Merge pull request 'fix(manifest): provenRestore=true (restore-drill 2026-09-29)' (#507 ) from fix/prod-restore-2026-09-29 into main

Merge branch 'main' into fix/prod-restore-2026-09-29
Merge pull request 'fix(signing): cosign-pubkey + SBOM + deployment/env-poster (9aef3cd97f)' (#506 ) from fix/prod-evidence-2026-09-29 into main
2026-11-08 03:58:42 +00:00 · 2026-11-08 03:58:30 +00:00 · 2026-11-08 03:58:27 +00:00 · 2026-11-08 01:30:28 +01:00 · 2026-11-07 23:21:36 +00:00 · 2026-11-07 23:21:24 +00:00
24 changed files with 258 additions and 70 deletions
@@ -309,3 +309,22 @@ jobs:
          trap 'docker rm -f "$cid" >/dev/null 2>&1 || true' EXIT
          docker cp . "$cid":/usr/src
          docker start -a "$cid"
+
+  design-conformance:
+    name: Component conformance (blocking)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - name: Checkout canonical siax-standard (SSOT)
+        uses: actions/checkout@v4
+        with:
+          repository: admin/siax-standard
+          token: ${{ secrets.SIAX_CI_TOKEN }}
+          path: siax-standard-ssot
+      - name: Component conformance (blocking)
+        run: |
+          node --input-type=module -e "import('./siax-standard-ssot/packages/doctor/src/commands/component-conformance.mjs').then(m=>{process.exit(m.run(['--repo', process.env.GITHUB_WORKSPACE, '--allow-path-prefix', 'siax-standard-ssot/', '--fail-on=block']))})"
@@ -0,0 +1,47 @@
+# Legacy instance audit — 0pt (server5) and L0RE (server5) — 2026-11-07
+
+Canonical runtimes: **0pt on server6** (Coolify app `shxd6lepxuxfsjsp0ath3z1g`,
+`0pt.app`) and **L0RE on server9** (`l0re.siax.io`). This document records the
+older instances on server5 and their disposition. It is not production
+documentation for either product.
+
+## 1. 0pt legacy (server5)
+
+| Item | Value |
+|---|---|
+| Containers | `0pt-api` (`0pt-api:c46ebbf`, created 2026-11-05), `0pt-web` (`:18080`) |
+| Database | `0pt-pg`, user/db `opt`, 11 MB |
+| Exposure | `0pt-web` only on `100.124.7.55:18080`; no DNS record, no reverse proxy |
+| Consumers | none found (`/etc/siax`, `/opt/siax`, site0 and L0RE deploy configs) |
+| Unique data | 32 canonical facts (30 GLEIF web observations + `body_type` YDL405 + `passmark.find_prime_numbers.v10`) |
+
+**Data reconciliation:** all 32 facts were exported and re-imported through the
+canonical API (`POST /api/0pt/canonical/facts`) into the server6 deployment.
+Replay returned `duplicates: 32`, so the import is idempotent. Production now
+holds 34 facts (32 migrated + 2 verification observations) and 4 entities.
+
+**Backup:** `server5:/var/backups/0pt-legacy/opt_legacy_20261107.dump.zst`
+(custom format, 32 KB) + offsite `server11:/home/backup/0pt/`.
+
+**Action taken:** `docker update --restart=no` + `docker stop` for `0pt-api` and
+`0pt-web`. `0pt-pg` left running for forensics/rollback. `0pt.app` verified 200
+after the stop (served by server6).
+
+**Full removal (requires owner decision):** snapshot/destroy `0pt-pg` volume
+after the retention window, remove the legacy compose project, revoke the old
+`INTERNAL_TOKEN` if it was ever stored on server5.
+
+## 2. L0RE orphan (server5)
+
+Documented separately in `admin/l0re` PR #485
+(`docs/runbook/l0re-orphan-decommission-20261107.md`): API stopped with
+`restart=no`, dump + restore proof (8 propositions/62 assertions), no unique
+legitimate data (pilot facts already re-projected to production). `l0re-pg` and
+`l0re-opensearch` remain for forensics.
+
+## 3. Single-runtime rule
+
+One primary runtime per logical service. A container image of a product running
+outside its registered Coolify app is a finding, not a fallback. Both server5
+instances were reachable only from the host, which is why the split survived
+until this audit.
@@ -89,7 +89,16 @@
    "0pt.source_registry_list",
    "0pt.order_create",
    "0pt.order_payment",
-    "0pt.write_iceberg_table"
+    "0pt.write_iceberg_table",
+    "0pt.structure.resolve_entities",
+    "0pt.structure.get_lineage",
+    "0pt.structure.quality_run",
+    "0pt.structure.quality_list_runs",
+    "0pt.structure.quality_checks",
+    "0pt.structure.quality_reports",
+    "0pt.structure.extract_document",
+    "0pt.structure.route_parsing",
+    "0pt.structure.normalize_value"
  ],
  "surfaces": [
    "api",
@@ -0,0 +1,15 @@
+{
+  "id": "0pt.structure.extract_document",
+  "name": "0pt.structure.extract_document",
+  "owner": "0pt",
+  "version": "1.0.0",
+  "riskLevel": "L2",
+  "piiLevel": "high",
+  "surfaces": [
+    "api"
+  ],
+  "requiresJob": false,
+  "tenantScoped": true,
+  "operationId": "0pt.extract_document",
+  "description": "Canonical capability descriptor for 0pt.structure.extract_document (owner 0pt). Verified against registry + openapi operationId 0pt.extract_document."
+}
@@ -0,0 +1,15 @@
+{
+  "id": "0pt.structure.get_lineage",
+  "name": "0pt.structure.get_lineage",
+  "owner": "0pt",
+  "version": "1.0.0",
+  "riskLevel": "L1",
+  "piiLevel": "low",
+  "surfaces": [
+    "api"
+  ],
+  "requiresJob": false,
+  "tenantScoped": true,
+  "operationId": "0pt.get_provenance",
+  "description": "Canonical capability descriptor for 0pt.structure.get_lineage (owner 0pt). Verified against registry + openapi operationId 0pt.get_provenance."
+}
@@ -0,0 +1,15 @@
+{
+  "id": "0pt.structure.normalize_value",
+  "name": "0pt.structure.normalize_value",
+  "owner": "0pt",
+  "version": "1.0.0",
+  "riskLevel": "L1",
+  "piiLevel": "low",
+  "surfaces": [
+    "api"
+  ],
+  "requiresJob": false,
+  "tenantScoped": true,
+  "operationId": "0pt.normalize_value",
+  "description": "Canonical capability descriptor for 0pt.structure.normalize_value (owner 0pt). Verified against registry + openapi operationId 0pt.normalize_value."
+}
@@ -0,0 +1,15 @@
+{
+  "id": "0pt.structure.quality_checks",
+  "name": "0pt.structure.quality_checks",
+  "owner": "0pt",
+  "version": "1.0.0",
+  "riskLevel": "L1",
+  "piiLevel": "low",
+  "surfaces": [
+    "api"
+  ],
+  "requiresJob": false,
+  "tenantScoped": true,
+  "operationId": "0pt.quality.checks",
+  "description": "Canonical capability descriptor for 0pt.structure.quality_checks (owner 0pt). Verified against registry + openapi operationId 0pt.quality.checks."
+}
@@ -0,0 +1,15 @@
+{
+  "id": "0pt.structure.quality_list_runs",
+  "name": "0pt.structure.quality_list_runs",
+  "owner": "0pt",
+  "version": "1.0.0",
+  "riskLevel": "L1",
+  "piiLevel": "low",
+  "surfaces": [
+    "api"
+  ],
+  "requiresJob": false,
+  "tenantScoped": true,
+  "operationId": "0pt.quality.list_runs",
+  "description": "Canonical capability descriptor for 0pt.structure.quality_list_runs (owner 0pt). Verified against registry + openapi operationId 0pt.quality.list_runs."
+}
@@ -0,0 +1,15 @@
+{
+  "id": "0pt.structure.quality_reports",
+  "name": "0pt.structure.quality_reports",
+  "owner": "0pt",
+  "version": "1.0.0",
+  "riskLevel": "L1",
+  "piiLevel": "low",
+  "surfaces": [
+    "api"
+  ],
+  "requiresJob": false,
+  "tenantScoped": true,
+  "operationId": "0pt.quality.reports",
+  "description": "Canonical capability descriptor for 0pt.structure.quality_reports (owner 0pt). Verified against registry + openapi operationId 0pt.quality.reports."
+}
@@ -0,0 +1,15 @@
+{
+  "id": "0pt.structure.quality_run",
+  "name": "0pt.structure.quality_run",
+  "owner": "0pt",
+  "version": "1.0.0",
+  "riskLevel": "L1",
+  "piiLevel": "low",
+  "surfaces": [
+    "api"
+  ],
+  "requiresJob": false,
+  "tenantScoped": true,
+  "operationId": "0pt.quality.run",
+  "description": "Canonical capability descriptor for 0pt.structure.quality_run (owner 0pt). Verified against registry + openapi operationId 0pt.quality.run."
+}
@@ -0,0 +1,15 @@
+{
+  "id": "0pt.structure.resolve_entities",
+  "name": "0pt.structure.resolve_entities",
+  "owner": "0pt",
+  "version": "1.0.0",
+  "riskLevel": "L2",
+  "piiLevel": "high",
+  "surfaces": [
+    "api"
+  ],
+  "requiresJob": false,
+  "tenantScoped": true,
+  "operationId": "0pt.resolve_entities",
+  "description": "Canonical capability descriptor for 0pt.structure.resolve_entities (owner 0pt). Verified against registry + openapi operationId 0pt.resolve_entities."
+}
@@ -0,0 +1,15 @@
+{
+  "id": "0pt.structure.route_parsing",
+  "name": "0pt.structure.route_parsing",
+  "owner": "0pt",
+  "version": "1.0.0",
+  "riskLevel": "L1",
+  "piiLevel": "low",
+  "surfaces": [
+    "api"
+  ],
+  "requiresJob": false,
+  "tenantScoped": true,
+  "operationId": "0pt.route_parsing",
+  "description": "Canonical capability descriptor for 0pt.structure.route_parsing (owner 0pt). Verified against registry + openapi operationId 0pt.route_parsing."
+}
@@ -1,12 +0,0 @@
-{
-  "id": "pe-artifact-0pt-13e156ec7e6b",
-  "repo": "0pt",
-  "evidenceType": "artifact-digest",
-  "result": "pass",
-  "verifiedAt": "2026-11-04T10:53:16Z",
-  "verifiedBy": "docker image inspect RepoDigests (real registry digest)",
-  "proofRef": "docker://server6 image shxd6lepxuxfsjsp0ath3z1g:13e156ec7e6be534de9c28d28ec2daff0355ca7f image@sha256:657bc7e2ed3425436b18680138d7c792ac879db4c49a505d1ea0305699d89089",
-  "sourceSha": "13e156ec7e6be534de9c28d28ec2daff0355ca7f",
-  "digest": "sha256:657bc7e2ed3425436b18680138d7c792ac879db4c49a505d1ea0305699d89089",
-  "tool": "docker"
-}
@@ -1,10 +0,0 @@
-{
-  "id": "pe-ci-0pt-13e156ec7e6b",
-  "repo": "0pt",
-  "evidenceType": "deploy-log",
-  "result": "pass",
-  "verifiedAt": "2026-11-04T10:53:16Z",
-  "verifiedBy": "Coolify deployment record (application_deployment_queues, status=finished)",
-  "proofRef": "coolify://server6/shxd6lepxuxfsjsp0ath3z1g finished 2026-11-04 05:42:18",
-  "sourceSha": "13e156ec7e6be534de9c28d28ec2daff0355ca7f"
-}
@@ -1,11 +0,0 @@
-{
-  "id": "pe-running-0pt-13e156ec7e6b",
-  "repo": "0pt",
-  "evidenceType": "running-digest",
-  "result": "pass",
-  "verifiedAt": "2026-11-04T10:53:16Z",
-  "verifiedBy": "docker inspect (running container image digest)",
-  "proofRef": "docker://server6 container/shxd6lepxuxfsjsp0ath3z1g-20261104T093337 image@sha256:657bc7e2ed3425436b18680138d7c792ac879db4c49a505d1ea0305699d89089",
-  "sourceSha": "13e156ec7e6be534de9c28d28ec2daff0355ca7f",
-  "digest": "sha256:657bc7e2ed3425436b18680138d7c792ac879db4c49a505d1ea0305699d89089"
-}
@@ -1,12 +0,0 @@
-{
-  "id": "pe-sbom-0pt-13e156ec7e6b",
-  "repo": "0pt",
-  "evidenceType": "sbom",
-  "result": "pass",
-  "verifiedAt": "2026-11-04T09:29:06Z",
-  "verifiedBy": "syft (estate-kampanj issue #76, skannad vid deployad commit)",
-  "proofRef": "siax/sbom/sbom-0pt-13e156ec7e6b.json",
-  "sourceSha": "13e156ec7e6be534de9c28d28ec2daff0355ca7f",
-  "tool": "syft",
-  "sbomFormat": "cyclonedx-json"
-}
@@ -1,4 +1,4 @@
 # 0pt — cosign-signeringskedjan (2026-09-29)

-Prod-imagen git.cloud.siax.io/sax3l/0pt:prod-8b5e23aa9b (sha256:889753b7e5a9db3e1c870eeb38f450cb0f20498e1025edb28153233e0b06f46d) är cosign-signerad
+Prod-imagen git.cloud.siax.io/sax3l/0pt:prod-9aef3cd97f (sha256:eab6227b702f61145e0279ee1958760389e4ecf68b24323daa467abeefb94f32) är cosign-signerad
 med nyckelparet vars pubkey ligger här. Privata nyckeln raderad efter signering.
@@ -1,4 +1,4 @@
 -----BEGIN PUBLIC KEY-----
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEiPRG9iG1pjIW548KoIduQPD/B3Yb
-tg5hPmy7o4feVQsdDnW38VtemVBQ4I+goytV9X4XkrFiweKmfqEMhGyPgg==
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEklcBOL7pw+7YVwUTrOHAxNTUmG7r
+qNYIEFFgJqdeYff9ZB0ntkIWKu/bN9Dhzyk8cuGOmkIHocyPIH25CXrP1Q==
 -----END PUBLIC KEY-----
@@ -1,10 +0,0 @@
-{
-  "$schema": "https://git.siax.io/sax3l/siax-standard/raw/branch/main/schema/siax.source-bundle.schema.json",
-  "id": "sb-0pt-13e156ec7e6b",
-  "repo": "0pt",
-  "commitSha": "13e156ec7e6be534de9c28d28ec2daff0355ca7f",
-  "branch": "main",
-  "buildId": "coolify:0pt",
-  "producedAt": "2026-11-04T01:26:48Z",
-  "artifactId": "shxd6lepxuxfsjsp0ath3z1g@sha256:657bc7e2ed3425436b18680138d7c792ac879db4c49a505d1ea0305699d89089"
-}
@@ -1,4 +1,4 @@
-- 020_canonical_facts.sql — 0pt canonical structured observations (X-800 / Scrape).
+-- 022_canonical_facts.sql — 0pt canonical structured observations (X-800 / Scrape).
 --
 -- 0pt owns normalized OBSERVED facts (what a source said, when, from which
 -- artifact). L0RE owns epistemic propositions/assertions and projections; it
@@ -82,18 +82,21 @@ CREATE INDEX IF NOT EXISTS idx_canonical_relations_object

 ALTER TABLE opt_canonical_entities ENABLE ROW LEVEL SECURITY;
 ALTER TABLE opt_canonical_entities FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS opt_canonical_entities_tenant ON opt_canonical_entities;
 CREATE POLICY opt_canonical_entities_tenant ON opt_canonical_entities
  USING (tenant_id = current_setting('app.opt_canonical_tenant_id', true))
  WITH CHECK (tenant_id = current_setting('app.opt_canonical_tenant_id', true));

 ALTER TABLE opt_canonical_facts ENABLE ROW LEVEL SECURITY;
 ALTER TABLE opt_canonical_facts FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS opt_canonical_facts_tenant ON opt_canonical_facts;
 CREATE POLICY opt_canonical_facts_tenant ON opt_canonical_facts
  USING (tenant_id = current_setting('app.opt_canonical_tenant_id', true))
  WITH CHECK (tenant_id = current_setting('app.opt_canonical_tenant_id', true));

 ALTER TABLE opt_canonical_relations ENABLE ROW LEVEL SECURITY;
 ALTER TABLE opt_canonical_relations FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS opt_canonical_relations_tenant ON opt_canonical_relations;
 CREATE POLICY opt_canonical_relations_tenant ON opt_canonical_relations
  USING (tenant_id = current_setting('app.opt_canonical_tenant_id', true))
  WITH CHECK (tenant_id = current_setting('app.opt_canonical_tenant_id', true));
@@ -0,0 +1,19 @@
+-- 023_canonical_grants.sql — app-role privileges for 022 canonical tables.
+--
+-- Tables created by a manual psql migration are owned by the migrating role
+-- (0pt_edge); the running application connects as 0pt_app. Existing 0pt tables
+-- carry explicit grants rather than default ACLs, so the canonical tables need
+-- the same treatment. RLS still applies to 0pt_app (FORCE is on); this only
+-- grants the statement privileges, not row visibility.
+--
+-- Idempotent and role-guarded: no-op in environments without the app role.
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '0pt_app') THEN
+    GRANT SELECT, INSERT, UPDATE, DELETE
+      ON opt_canonical_entities, opt_canonical_facts, opt_canonical_relations
+      TO "0pt_app";
+  END IF;
+END
+$$;
@@ -30,6 +30,11 @@ export interface CanonicalFactRepository {
  queryFacts(query: CanonicalQuery): Promise<CanonicalFact[]>;
 }

+/** PostgreSQL timestamptz arrives as Date; the API contract is RFC3339/ISO-8601. */
+function iso(value: unknown): string {
+  return value instanceof Date ? value.toISOString() : String(value);
+}
+
 export function entityKey(e: CanonicalEntityInput): string {
  return `${e.entity_type}\u0000${e.identity_namespace}\u0000${e.identity_value}`;
 }
@@ -216,11 +221,11 @@ class PostgresCanonicalFactRepository implements CanonicalFactRepository {
        source_record_id: r.source_record_id ?? undefined,
        st0re_artifact_id: r.st0re_artifact_id ?? undefined,
        aud0_evidence_ref: r.aud0_evidence_ref ?? undefined, run_ref: r.run_ref ?? undefined,
-        extractor_version: r.extractor_version, observed_at: String(r.observed_at),
-        valid_from: r.valid_from ? String(r.valid_from) : undefined,
-        valid_to: r.valid_to ? String(r.valid_to) : undefined,
+        extractor_version: r.extractor_version, observed_at: iso(r.observed_at),
+        valid_from: r.valid_from ? iso(r.valid_from) : undefined,
+        valid_to: r.valid_to ? iso(r.valid_to) : undefined,
        confidence: r.confidence === null ? undefined : Number(r.confidence),
-        quality_status: r.quality_status, status: r.status, created_at: String(r.created_at),
+        quality_status: r.quality_status, status: r.status, created_at: iso(r.created_at),
      })) as CanonicalFact[];
    });
  }
@@ -1,5 +1,10 @@
 import { describe, expect, it } from "vitest";
-import { operationFingerprint, operationIdentity, runIdempotentOperation } from "../../packages/siax-access/src/idempotency";
+import {
+  operationFingerprint,
+  operationIdentity,
+  runIdempotentOperation,
+  type IdempotencyStore,
+} from "../../packages/siax-access/src/idempotency";

 describe("@siax/access universal idempotency", () => {
  it("binds every result-affecting input into the fingerprint", () => {
@@ -18,7 +23,7 @@ describe("@siax/access universal idempotency", () => {
  });
  it("replays a stored receipt verbatim on the exact fingerprint", async () => {
    const stored = { x: 1 };
-    const store: any = {
+    const store: IdempotencyStore<unknown, { x: number }> = {
      start: async () => false,
      save: async () => {},
      receipt: async () => stored,
@@ -32,7 +37,7 @@ describe("@siax/access universal idempotency", () => {
  });
  it("claims once and saves only after the dispatch", async () => {
    const order: string[] = [];
-    const store: any = {
+    const store: IdempotencyStore<unknown, { x: number }> = {
      start: async () => { order.push("start"); return true; },
      save: async () => { order.push("save"); },
      receipt: async () => { order.push("receipt"); return undefined; },
@@ -47,7 +52,7 @@ describe("@siax/access universal idempotency", () => {
    expect(order).toEqual(["start", "dispatch", "save"]);
  });
  it("reports a store error as conflict, never as a fresh start", async () => {
-    const store: any = {
+    const store: IdempotencyStore<unknown, { x: number }> = {
      start: async () => { throw new Error("db down"); },
      save: async () => {},
      receipt: async () => { throw new Error("db down"); },
@@ -61,7 +66,7 @@ describe("@siax/access universal idempotency", () => {
    expect(dispatched).toBe(0);
  });
  it("does not rerun the dispatch when start succeeds but save later fails", async () => {
-    const store: any = { start: async () => true, save: async () => { throw new Error("journal write failed"); }, receipt: async () => undefined };
+    const store: IdempotencyStore<unknown, { x: number }> = { start: async () => true, save: async () => { throw new Error("journal write failed"); }, receipt: async () => undefined };
    let dispatched = 0;
    const outcome = await runIdempotentOperation({
      store, identity: {}, fingerprint: "fp",