chore(estate): add first siax.repo.v3.json manifest (P003 v3 adoption, REPO-16 NA→PASS) #30

Merged

admin merged 1 commits from chore/siax-repo-v3-manifest into main 2026-09-04 15:56:34 +00:00

Conversation 0 Commits 1 Files Changed 1

+120

admin commented 2026-09-04 11:27:14 +00:00

Owner

Copy Link

Copy Source

First siax.repo.v3.json in the SIAX platform estate

P049 certification found v3 adoption at 0/40 repos, which structurally blocks 8 of the 11 required siax-doctor commands (they return measuredScore 0 / *-NOMANIFEST for the whole estate). This PR adds the first v3 manifest, for 0pt. Additive only — siax.repo.json (v2) untouched per CONTRIBUTING.md; no other file changed; nothing under .gitea/workflows/** or .gitignore touched.

siax-doctor scores (siax-standard main, @siax/schemas validator)

command	before	after	non-PASS findings after (verbatim)
repo REPO-16	NA (siax.repo.v3.json saknas)	PASS — siax.repo.v3.json giltig mot @siax/schemas siax.repo.v3	unchanged pre-existing: DOC-07 FAIL, SEC-25 FAIL, CI-14 FAIL, CD-03 FAIL, REPO-01/12 PARTIAL (measuredScore 85 → 85; REPO-16 is NA-safe by design)
capabilities	0 / CAP-NOMANIFEST	100	CAP-DUP-OWNER PASS (19 unika capability-id:n över 1 repo); CAP-RECORD-OWNER WARN UNVERIFIED (inga siax.capability-poster hittade under <root>/<repo>/siax/capabilities/*.json)
dependencies	0 / DEP-NOMANIFEST	100	DEP-CYCLE PASS, DEP-REVERSE PASS, DEP-ASYM PASS (1 repo, 0 edges — other repos have no v3 yet)
surfaces	0 / SURF-NODATA	0	SURF-NODATA BLOCK UNVERIFIED: Repo-nivåns siax.repo.v3.json#/capabilities[] listar BARA id:n ... den strukturerade siax.capability#/surfaces[]-posten krävs — needs siax/capabilities/*.json records (deliberately NOT added: manifest-only PR)
engines	0 / ENG-NOMANIFEST	0	ENG-DIRECT-COUPLING BLOCK NA (inga product/customer-tier-repon ... hittades — 0pt is core-platform, so the only measurable check does not apply); ENG-REGISTRY WARN UNVERIFIED (no siax/engines/*.json)
licenses	0 / LIC-NOMANIFEST	0	LIC-UNASSESSED BLOCK UNVERIFIED: ingen siax.license-assessment-post hittad (manifestet påstår heller inte approved=true, så inget obestyrkt PASS-påstående föreligger); LIC-COVERAGE WARN UNVERIFIED

Estate doctors were run with --root pointing at a scratch dir containing only this repo. Note for whoever runs them next: --root children must be real directories — a symlinked checkout is skipped (listSubdirs uses isDirectory()), which still yields *-NOMANIFEST.

Fields set to an honest unknown/false value (one line each)

field	value	reason
productionEvidence.verified	false	No SHA→CI→artifact→SBOM→signature→deployment→running-digest chain exists. PRODUCTION_EVIDENCE.json is a from-scratch CI verification report of PR#28, not that chain.
identity.workloadIdentity	false	Outbound platform auth is an optional static bearer from env (ST0RE_SERVICE_TOKEN, src/clients/st0re-client.ts:92); cl0ud service-auth.ts registers no principal for 0pt; SIAX_SECRET_REFERENCE_INVENTORY only says "yes" to secret refs.
consumedBy	[]	SIAX_ESTATE.yaml 0pt row: consumers: UNKNOWN-not-verified-this-pass. SIAX_CAPABILITY_OWNERSHIP.md lists 0pt-motor, 0pt-scraper, b00k, cl0ud but in the column explicitly titled "Inferred consumers (reverse-engines lookup)" — candidates for a later pass, not asserted here.
reliability.backupFrequency	"none"	docs/runbook/backup-restore.md: "ingen databas i produktion ... Ingen backup behövs/sker idag".
reliability.provenRestore	false	P014 drill (2026-09-03) was real but against throwaway Docker containers of the schema — not a restore of a production backup (none exists). Consistent with the doctor's own DOC-07 FAIL on this repo.
reliability.slo / reliability.rollback	omitted	docs/slo.md defines targets but states they apply "när tjänsten är i produktion på flottan (Coolify)" — which has not happened; no rollback procedure documented in docs/runbook/deploy.md. Omitted rather than asserted either way.
licenses.approved	false	No siax.license-assessment record; docs/compliance/OSS-INVENTORY.md says licences "ej individuellt omverifierade denna pass (ANTAGANDE)". spdx: UNLICENSED from LICENSE (proprietary, all rights reserved) + packages/schemas/package.json.
operationalState	"degraded"	Live probe 2026-09-04: GET https://0pt.app/api/health → 200 {"ok":true,"service":"0pt-web","db":"not_configured","queue":"not_configured"}; GET /api/ready → 404; https://api.0pt.app/ → 404. The deployed build predates main's /api/ready (which would fail closed 503 with db unconfigured). Liveness alive, readiness not met → degraded, not running.
node / deployment.node	null	Estate: node: UNKNOWN. Live instance runs on Vercel, not a server5..11 fleet node (docs/runbook/deploy.md: "ingen Coolify-app provisionerad; live-instansen körs fortfarande på Vercel").
observability.metrics / otel	false	STATUS.md: "no metrics/traces emitted"; no @opentelemetry/* dependency; app/api/admin/metrics is order/financial aggregates, not observability.
contracts.jsonSchemas	omitted	packages/schemas/*.schema.json $ids are bare strings (0pt.iceberg_table.schema.v1), not URIs as the schema's format: uri requires.
surfaces	["api","ui"]	Only what ships: Next.js route handlers + FastAPI (api), Next.js pages (ui). No bin, no MCP tools file, no SDK package, job execution delegated to N0D per the registry (runtime: 'N0D', orchestrator: 'n0d_direct').
engines	["postgres","opensearch","clickhouse"]	Real adapters: lib/db.ts+sql/, src/search/opensearch-adapter.ts, src/analytics/clickhouse-analytics.ts (both exercised in CI against live services). Redis excluded despite REDIS_URL/redis:7 in compose: lib/health-checks.ts says no client code reads it (not_integrated).

Capabilities: exactly the CL0UD registry, and a discrepancy to be aware of

capabilities[] = the 19 entries in cl0ud/packages/capability-registry/src/registry.ts with owner: '0pt' (5 prospekt.* + 14 0pt.*), per the rule that the registry is the single source. But: this repo contains zero occurrences of "prospekt" in any .ts/.py/.md, and ships no CLI or MCP surface, while the registry declares surfaces: ['api','cli','mcp',(job)] for all five prospekt.* entries (cl0ud services.ts maps them to sub-services S1/S3 "prospekt-email-verifier"/"prospekt-search (Typesense)"). Either those live in another repo and the registry's owner is wrong, or 0pt is expected to absorb them. Not resolved here — surfaced for Simon.

Source discrepancies found (estate inventory vs taxonomy vs repo reality)

1. Taxonomy vs estate tier for cl0ud/h0st (known, tracked): SIAX_TAXONOMY.yaml says expectedTier: core-platform for all 8 core planes, but SIAX_ESTATE.yaml files cl0ud as foundation and h0st as shared-platform. The taxonomy file documents this itself and ADR-013 defers it. For 0pt both agree (core-platform), so this manifest is unaffected — mentioned because the same discrepancy will hit the cl0ud/h0st manifests next.
2. Live deployment ≠ main: 0pt.app serves a build without /api/ready and without the engine/stripe keys main's health route emits — the Vercel deploy is stale relative to main (P010/P014 merged 2026-09-01/03).
3. Deploy target: siax.config.json declares Coolify; reality is Vercel (deploy.md). .gitea/workflows/cd.yml posts to a Coolify UUID that per deploy.md has never been provisioned.
4. api.0pt.app: listed in v2 + domain inventory as prod; not live (404). Kept in domains[] with an explicit "NOT live" purpose rather than dropped, since the inventory lists it.
5. ACT0: estate act0 row lists 0pt as a declared consumer; 0pt's own row/v2/siax.config.json have no ACT0 dependency (no ACT0_URL); only src/services/external-writeback-service.ts references it and the registry marks that path "not yet a live, callable production path". Not added to consumes.
6. siax-standard added to consumes (not in v2): real dependency — every $schema URL in this repo and scripts/siax-doctor.mjs resolve to it.
7. License field: root package.json has no license field; packages/schemas/package.json and LICENSE say UNLICENSED/proprietary.
8. Estate row vs schema semantics: the estate row's engines: (CL0UD, ST0RE, N0D, AUD0, INF0) are platform services; in v3 those belong in consumes, while engines[] is for siax.engine ids (databases/queues/search). Mapped accordingly.
9. prospekt.* ownership — see the capabilities section above.

Merge policy check

Branch protection on main: required_approvals: 0, protected_file_patterns: .gitea/workflows/**;.gitignore (root siax.repo.v3.json does not match), required status checks CI (SIAX Cloud) / quality (push) + security (push). Will merge only when both are genuinely green; never on pending/queued.

🤖 Generated with Claude Code

## First `siax.repo.v3.json` in the SIAX platform estate P049 certification found v3 adoption at **0/40** repos, which structurally blocks 8 of the 11 required `siax-doctor` commands (they return `measuredScore 0 / *-NOMANIFEST` for the whole estate). This PR adds the first v3 manifest, for 0pt. **Additive only** — `siax.repo.json` (v2) untouched per CONTRIBUTING.md; no other file changed; nothing under `.gitea/workflows/**` or `.gitignore` touched. ### siax-doctor scores (siax-standard `main`, `@siax/schemas` validator) | command | before | after | non-PASS findings after (verbatim) | |---|---|---|---| | `repo` REPO-16 | **NA** (`siax.repo.v3.json saknas`) | **PASS** — `siax.repo.v3.json giltig mot @siax/schemas siax.repo.v3` | unchanged pre-existing: DOC-07 FAIL, SEC-25 FAIL, CI-14 FAIL, CD-03 FAIL, REPO-01/12 PARTIAL (measuredScore 85 → 85; REPO-16 is NA-safe by design) | | `capabilities` | 0 / CAP-NOMANIFEST | **100** | CAP-DUP-OWNER PASS (`19 unika capability-id:n över 1 repo`); CAP-RECORD-OWNER WARN UNVERIFIED (`inga siax.capability-poster hittade under <root>/<repo>/siax/capabilities/*.json`) | | `dependencies` | 0 / DEP-NOMANIFEST | **100** | DEP-CYCLE PASS, DEP-REVERSE PASS, DEP-ASYM PASS (1 repo, 0 edges — other repos have no v3 yet) | | `surfaces` | 0 / SURF-NODATA | **0** | SURF-NODATA BLOCK UNVERIFIED: `Repo-nivåns siax.repo.v3.json#/capabilities[] listar BARA id:n ... den strukturerade siax.capability#/surfaces[]-posten krävs` — needs `siax/capabilities/*.json` records (deliberately NOT added: manifest-only PR) | | `engines` | 0 / ENG-NOMANIFEST | **0** | ENG-DIRECT-COUPLING BLOCK NA (`inga product/customer-tier-repon ... hittades` — 0pt is core-platform, so the only measurable check does not apply); ENG-REGISTRY WARN UNVERIFIED (no `siax/engines/*.json`) | | `licenses` | 0 / LIC-NOMANIFEST | **0** | LIC-UNASSESSED BLOCK UNVERIFIED: `ingen siax.license-assessment-post hittad (manifestet påstår heller inte approved=true, så inget obestyrkt PASS-påstående föreligger)`; LIC-COVERAGE WARN UNVERIFIED | Estate doctors were run with `--root` pointing at a scratch dir containing **only** this repo. Note for whoever runs them next: `--root` children must be real directories — a symlinked checkout is skipped (`listSubdirs` uses `isDirectory()`), which still yields `*-NOMANIFEST`. ### Fields set to an honest unknown/false value (one line each) | field | value | reason | |---|---|---| | `productionEvidence.verified` | `false` | No SHA→CI→artifact→SBOM→signature→deployment→running-digest chain exists. `PRODUCTION_EVIDENCE.json` is a from-scratch CI verification report of PR#28, not that chain. | | `identity.workloadIdentity` | `false` | Outbound platform auth is an optional static bearer from env (`ST0RE_SERVICE_TOKEN`, `src/clients/st0re-client.ts:92`); cl0ud `service-auth.ts` registers no principal for 0pt; SIAX_SECRET_REFERENCE_INVENTORY only says "yes" to secret refs. | | `consumedBy` | `[]` | SIAX_ESTATE.yaml 0pt row: `consumers: UNKNOWN-not-verified-this-pass`. SIAX_CAPABILITY_OWNERSHIP.md lists `0pt-motor`, `0pt-scraper`, `b00k`, `cl0ud` but in the column explicitly titled "Inferred consumers (reverse-engines lookup)" — candidates for a later pass, not asserted here. | | `reliability.backupFrequency` | `"none"` | `docs/runbook/backup-restore.md`: "ingen databas i produktion ... Ingen backup behövs/sker idag". | | `reliability.provenRestore` | `false` | P014 drill (2026-09-03) was real but against throwaway Docker containers of the schema — not a restore of a production backup (none exists). Consistent with the doctor's own DOC-07 FAIL on this repo. | | `reliability.slo` / `reliability.rollback` | omitted | `docs/slo.md` defines targets but states they apply "när tjänsten är i produktion på flottan (Coolify)" — which has not happened; no rollback procedure documented in `docs/runbook/deploy.md`. Omitted rather than asserted either way. | | `licenses.approved` | `false` | No `siax.license-assessment` record; `docs/compliance/OSS-INVENTORY.md` says licences "ej individuellt omverifierade denna pass (ANTAGANDE)". `spdx: UNLICENSED` from `LICENSE` (proprietary, all rights reserved) + `packages/schemas/package.json`. | | `operationalState` | `"degraded"` | Live probe 2026-09-04: `GET https://0pt.app/api/health` → 200 `{"ok":true,"service":"0pt-web","db":"not_configured","queue":"not_configured"}`; `GET /api/ready` → **404**; `https://api.0pt.app/` → 404. The deployed build predates main's `/api/ready` (which would fail closed 503 with db unconfigured). Liveness alive, readiness not met → degraded, not running. | | `node` / `deployment.node` | `null` | Estate: `node: UNKNOWN`. Live instance runs on Vercel, not a `server5..11` fleet node (`docs/runbook/deploy.md`: "ingen Coolify-app provisionerad; live-instansen körs fortfarande på Vercel"). | | `observability.metrics` / `otel` | `false` | `STATUS.md`: "no metrics/traces emitted"; no `@opentelemetry/*` dependency; `app/api/admin/metrics` is order/financial aggregates, not observability. | | `contracts.jsonSchemas` | omitted | `packages/schemas/*.schema.json` `$id`s are bare strings (`0pt.iceberg_table.schema.v1`), not URIs as the schema's `format: uri` requires. | | `surfaces` | `["api","ui"]` | Only what ships: Next.js route handlers + FastAPI (`api`), Next.js pages (`ui`). No `bin`, no MCP tools file, no SDK package, `job` execution delegated to N0D per the registry (`runtime: 'N0D'`, `orchestrator: 'n0d_direct'`). | | `engines` | `["postgres","opensearch","clickhouse"]` | Real adapters: `lib/db.ts`+`sql/`, `src/search/opensearch-adapter.ts`, `src/analytics/clickhouse-analytics.ts` (both exercised in CI against live services). **Redis excluded** despite `REDIS_URL`/`redis:7` in compose: `lib/health-checks.ts` says no client code reads it (`not_integrated`). | ### Capabilities: exactly the CL0UD registry, and a discrepancy to be aware of `capabilities[]` = the **19** entries in `cl0ud/packages/capability-registry/src/registry.ts` with `owner: '0pt'` (5 `prospekt.*` + 14 `0pt.*`), per the rule that the registry is the single source. **But**: this repo contains zero occurrences of "prospekt" in any `.ts/.py/.md`, and ships no CLI or MCP surface, while the registry declares `surfaces: ['api','cli','mcp',(job)]` for all five `prospekt.*` entries (cl0ud `services.ts` maps them to sub-services S1/S3 "prospekt-email-verifier"/"prospekt-search (Typesense)"). Either those live in another repo and the registry's `owner` is wrong, or 0pt is expected to absorb them. Not resolved here — surfaced for Simon. ### Source discrepancies found (estate inventory vs taxonomy vs repo reality) 1. **Taxonomy vs estate tier for cl0ud/h0st (known, tracked)**: `SIAX_TAXONOMY.yaml` says `expectedTier: core-platform` for all 8 core planes, but `SIAX_ESTATE.yaml` files `cl0ud` as `foundation` and `h0st` as `shared-platform`. The taxonomy file documents this itself and ADR-013 defers it. For **0pt both agree** (`core-platform`), so this manifest is unaffected — mentioned because the same discrepancy will hit the cl0ud/h0st manifests next. 2. **Live deployment ≠ main**: `0pt.app` serves a build without `/api/ready` and without the `engine`/`stripe` keys main's health route emits — the Vercel deploy is stale relative to `main` (P010/P014 merged 2026-09-01/03). 3. **Deploy target**: `siax.config.json` declares Coolify; reality is Vercel (deploy.md). `.gitea/workflows/cd.yml` posts to a Coolify UUID that per deploy.md has never been provisioned. 4. **`api.0pt.app`**: listed in v2 + domain inventory as prod; not live (404). Kept in `domains[]` with an explicit "NOT live" purpose rather than dropped, since the inventory lists it. 5. **ACT0**: estate `act0` row lists `0pt` as a declared consumer; 0pt's own row/v2/`siax.config.json` have no ACT0 dependency (no `ACT0_URL`); only `src/services/external-writeback-service.ts` references it and the registry marks that path "not yet a live, callable production path". Not added to `consumes`. 6. **`siax-standard` added to `consumes`** (not in v2): real dependency — every `$schema` URL in this repo and `scripts/siax-doctor.mjs` resolve to it. 7. **License field**: root `package.json` has no `license` field; `packages/schemas/package.json` and `LICENSE` say UNLICENSED/proprietary. 8. **Estate row vs schema semantics**: the estate row's `engines:` (`CL0UD, ST0RE, N0D, AUD0, INF0`) are platform *services*; in v3 those belong in `consumes`, while `engines[]` is for `siax.engine` ids (databases/queues/search). Mapped accordingly. 9. **`prospekt.*` ownership** — see the capabilities section above. ### Merge policy check Branch protection on `main`: `required_approvals: 0`, `protected_file_patterns: .gitea/workflows/**;.gitignore` (root `siax.repo.v3.json` does not match), required status checks `CI (SIAX Cloud) / quality (push)` + `security (push)`. Will merge only when both are genuinely green; never on pending/queued. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

admin added 1 commit 2026-09-04 11:27:14 +00:00

chore(estate): add first siax.repo.v3.json manifest (P003 v3 adoption) ... cbf0e1a0bf

First siax.repo.v3.json in the SIAX platform estate (P049 certification
found v3 adoption at 0/40, which structurally blocked 8 of the 11 required
siax-doctor commands with score 0 / *-NOMANIFEST).

Additive only: siax.repo.json (v2) is left untouched per CONTRIBUTING.md.
No other file changed.

Every field is filled from a real source (siax.repo.json v2, package.json,
LICENSE, siax.config.json, docs/runbook/*, docs/slo.md, PRODUCTION_EVIDENCE.json,
siax-standard SIAX_ESTATE.yaml + SIAX_TAXONOMY.yaml, cl0ud
packages/capability-registry/src/registry.ts, and a live probe of 0pt.app on
2026-09-04). Where the truth is unknown or unproven the honest schema option
is used, never a value that merely looks complete:

- productionEvidence.verified=false: no SHA->CI->artifact->SBOM->signature->
  deployment->running-digest chain exists (PRODUCTION_EVIDENCE.json is a CI
  verification report, not that chain).
- identity.workloadIdentity=false: outbound platform calls use an optional
  static ST0RE_SERVICE_TOKEN env bearer (src/clients/st0re-client.ts); cl0ud
  service-auth.ts registers no principal for 0pt.
- consumedBy=[]: SIAX_ESTATE.yaml row says consumers UNKNOWN-not-verified;
  the 4 reverse-lookup candidates are labelled "inferred" there.
- reliability.backupFrequency=none / provenRestore=false: production has no
  database (live /api/health db=not_configured); the P014 drill ran against
  throwaway containers, not a production backup.
- licenses.approved=false: no siax.license-assessment record exists.
- operationalState=degraded: live 0pt.app answers liveness 200 but
  db=not_configured and /api/ready is 404 (deployed build predates main).
- node=null / deployment.node=null: live on Vercel, not a fleet node.
- observability.metrics=false / otel=false: STATUS.md "no metrics/traces
  emitted"; /api/admin/metrics is business aggregates, not observability.
- capabilities: exactly the 19 ids cl0ud's registry lists with owner '0pt'
  (5 prospekt.* + 14 0pt.*). NOTE: the repo contains zero "prospekt" code
  and ships no CLI/MCP surface despite the registry claiming those surfaces
  for prospekt.* -- flagged in the PR, not silently dropped.
- surfaces=[api, ui]: only what actually ships (Next.js route handlers +
  FastAPI, Next.js pages). No bin, no MCP tools file, no SDK package
  (packages/schemas is JSON Schema files consumed by path), job execution
  is delegated to N0D per the registry.

siax-doctor (siax-standard main, @siax/schemas):
  repo         REPO-16  NA  -> PASS (measuredScore 85 -> 85; REPO-16 is NA-safe)
  capabilities   0 / CAP-NOMANIFEST -> 100 (CAP-DUP-OWNER PASS, 19 ids)
  dependencies   0 / DEP-NOMANIFEST -> 100 (DEP-CYCLE/DEP-REVERSE/DEP-ASYM PASS)
  surfaces       0 / SURF-NODATA    ->   0 (needs siax/capabilities/*.json records)
  engines        0 / ENG-NOMANIFEST ->   0 (ENG-DIRECT-COUPLING NA for core-platform; ENG-REGISTRY UNVERIFIED)
  licenses       0 / LIC-NOMANIFEST ->   0 (LIC-UNASSESSED UNVERIFIED -- honestly no approved=true claim)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

admin merged commit into main 2026-09-04 15:56:34 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

siax-bot siax-ci siax-healer (siax-healer (CI self-healing agent)) admin (Simon Axelsson)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: admin/0pt#30