.gitea/workflows/masterplan-lock.yml

@@ -0,0 +1,21 @@
+name: masterplan-lock
+
+# Fails the build if this repo's copy of the SIAX Non-Platform masterplan
+# (PLAN/MASTERPLAN_INDEX.md) is deleted or its locked architecture
+# principles are stripped out. Dependency-free (POSIX sh) so it needs no
+# language toolchain. See scripts/check-masterplan-lock.sh and
+# sax3l/siax-masterplan.
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Masterplan lock check
+        run: sh scripts/check-masterplan-lock.sh

PLAN/MASTERPLAN_INDEX.md

@@ -0,0 +1,20 @@
+# 0pt — Masterplan-index (SIAX Non-Platform Masterplan)
+
+> **AI-session i detta repo?** Börja i [siax-masterplan → EXECUTE.md](https://git.siax.io/sax3l/siax-masterplan/src/branch/main/EXECUTE.md)
+
+**Repo:** `0pt` · **Domän:** Data OS (data engine, sourcing/enrichment) · **Kategori:** SIAX Non-Platform masterplan
+
+**Statusvokabulär:** MISSING → SCAFFOLDED → IMPLEMENTED → WIRED → INTEGRATION_TESTED → LIVE_VERIFIED → PRODUCTION_READY. Legacy = `LEGACY`, bort först när ersättaren är live (ingen dubbel sanning).
+
+## Låsta arkitekturprinciper (gäller detta repo)
+
+1. **En canonical owner per domän och sanning** — detta repo äger sin
+   domän-sanning; andra ytor konsumerar via API/event/SDK, aldrig egen SQL.
+2. Inga production-mock-fallbacks. Inga lokala fallback-sanningar.
+3. `tenant_id`/`actor_id` server-resolved; ingen frontend-tenant-trust.
+4. Allt API-first: kontrakt först (openapi.yaml), sedan surfaces.
+
+> Detta är en stub skapad av conformance-sweep mot `siax-standard`
+> (kriterium: masterplan-lock + PLAN-index). Fyll på med repo-specifik
+> planstatus — redigera inte låst principerna. Kanonisk källa:
+> [sax3l/siax-masterplan](https://git.siax.io/sax3l/siax-masterplan).

scripts/check-masterplan-lock.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env sh
+# check-masterplan-lock.sh
+#
+# Fails the build if this repo has drifted from the canonical SIAX Non-Platform
+# masterplan (sax3l/siax-masterplan). Dependency-free (POSIX sh + grep only) so
+# it runs before any language toolchain is installed.
+#
+# What it guards against:
+#   1. PLAN/MASTERPLAN_INDEX.md being deleted (silent regression to a parallel
+#      truth with no pointer back to the canonical docs).
+#   2. The "locked architecture principles" section being stripped or edited
+#      away, which is the actual enforcement text (one canonical owner per
+#      domain/truth, no cross-service SQL, no frontend-tenant-trust, no
+#      production-mock-fallbacks, API-first).
+#   3. The status vocabulary line (MISSING -> ... -> PRODUCTION_READY) going
+#      missing, which would let a repo invent its own status labels.
+#
+# See PLAN/MASTERPLAN_INDEX.md and sax3l/siax-masterplan for the source of
+# truth. Do not weaken this check to make a red build pass -- fix the drift
+# in PLAN/MASTERPLAN_INDEX.md instead (or resync it from siax-masterplan).
+
+set -eu
+
+PLAN_FILE="PLAN/MASTERPLAN_INDEX.md"
+fail=0
+
+if [ ! -f "$PLAN_FILE" ]; then
+  echo "::error::${PLAN_FILE} is missing. This repo must carry a repo-local copy of the SIAX Non-Platform masterplan index (source: sax3l/siax-masterplan). Restore it -- do not remove this check."
+  exit 1
+fi
+
+check_contains() {
+  needle="$1"
+  label="$2"
+  if ! grep -qF "$needle" "$PLAN_FILE"; then
+    echo "::error::${PLAN_FILE} no longer contains ${label} ('${needle}'). This looks like drift away from the canonical masterplan (sax3l/siax-masterplan). Refresh PLAN/MASTERPLAN_INDEX.md from source instead of editing this check."
+    fail=1
+  fi
+}
+
+check_contains "Låsta arkitekturprinciper" "the locked-architecture-principles heading"
+check_contains "En canonical owner per domän och sanning" "the one-canonical-owner-per-domain principle"
+check_contains "aldrig egen SQL" "the no-own-SQL / no-parallel-truth clause"
+check_contains "ingen frontend-tenant-trust" "the no-frontend-tenant-trust clause"
+check_contains "PRODUCTION_READY" "the status vocabulary"
+check_contains "sax3l/siax-masterplan" "the pointer back to the canonical masterplan repo"
+
+if [ "$fail" -ne 0 ]; then
+  echo "::error::masterplan lock check FAILED -- see above."
+  exit 1
+fi
+
+echo "masterplan lock check OK -- ${PLAN_FILE} still matches the canonical principles."