5 Commits

Include renames

Author	SHA1	Message	Date
admin	3d2fc6f913	fix(recovery): restore source removed by production documentation merge	2026-11-10 03:42:10 +01:00
admin	a4189333af	docs(production): standardiserad produktionsberedskap och gap-analys ... Lägger docs/production-readiness.md och siax/production-gaps.json enligt SIAX Master Definition of Done. Underlag: git-, kod- och live-evidens 2026-11-11. Nivån är evidensbaserad, inte ett leveransgodkännande.	2026-11-10 03:07:36 +01:00
admin	a88ad04867	fix(health): report real per-dependency status instead of hardcoded ok:true ... BACKLOG P0-3: /api/health only ever checked *presence* of DATABASE_URL/ REDIS_URL and always returned ok:true regardless of whether anything was reachable -- ARCHITECTURE.md's own words, "an uptime monitor watching HTTP 200 would show green for a dying instance". lib/health-checks.ts adds real dependency probes: - db: a live `select 1` round trip (not just DATABASE_URL presence) - engine: a real HTTP call to the FastAPI engine's own GET /health - stripe: Stripe's documented lightweight balance.retrieve() liveness call - queue: honestly reports "not_integrated" when REDIS_URL is set but unused -- no Redis client is wired anywhere in this repo, so reporting "ok" would fabricate a check that doesn't exist /api/health stays a liveness check (always 200 while the process can respond; the body's `ok` field is the honest signal). New GET /api/ready fails closed with 503 when the load-bearing dependency (db) isn't both configured and reachable -- the "no /ready route" gap. contracts/openapi.yaml, docs/architecture/ARCHITECTURE.md, and docs/slo.md updated to match. 17 new unit tests (dependency-injected fakes, no real network/DB) + 5 route-level tests.	2026-08-11 13:49:23 +02:00
adminandClaude Sonnet 5	2393f52768	docs(compliance): finish attributing the evasion-stack keep decision ... PR #15 already fixed AGENTS.md/SECURITY.md with a dated, attributed statement of the account owner's 2026-08-11 decision (Simon Axelsson, via an interactive decision prompt, responding to this repo's own removal proposal PR #7 which was verified clean/128 tests and closed unmerged -- no rationale beyond "keep it" was given or is invented). This PR finds and fixes every other place in the repo that still carried the earlier unattributed "medvetet anvandarbeslut" / "deliberate user decision" claim a compliance audit flagged as unverifiable: - docs/compliance/GOLDEN-STANDARD-REPORT.md: control C6 row + the "Bypass-undantag" formal section (the two places this doc was explicitly named to need checking) -- header gains a dated update note, C6 row and the section body get the same attributed statement as AGENTS.md/SECURITY.md. - docs/compliance/SLUTRAPPORT.md, docs/compliance/INVENTORY.md: historical session doc keeps its original text and gains a dated correction addendum; the INVENTORY.md evidence bullet is corrected in place. - docs/slo.md, CONTRIBUTING.md, prompts/002-compliance-audit.md, renovate.json, .gitea/workflows/security.yml: direct/living references to the exemption get the same attributed, dated pointer instead of the unattributed phrase. CLAUDE.md's general §1 anti-evasion policy text is untouched, per instruction -- this is a scoped exception note, not a change to the normative rule. No code changes. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-11 13:34:13 +02:00
admin	8db56f1b4c	docs: FAS 9 - README/SECURITY updates, CONTRIBUTING, AGENTS, runbooks (deploy/incident/backup-restore/oncall), SLO, prompts	2026-08-10 04:16:30 +02:00