admin
328f8a46cb
CI (SIAX Cloud) / security (push) Successful in 19s
Security Scan (SIAX Cloud) / security (push) Successful in 19s
CI (SIAX Cloud) / quality (push) Successful in 44s
CI (SIAX Cloud) / security (pull_request) Successful in 21s
Security Scan (SIAX Cloud) / security (pull_request) Successful in 20s
CI (SIAX Cloud) / quality (pull_request) Successful in 42s
BACKLOG P1-1: siax.repo.json/siax.config.json rewritten to be schema-valid against sax3l/siax-standard's actual v2.0 schemas (lifecycle, operationalState, gitHost, domains-as-objects, consumedBy, children, contracts -- validated with jsonschema, not just eyeballed). config.json restructured to the real deploy-descriptor shape (framework/build/start/ port/healthcheck/environments) instead of duplicating repo.json's identity fields, which the schema doesn't allow. BACKLOG P1-2: 3 ADRs for decisions already made and evidenced elsewhere in this repo (Coolify-not-Vercel, Zitadel-not-NextAuth, Iceberg-format pointer to n0d ADR-0030) -- retroactive documentation, not new decisions. The Stripe/Revolut and services/scrapers/* questions are explicitly NOT written as ADRs here; both are account-owner-gated or actively under review elsewhere (see docs/architecture/decisions/README.md). BACKLOG P1-3: CHANGELOG.md from real git log history (no tags/releases exist yet -- this doesn't invent version numbers that were never cut). BACKLOG P1-19: `pnpm siax:doctor` (scripts/siax-doctor.mjs, AGENT-04) -- zero-dependency, checks required files + manifest shape, prints control-IDs. .devcontainer/devcontainer.json (DX-03). compose.dev.yaml (DX-02 -- UNVERIFIED, no Docker available in this environment to smoke-test, flagged in the file itself). All 4 prompts + the index rewritten to AGENT-03 shape (goal/context/prerequisites/scope/contract/acceptance-criteria/ control-ID/forbidden-actions). BACKLOG P1-20: docs/architecture/ARCHITECTURE.md migrated to the v2.0 9-heading template -- new §5 "Ytor och paritet" (capability x API/CLI/MCP/console coverage table, grounded in the same registry facts docs/02-architecture.md already established), §6-9 renumbered from the old §5-8 (all internal cross-references fixed, CLAUDE.md's own §-numbers left untouched). docs/api/ added (points at contracts/openapi.yaml as the one SSOT instead of duplicating it as drift-prone prose). BACKLOG P1-21: packages/schemas now has a real package.json (was loose JSON files with no package -- pnpm-workspace.yaml's packages/* glob matched an empty package). Verified `pnpm install --frozen-lockfile` and the full typecheck/test/build suite still pass with 2 real workspace projects. apps/ restructuring explicitly NOT attempted (BACKLOG's own effort estimate is "L" / large -- moving the whole app tree is a bigger, riskier change than belongs in this pass). Import-boundary check added via dependency-cruiser (ARK-14) -- installed for real, config tested against this codebase (179 modules, 310 deps, 0 violations), wired as `pnpm run deps:check` (advisory, not yet a CI gate). BACKLOG P2-5: docs/02-architecture.md's "Hosting" section marked SUPERSEDED (the Vercel plan was superseded by the Coolify deploy.target flip, 2026-08-09 -- ADR-0001). README.md/.env.example were checked and are already accurately framed (live-on-Vercel vs. config-target-is-Coolify) -- not touched. BACKLOG P3-5: 2 stale github.com/sax3l/0pt/pull/3 links removed (the PR merged long ago, .env.example is real and current) -- docs/09-build-plan.md, docs/08-infrastructure.md. The "two diverged remotes, unresolved which is canonical" language elsewhere (CLAUDE.md, AGENTS.md, SECURITY.md, etc.) is deliberately NOT touched -- that's a live, correctly-flagged, account-owner- owned open question per the Gitea-exclusivity mandate, not a stale link. BACKLOG P6 (19 items): concrete artifacts for the ones that are actually a file (.editorconfig, dependency-cruiser, deprecation policy, K8s reference manifest, .actrc, Makefile, ONBOARDING.md); docs/guides/P6-GUIDES.md for the rest (CLI-13, DOC-18, UI-30, IAM-19, PAY-11, AI-18, OBS-21, TEST-20, NET-19, SCALE-13, OSS-10, AGENT-13) -- each grounded in this repo's actual code/gaps, not generic advice. NOT attempted (out of this task's scope, noted for the record): - P2-1 (cl0ud app-registry.ts mismatch) -- lives in a different repo (sax3l/cl0ud), not cloned/authorized for this task's single-repo PR flow. - The CI "doctor step" half of P1-15 -- deliberately left out of this PR's .gitea/workflows/ci.yml to avoid a 3-way merge conflict with ci/security-headers-and-scanning, which already restructured that file; add it as a follow-up once that PR merges. This branch was authored independently of, but shares docs/architecture/ ARCHITECTURE.md and docs/slo.md with, fix/honest-health-check and ci/security-headers-and-scanning -- expect a small, normal merge conflict if this is rebased after either of those merge first (both already rebased cleanly against each other and against main as of this commit).
66 lines
2.7 KiB
Markdown
66 lines
2.7 KiB
Markdown
# Onboarding — 0pt
|
|
|
|
BACKLOG P6 (DX-12). For a human or an agent picking this repo up cold.
|
|
|
|
## 1. Read, in order
|
|
|
|
1. `CLAUDE.md` — the contract for how this project is built. Non-negotiable
|
|
constraints (legal sourcing only, Postgres-backbone, provenance-per-field).
|
|
2. `AGENTS.md` — agent-specific ground rules.
|
|
3. `docs/architecture/ARCHITECTURE.md` — what the code actually does today
|
|
(as opposed to `docs/01-11`, which describe target state — see that
|
|
doc's own "Läsanvisning").
|
|
4. `README.md` "Known issues" — the live gaps, dated and evidenced.
|
|
5. `prompts/000-INDEX.md` — run `001-repo-health.md` before touching anything.
|
|
|
|
## 2. Get it running
|
|
|
|
```sh
|
|
corepack enable
|
|
corepack prepare pnpm@9 --activate
|
|
pnpm install --frozen-lockfile
|
|
pnpm run dev # http://localhost:3000, in-memory fallback, no DB needed
|
|
```
|
|
|
|
Or `make dev` (same thing). Want real Postgres locally instead of the
|
|
in-memory fallback? `make db-up` first (BACKLOG DX-02, `compose.dev.yaml` —
|
|
**unverified in CI, smoke-test before relying on it**), then re-run with
|
|
`DATABASE_URL` pointed at it (see the Makefile comment).
|
|
|
|
`pnpm run siax:doctor` (or `make doctor`) — runs the self-diagnostic subset
|
|
of the SIAX Golden Standard v2.0 checks locally (`scripts/siax-doctor.mjs`,
|
|
control AGENT-04). Run it after cloning and after any structural change.
|
|
|
|
## 3. Before you change anything
|
|
|
|
- `AUTH_ENFORCE` is fail-closed by default — don't set `AUTH_ENFORCE=false`
|
|
outside local dev, and never commit it set that way anywhere.
|
|
- `services/scrapers/*`, `services/infra/docker-compose.data-stack.yml`, and
|
|
`live/src/workers/adaptive_router.py`'s `curl_cffi` entries are frozen —
|
|
see `SECURITY.md`. Don't touch, remove, or comment on that code without an
|
|
explicit, current instruction from the account owner.
|
|
- Run `prompts/003-security-review.md`'s checklist before pushing anything
|
|
touching auth, payments, or the platform clients.
|
|
|
|
## 4. Before you push
|
|
|
|
```sh
|
|
pnpm run typecheck # blocking in CI
|
|
pnpm run test # blocking in CI
|
|
pnpm run build # blocking in CI
|
|
pnpm run lint # advisory, but fix what you can
|
|
```
|
|
|
|
CI (`.gitea/workflows/ci.yml`) re-runs all of these plus a blocking
|
|
Trivy/gitleaks scan (`security.yml`, BACKLOG P0-16/P0-19) — a red `trivy`
|
|
job on an otherwise-unrelated PR usually means a pre-existing dependency
|
|
finding, not something your change caused; check the run's date against
|
|
when that job started being blocking before assuming you broke it.
|
|
|
|
## 5. Who to ask
|
|
|
|
`CODEOWNERS` → `@sax3l` (Simon Axelsson). Two remotes exist for this repo
|
|
(`git.siax.io/sax3l/0pt` and `github.com/sax3l/0pt`) with independently
|
|
diverged history — which is authoritative is explicitly Simon's call, not
|
|
something to assume; see `CLAUDE.md`.
|