chore(estate): add first siax.repo.v3.json manifest (P003 v3 adoption, REPO-16 NA→PASS) #30
Merged
admin
merged 1 commits from 2026-09-04 15:56:34 +00:00
chore/siax-repo-v3-manifest into main
1
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
|
|
cbf0e1a0bf |
chore(estate): add first siax.repo.v3.json manifest (P003 v3 adoption)
CI (SIAX Cloud) / quality (push) Successful in 44s
CI (SIAX Cloud) / integration (push) Successful in 26s
CI (SIAX Cloud) / integration (pull_request) Successful in 27s
Security Scan (SIAX Cloud) / security (pull_request) Successful in 17s
CI (SIAX Cloud) / security (push) Successful in 20s
Security Scan (SIAX Cloud) / security (push) Successful in 17s
CI (SIAX Cloud) / quality (pull_request) Successful in 43s
CI (SIAX Cloud) / security (pull_request) Successful in 19s
First siax.repo.v3.json in the SIAX platform estate (P049 certification found v3 adoption at 0/40, which structurally blocked 8 of the 11 required siax-doctor commands with score 0 / *-NOMANIFEST). Additive only: siax.repo.json (v2) is left untouched per CONTRIBUTING.md. No other file changed. Every field is filled from a real source (siax.repo.json v2, package.json, LICENSE, siax.config.json, docs/runbook/*, docs/slo.md, PRODUCTION_EVIDENCE.json, siax-standard SIAX_ESTATE.yaml + SIAX_TAXONOMY.yaml, cl0ud packages/capability-registry/src/registry.ts, and a live probe of 0pt.app on 2026-09-04). Where the truth is unknown or unproven the honest schema option is used, never a value that merely looks complete: - productionEvidence.verified=false: no SHA->CI->artifact->SBOM->signature-> deployment->running-digest chain exists (PRODUCTION_EVIDENCE.json is a CI verification report, not that chain). - identity.workloadIdentity=false: outbound platform calls use an optional static ST0RE_SERVICE_TOKEN env bearer (src/clients/st0re-client.ts); cl0ud service-auth.ts registers no principal for 0pt. - consumedBy=[]: SIAX_ESTATE.yaml row says consumers UNKNOWN-not-verified; the 4 reverse-lookup candidates are labelled "inferred" there. - reliability.backupFrequency=none / provenRestore=false: production has no database (live /api/health db=not_configured); the P014 drill ran against throwaway containers, not a production backup. - licenses.approved=false: no siax.license-assessment record exists. - operationalState=degraded: live 0pt.app answers liveness 200 but db=not_configured and /api/ready is 404 (deployed build predates main). - node=null / deployment.node=null: live on Vercel, not a fleet node. - observability.metrics=false / otel=false: STATUS.md "no metrics/traces emitted"; /api/admin/metrics is business aggregates, not observability. - capabilities: exactly the 19 ids cl0ud's registry lists with owner '0pt' (5 prospekt.* + 14 0pt.*). NOTE: the repo contains zero "prospekt" code and ships no CLI/MCP surface despite the registry claiming those surfaces for prospekt.* -- flagged in the PR, not silently dropped. - surfaces=[api, ui]: only what actually ships (Next.js route handlers + FastAPI, Next.js pages). No bin, no MCP tools file, no SDK package (packages/schemas is JSON Schema files consumed by path), job execution is delegated to N0D per the registry. siax-doctor (siax-standard main, @siax/schemas): repo REPO-16 NA -> PASS (measuredScore 85 -> 85; REPO-16 is NA-safe) capabilities 0 / CAP-NOMANIFEST -> 100 (CAP-DUP-OWNER PASS, 19 ids) dependencies 0 / DEP-NOMANIFEST -> 100 (DEP-CYCLE/DEP-REVERSE/DEP-ASYM PASS) surfaces 0 / SURF-NODATA -> 0 (needs siax/capabilities/*.json records) engines 0 / ENG-NOMANIFEST -> 0 (ENG-DIRECT-COUPLING NA for core-platform; ENG-REGISTRY UNVERIFIED) licenses 0 / LIC-NOMANIFEST -> 0 (LIC-UNASSESSED UNVERIFIED -- honestly no approved=true claim) Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> |