# INVENTORY — 0pt (sax3l/0pt) — FAS 0

> Kategori: **platform (K1)** · Subkategori: **data-os** · Repo: `git.siax.io/sax3l/0pt`
> Kartlagd: 2026-08-10 · Metod: klon (git) + Gitea API (v1, token admin) + grep + live-prober
> Alla påståenden märkta **VERIFIERAT** / **ANTAGANDE** / **EJ VERIFIERAT** per AR-5.

---

## 1. Repo-identitet (VERIFIERAT — Gitea API)

| Fält | Värde |
|---|---|
| full_name | `sax3l/0pt` (id 21) |
| visibility | private |
| default_branch | `main` |
| HEAD (main) | `1346e868bf5c55c6771377c60a3ab7d3dd789ffc` (2026-08-09) |
| branches | 8 (main, fix/remove-vercel-deploy-target, unify/github-main-2026-07-28, docs/1p-egress-measurement-point, compliance/remove-evasion-stack, renovate/configure, foundation/hardening, feature/0pt-remove-noncompliant-scrapers) |
| språk | TypeScript (dominerande) + Python (engine + scrapers) |
| storlek | ~22 MB (inkl. committed skrapdata `services/scrapers/output/*.json` + `__pycache__/*.pyc`) |
| licens | egen (proprietär, SIAX Technology AB — LICENSE-fil finns) |
| Gitea | 1.26.4; Actions aktiverade (`has_actions: true`) |

**Historik:** Repot har haft två remotes (github.com/sax3l/0pt + git.siax.io/sax3l/0pt)
som divergerade; unifierades 2026-07-28 i Gitea main (merge `a714668`). Gitea main
är nu det gemensamma trädet. VERIFIERAT via merge-commits + CLAUDE.md-dokumentation.

## 2. Filträd (VERIFIERAT — git ls-files)

```
0pt/
├─ app/                    # Next.js 16 App Router: 20 sidor (sv UI-copy) + 28 API-routehandlers
│  └─ api/                 # health, orders, estimates, 0pt/*, auth/*, payments/*, admin/metrics,
│                          #   screen, uploads, vehicles, subscriptions, connections, webhooks/stripe, ai/parse
├─ components/             # shadcn/ui + sections + DataArtifact/ProvenanceBadge
├─ lib/                    # db, engine, auth, stripe, orders-store, subscriptions-store, data, services
├─ src/                    # capability-lagret (TS): clients (cl0ud, n0d, aud0, st0re, st0re-lakehouse),
│  │                       #   services (dataset, source, source-query, iceberg-write, document-capture/-extraction,
│  │                       #   external-writeback, source-rate-policy, dataset-iceberg-mapping), adapters, auth, types
├─ services/
│  ├─ api/                 # FastAPI-engine: orchestrator/main.py (12 endpoints) + workers (adaptive_router,
│  │                       #   pipeline, queue, resolve, run) + sources (sources.yaml, connectors, financials)
│  ├─ scrapers/            # Skrapmotor Python: engine.py, engine_v2.py, waf_bypass.py, clickhouse_pipeline.py,
│  │                       #   s3_sync.py + committed output/*.json + __pycache__/*.pyc
│  └─ infra/               # docker-compose.data-stack.yml (clickhouse, trino, flaresolverr, tor-proxy, superset, postgres)
├─ infra/                  # docker-compose.yml (postgres+pgvector, redis, api, worker, nocodb, metabase, caddy) + Caddyfile
├─ sql/                    # 001_init.sql, 004_iceberg_write_boundary.sql, 005_..._gap_closure.sql
│                          #   (002/003 saknas — refereras av 3 filer, se GAP-1)
├─ packages/schemas/       # JSON Schemas 0pt.* (dataset_iceberg_mapping, iceberg_table, lineage_event, signal, source_rate_policy)
├─ tests/                  # vitest: auth/ + p0/ + validation/ (17+ testfiler)
├─ docs/                   # 01–12 + architecture/ARCHITECTURE.md (S1–S12-luckor) + P0_*-flöden
├─ .gitea/workflows/       # ci.yml, deploy.yml, health-check.yml
├─ .github/workflows/      # ci.yml (arv från GitHub-linjen, kvar efter unifiering)
├─ Dockerfile              # Coolify, multi-stage, icke-root (node), HEALTHCHECK /api/health
└─ root: package.json, pnpm-workspace.yaml, pnpm-lock.yaml, siax.config.json, renovate.json,
   .npmrc, .env.example, .gitignore, .dockerignore, middleware.ts, next.config.mjs, vitest.config.ts,
   tsconfig{,.check}.json, eslint.config.mjs, CLAUDE.md, README.md, SECURITY.md, LICENSE
```

## 3. Beroenden

### 3.1 JS/TS (VERIFIERAT — package.json + pnpm-lock.yaml)

- **next@16.0.10, react@19.2.0** (App Router), tailwindcss@4, shadcn/ui (Radix-primitiver),
  zod@3.25.76, jose (JWT-verifiering), stripe@22, postgres@3, recharts, sonner, vaul m.fl.
- devDeps: vitest@3, typescript@5, eslint@9, prettier@3.
- packageManager: `pnpm@9.15.9` (lockfile v9.0).
- **Namnet i package.json är fortfarande `"my-v0-project"`** (v0-exportartefakt, GAP-2).
- **Förbjudet beroende enligt AR-4 (VERIFIERAT):**
  - `@vercel/analytics@1.3.1` (package.json rad 48) — används i `app/layout.tsx` rad 4/64.
  - `next/font/google` (Inter + JetBrains Mono) — `app/layout.tsx` rad 3/11-12. Google Fonts hämtas
    vid byggtid → AR-4-brott.
  - Azure Document Intelligence (`DOC_INTELLIGENCE_*`) — env-guardad adapter
    `src/adapters/document-intelligence-adapter.ts` (befintlig funktionalitet, AR-1 behåller).
  - Cloudflare R2 (`app/api/uploads`) — env-guardad stub (AR-4: pågående migrering noteras).

### 3.2 Python engine (VERIFIERAT — services/api/requirements.txt)

fastapi, uvicorn, pydantic, httpx, asyncpg (oanvänd), python-dotenv, pyyaml,
rapidfuzz (enda matching-engine, `workers/resolve.py`), tenacity.
**saknas (plan i docs/07):** spaCy/transformers (NER), dedupe-paket (rapidfuzz täcker dedup),
DuckDB/polars, Playwright (kompliant, ej installerat), unstructured, OCR.

### 3.3 Python scrapers (VERIFIERAT — services/scrapers/requirements.txt)

curl_cffi, cloudscraper, httpx, aiohttp, requests, beautifulsoup4, lxml, boto3.
→ **Bypass-stacken.** BEHÅLLS INTACT per explicit användarbeslut (AR-1-undantag):
`waf_bypass.py` (FlareSolverr, Tor, cloudscraper, TLS-fingerprintbyte, proxypool, nodriver,
fake-identity) + `services/infra/docker-compose.data-stack.yml` (flaresolverr, tor-proxy) +
`workers/adaptive_router.py` ("all methods, no compliance restrictions").
Dokumenteras i GOLDEN-STANDARD-REPORT som medvetet val (SEC-kontroller ➖/⚠️).

### 3.4 Beroenden uppåt (VERIFIERAT — src/clients/*)

| OS/klient | Env | Fail-beteende |
|---|---|---|
| Zitadel (IdP) | `ZITADEL_ISSUER` (default id-customers.siax.io) | Fail-closed (401/403), `assertAuthConfigSafe` |
| CL0UD | `CL0UD_URL` | **Fail-open** → `allow` (lucka S5) |
| AUD0 | `AUD0_URL` | No-op (lucka S6) |
| ST0RE | `ST0RE_URL` | Mock-artefakt |
| N0D | `N0D_URL` | Mock-jobb |
| Stripe | `STRIPE_*` | 501 |

AR-8 (beroenden bara nedåt, K1 får inte bero på K2–K5): alla OS-beroenden är plattformsinternta
(CL0UD/ST0RE/N0D/AUD0/INF0 = K1). VERIFIERAT: inget beroende på kundrepon (contentroom,
v0-datahub, prt-* etc.) finns i 0pt.

## 4. Drift (VERIFIERAT 2026-08-10)

| Fråga | Läge | Bevis |
|---|---|---|
| Live-instans | **Vercel** (0pt.app) — Coolify avsett, ej provisionerat | README §Deploy + ARCHITECTURE §5 |
| Nod (flotta) | `siax.config.json` → `deploy.node: null` — ingen nod tilldelad | siax.config.json |
| Domän | `0pt.app` (live). `api.0pt.app`/`data.0pt.app`/`dash.0pt.app` (Caddy) EJ VERIFIERAT | README + ARCHITECTURE §5 |
| /api/health | 200, `{"ok":true,"db":"not_configured","queue":"not_configured"}` | live-probe 2026-08-10 |
| /api/0pt (anonym) | **200 anonymt** — middleware fail-closed verkar INTE köra i prod (lucka S1) | live-probe 2026-08-10 |
| /api/orders (anonym) | **200 anonymt** — inget skyddat (lucka S3) | live-probe 2026-08-10 |
| CI (Gitea Actions) | senaste ci.yml på main: **success** (run 3759, 2026-08-09). ~~deploy.yml: röd men **avsiktligt** (guard: placeholder-app-ID)~~ **korrigerat 2026-09-06:** cd.yml är **grön** och deployar på riktigt — `COOLIFY_APP_ID` är en riktig UUID, guarden passerar, `coolify deploy HTTP 200` (run 11695, jobb 26295, head `1ff34410`). 48 runs totalt vid ursprungsmätningen | Gitea API `/actions/runs`, `/actions/variables`, `/actions/secrets` |
| Secrets | Inga hårdkodade hemligheter hittade (grep-skannat). **Infisical ej inkopplat** — inga referenser i repot | grep + ARCHITECTURE §5 |
| Backup | Ingen (ingen DB i prod att backa upp) | ARCHITECTURE §6 |

## 5. Förbjudna beroenden — sammanfattning (AR-4)

| Träff | Fil | Åtgärd FAS |
|---|---|---|
| `@vercel/analytics` | package.json + app/layout.tsx | FAS 6: ta bort (ersättning saknas — ej betald SaaS) |
| `next/font/google` | app/layout.tsx | FAS 6: ersätt med självhämtade fonter (fontsource) |
| Azure Doc Intelligence | src/adapters/document-intelligence-adapter.ts (env-guardad) | FAS 6: behåll (AR-1) — dokumenteras ⚠️, migration → backlog |
| Cloudflare R2 | app/api/uploads/route.ts (env-guardad stub) | FAS 6: behåll (AR-1 + pågående migrering) — dokumenteras |

## 6. Kända luckor (arv från docs/architecture/ARCHITECTURE.md §7, verifierade)

S1 (middleware körs ej i prod — live-bekräftat 2026-08-10), S2 (tenant från body, ej session),
S3 (icke-/api/0pt-API saknar auth — live-bekräftat), S4 (escrow-release utan identitet),
S5 (CL0UD fail-open), S6 (AUD0 no-op), S7 (db-grant påstår kryptering som inte finns),
S8 (engine utan auth), S9 (bypass-kod — **medvetet behållen per kontoägarens
daterade beslut, Simon Axelsson 2026-08-11, se SECURITY.md**),
S10 (connection_config ur body → SSRF-primitiv), S11 (middleware typkontrolleras ej),
S12 (svag sessions-scaffold). + GAP-1 (sql/002–003 saknas), GAP-2 (package.json-namn).

## 7. Utfallsfil FAS 0

✅ `docs/compliance/INVENTORY.md` skapad. Redo för FAS 1.