Skip to content

Phase 1: monorepo, KoSIT verifier, Token Factory client, CI - #1

Merged
OnePieceMonkey merged 7 commits into
mainfrom
phase-1-foundation
Oct 2, 2026
Merged

OnePieceMonkey merged 7 commits into
mainfrom
phase-1-foundation

Conversation

@OnePieceMonkey

Copy link
Copy Markdown
Owner

What

  • pnpm monorepo with strict TypeScript (apps/web placeholder, packages/core, eval)
  • Verifier service: KoSIT validator 1.6.3 + XRechnung 3.0.2 configuration 2026-08-31, pinned with SHA-256, built in Docker, secret-protected
  • pnpm verifier:check: 41/41 CII test suite instances valid, 4/4 mutations rejected with the expected rule ID
  • Central Token Factory client with cost ledger and daily budget guard; pnpm smoke:llm runs one extraction (Nemotron Super) and one repair (Nemotron Ultra) call
  • gitleaks pre-commit hook and CI (gitleaks, typecheck + tests, verifier check)
  • Planning: ZUGFeRD moved to phase 4 (VER-06 + CORE-05, after the kill gate); extraction uses the PDF text layer because Token Factory serves Nemotron only as text models

Requirements

OPS-01, OPS-02, OPS-03, OPS-04 (partial), VER-01, VER-02, VER-03, VER-04, VER-05

🤖 Generated with Claude Code

OnePieceMonkey and others added 7 commits October 2, 2026 20:30
Workspaces apps/web, packages/core, eval. apps/web is a placeholder until phase 4.

Refs: OPS-01

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Java 21 JDK HttpServer around KoSIT validator 1.6.3 with the XRechnung 3.0.2 configuration 2026-08-31, both pinned with SHA-256 in the Dockerfile. POST /v1/validate/xrechnung returns valid (acceptRecommendation only), findings with rule ID, severity, message and XPath location, the VARL report, its SHA-256 hash and the pinned versions. Every /v1 endpoint requires X-Verifier-Secret; the service refuses to start without a secret. No KoSIT daemon GUI.

Refs: VER-01, VER-02, VER-03, VER-05

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
pnpm verifier:check validates all 41 CII instances of the KoSIT test suite and four mutations that must be rejected with the expected rule ID and a location.

Refs: VER-01

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Single entry point for model calls. Counts tokens, prices them from pinned list prices with decimal.js and blocks calls once DAILY_BUDGET_USD is spent. Supports JSON-schema constrained decoding and disables Nemotron thinking by default. pnpm smoke:llm runs one extraction call (Super) and one repair call (Ultra).

Refs: OPS-03, OPS-04

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CI runs gitleaks, typecheck + tests, and the verifier acceptance check against a freshly built verifier image.

Refs: OPS-01, OPS-02

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Token Factory serves Nemotron only as text models; extraction uses the PDF text layer for now. ZUGFeRD is anchored in phase 4 as VER-06 + CORE-05 after the kill gate.

Refs: VER-04, EXT-02, CORE-05

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
gitleaks-action needs pull-requests: read to list PR commits. docker compose --wait returned before the verifier finished loading the KoSIT configuration.

Refs: OPS-02, VER-01

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@OnePieceMonkey
OnePieceMonkey merged commit a25e848 into main Oct 2, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant