adminandClaude Sonnet 5
2393f52768
CI (SIAX Cloud) / security (push) Successful in 20s
Security Scan (SIAX Cloud) / security (push) Successful in 20s
CI (SIAX Cloud) / quality (push) Successful in 41s
CI (SIAX Cloud) / security (pull_request) Successful in 20s
Security Scan (SIAX Cloud) / security (pull_request) Successful in 20s
CI (SIAX Cloud) / quality (pull_request) Successful in 41s
PR #15 already fixed AGENTS.md/SECURITY.md with a dated, attributed statement of the account owner's 2026-08-11 decision (Simon Axelsson, via an interactive decision prompt, responding to this repo's own removal proposal PR #7 which was verified clean/128 tests and closed unmerged -- no rationale beyond "keep it" was given or is invented). This PR finds and fixes every other place in the repo that still carried the earlier unattributed "medvetet anvandarbeslut" / "deliberate user decision" claim a compliance audit flagged as unverifiable: - docs/compliance/GOLDEN-STANDARD-REPORT.md: control C6 row + the "Bypass-undantag" formal section (the two places this doc was explicitly named to need checking) -- header gains a dated update note, C6 row and the section body get the same attributed statement as AGENTS.md/SECURITY.md. - docs/compliance/SLUTRAPPORT.md, docs/compliance/INVENTORY.md: historical session doc keeps its original text and gains a dated correction addendum; the INVENTORY.md evidence bullet is corrected in place. - docs/slo.md, CONTRIBUTING.md, prompts/002-compliance-audit.md, renovate.json, .gitea/workflows/security.yml: direct/living references to the exemption get the same attributed, dated pointer instead of the unattributed phrase. CLAUDE.md's general §1 anti-evasion policy text is untouched, per instruction -- this is a scoped exception note, not a change to the normative rule. No code changes. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
59 lines
2.8 KiB
Markdown
59 lines
2.8 KiB
Markdown
# Contributing — 0pt
|
|
|
|
> 0pt (SIAX Cloud Data OS) är proprietär mjukvara från SIAX Technology AB.
|
|
> Interna bidrag följer konventionerna nedan. Externt: kontakta
|
|
> `security@siax.io` / `simon@siax.io` innan bidrag.
|
|
|
|
## Repo-ryggrad
|
|
|
|
- **Kategori:** platform (K1) · **Subkategori:** data-os · **SSOT:**
|
|
[`siax.repo.json`](siax.repo.json) + [`siax.config.json`](siax.config.json)
|
|
- **Kontrakt:** [`contracts/openapi.yaml`](contracts/openapi.yaml) — alla
|
|
API-ändringar börjar här (SSOT), sedan routehandler.
|
|
- **Dokumentation:** `CLAUDE.md` först, sedan `docs/` och `docs/compliance/`.
|
|
Om kod och docs avviker: skriv avvikelsen, fabricera inte.
|
|
|
|
## Hårda regler (bryt aldrig)
|
|
|
|
1. **AR-1** — radera aldrig befintlig funktionalitet/endpoint. Bygg färdigt.
|
|
Undantag: `services/scrapers/*` + `services/infra/docker-compose.data-stack.yml`
|
|
är **medvetet behållna per kontoägarens daterade beslut** (Simon Axelsson,
|
|
2026-08-11 — se SECURITY.md/AGENTS.md) — rör dem inte.
|
|
2. **AR-2** — rör aldrig frysta kundrepon (contentroom, v0-datahub, prt-*, …).
|
|
3. **AR-4** — inga betald-SaaS-beroenden; inga Vercel/GCP/Azure/Google Fonts/
|
|
`next/font/google`; Cloudflare endast inom pågående migrering.
|
|
4. **AR-5** — bevis, inte påståenden. Märk VERIFIERAT/ANTAGANDE/EJ VERIFIERAT.
|
|
5. **AR-6** — aldrig hemligheter i repo (Infisical). Inga `NEXT_PUBLIC_*`-hemligheter.
|
|
6. **AR-8** — beroenden pekar bara nedåt (K1; aldrig kundrepon).
|
|
7. Tenant-id bunden till sessionen — aldrig litat på från request-body.
|
|
|
|
## Arbetsflöde
|
|
|
|
1. Branch från `main`: `git switch -c fix/my-change` (conventional prefix).
|
|
2. `pnpm install --frozen-lockfile` (eller `--no-frozen-lockfile` om lockfilen
|
|
medvetet uppdateras).
|
|
3. Grindar innan push:
|
|
```bash
|
|
pnpm run typecheck # BLOCKERANDE (src/ + tests/)
|
|
pnpm run test # BLOCKERANDE (vitest)
|
|
pnpm run lint # rådgivande (legacy-noise finns)
|
|
pnpm run build # BLOCKERANDE (next build)
|
|
```
|
|
4. Conventional Commits: `feat:` / `fix:` / `docs:` / `chore:` / `ci:` / `refactor:`.
|
|
5. **`.gitea/workflows/**` och `.gitignore` är skyddade på `main`** — ändringar
|
|
där går via PR (push direkt avvisas av pre-receive-hook).
|
|
6. Öppna PR mot `main`; CI måste vara grön innan merge.
|
|
7. Commit-meddelanden på engelska; UI-copy på svenska.
|
|
|
|
## Testkonventioner
|
|
|
|
- Enheter + capability-tester: `tests/{auth,p0,validation}/`.
|
|
- Real-infra-tester (`*.realinfra.test.ts`) skippar ärligt när ST0RE/N0D inte nås.
|
|
- Lägg aldrig till en test som fabricerar påståenden om kod som inte finns.
|
|
|
|
## Merge & release
|
|
|
|
- Merge via PR till `main` (skyddad). CD: `.gitea/workflows/cd.yml` triggar
|
|
Coolify-redeploy — fails medvetet tills en Coolify-app provisionerats och
|
|
`COOLIFY_APP_ID`/`COOLIFY_TOKEN` satts.
|