adminandClaude Sonnet 5
2393f52768
CI (SIAX Cloud) / security (push) Successful in 20s
Security Scan (SIAX Cloud) / security (push) Successful in 20s
CI (SIAX Cloud) / quality (push) Successful in 41s
CI (SIAX Cloud) / security (pull_request) Successful in 20s
Security Scan (SIAX Cloud) / security (pull_request) Successful in 20s
CI (SIAX Cloud) / quality (pull_request) Successful in 41s
PR #15 already fixed AGENTS.md/SECURITY.md with a dated, attributed statement of the account owner's 2026-08-11 decision (Simon Axelsson, via an interactive decision prompt, responding to this repo's own removal proposal PR #7 which was verified clean/128 tests and closed unmerged -- no rationale beyond "keep it" was given or is invented). This PR finds and fixes every other place in the repo that still carried the earlier unattributed "medvetet anvandarbeslut" / "deliberate user decision" claim a compliance audit flagged as unverifiable: - docs/compliance/GOLDEN-STANDARD-REPORT.md: control C6 row + the "Bypass-undantag" formal section (the two places this doc was explicitly named to need checking) -- header gains a dated update note, C6 row and the section body get the same attributed statement as AGENTS.md/SECURITY.md. - docs/compliance/SLUTRAPPORT.md, docs/compliance/INVENTORY.md: historical session doc keeps its original text and gains a dated correction addendum; the INVENTORY.md evidence bullet is corrected in place. - docs/slo.md, CONTRIBUTING.md, prompts/002-compliance-audit.md, renovate.json, .gitea/workflows/security.yml: direct/living references to the exemption get the same attributed, dated pointer instead of the unattributed phrase. CLAUDE.md's general §1 anti-evasion policy text is untouched, per instruction -- this is a scoped exception note, not a change to the normative rule. No code changes. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
49 lines
1.9 KiB
Markdown
49 lines
1.9 KiB
Markdown
# SLO — 0pt
|
|
|
|
> Gäller när tjänsten är i produktion på flottan (Coolify). Nuläget (2026-08-10):
|
|
> live på Vercel, ingen DB — se särskilda noteringar. Ägare: Simon Axelsson.
|
|
|
|
## Tillgänglighet
|
|
|
|
| SLO | Mål | Nuläge (2026-08-10) |
|
|
|---|---|---|
|
|
| `/api/health` (liveness) | 99,9 % | ✅ 200 (men alltid `ok:true` — readiness saknas, se D2) |
|
|
| Orderflöde `/api/orders` | 99,5 % | ⚠️ fungerar utan DB (in-memory), data försvinner vid restart |
|
|
| Capability-API `/api/0pt/*` | 99,5 % | ⚠️ live 200 anonymt (lucka S1) — målbild: 401 utan token |
|
|
| Engine (FastAPI, när deployad) | 99,0 % | ej deployad (EJ VERIFIERAT) |
|
|
|
|
## Latens (p95)
|
|
|
|
| Operation | Mål |
|
|
|---|---|
|
|
| `/api/health` | < 200 ms |
|
|
| `/api/estimates` | < 500 ms |
|
|
| `0pt.query_source` (enkla källor) | < 2 s |
|
|
| Iceberg-write (tung) | ej mätbart sync — asynkront via N0D-jobb |
|
|
|
|
## Data & proveniens
|
|
|
|
- **Proveniens per fält:** 100 % av levererade fält bär `bridge_provenance`
|
|
(källa, färskhet, konfidens, level). Målbild; i dag är leverans in-memory.
|
|
- **Inga fabricerade värden:** 100 % — hård garanti (never-fabricate-tester finns).
|
|
- **Retention/deletion-after-job:** mål 100 % av jobb — **inte implementerat**
|
|
(BACKLOG P2-2).
|
|
|
|
## Säkerhet (baskrav)
|
|
|
|
- 0 kända hårdkodade hemligheter i repo (skannat 2026-08-10: 0 träffar).
|
|
- Auth fail-closed i kod; **live-verifierad 401 krävs före produktionslöfte**
|
|
(lucka S1 öppen).
|
|
- Ingen betald SaaS-plattform som driftkrav (AR-4) — Stripe är kundval, env-guardad.
|
|
|
|
## Rapportering
|
|
|
|
- Mätning sker manuellt vid incidenter tills observabilitet är inkopplad
|
|
(BACKLOG P2-4). Mål: automatiska hälsokontroller via nightly.yml + Coolify.
|
|
|
|
## Undantag
|
|
|
|
Bypass-stacken (`services/scrapers/*`) är medvetet behållen per kontoägarens
|
|
daterade beslut (Simon Axelsson, 2026-08-11 — se SECURITY.md) och omfattas
|
|
inte av ovanstående SLO; dess körtid är ej mätbar i 0pt-SLO:er.
|