# Onboarding — 0pt

BACKLOG P6 (DX-12). For a human or an agent picking this repo up cold.

## 1. Read, in order

1. `CLAUDE.md` — the contract for how this project is built. Non-negotiable
   constraints (legal sourcing only, Postgres-backbone, provenance-per-field).
2. `AGENTS.md` — agent-specific ground rules.
3. `docs/architecture/ARCHITECTURE.md` — what the code actually does today
   (as opposed to `docs/01-11`, which describe target state — see that
   doc's own "Läsanvisning").
4. `README.md` "Known issues" — the live gaps, dated and evidenced.
5. `prompts/000-INDEX.md` — run `001-repo-health.md` before touching anything.

## 2. Get it running

```sh
corepack enable
corepack prepare pnpm@9 --activate
pnpm install --frozen-lockfile
pnpm run dev          # http://localhost:3000, in-memory fallback, no DB needed
```

Or `make dev` (same thing). Want real Postgres locally instead of the
in-memory fallback? `make db-up` first (BACKLOG DX-02, `compose.dev.yaml` —
**unverified in CI, smoke-test before relying on it**), then re-run with
`DATABASE_URL` pointed at it (see the Makefile comment).

`pnpm run siax:doctor` (or `make doctor`) — runs the self-diagnostic subset
of the SIAX Golden Standard v2.0 checks locally (`scripts/siax-doctor.mjs`,
control AGENT-04). Run it after cloning and after any structural change.

## 3. Before you change anything

- `AUTH_ENFORCE` is fail-closed by default — don't set `AUTH_ENFORCE=false`
  outside local dev, and never commit it set that way anywhere.
- `services/scrapers/*`, `services/infra/docker-compose.data-stack.yml`, and
  `live/src/workers/adaptive_router.py`'s `curl_cffi` entries are frozen —
  see `SECURITY.md`. Don't touch, remove, or comment on that code without an
  explicit, current instruction from the account owner.
- Run `prompts/003-security-review.md`'s checklist before pushing anything
  touching auth, payments, or the platform clients.

## 4. Before you push

```sh
pnpm run typecheck   # blocking in CI
pnpm run test        # blocking in CI
pnpm run build       # blocking in CI
pnpm run lint        # advisory, but fix what you can
```

CI (`.gitea/workflows/ci.yml`) re-runs all of these plus a blocking
Trivy/gitleaks scan (`security.yml`, BACKLOG P0-16/P0-19) — a red `trivy`
job on an otherwise-unrelated PR usually means a pre-existing dependency
finding, not something your change caused; check the run's date against
when that job started being blocking before assuming you broke it.

## 5. Who to ask

`CODEOWNERS` → `@sax3l` (Simon Axelsson). Two remotes exist for this repo
(`git.siax.io/sax3l/0pt` and `github.com/sax3l/0pt`) with independently
diverged history — which is authoritative is explicitly Simon's call, not
something to assume; see `CLAUDE.md`.