq: that repo's own ADR-0035 (decisions 1/2/10, CI-enforced by validate_engine_firewall.py) forbids VehIQ code from ever holding a ClickHouse credential or hammering OLTP directly for analytics. See docs/P070_VEHIQ_OLTP_EXTRACTOR.md for the full rationale. Also corrects a real schema mismatch found while building this: production has no generic `updated_at` on any of the three target tables (verified live, read-only, 2026-09-25). dealer_stock_entry/deal use listed_at/ created_at as insert-time watermarks instead (documented caveat: in-place updates are not caught without a schema change); app.listing has no timestamp column at all and is deliberately not covered yet. Vehicle dimension lookup is narrow by construction: keyed on exactly the vehicle_id set referenced by the batch just read, never a scan of the 98M-row vehiq.vehicle table (connector-level validate() refuses that table by name; runner-level tests assert the query only ever touches referenced IDs). Verified: fixture-backed connector/runner tests (watermark+limit, same-timestamp tie at a page boundary, crash/resume, empty-table case, narrow-lookup query-count assertions) + a real disposable Postgres container (caught two real Date-handling bugs fixtures could not) + a read-only proof against actual production (server10, vehiq-db): the extractor's exact SQL returns zero rows, no error, confirming it is safe to schedule with zero current effect. .gitea/workflows/vehiq-oltp-ingest.yml is present, cron-scheduled, and defaults to VEHIQ_INGEST_MODE=preview (read-only, never writes) with no secrets configured — safe to merge with zero production effect until explicitly activated per the doc's "what activating this requires". Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-25 19:11:15 +02:00
siax-bot	189d51fb62	Merge branch 'main' into fix/red-main-20260925-roda-mains	2026-09-25 15:54:27 +00:00
admin	ec487746fd	Merge pull request 'fix(readiness): /api/ready svarade 200 med en död motor i produktion' (#116) from fix/readiness-fails-closed-on-broken-engine-20260925 into main	2026-09-25 12:42:43 +00:00