124 Commits

Include renames

Author	SHA1	Message	Date
SIAX Agent	6bbbcf75d4	test(lint): typa idempotency-store i stället för any (blockerar quality-gaten) ... tests/siax-access/idempotency.test.ts hade fyra @typescript-eslint/no-explicit-any vilket fick quality-jobbet att exita 1 (133 testfiler gröna men lint röd) och därmed blockerade alla PR:er. Använder exporterade IdempotencyStore<unknown, {x:number}>; eslint rent, 7/7 tester gröna.	2026-11-07 18:15:04 +01:00
SIAX Agent	1a581fde29	fix(auth): en (1) tenant per intern serviceprincipal — multi-tenant nekas ... Den delade X-Internal-Token identifierar EN tjänsteprocess, inte flera oberoende principaler. En allowlist med flera tenants skulle låta varje tokeninnehavare välja mellan dem — samma klientstyrda auktoritet som guarden ska ta bort. Multi-tenant-tjänsteåtkomst kräver verifierad workload-identity-binding (CL0UD-delegation); tills den finns failar en ambig konfiguration stängt (401) och ingen identitet forwardas. Tester: multi-tenant nekas utan side effect, en tenant fungerar, 75/75 i auth+ cross-tenant-sviterna, tsc ren.	2026-11-07 16:39:48 +01:00
SIAX Agent	b97ad0b2f4	fix(auth): bind internal-service tenant authority to server config ... The first revision of this fix copied a CLIENT header (X-0pt-Internal-Tenant) or a single INTERNAL_TENANT_ID into x-0pt-verified-tenant. That is not an authorization source: any holder of the shared internal token could still name any tenant, leaving the original cross-tenant write reachable through a different header. - INTERNAL_SERVICE_TENANTS (server env) is now the only tenant authority for the X-Internal-Token principal; empty => no authority (fail closed, 403). - Middleware strips inbound x-0pt-verified-{tenant,sub} and the service scope header on every path, including the dev escape hatch. - x-0pt-verified-service-tenants carries the allowlist; the tenant guard checks membership and denies anything outside it. - POST /api/0pt/quality/bridge-run now runs the same tenant guard as canonical/facts (it auto-provisions tenant-scoped rules). - 16 new regression tests; auth + cross-tenant + canonical + bridge suites 87/87; tsc --noEmit clean.	2026-11-07 15:32:51 +01:00
admin	f77a4fec96	feat(@siax/access): universal idempotency contract ... operationIdentity binds tenant/project/actor + every result-affecting input into a stable fingerprint; a changed payload under the same key is a CONFLICT, never a replay of someone else's receipt. runIdempotentOperation encodes the 0pt-proven order (durable claim -> downstream dispatch -> save receipt -> replay) and the commit boundaries. Structural IdempotencyStore lets each product ship its own Postgres adapter while sharing the contract. Derived from 0pt's durable upload attempts; DOC0/N0D can adopt the same shape instead of re-implementing it.	2026-11-06 10:47:59 +01:00
admin	6ca6e8e0a6	feat(idempotency): operation-scope binding for upload identity ... Per the reap-use mandate: 'identical file + different instruction' is a DIFFERENT operation. bindOperationToUploadIdentity() folds instruction, field contract, model, data class and export format into the DOC0-compatible upload filename so the durable fingerprint covers every result-affecting input. The bytes' SHA-256 stays stable; DOC0 still receives the caller's x-idempotency-key (its own idempotency, its own contract). Classification: STANDARDIZE/0pt-owned (upstream DOC0 untouched).	2026-11-06 10:29:59 +01:00
admin	c46ebbf810	feat(0pt): canonical-fact machine route + renumber migration to 022 (#484)	2026-11-05 19:16:13 +00:00
admin	03cdb7815e	feat(0pt): canonical structured observations — entities, facts, relations (#480)	2026-11-05 17:53:34 +00:00
admin	063206d8b0	feat(auth): adopt @siax/auth-zitadel canonical claim normalizer	2026-11-04 02:23:21 +01:00
admin	92eb78ba0a	fix(upload): an idempotent retry returns the same verified receipt ... A client retry with the same idempotency key replayed the journal and got 'outcome_unknown' even when the first upload had succeeded, because the verified DOC0 receipt was never persisted. Store document/version/checksum/ stage on the attempt (sql/021) and return it on replay; only a missing receipt falls back to observation. No second POST, no duplicate document.	2026-11-03 00:35:32 +01:00
admin	dade37ee05	feat(credits): one-time trial grant so the ledger runs in production ... - Ledger accepts kind='grant' (a server-owned balance grant, not a payment). - OPT_TRIAL_CREDITS=N grants N credits once per tenant (idempotent key trial:<tenant>) on balance/structure, so reserve -> settle is exercised before any customer purchase. - sql/020 extends the kind constraint (re-runnable). - Tests for the grant helper; full suite 1345 passed.	2026-11-02 22:05:06 +01:00
admin	c7187368de	fix(workbench): accept a JSON-number decimal and deliver the source's exact string ... The local model returns 12500.00 as a JSON number, which the contract rejects as a non-string decimal. A numeric value now matches a source span numerically and the delivered value is rewritten to that span's decimal string (12500.00), so precision is preserved instead of rounded. Exact string equality is still required for string decimals, and ambiguous formats still go to review.	2026-11-02 18:07:52 +01:00
admin	8b571cf2f4	fix(decision-ollama): use Ollama's native JSON mode without thinking ... The 9B model spent its whole 4000-token budget on reasoning and came back model_incomplete. Call /api/chat with format=json, think=false and num_predict, and read prompt_eval_count/eval_count/done_reason. Structured extraction no longer needs chain-of-thought.	2026-11-02 17:51:09 +01:00
admin	6c4f1998dc	feat(workbench): locale-aware decimal/date evidence without an AI dependency ... A source span now supports a decimal ('12 500,00' -> '12500.00') or a date ('14/10/2026' -> '2026-10-14') when the reading is unambiguous. Ambiguous formats (01/02/2026, 1,234) still go to review. Evidence derivation scans the source for typed candidates, so the local decision-server model only has to return values, not UTF-16 offsets.	2026-11-02 17:39:31 +01:00
admin	c33d88f0ea	fix(workbench): tolerate flat or fenced JSON from a small local model ... The decision-server model sometimes returns {field: value} or wraps the JSON in a markdown fence. Accept both, while still requiring every value to be an exact, unique substring of the source before it can be validated.	2026-11-02 17:18:34 +01:00
admin	525bf6b9a0	feat(workbench): use the decision server's local model while the AI API is on hold ... - DecisionOllamaGatewayClient calls the self-hosted Ollama on server-decision-01 (tailnet HTTP only for loopback/RFC1918/100.64-127), keeps the same local admission and reports providerKind=local. - createInf0Gateway prefers it over INF0/LiteLLM when configured. - Evidence is computed deterministically from values when a small model omits offsets; a value must occur exactly once in the source or the result goes to review. This makes a 9B local model usable without weakening verification. Tests: 4 new gateway cases + 2 evidence-derivation cases; full typecheck green.	2026-11-02 17:09:42 +01:00
admin	48dff2078e	fix(admission): zero maximumCredits means pilot mode, not a missing reservation ... The structure route ran the model with maximumCredits=1 and no reservation when credits were off, so admission returned reservation_required and the route answered 502. Admission now requires a reservation only when maximumCredits>0. Verified against the live stack: DOC0 segments -> LiteLLM/Ollama (inf0-valuation) -> evidence validation -> needs_review (no export).	2026-11-02 16:42:01 +01:00
admin	e3c4bc28c3	feat(workbench): live LiteLLM gateway adapter + explicit project grants ... - createInf0Gateway prefers the live OpenAI-compatible LiteLLM gateway and falls back to the native INF0 surface; admission stays local and fail-closed. - Project authorization: OpenFGA when configured, otherwise a validated server-owned OPT_PROJECT_GRANTS list (deny by default). - Tests for the gateway adapter, the factory and grants.	2026-11-02 14:50:50 +01:00
admin	b3239487b7	feat(document-workbench): wire customer upload, structuring, credits and readiness ... - POST /api/0pt/documents/upload: real multipart bytes into DOC0 through the durable attempt journal and the existing coordinator; verified tenant/actor only, project authorization fail-closed. - POST /api/0pt/documents/structure: DOC0 segments -> INF0 -> evidence-bound validation -> optional JSON/CSV export, with credit reserve/settle. - Credits: balance, server-owned price book, Stripe Checkout and idempotent webhook reconciliation via a Stripe re-read of session + payment intent. - /portal/dokument and /portal/krediter: SIAX-styled workspace. - @siax/access: universal, framework-neutral OpenFGA project relationship primitive reusable by DOC0/N0D/other products. - Readiness: real Redis PING probe instead of presence-only; queue is now a live dependency when configured. - Dockerfile: copy every workspace manifest so --frozen-lockfile works. - Format/build hygiene: .prettierignore, .worktrees ignored, valid manifest YAML.	2026-11-02 14:46:10 +01:00
admin	d56ccbb542	feat: validate and export evidenced document batches	2026-11-02 08:37:11 +01:00
admin	c1244a298c	fix: bind DOC0 upload receipts to original request	2026-11-02 08:24:18 +01:00
admin	243c45c0f2	Merge pull request 'Enforce tenant isolation for document credit storage' (#422) from codex/credit-ledger-tenant-rls into main	2026-11-02 06:41:36 +00:00
admin	0f734297ce	fix: enforce tenant isolation on credit storage	2026-11-02 07:39:35 +01:00
admin	da5a7f403e	fix: bind model results to immutable evidence and policy	2026-11-02 07:34:47 +01:00
admin	ce41d601f7	feat: coordinate journaled document upload attempts	2026-11-02 07:17:32 +01:00
admin	347b81ceb4	Merge pull request 'Distinguish unavailable sources from empty results' (#419) from codex/source-failure-honesty into main	2026-11-02 06:09:10 +00:00
admin	5137bf87a1	fix: distinguish failed sources from empty results	2026-11-02 06:58:15 +01:00
admin	47e0264571	fix: stabilize DOC0 upload fingerprint metadata	2026-11-02 06:52:50 +01:00
admin	cf37a66d35	feat: persist scoped document upload attempts	2026-11-02 03:48:13 +01:00
admin	f79853d156	feat: inspect document upload journal from 0pt	2026-11-02 03:06:56 +01:00
admin	eec8cb2396	feat: validate source-backed decimals and dates	2026-11-02 02:20:54 +01:00
admin	4d56a1dd62	fix: reconcile uncertain document uploads	2026-11-02 02:17:55 +01:00
admin	70b92e2fea	fix: secure document upload transport	2026-11-02 02:09:45 +01:00
admin	daa0a2415f	feat: add evidence-checked document exports	2026-11-02 02:03:48 +01:00
admin	bd1c20edb2	feat: add guarded document workbench foundations	2026-11-02 01:26:36 +01:00
admin	179f8dc478	test(doctor): använd siax.repo.v3.json i fixturen (matchar doctorn)	2026-11-01 01:46:56 +01:00
admin	6784f42696	Merge main into fix/prod-truth-20260922 (syntetiska mutation-fixturer behållna; main:s nyare evidens-tidsstämpel)	2026-10-30 17:13:47 +01:00
Claude CodeandClaude Sonnet 5.5	d5539ac638	fix(ci): stamp live-ClickHouse seed events relative to now (30-day raw-event TTL expired the fixed 2026-09 timestamps) ... Root cause of red integration job on main/#173/#174: opt_analytics_event has TTL event_time + 30 DAY; seeds dated 2026-09-01 expired on 2026-10-01 so tenant-isolation reads returned 0 rows. Same time bomb latent in 3 sibling suites. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-02 18:38:23 +02:00
admin	1c87b82e70	feat(import): ImportDispatchPolicy (DES1GN ADR D3 §31) — ett objekt, en sanning ... - lib/import-dispatch-policy.ts: maxInlineRows=500 (inline-tak, oförändrat kontrakt), maxRows=5000 (N0D-dispatch-signal), maxBytes=1_000_000 (bytes, UTF-8), format-allowlist ['csv']; ren evaluateImportDispatch() med deterministisk precedens format > bytes > rows - route: taken härstammar från policyn; bytes-koll (ersätter chars); rows > maxRows -> 413 n0d_dispatch_required med hint {capability_id: 0pt.import_execute, job_type: 0pt.import_execute_job, status: UNVERIFIED} (descriptor-gate stängd: aldrig tyst trunkering, aldrig tyst dispatch) - tester: 9 nya (verdict per kombination inkl. gränsvärden 500/501/5000/5001, bytes-gräns, allowlist, precedens; route-koppling 200/413/413) — 21/21 gröna i sviten; full N0D-worker-integration markeras UNVERIFIED	2026-09-30 21:48:16 +02:00
admin	04813c34b0	feat(collab): order-anteckningar — @siax/collaboration-kernelns första produktkonsument (spår C) ... Kernel 0.3.0 används som capability, inte som paket-dekor: - lib/order-notes-store.ts: varje note ÄR en CollaborationOperation; nextLamportClock för nya klockor, mergeOperationLog/compareOperations för deterministisk listning; optimistisk version -> 409 vid stale skrivning. - lib/order-notes-client.ts: kernel-CollaborationTransport över host-API; offline = medvetet no-op + varning (ingen tyst förlust), 409 -> ConflictError. - app/api/admin/order-notes: requireRouteAuth (fail-closed 401), server-authoritative tenant-guard (403), AUD0-audit via hostens klient. - app/admin/notes: admin-yta med offline-växel, konflikt-banner + reload. - sql/016_order_notes.sql: persistens (DB-tabell, version + Lamport-klocka). Tester: API (happy/conflict 409/empty/400/401/403/404), klient-adapter (offline no-op utan fetch, 409-mappning, presence), SSR-render. 18 nya test.	2026-09-30 17:07:21 +02:00
admin	c1648c04a7	feat(orders): CSV-import admin-yta — första riktiga ImportWizard-värden (C8) ... Symmetrisk mot våg 3.4 CSV-export: POST /api/orders/import (validate | dry_run | execute) + /admin/import som renderar @siax/ui ImportWizard (0.14.0) över @siax/import-export runtime (0.2.0). - Servern är enda auktoritet: RFC4180-parse (ingen eval), omvalidering via frysta @siax/contracts-kerneln (validateRows) + hostregler, exekvering genom BEFINTLIG orderlogik (createOrder, tenant-guardad). - Fail-closed: 401 utan principal, 400 okänd header, 413 vid radtak (500), per-rad-atomsäkra inserts — felrad kan aldrig skada OK-rader. - Partiell import: OK-rader skapas, felrader rapporteras per rad (row/field/code). AUD0-audit via 0pts enda producer-boundary (durable outbox under DATABASE_URL). - Reload-persistens: efter execute läses /api/orders om och de nya raderna listas på sidan. - Tester: 12 route-test (happy, partial, auth fail-closed, tak, no-write validate, header, quoting, rad-fel mitt i batch) + 3 SSR-render-test av ImportWizard över runtime-storen. - Deps: @siax/ui ^0.14.0, @siax/charts ^0.5.0, @siax/import-export ^0.2.0; pnpm-overrides till contracts 0.10.0 / import-export 0.2.0 (ui 0.14.0 deklarerar 0.11.0/0.2.1 som ännu ej publicerats).	2026-09-30 15:36:02 +02:00
admin	0386d82c49	fix(health): engine-kollen ärlig (not_configured när URL saknas) + EVIDENCE-docs mot Coolify-verkligheten	2026-09-30 10:08:25 +02:00
admin	c3582838aa	feat(orders): kanonisk statusmaskin + guardad DB-constraint (ADR-0002, C3)	2026-09-29 21:15:35 +02:00
admin	bc76ebc5e5	feat(orders): CSV-export-endpoint — export-kernelns första adoption (våg 3.4)	2026-09-29 17:01:13 +02:00
admin	a2377215e7	feat(admin): InboxList — orderkön som universal inkorg (våg 3.3-adoption) ... Servern projicerar öppna ordrar (draft/quoted/in_production/review) på universal-inbox-konvolverna via createInboxItem (buildOrderInboxItem i lib/order-flow, ADR-0001-mönstret: policy/resolution i serverlagret). Admin renderar InboxList (@siax/ui 0.11.1) ovanpå orderkön — resolve- aktionen gateras genom advance_action-state (available krävs). Terminala statusar ger ingen post. tests/order-flow 6/6; full svit 1144/1144; build ✓.	2026-09-29 16:10:10 +02:00
admin	5ffd41a461	fix(lint): odoo-bills-adapter AUD0-body — disable med skäl (CI-fynd)	2026-09-29 13:27:31 +02:00
admin	e24f8e8af4	fix(lint): typa AUD0-ingest-body i external-writeback-testet (CI-fynd)	2026-09-29 13:17:00 +02:00
admin	3279fa0533	fix(lint): eslint-undantag på rätt rader — json:any i graph-adapter + require-fixtures ... eslint-disable-next-line gällde nästa rad; json:any-linen behövde eget undantag. npm run lint: 0 errors (8→0). 1141/1141.	2026-09-29 12:50:06 +02:00
admin	1b6140a16a	fix(lint): rotfelsa ärvd lint-skuld — graph-adapter + p0-tester (blockerade #128) ... Parallellsessions-merge lämnade 12 eslint-errors på main (no-explicit-any i graph-mailbox-adapter + 2 p0-tester). Graph-JSON:n är genuint ostrukturerad — medveten, avgränsad eslint-undantag med skäl (DoD §13); p0-testerna typade med Record/cast. Lint 0 errors; tsc grön; 1141/1141.	2026-09-29 12:31:34 +02:00
admin	a49bc148fc	feat(admin): authz-pilot — server-renderad advance-resolution + ActionGate (ADR-0001) ... GET /api/orders returnerar per order frozen advance_action (resolveAction ur lib/order-flow); admin renderar via ActionGate — policy i serverlagret, presentation i klienten (DoD §21). Terminala/okända statusar → read_only med varför-text i stället för missvisande 'klar'. tests/order-flow.test.ts 3/3; full svit 1138 godkända; typecheck grön.	2026-09-29 12:21:02 +02:00
Claude CodeandClaude Sonnet 5	07158099ee	feat(ingestion): VehIQ OLTP -> ClickHouse watermark extractor (P070) ... Implements Simon's specified pattern (dealer_stock_entry/deal -> watermark/updated_at -> 0pt ingestion -> ClickHouse) as a P061 connector pair (PostgresWatermarkConnector, PostgresKeyedLookupConnector) plugged into the existing P062 IngestionRunner, writing to opt_dataset_projection via SiaxAnalyticsEngine.ingestProjection. Built here, not in admin/vehiq: that repo's own ADR-0035 (decisions 1/2/10, CI-enforced by validate_engine_firewall.py) forbids VehIQ code from ever holding a ClickHouse credential or hammering OLTP directly for analytics. See docs/P070_VEHIQ_OLTP_EXTRACTOR.md for the full rationale. Also corrects a real schema mismatch found while building this: production has no generic `updated_at` on any of the three target tables (verified live, read-only, 2026-09-25). dealer_stock_entry/deal use listed_at/ created_at as insert-time watermarks instead (documented caveat: in-place updates are not caught without a schema change); app.listing has no timestamp column at all and is deliberately not covered yet. Vehicle dimension lookup is narrow by construction: keyed on exactly the vehicle_id set referenced by the batch just read, never a scan of the 98M-row vehiq.vehicle table (connector-level validate() refuses that table by name; runner-level tests assert the query only ever touches referenced IDs). Verified: fixture-backed connector/runner tests (watermark+limit, same-timestamp tie at a page boundary, crash/resume, empty-table case, narrow-lookup query-count assertions) + a real disposable Postgres container (caught two real Date-handling bugs fixtures could not) + a read-only proof against actual production (server10, vehiq-db): the extractor's exact SQL returns zero rows, no error, confirming it is safe to schedule with zero current effect. .gitea/workflows/vehiq-oltp-ingest.yml is present, cron-scheduled, and defaults to VEHIQ_INGEST_MODE=preview (read-only, never writes) with no secrets configured — safe to merge with zero production effect until explicitly activated per the doc's "what activating this requires". Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-25 19:11:15 +02:00