admin
328f8a46cb
CI (SIAX Cloud) / security (push) Successful in 19s
Security Scan (SIAX Cloud) / security (push) Successful in 19s
CI (SIAX Cloud) / quality (push) Successful in 44s
CI (SIAX Cloud) / security (pull_request) Successful in 21s
Security Scan (SIAX Cloud) / security (pull_request) Successful in 20s
CI (SIAX Cloud) / quality (pull_request) Successful in 42s
BACKLOG P1-1: siax.repo.json/siax.config.json rewritten to be schema-valid against sax3l/siax-standard's actual v2.0 schemas (lifecycle, operationalState, gitHost, domains-as-objects, consumedBy, children, contracts -- validated with jsonschema, not just eyeballed). config.json restructured to the real deploy-descriptor shape (framework/build/start/ port/healthcheck/environments) instead of duplicating repo.json's identity fields, which the schema doesn't allow. BACKLOG P1-2: 3 ADRs for decisions already made and evidenced elsewhere in this repo (Coolify-not-Vercel, Zitadel-not-NextAuth, Iceberg-format pointer to n0d ADR-0030) -- retroactive documentation, not new decisions. The Stripe/Revolut and services/scrapers/* questions are explicitly NOT written as ADRs here; both are account-owner-gated or actively under review elsewhere (see docs/architecture/decisions/README.md). BACKLOG P1-3: CHANGELOG.md from real git log history (no tags/releases exist yet -- this doesn't invent version numbers that were never cut). BACKLOG P1-19: `pnpm siax:doctor` (scripts/siax-doctor.mjs, AGENT-04) -- zero-dependency, checks required files + manifest shape, prints control-IDs. .devcontainer/devcontainer.json (DX-03). compose.dev.yaml (DX-02 -- UNVERIFIED, no Docker available in this environment to smoke-test, flagged in the file itself). All 4 prompts + the index rewritten to AGENT-03 shape (goal/context/prerequisites/scope/contract/acceptance-criteria/ control-ID/forbidden-actions). BACKLOG P1-20: docs/architecture/ARCHITECTURE.md migrated to the v2.0 9-heading template -- new §5 "Ytor och paritet" (capability x API/CLI/MCP/console coverage table, grounded in the same registry facts docs/02-architecture.md already established), §6-9 renumbered from the old §5-8 (all internal cross-references fixed, CLAUDE.md's own §-numbers left untouched). docs/api/ added (points at contracts/openapi.yaml as the one SSOT instead of duplicating it as drift-prone prose). BACKLOG P1-21: packages/schemas now has a real package.json (was loose JSON files with no package -- pnpm-workspace.yaml's packages/* glob matched an empty package). Verified `pnpm install --frozen-lockfile` and the full typecheck/test/build suite still pass with 2 real workspace projects. apps/ restructuring explicitly NOT attempted (BACKLOG's own effort estimate is "L" / large -- moving the whole app tree is a bigger, riskier change than belongs in this pass). Import-boundary check added via dependency-cruiser (ARK-14) -- installed for real, config tested against this codebase (179 modules, 310 deps, 0 violations), wired as `pnpm run deps:check` (advisory, not yet a CI gate). BACKLOG P2-5: docs/02-architecture.md's "Hosting" section marked SUPERSEDED (the Vercel plan was superseded by the Coolify deploy.target flip, 2026-08-09 -- ADR-0001). README.md/.env.example were checked and are already accurately framed (live-on-Vercel vs. config-target-is-Coolify) -- not touched. BACKLOG P3-5: 2 stale github.com/sax3l/0pt/pull/3 links removed (the PR merged long ago, .env.example is real and current) -- docs/09-build-plan.md, docs/08-infrastructure.md. The "two diverged remotes, unresolved which is canonical" language elsewhere (CLAUDE.md, AGENTS.md, SECURITY.md, etc.) is deliberately NOT touched -- that's a live, correctly-flagged, account-owner- owned open question per the Gitea-exclusivity mandate, not a stale link. BACKLOG P6 (19 items): concrete artifacts for the ones that are actually a file (.editorconfig, dependency-cruiser, deprecation policy, K8s reference manifest, .actrc, Makefile, ONBOARDING.md); docs/guides/P6-GUIDES.md for the rest (CLI-13, DOC-18, UI-30, IAM-19, PAY-11, AI-18, OBS-21, TEST-20, NET-19, SCALE-13, OSS-10, AGENT-13) -- each grounded in this repo's actual code/gaps, not generic advice. NOT attempted (out of this task's scope, noted for the record): - P2-1 (cl0ud app-registry.ts mismatch) -- lives in a different repo (sax3l/cl0ud), not cloned/authorized for this task's single-repo PR flow. - The CI "doctor step" half of P1-15 -- deliberately left out of this PR's .gitea/workflows/ci.yml to avoid a 3-way merge conflict with ci/security-headers-and-scanning, which already restructured that file; add it as a follow-up once that PR merges. This branch was authored independently of, but shares docs/architecture/ ARCHITECTURE.md and docs/slo.md with, fix/honest-health-check and ci/security-headers-and-scanning -- expect a small, normal merge conflict if this is rebased after either of those merge first (both already rebased cleanly against each other and against main as of this commit).
42 lines
2.0 KiB
Markdown
42 lines
2.0 KiB
Markdown
# API deprecation policy — 0pt
|
|
|
|
BACKLOG P6 (API-24). There is exactly one prior breaking-ish change in this
|
|
repo's history to learn from: `services/api/orchestrator/main.py` moved from
|
|
`src/orchestrator` (docs/09-build-plan.md Phase 0) — internal, pre-contract,
|
|
no external consumers yet. This policy is written before it's needed for a
|
|
real consumer, on purpose (BACKLOG's own framing: "cheaper to write the
|
|
policy than to clean up after breaking someone").
|
|
|
|
## What counts as breaking
|
|
|
|
- Removing a path, operation, or required request/response field from
|
|
`contracts/openapi.yaml`.
|
|
- Narrowing an accepted value (enum shrink, type tightening) on a request field.
|
|
- Changing a response field's meaning without changing its name/type.
|
|
- Changing default auth/tenant behavior on an existing route (e.g. what
|
|
BACKLOG P0-4 fixed — the reverse of a break, but the same class of change).
|
|
|
|
Not breaking: adding an optional field, adding a new path, widening an
|
|
accepted value, adding a new enum member a client can ignore.
|
|
|
|
## Process
|
|
|
|
1. Mark the field/path `deprecated: true` in `contracts/openapi.yaml` with an
|
|
`x-siax-deprecated-since` date and a one-line replacement pointer.
|
|
2. Keep the deprecated shape working for **at least one release cycle**
|
|
after the replacement ships (see `CHANGELOG.md` once real releases/tags
|
|
exist — BACKLOG P1-3).
|
|
3. Announce in `CHANGELOG.md`'s `[Unreleased]` section before merge, not
|
|
after.
|
|
4. Only remove once nothing in this repo's own consumers (Protosell/FiveCRM,
|
|
VehIQ per `CLAUDE.md`) is verified to depend on the old shape — "verified"
|
|
means checked against those repos, not assumed silent.
|
|
|
|
## What this repo does NOT have yet
|
|
|
|
No consumers are known to be live against this contract yet
|
|
(`docs/architecture/ARCHITECTURE.md` §2 "Beroenden nedåt": "Inga sådana
|
|
anrop finns i det här repot" — unverified downstream). This policy exists
|
|
so the first real breaking change has a process to follow, not because one
|
|
has happened.
|