Onboarding — 0pt

BACKLOG P6 (DX-12). For a human or an agent picking this repo up cold.

1. Read, in order

CLAUDE.md — the contract for how this project is built. Non-negotiable constraints (legal sourcing only, Postgres-backbone, provenance-per-field).
AGENTS.md — agent-specific ground rules.
docs/architecture/ARCHITECTURE.md — what the code actually does today (as opposed to docs/01-11, which describe target state — see that doc's own "Läsanvisning").
README.md "Known issues" — the live gaps, dated and evidenced.
prompts/000-INDEX.md — run 001-repo-health.md before touching anything.

2. Get it running

corepack enable
corepack prepare pnpm@9 --activate
pnpm install --frozen-lockfile
pnpm run dev          # http://localhost:3000, in-memory fallback, no DB needed

Or make dev (same thing). Want real Postgres locally instead of the in-memory fallback? make db-up first (BACKLOG DX-02, compose.dev.yaml — unverified in CI, smoke-test before relying on it), then re-run with DATABASE_URL pointed at it (see the Makefile comment).

pnpm run siax:doctor (or make doctor) — runs the self-diagnostic subset of the SIAX Golden Standard v2.0 checks locally (scripts/siax-doctor.mjs, control AGENT-04). Run it after cloning and after any structural change.

3. Before you change anything

AUTH_ENFORCE is fail-closed by default — don't set AUTH_ENFORCE=false outside local dev, and never commit it set that way anywhere.
services/scrapers/*, services/infra/docker-compose.data-stack.yml, and live/src/workers/adaptive_router.py's curl_cffi entries are frozen — see SECURITY.md. Don't touch, remove, or comment on that code without an explicit, current instruction from the account owner.
Run prompts/003-security-review.md's checklist before pushing anything touching auth, payments, or the platform clients.

4. Before you push

pnpm run typecheck   # blocking in CI
pnpm run test        # blocking in CI
pnpm run build       # blocking in CI
pnpm run lint        # advisory, but fix what you can

CI (.gitea/workflows/ci.yml) re-runs all of these plus a blocking Trivy/gitleaks scan (security.yml, BACKLOG P0-16/P0-19) — a red trivy job on an otherwise-unrelated PR usually means a pre-existing dependency finding, not something your change caused; check the run's date against when that job started being blocking before assuming you broke it.

5. Who to ask

CODEOWNERS → @sax3l (Simon Axelsson). Two remotes exist for this repo (git.siax.io/sax3l/0pt and github.com/sax3l/0pt) with independently diverged history — which is authoritative is explicitly Simon's call, not something to assume; see CLAUDE.md.

2.7 KiB Raw Blame History