From bb4cc781457255101e013efbfb42da65662fe217 Mon Sep 17 00:00:00 2001 From: siax-bot Date: Thu, 10 Sep 2026 18:17:07 +0200 Subject: [PATCH] chore(conformance): add masterplan-lock guard + PLAN/MASTERPLAN_INDEX.md Per siax-standard conformance sweep: repo lacked the masterplan-lock CI guard (.gitea/workflows/masterplan-lock.yml + scripts/check-masterplan-lock.sh) and a repo-local PLAN/MASTERPLAN_INDEX.md. Copied from sax3l/st0re template (generic POSIX sh check), stub PLAN index with locked architecture principles and pointer to sax3l/siax-masterplan. Refs: sax3l/siax-standard (conformance sweep 2026-09-10) --- .gitea/workflows/masterplan-lock.yml | 21 +++++++++++ PLAN/MASTERPLAN_INDEX.md | 20 +++++++++++ scripts/check-masterplan-lock.sh | 53 ++++++++++++++++++++++++++++ 3 files changed, 94 insertions(+) create mode 100644 .gitea/workflows/masterplan-lock.yml create mode 100644 PLAN/MASTERPLAN_INDEX.md create mode 100755 scripts/check-masterplan-lock.sh diff --git a/.gitea/workflows/masterplan-lock.yml b/.gitea/workflows/masterplan-lock.yml new file mode 100644 index 0000000..b3bc95a --- /dev/null +++ b/.gitea/workflows/masterplan-lock.yml @@ -0,0 +1,21 @@ +name: masterplan-lock + +# Fails the build if this repo's copy of the SIAX Non-Platform masterplan +# (PLAN/MASTERPLAN_INDEX.md) is deleted or its locked architecture +# principles are stripped out. Dependency-free (POSIX sh) so it needs no +# language toolchain. See scripts/check-masterplan-lock.sh and +# sax3l/siax-masterplan. + +on: + push: + branches: ["**"] + pull_request: + workflow_dispatch: + +jobs: + check: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Masterplan lock check + run: sh scripts/check-masterplan-lock.sh \ No newline at end of file diff --git a/PLAN/MASTERPLAN_INDEX.md b/PLAN/MASTERPLAN_INDEX.md new file mode 100644 index 0000000..cdc8382 --- /dev/null +++ b/PLAN/MASTERPLAN_INDEX.md @@ -0,0 +1,20 @@ +# 0pt — Masterplan-index (SIAX Non-Platform Masterplan) + +> **AI-session i detta repo?** Börja i [siax-masterplan → EXECUTE.md](https://git.siax.io/sax3l/siax-masterplan/src/branch/main/EXECUTE.md) + +**Repo:** `0pt` · **Domän:** Data OS (data engine, sourcing/enrichment) · **Kategori:** SIAX Non-Platform masterplan + +**Statusvokabulär:** MISSING → SCAFFOLDED → IMPLEMENTED → WIRED → INTEGRATION_TESTED → LIVE_VERIFIED → PRODUCTION_READY. Legacy = `LEGACY`, bort först när ersättaren är live (ingen dubbel sanning). + +## Låsta arkitekturprinciper (gäller detta repo) + +1. **En canonical owner per domän och sanning** — detta repo äger sin + domän-sanning; andra ytor konsumerar via API/event/SDK, aldrig egen SQL. +2. Inga production-mock-fallbacks. Inga lokala fallback-sanningar. +3. `tenant_id`/`actor_id` server-resolved; ingen frontend-tenant-trust. +4. Allt API-first: kontrakt först (openapi.yaml), sedan surfaces. + +> Detta är en stub skapad av conformance-sweep mot `siax-standard` +> (kriterium: masterplan-lock + PLAN-index). Fyll på med repo-specifik +> planstatus — redigera inte låst principerna. Kanonisk källa: +> [sax3l/siax-masterplan](https://git.siax.io/sax3l/siax-masterplan). \ No newline at end of file diff --git a/scripts/check-masterplan-lock.sh b/scripts/check-masterplan-lock.sh new file mode 100755 index 0000000..5c14e8f --- /dev/null +++ b/scripts/check-masterplan-lock.sh @@ -0,0 +1,53 @@ +#!/usr/bin/env sh +# check-masterplan-lock.sh +# +# Fails the build if this repo has drifted from the canonical SIAX Non-Platform +# masterplan (sax3l/siax-masterplan). Dependency-free (POSIX sh + grep only) so +# it runs before any language toolchain is installed. +# +# What it guards against: +# 1. PLAN/MASTERPLAN_INDEX.md being deleted (silent regression to a parallel +# truth with no pointer back to the canonical docs). +# 2. The "locked architecture principles" section being stripped or edited +# away, which is the actual enforcement text (one canonical owner per +# domain/truth, no cross-service SQL, no frontend-tenant-trust, no +# production-mock-fallbacks, API-first). +# 3. The status vocabulary line (MISSING -> ... -> PRODUCTION_READY) going +# missing, which would let a repo invent its own status labels. +# +# See PLAN/MASTERPLAN_INDEX.md and sax3l/siax-masterplan for the source of +# truth. Do not weaken this check to make a red build pass -- fix the drift +# in PLAN/MASTERPLAN_INDEX.md instead (or resync it from siax-masterplan). + +set -eu + +PLAN_FILE="PLAN/MASTERPLAN_INDEX.md" +fail=0 + +if [ ! -f "$PLAN_FILE" ]; then + echo "::error::${PLAN_FILE} is missing. This repo must carry a repo-local copy of the SIAX Non-Platform masterplan index (source: sax3l/siax-masterplan). Restore it -- do not remove this check." + exit 1 +fi + +check_contains() { + needle="$1" + label="$2" + if ! grep -qF "$needle" "$PLAN_FILE"; then + echo "::error::${PLAN_FILE} no longer contains ${label} ('${needle}'). This looks like drift away from the canonical masterplan (sax3l/siax-masterplan). Refresh PLAN/MASTERPLAN_INDEX.md from source instead of editing this check." + fail=1 + fi +} + +check_contains "Låsta arkitekturprinciper" "the locked-architecture-principles heading" +check_contains "En canonical owner per domän och sanning" "the one-canonical-owner-per-domain principle" +check_contains "aldrig egen SQL" "the no-own-SQL / no-parallel-truth clause" +check_contains "ingen frontend-tenant-trust" "the no-frontend-tenant-trust clause" +check_contains "PRODUCTION_READY" "the status vocabulary" +check_contains "sax3l/siax-masterplan" "the pointer back to the canonical masterplan repo" + +if [ "$fail" -ne 0 ]; then + echo "::error::masterplan lock check FAILED -- see above." + exit 1 +fi + +echo "masterplan lock check OK -- ${PLAN_FILE} still matches the canonical principles." -- 2.54.0