feat(compliance): scaffold Golden Standard artifacts (CI-14, DX-02, DX-03) #21

Merged

sax3l merged 2 commits from feat/golden-standard-scaffold into main 2026-09-06 09:44:56 +00:00

Conversation 2 Commits 2 Files Changed 1

+11

2 Commits

Author	SHA1	Message	Date
Claude Opus 5	e433e7f991	Merge main into the Golden Standard scaffold branch — keep only CODEOWNERS ... PR #21 was batch-closed 2026-09-04 as "verified against main (added-files present: all)". That check cannot have run: `.gitea/CODEOWNERS` and `docs/compliance/SCAFFOLD-TODO.md` were absent from main, and the other two files differed. Reopened; this merge resolves it against what main says today. Resolution, file by file, measured against origin/main (08c88f39): - .devcontainer/devcontainer.json — KEEP MAIN. Main's version is strictly richer (corepack pin, siax-doctor postStart, forwardPorts, AUTH_ENFORCE). The scaffold's three-line version would be a regression. - compose.dev.yaml — KEEP MAIN. Main declares a real pgvector service with an init mount, healthcheck and a documented P014 verification. The scaffold's `services: {}` would delete a working local dev stack. - docs/compliance/SCAFFOLD-TODO.md — DROPPED. Written 2026-08-11 and now false on every substantive claim: it says siax.repo.json fails schema validation (main's has repo/lifecycle/gitHost/consumedBy/children/ operationalState and object-form domains), that domains are strings (they are objects), that consumedBy is missing (present), and that DOC-07 has no proven restore (docs/runbook/backup-restore.md line 23 records an executed drill dated 2026-09-03). Merging it would add stale false statements. - .gitea/CODEOWNERS — KEPT. Genuinely absent from main, still wanted by CI-14, and correct as written. Net diff against main is one added file. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-06 11:35:32 +02:00
adminandClaude Sonnet 5	7b1814fef4	feat(compliance): scaffold Golden Standard artifacts (CI-14, DX-02, DX-03) ... Applies siax-standard/packages/scaffold (feat/scaffold-generator) to close three BLOCK-level gaps found by the doctor: - .gitea/CODEOWNERS (CI-14) — was completely missing - compose.dev.yaml (DX-02) — was completely missing, left as `services: {}` since the scaffold cannot know this repo's real local dependencies - .devcontainer/devcontainer.json (DX-03) — was completely missing siax.repo.json, the four docs/runbook/*.md files, .gitea/workflows/security.yml, prompts/000-INDEX.md and contracts/openapi.yaml already existed with content and were left untouched (AR-1: the generator never overwrites existing content). docs/compliance/SCAFFOLD-TODO.md was generated and then manually corrected before this commit — the generator emits some fixed TODO/warning lines regardless of actual repo state, and three of them were false for 0pt: - claimed appId is null needing an appIdJustification field removed; the EXISTING siax.repo.json already has appId: "0PT" set, no such field exists - claimed domains: 0 ("none found"); the EXISTING siax.repo.json already lists 2 domains (0pt.app, api.0pt.app) as strings — the new schema wants objects, so they fail validation and get silently dropped to 0, which reads as "no domains configured" when in fact 0pt.app is a real domain - asked to fill in both consumes[] and consumedBy[] "from scratch"; consumes[] is already fully populated in the existing file (CL0UD, ST0RE, N0D, AUD0, INF0) — only consumedBy[] is actually missing Doctor measuredScore: 74 -> 85 (CI-14, DX-02, DX-03 flip FAIL -> PASS). REPO-04 stays FAIL: siax.repo.json still needs a human to add the missing required fields and convert domains to the new object shape (AR-1 will not touch a file that already has content) — tracked in SCAFFOLD-TODO.md. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-11 14:36:03 +02:00