0pt/CHANGELOG.md

Changelog

BACKLOG P1-3. Format loosely follows Keep a Changelog. No git tags/releases exist yet for this repo — this file starts the practice retroactively from real git log history rather than inventing version numbers that were never cut. Dates are commit dates on main, not calendar "release" dates (there have been none).

Unreleased

• feat(deploy): appen är nu faktiskt byggbar och körbar utanför Vercel. next.config.mjs sätter output: "standalone"; Dockerfilen är omskriven till samma form som sax3l/siax-io (som redan körs självhostat på flottan): fyra steg, node:22-alpine (matchar CI:s nodversion, var 24), libc6-compat, icke-root, HEALTHCHECK mot /api/health, npm/npx borttaget ur runtime-imagen. Uppmätt: image 1,33 GB -> 423 MB. --ignore-workspace borttaget (dess motivering var inaktuell sedan P1-21) så containerinstallationen är samma kommando som CI kör; --prod=false tillagt eftersom Coolify sätter NODE_ENV=production vid byggtid och pnpm då hoppar över devDependencies.

• fix(images): images.unoptimized: true borttaget — det var v0-generatorns standardvärde, inte ett val (next.config.mjs var orörd sedan initial commit). Självhostad bildoptimering kräver att sharp faktiskt finns i runtime-imagen: next build spårar den inte in i .next/standalone, och outputFileTracingIncludes får Turbopack att panika på pnpms symlänkar. Sharp levereras därför i ett eget npm-steg i Dockerfile, pinnat till versionen i pnpm-lock.yaml. Verifierat i containern: /_next/image svarar 200 med image/avif (1,46 MB PNG -> 6,7 kB).

• fix(security): response security headers are set by the app itself, in next.config.mjs headers() — CSP (incl. frame-ancestors 'none', base-uri 'self', object-src 'none', form-action 'self'), HSTS, X-Frame-Options DENY, X-Content-Type-Options, Referrer-Policy, Permissions-Policy — plus poweredByHeader: false. Regression-gated by tests/security/security-headers.test.ts (blocking, runs in pnpm run test) and re-checkable against a live origin with node scripts/siax-doctor.mjs --live. (BACKLOG P0-13, P1-15)

  Correcting this file: from 2026-08 until 2026-09-07 this bullet also claimed the headers themselves, while main contained none — a repo-wide grep for content-security-policy|strict-transport-security| x-frame-options matched only CHANGELOG.md. The only thing setting HSTS on 0pt.app was Vercel's platform default (still observable on the 402 responses recorded in evidence/operational-state.json), which is not this repo's and does not survive the move to Coolify/Traefik. The claim is true as of this entry; the four claims it was bundled with are not, and are tracked in the section below.

• fix(repo-honesty): scripts/siax-doctor.mjs validated that siax.repo.json fields were PRESENT, never what they said — measured: operationalState: "running" (false at the time; every declared host answered 402/404) and "down" (true) both produced 40/40 and byte-identical output. It now validates values (enums, hostname form), cross-file consistency (declared prod hostnames must appear in this repo's own deploy/contract config, and vice versa), and requires operationalState to be backed by a dated probe record in evidence/operational-state.json that agrees with it. Offline and deterministic by default; --live (opt-in) probes the real hosts. Gated by tests/repo/siax-doctor.test.ts, which also asserts the negative cases against fixture trees. (BACKLOG P1-19, control AGENT-04, GOV-06)

• fix(health): /api/health reports real per-dependency status instead of a hardcoded ok: true; new /api/ready readiness endpoint. (BACKLOG P0-3)

• docs/chore: repo-hygiene pass — schema-valid siax.repo.json/siax.config.json (standard v2.0), ADRs, this CHANGELOG, siax:doctor script, devcontainer, docs/architecture/ARCHITECTURE.md §5 "Ytor och paritet", CODEOWNERS, stale-link cleanup. (BACKLOG P1-1, P1-2, P1-3, P1-19, P1-20, P1-21, P2-5, P3-5)

Claimed here before 2026-09-07 but NOT implemented — status 2026-09-15

These were asserted by the earlier fix(security) bullet and were not true on main at that time. Current state (measured against main, 2026-09-15):

• CI security gates now ENFORCE: security.yml and nightly.yml run Trivy with --exit-code 1 (landed via ci/make-required-security-gate-real, 2026-09-08). (BACKLOG P0-16 — CLOSED)
• gitleaks is still not run anywhere in this repo. (BACKLOG P0-19 — OPEN)
• Actions are still NOT pinned to commit SHAs (actions/checkout@v4 etc.). (BACKLOG P1-14 — OPEN)
• No SBOM and no license inventory are produced or uploaded as CI artifacts. (OPEN; the fix/wire-signed-digest-to-deploy branch carries a prepared release chain that needs its cosign/registry secrets before it can land.)

2026-08-11 — Evasion-stack decision provenance

• Attributed and dated the account-owner's keep-decision on services/scrapers/* across SECURITY.md, CONTRIBUTING.md, prompts/002-compliance-audit.md, renovate.json, .gitea/workflows/security.yml, docs/slo.md.

2026-08-09/10 — Golden Standard compliance pass (FAS 0–10)

• docs/compliance/{INVENTORY,RELATIONS,OSS-INVENTORY,GOLDEN-STANDARD-REPORT,BACKLOG,SLUTRAPPORT}.md written; siax.repo.json classification recorded.
• fix(security): GET /api/orders and GET /api/admin/metrics now require auth (were live 200 anonymous — the routes sit outside middleware.ts's /api/0pt/:path* matcher).
• fix(deploy): siax.config.json deploy.target flipped from vercel to coolify (config-only; the live instance is still on Vercel until a Coolify app is provisioned and DNS is cut over).
• feat(contract): OpenAPI 3.1 SSOT added (contracts/openapi.yaml); @vercel/analytics and next/font/google removed in favor of self-hosted @fontsource-variable/* (AR-4).
• ci(workflows): CD/security/nightly split under .gitea/workflows/.
• README/SECURITY/CONTRIBUTING/AGENTS + runbooks (deploy, incident, backup-restore, oncall) + SLO doc added.

2026-08 — Auth + capability hardening ("Wave 2/3")

• fix(auth): AUTH_ENFORCE default flipped to fail-closed on /api/0pt/*.
• Zitadel Bearer-token verification wired into middleware.ts (src/auth/zitadel.ts, src/auth/context.ts).
• P0 capability layer built out: 0pt.query_source, document capture/extraction, Iceberg write-boundary, external writeback, dataset quality flow docs.
• CI quality gate added (typecheck/lint/test), .env.example committed (previously blocked by a blanket .gitignore .env* rule).

2026-07-13 — Scraper stack (kept, see BACKLOG P3-3 / SECURITY.md)

• services/scrapers/* (WAF-bypass, proxy rotation, ClickHouse pipeline) was added on the Gitea line of history. This is the subject of the dated, attributed account-owner decision referenced throughout this repo's compliance docs — not reopened or altered by this changelog entry.

Earlier

• Initial Next.js scaffold, order/catalog/portal UI, FastAPI engine scaffold, i18n (EN/SV) and accessibility passes, lakehouse write-path ownership ADR (ADR-0030, in the n0d repo).