From a14911b263ebe9ba30345cb1c653986741ece2be Mon Sep 17 00:00:00 2001 From: Simon Axelsson Date: Tue, 11 Aug 2026 11:32:13 +0200 Subject: [PATCH] docs(compliance): record dated provenance for evasion-stack keep decision MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit AGENTS.md and SECURITY.md previously attributed keeping the WAF-bypass/ Tor/FlareSolverr/curl_cffi/cloudscraper stack to an unattributed, unverified "medvetet användarbeslut" (deliberate user decision) with no stated author or date -- flagged by a prior audit as unverified provenance. Replace with an accurate, dated statement: the account owner (Simon Axelsson) was asked directly via an interactive decision prompt on 2026-08-11, in direct response to a compliance audit's removal proposal (the surgically-clean removal PR #7, verified 128/128 tests, was closed unmerged), and explicitly chose to keep the code. No business or legal rationale beyond "keep it" was given or is invented here. This is a narrow, scoped exception for the existing 0PT/0pt-motor sourcing engine. CLAUDE.md §1's general anti-evasion policy text is untouched and remains in force as written unless/until the account owner says otherwise. No code changes -- documentation only. Co-Authored-By: Claude Sonnet 5 --- AGENTS.md | 11 +++++++++-- SECURITY.md | 12 ++++++++++-- 2 files changed, 19 insertions(+), 4 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index c51f26b..3affc44 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -19,8 +19,15 @@ entity-resolution, provenance per fält, adaptive router, orderflöde med ## Viktiga förhållanden - **Bypass-stacken** (`services/scrapers/*`, `waf_bypass.py`, data-stack-compose, - `adaptive_router.py`) är **medvetet behållen per användarbeslut** — rör den inte, - och nämn alltid "medvetet användarbeslut" om den dyker upp i compliance-rapporter. + `adaptive_router.py`) är **behållen** — rör den inte. Kontoägaren Simon Axelsson + fattade detta beslut explicit via en interaktiv beslutsprompt **2026-08-11**, som + direkt svar på ett compliance-uppdrags förslag att ta bort stacken (den städade + borttagnings-PR:en #7 verifierades ren men stängdes omergad av kontoägaren). + Beslutet saknar en dokumenterad affärs-/juridisk motivering utöver "behåll" — + hitta inte på en sådan om den dyker upp i compliance-rapporter. Detta är ett + specifikt, avgränsat undantag för den befintliga 0PT/0pt-motor-sourcingmotorn: + CLAUDE.md §1:s generella anti-evasion-policy ändras INTE av detta beslut och + gäller som skriven, om inte kontoägaren säger annat. - **Auth:** `/api/0pt/*` fail-closed i kod (Zitadel via middleware), men live-instansen svarade 2026-08-10 anonymt 200 (lucka S1 — rotorsaksanalys ej klar). Påstå aldrig att produktionen är skyddad innan en anonym request fått 401. diff --git a/SECURITY.md b/SECURITY.md index 7dcb647..6fa445c 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -77,8 +77,16 @@ rather than surfacing something new: (`waf_bypass.py`: FlareSolverr, Tor, cloudscraper, curl_cffi, proxy rotation, fake identities) and `services/infra/docker-compose.data-stack.yml` (flaresolverr/tor containers) contradict this repo's own compliance docs. - They are retained **as an explicit user decision** (2026-08-10) and are out of - scope for deletion — see `docs/compliance/GOLDEN-STANDARD-REPORT.md` control C6. + A cleanup PR that surgically removed this stack (PR #7, verified clean, 128/128 + tests) was closed unmerged by the account owner. **The account owner, Simon + Axelsson, was asked directly via an interactive decision prompt on 2026-08-11 + whether to keep or remove this code, and explicitly chose to keep it.** No + business or legal justification beyond "keep it" was recorded — none is + invented here. This is a narrow, scoped exception for the existing 0PT/0pt-motor + sourcing engine; it does not change `CLAUDE.md` §1's general anti-evasion policy, + which remains in force as written unless/until the account owner says otherwise. + Out of scope for deletion — see `docs/compliance/GOLDEN-STANDARD-REPORT.md` + control C6. - Beyond those items, other authentication gaps on internal API routes may still exist and are tracked internally pending an intentional, reviewed fix; reporting any you find is still welcome and helps confirm priority. -- 2.54.0