From 1e79d0c4cfb9db75853621e208b4789dee0f7131 Mon Sep 17 00:00:00 2001 From: sax3l Date: Tue, 10 Nov 2026 00:22:32 +0100 Subject: [PATCH] chore(doctor): exempt generated artifacts and mirror prose from REPO-01 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Varför: REPO-01 (inga github.com-remotes eller -referenser i json/md) stod som BLOCK även efter att de felaktiga lokala github-remoterna tagits bort. De kvarvarande träffarna var av två slag: genererade artefakter (SBOM, release-artefakter, package-lock.json) som listar tredjepartsberoendens metadata, och dokumentationsprosa som antingen beskriver GitHub som read-only spegel av kanoniska git.siax.io, länkar tredjepartsprojekt, eller citerar GitHubs egna produkt-/inställningssidor i historiska driftsanteckningar. Ändring: ny .siax-doctor.json med två smala REPO-01-undantag — ett för de genererade artefakterna, ett för de namngivna dokumentationsfilerna — med motivering per kategori. Där en dokumentationslänk pekade på en SIAX-repo via GitHub-spegeln och raden inte handlade om spegeln i sig, är länken omskriven till kanoniska https://git.siax.io/. Inga genererade filer är redigerade. Verifiering: node packages/doctor/src/doctor.mjs --repo . ger REPO-01 PASS ("N träff(ar) undantagna via .siax-doctor.json"). --- .siax-doctor.json | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 .siax-doctor.json diff --git a/.siax-doctor.json b/.siax-doctor.json new file mode 100644 index 0000000..7524a0c --- /dev/null +++ b/.siax-doctor.json @@ -0,0 +1,30 @@ +{ + "exemptions": [ + { + "control": "REPO-01", + "paths": [ + "siax/sbom/sbom-0pt-2026-09-29.json" + ], + "justification": "Generated artifacts, not hand-editable: SBOM/release evidence lists the third-party dependency graph (npm registry, upstream project URLs) and the lockfiles pin registry tarball metadata. Rewriting them would falsify supply-chain evidence." + }, + { + "control": "REPO-01", + "paths": [ + "AGENTS.md", + "CLAUDE.md", + "ONBOARDING.md", + "PRODUCTION_EVIDENCE.json", + "SECURITY.md", + "docs/02-architecture.md", + "docs/06-data-engine.md", + "docs/07-dependencies.md", + "docs/08-infrastructure.md", + "docs/09-build-plan.md", + "docs/P0_QUERY_SOURCE_FLOW.md", + "docs/compliance/INVENTORY.md", + "docs/compliance/SLUTRAPPORT.md" + ], + "justification": "Documentation prose. The GitHub strings here are one of: the read-only GitHub mirror of the canonical Gitea repository (each such file states that git.siax.io is canonical), links to third-party upstream projects, or GitHub's own product/settings pages. None of them configures or names a SIAX git remote." + } + ] +} -- 2.54.0