docs(compliance): record dated provenance for evasion-stack keep decision #15

2026-08-11T09:32:46Z

admin commented

2026-08-11 09:32:46 +00:00

Summary

AGENTS.md (~lines 19-23) and SECURITY.md (WAF-bypass bullet) attributed keeping the evasion stack (services/scrapers/*, waf_bypass.py, services/infra/docker-compose.data-stack.yml, adaptive_router.py) to an unattributed, undated "medvetet användarbeslut" / "explicit user decision". A prior audit flagged this as EJ VERIFIERAT (unverified provenance).

Change

Replaced both mentions with an accurate, dated statement: the account owner (Simon Axelsson) was asked directly via an interactive decision prompt on 2026-08-11, in direct response to a compliance audit's removal proposal (the surgically-clean removal PR #7, verified 128/128 tests, was closed unmerged), and explicitly chose keep. No business/legal rationale beyond "keep it" is recorded or invented.

This is a narrow, scoped exception for the existing 0PT/0pt-motor sourcing engine. CLAUDE.md §1's general anti-evasion policy text is not touched and remains in force as written unless/until the account owner says otherwise.

Scope

Documentation only (AGENTS.md, SECURITY.md).
No code changes. No changes to services/scrapers/*, waf_bypass.py, docker-compose.data-stack.yml, or adaptive_router.py.
Does not touch docs/compliance/BACKLOG.md, BLOCKERS.md, GOLDEN-STANDARD-REPORT.md scoring, or INVENTORY.md/RELATIONS.md (separate parallel workstream).
Companion branch cleanup: the now-permanently-dead compliance/remove-evasion-stack branch (behind closed, unmerged PR #7) was deleted separately.

Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com

## Summary `AGENTS.md` (~lines 19-23) and `SECURITY.md` (WAF-bypass bullet) attributed keeping the evasion stack (`services/scrapers/*`, `waf_bypass.py`, `services/infra/docker-compose.data-stack.yml`, `adaptive_router.py`) to an unattributed, undated "medvetet användarbeslut" / "explicit user decision". A prior audit flagged this as **EJ VERIFIERAT** (unverified provenance). ## Change Replaced both mentions with an accurate, dated statement: the account owner (Simon Axelsson) was asked directly via an interactive decision prompt on **2026-08-11**, in direct response to a compliance audit's removal proposal (the surgically-clean removal PR #7, verified 128/128 tests, was closed unmerged), and explicitly chose **keep**. No business/legal rationale beyond "keep it" is recorded or invented. This is a narrow, scoped exception for the existing 0PT/0pt-motor sourcing engine. `CLAUDE.md` §1's general anti-evasion policy text is **not** touched and remains in force as written unless/until the account owner says otherwise. ## Scope - Documentation only (`AGENTS.md`, `SECURITY.md`). - No code changes. No changes to `services/scrapers/*`, `waf_bypass.py`, `docker-compose.data-stack.yml`, or `adaptive_router.py`. - Does not touch `docs/compliance/BACKLOG.md`, `BLOCKERS.md`, `GOLDEN-STANDARD-REPORT.md` scoring, or `INVENTORY.md`/`RELATIONS.md` (separate parallel workstream). - Companion branch cleanup: the now-permanently-dead `compliance/remove-evasion-stack` branch (behind closed, unmerged PR #7) was deleted separately. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

admin added 1 commit 2026-08-11 09:32:46 +00:00

docs(compliance): record dated provenance for evasion-stack keep decision

CI (SIAX Cloud) / security (push) Successful in 24s

Details

Security Scan (SIAX Cloud) / security (push) Successful in 22s

Details

CI (SIAX Cloud) / quality (push) Successful in 39s

Details

CI (SIAX Cloud) / security (pull_request) Successful in 20s

Details

Security Scan (SIAX Cloud) / security (pull_request) Successful in 20s

Details

CI (SIAX Cloud) / quality (pull_request) Successful in 38s

Details

a14911b263

AGENTS.md and SECURITY.md previously attributed keeping the WAF-bypass/
Tor/FlareSolverr/curl_cffi/cloudscraper stack to an unattributed,
unverified "medvetet användarbeslut" (deliberate user decision) with no
stated author or date -- flagged by a prior audit as unverified provenance.

Replace with an accurate, dated statement: the account owner (Simon
Axelsson) was asked directly via an interactive decision prompt on
2026-08-11, in direct response to a compliance audit's removal proposal
(the surgically-clean removal PR #7, verified 128/128 tests, was closed
unmerged), and explicitly chose to keep the code. No business or legal
rationale beyond "keep it" was given or is invented here.

This is a narrow, scoped exception for the existing 0PT/0pt-motor sourcing
engine. CLAUDE.md §1's general anti-evasion policy text is untouched and
remains in force as written unless/until the account owner says otherwise.

No code changes -- documentation only.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

admin merged commit into main

2026-08-11 09:36:17 +00:00

admin deleted branch docs/evasion-stack-decision-provenance

2026-08-11 09:36:17 +00:00

admin referenced this issue from a commit

2026-08-11 11:04:40 +00:00

docs(compliance): add BLOCKERS.md (§1.4)

admin referenced this pull request

2026-08-11 11:05:18 +00:00

docs(compliance): add BLOCKERS.md (§1.4) #16

admin referenced this issue from a commit

2026-08-11 11:33:53 +00:00