siax/signing/README.md

@@ -1,4 +1,4 @@
 # 0pt — cosign-signeringskedjan (2026-09-29)
 
-Prod-imagen git.cloud.siax.io/sax3l/0pt:prod-336b51f29a (sha256:47e833bd731113d227b886d7ae6e4d87da6a041465c0b86ed952784493142ac0) är cosign-signerad
+Prod-imagen git.cloud.siax.io/sax3l/0pt:prod-8ed38d4f8d (sha256:159521ef1149309f22b86369e49c560e38433570ab355c8564b8a2e039de4676) är cosign-signerad
 med nyckelparet vars pubkey ligger här. Privata nyckeln raderad efter signering.

siax/signing/cosign.pub

@@ -1,4 +1,4 @@
 -----BEGIN PUBLIC KEY-----
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEj21uvplbljsN4Z1SzDAVLT/6yoLf
-WVZ9TehoZK8LnxIpY5w6AGf6hoVE1CeyMsLvGIM7ss/Kf/aR2SfrQRAuGA==
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEDQS5VnDOc5cMcgWUwapRPx9H7Aq5
+XtyqwOgteR5e4H9emvh3HkWWXop8DMa6vjfH667fZN4pjFZeb3bbZa74pQ==
 -----END PUBLIC KEY-----

tests/integration/analytics-engine-clickhouse.integration.test.ts

@@ -17,6 +17,15 @@ import { ClickHouseAnalyticsEngine } from "@/src/analytics/engine/clickhouse-eng
 import { ANALYTICS_MATERIALIZED_VIEWS, ANALYTICS_TABLES } from "@/src/analytics/engine/schema";
 import type { AnalyticsIdentity } from "@/src/analytics/engine/siax-analytics-engine";
 
+
+/**
+ * Raw events carry a 30-day TTL (src/analytics/engine/schema.ts). Fixed
+ * historical timestamps silently expire and make live-ClickHouse suites read
+ * 0 rows, so seed rows are stamped relative to now (UTC, ClickHouse
+ * DateTime64(3) text form).
+ */
+const SEED_EVENT_TIME = new Date(Date.now() - 2 * 3600_000).toISOString().replace("T", " ").replace("Z", "");
+
 const CLICKHOUSE_URL = process.env.CLICKHOUSE_URL;
 const CLICKHOUSE_AUTH = process.env.CLICKHOUSE_AUTH;
 const run = CLICKHOUSE_URL ? describe : describe.skip;
@@ -113,7 +122,7 @@ run("BI-P009/BI-P010 ClickHouse provider against a LIVE server", () => {
         dataset_id: "ds_mv",
         metric: "mv_metric",
         event_id: `mv${i}`,
-        event_time: "2026-09-03 12:00:00.000",
+        event_time: SEED_EVENT_TIME,
         value: 2,
         dim_names: [],
         dim_values: [],
@@ -140,7 +149,7 @@ run("BI-P009/BI-P010 ClickHouse provider against a LIVE server", () => {
         dataset_id: "ds_g",
         metric: "grouped",
         event_id: `g${i}`,
-        event_time: "2026-09-04 09:00:00.000",
+        event_time: SEED_EVENT_TIME,
         value: 5,
         dim_names: ["severity"],
         dim_values: [sev],

tests/integration/analytics-resource-governance.integration.test.ts

@@ -19,6 +19,15 @@ import { ClickHouseAnalyticsEngine } from "@/src/analytics/engine/clickhouse-eng
 import { DEFAULT_BUDGETS } from "@/src/analytics/engine/resource-governance";
 import type { AnalyticsIdentity } from "@/src/analytics/engine/siax-analytics-engine";
 
+
+/**
+ * Raw events carry a 30-day TTL (src/analytics/engine/schema.ts). Fixed
+ * historical timestamps silently expire and make live-ClickHouse suites read
+ * 0 rows, so seed rows are stamped relative to now (UTC, ClickHouse
+ * DateTime64(3) text form).
+ */
+const SEED_EVENT_TIME = new Date(Date.now() - 2 * 3600_000).toISOString().replace("T", " ").replace("Z", "");
+
 const CLICKHOUSE_URL = process.env.CLICKHOUSE_URL;
 const CLICKHOUSE_AUTH = process.env.CLICKHOUSE_AUTH;
 const run = CLICKHOUSE_URL ? describe : describe.skip;
@@ -75,7 +84,7 @@ run("BI-P012 resource governance against a LIVE ClickHouse", () => {
         dataset_id: "ds_v",
         metric: "victim_metric",
         event_id: `v${i}`,
-        event_time: "2026-09-05 08:00:00.000",
+        event_time: SEED_EVENT_TIME,
         value: 1,
         dim_names: ["severity"],
         dim_values: ["warning"],

tests/integration/analytics-tenant-isolation.integration.test.ts

@@ -37,6 +37,15 @@ import { ANALYTICS_TABLES, sortingKeySql } from "@/src/analytics/engine/schema";
 import { DEFAULT_BUDGETS } from "@/src/analytics/engine/resource-governance";
 import type { AnalyticsIdentity } from "@/src/analytics/engine/siax-analytics-engine";
 
+
+/**
+ * Raw events carry a 30-day TTL (src/analytics/engine/schema.ts). Fixed
+ * historical timestamps silently expire and make live-ClickHouse suites read
+ * 0 rows, so seed rows are stamped relative to now (UTC, ClickHouse
+ * DateTime64(3) text form).
+ */
+const SEED_EVENT_TIME = new Date(Date.now() - 2 * 3600_000).toISOString().replace("T", " ").replace("Z", "");
+
 const CLICKHOUSE_URL = process.env.CLICKHOUSE_URL;
 const CLICKHOUSE_AUTH = process.env.CLICKHOUSE_AUTH;
 const run = CLICKHOUSE_URL ? describe : describe.skip;
@@ -100,7 +109,7 @@ run("BI-P011 tenant isolation against a LIVE ClickHouse", () => {
           dataset_id: "ds_shared",
           metric: "rows_ingested",
           event_id: `a${i}`,
-          event_time: "2026-09-01 10:00:00.000",
+          event_time: SEED_EVENT_TIME,
           value: 1,
           dim_names: ["severity"],
           dim_values: [i % 2 === 0 ? "warning" : "critical"],
@@ -113,7 +122,7 @@ run("BI-P011 tenant isolation against a LIVE ClickHouse", () => {
           dataset_id: "ds_shared",
           metric: "rows_ingested",
           event_id: `b${i}`,
-          event_time: "2026-09-01 10:00:00.000",
+          event_time: SEED_EVENT_TIME,
           value: 1000,
           dim_names: ["severity"],
           dim_values: ["critical"],
@@ -275,7 +284,7 @@ run("BI-P011 tenant isolation against a LIVE ClickHouse", () => {
       restrictedAuth,
       {},
       {},
-      JSON.stringify({ tenant_id: "t_beta", project_id: "p", dataset_id: "d", metric: "m", event_id: "x", event_time: "2026-09-01 00:00:00.000", value: 1, dim_names: [], dim_values: [] }),
+      JSON.stringify({ tenant_id: "t_beta", project_id: "p", dataset_id: "d", metric: "m", event_id: "x", event_time: SEED_EVENT_TIME, value: 1, dim_names: [], dim_values: [] }),
     );
     expect(write.ok).toBe(false);
 

tests/integration/semantic-parity.integration.test.ts

@@ -60,6 +60,15 @@ import {
 } from '@/src/analytics/metrics/semantic-registry';
 import type { MetricSpec } from '@/src/analytics/metrics/metric-model';
 
+
+/**
+ * Raw events carry a 30-day TTL (src/analytics/engine/schema.ts). Fixed
+ * historical timestamps silently expire and make live-ClickHouse suites read
+ * 0 rows, so seed rows are stamped relative to now (UTC, ClickHouse
+ * DateTime64(3) text form).
+ */
+const SEED_EVENT_TIME = new Date(Date.now() - 2 * 3600_000).toISOString().replace("T", " ").replace("Z", "");
+
 const CLICKHOUSE_URL = process.env.CLICKHOUSE_URL;
 const CLICKHOUSE_AUTH = process.env.CLICKHOUSE_AUTH;
 // Collection-time, never inside a hook: `describe.skipIf(flagSetInBeforeAll)`
@@ -280,7 +289,7 @@ run('BI-P029 — one golden metric, two independent compilers, one live ClickHou
         dataset_id: 'ds_sales',
         metric: 'amount_sek',
         event_id: `e${i}`,
-        event_time: '2026-09-03 12:00:00.000',
+        event_time: SEED_EVENT_TIME,
         value: r.amount,
         dim_names: ['country_code', 'sales_channel'],
         dim_values: [r.country, r.channel],