adminandClaude Sonnet 5
2393f52768
PR #15 already fixed AGENTS.md/SECURITY.md with a dated, attributed statement of the account owner's 2026-08-11 decision (Simon Axelsson, via an interactive decision prompt, responding to this repo's own removal proposal PR #7 which was verified clean/128 tests and closed unmerged -- no rationale beyond "keep it" was given or is invented). This PR finds and fixes every other place in the repo that still carried the earlier unattributed "medvetet anvandarbeslut" / "deliberate user decision" claim a compliance audit flagged as unverifiable: - docs/compliance/GOLDEN-STANDARD-REPORT.md: control C6 row + the "Bypass-undantag" formal section (the two places this doc was explicitly named to need checking) -- header gains a dated update note, C6 row and the section body get the same attributed statement as AGENTS.md/SECURITY.md. - docs/compliance/SLUTRAPPORT.md, docs/compliance/INVENTORY.md: historical session doc keeps its original text and gains a dated correction addendum; the INVENTORY.md evidence bullet is corrected in place. - docs/slo.md, CONTRIBUTING.md, prompts/002-compliance-audit.md, renovate.json, .gitea/workflows/security.yml: direct/living references to the exemption get the same attributed, dated pointer instead of the unattributed phrase. CLAUDE.md's general §1 anti-evasion policy text is untouched, per instruction -- this is a scoped exception note, not a change to the normative rule. No code changes. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
9.0 KiB
INVENTORY — 0pt (sax3l/0pt) — FAS 0
Kategori: platform (K1) · Subkategori: data-os · Repo:
git.siax.io/sax3l/0ptKartlagd: 2026-08-10 · Metod: klon (git) + Gitea API (v1, token admin) + grep + live-prober Alla påståenden märkta VERIFIERAT / ANTAGANDE / EJ VERIFIERAT per AR-5.
1. Repo-identitet (VERIFIERAT — Gitea API)
| Fält | Värde |
|---|---|
| full_name | sax3l/0pt (id 21) |
| visibility | private |
| default_branch | main |
| HEAD (main) | 1346e868bf5c55c6771377c60a3ab7d3dd789ffc (2026-08-09) |
| branches | 8 (main, fix/remove-vercel-deploy-target, unify/github-main-2026-07-28, docs/1p-egress-measurement-point, compliance/remove-evasion-stack, renovate/configure, foundation/hardening, feature/0pt-remove-noncompliant-scrapers) |
| språk | TypeScript (dominerande) + Python (engine + scrapers) |
| storlek | ~22 MB (inkl. committed skrapdata services/scrapers/output/*.json + __pycache__/*.pyc) |
| licens | egen (proprietär, SIAX Technology AB — LICENSE-fil finns) |
| Gitea | 1.26.4; Actions aktiverade (has_actions: true) |
Historik: Repot har haft två remotes (github.com/sax3l/0pt + git.siax.io/sax3l/0pt)
som divergerade; unifierades 2026-07-28 i Gitea main (merge a714668). Gitea main
är nu det gemensamma trädet. VERIFIERAT via merge-commits + CLAUDE.md-dokumentation.
2. Filträd (VERIFIERAT — git ls-files)
0pt/
├─ app/ # Next.js 16 App Router: 20 sidor (sv UI-copy) + 28 API-routehandlers
│ └─ api/ # health, orders, estimates, 0pt/*, auth/*, payments/*, admin/metrics,
│ # screen, uploads, vehicles, subscriptions, connections, webhooks/stripe, ai/parse
├─ components/ # shadcn/ui + sections + DataArtifact/ProvenanceBadge
├─ lib/ # db, engine, auth, stripe, orders-store, subscriptions-store, data, services
├─ src/ # capability-lagret (TS): clients (cl0ud, n0d, aud0, st0re, st0re-lakehouse),
│ │ # services (dataset, source, source-query, iceberg-write, document-capture/-extraction,
│ │ # external-writeback, source-rate-policy, dataset-iceberg-mapping), adapters, auth, types
├─ services/
│ ├─ api/ # FastAPI-engine: orchestrator/main.py (12 endpoints) + workers (adaptive_router,
│ │ # pipeline, queue, resolve, run) + sources (sources.yaml, connectors, financials)
│ ├─ scrapers/ # Skrapmotor Python: engine.py, engine_v2.py, waf_bypass.py, clickhouse_pipeline.py,
│ │ # s3_sync.py + committed output/*.json + __pycache__/*.pyc
│ └─ infra/ # docker-compose.data-stack.yml (clickhouse, trino, flaresolverr, tor-proxy, superset, postgres)
├─ infra/ # docker-compose.yml (postgres+pgvector, redis, api, worker, nocodb, metabase, caddy) + Caddyfile
├─ sql/ # 001_init.sql, 004_iceberg_write_boundary.sql, 005_..._gap_closure.sql
│ # (002/003 saknas — refereras av 3 filer, se GAP-1)
├─ packages/schemas/ # JSON Schemas 0pt.* (dataset_iceberg_mapping, iceberg_table, lineage_event, signal, source_rate_policy)
├─ tests/ # vitest: auth/ + p0/ + validation/ (17+ testfiler)
├─ docs/ # 01–12 + architecture/ARCHITECTURE.md (S1–S12-luckor) + P0_*-flöden
├─ .gitea/workflows/ # ci.yml, deploy.yml, health-check.yml
├─ .github/workflows/ # ci.yml (arv från GitHub-linjen, kvar efter unifiering)
├─ Dockerfile # Coolify, multi-stage, icke-root (node), HEALTHCHECK /api/health
└─ root: package.json, pnpm-workspace.yaml, pnpm-lock.yaml, siax.config.json, renovate.json,
.npmrc, .env.example, .gitignore, .dockerignore, middleware.ts, next.config.mjs, vitest.config.ts,
tsconfig{,.check}.json, eslint.config.mjs, CLAUDE.md, README.md, SECURITY.md, LICENSE
3. Beroenden
3.1 JS/TS (VERIFIERAT — package.json + pnpm-lock.yaml)
- next@16.0.10, react@19.2.0 (App Router), tailwindcss@4, shadcn/ui (Radix-primitiver), zod@3.25.76, jose (JWT-verifiering), stripe@22, postgres@3, recharts, sonner, vaul m.fl.
- devDeps: vitest@3, typescript@5, eslint@9, prettier@3.
- packageManager:
pnpm@9.15.9(lockfile v9.0). - Namnet i package.json är fortfarande
"my-v0-project"(v0-exportartefakt, GAP-2). - Förbjudet beroende enligt AR-4 (VERIFIERAT):
@vercel/analytics@1.3.1(package.json rad 48) — används iapp/layout.tsxrad 4/64.next/font/google(Inter + JetBrains Mono) —app/layout.tsxrad 3/11-12. Google Fonts hämtas vid byggtid → AR-4-brott.- Azure Document Intelligence (
DOC_INTELLIGENCE_*) — env-guardad adaptersrc/adapters/document-intelligence-adapter.ts(befintlig funktionalitet, AR-1 behåller). - Cloudflare R2 (
app/api/uploads) — env-guardad stub (AR-4: pågående migrering noteras).
3.2 Python engine (VERIFIERAT — services/api/requirements.txt)
fastapi, uvicorn, pydantic, httpx, asyncpg (oanvänd), python-dotenv, pyyaml,
rapidfuzz (enda matching-engine, workers/resolve.py), tenacity.
saknas (plan i docs/07): spaCy/transformers (NER), dedupe-paket (rapidfuzz täcker dedup),
DuckDB/polars, Playwright (kompliant, ej installerat), unstructured, OCR.
3.3 Python scrapers (VERIFIERAT — services/scrapers/requirements.txt)
curl_cffi, cloudscraper, httpx, aiohttp, requests, beautifulsoup4, lxml, boto3.
→ Bypass-stacken. BEHÅLLS INTACT per explicit användarbeslut (AR-1-undantag):
waf_bypass.py (FlareSolverr, Tor, cloudscraper, TLS-fingerprintbyte, proxypool, nodriver,
fake-identity) + services/infra/docker-compose.data-stack.yml (flaresolverr, tor-proxy) +
workers/adaptive_router.py ("all methods, no compliance restrictions").
Dokumenteras i GOLDEN-STANDARD-REPORT som medvetet val (SEC-kontroller ➖/⚠️).
3.4 Beroenden uppåt (VERIFIERAT — src/clients/*)
| OS/klient | Env | Fail-beteende |
|---|---|---|
| Zitadel (IdP) | ZITADEL_ISSUER (default id-customers.siax.io) |
Fail-closed (401/403), assertAuthConfigSafe |
| CL0UD | CL0UD_URL |
Fail-open → allow (lucka S5) |
| AUD0 | AUD0_URL |
No-op (lucka S6) |
| ST0RE | ST0RE_URL |
Mock-artefakt |
| N0D | N0D_URL |
Mock-jobb |
| Stripe | STRIPE_* |
501 |
AR-8 (beroenden bara nedåt, K1 får inte bero på K2–K5): alla OS-beroenden är plattformsinternta (CL0UD/ST0RE/N0D/AUD0/INF0 = K1). VERIFIERAT: inget beroende på kundrepon (contentroom, v0-datahub, prt-* etc.) finns i 0pt.
4. Drift (VERIFIERAT 2026-08-10)
| Fråga | Läge | Bevis |
|---|---|---|
| Live-instans | Vercel (0pt.app) — Coolify avsett, ej provisionerat | README §Deploy + ARCHITECTURE §5 |
| Nod (flotta) | siax.config.json → deploy.node: null — ingen nod tilldelad |
siax.config.json |
| Domän | 0pt.app (live). api.0pt.app/data.0pt.app/dash.0pt.app (Caddy) EJ VERIFIERAT |
README + ARCHITECTURE §5 |
| /api/health | 200, {"ok":true,"db":"not_configured","queue":"not_configured"} |
live-probe 2026-08-10 |
| /api/0pt (anonym) | 200 anonymt — middleware fail-closed verkar INTE köra i prod (lucka S1) | live-probe 2026-08-10 |
| /api/orders (anonym) | 200 anonymt — inget skyddat (lucka S3) | live-probe 2026-08-10 |
| CI (Gitea Actions) | senaste ci.yml på main: success (run 3759, 2026-08-09). deploy.yml: röd men avsiktligt (guard: placeholder-app-ID). 48 runs totalt | Gitea API /actions/runs |
| Secrets | Inga hårdkodade hemligheter hittade (grep-skannat). Infisical ej inkopplat — inga referenser i repot | grep + ARCHITECTURE §5 |
| Backup | Ingen (ingen DB i prod att backa upp) | ARCHITECTURE §6 |
5. Förbjudna beroenden — sammanfattning (AR-4)
| Träff | Fil | Åtgärd FAS |
|---|---|---|
@vercel/analytics |
package.json + app/layout.tsx | FAS 6: ta bort (ersättning saknas — ej betald SaaS) |
next/font/google |
app/layout.tsx | FAS 6: ersätt med självhämtade fonter (fontsource) |
| Azure Doc Intelligence | src/adapters/document-intelligence-adapter.ts (env-guardad) | FAS 6: behåll (AR-1) — dokumenteras ⚠️, migration → backlog |
| Cloudflare R2 | app/api/uploads/route.ts (env-guardad stub) | FAS 6: behåll (AR-1 + pågående migrering) — dokumenteras |
6. Kända luckor (arv från docs/architecture/ARCHITECTURE.md §7, verifierade)
S1 (middleware körs ej i prod — live-bekräftat 2026-08-10), S2 (tenant från body, ej session), S3 (icke-/api/0pt-API saknar auth — live-bekräftat), S4 (escrow-release utan identitet), S5 (CL0UD fail-open), S6 (AUD0 no-op), S7 (db-grant påstår kryptering som inte finns), S8 (engine utan auth), S9 (bypass-kod — medvetet behållen per kontoägarens daterade beslut, Simon Axelsson 2026-08-11, se SECURITY.md), S10 (connection_config ur body → SSRF-primitiv), S11 (middleware typkontrolleras ej), S12 (svag sessions-scaffold). + GAP-1 (sql/002–003 saknas), GAP-2 (package.json-namn).
7. Utfallsfil FAS 0
✅ docs/compliance/INVENTORY.md skapad. Redo för FAS 1.