66 lines
2.7 KiB
Markdown
66 lines
2.7 KiB
Markdown
# Onboarding — 0pt
|
|
|
|
BACKLOG P6 (DX-12). For a human or an agent picking this repo up cold.
|
|
|
|
## 1. Read, in order
|
|
|
|
1. `CLAUDE.md` — the contract for how this project is built. Non-negotiable
|
|
constraints (legal sourcing only, Postgres-backbone, provenance-per-field).
|
|
2. `AGENTS.md` — agent-specific ground rules.
|
|
3. `docs/architecture/ARCHITECTURE.md` — what the code actually does today
|
|
(as opposed to `docs/01-11`, which describe target state — see that
|
|
doc's own "Läsanvisning").
|
|
4. `README.md` "Known issues" — the live gaps, dated and evidenced.
|
|
5. `prompts/000-INDEX.md` — run `001-repo-health.md` before touching anything.
|
|
|
|
## 2. Get it running
|
|
|
|
```sh
|
|
corepack enable
|
|
corepack prepare pnpm@9 --activate
|
|
pnpm install --frozen-lockfile
|
|
pnpm run dev # http://localhost:3000, in-memory fallback, no DB needed
|
|
```
|
|
|
|
Or `make dev` (same thing). Want real Postgres locally instead of the
|
|
in-memory fallback? `make db-up` first (BACKLOG DX-02, `compose.dev.yaml` —
|
|
**unverified in CI, smoke-test before relying on it**), then re-run with
|
|
`DATABASE_URL` pointed at it (see the Makefile comment).
|
|
|
|
`pnpm run siax:doctor` (or `make doctor`) — runs the self-diagnostic subset
|
|
of the SIAX Golden Standard v2.0 checks locally (`scripts/siax-doctor.mjs`,
|
|
control AGENT-04). Run it after cloning and after any structural change.
|
|
|
|
## 3. Before you change anything
|
|
|
|
- `AUTH_ENFORCE` is fail-closed by default — don't set `AUTH_ENFORCE=false`
|
|
outside local dev, and never commit it set that way anywhere.
|
|
- `services/scrapers/*`, `services/infra/docker-compose.data-stack.yml`, and
|
|
`live/src/workers/adaptive_router.py`'s `curl_cffi` entries are frozen —
|
|
see `SECURITY.md`. Don't touch, remove, or comment on that code without an
|
|
explicit, current instruction from the account owner.
|
|
- Run `prompts/003-security-review.md`'s checklist before pushing anything
|
|
touching auth, payments, or the platform clients.
|
|
|
|
## 4. Before you push
|
|
|
|
```sh
|
|
pnpm run typecheck # blocking in CI
|
|
pnpm run test # blocking in CI
|
|
pnpm run build # blocking in CI
|
|
pnpm run lint # advisory, but fix what you can
|
|
```
|
|
|
|
CI (`.gitea/workflows/ci.yml`) re-runs all of these plus a blocking
|
|
Trivy/gitleaks scan (`security.yml`, BACKLOG P0-16/P0-19) — a red `trivy`
|
|
job on an otherwise-unrelated PR usually means a pre-existing dependency
|
|
finding, not something your change caused; check the run's date against
|
|
when that job started being blocking before assuming you broke it.
|
|
|
|
## 5. Who to ask
|
|
|
|
`CODEOWNERS` → `@sax3l` (Simon Axelsson). Two remotes exist for this repo
|
|
(`git.siax.io/sax3l/0pt` and `github.com/sax3l/0pt`) with independently
|
|
diverged history — which is authoritative is explicitly Simon's call, not
|
|
something to assume; see `CLAUDE.md`.
|