admin/0pt
5
0
Fork 0
Code Issues 9 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(compliance): add BLOCKERS.md (§1.4) #16

Merged
admin merged 1 commits from docs/compliance-blockers-2026-08-11 into main 2026-08-11 12:31:00 +00:00
Conversation 0 Commits 1 Files Changed 1
+72
admin commented 2026-08-11 11:05:18 +00:00
Owner
Copy Link
Copy Source

Summary

docs/compliance/BLOCKERS.md did not exist in this repo (confirmed absent in a recent audit pass). Per the Golden Standard framework's own §1.4 (Blockerarpolicy), an unwritten blocker is itself a delivery defect. This PR adds it.

Four blockers recorded, each freshly re-verified against current main (5c36dc3) rather than copied from earlier findings:

  1. WAF-bypass/Tor/FlareSolverr stack (services/scrapers/*) — the removal PR (#7) is closed/unmerged. Fresh check found the account-owner decision (keep) is now actually on record via merged PR #15 (today), documented in AGENTS.md/SECURITY.md. Recorded as decided, not still-pending — honest state, not resolved by this PR.
  2. No Coolify app / Infisical project — cd.yml still carries the literal TODO-no-coolify-app-provisioned-yet placeholder on current main.
  3. DNS delegation (0pt.app, 0pt.dev) — live NS lookup today still shows Vercel nameservers, despite PowerDNS holding shadow zone copies.
  4. middleware.ts not executing in production — fresh live probe today: /api/0pt, /api/orders, /api/admin/metrics all still answer HTTP 200 anonymously, even after the merged auth fix (PR #11). Sharper than the existing backlog item: the code is now fixed but production still doesn't reflect it — points at a build/deploy gap, not (only) an app-code gap.

Scope

  • Documentation only — one new file (docs/compliance/BLOCKERS.md).
  • No changes to services/scrapers/{waf_bypass,engine,engine_v2}.py, services/scrapers/requirements.txt, services/infra/docker-compose.data-stack.yml, or docs/compliance/BACKLOG.md.
  • Does not reopen or merge PR #7. That question is being handled in a separate, parallel thread — this PR only records state honestly.

Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com

## Summary `docs/compliance/BLOCKERS.md` did not exist in this repo (confirmed absent in a recent audit pass). Per the Golden Standard framework's own §1.4 (Blockerarpolicy), an unwritten blocker is itself a delivery defect. This PR adds it. Four blockers recorded, each freshly re-verified against current `main` (`5c36dc3`) rather than copied from earlier findings: 1. **WAF-bypass/Tor/FlareSolverr stack** (`services/scrapers/*`) — the removal PR (#7) is closed/unmerged. Fresh check found the account-owner decision (keep) is now actually on record via merged PR #15 (today), documented in `AGENTS.md`/`SECURITY.md`. Recorded as *decided*, not still-pending — honest state, not resolved by this PR. 2. **No Coolify app / Infisical project** — `cd.yml` still carries the literal `TODO-no-coolify-app-provisioned-yet` placeholder on current main. 3. **DNS delegation** (`0pt.app`, `0pt.dev`) — live NS lookup today still shows Vercel nameservers, despite PowerDNS holding shadow zone copies. 4. **`middleware.ts` not executing in production** — fresh live probe today: `/api/0pt`, `/api/orders`, `/api/admin/metrics` all still answer HTTP 200 anonymously, *even after* the merged auth fix (PR #11). Sharper than the existing backlog item: the code is now fixed but production still doesn't reflect it — points at a build/deploy gap, not (only) an app-code gap. ## Scope - Documentation only — one new file (`docs/compliance/BLOCKERS.md`). - No changes to `services/scrapers/{waf_bypass,engine,engine_v2}.py`, `services/scrapers/requirements.txt`, `services/infra/docker-compose.data-stack.yml`, or `docs/compliance/BACKLOG.md`. - Does not reopen or merge PR #7. That question is being handled in a separate, parallel thread — this PR only records state honestly. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
admin added 1 commit 2026-08-11 11:05:19 +00:00
docs(compliance): add BLOCKERS.md (§1.4)
CI (SIAX Cloud) / security (push) Successful in 16s
Details
Security Scan (SIAX Cloud) / security (push) Successful in 19s
Details
CI (SIAX Cloud) / quality (push) Successful in 43s
Details
CI (SIAX Cloud) / security (pull_request) Successful in 26s
Details
Security Scan (SIAX Cloud) / security (pull_request) Successful in 21s
Details
CI (SIAX Cloud) / quality (pull_request) Successful in 46s
Details
e9dff491ca 
Golden Standard §1.4 requires an unresolved blocker to be recorded in
docs/compliance/BLOCKERS.md; this file was confirmed absent in a recent
audit pass, which is itself a delivery defect per the framework's own
rule. Records four blockers, each freshly re-verified against current
main rather than copied from prior findings:

- WAF-bypass/Tor/FlareSolverr stack (services/scrapers/*): the account
  owner's decision (keep) is now on record via merged PR #15 as of
  today; PR #7 (removal) stays closed/unmerged. Documented as decided,
  not left as still-pending.
- No Coolify app / Infisical project provisioned (cd.yml still carries
  the TODO placeholder on current main).
- 0pt.app / 0pt.dev DNS still delegated to Vercel nameservers (live NS
  lookup today), despite PowerDNS holding shadow zone copies.
- middleware.ts still answers anonymously live even after a merged
  auth fix (PR #11) — confirmed with a fresh live probe today, which
  sharpens the existing P0-1 backlog item.

Scope: documentation only, this one new file. Does not touch
services/scrapers/*, services/infra/docker-compose.data-stack.yml,
docs/compliance/BACKLOG.md, or PR #7.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
admin merged commit into main 2026-08-11 12:31:00 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
siax-bot siax-ci siax-healer (siax-healer (CI self-healing agent)) admin (Simon Axelsson)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: admin/0pt#16