chore(estate): add first siax.repo.v3.json manifest (P003 v3 adoption, REPO-16 NA→PASS) #30

Merged
admin merged 1 commits from chore/siax-repo-v3-manifest into main 2026-09-04 15:56:34 +00:00
1 Commits
Author SHA1 Message Date
Simon AxelssonandClaude Fable 5.1 cbf0e1a0bf chore(estate): add first siax.repo.v3.json manifest (P003 v3 adoption)
CI (SIAX Cloud) / quality (push) Successful in 44s
CI (SIAX Cloud) / integration (push) Successful in 26s
CI (SIAX Cloud) / integration (pull_request) Successful in 27s
Security Scan (SIAX Cloud) / security (pull_request) Successful in 17s
CI (SIAX Cloud) / security (push) Successful in 20s
Security Scan (SIAX Cloud) / security (push) Successful in 17s
CI (SIAX Cloud) / quality (pull_request) Successful in 43s
CI (SIAX Cloud) / security (pull_request) Successful in 19s
First siax.repo.v3.json in the SIAX platform estate (P049 certification
found v3 adoption at 0/40, which structurally blocked 8 of the 11 required
siax-doctor commands with score 0 / *-NOMANIFEST).

Additive only: siax.repo.json (v2) is left untouched per CONTRIBUTING.md.
No other file changed.

Every field is filled from a real source (siax.repo.json v2, package.json,
LICENSE, siax.config.json, docs/runbook/*, docs/slo.md, PRODUCTION_EVIDENCE.json,
siax-standard SIAX_ESTATE.yaml + SIAX_TAXONOMY.yaml, cl0ud
packages/capability-registry/src/registry.ts, and a live probe of 0pt.app on
2026-09-04). Where the truth is unknown or unproven the honest schema option
is used, never a value that merely looks complete:

- productionEvidence.verified=false: no SHA->CI->artifact->SBOM->signature->
  deployment->running-digest chain exists (PRODUCTION_EVIDENCE.json is a CI
  verification report, not that chain).
- identity.workloadIdentity=false: outbound platform calls use an optional
  static ST0RE_SERVICE_TOKEN env bearer (src/clients/st0re-client.ts); cl0ud
  service-auth.ts registers no principal for 0pt.
- consumedBy=[]: SIAX_ESTATE.yaml row says consumers UNKNOWN-not-verified;
  the 4 reverse-lookup candidates are labelled "inferred" there.
- reliability.backupFrequency=none / provenRestore=false: production has no
  database (live /api/health db=not_configured); the P014 drill ran against
  throwaway containers, not a production backup.
- licenses.approved=false: no siax.license-assessment record exists.
- operationalState=degraded: live 0pt.app answers liveness 200 but
  db=not_configured and /api/ready is 404 (deployed build predates main).
- node=null / deployment.node=null: live on Vercel, not a fleet node.
- observability.metrics=false / otel=false: STATUS.md "no metrics/traces
  emitted"; /api/admin/metrics is business aggregates, not observability.
- capabilities: exactly the 19 ids cl0ud's registry lists with owner '0pt'
  (5 prospekt.* + 14 0pt.*). NOTE: the repo contains zero "prospekt" code
  and ships no CLI/MCP surface despite the registry claiming those surfaces
  for prospekt.* -- flagged in the PR, not silently dropped.
- surfaces=[api, ui]: only what actually ships (Next.js route handlers +
  FastAPI, Next.js pages). No bin, no MCP tools file, no SDK package
  (packages/schemas is JSON Schema files consumed by path), job execution
  is delegated to N0D per the registry.

siax-doctor (siax-standard main, @siax/schemas):
  repo         REPO-16  NA  -> PASS (measuredScore 85 -> 85; REPO-16 is NA-safe)
  capabilities   0 / CAP-NOMANIFEST -> 100 (CAP-DUP-OWNER PASS, 19 ids)
  dependencies   0 / DEP-NOMANIFEST -> 100 (DEP-CYCLE/DEP-REVERSE/DEP-ASYM PASS)
  surfaces       0 / SURF-NODATA    ->   0 (needs siax/capabilities/*.json records)
  engines        0 / ENG-NOMANIFEST ->   0 (ENG-DIRECT-COUPLING NA for core-platform; ENG-REGISTRY UNVERIFIED)
  licenses       0 / LIC-NOMANIFEST ->   0 (LIC-UNASSESSED UNVERIFIED -- honestly no approved=true claim)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-04 13:26:18 +02:00