adminandClaude Sonnet 5
2393f52768
CI (SIAX Cloud) / security (push) Successful in 20s
Security Scan (SIAX Cloud) / security (push) Successful in 20s
CI (SIAX Cloud) / quality (push) Successful in 41s
CI (SIAX Cloud) / security (pull_request) Successful in 20s
Security Scan (SIAX Cloud) / security (pull_request) Successful in 20s
CI (SIAX Cloud) / quality (pull_request) Successful in 41s
PR #15 already fixed AGENTS.md/SECURITY.md with a dated, attributed statement of the account owner's 2026-08-11 decision (Simon Axelsson, via an interactive decision prompt, responding to this repo's own removal proposal PR #7 which was verified clean/128 tests and closed unmerged -- no rationale beyond "keep it" was given or is invented). This PR finds and fixes every other place in the repo that still carried the earlier unattributed "medvetet anvandarbeslut" / "deliberate user decision" claim a compliance audit flagged as unverifiable: - docs/compliance/GOLDEN-STANDARD-REPORT.md: control C6 row + the "Bypass-undantag" formal section (the two places this doc was explicitly named to need checking) -- header gains a dated update note, C6 row and the section body get the same attributed statement as AGENTS.md/SECURITY.md. - docs/compliance/SLUTRAPPORT.md, docs/compliance/INVENTORY.md: historical session doc keeps its original text and gains a dated correction addendum; the INVENTORY.md evidence bullet is corrected in place. - docs/slo.md, CONTRIBUTING.md, prompts/002-compliance-audit.md, renovate.json, .gitea/workflows/security.yml: direct/living references to the exemption get the same attributed, dated pointer instead of the unattributed phrase. CLAUDE.md's general §1 anti-evasion policy text is untouched, per instruction -- this is a scoped exception note, not a change to the normative rule. No code changes. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2.8 KiB
2.8 KiB
Contributing — 0pt
0pt (SIAX Cloud Data OS) är proprietär mjukvara från SIAX Technology AB. Interna bidrag följer konventionerna nedan. Externt: kontakta
security@siax.io/simon@siax.ioinnan bidrag.
Repo-ryggrad
- Kategori: platform (K1) · Subkategori: data-os · SSOT:
siax.repo.json+siax.config.json - Kontrakt:
contracts/openapi.yaml— alla API-ändringar börjar här (SSOT), sedan routehandler. - Dokumentation:
CLAUDE.mdförst, sedandocs/ochdocs/compliance/. Om kod och docs avviker: skriv avvikelsen, fabricera inte.
Hårda regler (bryt aldrig)
- AR-1 — radera aldrig befintlig funktionalitet/endpoint. Bygg färdigt.
Undantag:
services/scrapers/*+services/infra/docker-compose.data-stack.ymlär medvetet behållna per kontoägarens daterade beslut (Simon Axelsson, 2026-08-11 — se SECURITY.md/AGENTS.md) — rör dem inte. - AR-2 — rör aldrig frysta kundrepon (contentroom, v0-datahub, prt-*, …).
- AR-4 — inga betald-SaaS-beroenden; inga Vercel/GCP/Azure/Google Fonts/
next/font/google; Cloudflare endast inom pågående migrering. - AR-5 — bevis, inte påståenden. Märk VERIFIERAT/ANTAGANDE/EJ VERIFIERAT.
- AR-6 — aldrig hemligheter i repo (Infisical). Inga
NEXT_PUBLIC_*-hemligheter. - AR-8 — beroenden pekar bara nedåt (K1; aldrig kundrepon).
- Tenant-id bunden till sessionen — aldrig litat på från request-body.
Arbetsflöde
- Branch från
main:git switch -c fix/my-change(conventional prefix). pnpm install --frozen-lockfile(eller--no-frozen-lockfileom lockfilen medvetet uppdateras).- Grindar innan push:
pnpm run typecheck # BLOCKERANDE (src/ + tests/) pnpm run test # BLOCKERANDE (vitest) pnpm run lint # rådgivande (legacy-noise finns) pnpm run build # BLOCKERANDE (next build) - Conventional Commits:
feat:/fix:/docs:/chore:/ci:/refactor:. .gitea/workflows/**och.gitignoreär skyddade påmain— ändringar där går via PR (push direkt avvisas av pre-receive-hook).- Öppna PR mot
main; CI måste vara grön innan merge. - Commit-meddelanden på engelska; UI-copy på svenska.
Testkonventioner
- Enheter + capability-tester:
tests/{auth,p0,validation}/. - Real-infra-tester (
*.realinfra.test.ts) skippar ärligt när ST0RE/N0D inte nås. - Lägg aldrig till en test som fabricerar påståenden om kod som inte finns.
Merge & release
- Merge via PR till
main(skyddad). CD:.gitea/workflows/cd.ymltriggar Coolify-redeploy — fails medvetet tills en Coolify-app provisionerats ochCOOLIFY_APP_ID/COOLIFY_TOKENsatts.