Claude Opus 5
d7a1c4d5e1
CI (SIAX Cloud) / security (push) Successful in 31s
CI (SIAX Cloud) / integration (push) Successful in 42s
Security Scan (SIAX Cloud) / security (push) Successful in 44s
CI (SIAX Cloud) / quality (push) Successful in 1m6s
CI (SIAX Cloud) / security (pull_request) Successful in 30s
CI (SIAX Cloud) / integration (pull_request) Successful in 37s
Security Scan (SIAX Cloud) / security (pull_request) Successful in 26s
CI (SIAX Cloud) / quality (pull_request) Successful in 1m2s
Six documents on main assert that no Coolify app has been provisioned for 0pt and
that cd.yml's COOLIFY_APP_ID is a literal placeholder whose guard fails the job on
purpose. That is no longer true, and the gap is not cosmetic: it means a merge to
main silently ships to production while the repo's own docs promise it cannot.
Measured, not assumed:
* repo Actions secret COOLIFY_TOKEN exists, created 2026-08-31T11:34:34Z
(GET /api/v1/repos/sax3l/0pt/actions/secrets)
* repo Actions variable COOLIFY_APP_ID exists with a real 24-character value,
not the "TODO-no-coolify-app-provisioned-yet" literal
(GET /api/v1/repos/sax3l/0pt/actions/variables)
* both guards in .gitea/workflows/cd.yml therefore pass; on the push to main at
1ff34410 (2026-09-06) the job "Deploy to Coolify / deploy" (run 11695, job
26295) finished SUCCESS with "coolify deploy HTTP 200" in its log
Deliberately NOT claimed: that the Coolify app builds, starts or serves, or that
0pt.app DNS points at it rather than Vercel. Nobody probed the running site, and
every corrected passage says so explicitly rather than replacing one unverified
claim with another.
Corrected: README.md "Deploy", docs/02-architecture.md hosting callout,
docs/architecture/decisions/0001 (consequence annotated, decision untouched --
an ADR is a historical record), docs/runbook/incident.md (the symptom row is now
inverted: the risk is an unintended deploy, not a red job),
docs/compliance/GOLDEN-STANDARD-REPORT.md D4 (❌ -> ⚠️, not ✅, because "webhook
accepted" is not "app serves"), docs/compliance/INVENTORY.md CI row.
Falsifiable check over all six files (stale claim present without a correction
marker = red):
origin/main -> FAIL (12 findings)
this branch -> PASS
mutation: drop only the README bullet -> FAIL
mutation: drop only the runbook correction -> FAIL
The check initially passed vacuously on docs/02-architecture.md because PR #32 had
already put the string "CORRECTED 2026-09-06" in that file for an unrelated reason;
the marker was made specific so the check could actually fail there too.
Docs only. No workflow files, no .gitignore, no source.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
9.3 KiB
9.3 KiB
INVENTORY — 0pt (sax3l/0pt) — FAS 0
Kategori: platform (K1) · Subkategori: data-os · Repo:
git.siax.io/sax3l/0ptKartlagd: 2026-08-10 · Metod: klon (git) + Gitea API (v1, token admin) + grep + live-prober Alla påståenden märkta VERIFIERAT / ANTAGANDE / EJ VERIFIERAT per AR-5.
1. Repo-identitet (VERIFIERAT — Gitea API)
| Fält | Värde |
|---|---|
| full_name | sax3l/0pt (id 21) |
| visibility | private |
| default_branch | main |
| HEAD (main) | 1346e868bf5c55c6771377c60a3ab7d3dd789ffc (2026-08-09) |
| branches | 8 (main, fix/remove-vercel-deploy-target, unify/github-main-2026-07-28, docs/1p-egress-measurement-point, compliance/remove-evasion-stack, renovate/configure, foundation/hardening, feature/0pt-remove-noncompliant-scrapers) |
| språk | TypeScript (dominerande) + Python (engine + scrapers) |
| storlek | ~22 MB (inkl. committed skrapdata services/scrapers/output/*.json + __pycache__/*.pyc) |
| licens | egen (proprietär, SIAX Technology AB — LICENSE-fil finns) |
| Gitea | 1.26.4; Actions aktiverade (has_actions: true) |
Historik: Repot har haft två remotes (github.com/sax3l/0pt + git.siax.io/sax3l/0pt)
som divergerade; unifierades 2026-07-28 i Gitea main (merge a714668). Gitea main
är nu det gemensamma trädet. VERIFIERAT via merge-commits + CLAUDE.md-dokumentation.
2. Filträd (VERIFIERAT — git ls-files)
0pt/
├─ app/ # Next.js 16 App Router: 20 sidor (sv UI-copy) + 28 API-routehandlers
│ └─ api/ # health, orders, estimates, 0pt/*, auth/*, payments/*, admin/metrics,
│ # screen, uploads, vehicles, subscriptions, connections, webhooks/stripe, ai/parse
├─ components/ # shadcn/ui + sections + DataArtifact/ProvenanceBadge
├─ lib/ # db, engine, auth, stripe, orders-store, subscriptions-store, data, services
├─ src/ # capability-lagret (TS): clients (cl0ud, n0d, aud0, st0re, st0re-lakehouse),
│ │ # services (dataset, source, source-query, iceberg-write, document-capture/-extraction,
│ │ # external-writeback, source-rate-policy, dataset-iceberg-mapping), adapters, auth, types
├─ services/
│ ├─ api/ # FastAPI-engine: orchestrator/main.py (12 endpoints) + workers (adaptive_router,
│ │ # pipeline, queue, resolve, run) + sources (sources.yaml, connectors, financials)
│ ├─ scrapers/ # Skrapmotor Python: engine.py, engine_v2.py, waf_bypass.py, clickhouse_pipeline.py,
│ │ # s3_sync.py + committed output/*.json + __pycache__/*.pyc
│ └─ infra/ # docker-compose.data-stack.yml (clickhouse, trino, flaresolverr, tor-proxy, superset, postgres)
├─ infra/ # docker-compose.yml (postgres+pgvector, redis, api, worker, nocodb, metabase, caddy) + Caddyfile
├─ sql/ # 001_init.sql, 004_iceberg_write_boundary.sql, 005_..._gap_closure.sql
│ # (002/003 saknas — refereras av 3 filer, se GAP-1)
├─ packages/schemas/ # JSON Schemas 0pt.* (dataset_iceberg_mapping, iceberg_table, lineage_event, signal, source_rate_policy)
├─ tests/ # vitest: auth/ + p0/ + validation/ (17+ testfiler)
├─ docs/ # 01–12 + architecture/ARCHITECTURE.md (S1–S12-luckor) + P0_*-flöden
├─ .gitea/workflows/ # ci.yml, deploy.yml, health-check.yml
├─ .github/workflows/ # ci.yml (arv från GitHub-linjen, kvar efter unifiering)
├─ Dockerfile # Coolify, multi-stage, icke-root (node), HEALTHCHECK /api/health
└─ root: package.json, pnpm-workspace.yaml, pnpm-lock.yaml, siax.config.json, renovate.json,
.npmrc, .env.example, .gitignore, .dockerignore, middleware.ts, next.config.mjs, vitest.config.ts,
tsconfig{,.check}.json, eslint.config.mjs, CLAUDE.md, README.md, SECURITY.md, LICENSE
3. Beroenden
3.1 JS/TS (VERIFIERAT — package.json + pnpm-lock.yaml)
- next@16.0.10, react@19.2.0 (App Router), tailwindcss@4, shadcn/ui (Radix-primitiver), zod@3.25.76, jose (JWT-verifiering), stripe@22, postgres@3, recharts, sonner, vaul m.fl.
- devDeps: vitest@3, typescript@5, eslint@9, prettier@3.
- packageManager:
pnpm@9.15.9(lockfile v9.0). - Namnet i package.json är fortfarande
"my-v0-project"(v0-exportartefakt, GAP-2). - Förbjudet beroende enligt AR-4 (VERIFIERAT):
@vercel/analytics@1.3.1(package.json rad 48) — används iapp/layout.tsxrad 4/64.next/font/google(Inter + JetBrains Mono) —app/layout.tsxrad 3/11-12. Google Fonts hämtas vid byggtid → AR-4-brott.- Azure Document Intelligence (
DOC_INTELLIGENCE_*) — env-guardad adaptersrc/adapters/document-intelligence-adapter.ts(befintlig funktionalitet, AR-1 behåller). - Cloudflare R2 (
app/api/uploads) — env-guardad stub (AR-4: pågående migrering noteras).
3.2 Python engine (VERIFIERAT — services/api/requirements.txt)
fastapi, uvicorn, pydantic, httpx, asyncpg (oanvänd), python-dotenv, pyyaml,
rapidfuzz (enda matching-engine, workers/resolve.py), tenacity.
saknas (plan i docs/07): spaCy/transformers (NER), dedupe-paket (rapidfuzz täcker dedup),
DuckDB/polars, Playwright (kompliant, ej installerat), unstructured, OCR.
3.3 Python scrapers (VERIFIERAT — services/scrapers/requirements.txt)
curl_cffi, cloudscraper, httpx, aiohttp, requests, beautifulsoup4, lxml, boto3.
→ Bypass-stacken. BEHÅLLS INTACT per explicit användarbeslut (AR-1-undantag):
waf_bypass.py (FlareSolverr, Tor, cloudscraper, TLS-fingerprintbyte, proxypool, nodriver,
fake-identity) + services/infra/docker-compose.data-stack.yml (flaresolverr, tor-proxy) +
workers/adaptive_router.py ("all methods, no compliance restrictions").
Dokumenteras i GOLDEN-STANDARD-REPORT som medvetet val (SEC-kontroller ➖/⚠️).
3.4 Beroenden uppåt (VERIFIERAT — src/clients/*)
| OS/klient | Env | Fail-beteende |
|---|---|---|
| Zitadel (IdP) | ZITADEL_ISSUER (default id-customers.siax.io) |
Fail-closed (401/403), assertAuthConfigSafe |
| CL0UD | CL0UD_URL |
Fail-open → allow (lucka S5) |
| AUD0 | AUD0_URL |
No-op (lucka S6) |
| ST0RE | ST0RE_URL |
Mock-artefakt |
| N0D | N0D_URL |
Mock-jobb |
| Stripe | STRIPE_* |
501 |
AR-8 (beroenden bara nedåt, K1 får inte bero på K2–K5): alla OS-beroenden är plattformsinternta (CL0UD/ST0RE/N0D/AUD0/INF0 = K1). VERIFIERAT: inget beroende på kundrepon (contentroom, v0-datahub, prt-* etc.) finns i 0pt.
4. Drift (VERIFIERAT 2026-08-10)
| Fråga | Läge | Bevis |
|---|---|---|
| Live-instans | Vercel (0pt.app) — Coolify avsett, ej provisionerat | README §Deploy + ARCHITECTURE §5 |
| Nod (flotta) | siax.config.json → deploy.node: null — ingen nod tilldelad |
siax.config.json |
| Domän | 0pt.app (live). api.0pt.app/data.0pt.app/dash.0pt.app (Caddy) EJ VERIFIERAT |
README + ARCHITECTURE §5 |
| /api/health | 200, {"ok":true,"db":"not_configured","queue":"not_configured"} |
live-probe 2026-08-10 |
| /api/0pt (anonym) | 200 anonymt — middleware fail-closed verkar INTE köra i prod (lucka S1) | live-probe 2026-08-10 |
| /api/orders (anonym) | 200 anonymt — inget skyddat (lucka S3) | live-probe 2026-08-10 |
| CI (Gitea Actions) | senaste ci.yml på main: success (run 3759, 2026-08-09). COOLIFY_APP_ID är en riktig UUID, guarden passerar, coolify deploy HTTP 200 (run 11695, jobb 26295, head 1ff34410). 48 runs totalt vid ursprungsmätningen |
Gitea API /actions/runs, /actions/variables, /actions/secrets |
| Secrets | Inga hårdkodade hemligheter hittade (grep-skannat). Infisical ej inkopplat — inga referenser i repot | grep + ARCHITECTURE §5 |
| Backup | Ingen (ingen DB i prod att backa upp) | ARCHITECTURE §6 |
5. Förbjudna beroenden — sammanfattning (AR-4)
| Träff | Fil | Åtgärd FAS |
|---|---|---|
@vercel/analytics |
package.json + app/layout.tsx | FAS 6: ta bort (ersättning saknas — ej betald SaaS) |
next/font/google |
app/layout.tsx | FAS 6: ersätt med självhämtade fonter (fontsource) |
| Azure Doc Intelligence | src/adapters/document-intelligence-adapter.ts (env-guardad) | FAS 6: behåll (AR-1) — dokumenteras ⚠️, migration → backlog |
| Cloudflare R2 | app/api/uploads/route.ts (env-guardad stub) | FAS 6: behåll (AR-1 + pågående migrering) — dokumenteras |
6. Kända luckor (arv från docs/architecture/ARCHITECTURE.md §7, verifierade)
S1 (middleware körs ej i prod — live-bekräftat 2026-08-10), S2 (tenant från body, ej session), S3 (icke-/api/0pt-API saknar auth — live-bekräftat), S4 (escrow-release utan identitet), S5 (CL0UD fail-open), S6 (AUD0 no-op), S7 (db-grant påstår kryptering som inte finns), S8 (engine utan auth), S9 (bypass-kod — medvetet behållen per kontoägarens daterade beslut, Simon Axelsson 2026-08-11, se SECURITY.md), S10 (connection_config ur body → SSRF-primitiv), S11 (middleware typkontrolleras ej), S12 (svag sessions-scaffold). + GAP-1 (sql/002–003 saknas), GAP-2 (package.json-namn).
7. Utfallsfil FAS 0
✅ docs/compliance/INVENTORY.md skapad. Redo för FAS 1.