# Changelog

> BACKLOG P1-3. Format loosely follows [Keep a Changelog](https://keepachangelog.com/).
> No git tags/releases exist yet for this repo — this file starts the practice
> retroactively from real `git log` history rather than inventing version
> numbers that were never cut. Dates are commit dates on `main`, not calendar
> "release" dates (there have been none).

## [Unreleased]

- `feat(deploy)`: appen är nu faktiskt byggbar och körbar utanför Vercel.
  `next.config.mjs` sätter `output: "standalone"`; Dockerfilen är omskriven
  till samma form som `sax3l/siax-io` (som redan körs självhostat på flottan):
  fyra steg, `node:22-alpine` (matchar CI:s nodversion, var 24), `libc6-compat`,
  icke-root, HEALTHCHECK mot `/api/health`, npm/npx borttaget ur runtime-imagen.
  Uppmätt: image 1,33 GB -> 423 MB. `--ignore-workspace` borttaget (dess
  motivering var inaktuell sedan P1-21) så containerinstallationen är samma
  kommando som CI kör; `--prod=false` tillagt eftersom Coolify sätter
  NODE_ENV=production vid byggtid och pnpm då hoppar över devDependencies.
- `fix(images)`: `images.unoptimized: true` borttaget — det var v0-generatorns
  standardvärde, inte ett val (`next.config.mjs` var orörd sedan initial commit).
  Självhostad bildoptimering kräver att `sharp` faktiskt finns i runtime-imagen:
  `next build` spårar den inte in i `.next/standalone`, och
  `outputFileTracingIncludes` får Turbopack att panika på pnpms symlänkar. Sharp
  levereras därför i ett eget npm-steg i Dockerfile, pinnat till versionen i
  `pnpm-lock.yaml`. Verifierat i containern: `/_next/image` svarar 200 med
  `image/avif` (1,46 MB PNG -> 6,7 kB).
- fix(security): response security headers are set by the app itself, in
  `next.config.mjs` `headers()` — CSP (incl. `frame-ancestors 'none'`,
  `base-uri 'self'`, `object-src 'none'`, `form-action 'self'`), HSTS,
  X-Frame-Options `DENY`, X-Content-Type-Options, Referrer-Policy,
  Permissions-Policy — plus `poweredByHeader: false`. Regression-gated by
  `tests/security/security-headers.test.ts` (blocking, runs in
  `pnpm run test`) and re-checkable against a live origin with
  `node scripts/siax-doctor.mjs --live`. (BACKLOG P0-13, P1-15)

  Correcting this file: from 2026-08 until 2026-09-07 this bullet also
  claimed the headers themselves, while `main` contained none — a repo-wide
  grep for `content-security-policy|strict-transport-security|
  x-frame-options` matched only CHANGELOG.md. The only thing setting HSTS on
  0pt.app was Vercel's platform default (still observable on the 402
  responses recorded in `evidence/operational-state.json`), which is not this
  repo's and does not survive the move to Coolify/Traefik. The claim is true
  as of this entry; the four claims it was bundled with are not, and are
  tracked in the section below.

- fix(repo-honesty): `scripts/siax-doctor.mjs` validated that
  `siax.repo.json` fields were PRESENT, never what they said — measured:
  `operationalState: "running"` (false at the time; every declared host
  answered 402/404) and `"down"` (true) both produced 40/40 and
  byte-identical output. It now validates values (enums, hostname form),
  cross-file consistency (declared prod hostnames must appear in this repo's
  own deploy/contract config, and vice versa), and requires
  `operationalState` to be backed by a dated probe record in
  `evidence/operational-state.json` that agrees with it. Offline and
  deterministic by default; `--live` (opt-in) probes the real hosts.
  Gated by `tests/repo/siax-doctor.test.ts`, which also asserts the negative
  cases against fixture trees. (BACKLOG P1-19, control AGENT-04, GOV-06)
- fix(health): `/api/health` reports real per-dependency status instead of a
  hardcoded `ok: true`; new `/api/ready` readiness endpoint. (BACKLOG P0-3)
- docs/chore: repo-hygiene pass — schema-valid `siax.repo.json`/`siax.config.json`
  (standard v2.0), ADRs, this CHANGELOG, `siax:doctor` script, devcontainer,
  `docs/architecture/ARCHITECTURE.md` §5 "Ytor och paritet", CODEOWNERS,
  stale-link cleanup. (BACKLOG P1-1, P1-2, P1-3, P1-19, P1-20, P1-21, P2-5, P3-5)

### Claimed here before 2026-09-07 but NOT implemented — status 2026-09-15

These were asserted by the earlier `fix(security)` bullet and were not true on
`main` at that time. Current state (measured against `main`, 2026-09-15):

- CI security gates now ENFORCE: `security.yml` and `nightly.yml` run Trivy
  with `--exit-code 1` (landed via `ci/make-required-security-gate-real`,
  2026-09-08). (BACKLOG P0-16 — CLOSED)
- gitleaks is still not run anywhere in this repo. (BACKLOG P0-19 — OPEN)
- Actions are still NOT pinned to commit SHAs (`actions/checkout@v4` etc.).
  (BACKLOG P1-14 — OPEN)
- No SBOM and no license inventory are produced or uploaded as CI artifacts.
  (OPEN; the `fix/wire-signed-digest-to-deploy` branch carries a prepared
  release chain that needs its cosign/registry secrets before it can land.)

## 2026-08-11 — Evasion-stack decision provenance

- Attributed and dated the account-owner's keep-decision on `services/scrapers/*`
  across `SECURITY.md`, `CONTRIBUTING.md`, `prompts/002-compliance-audit.md`,
  `renovate.json`, `.gitea/workflows/security.yml`, `docs/slo.md`.

## 2026-08-09/10 — Golden Standard compliance pass (FAS 0–10)

- `docs/compliance/{INVENTORY,RELATIONS,OSS-INVENTORY,GOLDEN-STANDARD-REPORT,BACKLOG,SLUTRAPPORT}.md`
  written; `siax.repo.json` classification recorded.
- `fix(security)`: `GET /api/orders` and `GET /api/admin/metrics` now require
  auth (were live 200 anonymous — the routes sit outside `middleware.ts`'s
  `/api/0pt/:path*` matcher).
- `fix(deploy)`: `siax.config.json` `deploy.target` flipped from `vercel` to
  `coolify` (config-only; the live instance is still on Vercel until a
  Coolify app is provisioned and DNS is cut over).
- `feat(contract)`: OpenAPI 3.1 SSOT added (`contracts/openapi.yaml`);
  `@vercel/analytics` and `next/font/google` removed in favor of self-hosted
  `@fontsource-variable/*` (AR-4).
- `ci(workflows)`: CD/security/nightly split under `.gitea/workflows/`.
- README/SECURITY/CONTRIBUTING/AGENTS + runbooks (deploy, incident,
  backup-restore, oncall) + SLO doc added.

## 2026-08 — Auth + capability hardening ("Wave 2/3")

- `fix(auth)`: `AUTH_ENFORCE` default flipped to fail-closed on `/api/0pt/*`.
- Zitadel Bearer-token verification wired into `middleware.ts`
  (`src/auth/zitadel.ts`, `src/auth/context.ts`).
- P0 capability layer built out: `0pt.query_source`, document
  capture/extraction, Iceberg write-boundary, external writeback, dataset
  quality flow docs.
- CI quality gate added (typecheck/lint/test), `.env.example` committed
  (previously blocked by a blanket `.gitignore` `.env*` rule).

## 2026-07-13 — Scraper stack (kept, see BACKLOG P3-3 / SECURITY.md)

- `services/scrapers/*` (WAF-bypass, proxy rotation, ClickHouse pipeline) was
  added on the Gitea line of history. This is the subject of the dated,
  attributed account-owner decision referenced throughout this repo's
  compliance docs — not reopened or altered by this changelog entry.

## Earlier

- Initial Next.js scaffold, order/catalog/portal UI, FastAPI engine
  scaffold, i18n (EN/SV) and accessibility passes, lakehouse write-path
  ownership ADR (`ADR-0030`, in the `n0d` repo).

[Unreleased]: https://git.siax.io/sax3l/0pt/compare/main...HEAD