|
23628
|
5
|
5
|
5
|
74
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"6b3be1daf {"Commits":[{"Sha1":"6b3be1dafc25b3d82703595f7542769eae6b7744","Message":"chore(reports): 刷新治理证据,绑定提交 b0d8e83\n\n三级门禁在 b0d8e83 上重跑后的报告：\n- pnpm check exit 0（16 项静态门禁）\n- check:runtime passed：380 tests / 0 failures\n- check:ui passed：14 用例 / 0 失败\n\n诚实标注：provenance 的 worktreeDirty 仍为 true。原因不是本提交遗漏了文件，\n而是**同一工作区存在并发会话**，其在制品（CLAUDE.md、两端 approval-tickets.service、\nweb/src/lib/types.ts、check-order-concurrency-guard.mjs、check-owner-matrix.mjs）\n在重跑期间处于未提交状态，已刻意不纳入本提交。\n\n因此本组报告只能宣称「本地工作区（含上述并发在制品）在 2026-08-17 通过三级门禁」，\n不得外推为 clean checkout 通过、远端已发布或 CI 已拦截。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-17T16:16:17-07:00"},{"Sha1":"b0d8e837396f6e0f15c0ceeb46b236f14f40f5c9","Message":"feat: 合并提交长期未落库的批次——Finance Phase A、安全边界、outbox 租约与 crew 雇佣纵切\n\n本次是一次「补提交」：工作区此前累积了大量从未进入任何提交的成果，\n其中包含三个只存在于本地的门禁脚本（partner-truth / security-boundary /\noutbox-lease），clean checkout 根本跑不出当前的治理结论。一并落库。\n\n主要内容\n- Finance 对账 Phase A：12 个 model、双后端服务与 worker、/finance 工作面与 e2e\n- 应用安全边界（C21）：显式 demo/signed 分界、principal 取 tenant/actor、\n 治理动作 RBAC、支付 webhook raw-body HMAC\n- Outbox 多实例租约（C22）：CTE + FOR UPDATE SKIP LOCKED 原子领取、行锁 fencing、\n 租约过期崩溃恢复\n- crew 雇佣纵切（L7，新）：crewEngagementMachine 落 contracts 单源，双后端对等写链\n （updateMany + stage/version 双前置条件，0 行即 409），两端迁移逐字一致，\n /team 的 employment 由写死的 UNKNOWN 变为 crew_engagements 真实阶段\n- 新门禁：check:partner-truth / check:security-boundary / check:outbox-lease /\n check:owner-matrix，并把 crew 写链接入 check:concurrency-guard（20→22 条）\n- a11y 与 Tailwind token 修复及其静默失效门禁\n\ncrew 纵切的两个设计要点\n- 无行即未雇佣，不设 NOT_HIRED 状态（与 TrustState 缺行=UNCONFIGURED 同构）\n- 实习期强制人审、转正后才准进入信任爬坡放行：商业分层直接就是授权分层，\n 实习期本质上是在攒 approval.decided 样本，转正把信任兑现为自治\n- PLANNED 的 SKU 不可雇佣，避免造出「实习中却没有任何工作面」的假雇佣事实\n\n验收（本地 dirty 工作区，2026-08-17；不得外推为远端已发布或生产就绪）\n- pnpm check exit 0（16 项静态门禁；新增并发写链守卫已做负向测试，确认会红）\n- check:runtime passed：380 tests / 0 failures（地板 355→380）\n- check:ui passed：14 用例 / 0 失败（地板 13→14）\n\n按 CLAUDE.md 提交纪律，baseline.json 的地板与支撑它的测试文件在同一提交内。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-17T16:09:30-07:00"},{"Sha1":"44fed27603c1bd264192d1ce05016c1cd5b1c8ea","Message":"fix(a11y): 修复侧栏隐形导航 + 颜色 token 全面达标 AA,并新增 Tailwind 静默失效门禁\n\n根因:Tailwind 颜色类透明度修饰符只有落在预设刻度(5 的倍数)或方括号任意值\n才生成 CSS。侧栏写 text-white/68 属死类,文字回退继承 --hm-ink 压在深蓝\n--hm-nav 上,实测对比度 1.02——导航区在浏览器里等于隐形,而 TypeScript\n与 ESLint 均不报,只有量计算样式才暴露。\n\n- 侧栏 6 处非法透明度(/38 /58 /68 /78)改为合法刻度,导航项对比度 1.02 → 5.18~17.64,6/6 达标\n- 全站实测 187 个文本节点原有 45 处不达 AA,根因集中在 token 自身取值偏浅;\n 按 token 层修复(text-tertiary/warning/success/danger/ai),每个新值在白底与\n 各自浅色底双双达标才采用,注释写进 globals.css。结果 45 → 0\n- 新增 check:tailwind-tokens 绊网并接入 pnpm check 与棘轮(地板 0);\n 负向测试已验证:注入 text-white/68 即 exit 1,恢复即 exit 0\n- 团队总览按用户拍板退回外壳设计语言(--hm-* / 12px 圆角 / 无衬线),\n 补回此前被重构弄丢的「昨天那一页」与雇佣价目,触控目标统一 44px\n- 花名册单源 contracts CREW_ROSTER + deriveCrewStatus(计费跳档将复用同一口径)\n- e2e 重写为一条覆盖全模块的用例(旧两条因 testid 重命名已失效)\n- CLAUDE.md 基线表 + 治理经验库 ⑬ 回灌\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-14T19:18:43-07:00"}],"HeadCommit":{"Sha1":"6b3be1dafc25b3d82703595f7542769eae6b7744","Message":"chore(reports): 刷新治理证据,绑定提交 b0d8e83\n\n三级门禁在 b0d8e83 上重跑后的报告：\n- pnpm check exit 0（16 项静态门禁）\n- check:runtime passed：380 tests / 0 failures\n- check:ui passed：14 用例 / 0 失败\n\n诚实标注：provenance 的 worktreeDirty 仍为 true。原因不是本提交遗漏了文件，\n而是**同一工作区存在并发会话**，其在制品（CLAUDE.md、两端 approval-tickets.service、\nweb/src/lib/types.ts、check-order-concurrency-guard.mjs、check-owner-matrix.mjs）\n在重跑期间处于未提交状态，已刻意不纳入本提交。\n\n因此本组报告只能宣称「本地工作区（含上述并发在制品）在 2026-08-17 通过三级门禁」，\n不得外推为 clean checkout 通过、远端已发布或 CI 已拦截。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-17T16:16:17-07:00"},"CompareURL":"luoanwu/haimate/compare/66f0513cfb65a0eb27fe77ff8b5bd158c0901623...6b3be1dafc25b3d82703595f7542769eae6b7744","Len":3}...
|
1787008617
|
Edit
Delete
|
|
23627
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"125c54d32 {"Commits":[{"Sha1":"125c54d328d3da221b5d91c0a2dd0475712c6e96","Message":"Merge pull request #12 from laoluojuhai/fix/vm-dockerfile-build-path\n\nfix(vm): 打通容器构建路径——保住 slim 运行镜像，不靠放宽红线换构建成功","AuthorEmail":"158980461+laoluojuhai@users.noreply.github.com","AuthorName":"laoluojuhai","CommitterEmail":"noreply@github.com","CommitterName":"GitHub","Timestamp":"2026-08-17T07:09:44-07:00"},{"Sha1":"6f13a78de9c02ae6a36fcebfb4bde63fbd092158","Message":"fix(vm): 打通容器构建路径——保住 slim 运行镜像，不靠放宽红线换构建成功\n\n`deploy/vm/Dockerfile` 的构建路径从未真正跑通过（并发治理会话只用 pnpm/turbo 跑门禁，\n从不 docker build）。而 check:vm-deploy 一直是绿的——它查 Dockerfile 的**结构**\n（每个 stage 用哪个 FROM、有没有 fat runtime），不查它**能不能构建出来**。\n于是棘轮报告写着「镜像瘦身非 root、可回滚、备份可恢复」✅，而那个镜像根本产不出来。\n\n5 处构建 bug：\n1. contracts 的 `prepare`(tsc) 在只有 manifest 的依赖层里跑，找不到 tsconfig/src → TS5058。\n 先 COPY contracts 的 tsconfig + src 给它当输入。\n2. 新 workspace 包 @repo/password-auth（两后端 runtime 依赖）未进 manifest COPY、\n 也没被显式 build。\n3. `pnpm deploy --prod --legacy`：pnpm 9.15.9 不认 `--legacy`（Unknown option）。\n 旧注释称「未开启 inject-workspace-packages 时需要 --legacy」——实测在本仓版本上\n 不成立，去掉即可正常打平 workspace 包（sharp 这类 lockfile 原生依赖也照常带出）。\n4. `pnpm deploy` 只按 lockfile 物化依赖，而 .prisma/client（含平台相关 query engine）\n 是 `prisma generate` **生成**的、不在任何 lockfile 里，永远不会被带出去 →\n 新增一步从 build 树复制。路径由 @prisma/client 的解析结果反推，不硬编码 pnpm store\n 的哈希目录名；且必须从 app 目录解析（workspace 根 node_modules 里没有它）。\n5. web stage `COPY apps/web/public` 失败——git 未跟踪任何 public 资产。\n ⚠️ 本机可能有个空的 public/（git 不跟踪空目录），docker build 读本地上下文因而能过，\n CI 与全新 clone 上必挂，注释已写明这个陷阱。\n\n**刻意不采用**此前 `dockerfile-vm-deploy-fixes-ec411c0.patch` 的策略（放弃 slim、\n运行镜像改 FROM build）：那会撞 4 条门禁红线（runtime-from-base-* / no-fat-runtime-*），\n而实测 slim 路径的两个阻塞点（3、4）都可解，「镜像瘦身作为后续项不阻塞」的前提不成立。\n体积实测：api-nestjs 741MB / api-fastify 695MB / web 546MB，\n对照 fat 方案 8.46GB、2026-08-06 实际部署的 2.69GB。非 root 由镜像层 USER node 保证，\n而非仅靠 compose 的 user: 覆盖。\n\n顺带两处断链（均为 MinIO 进 compose 后没人跟上）：\n- .env.example 与 vm:init 都不认识 S3_*，而它们是 compose 的必填变量 → 新机器\n `vm:init` 后 `vm:up` 必然卡在变量插值。已补占位符 + 随机生成 + 存量 .env 自愈。\n- .dockerignore 只写 `**/.next`，匹配不到本仓工具链自建的 distDir\n （.next-ui-* / .next-dev-* / .next-manual-*），也没排除 sites/（G26 那套独立\n Cloudflare 系统，其 .sites-runtime 本机 1.0GB）→ COPY . . 层 3.79GB → 270MB。\n\n证据（作用域＝本地工作区）：\n- docker build 四个 target 全部 EXIT=0（api-nestjs / api-fastify / web / migrate）\n- 镜像内实测 @prisma/client 与原生模块 sharp 均可加载、dist 入口就位、uid=1000 非 root\n- Dockerfile 里那条「Prisma Client 缺失即构建失败」的断言**首次真正执行并通过**\n- pnpm vm:config EXIT=0（7 个服务解析通过）\n- pnpm check 22 项全绿 exit=0\n\n未验证：未跑 vm:up / vm:smoke（整栈起停与真实写链冒烟），故不得宣称「可部署」。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-17T06:57:55-07:00"}],"HeadCommit":{"Sha1":"125c54d328d3da221b5d91c0a2dd0475712c6e96","Message":"Merge pull request #12 from laoluojuhai/fix/vm-dockerfile-build-path\n\nfix(vm): 打通容器构建路径——保住 slim 运行镜像，不靠放宽红线换构建成功","AuthorEmail":"158980461+laoluojuhai@users.noreply.github.com","AuthorName":"laoluojuhai","CommitterEmail":"noreply@github.com","CommitterName":"GitHub","Timestamp":"2026-08-17T07:09:44-07:00"},"CompareURL":"luoanwu/juhai-quotation-system/compare/8ae98649e077fa188f8e9c1b0a11b78a2377c836...125c54d328d3da221b5d91c0a2dd0475712c6e96","Len":2}...
|
1786975808
|
Edit
Delete
|
|
23626
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"8ae98649e {"Commits":[{"Sha1":"8ae98649e077fa188f8e9c1b0a11b78a2377c836","Message":"Merge pull request #11 from laoluojuhai/feat/product-catalog-search-and-image-upload\n\nfeat(products): 商品库服务端搜索筛选 + 图片上传至对象存储","AuthorEmail":"158980461+laoluojuhai@users.noreply.github.com","AuthorName":"laoluojuhai","CommitterEmail":"noreply@github.com","CommitterName":"GitHub","Timestamp":"2026-08-17T04:16:44-07:00"},{"Sha1":"6a67a7abf58201b2b407aab3e500b463d3f08bc7","Message":"Merge branch 'feat/product-catalog-search-and-image-upload' of https://github.com/laoluojuhai/juhai-quotation-system into feat/product-catalog-search-and-image-upload\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-17T04:04:06-07:00"},{"Sha1":"874115874d1ce6a322367e0553a620a531ebdaf9","Message":"fix(e2e): 修两条潜伏五天的失效断言——\u0026\u0026 串行链把 UI 验收挡在门外\n\n上一条提交让 static governance 转绿后，CI 的 Runtime and UI acceptance 才**首次真正\n跑起来**（自 2026-08-06 起每轮都是 SKIPPED），当场暴露两条 E2E 失效断言。二者均由\n35ebc86（2026-08-12）改文案引入而断言没跟上，与本轮重构无关：\n\n① 侧栏入口叫「报价审核」，子页标题已改为「待我审核」——入口名与标题是两个口径，\n 不能因为同一个入口就复用同一个词。\n② 版本徽标由「版本 1」改为紧凑的「v1」（与版本中心的「V1」看齐）。\n 断言收紧为 /·\\s*v1\\s*·/：裸 `v1` 会被报价号或客户名里任何含 v1 的片段撞上，\n 会让断言以错误理由变绿，那恰恰是它该防的漂移。\n\nmodule-integration 的浏览器证据标记同步跟到**标题**而非入口名——写成入口名会被\nopenWorkspaceEntry(page, \"报价审核\") 白白喂饱，标记就不再证明任何事（负向实测：\n把 E2E 里该断言改掉即 exit=1 并命中 browser-name: \"待我审核\"）。\n\n顺带删掉上一条提交遗留的死代码：权限判据已随创建卡下沉进 QuotationCreateCard，\nQuotationWorkbench 里的 userCan 不再有消费者，留着会让下一个人以为还有权限逻辑要接。\n\n三级门禁证据（作用域＝本地工作区）：\n- 静态 pnpm check：22 项全绿 exit=0，16 组负向自检有牙\n- check:runtime：548/548（地板 503；contracts 436 + NestJS 56 + Fastify 56）\n- check:ui：12/12 全绿\n\n教训已回灌 CLAUDE.md：串行 \u0026\u0026 门禁链报出的违规数是**下界不是总数**，\n本轮 CI 报「共 1 处违规」，实际是 4 处静态 + 2 处 E2E。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-17T04:03:39-07:00"},{"Sha1":"c7d8d5944215315512254bb9a8f6cc2bd937c88f","Message":"Merge branch 'main' into feat/product-catalog-search-and-image-upload","AuthorEmail":"158980461+laoluojuhai@users.noreply.github.com","AuthorName":"laoluojuhai","CommitterEmail":"noreply@github.com","CommitterName":"GitHub","Timestamp":"2026-08-17T03:48:25-07:00"},{"Sha1":"3afb568a1d13a2ceeaf49a2a9bf1d8634f422c23","Message":"fix(gate): 版本中心断言重锚为结构式——距离窗口误杀且漏杀，顺带逼出报价域拆分\n\nPR #11 的 CI 红在 quotation-version-detail-visible。查证为**门禁误杀**：版本中心的\n快照详情一直正常渲染（浏览器实测展开 V1 可见「经济方案 ¥910,000.00 · 1 项明细」），\n只是行内补了 diff 段落与三段设计裁决注释后，两个锚点间距涨到 1309 字符、超过\n{0,500} 距离窗口（after-sales-order-options-hook 同型，本仓第二次踩）。\n\n断言重锚为否定环视 (?:(?!\u003c\\/details\u003e)[\\s\\S])*，语义由「两锚点挨得近」改为\n「快照摘要在版本行元素内部」。差分真值表显示旧写法 4 例错 2 例、两个方向都错：\n不仅误杀，还漏杀「快照挪到行外但离得近」——重锚顺手补上那个洞，并固化为\ncontract-integration.test.mjs 第 24b 条负向用例（实跑 exit=1 且命中预期断言 id）。\n\ncomponent-size 同轮逼出真拆分（门禁明说「先拆分而不是上调登记值」）：\n- QuotationWorkbench 661→169：创建卡连同表单状态提为 QuotationCreateCard、\n 单档编辑器提为 QuotationOptionEditor、版本中心提为 QuotationVersionCenter\n- MobileOverview 473→413：报价经营四指标卡提为 OverviewQuoteMetrics\n全部抽为**同文件兄弟组件**——搬到独立文件会让按路径锚定的门禁锚点落空。\nQuotationCreateCard 刻意始终挂载、在 hooks 之后才 return null，保证候选查询的\n发起时机与重构前逐字一致（只搬行不改行为）。登记值同步下调/毕业锁住进步。\n\n⚠️ 抽 OverviewQuoteMetrics 时一度把三元中段当 JSX 搬走并用 \u003c\u003e 包裹，`) : (`\n降格为文本节点原样上屏，且两个分支同时渲染——给有权限的管理员显示「未向当前\n角色开放」。tsc 与 22 项静态门禁全绿，只有浏览器截图抓得到。已修并留档。\n\n证据（作用域＝本地工作区）：pnpm check 22 项全绿 exit=0、16 组负向自检有牙、\n浏览器实测总览/新建报价/版本中心三处渲染正常。未重跑 check:runtime / check:ui\n（两后端与 contracts 一行未动，那两级证据仍绑定上一轮 commit）。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-17T03:47:39-07:00"}],"HeadCommit":{"Sha1":"8ae98649e077fa188f8e9c1b0a11b78a2377c836","Message":"Merge pull request #11 from laoluojuhai/feat/product-catalog-search-and-image-upload\n\nfeat(products): 商品库服务端搜索筛选 + 图片上传至对象存储","AuthorEmail":"158980461+laoluojuhai@users.noreply.github.com","AuthorName":"laoluojuhai","CommitterEmail":"noreply@github.com","CommitterName":"GitHub","Timestamp":"2026-08-17T04:16:44-07:00"},"CompareURL":"luoanwu/juhai-quotation-system/compare/7619cf79681794bf28a8dceeb606c9dcfec21a5c...8ae98649e077fa188f8e9c1b0a11b78a2377c836","Len":41}...
|
1786965499
|
Edit
Delete
|
|
23625
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/feat/product-catalog-search-and-image-u refs/heads/feat/product-catalog-search-and-image-upload...
|
0
|
{"Commits":[{"Sha1":"6a67a7abf {"Commits":[{"Sha1":"6a67a7abf58201b2b407aab3e500b463d3f08bc7","Message":"Merge branch 'feat/product-catalog-search-and-image-upload' of https://github.com/laoluojuhai/juhai-quotation-system into feat/product-catalog-search-and-image-upload\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-17T04:04:06-07:00"},{"Sha1":"c7d8d5944215315512254bb9a8f6cc2bd937c88f","Message":"Merge branch 'main' into feat/product-catalog-search-and-image-upload","AuthorEmail":"158980461+laoluojuhai@users.noreply.github.com","AuthorName":"laoluojuhai","CommitterEmail":"noreply@github.com","CommitterName":"GitHub","Timestamp":"2026-08-17T03:48:25-07:00"},{"Sha1":"e3fc771d3e1769a970dd0638d0ce694fae74a023","Message":"Merge pull request #8 from laoluojuhai/feat/g8-verified-auth\n\nfeat(g8): 已验签身份落地 + 业务闭环五切片 + 工作区卫生门禁","AuthorEmail":"158980461+laoluojuhai@users.noreply.github.com","AuthorName":"laoluojuhai","CommitterEmail":"noreply@github.com","CommitterName":"GitHub","Timestamp":"2026-08-02T19:06:51-07:00"}],"HeadCommit":{"Sha1":"6a67a7abf58201b2b407aab3e500b463d3f08bc7","Message":"Merge branch 'feat/product-catalog-search-and-image-upload' of https://github.com/laoluojuhai/juhai-quotation-system into feat/product-catalog-search-and-image-upload\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-17T04:04:06-07:00"},"CompareURL":"luoanwu/juhai-quotation-system/compare/874115874d1ce6a322367e0553a620a531ebdaf9...6a67a7abf58201b2b407aab3e500b463d3f08bc7","Len":3}...
|
1786964711
|
Edit
Delete
|
|
23624
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/feat/product-catalog-search-and-image-u refs/heads/feat/product-catalog-search-and-image-upload...
|
0
|
{"Commits":[{"Sha1":"874115874 {"Commits":[{"Sha1":"874115874d1ce6a322367e0553a620a531ebdaf9","Message":"fix(e2e): 修两条潜伏五天的失效断言——\u0026\u0026 串行链把 UI 验收挡在门外\n\n上一条提交让 static governance 转绿后，CI 的 Runtime and UI acceptance 才**首次真正\n跑起来**（自 2026-08-06 起每轮都是 SKIPPED），当场暴露两条 E2E 失效断言。二者均由\n35ebc86（2026-08-12）改文案引入而断言没跟上，与本轮重构无关：\n\n① 侧栏入口叫「报价审核」，子页标题已改为「待我审核」——入口名与标题是两个口径，\n 不能因为同一个入口就复用同一个词。\n② 版本徽标由「版本 1」改为紧凑的「v1」（与版本中心的「V1」看齐）。\n 断言收紧为 /·\\s*v1\\s*·/：裸 `v1` 会被报价号或客户名里任何含 v1 的片段撞上，\n 会让断言以错误理由变绿，那恰恰是它该防的漂移。\n\nmodule-integration 的浏览器证据标记同步跟到**标题**而非入口名——写成入口名会被\nopenWorkspaceEntry(page, \"报价审核\") 白白喂饱，标记就不再证明任何事（负向实测：\n把 E2E 里该断言改掉即 exit=1 并命中 browser-name: \"待我审核\"）。\n\n顺带删掉上一条提交遗留的死代码：权限判据已随创建卡下沉进 QuotationCreateCard，\nQuotationWorkbench 里的 userCan 不再有消费者，留着会让下一个人以为还有权限逻辑要接。\n\n三级门禁证据（作用域＝本地工作区）：\n- 静态 pnpm check：22 项全绿 exit=0，16 组负向自检有牙\n- check:runtime：548/548（地板 503；contracts 436 + NestJS 56 + Fastify 56）\n- check:ui：12/12 全绿\n\n教训已回灌 CLAUDE.md：串行 \u0026\u0026 门禁链报出的违规数是**下界不是总数**，\n本轮 CI 报「共 1 处违规」，实际是 4 处静态 + 2 处 E2E。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-17T04:03:39-07:00"}],"HeadCommit":{"Sha1":"874115874d1ce6a322367e0553a620a531ebdaf9","Message":"fix(e2e): 修两条潜伏五天的失效断言——\u0026\u0026 串行链把 UI 验收挡在门外\n\n上一条提交让 static governance 转绿后，CI 的 Runtime and UI acceptance 才**首次真正\n跑起来**（自 2026-08-06 起每轮都是 SKIPPED），当场暴露两条 E2E 失效断言。二者均由\n35ebc86（2026-08-12）改文案引入而断言没跟上，与本轮重构无关：\n\n① 侧栏入口叫「报价审核」，子页标题已改为「待我审核」——入口名与标题是两个口径，\n 不能因为同一个入口就复用同一个词。\n② 版本徽标由「版本 1」改为紧凑的「v1」（与版本中心的「V1」看齐）。\n 断言收紧为 /·\\s*v1\\s*·/：裸 `v1` 会被报价号或客户名里任何含 v1 的片段撞上，\n 会让断言以错误理由变绿，那恰恰是它该防的漂移。\n\nmodule-integration 的浏览器证据标记同步跟到**标题**而非入口名——写成入口名会被\nopenWorkspaceEntry(page, \"报价审核\") 白白喂饱，标记就不再证明任何事（负向实测：\n把 E2E 里该断言改掉即 exit=1 并命中 browser-name: \"待我审核\"）。\n\n顺带删掉上一条提交遗留的死代码：权限判据已随创建卡下沉进 QuotationCreateCard，\nQuotationWorkbench 里的 userCan 不再有消费者，留着会让下一个人以为还有权限逻辑要接。\n\n三级门禁证据（作用域＝本地工作区）：\n- 静态 pnpm check：22 项全绿 exit=0，16 组负向自检有牙\n- check:runtime：548/548（地板 503；contracts 436 + NestJS 56 + Fastify 56）\n- check:ui：12/12 全绿\n\n教训已回灌 CLAUDE.md：串行 \u0026\u0026 门禁链报出的违规数是**下界不是总数**，\n本轮 CI 报「共 1 处违规」，实际是 4 处静态 + 2 处 E2E。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-17T04:03:39-07:00"},"CompareURL":"luoanwu/juhai-quotation-system/compare/3afb568a1d13a2ceeaf49a2a9bf1d8634f422c23...874115874d1ce6a322367e0553a620a531ebdaf9","Len":1}...
|
1786964630
|
Edit
Delete
|
|
23623
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/feat/product-catalog-search-and-image-u refs/heads/feat/product-catalog-search-and-image-upload...
|
0
|
{"Commits":[{"Sha1":"3afb568a1 {"Commits":[{"Sha1":"3afb568a1d13a2ceeaf49a2a9bf1d8634f422c23","Message":"fix(gate): 版本中心断言重锚为结构式——距离窗口误杀且漏杀，顺带逼出报价域拆分\n\nPR #11 的 CI 红在 quotation-version-detail-visible。查证为**门禁误杀**：版本中心的\n快照详情一直正常渲染（浏览器实测展开 V1 可见「经济方案 ¥910,000.00 · 1 项明细」），\n只是行内补了 diff 段落与三段设计裁决注释后，两个锚点间距涨到 1309 字符、超过\n{0,500} 距离窗口（after-sales-order-options-hook 同型，本仓第二次踩）。\n\n断言重锚为否定环视 (?:(?!\u003c\\/details\u003e)[\\s\\S])*，语义由「两锚点挨得近」改为\n「快照摘要在版本行元素内部」。差分真值表显示旧写法 4 例错 2 例、两个方向都错：\n不仅误杀，还漏杀「快照挪到行外但离得近」——重锚顺手补上那个洞，并固化为\ncontract-integration.test.mjs 第 24b 条负向用例（实跑 exit=1 且命中预期断言 id）。\n\ncomponent-size 同轮逼出真拆分（门禁明说「先拆分而不是上调登记值」）：\n- QuotationWorkbench 661→169：创建卡连同表单状态提为 QuotationCreateCard、\n 单档编辑器提为 QuotationOptionEditor、版本中心提为 QuotationVersionCenter\n- MobileOverview 473→413：报价经营四指标卡提为 OverviewQuoteMetrics\n全部抽为**同文件兄弟组件**——搬到独立文件会让按路径锚定的门禁锚点落空。\nQuotationCreateCard 刻意始终挂载、在 hooks 之后才 return null，保证候选查询的\n发起时机与重构前逐字一致（只搬行不改行为）。登记值同步下调/毕业锁住进步。\n\n⚠️ 抽 OverviewQuoteMetrics 时一度把三元中段当 JSX 搬走并用 \u003c\u003e 包裹，`) : (`\n降格为文本节点原样上屏，且两个分支同时渲染——给有权限的管理员显示「未向当前\n角色开放」。tsc 与 22 项静态门禁全绿，只有浏览器截图抓得到。已修并留档。\n\n证据（作用域＝本地工作区）：pnpm check 22 项全绿 exit=0、16 组负向自检有牙、\n浏览器实测总览/新建报价/版本中心三处渲染正常。未重跑 check:runtime / check:ui\n（两后端与 contracts 一行未动，那两级证据仍绑定上一轮 commit）。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-17T03:47:39-07:00"}],"HeadCommit":{"Sha1":"3afb568a1d13a2ceeaf49a2a9bf1d8634f422c23","Message":"fix(gate): 版本中心断言重锚为结构式——距离窗口误杀且漏杀，顺带逼出报价域拆分\n\nPR #11 的 CI 红在 quotation-version-detail-visible。查证为**门禁误杀**：版本中心的\n快照详情一直正常渲染（浏览器实测展开 V1 可见「经济方案 ¥910,000.00 · 1 项明细」），\n只是行内补了 diff 段落与三段设计裁决注释后，两个锚点间距涨到 1309 字符、超过\n{0,500} 距离窗口（after-sales-order-options-hook 同型，本仓第二次踩）。\n\n断言重锚为否定环视 (?:(?!\u003c\\/details\u003e)[\\s\\S])*，语义由「两锚点挨得近」改为\n「快照摘要在版本行元素内部」。差分真值表显示旧写法 4 例错 2 例、两个方向都错：\n不仅误杀，还漏杀「快照挪到行外但离得近」——重锚顺手补上那个洞，并固化为\ncontract-integration.test.mjs 第 24b 条负向用例（实跑 exit=1 且命中预期断言 id）。\n\ncomponent-size 同轮逼出真拆分（门禁明说「先拆分而不是上调登记值」）：\n- QuotationWorkbench 661→169：创建卡连同表单状态提为 QuotationCreateCard、\n 单档编辑器提为 QuotationOptionEditor、版本中心提为 QuotationVersionCenter\n- MobileOverview 473→413：报价经营四指标卡提为 OverviewQuoteMetrics\n全部抽为**同文件兄弟组件**——搬到独立文件会让按路径锚定的门禁锚点落空。\nQuotationCreateCard 刻意始终挂载、在 hooks 之后才 return null，保证候选查询的\n发起时机与重构前逐字一致（只搬行不改行为）。登记值同步下调/毕业锁住进步。\n\n⚠️ 抽 OverviewQuoteMetrics 时一度把三元中段当 JSX 搬走并用 \u003c\u003e 包裹，`) : (`\n降格为文本节点原样上屏，且两个分支同时渲染——给有权限的管理员显示「未向当前\n角色开放」。tsc 与 22 项静态门禁全绿，只有浏览器截图抓得到。已修并留档。\n\n证据（作用域＝本地工作区）：pnpm check 22 项全绿 exit=0、16 组负向自检有牙、\n浏览器实测总览/新建报价/版本中心三处渲染正常。未重跑 check:runtime / check:ui\n（两后端与 contracts 一行未动，那两级证据仍绑定上一轮 commit）。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-17T03:47:39-07:00"},"CompareURL":"luoanwu/juhai-quotation-system/compare/6e260f9edb613a60434dd3c0b38c78068c346022...3afb568a1d13a2ceeaf49a2a9bf1d8634f422c23","Len":1}...
|
1786963673
|
Edit
Delete
|
|
23260
|
5
|
5
|
5
|
75
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"27a28dd5a {"Commits":[{"Sha1":"27a28dd5a5a8aabd88832337fd5ffbc1216dbbf8","Message":"docs(ai-mentor): 培训 AI 导师「嗨伙伴」设计稿\n\n定位：AI 演客户，人演顾问，AI 打首评，人做复检。\n\n核心判断：\n1. 角色反转把幻觉赶到无害的一侧——AI 只演客户（客户发言不构成巨嗨对外承诺），\n 并明令禁止 AI 以客户身份陈述巨嗨产品/价格/兼容性（客户本就不该知道），\n 从而把「输出巨嗨事实」从 AI 的可能行为里整个移除。\n 顺带补上文档 15.2「三人轮换」里最难安排的客户角色。\n2. AI 的目标函数是按案例卡「隐藏风险」诱导学员犯错，不是配合学员；学员没上钩才算通过。\n3. 评分分两层：红线层用 20.2 禁用清单做确定性扫描（可复现可审计），\n 评分层 LLM 按 18.1 八维打分但每维必须附学员原话；\n 并套用 19.4 教练校准——AI 与人类复检维度偏差超 10 个百分点即冻结 AI 评分回人工。\n\n与上游嗨伙伴产品线对齐（工作/嗨伙计 crew.ts + check:partner-truth）：\n- 防幻觉架构照搬已验证的 hallucination-guard 形状（renderQuote → renderFact(contentId)），\n 不重新发明；\n- 「执行完成只认领域终态，ToolCall ALLOWED 不算完成」映射为\n 「AI 打完分 ≠ 培训完成」，领域终态是学员通过复检并获得 18.2 操作授权；\n- 一期为内部工具，不进 CREW_ROSTER（未对外售卖即无产品就绪事实）。\n\n硬依赖点名：二期「官网事实问答」被 ContentLedger 阻塞——它尚未落地，\n没有它就等于让 LLM 直接产出巨嗨事实，是本设计第 4 节明令禁止的形态。\n\n未落地、未评审。对象模型与状态机为草案，未登记 owner-matrix。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"ailaoluo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"ailaoluo","Timestamp":"2026-08-15T21:27:44-07:00"}],"HeadCommit":{"Sha1":"27a28dd5a5a8aabd88832337fd5ffbc1216dbbf8","Message":"docs(ai-mentor): 培训 AI 导师「嗨伙伴」设计稿\n\n定位：AI 演客户，人演顾问，AI 打首评，人做复检。\n\n核心判断：\n1. 角色反转把幻觉赶到无害的一侧——AI 只演客户（客户发言不构成巨嗨对外承诺），\n 并明令禁止 AI 以客户身份陈述巨嗨产品/价格/兼容性（客户本就不该知道），\n 从而把「输出巨嗨事实」从 AI 的可能行为里整个移除。\n 顺带补上文档 15.2「三人轮换」里最难安排的客户角色。\n2. AI 的目标函数是按案例卡「隐藏风险」诱导学员犯错，不是配合学员；学员没上钩才算通过。\n3. 评分分两层：红线层用 20.2 禁用清单做确定性扫描（可复现可审计），\n 评分层 LLM 按 18.1 八维打分但每维必须附学员原话；\n 并套用 19.4 教练校准——AI 与人类复检维度偏差超 10 个百分点即冻结 AI 评分回人工。\n\n与上游嗨伙伴产品线对齐（工作/嗨伙计 crew.ts + check:partner-truth）：\n- 防幻觉架构照搬已验证的 hallucination-guard 形状（renderQuote → renderFact(contentId)），\n 不重新发明；\n- 「执行完成只认领域终态，ToolCall ALLOWED 不算完成」映射为\n 「AI 打完分 ≠ 培训完成」，领域终态是学员通过复检并获得 18.2 操作授权；\n- 一期为内部工具，不进 CREW_ROSTER（未对外售卖即无产品就绪事实）。\n\n硬依赖点名：二期「官网事实问答」被 ContentLedger 阻塞——它尚未落地，\n没有它就等于让 LLM 直接产出巨嗨事实，是本设计第 4 节明令禁止的形态。\n\n未落地、未评审。对象模型与状态机为草案，未登记 owner-matrix。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"ailaoluo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"ailaoluo","Timestamp":"2026-08-15T21:27:44-07:00"},"CompareURL":"luoanwu/training-framework/compare/299e9e73a28b31c10f2bd4a03db552811de642db...27a28dd5a5a8aabd88832337fd5ffbc1216dbbf8","Len":1}...
|
1786855126
|
Edit
Delete
|
|
23259
|
5
|
5
|
5
|
75
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"299e9e73a {"Commits":[{"Sha1":"299e9e73a28b31c10f2bd4a03db552811de642db","Message":"docs(governance): record gitea publish baseline for independent repo\n\n远端已建立并实测对齐：\ngitea = https://gitea.g-hi.com/luoanwu/training-framework.git（独立新仓）\nls-remote 实测 gitea/main=4bcef1bb，与推送时本地 HEAD 逐字一致。\n\n同时写明仍不成立的宣称：远端 CI 已绿、已部署、生产可用。\n并记录 push 打印 Everything up-to-date 不构成已发布证据。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"ailaoluo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"ailaoluo","Timestamp":"2026-08-15T21:04:53-07:00"}],"HeadCommit":{"Sha1":"299e9e73a28b31c10f2bd4a03db552811de642db","Message":"docs(governance): record gitea publish baseline for independent repo\n\n远端已建立并实测对齐：\ngitea = https://gitea.g-hi.com/luoanwu/training-framework.git（独立新仓）\nls-remote 实测 gitea/main=4bcef1bb，与推送时本地 HEAD 逐字一致。\n\n同时写明仍不成立的宣称：远端 CI 已绿、已部署、生产可用。\n并记录 push 打印 Everything up-to-date 不构成已发布证据。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"ailaoluo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"ailaoluo","Timestamp":"2026-08-15T21:04:53-07:00"},"CompareURL":"luoanwu/training-framework/compare/4bcef1bbfffbca2968adef922ca60afb8d4d5bfd...299e9e73a28b31c10f2bd4a03db552811de642db","Len":1}...
|
1786853096
|
Edit
Delete
|
|
23258
|
5
|
5
|
5
|
75
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"4bcef1bbf {"Commits":[{"Sha1":"4bcef1bbfffbca2968adef922ca60afb8d4d5bfd","Message":"docs(governance): record clean three-tier evidence SHAs and provenance blind spot\n\n三级证据现均 worktreeDirty=false，分别绑定 9c7586e/1ea36ef/4b8055e\n（相邻 commit 只差 reports/*.latest.json，源码逐字相同）。\n\n同时记录一个继承自源仓的治理盲区：governance-report 对 runtime/UI 报告\n只校验 gitSha 格式合法，不校验等于当前 HEAD——证据新鲜度只靠人工纪律，\n无机器守卫。判断三级状态须实际比对各报告 provenance.gitSha 与 HEAD。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"ailaoluo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"ailaoluo","Timestamp":"2026-08-15T20:56:20-07:00"},{"Sha1":"9c7586eee8910f54f7805c411fa9a742b77fbfd5","Message":"chore(reports): bind UI acceptance evidence to clean commit\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"ailaoluo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"ailaoluo","Timestamp":"2026-08-15T20:55:43-07:00"},{"Sha1":"4b8055e04b7dd0b4943fa712a7663ee4e11ec194","Message":"chore(reports): bind runtime acceptance evidence to clean commit\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"ailaoluo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"ailaoluo","Timestamp":"2026-08-15T20:55:21-07:00"},{"Sha1":"1ea36ef0c0c09a93e20594dc31f10a4beef7877e","Message":"chore(reports): refresh static gate evidence on clean tree\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"ailaoluo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"ailaoluo","Timestamp":"2026-08-15T20:55:00-07:00"},{"Sha1":"67310efba607e03c717fc0d3bb3c50b3f880427c","Message":"feat(recruitment): 前端作战台 + 3 个浏览器用例，三级门禁全绿\n\n前端（apps/web）：\n- RecruitmentPanel 招商作战台挂上首页：线索列表/创建/推进/转换、商机卡、\n 岗位切换器、看板（在途/高质量成交/阶段门拦截）\n- 动作按钮不硬编码 17 态，从 GET /api/opportunities/machine 的\n states[state].on 渲染；证据表单由 contracts 的 GATE_REQUIREMENTS 驱动，\n 后端加一项要求前端自动多一格\n- 阶段门反馈分两种：gate-blocked（缺证据 + missing[]）与 role-blocked（403）\n- lib/api.ts 增招商调用层，动作接口带 x-actor-role 头\n\n浏览器级验收（4 → 7 用例），把招商域证据等级从「真实 DB API」推到「浏览器交互」：\n- 线索 → 分配 → 接通 → 转商机，验证 CONVERTED 冻结\n- 阶段门：空证据提交被服务端拦下、UI 显示 missing[]、状态不动；补齐后放行\n- 回款门：SALES 填齐同样证据仍被 403，切 FINANCE 才通过\n （证据完全相同、唯一变量是岗位——锁死「角色门独立于证据门」）\n\n棘轮上调（只涨不降）：uiTestsPassed 4 → 7\n\n文档：CLAUDE.md 证据段与蓝图状态同步为「一期已落地」，并写明未覆盖项\n（Fastify 侧 UI 属 G17 既有缺口、Interaction 录入页、看板外读模型）。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"ailaoluo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"ailaoluo","Timestamp":"2026-08-15T20:53:03-07:00"}],"HeadCommit":{"Sha1":"4bcef1bbfffbca2968adef922ca60afb8d4d5bfd","Message":"docs(governance): record clean three-tier evidence SHAs and provenance blind spot\n\n三级证据现均 worktreeDirty=false，分别绑定 9c7586e/1ea36ef/4b8055e\n（相邻 commit 只差 reports/*.latest.json，源码逐字相同）。\n\n同时记录一个继承自源仓的治理盲区：governance-report 对 runtime/UI 报告\n只校验 gitSha 格式合法，不校验等于当前 HEAD——证据新鲜度只靠人工纪律，\n无机器守卫。判断三级状态须实际比对各报告 provenance.gitSha 与 HEAD。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"ailaoluo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"ailaoluo","Timestamp":"2026-08-15T20:56:20-07:00"},"CompareURL":"","Len":8}...
|
1786853015
|
Edit
Delete
|
|
23257
|
5
|
5
|
5
|
75
|
0
|
0
|
refs/heads/main
|
0
|
|
1786853015
|
Edit
Delete
|
|
23256
|
5
|
1
|
5
|
75
|
0
|
0
|
|
0
|
|
1786852991
|
Edit
Delete
|
|
23255
|
5
|
5
|
5
|
74
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"66f0513cf {"Commits":[{"Sha1":"66f0513cfb65a0eb27fe77ff8b5bd158c0901623","Message":"docs(finance): 财务对账模块蓝图与 money 契约(在制品,尚无运行时消费方)\n\nADR-0010 + finance-reconciliation-blueprint + owner-matrix/domain-glossary 登记 +\npackages/contracts/src/money.ts。money.ts 未从 index 导出、双端零消费方,\n按\"先登记后建表\"纪律先落蓝图与对象归属,实现另行推进。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-14T16:07:13-07:00"},{"Sha1":"cc2759215b871373a7df54e410fb788f4c8cc8be","Message":"fix: 对抗性验收发现的三项修复——中文短词检索/分区覆盖/实时偶发\n\n- KbStore(双端): trigram 只为 ≥3 字符查询产出 trigram,2 字中文词(房态/报价)\n 命中 0 行且不抛错,原 LIKE 兜底只在抛错时触发 → 空结果继续走 LIKE 子串兜底;\n 双端各补 HTTP 层中文短词回归(负向测试:撤掉兜底两端同时红)\n- ApprovalsPanel: 补 approvals-pending/approvals-decided 语义容器与 e2e 分区断言。\n 实测原用例在分区回潮后仍全绿(零覆盖),新断言可让审批闭环用例由绿转红\n- e2e 实时断言 15s→30s: dispatcher 1s 轮询在并行负载下抖动导致偶发红;\n 放宽等待不掩盖回归,禁用 retries(会把真回归记成 flaky 且仍计入 uiTestsPassed)\n- 边界断言钉死 contracts 真实上限(200 放行/201 拒绝/未知参数 400)\n- CLAUDE.md G18 补记 UI 层实时偶发与\"禁用 retries\"纪律\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-14T16:07:03-07:00"}],"HeadCommit":{"Sha1":"66f0513cfb65a0eb27fe77ff8b5bd158c0901623","Message":"docs(finance): 财务对账模块蓝图与 money 契约(在制品,尚无运行时消费方)\n\nADR-0010 + finance-reconciliation-blueprint + owner-matrix/domain-glossary 登记 +\npackages/contracts/src/money.ts。money.ts 未从 index 导出、双端零消费方,\n按\"先登记后建表\"纪律先落蓝图与对象归属,实现另行推进。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-14T16:07:13-07:00"},"CompareURL":"luoanwu/haimate/compare/a7b05c570031d440008da58d5cd13d7c9097b687...66f0513cfb65a0eb27fe77ff8b5bd158c0901623","Len":2}...
|
1786748944
|
Edit
Delete
|
|
23254
|
5
|
5
|
5
|
74
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"a7b05c570 {"Commits":[{"Sha1":"a7b05c570031d440008da58d5cd13d7c9097b687","Message":"chore(reports): 刷新治理证据,绑定双远端对齐快照提交\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-14T15:24:05-07:00"},{"Sha1":"38a5b9eff3b427df3010450beb499ad886cd47f2","Message":"docs(governance): 发布状态快照——双远端 haimate 均对齐 950d7e3\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-14T15:24:05-07:00"}],"HeadCommit":{"Sha1":"a7b05c570031d440008da58d5cd13d7c9097b687","Message":"chore(reports): 刷新治理证据,绑定双远端对齐快照提交\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-14T15:24:05-07:00"},"CompareURL":"luoanwu/haimate/compare/950d7e3d2189ba40de3049c4f10df0cad414c691...a7b05c570031d440008da58d5cd13d7c9097b687","Len":2}...
|
1786746304
|
Edit
Delete
|
|
23253
|
5
|
5
|
5
|
74
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"950d7e3d2 {"Commits":[{"Sha1":"950d7e3d2189ba40de3049c4f10df0cad414c691","Message":"chore(reports): 刷新治理证据,绑定发布状态快照提交\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-14T15:17:56-07:00"},{"Sha1":"5261c63466442dec3dfed5282117e8e700d22aea","Message":"docs(governance): 发布状态快照切换为 haimate 独立远端事实\n\norigin=GitHub laoluojuhai/haimate(私有)已推送对齐;gitea 远端项目待建(push-to-create 关闭)。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-14T15:17:56-07:00"},{"Sha1":"5aba5a36e8958a21696e895693aa69bdc54a3308","Message":"chore(reports): 刷新治理证据,绑定产品全景图归档提交(worktreeDirty=false)\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-14T15:09:08-07:00"},{"Sha1":"7e2efd8626198ee54b5c98a118eadfa349ead8f8","Message":"docs(product): 归档产品全景图 + 忽略 playwright-cli 调试产物\n\nmermaid 导出的产品全景图移入 docs/product/ 并在 README 登记(说明性快照,\n状态标注不作真源);.playwright-cli/ 为浏览器交互调试缓存,非验收证据,入 ignore。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-14T15:08:55-07:00"},{"Sha1":"5f4af5cd5ddb5188f410e292d5066def03fcf982","Message":"chore(reports): 刷新治理证据,绑定 P0 收口加固提交\n\n静态门禁绑定 8c986f5;runtime(252 tests)/UI(11 用例)证据为提交前 dirty 工作区实跑,\nworktreeDirty=true 仅余未跟踪的 mermaid-diagram.svg(未入库的本地产物)。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-14T15:04:05-07:00"}],"HeadCommit":{"Sha1":"950d7e3d2189ba40de3049c4f10df0cad414c691","Message":"chore(reports): 刷新治理证据,绑定发布状态快照提交\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-14T15:17:56-07:00"},"CompareURL":"luoanwu/haimate/compare/b4c2a8dcb155eeb7b28c2a2ee55520c649dd3d49...950d7e3d2189ba40de3049c4f10df0cad414c691","Len":10}...
|
1786746163
|
Edit
Delete
|
|
23252
|
5
|
5
|
5
|
74
|
0
|
0
|
refs/heads/main
|
0
|
|
1786746163
|
Edit
Delete
|
|
23251
|
5
|
1
|
5
|
74
|
0
|
0
|
|
0
|
|
1786746150
|
Edit
Delete
|
|
22536
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/feat/product-catalog-search-and-image-u refs/heads/feat/product-catalog-search-and-image-upload...
|
0
|
{"Commits":[{"Sha1":"6e260f9ed {"Commits":[{"Sha1":"6e260f9edb613a60434dd3c0b38c78068c346022","Message":"feat(ui): 交互审计全项收口——成功回执、状态机中文报错、子页交互三缺口\n\n同日两轮，基线 2c0409a 干净树，全部改动可干净归属。\n\n轮一（审计项 3/4）：\n- 成功回执：保存方案/收款登记/确认到账/发送报价四处 mutation 补 toast\n （按售后成例「结果 + 下一站归谁」；收款文案显式说清「登记≠到账，\n 确认后才解锁发货门禁」的三责分离）。ToastProvider 早已挂载，\n 此前 81 个 mutation 只有售后 1 个消费者。\n- 双后端 24 处状态机报错去英文枚举：`状态 ${STATE} 不允许执行 ${event}`\n → `…当前状态为「中文标签」，不支持该操作`（9 通用 + 3 动作变体 ×2 后端，\n 文案逐字一致）；消费 contracts 既有 *_STATE_LABELS——错误路径此前从未用过它们，\n 与 error-messages.ts 的发现同构。内部事件动词不外泄（标注 21）；\n code/state/allowed 结构字段原样保留，前端零影响。\n\n轮二（子页交互审计 P1-P3；shell 骨架已把 08-04 诊断 §2.7 实质关闭，本轮修行为缺口）：\n- P1 履约 Orders 六 mode 同实例：page/搜索词/状态筛选/选中补 [mode] 重置，\n 镜像售后纪律；「切队列不换单」由 selectedOrderId ?? focusId 回退结构保住。\n- P2 售后流水线胶囊接 AfterSalesSummary.byState 出每段积压数\n （共用 query cache；徽标 aria-hidden，0 不渲染）。\n- P3 新建 WorkspaceMain：main landmark + aria-label=入口名 + tabIndex=-1，\n 子页切换后焦点移入播报并滚回顶部；首帧不抢焦点；带 focusId 的跳转不滚顶\n （报价卡自滚，父效应后跑会砸掉它——标注 16）。\n Home 借道 activeEntry 单查找瘦身回 399/400，下一个动 Home 的必须先拆分。\n\n证据（2026-08-13 本地，详见 CLAUDE.md 动态区两条新记录）：\ncheck:runtime 全量 548 用例绿（地板 503，分包 436/56/56，全新库 gov25）；\n三端 typecheck / web lint / design-tokens / dual-backend / workspace-hygiene 绿；\n真实 Chromium 全新库（ui19）「商品客户」「客户方案闭环」两章全绿；\n浏览器实测：保存方案 toast 落 aria-live、409 新文案「方案当前状态为「可设计」…」、\n物流搜索词切队列后清空、切维修复检焦点落 main 且 scrollY 600→0、\n流水线徽标计数与真数据一致。module-integration/component-size 仍剩的红\n均属报价版本中心在途战役（quotation-version-detail-visible + 3 处体积），非本轮引入。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-13T08:00:31-07:00"}],"HeadCommit":{"Sha1":"6e260f9edb613a60434dd3c0b38c78068c346022","Message":"feat(ui): 交互审计全项收口——成功回执、状态机中文报错、子页交互三缺口\n\n同日两轮，基线 2c0409a 干净树，全部改动可干净归属。\n\n轮一（审计项 3/4）：\n- 成功回执：保存方案/收款登记/确认到账/发送报价四处 mutation 补 toast\n （按售后成例「结果 + 下一站归谁」；收款文案显式说清「登记≠到账，\n 确认后才解锁发货门禁」的三责分离）。ToastProvider 早已挂载，\n 此前 81 个 mutation 只有售后 1 个消费者。\n- 双后端 24 处状态机报错去英文枚举：`状态 ${STATE} 不允许执行 ${event}`\n → `…当前状态为「中文标签」，不支持该操作`（9 通用 + 3 动作变体 ×2 后端，\n 文案逐字一致）；消费 contracts 既有 *_STATE_LABELS——错误路径此前从未用过它们，\n 与 error-messages.ts 的发现同构。内部事件动词不外泄（标注 21）；\n code/state/allowed 结构字段原样保留，前端零影响。\n\n轮二（子页交互审计 P1-P3；shell 骨架已把 08-04 诊断 §2.7 实质关闭，本轮修行为缺口）：\n- P1 履约 Orders 六 mode 同实例：page/搜索词/状态筛选/选中补 [mode] 重置，\n 镜像售后纪律；「切队列不换单」由 selectedOrderId ?? focusId 回退结构保住。\n- P2 售后流水线胶囊接 AfterSalesSummary.byState 出每段积压数\n （共用 query cache；徽标 aria-hidden，0 不渲染）。\n- P3 新建 WorkspaceMain：main landmark + aria-label=入口名 + tabIndex=-1，\n 子页切换后焦点移入播报并滚回顶部；首帧不抢焦点；带 focusId 的跳转不滚顶\n （报价卡自滚，父效应后跑会砸掉它——标注 16）。\n Home 借道 activeEntry 单查找瘦身回 399/400，下一个动 Home 的必须先拆分。\n\n证据（2026-08-13 本地，详见 CLAUDE.md 动态区两条新记录）：\ncheck:runtime 全量 548 用例绿（地板 503，分包 436/56/56，全新库 gov25）；\n三端 typecheck / web lint / design-tokens / dual-backend / workspace-hygiene 绿；\n真实 Chromium 全新库（ui19）「商品客户」「客户方案闭环」两章全绿；\n浏览器实测：保存方案 toast 落 aria-live、409 新文案「方案当前状态为「可设计」…」、\n物流搜索词切队列后清空、切维修复检焦点落 main 且 scrollY 600→0、\n流水线徽标计数与真数据一致。module-integration/component-size 仍剩的红\n均属报价版本中心在途战役（quotation-version-detail-visible + 3 处体积），非本轮引入。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-13T08:00:31-07:00"},"CompareURL":"luoanwu/juhai-quotation-system/compare/2c0409a3cbd22aaba6d36a123d8ba9bea5711059...6e260f9edb613a60434dd3c0b38c78068c346022","Len":1}...
|
1786633238
|
Edit
Delete
|
|
22535
|
5
|
5
|
5
|
73
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"5756bf365 {"Commits":[{"Sha1":"5756bf3650630520be67b4d5373a82937d065311","Message":"feat(content-analysis): add vocal score physical projection\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-13T03:30:36-07:00"}],"HeadCommit":{"Sha1":"5756bf3650630520be67b4d5373a82937d065311","Message":"feat(content-analysis): add vocal score physical projection\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-13T03:30:36-07:00"},"CompareURL":"luoanwu/highpraise-content-management-platform/compare/5adfbb1177c24e9a9ddb95ab1b5e5865baa60642...5756bf3650630520be67b4d5373a82937d065311","Len":1}...
|
1786617045
|
Edit
Delete
|
|
22446
|
5
|
5
|
5
|
73
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"5adfbb117 {"Commits":[{"Sha1":"5adfbb1177c24e9a9ddb95ab1b5e5865baa60642","Message":"feat(content-analysis): integrate canonical vocal score metrics\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-13T01:35:39-07:00"},{"Sha1":"e64a62b0b11460ac8ac0965fa3f755a6e23963a5","Message":"feat(content-analysis): add isolated vocal score gold metrics\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-13T00:43:04-07:00"},{"Sha1":"43f31bf8615c32aa70532927d9f34fcdcce68717","Message":"feat(score): harden evaluation eligibility\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-12T23:10:30-07:00"},{"Sha1":"5f47fc13a7039417186241b5f6d2a6fe60f0a0f8","Message":"fix(stem): align realtime endpoint and seal publish evidence\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-12T21:20:21-07:00"},{"Sha1":"3eb89b087903c1657bca1927cf18941a303029a1","Message":"feat(三线完善): run 工作台 + 评分真实链 + 舞谱回放对拍 + 灯谱修订对比；全量门禁首绿\n\n- Web：/content-analysis/runs 持久编排工作台（素材载入/歌词证据浏览器内容寻址/实时列表与详情）\n- 评分工作台接通 WAV→3351→DSP→P0 真实链（补 next.config DSP rewrite），DSP 成熟度徽标不弱化诚实边界\n- 舞谱工作台本地回放对拍（SHA 绑定回放源 + 播放头 + 越拍高亮）\n- 灯谱 RevisionDiffPanel（基准快照 cue 级 diff + 修订链视图）+ A–E 报告钻取\n- 注册表/门禁成对更新（integrationStatus、runs 工作台、activeScope）\n- 修复三处历史死断言（首页 spec 漂移）+ C16 式容器锚定；首页 runs 链接标签\n- 目标仓首次全绿：check:runtime 80 tests、check:ui 15 用例、pnpm check 含棘轮全通过，\n reportProvenanceViolations 13→0，棘轮地板收紧至 15 文件/95 用例/80 tests/15 UI 用例\n- CLAUDE.md 动态区 8 行基线表 + 4 段说明同步为目标仓新鲜证据口径\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"ailaoluo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"ailaoluo","Timestamp":"2026-08-12T08:26:31-07:00"}],"HeadCommit":{"Sha1":"5adfbb1177c24e9a9ddb95ab1b5e5865baa60642","Message":"feat(content-analysis): integrate canonical vocal score metrics\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-13T01:35:39-07:00"},"CompareURL":"","Len":7}...
|
1786612368
|
Edit
Delete
|
|
22445
|
5
|
5
|
5
|
73
|
0
|
0
|
refs/heads/main
|
0
|
|
1786612368
|
Edit
Delete
|
|
22305
|
5
|
7
|
5
|
57
|
0
|
0
|
|
0
|
2|chore: add material factory model weights
|
1786603029
|
Edit
Delete
|
|
22304
|
5
|
5
|
5
|
57
|
0
|
0
|
refs/heads/feat/qwen-image-3-hosted
|
0
|
{"Commits":[{"Sha1":"a3b0b41a7 {"Commits":[{"Sha1":"a3b0b41a799077b4ab46b58ee7290ae27be009f3","Message":"feat: integrate Qwen-Image 3.0 hosted edit via DashScope\n\nQwen-Image 3.0 (released 2026-07-21) ships no public weights (HF-verified;\nlatest open checkpoint remains Qwen-Image-2512), so integration goes through\nthe Aliyun Model Studio hosted API instead of the weights manifest.\n\n- contracts: add qwen-image-3-api capability (kind=hosted-api), HOSTED_EDIT_KINDS,\n buildEditInstruction (prompt stays aligned with OCR gate expectations),\n sidecarCapabilitySchema.kind; fix lingering \"Qwen-Image 2.0\" routing drift\n- sidecar: /v1/edit now really calls DashScope multimodal-generation\n (base64 base image, \u003e2048px downscale, 24h result URL downloaded to disk\n immediately, honest 503 HOSTED_API_KEY_MISSING / 502 HOSTED_API_ERROR;\n zero new Python deps)\n- backends (NestJS+Fastify, isomorphic): render pipeline executes hosted edit\n kinds when credential ready -\u003e Asset(RENDERED, model=real engine id) -\u003e\n server-side OCR gate; other model kinds stay honestly BLOCKED\n- web: EditStudio hosted-edit entry (run-hosted-edit); MODEL_ROUTING_FALLBACK\n now derived from contracts; purge remaining \"Qwen-Image 2.0\" labels\n- acceptance: deterministic no-key BLOCKED assertions + runIf(DASHSCOPE_API_KEY)\n live test; 20B BLOCKED assertion moved to always-deterministic DESIGN_MASTER\n- gates re-run green: pnpm check / check:runtime / check:inference / check:ui\n (refreshed the stale failed ui-acceptance report left by a July port collision)\n- docs: CLAUDE.md C9 closed record, G14 rewrite, baseline refresh\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-12T22:57:17-07:00"},{"Sha1":"34dc595ae157cf7904da55c885aee4af2c69c469","Message":"chore: add material factory model weights\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-07-06T02:21:25-07:00"}],"HeadCommit":{"Sha1":"a3b0b41a799077b4ab46b58ee7290ae27be009f3","Message":"feat: integrate Qwen-Image 3.0 hosted edit via DashScope\n\nQwen-Image 3.0 (released 2026-07-21) ships no public weights (HF-verified;\nlatest open checkpoint remains Qwen-Image-2512), so integration goes through\nthe Aliyun Model Studio hosted API instead of the weights manifest.\n\n- contracts: add qwen-image-3-api capability (kind=hosted-api), HOSTED_EDIT_KINDS,\n buildEditInstruction (prompt stays aligned with OCR gate expectations),\n sidecarCapabilitySchema.kind; fix lingering \"Qwen-Image 2.0\" routing drift\n- sidecar: /v1/edit now really calls DashScope multimodal-generation\n (base64 base image, \u003e2048px downscale, 24h result URL downloaded to disk\n immediately, honest 503 HOSTED_API_KEY_MISSING / 502 HOSTED_API_ERROR;\n zero new Python deps)\n- backends (NestJS+Fastify, isomorphic): render pipeline executes hosted edit\n kinds when credential ready -\u003e Asset(RENDERED, model=real engine id) -\u003e\n server-side OCR gate; other model kinds stay honestly BLOCKED\n- web: EditStudio hosted-edit entry (run-hosted-edit); MODEL_ROUTING_FALLBACK\n now derived from contracts; purge remaining \"Qwen-Image 2.0\" labels\n- acceptance: deterministic no-key BLOCKED assertions + runIf(DASHSCOPE_API_KEY)\n live test; 20B BLOCKED assertion moved to always-deterministic DESIGN_MASTER\n- gates re-run green: pnpm check / check:runtime / check:inference / check:ui\n (refreshed the stale failed ui-acceptance report left by a July port collision)\n- docs: CLAUDE.md C9 closed record, G14 rewrite, baseline refresh\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-12T22:57:17-07:00"},"CompareURL":"luoanwu/image-generation/compare/fc2ce503c94d763b1d077e7c734720a0c58e23a8...a3b0b41a799077b4ab46b58ee7290ae27be009f3","Len":2}...
|
1786602934
|
Edit
Delete
|
|
22303
|
5
|
5
|
5
|
57
|
0
|
0
|
refs/heads/feat/qwen-image-3-hosted
|
0
|
|
1786602934
|
Edit
Delete
|
|
22302
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/feat/product-catalog-search-and-image-u refs/heads/feat/product-catalog-search-and-image-upload...
|
0
|
{"Commits":[{"Sha1":"2c0409a3c {"Commits":[{"Sha1":"2c0409a3cbd22aaba6d36a123d8ba9bea5711059","Message":"chore(dev): dev 端口防跨仓劫持——API 迁 13099、web 改 autoPort\n\n实锤：本机多仓并发会话互抢 3xxx 段端口，3098 被他仓 Next 占、3099 被\n「图像生成」的 fastify 占——后者 /api/health 报文与本仓逐字同构\n（fastify + database/redis up），探活全绿而业务路由全 404，页面表现为\n「Route GET:/api/solutions not found」（G15「端口通≠基座对」的跨仓变体）。\n\n- api-fastify：固定端口 3099 → 13099，迁出拥挤段；\n- web：去掉写死的 -p 3098，改 autoPort（next dev 吃 PORT env），\n API_PROXY_TARGET / NEXT_PUBLIC_WS_URL 同步指向 13099。\n判断「端口上是不是本仓服务」以后要打带 token 的业务路由，不能只看 health。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-12T23:35:20-07:00"}],"HeadCommit":{"Sha1":"2c0409a3cbd22aaba6d36a123d8ba9bea5711059","Message":"chore(dev): dev 端口防跨仓劫持——API 迁 13099、web 改 autoPort\n\n实锤：本机多仓并发会话互抢 3xxx 段端口，3098 被他仓 Next 占、3099 被\n「图像生成」的 fastify 占——后者 /api/health 报文与本仓逐字同构\n（fastify + database/redis up），探活全绿而业务路由全 404，页面表现为\n「Route GET:/api/solutions not found」（G15「端口通≠基座对」的跨仓变体）。\n\n- api-fastify：固定端口 3099 → 13099，迁出拥挤段；\n- web：去掉写死的 -p 3098，改 autoPort（next dev 吃 PORT env），\n API_PROXY_TARGET / NEXT_PUBLIC_WS_URL 同步指向 13099。\n判断「端口上是不是本仓服务」以后要打带 token 的业务路由，不能只看 health。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-12T23:35:20-07:00"},"CompareURL":"luoanwu/juhai-quotation-system/compare/35ebc8613b168219ce82c0b3cf9336d32e958821...2c0409a3cbd22aaba6d36a123d8ba9bea5711059","Len":1}...
|
1786602927
|
Edit
Delete
|
|
22301
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/feat/product-catalog-search-and-image-u refs/heads/feat/product-catalog-search-and-image-upload...
|
0
|
{"Commits":[{"Sha1":"35ebc8613 {"Commits":[{"Sha1":"35ebc8613b168219ce82c0b3cf9336d32e958821","Message":"feat(ui): 方案商品多选批量添加 + 交互模式采纳率收口（全量落盘，含并发在途批次）\n\n整棵混合工作区的全量提交：多个战役共树、文件内手笔交错，无法按文件拆分归属，\n经用户裁决全量提交推送；已知红盘如实列出，等对应战役收口后 CI 自然转绿。\n\n本轮两个战役（已验证）：\n- 方案设计三档选品改多选批量：新增 TierProductPicker（checkbox 候选 + 分类/关键词\n 收窄 + 待添加纸片跨筛选常驻 + 已添加禁勾），SolutionDesigner 416→252 行并从\n component-size 棘轮毕业；E2E 方案章改写为「勾 2 件一次落 2 行」的多选证明。\n- 交互模式采纳率收口：裸 {x.error.message} 29→1（统一走 ErrorAlert/QueryErrorState，\n receivables 本地 ErrorText 裸实现改包装、13 调用点一次收口，消掉 text-red-600 与\n 「操作失败，请重试」兜底）；裸 disabled={isPending} 59→31（单动作按钮换 Button\n loading 保焦点带 aria-busy；行共享 mutation/批准驳回对/兄弟禁用具名保留）；\n check:design-tokens 新增 designTokenRawErrorMessage=1 / designTokenBareIsPendingDisable=31\n 两条采纳率棘轮（计数单源 scripts/lib/design-adoption.mjs），design-adoption.test.mjs\n 13 例负向自检进 gate-selftest，活体注入实跑 exit=1 判红后恢复。\n\n同树落盘的并发/前序批次（未逐一复验，以各自战役记录为准）：\n- 报价版本中心（进行中，已知红：module-integration 的 quotation-version-detail-visible\n + component-size 3 处【MobileOverview 473\u003e430、QuotationCard 437、QuotationWorkbench\n 665\u003e566】+ gate-selftest 基线用例如实继承）\n- 事件业务编号按域推广、售后/方案后端切片、设计稿真源目录与 08-07 迁移目录等\n\n证据（本地混合工作区，2026-08-13，详见 CLAUDE.md 动态区新条目）：\ntypecheck / lint / design-tokens / role-permissions / naming / schema / validation /\ncontract-consumers / governance-docs / workspace-hygiene 绿；真实 Chromium 定向验收\n「商品客户」「客户方案闭环」两章通过（全新库 ui18）；「报价闭环」红属版本中心在途，\n「履约闭环」被串行阻断——fulfillment/receivables 的 loading 换写暂只有 typecheck+lint\n级证据，全量 check:ui 复跑时重点看这两章。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-12T23:22:47-07:00"},{"Sha1":"0b2e3703fed8f72749a8dc1824848d0601f1c9ea","Message":"docs(governance): 回灌远端 CI 证据——run 31072021158 @ ac22869 全绿\n\n作用域是**这个提交与这条分支**，不是 main（main 仍落后 21 个提交）。\nstatic ✅ / runtime 497 用例（contracts 395 + 双端各 51）/ UI 12 用例，\nCI 侧真起 MinIO 跑上传写链。\n\n同时记下两次实测判红的插曲：check:runtime 加了 S3 preflight 却没同步 CI 环境；\nMinIO 放进 services: 起不来（Actions 的 service 容器没有传 command 的字段）。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-05T21:52:52-07:00"},{"Sha1":"ac228691be9468a1345b4f3669a7c5aa0ca86bef","Message":"ci: MinIO 改用显式 step 启动——services 传不了启动参数\n\n上一提交把 MinIO 放进 `services:`，CI 实测判红：\n「Failed to initialize container minio/minio:latest」。\n\n根因：Actions 的 service 容器只支持 image/env/ports/options/credentials/volumes，\n**没有传 command/args 的字段**；而 minio 镜像的 entrypoint 需要 `server /data`。\n不带参数时它打印 usage 后正常退出，于是健康检查永远 unhealthy。\n\n改为在 runtime job 里显式 `docker run -d ... server /data` 并轮询\n/minio/health/live。步骤跑在 runner 宿主机上，端口映射到 127.0.0.1:9000，\n与 S3_ENDPOINT 一致。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-05T21:42:48-07:00"},{"Sha1":"6a2a86ba23719de7baa4940fb278b2df8b72b95e","Message":"ci: 补 MinIO 服务与 S3 环境——check:runtime 现在硬要求对象存储\n\n上一提交给 check:runtime / check:ui 的 preflight 加了 S3_ENDPOINT / S3_BUCKET\n强制显式传参与桶名归属守卫（G15 同型：本机与 CI 都可能共用对象存储，\n静默写进别人的桶就是拿别仓存储当验收基座）。\n\nCI 只起了 postgres + redis，因此上一提交推上去会在 preflight 处直接判红——\n这不是回归，是我加了硬要求却没同步跑它的环境。\n\n桶名用 juhai-quotation-ci（须匹配 juhai-quotation* 前缀守卫）。\n健康检查用 /minio/health/live：容器镜像里没有 mc 客户端，`mc ready` 不可用。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-05T21:38:10-07:00"},{"Sha1":"8feb39921ea8a404b09e287154f4c6fd1f7bd3e3","Message":"feat(products): 商品库服务端搜索筛选 + 图片上传至对象存储\n\n## 一、服务端搜索与筛选（此前 115 个商品只能翻页找）\n\n商品列表新增 keyword / kind 两个过滤维度，与既有 active 一并落 DB where。\n谓词收进 contracts `buildProductListFilter` 单源，两后端各自\n`{ tenantId, ...buildProductListFilter(query) }`——行为对等由结构保证，\n任一侧自己拼 where 就会搜出不同结果而无红盘（G17 漂移形态）。\n\n- 关键词语义（SKU + 名称双列 contains、大小写不敏感、不含 description）\n 单独抽 `buildProductKeywordFilter`，换口径只改这一个函数。\n- 空串/纯空白在契约层归一为 undefined（C24 同型：清空搜索框最易发出空串），\n 前端另在 api 层直接不发该参数——双层防御。\n- tenantId 刻意不由该函数产出：租户隔离不能依赖一个可被调用方忘记展开的返回值。\n\n页面同步重构：录入表单默认收起、卡片压缩、展开管理时横跨整行、分页条下移、\n空态区分「筛选无结果」与「库里没商品」、成本 ¥0 改显「成本未录入」\n（导入时成本列整列为空是已知缺口，直显 ¥0.00 会被读成毛利 100%）。\n配件行由固定列宽改 flex-wrap + 最小宽度：视口断点用在 1/3 视口宽的卡片里\n是容器语境错配，断点满足了容器并没有变宽。\n\nProductLibrary 443 → 183 行，拆出 5 个子组件并从 component-size 债务登记毕业。\n\n## 二、图片上传至对象存储（此前只能粘贴外链 URL）\n\nMinIO 进 compose，两后端走 S3 SDK——换阿里云 OSS / 腾讯云 COS 只改 endpoint\n与凭证，写链代码不动。上传链：multipart → 按真实字节魔数判类型 → sharp 转\nWebP + 缩略图 → 写对象存储 → 落库（与 outbox 同 tx）。\n\n- 类型判定收进 contracts，连判定顺序也收：Content-Type 与扩展名都是攻击者\n 可控输入；顺序决定 0 字节文件报「没收到文件」还是「类型不支持」。\n 不收 SVG（可执行文档，直出即存储型 XSS）与 GIF。\n- S3 写入必须先于落库且在事务外：先落库则上传失败留下指向空对象的行（破图），\n 先上传则落库失败只留下无人引用的对象（垃圾，可清理）。代价不对称。\n- 公开回读 /api/files/:tenantId/:imageId/:variant 不鉴权（对客报价页没有内部\n 身份），路径穿越由 schema 校验后重建 key 结构性排除，非法参数回 404 不回 400。\n- DB 存相对路径而非对象存储绝对地址：换存储那天不必迁移存量 URL。\n- backup/restore 成对覆盖 minio 卷：只备份 Postgres 时恢复演练照常报绿，\n 但每行 ProductImage 都指向不存在的对象。卷名问 Docker 要而不是按\n 「项目名_卷名」拼——拼错会备份一个空卷而命令成功。\n\n## 三、修复与门禁\n\n- 修 `after-sales-order-options-hook` 在 HEAD 上的存量误杀（C29 修复插入\n ~700 字符把距离顶到 1749，撑破 1600 窗口，接线本身完好）。\n- 三条断言随组件拆分重新锚定（成本可见性/公开配件/配件确认框/元→分转换）。\n- 新增 6 条上传链断言；其中 2 条初版无牙被负向测试当场抓出并重写：\n 距离型顺序断言不测顺序、`id: imageId` 锚点在 removeImage 里不唯一（G13 同型）。\n 窗口取值均由实测距离确定，不拍脑袋。\n- DIVERGENCE_CEILINGS.products 142→152 属扩容非放水：同轮 PARITY_FLOORS.products\n 74.1→76.9（实测 77.4 高于校准时 74.6），只放松绝对判据是净削弱。\n- turbo globalEnv 补 S3_* 六项（不补则测试进程拿不到凭证，表现为 500）。\n\n## 证据（作用域＝本地工作区）\n\n- pnpm check：21 项全绿；负向注入 40 → 44 条\n- check:runtime：497/497（contracts 395 + 双端各 51），真上传打真 MinIO，地板已收紧\n- check:ui：12/12，上传段断言 naturalWidth \u003e 0（src 有值只证明存了个字符串）\n\n尚未核验远端 CI。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-05T21:35:24-07:00"}],"HeadCommit":{"Sha1":"35ebc8613b168219ce82c0b3cf9336d32e958821","Message":"feat(ui): 方案商品多选批量添加 + 交互模式采纳率收口（全量落盘，含并发在途批次）\n\n整棵混合工作区的全量提交：多个战役共树、文件内手笔交错，无法按文件拆分归属，\n经用户裁决全量提交推送；已知红盘如实列出，等对应战役收口后 CI 自然转绿。\n\n本轮两个战役（已验证）：\n- 方案设计三档选品改多选批量：新增 TierProductPicker（checkbox 候选 + 分类/关键词\n 收窄 + 待添加纸片跨筛选常驻 + 已添加禁勾），SolutionDesigner 416→252 行并从\n component-size 棘轮毕业；E2E 方案章改写为「勾 2 件一次落 2 行」的多选证明。\n- 交互模式采纳率收口：裸 {x.error.message} 29→1（统一走 ErrorAlert/QueryErrorState，\n receivables 本地 ErrorText 裸实现改包装、13 调用点一次收口，消掉 text-red-600 与\n 「操作失败，请重试」兜底）；裸 disabled={isPending} 59→31（单动作按钮换 Button\n loading 保焦点带 aria-busy；行共享 mutation/批准驳回对/兄弟禁用具名保留）；\n check:design-tokens 新增 designTokenRawErrorMessage=1 / designTokenBareIsPendingDisable=31\n 两条采纳率棘轮（计数单源 scripts/lib/design-adoption.mjs），design-adoption.test.mjs\n 13 例负向自检进 gate-selftest，活体注入实跑 exit=1 判红后恢复。\n\n同树落盘的并发/前序批次（未逐一复验，以各自战役记录为准）：\n- 报价版本中心（进行中，已知红：module-integration 的 quotation-version-detail-visible\n + component-size 3 处【MobileOverview 473\u003e430、QuotationCard 437、QuotationWorkbench\n 665\u003e566】+ gate-selftest 基线用例如实继承）\n- 事件业务编号按域推广、售后/方案后端切片、设计稿真源目录与 08-07 迁移目录等\n\n证据（本地混合工作区，2026-08-13，详见 CLAUDE.md 动态区新条目）：\ntypecheck / lint / design-tokens / role-permissions / naming / schema / validation /\ncontract-consumers / governance-docs / workspace-hygiene 绿；真实 Chromium 定向验收\n「商品客户」「客户方案闭环」两章通过（全新库 ui18）；「报价闭环」红属版本中心在途，\n「履约闭环」被串行阻断——fulfillment/receivables 的 loading 换写暂只有 typecheck+lint\n级证据，全量 check:ui 复跑时重点看这两章。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-12T23:22:47-07:00"},"CompareURL":"luoanwu/juhai-quotation-system/compare/be1e0734c39315b61a7bf452231a853f44866085...35ebc8613b168219ce82c0b3cf9336d32e958821","Len":5}...
|
1786602303
|
Edit
Delete
|
|
22300
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/feat/product-catalog-search-and-image-u refs/heads/feat/product-catalog-search-and-image-upload...
|
0
|
|
1786602303
|
Edit
Delete
|
|
22265
|
5
|
1
|
5
|
73
|
0
|
0
|
|
0
|
|
1786594169
|
Edit
Delete
|
|
21333
|
5
|
5
|
5
|
67
|
0
|
0
|
refs/heads/governance/adversarial-audit-fixes-2026 refs/heads/governance/adversarial-audit-fixes-20260728...
|
0
|
{"Commits":[{"Sha1":"f77fe276f {"Commits":[{"Sha1":"f77fe276fc4f6336bb58132bef8e01e83b4c9ea1","Message":"fix: 对抗验收 C30——键口径双源静默失败 / 导出与手改不同源 / 会计头幽灵声称；并补视图精度\n\n对刚落地的手改写链做对抗性验收（try-to-break-it），当场抓到三处、全部修复并接入回归：\n- C30①【数据完整性】编辑键口径双源：校验用 Number(\"01\")=1 找得到行、应用用\n String(line_id)=\"1\" 查不到该键 → \"01\" 判合法却不落盘（响应 ok:true/manualLines:0）；\n 该行本已有手改时更会被 apply 当\"缺席\"**静默还原**（实测本意改 end=14.5、磁盘回退 13.2）。\n 修法：键统一 ^(0|[1-9]\\d*)$ fail closed，校验与应用共用同一把钥匙\n- C30②【双出口矛盾】export 只查 \u003csong\u003e_p2/ 而手改按两级查找写入 → cli 直跑产出的\n \u003csong\u003e/line_times.json 会「页面看得到手改、导出读不到」。修法：export 收口\n resolveLineTimesPath（与读/写路由同源）\n- C30③【幽灵声称】蓝图两处写 X-Export-Manual-Edits「M1 随做」实则从未实现 → 真加会计头\n- 视图精度（用户新需求）：刻度加亚秒档（短歌 16× 从 0 个标签 → 56 个 0.1s 刻度）+\n 标签带小数；zoom-to-line 改「最接近目标占比 1/3」（长拖腔行 19%→38%）；字条加刻度栅格\n + 走带上画字条窗口投影（两个时间视图互相定位）；读数精度随每像素秒数自适应到 ms 级；\n 字条字块同步逐字高亮 + 播放头；修字条头部窄栏文案与读数交错换行\n- 验收：check:ui 12 用例全绿（新增导出一致性、走带精度两例 + 非规范化键负向断言），\n 地板 ui 10→12、ownTestCases 66→69；pnpm check 静态全链绿；负向测试实证：\n 退回键守卫缺陷形态即精确红在该断言、恢复复绿\n- 判读纪律实证入册：后台通知 exit code 被管道 tail 吞掉（通知 exit 0 / 报告 failed），\n 只认 runner report status 或显式 set -o pipefail\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-08T11:32:01-07:00"}],"HeadCommit":{"Sha1":"f77fe276fc4f6336bb58132bef8e01e83b4c9ea1","Message":"fix: 对抗验收 C30——键口径双源静默失败 / 导出与手改不同源 / 会计头幽灵声称；并补视图精度\n\n对刚落地的手改写链做对抗性验收（try-to-break-it），当场抓到三处、全部修复并接入回归：\n- C30①【数据完整性】编辑键口径双源：校验用 Number(\"01\")=1 找得到行、应用用\n String(line_id)=\"1\" 查不到该键 → \"01\" 判合法却不落盘（响应 ok:true/manualLines:0）；\n 该行本已有手改时更会被 apply 当\"缺席\"**静默还原**（实测本意改 end=14.5、磁盘回退 13.2）。\n 修法：键统一 ^(0|[1-9]\\d*)$ fail closed，校验与应用共用同一把钥匙\n- C30②【双出口矛盾】export 只查 \u003csong\u003e_p2/ 而手改按两级查找写入 → cli 直跑产出的\n \u003csong\u003e/line_times.json 会「页面看得到手改、导出读不到」。修法：export 收口\n resolveLineTimesPath（与读/写路由同源）\n- C30③【幽灵声称】蓝图两处写 X-Export-Manual-Edits「M1 随做」实则从未实现 → 真加会计头\n- 视图精度（用户新需求）：刻度加亚秒档（短歌 16× 从 0 个标签 → 56 个 0.1s 刻度）+\n 标签带小数；zoom-to-line 改「最接近目标占比 1/3」（长拖腔行 19%→38%）；字条加刻度栅格\n + 走带上画字条窗口投影（两个时间视图互相定位）；读数精度随每像素秒数自适应到 ms 级；\n 字条字块同步逐字高亮 + 播放头；修字条头部窄栏文案与读数交错换行\n- 验收：check:ui 12 用例全绿（新增导出一致性、走带精度两例 + 非规范化键负向断言），\n 地板 ui 10→12、ownTestCases 66→69；pnpm check 静态全链绿；负向测试实证：\n 退回键守卫缺陷形态即精确红在该断言、恢复复绿\n- 判读纪律实证入册：后台通知 exit code 被管道 tail 吞掉（通知 exit 0 / 报告 failed），\n 只认 runner report status 或显式 set -o pipefail\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-08T11:32:01-07:00"},"CompareURL":"luoanwu/songformer-structure-lyrics/compare/3fdb4053791bac065674586a5173a8a41aa5a0c4...f77fe276fc4f6336bb58132bef8e01e83b4c9ea1","Len":1}...
|
1786213926
|
Edit
Delete
|
|
21332
|
5
|
5
|
5
|
67
|
0
|
0
|
refs/heads/governance/adversarial-audit-fixes-2026 refs/heads/governance/adversarial-audit-fixes-20260728...
|
0
|
{"Commits":[{"Sha1":"3fdb40537 {"Commits":[{"Sha1":"3fdb4053791bac065674586a5173a8a41aa5a0c4","Message":"feat: 复核工作台手改写链 M1——直改产物+留档+拖动/打点/快捷键；走带播放链路补齐机器验收\n\n- 手改（ManualTimingEdit，2026-08-08 六项拍板落地）：编辑态（E）走带行区间双手柄拖动、\n 字时间编辑条（局部波形+字块拖动+联动边界+播放同步逐字高亮与播放头）、G29 null 字赋时、\n T 逐字打点（回补 100ms）、[ ] ; ' , . I O 微调与 ⌘Z/⌘S；保存=整卷 PUT 直改\n line_times.json + manual.original 留档（沿 clamped_from 纪律），指纹乐观锁 409 +\n 执行中 409（文件双写者显式登记）；重跑 fail closed（409 MANUAL_EDITS_PRESENT →\n confirmDiscardManualEdits）+ 自动备份 .manual-backups/（永不自动套用）；reconcile 单源\n lib/manual-edits.ts、产物定位单源 lib/review-artifacts.ts（读/写/守卫共用 _p2 优先）；\n 蓝图 docs/domain/review-manual-timing-blueprint.md + owner-matrix 登记\n- 走带整曲播放链路（前一轮未提交部分随本提交入库）：/api/review/full-audio（HTTP Range +\n 扩展名白名单，C28 收口）+ audio-source 单源 + audio-probe fixture + 真波形/seek/跟播/\n 双音源互斥 e2e + 深色三栏工作台改版余量\n- 验收：check:ui 10 用例全绿（新增手改用例：真实鼠标拖字块+真实键盘 [+落盘留档回读+\n 重跑 409+还原清 manual+指纹/非法/穿越负向矩阵），地板 ui 7→10、ownTestCases 62→66；\n pnpm check 静态全链绿；备份路径 live 实证（confirm→备份含手改值）\n- 教训入册（G18）：浏览器面板按键注入不带 e.code，快捷键实测须真键盘/Playwright；\n 拖动手势收 buttons===0 悬停移动防\"粘手\"（pointerup 窗外丢失实锤）\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-08T11:10:41-07:00"}],"HeadCommit":{"Sha1":"3fdb4053791bac065674586a5173a8a41aa5a0c4","Message":"feat: 复核工作台手改写链 M1——直改产物+留档+拖动/打点/快捷键；走带播放链路补齐机器验收\n\n- 手改（ManualTimingEdit，2026-08-08 六项拍板落地）：编辑态（E）走带行区间双手柄拖动、\n 字时间编辑条（局部波形+字块拖动+联动边界+播放同步逐字高亮与播放头）、G29 null 字赋时、\n T 逐字打点（回补 100ms）、[ ] ; ' , . I O 微调与 ⌘Z/⌘S；保存=整卷 PUT 直改\n line_times.json + manual.original 留档（沿 clamped_from 纪律），指纹乐观锁 409 +\n 执行中 409（文件双写者显式登记）；重跑 fail closed（409 MANUAL_EDITS_PRESENT →\n confirmDiscardManualEdits）+ 自动备份 .manual-backups/（永不自动套用）；reconcile 单源\n lib/manual-edits.ts、产物定位单源 lib/review-artifacts.ts（读/写/守卫共用 _p2 优先）；\n 蓝图 docs/domain/review-manual-timing-blueprint.md + owner-matrix 登记\n- 走带整曲播放链路（前一轮未提交部分随本提交入库）：/api/review/full-audio（HTTP Range +\n 扩展名白名单，C28 收口）+ audio-source 单源 + audio-probe fixture + 真波形/seek/跟播/\n 双音源互斥 e2e + 深色三栏工作台改版余量\n- 验收：check:ui 10 用例全绿（新增手改用例：真实鼠标拖字块+真实键盘 [+落盘留档回读+\n 重跑 409+还原清 manual+指纹/非法/穿越负向矩阵），地板 ui 7→10、ownTestCases 62→66；\n pnpm check 静态全链绿；备份路径 live 实证（confirm→备份含手改值）\n- 教训入册（G18）：浏览器面板按键注入不带 e.code，快捷键实测须真键盘/Playwright；\n 拖动手势收 buttons===0 悬停移动防\"粘手\"（pointerup 窗外丢失实锤）\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-08T11:10:41-07:00"},"CompareURL":"luoanwu/songformer-structure-lyrics/compare/88df9fddc74d13ebbc389e8ca265c8953c06bc22...3fdb4053791bac065674586a5173a8a41aa5a0c4","Len":1}...
|
1786212652
|
Edit
Delete
|
|
20957
|
5
|
5
|
5
|
53
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"5fc0d4e18 {"Commits":[{"Sha1":"5fc0d4e18a5b865a166b486b4836bc822e8392d0","Message":"Merge branch 'hljTest' into main\n\n集成豆包歌词起草、Tesla P4 出歌修复(fp32+int8+DiT offload)、\nnginx HTTPS 总入口 + systemd 常驻部署、web basePath '/song'。\n\nCo-Authored-By: Claude Opus 4.8 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-05T20:59:21-07:00"},{"Sha1":"67970c1b0a1dcb0e91d17be0a26611d01e28f35c","Message":"feat: 歌曲在线回放链路 + 曲库播放 UI\n\n- 新增 song-playback.service.ts:短时随机凭证签发，浏览器分段播放\n- songs.controller.ts:Range 响应支持 FLAC 分段流式回放，不预下载\n- LibraryView 接入在线播放交互；api.ts/contracts 同步回放契约\n- 刷新治理 reports 与 GPU 部署校验(check-deployment.mjs)\n\nCo-Authored-By: Claude Opus 4.8 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-05T20:59:07-07:00"},{"Sha1":"da3f6895d371408052023bc1698549e1f348f04a","Message":"chore(web): 整合服务器部署接入 basePath: '/song'\n\nnginx 整合服务器 (/etc/nginx/sites-enabled/00-incoming.conf) 已按\nbasePath 模式把 /song/* 反代到本仓 web(:3101)、/song-api/* 反代到\nAPI(:3201)。web 不加 basePath 时 next 端对 /_next/* 资源按根路径\n提供，nginx 转发到 :3101 后 404。\n\n改动：\n- 非 capacitor 构建启用 basePath: '/song'（capacitor 静态导出仍\n 走 out/，绝对 URL 直连后端，不需 basePath）。\n- 增补一段注释说明与 nginx /song 路由的对应关系。\n\ndev 访问 http://localhost:3101/song/，与 generation.g-hi.com\n线上 /song/ 同源。\n\nCo-authored-by: Qwen-Coder \u003cqwen-coder@alibabacloud.com\u003e\n","AuthorEmail":"luoanwu@g-hi.com","AuthorName":"luoanwu","CommitterEmail":"luoanwu@g-hi.com","CommitterName":"luoanwu","Timestamp":"2026-08-04T14:13:00+08:00"},{"Sha1":"04835a06e70f200230a21a912961afcbd6c503fd","Message":"docs: 重写 docs/README 为本项目(歌词→歌曲批量生产)说明\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-07-30T14:45:29+08:00"},{"Sha1":"e8b913f5667fb8a1812a240ef11d6dc579839351","Message":"chore(deploy): 纳入 nginx HTTPS 总入口配置与部署说明\n\ngeneration.g-hi.com 经 nginx(443) 分流：/ws→3201、其余→3101(Next)，\nHTTP 跳转 HTTPS；IP/其它域名兜底回退到同机 voiceprint(8443)。\n配置与说明沉淀到 deploy/nginx/，并同步更新 systemd/README 的服务拓扑。\n证书与 .env 不入库。\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-07-30T14:22:31+08:00"}],"HeadCommit":{"Sha1":"5fc0d4e18a5b865a166b486b4836bc822e8392d0","Message":"Merge branch 'hljTest' into main\n\n集成豆包歌词起草、Tesla P4 出歌修复(fp32+int8+DiT offload)、\nnginx HTTPS 总入口 + systemd 常驻部署、web basePath '/song'。\n\nCo-Authored-By: Claude Opus 4.8 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-05T20:59:21-07:00"},"CompareURL":"luoanwu/song-generation/compare/d28a8594e6cf9091cdf9ccd0fad377041dfaf727...5fc0d4e18a5b865a166b486b4836bc822e8392d0","Len":9}...
|
1785990478
|
Edit
Delete
|
|
20884
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/feat/multi-role-assignment
|
0
|
{"Commits":[{"Sha1":"be1e0734c {"Commits":[{"Sha1":"be1e0734c39315b61a7bf452231a853f44866085","Message":"test(manual): 采集 spec 适配工作台 UI 改版（1–11 章绿，余记 backlog）\n\n2026-08-04 UI 改版（侧栏 6 组折叠 + 视图切换器、收款抽屉、后果确认框铺开、\n公开页一方案一链接单档投影、合同定稿成为激活前置）让手册截图采集大面积失效\n（采集是「有环境才跑、非门禁」的真实运行任务，改版后没有门禁会红——正是本仓\n两次为文档漂移付代价的形态 C14/C25）。\n\n本轮适配并经 build:manual 实跑通过第 1–11 章：\n- 移植 openWorkspaceEntry + workspaceTab helper，折叠入口（报价5/履约4/售后8）\n 改走「组条目 → 视图切换器 tab」的真实用户路径；第 1 章 nav-group 标注按 6 组重写\n- 报价发送补 send-quotation-dialog「确认发送」；申请合同补\n quotation-request-contract-dialog 确认；客户报价页去掉已下线的「选择方案」下拉、\n 「打开客户页」多档链接取 .first()\n- 第 13 章收款改为「选单 → 开 open-receivables-drawer 抽屉 → 切分期/收款 tab」，\n 状态标签改中文（RECORDED→待确认到账）\n\n未完成（文件头 backlog 详列）：合同定稿新章节（激活前置，需先建模板）、收款抽屉\n后半（14 章开票/红冲/退款）、确认框簇、售后流水线；正文与 manifest 待全章绿后统一重生成。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-05T18:32:06-07:00"}],"HeadCommit":{"Sha1":"be1e0734c39315b61a7bf452231a853f44866085","Message":"test(manual): 采集 spec 适配工作台 UI 改版（1–11 章绿，余记 backlog）\n\n2026-08-04 UI 改版（侧栏 6 组折叠 + 视图切换器、收款抽屉、后果确认框铺开、\n公开页一方案一链接单档投影、合同定稿成为激活前置）让手册截图采集大面积失效\n（采集是「有环境才跑、非门禁」的真实运行任务，改版后没有门禁会红——正是本仓\n两次为文档漂移付代价的形态 C14/C25）。\n\n本轮适配并经 build:manual 实跑通过第 1–11 章：\n- 移植 openWorkspaceEntry + workspaceTab helper，折叠入口（报价5/履约4/售后8）\n 改走「组条目 → 视图切换器 tab」的真实用户路径；第 1 章 nav-group 标注按 6 组重写\n- 报价发送补 send-quotation-dialog「确认发送」；申请合同补\n quotation-request-contract-dialog 确认；客户报价页去掉已下线的「选择方案」下拉、\n 「打开客户页」多档链接取 .first()\n- 第 13 章收款改为「选单 → 开 open-receivables-drawer 抽屉 → 切分期/收款 tab」，\n 状态标签改中文（RECORDED→待确认到账）\n\n未完成（文件头 backlog 详列）：合同定稿新章节（激活前置，需先建模板）、收款抽屉\n后半（14 章开票/红冲/退款）、确认框簇、售后流水线；正文与 manifest 待全章绿后统一重生成。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-05T18:32:06-07:00"},"CompareURL":"luoanwu/juhai-quotation-system/compare/1334a6214585274050083c387a7fbbb5a591d308...be1e0734c39315b61a7bf452231a853f44866085","Len":1}...
|
1785979947
|
Edit
Delete
|
|
20883
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/feat/multi-role-assignment
|
0
|
{"Commits":[{"Sha1":"1334a6214 {"Commits":[{"Sha1":"1334a6214585274050083c387a7fbbb5a591d308","Message":"docs(governance): C29 二次复发回灌——修复挂错消费者 + 内部提交路径零覆盖\n\n对抗式点击测试实打提交时抓到：C29 当初的「resolver 前预生成」只打到公开客户表单，\n内部售后工作台建单表单遗漏，点提交静默无 POST。已修（bf77845）+ 回归锁（a3dd491）。\nC29 行补记复发经过与通用教训：一个 bug 的修复挂在某个消费者上时，必须问同一 contracts\nschema 的其他消费者有没有同一个坑，并让门禁覆盖每一条提交路径而非只覆盖第一条。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-05T17:50:36-07:00"}],"HeadCommit":{"Sha1":"1334a6214585274050083c387a7fbbb5a591d308","Message":"docs(governance): C29 二次复发回灌——修复挂错消费者 + 内部提交路径零覆盖\n\n对抗式点击测试实打提交时抓到：C29 当初的「resolver 前预生成」只打到公开客户表单，\n内部售后工作台建单表单遗漏，点提交静默无 POST。已修（bf77845）+ 回归锁（a3dd491）。\nC29 行补记复发经过与通用教训：一个 bug 的修复挂在某个消费者上时，必须问同一 contracts\nschema 的其他消费者有没有同一个坑，并让门禁覆盖每一条提交路径而非只覆盖第一条。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-05T17:50:36-07:00"},"CompareURL":"luoanwu/juhai-quotation-system/compare/a3dd4914eeaa83dc5ac32695829417bdf1faf44a...1334a6214585274050083c387a7fbbb5a591d308","Len":1}...
|
1785977443
|
Edit
Delete
|
|
20882
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/feat/multi-role-assignment
|
0
|
{"Commits":[{"Sha1":"a3dd4914e {"Commits":[{"Sha1":"a3dd4914eeaa83dc5ac32695829417bdf1faf44a","Message":"test(web): E2E 覆盖内部售后建单表单提交（C29 回潮回归锁）\n\n上一提交（bf77845）修了内部售后工作台建单表单静默无 POST 的 bug，但 E2E 此前\n只覆盖公开客户表单（public-after-sales-create）的提交，内部工作台表单\n（after-sales-create-card）提交路径长期零覆盖——正是这个盲区让 C29 二次复发\n逃过所有门禁。\n\n本回归锁在履约闭环用例末尾走内部表单真实提交：选订单→联动带出商品→填量与原因→\n点「提交售后申请」，用 waitForResponse 捕 POST /api/after-sales。C29 回潮的形态是\n「提交静默无请求」，届时 waitForResponse 超时即红。状态断言用 \u003c500 而非 pin 201：\n本用例前序公开售后已在同一交付订单消耗过退货额度，内部再建可能 201 或 409，\n两者都证明「客户端校验通过 + POST 真发出 + 服务端处理」这条链通畅。\n\n负向验证（本会话）：撤掉 AfterSalesWorkbench 挂载预生成后重跑 check:ui，本断言在\nwaitForResponse 处超时判红（error-context 确认按钮 active、表单已填、无 response）；\n恢复修复后 12/12 复绿。报告 status=passed，绑定 bf77845。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-05T17:46:57-07:00"}],"HeadCommit":{"Sha1":"a3dd4914eeaa83dc5ac32695829417bdf1faf44a","Message":"test(web): E2E 覆盖内部售后建单表单提交（C29 回潮回归锁）\n\n上一提交（bf77845）修了内部售后工作台建单表单静默无 POST 的 bug，但 E2E 此前\n只覆盖公开客户表单（public-after-sales-create）的提交，内部工作台表单\n（after-sales-create-card）提交路径长期零覆盖——正是这个盲区让 C29 二次复发\n逃过所有门禁。\n\n本回归锁在履约闭环用例末尾走内部表单真实提交：选订单→联动带出商品→填量与原因→\n点「提交售后申请」，用 waitForResponse 捕 POST /api/after-sales。C29 回潮的形态是\n「提交静默无请求」，届时 waitForResponse 超时即红。状态断言用 \u003c500 而非 pin 201：\n本用例前序公开售后已在同一交付订单消耗过退货额度，内部再建可能 201 或 409，\n两者都证明「客户端校验通过 + POST 真发出 + 服务端处理」这条链通畅。\n\n负向验证（本会话）：撤掉 AfterSalesWorkbench 挂载预生成后重跑 check:ui，本断言在\nwaitForResponse 处超时判红（error-context 确认按钮 active、表单已填、无 response）；\n恢复修复后 12/12 复绿。报告 status=passed，绑定 bf77845。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-05T17:46:57-07:00"},"CompareURL":"luoanwu/juhai-quotation-system/compare/bf778452d29f9965677f5d7eafdbd98843ef0ac6...a3dd4914eeaa83dc5ac32695829417bdf1faf44a","Len":1}...
|
1785977229
|
Edit
Delete
|
|
20881
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/feat/multi-role-assignment
|
0
|
{"Commits":[{"Sha1":"bf778452d {"Commits":[{"Sha1":"bf778452d29f9965677f5d7eafdbd98843ef0ac6","Message":"fix(web): 内部售后建单表单幂等键在 resolver 前预生成（C29 回潮）\n\nAfterSalesWorkbench 的 CreateCaseForm 点「提交售后申请」静默无反应——\n不发请求、无报错。根因是 C29 的同一形态：idempotencyKey 默认 \"\"，只在\nsubmit 回调**内部**用 `|| crypto.randomUUID()` 兜底；但 zodResolver 的\n`min(1)` 先于回调校验空串失败，回调永不执行、兜底成死代码；该字段又无输入框，\nFormMessage 无处渲染，用户零反馈。\n\nC29 的修复此前只打到公开客户表单 PublicFulfillmentView（挂载后预生成），\n没打到内部工作台表单。E2E 只走公开表单提交路径，HTTP 验收直接带 key 打 API，\n内部建单提交路径零覆盖——「测试路径 ≠ 运行路径」(P1)。\n\n修复：挂载后 useEffect 预生成 idempotencyKey（镜像公开表单）；本表单提交后\nform.reset() 会把键清空，故 reset 后补发一次，保证可连续建单。\n\n验证（本地工作区，2026-08-05）：\n- web typecheck 通过\n- 浏览器实测：客服建单 POST /api/after-sales → 201；自批 403 SELF_APPROVAL_FORBIDDEN；\n 换审批人 200；退款额度 ¥110,000 冻结\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-05T17:31:03-07:00"}],"HeadCommit":{"Sha1":"bf778452d29f9965677f5d7eafdbd98843ef0ac6","Message":"fix(web): 内部售后建单表单幂等键在 resolver 前预生成（C29 回潮）\n\nAfterSalesWorkbench 的 CreateCaseForm 点「提交售后申请」静默无反应——\n不发请求、无报错。根因是 C29 的同一形态：idempotencyKey 默认 \"\"，只在\nsubmit 回调**内部**用 `|| crypto.randomUUID()` 兜底；但 zodResolver 的\n`min(1)` 先于回调校验空串失败，回调永不执行、兜底成死代码；该字段又无输入框，\nFormMessage 无处渲染，用户零反馈。\n\nC29 的修复此前只打到公开客户表单 PublicFulfillmentView（挂载后预生成），\n没打到内部工作台表单。E2E 只走公开表单提交路径，HTTP 验收直接带 key 打 API，\n内部建单提交路径零覆盖——「测试路径 ≠ 运行路径」(P1)。\n\n修复：挂载后 useEffect 预生成 idempotencyKey（镜像公开表单）；本表单提交后\nform.reset() 会把键清空，故 reset 后补发一次，保证可连续建单。\n\n验证（本地工作区，2026-08-05）：\n- web typecheck 通过\n- 浏览器实测：客服建单 POST /api/after-sales → 201；自批 403 SELF_APPROVAL_FORBIDDEN；\n 换审批人 200；退款额度 ¥110,000 冻结\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-05T17:31:03-07:00"},"CompareURL":"luoanwu/juhai-quotation-system/compare/d6b659343565a590d5c9d75adecc62710643a553...bf778452d29f9965677f5d7eafdbd98843ef0ac6","Len":1}...
|
1785976276
|
Edit
Delete
|
|
20880
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/feat/multi-role-assignment
|
0
|
{"Commits":[{"Sha1":"d6b659343 {"Commits":[{"Sha1":"d6b659343565a590d5c9d75adecc62710643a553","Message":"feat(web): 工作台 UI 改版 + 采购/客服权限补齐 + 订单收款列摘要\n\n前端工作台按侧栏 6 组流水线重组导航，新增 WorkspaceViewSwitcher / AfterSalesPipeline\n与 Drawer/Breadcrumb/Segmented/Toast/ErrorAlert 原语；收款面板从 964 行拆抽屉编排并\n从 component-size 登记表毕业；设计令牌换画布 #e9e9e3 并加深 muted/brand-strong 回 AA。\n\n契约与后端：\n- contracts 新增 formatCents 单源，收口前端 4 份 money 实现与后端错误文案的金额漂移\n- SalesOrderView.shipmentGate 可选字段：订单列表「收款」列摘要，与发运门禁共用\n evaluateShipmentPaymentGate + toGateInstallments 投影，现算不落汇总列\n- ROLE_PERMISSION_MAP 补 PROCUREMENT/CUSTOMER_SERVICE 只读集合（product.read /\n customer.read / fulfillment.order.read），不含写权限与敏感成本列\n\n验收（当前工作区，2026-08-05）：\n- pnpm check 全绿（typecheck 强制重跑 Cached:0/7）\n- check:runtime 470/470（contracts 372 / NestJS 49 / Fastify 49），含 shipmentGate 三态\n- check:ui 12/12\n- 对抗探测：鉴权无回退/跨租户404/自批403/状态机409/并发恰好一次 均实测有牙\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-05T11:17:13-07:00"},{"Sha1":"ec411c0e6fb0c5cbcebb686f67b01cb355c29665","Message":"docs(analysis): 前端 UI 诊断报告 2026-08-04（并发治理会话产出）\n\n29 入口/84 组件/42 useQuery/81 useMutation 只读走查：流程断裂（仅 1 个跨域跳转）、\n反馈缺位（81 个 mutation 零成功提示）、重复实现（money 格式化 4 份）三条问题线，\n含 1 个多角色待办入口丢失的真 bug 与文末 Top5 修复建议。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-04T09:20:22-07:00"}],"HeadCommit":{"Sha1":"d6b659343565a590d5c9d75adecc62710643a553","Message":"feat(web): 工作台 UI 改版 + 采购/客服权限补齐 + 订单收款列摘要\n\n前端工作台按侧栏 6 组流水线重组导航，新增 WorkspaceViewSwitcher / AfterSalesPipeline\n与 Drawer/Breadcrumb/Segmented/Toast/ErrorAlert 原语；收款面板从 964 行拆抽屉编排并\n从 component-size 登记表毕业；设计令牌换画布 #e9e9e3 并加深 muted/brand-strong 回 AA。\n\n契约与后端：\n- contracts 新增 formatCents 单源，收口前端 4 份 money 实现与后端错误文案的金额漂移\n- SalesOrderView.shipmentGate 可选字段：订单列表「收款」列摘要，与发运门禁共用\n evaluateShipmentPaymentGate + toGateInstallments 投影，现算不落汇总列\n- ROLE_PERMISSION_MAP 补 PROCUREMENT/CUSTOMER_SERVICE 只读集合（product.read /\n customer.read / fulfillment.order.read），不含写权限与敏感成本列\n\n验收（当前工作区，2026-08-05）：\n- pnpm check 全绿（typecheck 强制重跑 Cached:0/7）\n- check:runtime 470/470（contracts 372 / NestJS 49 / Fastify 49），含 shipmentGate 三态\n- check:ui 12/12\n- 对抗探测：鉴权无回退/跨租户404/自批403/状态机409/并发恰好一次 均实测有牙\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-05T11:17:13-07:00"},"CompareURL":"luoanwu/juhai-quotation-system/compare/3ab4474b6c62c031d9016986285fed531904c82c...d6b659343565a590d5c9d75adecc62710643a553","Len":2}...
|
1785953861
|
Edit
Delete
|
|
20661
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/feat/multi-role-assignment
|
0
|
{"Commits":[{"Sha1":"3ab4474b6 {"Commits":[{"Sha1":"3ab4474b6c62c031d9016986285fed531904c82c","Message":"chore(governance): REDIS_URL 运行时 fail-closed 绊网与报告聚合接线（并发治理会话收尾）\n\nN6：G15 只在 runner preflight 强制显式 REDIS_URL，应用运行时仍会静默默认\nlocalhost:6379——队列投空、pub/sub 静默丢事件且零日志。四个连接位点\n（双后端 BullMQ + pub/sub）全部接入 fail-closed 判定，governance-report 聚合随之扩展。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-04T06:57:12-07:00"},{"Sha1":"a82bc613d079d5b14ccdc66d2b901d99d980403f","Message":"chore(governance): 刷新证据行与棘轮——tests 470、own-test-cases 332、UI 12 含死路恢复链\n\n- CLAUDE.md 真源地图新增「履约死路恢复」条目；G16 条目按事务级咨询锁机制修正\n （含连接池滞留 bug 的完整教训与绊网口径）\n- 动态区证据行：静态/runtime/UI 三级 2026-08-04 实跑全绿，作用域＝本地工作区\n- 棘轮收紧：testsPassed 465→470（byPackage 372/49/49）、ownTestCases 327→332、\n gateSelftests 8→14\n- reports/*.latest.json 为终链同 run 产物（provenance 一致）\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-04T06:56:25-07:00"},{"Sha1":"68fe619dbf7752a2bdd058e16fa81fa13653e323","Message":"chore(governance): 新增 sites/component-size 门禁、Redis fail-closed 与依赖范围对齐（并发治理会话）\n\n- check:sites-governance / check:component-size 两个新门禁接入 check 链（含负向自检）\n- Redis URL fail-closed 与队列前缀模块收口\n- 双后端依赖范围从 ^X.0.0 对齐到实际锁定版本邻域（N7 断言配套）\n- pnpm-lock.yaml 同步 specifier（仅 5 行，锁定版本零变化）——不同步则干净\n checkout 上 frozen install 直接 ERR_PNPM_OUTDATED_LOCKFILE\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-04T06:56:01-07:00"},{"Sha1":"4b637592aa9a1af503cbc7bf02e9e7fafa166f49","Message":"style(web): 移动导航搜索与首页视觉打磨（并发治理会话工作，随本轮一并落库）\n\n移动端「更多」菜单搜索、退款入口定位与首页布局打磨及配套 E2E 断言。\n本切片由并发治理会话实现并已随本轮三级门禁（check / runtime 470 / UI 12）整体验证。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-04T06:56:01-07:00"},{"Sha1":"da3230ece27359e62fd0945dd9d74a79f04fef83","Message":"fix(events): outbox 选主改事务级咨询锁——会话级锁在连接池上滞留导致投递饿死\n\nG16 领取锁闭环（初版为并发治理会话实现，本提交含其 dispatcher 失败判责拆分与\ndual-backend N7 依赖断言，一并落库）。当日实锤修正：\n\n会话级 pg_try_advisory_lock + pg_advisory_unlock 各发一条 $queryRaw——Prisma 是\n连接池，加锁与解锁大概率落在不同池化连接：锁被闲置连接永久滞留，集群投递静默\n饿死。欺骗性极强：低并发 vitest 全绿（池内单连接复用），check:ui 高并发下三连红\n且失败点漂移（前几步实时刷新正常、后面某步等失效超时）。\n\n改为事务级 pg_try_advisory_xact_lock：在 $transaction 事务客户端上取锁，提交/回滚\n自动释放，「解锁落错连接」结构上不可达；锁查询失败＝事务抛错＝本轮不跑批\n（fail-closed 不变）。事务只为持锁而存在，批内行更新仍走连接池。\n\n绊网同步翻转：xact 锁在位/事务客户端取锁/锁结果闸住跑批/会话级回潮即红/失败阶段\n判责/双端锁键对齐；定位锚用调用形态而非裸词（防注释锁名抢占第一处匹配，G13 同型）。\n12 条负向自检全绿，check:ui 12/12 复绿实证实时链恢复。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-04T06:55:43-07:00"}],"HeadCommit":{"Sha1":"3ab4474b6c62c031d9016986285fed531904c82c","Message":"chore(governance): REDIS_URL 运行时 fail-closed 绊网与报告聚合接线（并发治理会话收尾）\n\nN6：G15 只在 runner preflight 强制显式 REDIS_URL，应用运行时仍会静默默认\nlocalhost:6379——队列投空、pub/sub 静默丢事件且零日志。四个连接位点\n（双后端 BullMQ + pub/sub）全部接入 fail-closed 判定，governance-report 聚合随之扩展。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-04T06:57:12-07:00"},"CompareURL":"luoanwu/juhai-quotation-system/compare/dddca39245dbd8ff6caea7a87c7e48de227e2daa...3ab4474b6c62c031d9016986285fed531904c82c","Len":6}...
|
1785852216
|
Edit
Delete
|
|
20660
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/feat/multi-role-assignment
|
0
|
{"Commits":[{"Sha1":"dddca3924 {"Commits":[{"Sha1":"dddca39245dbd8ff6caea7a87c7e48de227e2daa","Message":"Enforce after-sales lifecycle gates and approval inbox integration\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-04T04:24:41-07:00"},{"Sha1":"c3ea882a2a67fdb7799a39b0d69278e7de50124b","Message":"feat: complete governed business lifecycle\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-03T20:59:05-07:00"}],"HeadCommit":{"Sha1":"dddca39245dbd8ff6caea7a87c7e48de227e2daa","Message":"Enforce after-sales lifecycle gates and approval inbox integration\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-04T04:24:41-07:00"},"CompareURL":"luoanwu/juhai-quotation-system/compare/7a0c7fc472beebeaac8232aaff49889c3cb97fa0...dddca39245dbd8ff6caea7a87c7e48de227e2daa","Len":2}...
|
1785842687
|
Edit
Delete
|
|
20428
|
5
|
5
|
5
|
67
|
0
|
0
|
refs/heads/claude/clever-morse-0c9e45
|
0
|
{"Commits":[{"Sha1":"20f1c2e12 {"Commits":[{"Sha1":"20f1c2e121df86352990d766deeca892bda3983a","Message":"治理: C29 关闭——导出层双出口收口 + apps/web 首个 vitest 纯函数层，testsPassed 地板 56→85\n\n两处实锤缺陷同根因收口（纯函数困在 route.ts 不可 import 不可测）：\n- line_times 查找单源 review-paths.ts：export 曾只看 \u003csong\u003e_p2/ 漏 \u003csong\u003e/ 兜底，\n cli 直跑产物页面能渲染、导出却 409（dev server 实测修复后 409→200）；\n 4 个 review 路由的 WORKDIR 口径与两级查找一并收口（audio segments 同款漂移）\n- 时间戳/G29 分组/忠实性纯函数单源 export-format.ts：ASS 分支局部 assT 绕过\n clockParts，真实数据 start=59.996 渲染 0:00:60.00 非法时间戳（修复后 0:01:00.00）\n\nvitest 29 例 TDD 先红后绿（先红 3 例精确命中两缺陷）；test 脚本挂入 turbo 后被\ncheck:runtime 强制执行——testsPassed 地板 56→85、ownTests 13、ownTestCases 92。\n三级门禁实跑：pnpm check exit 0 / check:runtime passed(85) / check:ui 7/7。\n\n副产物：登记 G30（docs-truth no-ghost-path 用 existsSync 校验 models/ 路径而\n权重不进 git，全新检出必红三条——G24 外第三处 CI 结构性必红）。\nlaunch.json 新增 web-export-proof 取证通道（REVIEW_WORKDIR 注入 + 隔离 distDir）。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-03T20:11:28-07:00"}],"HeadCommit":{"Sha1":"20f1c2e121df86352990d766deeca892bda3983a","Message":"治理: C29 关闭——导出层双出口收口 + apps/web 首个 vitest 纯函数层，testsPassed 地板 56→85\n\n两处实锤缺陷同根因收口（纯函数困在 route.ts 不可 import 不可测）：\n- line_times 查找单源 review-paths.ts：export 曾只看 \u003csong\u003e_p2/ 漏 \u003csong\u003e/ 兜底，\n cli 直跑产物页面能渲染、导出却 409（dev server 实测修复后 409→200）；\n 4 个 review 路由的 WORKDIR 口径与两级查找一并收口（audio segments 同款漂移）\n- 时间戳/G29 分组/忠实性纯函数单源 export-format.ts：ASS 分支局部 assT 绕过\n clockParts，真实数据 start=59.996 渲染 0:00:60.00 非法时间戳（修复后 0:01:00.00）\n\nvitest 29 例 TDD 先红后绿（先红 3 例精确命中两缺陷）；test 脚本挂入 turbo 后被\ncheck:runtime 强制执行——testsPassed 地板 56→85、ownTests 13、ownTestCases 92。\n三级门禁实跑：pnpm check exit 0 / check:runtime passed(85) / check:ui 7/7。\n\n副产物：登记 G30（docs-truth no-ghost-path 用 existsSync 校验 models/ 路径而\n权重不进 git，全新检出必红三条——G24 外第三处 CI 结构性必红）。\nlaunch.json 新增 web-export-proof 取证通道（REVIEW_WORKDIR 注入 + 隔离 distDir）。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-03T20:11:28-07:00"},"CompareURL":"luoanwu/songformer-structure-lyrics/compare/88df9fddc74d13ebbc389e8ca265c8953c06bc22...20f1c2e121df86352990d766deeca892bda3983a","Len":1}...
|
1785813098
|
Edit
Delete
|
|
20427
|
5
|
5
|
5
|
67
|
0
|
0
|
refs/heads/claude/clever-morse-0c9e45
|
0
|
|
1785813098
|
Edit
Delete
|
|
20409
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/feat/multi-role-assignment
|
0
|
{"Commits":[{"Sha1":"7a0c7fc47 {"Commits":[{"Sha1":"7a0c7fc472beebeaac8232aaff49889c3cb97fa0","Message":"chore(governance): 刷新报告与证据行，清理 tsconfig 临时产物残留\n\n- `apps/web/tsconfig.json`：C28 工作区卫生自愈剥掉 `.next-ui-14845` 残留\n （check:ui 的独立 distDir 会把该路径写进被跟踪的 tsconfig）\n- `reports/*.latest.json`：本轮 `pnpm check` 重跑产物，provenance 绑定当前工作区\n- `CLAUDE.md` 证据行：**含并行会话在同一 checkout 的更新**（客户勘测提交相关，\n 非本会话产出），已与本轮交付培训内容合并，未覆盖任何一方\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-03T10:40:43-07:00"},{"Sha1":"167d026f912b2b17c9e4380a5eb18d1d50130751","Message":"feat(fulfillment): 交付培训成为硬卡点——安装完成前使用培训、服务关闭前运维培训\n\n用户裁决两条：培训是**硬卡点**而非记录；由各自角色做、记录客方参加人，\n不引入客户在线签收（本仓无实名认证，凭链接签收只能是具名降级）。\n\n## 卡点做成结构约束，不是运行时 if\n- 安装：`IN_PROGRESS --deliver_training--\u003e TRAINING --complete--\u003e COMPLETED`\n- 客服：`IN_SERVICE --deliver_operation_training--\u003e OPERATION_TRAINING --close--\u003e CLOSED`\n\n⚠️ **安装工单此前根本没有状态机**——三个状态靠 `updateMany` 的 where 条件硬走，\n不受 assertTransition 与状态机不变量守护。本轮补齐 `installationMachine` 并登记进\n不变量表（11 条结构断言自动生效）。否则新卡点又是一条只靠 if、没有结构保障的规则。\n\n客服侧相反：它本来就走 assertTransition，所以在 contracts 插入 `OPERATION_TRAINING`\n态之后，「服务中直接关单」**一行服务端代码都不用改**就自动变成 INVALID_TRANSITION。\n这个对比正是状态机单源的价值。\n\n## 参加人必填是刻意的\n`attendees` 记的是**客方名单**——培训的价值在于「谁被教会了」，不是「谁去讲了」。\n讲师取已验签 actor，不由客户端填，免得填错或冒名。一场没有参加人的培训等于没培训，\n允许留空就等于允许走过场。\n\n## 过程中挖出两处真问题\n1. **动作白名单是双真源**：两端各有一份手抄的 `[\"accept\",\"start\",\"close\"]`，\n 与 contracts 的 `SERVICE_HANDOFF_EVENTS` 平行维护。加了新事件而拷贝不知道，\n 表现是 400「Unsupported action」——排查时很难联想到「白名单没跟上」。\n 已改为两端都读 contracts 事件全集。\n2. **Zod 静默剥字段**：`acceptServiceHandoffSchema` 没登记 `attendees`，\n 请求里填了也会被剥掉，服务端于是说「没填参加人」——**调用方明明填了却被告知没填**，\n 这类不一致最难自查。已在 contracts 补登记并注明。\n\n## 一处「类型绿但数据没出来」\n客服读模型是**白名单重建对象字面量**（C20：不得泄漏成本/毛利/审批意见），\n返回类型是推断的，漏投影新字段**不会有任何编译错误**。安装侧是泛型透传所以自动带上，\n客服侧必须显式列出。已补，并由 `handoff-training-projected-*` 断言守住。\n\n## 界面\n安装工单进度四段（待开始/现场安装/使用培训/客户验收），段位改为按状态映射——\n原来是硬编码 if 链，新增状态会静默停在旧段位。安装中显示培训表单，\n完工表单挪到培训之后；客服服务中显示运维培训表单，关单挪到培训之后。\n\n## 门禁（4 条断言 + 4 条负向注入）\n`installation-training-required-*`、`training-attendees-required-*`、\n`handoff-action-allowlist-single-source-*`、`handoff-training-projected-*`。\n另收紧一条既有断言：完工表单必须挂在 **TRAINING** 段（原来锚的是两个标记的邻近性，\n插入培训表单后被撑开而误报；真正该守的是「完工在培训之后」，锚这个既更强也不怕插内容）。\n自检从 5 条扩到 9 条，均实跑判红。\n\n## 三级门禁证据（本地工作区，PG:55432 + Redis:6382）\n- `pnpm check` exit 0；门禁自检 9 条负向注入\n- `pnpm check:runtime` **413/413**（地板 380→400）\n- `pnpm check:ui` **12/12**，unexpected 0；E2E 断言「安装中不应出现完工按钮」\n ——卡点只在服务端而界面仍能诱导用户走错路，同样是缺陷\n\n## 未做\n客服交接的 E2E 里没有关单步骤，**运维培训卡点缺浏览器级证据**（HTTP 层已覆盖）。\n本次 runtime 增量含并行会话在同一 checkout 写入的约 400 行 HTTP 验收，非本会话产出。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-03T10:36:05-07:00"}],"HeadCommit":{"Sha1":"7a0c7fc472beebeaac8232aaff49889c3cb97fa0","Message":"chore(governance): 刷新报告与证据行，清理 tsconfig 临时产物残留\n\n- `apps/web/tsconfig.json`：C28 工作区卫生自愈剥掉 `.next-ui-14845` 残留\n （check:ui 的独立 distDir 会把该路径写进被跟踪的 tsconfig）\n- `reports/*.latest.json`：本轮 `pnpm check` 重跑产物，provenance 绑定当前工作区\n- `CLAUDE.md` 证据行：**含并行会话在同一 checkout 的更新**（客户勘测提交相关，\n 非本会话产出），已与本轮交付培训内容合并，未覆盖任何一方\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-03T10:40:43-07:00"},"CompareURL":"luoanwu/juhai-quotation-system/compare/744d532b80ba3fd239cfbdd2b3700e3d73c08675...7a0c7fc472beebeaac8232aaff49889c3cb97fa0","Len":2}...
|
1785778851
|
Edit
Delete
|
|
20408
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/feat/multi-role-assignment
|
0
|
{"Commits":[{"Sha1":"744d532b8 {"Commits":[{"Sha1":"744d532b80ba3fd239cfbdd2b3700e3d73c08675","Message":"test(governance): 三级门禁全绿——runtime 396/396、UI 12/12，合同与多角色补齐验收\n\n本轮把欠了整条线的运行态证据补齐：静态 → 真实 DB → 浏览器三级全部实跑通过。\n\n## 合同域门禁（5 条断言 + 自检固化）\n`check:module-integration` 新增：渲染必须调 contracts 纯函数、清单必须走 contracts\n清洗、定稿必须校验金额、激活必须要求合同已定稿、合同列表必须有自己的读模型。\n5 条负向注入逐条实跑判红，并固化进 `scripts/lib/contract-integration.test.mjs`\n（fixture 隔离，不碰真文件；配「未注入 → 绿」基线用例，防止所有\"期望红\"\n以完全错误的理由通过）。gateSelftests 地板 6 → 7。\n\n其中「合同列表必须有自己的读模型」防的是真实发生过的缺陷：\n借用「待激活申请」options（只返 REQUESTED）会让财务一激活，刚签的合同就从界面消失。\n\n## 状态机不变量逼出的设计修正\n`contractMachine` 原本是 `DRAFT ⇄ FINALIZED` 的**无终态环**——合同永远走不完，\n而\"订单已激活则不可修改\"只是运行时守卫。contracts 的状态机不变量测试\n（\"从任一状态都能走到终态\"）当场判红。加终态 `EFFECTIVE`，由财务激活时迁入：\n`revise` 从 EFFECTIVE 出发在**状态机层面就不存在**，运行时检查降为第二层。\n\n## 修掉一个我自己制造的严重问题\n早先用批量正则把测试里的 `role:` 改成 `roles:`，**误伤 153 处 `api()` helper 入参**。\n该 helper 收的是 `role`，`roles` 被静默忽略并回落成默认 ADMIN——\n**测试照样绿，但所有「某角色应当 403」的负例都退化成「ADMIN 当然 200」**。\n已全部回退。教训：批量正则改测试比改源码危险得多，源码有编译器兜底，测试没有。\n\n## 修掉一处静默降级（用户反馈两次）\n`draft()` 里 `template ? render(...) : \"\"`——取不到默认模板就给空正文，不报错不提示。\n而\"合同建出来了、正文是空的\"在界面上与\"模板没生效\"完全一样。改为：\n默认模板优先，没设默认但只有一个模板时直接采用；仍取不到时界面明确说明原因。\n另补「套用模板」选择器——此前 `templateId` 存了却从不重渲染，已有合同换不了模板。\n\n## 版式\n按反馈调整为：套用模板 → 合同正文 → 合同清单。\n打印改为只打这一份合同：`@media print` 内 5 条规则（全页隐藏 → 放行合同卡 →\n正文去滚动上限并允许换行 → 按钮与留证快照不打印），沿用配货单打印同一模式，\n含「window.print() 必须在原始 click 内同步调用」那条硬约束。\n\n## 三级门禁证据（本地工作区）\n- `pnpm check` exit 0；门禁自检 8 组\n- `pnpm check:runtime` **396/396**（地板抬至 380），双后端 HTTP 各 45/45\n- `pnpm check:ui` **12/12**，unexpected 0（地板抬至 12）\n- 新增双后端 HTTP 验收：未定稿激活 409 CONTRACT_NOT_FINALIZED、\n 改金额定稿 409 CONTRACT_TOTAL_MISMATCH、合同清单只有对客七列且不含 cost\n- 新增 E2E 真实界面链路：建模板 → 生成合同 → 断言正文按模板渲染 →\n 定稿 → 只读预览 → 激活\n\n## 顺带修复的真账\n多角色改造遗留：两后端测试夹具签单值 role、fromRole/toRole 断言、\nNestJS api() helper 签发、E2E 建账号入参、合同外键 Restrict 导致的清理顺序。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-03T06:17:45-07:00"},{"Sha1":"0e13b856b65685957296087a642c46a9b57c8d0a","Message":"feat(contract): 合同管理界面——模板维护、清单改写、预览与定稿\n\n## 界面三段\n- **模板维护**：正文编辑 + 可用变量清单（真源是 contracts 白名单，不手抄）；\n 默认模板里乙方那几行留了「请填写」占位提示，免得有人以为忘了配变量\n- **合同面板**：清单可改名称/规格/单位/备注，**单价与金额只读**——\n 金额与报价锁死，改写法不改钱，只读比\"改了再被服务端拒绝\"少一次挫败\n- **定稿后**：正文转只读预览 + 打印 + 撤回定稿；留证快照可展开查看\n\n## 浏览器验证时抓到一个真实缺陷\n最初用「待激活申请」的 options 驱动合同列表——而它只返 `status=REQUESTED`。\n结果是**财务一激活，刚签的合同就从界面上凭空消失**。\n补了 `GET /api/contracts` 作为合同自己的读模型（两后端对等），\n视图改为「已有合同 + 尚未起草的待激活申请」两段驱动，后者按 contractRequestId 去重。\n\n这个 bug 单测抓不到，也不会有任何红盘——它只在\"数据恰好处于某状态\"时显形，\n而 dev 库里正好一条 REQUESTED 都没有，所以一打开就是空白。\n\n## 前端不做第二份渲染\n预览直接显示服务端渲染好的 `body`，前端**没有任何占位符处理**。\n在前端补一套 replace 会变成第二份渲染实现（G17 漂移形态）：\n两边看起来一样，直到某天对空值的处理不同，界面上好好的合同打印出来金额是空的。\n\n## 证据（本地工作区）\n- `pnpm check` exit 0；全仓 typecheck 0 错误\n- 浏览器实测：模板维护渲染、合同面板 1 个、状态「已定稿」、清单 1 行、\n 合计 ¥660000.00、预览/撤回定稿/打印按钮齐全（截图见会话）\n- `GET /api/contracts` 返回真实合同（编号、报价号、客户名、合计、定稿时间）\n\n## 未做\nE2E 用例、两后端 HTTP 验收、`check:module-integration` 合同断言均未补（#31）。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-02T23:19:14-07:00"},{"Sha1":"ef882dee3f2d670038bff1151a04e6cb4a4d3d45","Message":"feat(contract): 合同管理落地——模板、清单清洗、预览、定稿快照与激活前置\n\n动手前先证伪了「优化完善」这个词：**本仓此前没有合同**。\n`ContractRequest` 只是流程凭证（状态 + 报价引用 + 拒绝留痕），没有正文、条款、\n甲乙方、签署；「合同管理」视图做的是财务把报价激活成订单，本质是审批队列。\n所以这是新建业务对象，不是加按钮。\n\n## 用户裁决（五条）\n模板+变量填充 / 定稿即快照 / 仅内部预览打印 / 乙方写进模板正文 / 定稿为激活前置。\n另就清单追加两条：只改写法金额锁死 / PUBLIC 附件归入主行备注。\n\n## 合同清单与报价清单是两份不同明细\n报价行 26 列里 9 列是内部的——成本价、底价、成本合计、低于底价标记、调价原因、\n标准价、三种折扣构成。投影**重建对象字面量**而不是删字段，成本列在结构上进不来\n（单测断言 Object.keys 恰为七列，并扫描序列化结果确认成本数字不出现）。\n最隐蔽的一条是 `QuoteLineAccessory.visibility=INTERNAL`：「别显示成本」人人记得，\n「别显示内部附件」没人会想到，因为它藏在子表里。\n\n**金额锁死**先验了算术前提才敢定：dev 库 `sum(quote_lines.total_cents)` 恒等于\n`quote_options.total_cents`，差额全为 0，否则这条不变量会一上线就误杀所有合同（C1 同型）。\n校验放在**定稿**而非每次保存——草稿期正在合并行，中间态必然对不上，\n每次都校验会让「合并两行」这个动作根本做不完。\n\n## 渲染两层 fail-closed\n未知变量、取不到值的变量都抛错并点名。理由：一份看起来正常、金额那行却空白的合同\n被打印去签，比当场报错危险一个量级。另单独检查未闭合 `{{`——它会被正则整段跳过，\n不专门查就会原样印进合同且无人报错。\n\n## 真实链路验证抓出两个 bug\n① `variablesSnapshot` 恒为空：起草时正文已渲染，到定稿时里面早没有 `{{}}` 可提取。\n 改为快照**全部可解析变量**——留证本就该全记，不该取决于模板作者当初印没印。\n② Fastify 路由多写了 `/api` 前缀（注册作用域已带 prefix），实际成了 `/api/api/...`。\n\n## 又踩了一次同字面量陷阱\nNestJS 激活前置最初插错位置——「仓库不存在」那段在文件里出现多次，\n`replace` 只换第一处，守卫落进了 `createStocktake`（盘点）。\n已改为断言锚点唯一性后再插入。CLAUDE.md 点名过两次的坑，我这是第三次踩。\n\n## 证据（本地工作区，Fastify 真实链路）\n- `pnpm check` exit 0；contracts 单测 302（新增 22 条合同用例）\n- 模板：经理可建 201 / 销售 403 / 未登记变量 409 点名「甲方开户行」\n- 合同：起草生成 1 行清单（七列，含\"含：附件\"备注）、正文变量全替换、大写金额正确\n- 定稿：改金额 → 409 报出差额 -10000.00 元；销售定稿 403；正确金额 → FINALIZED\n- 撤回定稿：订单已激活 → 409 ORDER_ALREADY_ACTIVATED\n- 缺税号时起草 → 409 MISSING_VALUE 点名「甲方税号」（真实数据触发，非构造）\n- 留证快照 12 项（缺签署人两项因该报价未走客户接受，属正确 fail-closed）\n\n## 未做（不隐藏）\n前端界面（模板维护/预览/修改）未做；两后端 HTTP 验收测试与 E2E 未补；\n`check:runtime`/`check:ui` 本轮未跑；激活前置只在代码与单测层验证，\n未构造完整「未定稿→拒绝激活」的真实 HTTP 流程（dev 库无待激活申请，\n且 quotation_id 唯一约束挡住了造数）。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-02T23:07:37-07:00"},{"Sha1":"e0b780d18833713a675d8903f407bd7afd55e650","Message":"feat(auth): 多角色并存——一个账号可持多个角色，能力取并集，互斥组合硬禁止\n\n用户裁决两条：① 多角色并存（而非租户自定义角色）；② 互斥组合硬禁止（而非仅警示）。\n\n## 为什么是多角色而不是自定义角色\n备选方案是「租户自建角色 + 勾选任意 capability 子集」。不选它只有一条理由但足够硬：\n那会把「谁能做什么」的真源从 ROLE_PERMISSION_MAP **搬进数据库**，\n`check:role-permissions` 里「数据库不另存权限副本」这条核心断言随即失效，\n排查越权要同时看代码和数据。多角色只在 DB 存**角色分配**，真源不动，门禁继续有牙。\n代价是表达力：拼不出「销售但能看成本」这种现有角色组合不出的能力集。**已知取舍，非遗漏。**\n\n## 互斥矩阵为什么按角色对而不是 capability 对\n按能力对看着更本质，实则注册即红：`FINANCE` 单角色本身就同时持有 `payment.record`\n与 `payment.confirm`，门禁上线当天就判自己违规（C1 同型：扫到自身定义源）。\n故定义在角色层，并由 `it.each(MANAGED_USER_ROLES)`「每个单角色都不触发冲突」常驻断言守住。\n三组：采购三责分离 / 收款与发货放行 / 财务发起与审批；ADMIN 须单独持有。\n**这挡不住 ADMIN**——它持全部 capability，三责分离对它本就不成立，\n所以审批动作仍按 actor 硬校验 `approver !== requester`，两层缺一不可。\n\n## 删掉 requestRole 是本次最关键的决定\n`hasRolePermission` 改为同时接受单角色与角色集，好让 185 处调用点逐字不变。\n但这带来一个隐患：若保留 `requestRole`/`RequestRole` 单值访问器，\n调用点会**照常编译通过、静默只按主角色授权**——并集悄悄失效，零红盘。\n删掉它，编译器逼出 122+29 个错误，一个都跑不掉。\n\n编译器抓不到的恰是最危险的一处：`lockActiveAdmins` 的裸 SQL `\"role\" = 'ADMIN'`。\n它绕过 Prisma 类型检查；若当初保留 role 列做「兼容」，这句会静默匹配陈旧数据——\n**最后管理员保护看似还在，锁的却是错的行**。这是坚持 DROP COLUMN（并按门禁写\n`migration-allow` 留痕）的真正理由。计数侧同理：数组列上等值查询恒不匹配，\n`count` 恒为 0 会让保护永远放行。\n\n## 顺带修掉一个存量 bug\n两后端 `reverseAllocation` 把**角色名当操作人**存进 `reversedBy`（`reversedBy: role` → \"FINANCE\"）。\n列是 String? 所以静默收下，反核销记录追不到人。多角色改造让它变成类型错误才暴露，已改传 actor。\n\n## token 与失效语义\nclaims `role` → `roles`，**无兼容分支**：留着它，只带 `role` 的旧令牌会走进「按单角色授权」\n的窄路径而调用方以为拿到并集，这种不一致比直接 401 难查得多。旧令牌一律 401 CLAIMS。\n受管理令牌回查用 `sameRoleSet` **集合语义**——按数组逐位比会让管理员调整勾选顺序\n就把在线用户全部踢下线（同 sameTagSet 那条教训）。\n\n## 迁移\n两端对等：users.role → users.roles、user_events 角色快照转集合，先回填再删旧列。\nDROP COLUMN 与 CREATE INDEX 均按门禁要求加 `-- migration-allow:` 留痕。\n\n## 前端\n账号页角色由单选下拉改多选勾选，实时显示并集能力数与互斥冲突——\n预览调 contracts 同一个 `previewRoleAssignment`，不在前端另写一套 if。\n**前端只提示不裁决**：绕过 UI 直接 curl 照样 400。\n\n## 证据（本地工作区）\n- `pnpm check` exit 0；contracts 273/273（新增 33 条多角色单测）；全仓 typecheck 0 错误\n- 门禁负向已实跑判红：注入「退化成只按主角色授权」→ check:role-permissions exit 1；\n 注入「待办中心放行全集」→ check:module-integration exit 1；均恢复后转绿\n- 迁移在 dev 库实跑：单角色→单元素集合、0 个空角色集账号、旧列已删\n- 真实 HTTP 四条对抗：仓库+采购 400 点名冲突／空集 400／ADMIN 混搭 400／销售+技术 201\n- 浏览器：多选控件 10 角色、并集能力数实时更新、互斥冲突当场提示\n\n## 未做（不隐藏）\n`check:runtime` 与 `check:ui` 本轮未实跑；两后端多角色 HTTP 验收与 E2E 用例尚未补齐。\n动态区 runtime/UI 证据行仍是上一轮日期，未据本次改动更新。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-02T22:26:56-07:00"}],"HeadCommit":{"Sha1":"744d532b80ba3fd239cfbdd2b3700e3d73c08675","Message":"test(governance): 三级门禁全绿——runtime 396/396、UI 12/12，合同与多角色补齐验收\n\n本轮把欠了整条线的运行态证据补齐：静态 → 真实 DB → 浏览器三级全部实跑通过。\n\n## 合同域门禁（5 条断言 + 自检固化）\n`check:module-integration` 新增：渲染必须调 contracts 纯函数、清单必须走 contracts\n清洗、定稿必须校验金额、激活必须要求合同已定稿、合同列表必须有自己的读模型。\n5 条负向注入逐条实跑判红，并固化进 `scripts/lib/contract-integration.test.mjs`\n（fixture 隔离，不碰真文件；配「未注入 → 绿」基线用例，防止所有\"期望红\"\n以完全错误的理由通过）。gateSelftests 地板 6 → 7。\n\n其中「合同列表必须有自己的读模型」防的是真实发生过的缺陷：\n借用「待激活申请」options（只返 REQUESTED）会让财务一激活，刚签的合同就从界面消失。\n\n## 状态机不变量逼出的设计修正\n`contractMachine` 原本是 `DRAFT ⇄ FINALIZED` 的**无终态环**——合同永远走不完，\n而\"订单已激活则不可修改\"只是运行时守卫。contracts 的状态机不变量测试\n（\"从任一状态都能走到终态\"）当场判红。加终态 `EFFECTIVE`，由财务激活时迁入：\n`revise` 从 EFFECTIVE 出发在**状态机层面就不存在**，运行时检查降为第二层。\n\n## 修掉一个我自己制造的严重问题\n早先用批量正则把测试里的 `role:` 改成 `roles:`，**误伤 153 处 `api()` helper 入参**。\n该 helper 收的是 `role`，`roles` 被静默忽略并回落成默认 ADMIN——\n**测试照样绿，但所有「某角色应当 403」的负例都退化成「ADMIN 当然 200」**。\n已全部回退。教训：批量正则改测试比改源码危险得多，源码有编译器兜底，测试没有。\n\n## 修掉一处静默降级（用户反馈两次）\n`draft()` 里 `template ? render(...) : \"\"`——取不到默认模板就给空正文，不报错不提示。\n而\"合同建出来了、正文是空的\"在界面上与\"模板没生效\"完全一样。改为：\n默认模板优先，没设默认但只有一个模板时直接采用；仍取不到时界面明确说明原因。\n另补「套用模板」选择器——此前 `templateId` 存了却从不重渲染，已有合同换不了模板。\n\n## 版式\n按反馈调整为：套用模板 → 合同正文 → 合同清单。\n打印改为只打这一份合同：`@media print` 内 5 条规则（全页隐藏 → 放行合同卡 →\n正文去滚动上限并允许换行 → 按钮与留证快照不打印），沿用配货单打印同一模式，\n含「window.print() 必须在原始 click 内同步调用」那条硬约束。\n\n## 三级门禁证据（本地工作区）\n- `pnpm check` exit 0；门禁自检 8 组\n- `pnpm check:runtime` **396/396**（地板抬至 380），双后端 HTTP 各 45/45\n- `pnpm check:ui` **12/12**，unexpected 0（地板抬至 12）\n- 新增双后端 HTTP 验收：未定稿激活 409 CONTRACT_NOT_FINALIZED、\n 改金额定稿 409 CONTRACT_TOTAL_MISMATCH、合同清单只有对客七列且不含 cost\n- 新增 E2E 真实界面链路：建模板 → 生成合同 → 断言正文按模板渲染 →\n 定稿 → 只读预览 → 激活\n\n## 顺带修复的真账\n多角色改造遗留：两后端测试夹具签单值 role、fromRole/toRole 断言、\nNestJS api() helper 签发、E2E 建账号入参、合同外键 Restrict 导致的清理顺序。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-03T06:17:45-07:00"},"CompareURL":"luoanwu/juhai-quotation-system/compare/4e06b62635319faead311e0b6799c2e47877f859...744d532b80ba3fd239cfbdd2b3700e3d73c08675","Len":4}...
|
1785765661
|
Edit
Delete
|
|
20407
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/feat/multi-role-assignment
|
0
|
|
1785765661
|
Edit
Delete
|
|
20306
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/feat/g8-verified-auth
|
0
|
{"Commits":[{"Sha1":"4e06b6263 {"Commits":[{"Sha1":"4e06b62635319faead311e0b6799c2e47877f859","Message":"feat(fulfillment): 履约五模块 UI 优化——分批发运、采购看板、交接中文标签与终态确认\n\n- 契约单源：新增 SHIPMENT_STATE_LABELS 与 CONTRACT_REQUEST_STATUS_LABELS，\n 补齐发运/合同状态此前缺失的中文标签定义\n- 履约协同：订单卡显示下单时间与「当前责任人」指引（与安装页口径一致）\n- 采购协同：消费服务端 /purchase-orders/summary 聚合做看板指标（不在浏览器\n reduce，C27 口径）；补加载/空态；四段进度条与明细待收展示\n- 物流发运：发运表单支持逐行下调本批数量（分批发运蓝图承诺补齐 UI 端）；\n 新增「发运记录」区展示含已送达在内的全部发运单；配货清单补加载/空态\n- 技术履约：工单生成/开始/完成时间恒显（此前仅完工后可见）\n- 客服交接：发运/安装/合同状态全部改用 contracts 中文标签（消除英文枚举\n 直出）；新增服务进度时间线；「关闭服务」终态动作补二次确认；显示交接备注\n\n证据：pnpm check 19 项全绿；contracts 240/240；check:ui 12/12 全绿\n（履约闭环用例覆盖新版发运表单/采购流转/交接卡；此前并行红项未复现）。\nCLAUDE.md 动态区证据行已同步。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-02T19:32:04-07:00"}],"HeadCommit":{"Sha1":"4e06b62635319faead311e0b6799c2e47877f859","Message":"feat(fulfillment): 履约五模块 UI 优化——分批发运、采购看板、交接中文标签与终态确认\n\n- 契约单源：新增 SHIPMENT_STATE_LABELS 与 CONTRACT_REQUEST_STATUS_LABELS，\n 补齐发运/合同状态此前缺失的中文标签定义\n- 履约协同：订单卡显示下单时间与「当前责任人」指引（与安装页口径一致）\n- 采购协同：消费服务端 /purchase-orders/summary 聚合做看板指标（不在浏览器\n reduce，C27 口径）；补加载/空态；四段进度条与明细待收展示\n- 物流发运：发运表单支持逐行下调本批数量（分批发运蓝图承诺补齐 UI 端）；\n 新增「发运记录」区展示含已送达在内的全部发运单；配货清单补加载/空态\n- 技术履约：工单生成/开始/完成时间恒显（此前仅完工后可见）\n- 客服交接：发运/安装/合同状态全部改用 contracts 中文标签（消除英文枚举\n 直出）；新增服务进度时间线；「关闭服务」终态动作补二次确认；显示交接备注\n\n证据：pnpm check 19 项全绿；contracts 240/240；check:ui 12/12 全绿\n（履约闭环用例覆盖新版发运表单/采购流转/交接卡；此前并行红项未复现）。\nCLAUDE.md 动态区证据行已同步。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-02T19:32:04-07:00"},"CompareURL":"luoanwu/juhai-quotation-system/compare/9f1ea88bcf8f55b6a1d25f0c5e5d0e282fd09a56...4e06b62635319faead311e0b6799c2e47877f859","Len":1}...
|
1785724341
|
Edit
Delete
|
|
20297
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/feat/g8-verified-auth
|
0
|
{"Commits":[{"Sha1":"9f1ea88bc {"Commits":[{"Sha1":"9f1ea88bcf8f55b6a1d25f0c5e5d0e282fd09a56","Message":"fix(dev): 本地启动链补齐 G8 验签所需 env——launch.json 与 README 都停在验签之前\n\n## 症状\n`preview_start` 起 web 后页面能开、功能全死：每个 API 请求 500 AUTH_NOT_CONFIGURED。\n（同时出现的 corepack `Invalid package.json` 是另一回事——那三次重试恰好撞在\n上一个 cherry-pick 的冲突窗口里，`package.json` 当时带着冲突标记，确实不是合法 JSON。\n冲突收干净后自动消失，不是配置问题。）\n\n## 根因\n`.claude/launch.json` 与 README 的「快速开始」都写于 G8 落地之前。\nG8 之后两个后端每请求都要 verifyAccessToken，缺 AUTH_JWT_SECRET 即 fail-closed 500\n——刻意不回 401：密钥没配是服务端故障，回 401 会把运维问题伪装成调用方的凭证问题。\n而 `.env.example` 双端其实都已补过密钥，漏的只有这两个**启动入口**。\n\n## 改动\n- launch.json 四个配置：后端补 AUTH_JWT_SECRET + LOCAL_IDENTITY_SWITCH_ENABLED\n- web 侧现签引导令牌：本地身份切换接口自己也要验签，没有引导令牌就是先有鸡还是\n 先有蛋。令牌用 contracts 的 signAccessToken 现签——**与后端同一份密钥、同一个\n 函数**，不另造第二条签发路径（那正是 P1 禁止的双真源形态）\n- 加 `test -n \"$NEXT_PUBLIC_AUTH_TOKEN\"`：签发失败当场退出，不让「令牌为空」\n 静默退化成满屏 401——那种失败看起来和「没登录」一模一样，最难判责\n- 顺手修 api-nestjs 的 `port` 字段：原为 3099，与实际监听的 3097 对不上\n- README 第 3 步补 AUTH_JWT_SECRET / NEXT_PUBLIC_AUTH_TOKEN 及其 fail-closed 语义；\n 命令表补 4 个已存在却从未登记的门禁（api-routes / approval-payload /\n workspace-hygiene / gate-selftest）\n\n## 证据（本地工作区，Fastify + PG:55432 + Redis:6382）\n- /api/health → `{\"status\":\"ok\",\"checks\":{\"database\":\"up\",\"redis\":\"up\"}}`\n- 无令牌 GET /api/quotations → 401；签名令牌 → 200 带真实数据；\n 令牌改一个字符 → 401（验签真的参与判定，不是摆设）\n- 浏览器 http://localhost:3098：demo-tenant 工作台渲染，KPI ¥2,733,893.60 / 5 份报价，\n 实时通道在线，本地身份切换 10 个角色可用，控制台零报错\n- `pnpm check` exit 0\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-02T18:24:48-07:00"},{"Sha1":"44a51eebab6962f641bdf6d95eb2742d082d0a32","Message":"fix(gate): 捡回工作区卫生门禁（C28）——check:ui 的 tsconfig 残留会自愈\n\n`34635aa` 是 2026-07-31 落在一个 detached worktree 里、**从未合入也未被重新实现**的\n改进。经核查：三个脚本文件在 main 血脉里全都不存在，棘轮无 workspaceHygieneViolations，\n而它修的 bug 至今仍在（restoreWebTypeArtifacts 仍是快照式还原）。故 cherry-pick 捡回。\n\n## 解决的问题\ncheck:ui 为规避 manifest/EMFILE 假 404（C17）给 Next 用独立 distDir `.next-ui-\u003cpid\u003e`，\nNext dev 会把该路径写进**被跟踪的** apps/web/tsconfig.json。\n此前的备份/还原是**快照式**——把启动前就存在的残留原样写回，永不自愈；\n而残留恰恰来自还原逻辑捕获不到的退出路径（SIGKILL / 并发轮次互相复活死条目）。\n本仓有并发会话共用 checkout，这条路径不是假想。\n\n## 修法两层\n- runner 还原后**无条件剥离** `.next-ui-*`：干净工作区上是恒等变换，仍严格净零\n- 独立门禁 `check:workspace-hygiene` 作第二道防线，入棘轮\n 判据刻意收窄防假门禁：只查 include 不查 exclude（node_modules 天然 gitignore，\n 一并查会注册即红，重蹈 C1）；合法性只看首个路径段而非字面量白名单，\n 以免随 Next 版本增删而变成维护跑步机\n\n## 落地时的两处调整\n1. **编号 C25 → C28**：并行工作里已有另一个 C25（孤儿组件 `OrdersPanel`/`UsersPanel`），\n 撞车。按「编号只用于定位、不复用」的约定改为空号 C28。\n2. **只取代码不取报告**：原提交带的 baseline 与 20 份 report 快照已全部过期\n （gateSelftests 地板当时 2→3，现已是 6），直接取会把棘轮改坏。\n 报告全部还原为当前 HEAD，改由本轮重跑生成。\n\n## 门禁上线即抓到 5 处真实残留\n`.next-manual-10560` / `.next-ui-{49228,61102,94609}` / `.next-dev-3098`\n——比原提交记录的面更广：除 check:ui 外，手册截图 runner 与开发服务器同样会写入。\n已清理；runner 侧自愈只覆盖 `.next-ui-*`，其余 runner 若再产生仍由本门禁兜住。\n\n## 证据（本地工作区）\n`pnpm check` exit 0（含新门禁）；`check:gate-selftest` 7 组负向全绿；\n真实链路负向：注入 `.next-ui-99999` → exit 1，移除后 → exit 0。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-02T18:13:12-07:00"}],"HeadCommit":{"Sha1":"9f1ea88bcf8f55b6a1d25f0c5e5d0e282fd09a56","Message":"fix(dev): 本地启动链补齐 G8 验签所需 env——launch.json 与 README 都停在验签之前\n\n## 症状\n`preview_start` 起 web 后页面能开、功能全死：每个 API 请求 500 AUTH_NOT_CONFIGURED。\n（同时出现的 corepack `Invalid package.json` 是另一回事——那三次重试恰好撞在\n上一个 cherry-pick 的冲突窗口里，`package.json` 当时带着冲突标记，确实不是合法 JSON。\n冲突收干净后自动消失，不是配置问题。）\n\n## 根因\n`.claude/launch.json` 与 README 的「快速开始」都写于 G8 落地之前。\nG8 之后两个后端每请求都要 verifyAccessToken，缺 AUTH_JWT_SECRET 即 fail-closed 500\n——刻意不回 401：密钥没配是服务端故障，回 401 会把运维问题伪装成调用方的凭证问题。\n而 `.env.example` 双端其实都已补过密钥，漏的只有这两个**启动入口**。\n\n## 改动\n- launch.json 四个配置：后端补 AUTH_JWT_SECRET + LOCAL_IDENTITY_SWITCH_ENABLED\n- web 侧现签引导令牌：本地身份切换接口自己也要验签，没有引导令牌就是先有鸡还是\n 先有蛋。令牌用 contracts 的 signAccessToken 现签——**与后端同一份密钥、同一个\n 函数**，不另造第二条签发路径（那正是 P1 禁止的双真源形态）\n- 加 `test -n \"$NEXT_PUBLIC_AUTH_TOKEN\"`：签发失败当场退出，不让「令牌为空」\n 静默退化成满屏 401——那种失败看起来和「没登录」一模一样，最难判责\n- 顺手修 api-nestjs 的 `port` 字段：原为 3099，与实际监听的 3097 对不上\n- README 第 3 步补 AUTH_JWT_SECRET / NEXT_PUBLIC_AUTH_TOKEN 及其 fail-closed 语义；\n 命令表补 4 个已存在却从未登记的门禁（api-routes / approval-payload /\n workspace-hygiene / gate-selftest）\n\n## 证据（本地工作区，Fastify + PG:55432 + Redis:6382）\n- /api/health → `{\"status\":\"ok\",\"checks\":{\"database\":\"up\",\"redis\":\"up\"}}`\n- 无令牌 GET /api/quotations → 401；签名令牌 → 200 带真实数据；\n 令牌改一个字符 → 401（验签真的参与判定，不是摆设）\n- 浏览器 http://localhost:3098：demo-tenant 工作台渲染，KPI ¥2,733,893.60 / 5 份报价，\n 实时通道在线，本地身份切换 10 个角色可用，控制台零报错\n- `pnpm check` exit 0\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-02T18:24:48-07:00"},"CompareURL":"luoanwu/juhai-quotation-system/compare/90cb8a4111b88f700b2dba5913e7a1e29c9666b6...9f1ea88bcf8f55b6a1d25f0c5e5d0e282fd09a56","Len":2}...
|
1785720302
|
Edit
Delete
|
|
20296
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/feat/g8-verified-auth
|
0
|
{"Commits":[{"Sha1":"90cb8a411 {"Commits":[{"Sha1":"90cb8a4111b88f700b2dba5913e7a1e29c9666b6","Message":"feat(auth): 用户与权限管理落地——登录、受管理令牌吊销、本地身份切换\n\n承接 G8 验签切片（已合入的 auth.ts 单源），把「令牌从哪来」这一半补上：\n此前只解决了「后端是否验签」，令牌仍靠带外发放、没有账号也无从吊销。\n\n## 用户与访问管理\n- 新增 `packages/password-auth`：口令哈希与校验独立成包，不与业务代码混在一起\n- 迁移 `20260802150000_user_access_management`（两后端对等）\n- 登录端点 + `/login` 页面 + `features/users` 管理界面\n- **受管理令牌**：claims 带 `authVersion`，每次鉴权比对 DB 快照\n （同租户/同用户/同角色/ACTIVE/版本一致），任一不符即 REVOKED——\n 这让「停用账号」「改角色」能**立即生效**，而不是等令牌自然过期；\n 未带 authVersion 的 bootstrap/local 令牌走原有受控接缝，不受影响\n- 蓝图见 docs/domain/user-access-management-blueprint.md\n\n## 本地身份切换（开发接缝，非生产能力）\n`LOCAL_DEVELOPMENT_IDENTITIES` 固定目录 + 显式开关，双后端仅在非生产签发；\nWeb 用同一 cookie 同步 SSR / REST / 实时连接。**只为职责分离验收而存在**\n（不可自批需要两个不同的 sub，而浏览器会话只有一个身份），生产模式无条件关闭。\n契约层单测钉住：目录 id/sub 唯一、不含 UNAUTHENTICATED、只接受目录内身份。\n\n## 方案技术复核邀请\n迁移 `20260802170000_solution_technical_reviewer_invitation` + 两后端服务与路由，\n配套 SolutionStatusBadge；owner-matrix 与方案蓝图同步登记。\n\n## 文档\n新增 docs/spatiotemporal-fact-model.md（时空事实模型范式规范）；\n词典、角色权限蓝图、待办审批蓝图、操作手册、治理经验库同步更新；\nG8 交接文档转为已完成归档，并保留四条诚实边界（RLS 未做、令牌分发非生产级、\naccess_token 进 log 的残留风险、验签可信才谈防抵赖）。\n\n## 证据（本地工作区，dirty）\n`pnpm check` exit 0。runtime/ui 由本轮实现方记录于交接文档：\n312/312 与 11/11，其中浏览器真实完成管理员→技术→管理员切换。\n该证据绑定本地工作区，不外推为远端 CI、部署或生产签收。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-02T09:40:29-07:00"},{"Sha1":"b1e5c5e57f3d4075b12289f9de89ae616d909b7e","Message":"feat(governance): 业务闭环五切片——事件如实、配货可取消复活、退款可撤回、合同申请可拒绝、过期报价可续期\n\n跨域闭环分析(2026-08-02)定位的死路与半接线修复:\n- A1 客户「暂缓」(DEFER)事件错标成 customer_selected → 契约新增 solution.customer_deferred,两后端按 action 如实发布\n- A2 配货单 cancel 死边接线:补 cancel 端点与订单取消级联;salesOrderId 唯一 → 取消后重配走 CANCELLED--recreate--\u003eDRAFT 同行复活,明细重建实拣归零\n- A3 退款撤回补 UI 入口 + 双后端「申请→撤回→冻结额度释放」验收\n- B1 合同申请拒绝:ContractRequestStatus 增 REJECTED(留痕三列),报价同 tx contract_reject→ACCEPTED,复活重申请;连带拆开 CONTRACT_REQUESTED 的语义混叠,新增 CONTRACT_EFFECTIVE 终态由 activateContract 同 tx 迁移(不变量测试逼出的裁决)\n- B2 过期报价续期:SENT 增 send 自环,重发=完整 send 流程(版本+1/刷新有效期/重快照开关),配件冻结幂等\n\n迁移:20260802100000_contract_request_rejection(两后端,ALTER TYPE ADD VALUE + 加列,均 additive)\n证据(本地 dirty 工作区,2026-08-02):pnpm check EXIT=0;check:runtime 330 用例全绿(地板312);check:ui 11/12——唯一红盘为并发会话 skip_technical_review WIP 与其 E2E 不同步,非本切片所致\n文档:business-flow-overview 状态机索引与主干分支、quotation-blueprint §10、inventory-blueprint §9\n\n注:本提交经 hunk 级分离,不含同工作区并发会话的用户管理/技术复核指派 WIP;\n快照缺 MobileOverview 的 CONTRACT_EFFECTIVE 标签一行(属对方文件),合并后自愈\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-02T09:21:45-07:00"},{"Sha1":"7b3c8328178440e90c3a332dfbbd563401c44edc","Message":"feat(g8): 验签切片完成——前端单 token、测试夹具真签、本地身份切换、auth-source 门禁与文档回灌\n\n本地三级门禁证据(2026-08-02, dirty 工作区): check 绿 / check:runtime 312 用例 / check:ui 11 用例。\n剩余 G8 边界(生产 IdP、令牌吊销轮换、RLS)见 docs/handoff/g8-verified-auth.md 与 CLAUDE.md 动态区。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-02T08:31:43-07:00"},{"Sha1":"83498209dddd46dfc21f45b1806b94e18d903552","Message":"docs(handoff): G8 验签改造交接文档——已裁决/已完成/剩余四步/诚实边界/已踩的坑\n\n上下文将满，把接手所需信息落盘：两项用户裁决、已完成范围、剩余四步的具体做法\n（含「测试 helper 签名保持不变、只换内部实现」这个让上百处调用点零改动的关键做法）、\n必须保留的诚实边界（RLS 未做、令牌分发非生产级、access_token 进 log 的残留风险），\n以及两个已踩过的坑（pnpm store 错位会触发清空重装；contracts lib 刻意不含 DOM）。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-02T00:21:26-07:00"},{"Sha1":"5f8b521692f93344dd494d71fdcfe3cd3786fa6f","Message":"feat(g8/wip): 访问令牌验签单源 + 两后端强制验签（进行中，测试与前端未改完）\n\n⚠️ **本提交是 WIP，尚未通过 runtime/ui 门禁**——两套 HTTP 验收与 E2E 仍在发\ndemo 头，必然红。推上来是为了不丢这批安全改造，勿合并。\n\n## 已完成\n- contracts 新增 auth.ts：HS256 验签单源\n · verifyAccessToken(token, secret)：**显式限定 algorithms**（不写就允许\n alg:none / 算法混淆）；密钥 \u003c32 字符当场抛 CONFIG 而非降级放行\n · secret 由调用方显式传入——contracts 会被打进浏览器包，自己读 env\n 就有把密钥内联进前端产物的风险\n · decodeAccessTokenClaimsUnverified 仅供 UI 门控，名字写明它不是安全校验\n · 11 条对抗性单测：alg:none / HS512 混淆 / 篡改租户 / 过期 / 弱密钥 / 非法角色\n- 两后端改为**每请求验签一次**（NestJS 全局 APP_GUARD、Fastify onRequest 钩子），\n claims 挂 req 供下游同步读取\n- 身份三件套（tenantId/role/sub）全部改从已验签 claims 取；\n **删除全部回退分支**——验签失败即 401，绝不落回 x-tenant-id/x-user-role/x-user-id\n （那条兼容路径在验签落地后就是降级攻击面，G8 原文点名）\n- SSE/WS 的 ?access_token= 同样验签；删除 ?tenantId= 明文参数\n （它等于让任何人自称任意租户）\n- 免认证白名单只有 /api/health 与 /api/public/**，默认拒绝\n\n## 一并暴露的既有问题\nCLAUDE.md 只记了「租户未验签」，实际**角色也未验签**：x-user-role 同样是\n客户端自报，整个 capability 体系建立在后端信任这个头之上。现已一并收进 token。\n\n## 未完成（下一步）\n- 前端与导入脚本仍发 demo 头\n- 两套 HTTP 验收 + E2E 需改用 jose 现签 token，并补 401 判责断言\n- contracts/tenant.ts 的旧未验签 seam 待删\n- 门禁断言（禁止 demo 头回退回潮）+ 治理回灌\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-02T00:07:43-07:00"}],"HeadCommit":{"Sha1":"90cb8a4111b88f700b2dba5913e7a1e29c9666b6","Message":"feat(auth): 用户与权限管理落地——登录、受管理令牌吊销、本地身份切换\n\n承接 G8 验签切片（已合入的 auth.ts 单源），把「令牌从哪来」这一半补上：\n此前只解决了「后端是否验签」，令牌仍靠带外发放、没有账号也无从吊销。\n\n## 用户与访问管理\n- 新增 `packages/password-auth`：口令哈希与校验独立成包，不与业务代码混在一起\n- 迁移 `20260802150000_user_access_management`（两后端对等）\n- 登录端点 + `/login` 页面 + `features/users` 管理界面\n- **受管理令牌**：claims 带 `authVersion`，每次鉴权比对 DB 快照\n （同租户/同用户/同角色/ACTIVE/版本一致），任一不符即 REVOKED——\n 这让「停用账号」「改角色」能**立即生效**，而不是等令牌自然过期；\n 未带 authVersion 的 bootstrap/local 令牌走原有受控接缝，不受影响\n- 蓝图见 docs/domain/user-access-management-blueprint.md\n\n## 本地身份切换（开发接缝，非生产能力）\n`LOCAL_DEVELOPMENT_IDENTITIES` 固定目录 + 显式开关，双后端仅在非生产签发；\nWeb 用同一 cookie 同步 SSR / REST / 实时连接。**只为职责分离验收而存在**\n（不可自批需要两个不同的 sub，而浏览器会话只有一个身份），生产模式无条件关闭。\n契约层单测钉住：目录 id/sub 唯一、不含 UNAUTHENTICATED、只接受目录内身份。\n\n## 方案技术复核邀请\n迁移 `20260802170000_solution_technical_reviewer_invitation` + 两后端服务与路由，\n配套 SolutionStatusBadge；owner-matrix 与方案蓝图同步登记。\n\n## 文档\n新增 docs/spatiotemporal-fact-model.md（时空事实模型范式规范）；\n词典、角色权限蓝图、待办审批蓝图、操作手册、治理经验库同步更新；\nG8 交接文档转为已完成归档，并保留四条诚实边界（RLS 未做、令牌分发非生产级、\naccess_token 进 log 的残留风险、验签可信才谈防抵赖）。\n\n## 证据（本地工作区，dirty）\n`pnpm check` exit 0。runtime/ui 由本轮实现方记录于交接文档：\n312/312 与 11/11，其中浏览器真实完成管理员→技术→管理员切换。\n该证据绑定本地工作区，不外推为远端 CI、部署或生产签收。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-02T09:40:29-07:00"},"CompareURL":"luoanwu/juhai-quotation-system/compare/7619cf79681794bf28a8dceeb606c9dcfec21a5c...90cb8a4111b88f700b2dba5913e7a1e29c9666b6","Len":5}...
|
1785690034
|
Edit
Delete
|
|
20295
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/feat/g8-verified-auth
|
0
|
|
1785690034
|
Edit
Delete
|
|
20294
|
5
|
5
|
5
|
67
|
0
|
0
|
refs/heads/governance/adversarial-audit-fixes-2026 refs/heads/governance/adversarial-audit-fixes-20260728...
|
0
|
{"Commits":[{"Sha1":"88df9fddc {"Commits":[{"Sha1":"88df9fddc74d13ebbc389e8ca265c8953c06bc22","Message":"治理: /review 首个自动化验收——fixture 注入 + G29 null 字芯片用例，UI 地板 6→7\n\n- REVIEW_WORKDIR 注入点 + 仓内确定性 fixture（fixture-song，含 G29 null 时间字）\n- check:ui 第 7 例：字级时间面板渲染 / null 字禁用虚线芯片（title 无对齐证据）/\n 有证据字可点击试听\n- 负向测试：fixture 缺失整轮红且 e2e-results 显示仅新用例 ok:false（其余 6 绿）\n- 地板 uiTestsPassed 6→7、ownTestCases 62→63；报告绑定 gitSha 348939f5\n- 边界如实记：执行链路（C24 重跑刷新）仍无自动化，fixture 用例覆盖不到\n\ncheck / check:ui(7) 本机全绿。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-01T22:14:08-07:00"},{"Sha1":"348939f512d2bc10165e5bcb98597837828a63f2","Message":"治理: G29 关闭——null 时间字契约落地，导出契约账本清零\n\n用户拍板选 A：无对齐证据的官方字保留、时间置 null（官方字全覆盖）。\n\n- phase2 三处修复：发射点保留 null 字 / VAD 尾延长落最后一个有时间字 /\n 全局换算透传 null；TDD 2 用例先红后绿，pytest 地板 137→139\n- 导出层 groupTimedChars：null 字并入相邻有时间段（行首并后、其余并前、\n 全 null 回落行级），elrc/ass/kas 渲染零改动消费分组结果\n- 工作台 null 字虚线禁用芯片（不参与高亮/试听），类型 start/end 允许 null\n- 4 首债务歌复跑（GUNCHARLIE/有你有我/爱情一阵风/素颜）：\n check:export-contract 账本 23 行→0，存量冻结清空\n- 浏览器实证（web-verify:3131 隔离 distDir）：素颜 elrc\n \u003c00:20.33\u003e的很\u003c00:20.35\u003e 文本完整、X-Export-Per-Char-Downgraded 4→0、\n 工作台 13 个 null 芯片正确渲染、控制台零错误\n\ncheck / pipeline(139) / export-contract(账本清零) 本机全绿。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-01T20:51:41-07:00"},{"Sha1":"54d0518408a1fdeae63f4fb61a3d5fb885e09c0c","Message":"治理: G25 关闭——7 首债务歌定源重跑 phase2 清账，残余分类转出 G29\n\n- 定源纪律：qingtian×2 靠人声时长 314.57s 逐位比对定源晴天 full_mix，\n 分析对齐靠歌词 grep + 230.24s 时长吻合定源魏翔时差（比对而非猜）；\n 爱情一阵风/素颜 现场重分离（demucs worker）\n- 7 首 phase2 重跑（52-89s/首）：陈旧产物债 90 行→23 行全清\n （qingtian×2 22→0、分析对齐 21→0、GUNCHARLIE 48→1）\n- 剩余 4 首 23 行重跑不可清：实为现行代码缺口——phase2 丢弃无对齐\n 证据的官方字（素颜 L3「很」抽查推翻 roman 空预设），违反双轨契约\n 官方字全覆盖意图，登记 G29 待契约拍板\n- 冻结账本收紧 7 首→4 首；门禁 INFO 文案改指 G29（重跑不可清）\n- 词元化修复（C18/G27/C26）借清账首次过真歌产物级验证（泰/闽/国语）\n\ncheck / pipeline(137) / export-contract(存量4+新增0) 本机全绿。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-01T20:33:19-07:00"},{"Sha1":"2a22686cab5028a364debbc9aad9ffeaed40d20f","Message":"治理: 语言判定/词元化单源收口 + 报告 provenance 与导出契约账本\n\n- C23 运行时单源 config/structure-modes.v1.json 入库（fresh clone 实证必红）+\n check:pipeline 入库绊网（git ls-files 而非 existsSync）\n- C24 工作台同曲重跑面板不刷新：dataToken 令牌驱动重取\n- C25 vote_language/resolve_structure_languages 标签归一 + 拉丁票白名单\n fail-closed（用户拍板），策略收口 _latin_script_language 单源\n- G27+C26 worker 词元化三处对齐 services + NFD 谚文/假名修复（分组保码位、\n 罗马化走 NFC 合成）；check:pipeline 升级为跨 venv 行为比对（11 组多语言用例\n + 词元拼接无损不变量）\n- C27 phase1 CLI 声明通道接通（run/align 均传 declared_language）+\n resolve_structure_languages 对 detected/fallback/declared 入口统一归一\n- G22 主体：scripts/lib/provenance.mjs 单源，15 处报告写点统一携带\n gitSha/worktreeDirty，check:governance 强制校验（含 runtime/ui 转强制）\n- G25 半闭环：check:export-contract 门禁 + 冻结账本（首跑盘出存量债 7 首，\n 新增即阻塞、账本缺失 fail-closed）\n\npytest 地板 124→137；check / runtime(56) / ui(6) / pipeline(137) /\nexport-contract 五级门禁本机全绿；全部修复先红后绿负向测试取证。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-01T20:13:48-07:00"},{"Sha1":"eb6956a03b3a63cf459aade2c4538b9a3e992e91","Message":"feat: default review runs to vocal-fast\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-07-30T19:52:34-07:00"}],"HeadCommit":{"Sha1":"88df9fddc74d13ebbc389e8ca265c8953c06bc22","Message":"治理: /review 首个自动化验收——fixture 注入 + G29 null 字芯片用例，UI 地板 6→7\n\n- REVIEW_WORKDIR 注入点 + 仓内确定性 fixture（fixture-song，含 G29 null 时间字）\n- check:ui 第 7 例：字级时间面板渲染 / null 字禁用虚线芯片（title 无对齐证据）/\n 有证据字可点击试听\n- 负向测试：fixture 缺失整轮红且 e2e-results 显示仅新用例 ok:false（其余 6 绿）\n- 地板 uiTestsPassed 6→7、ownTestCases 62→63；报告绑定 gitSha 348939f5\n- 边界如实记：执行链路（C24 重跑刷新）仍无自动化，fixture 用例覆盖不到\n\ncheck / check:ui(7) 本机全绿。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-01T22:14:08-07:00"},"CompareURL":"luoanwu/songformer-structure-lyrics/compare/7d093d6ffa01151af6a18fbd41e0d3d8fb82e9ed...88df9fddc74d13ebbc389e8ca265c8953c06bc22","Len":5}...
|
1785651775
|
Edit
Delete
|
|
20293
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"7619cf796 {"Commits":[{"Sha1":"7619cf79681794bf28a8dceeb606c9dcfec21a5c","Message":"Merge pull request #7 from laoluojuhai/feat/solution-tier-multi-product\n\nfeat(approval-inbox): 跨域待办审批中心切片二——不可自批 6/6 道闭环","AuthorEmail":"158980461+laoluojuhai@users.noreply.github.com","AuthorName":"laoluojuhai","CommitterEmail":"noreply@github.com","CommitterName":"GitHub","Timestamp":"2026-08-01T22:08:17-07:00"},{"Sha1":"06495232f1936d9e221f7745216962379994b261","Message":"chore: 合并 main 后刷新治理报告\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-01T20:45:47-07:00"},{"Sha1":"ae1046edf9b030e1a67c30235ddd345590e61fdf","Message":"Merge remote-tracking branch 'github/main' into feat/solution-tier-multi-product\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-01T20:42:40-07:00"},{"Sha1":"479c742208b50c7e788cb4eea1b6b878fcfe615e","Message":"feat(approval-inbox): 切片二收口——报价审批补发起人，不可自批 6/6 道闭环\n\n上一轮避让并发会话对报价域的改动，留下 ApprovalRequest 这最后一道。\n现该域已干净（其工作已合入 b15cb54），补齐收口。\n\n## 改动\n- ApprovalRequest.requestedBy（两后端 schema 对等 + 迁移，nullable）\n- requestApproval 落发起人；decideApproval 校验 approver ≠ requester\n → 403 + code=SELF_APPROVAL_FORBIDDEN，与其余五道口径一致\n- actor 串进两后端的 request-approval / approve / reject-approval\n （Fastify 的 request-approval 因此脱离无 actor 的 noBodyAction）\n- contracts 描述表 QUOTATION_APPROVAL.selfRequestedKnown → true；\n 聚合把 PENDING 子行的 requestedBy 带出来，自批过滤在报价审批上真正生效\n- UI 文案去掉「报价审批暂未记录发起人」的例外说明\n\n## 至此不可自批覆盖 6/6 道真审批\n报价 / 方案技术复核 / 方案经理批准 / 采购 / 盘点 / 红冲 / 退款\n（仅剩的两类 selfRequestedKnown=false 是「客户决定后的待办」，本就无发起人概念）\n\n## 诚实边界（未因本片改变）\n- 列均 nullable：建列前的存量行判不了就不判，**不假装判过**\n- 仍受 G8 制约：Bearer 未验签、actor 取不到时兜底 `role:\u003cROLE\u003e`，\n 所以这是「防误操作」不是「防抵赖」，**不得宣称为审计级职责分离**\n\n## 证据（本地工作区 2026-08-01）\n- pnpm check 0 / check:runtime 296 / check:ui 10\n- 两后端各 +1 条报价自批 403 断言，并各配一条「换个审批人即通过」的反证\n ——只断言 403 无法区分「拦对了」与「谁都批不了」的误杀\n- 负向实跑判红后恢复：拔掉报价不可自批校验 → 期望 403 实得 200\n- 回灌：CLAUDE.md 真源地图新增「跨域待办审批与不可自批」条目 +\n 证据新鲜度/棘轮行更新；蓝图 §4 缺口 1、2 标记闭环\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-01T20:28:00-07:00"},{"Sha1":"fbdc3680f4ef53e824738ca8cbf8f0e6deefce55","Message":"fix(gate): 文档诚实注收窄到行——文件级标注不该赦免同文件里的另一句谎话\n\ngit-standard 导语长期写「Conventional Commits 规范 + commitlint 自动校验」，\n而同文件 §三 已标注「🟡 规划未落地」。上一轮加的 commitlint-husky-honesty\n是**文件级**判定（文件里出现「规划未落地」即算诚实），因此绿着放行了这句\n自相矛盾的导语——而读者读的正是导语，不会翻到第三节。\n\n粒度选得比缺陷粗一级，门禁就会用\"文件里有免责声明\"赦免\"文件里另一句谎话\"。\n读者是按句子受骗的，断言就得按句子判。\n\n改动：\n- git-standard 导语改为如实描述：校验靠人、无 hook、提交前手工跑 pnpm check\n- 新增 commitlint-husky-no-auto-claim：同一行既点名 commitlint/husky\n 又宣称\"自动\"、且该行无未落地字样 → 判红。收窄到行是为了不误咬 CI 侧\n 合法的\"自动\"表述（C14：宁可窄，不造模糊规则）\n\n负向证据（scripts/lib/docs-truth.test.mjs，由 check:gate-selftest 重跑）：\n- 向两份文件各写回**那句历史原文** → 各自 exit 恰为 1 且命中\n [commitlint-husky-no-auto-claim:\u003cfile\u003e]，确认红在点子上而非撞上别的断言\n- 同行带未落地标注的「自动」表述 → 仍绿，锁住新断言的窄边界。\n 只有红测试的门禁会朝越咬越宽漂移，直到有人为了让它闭嘴而删掉它\n\npnpm check exit 0；check:gate-selftest 5 组全绿。作用域：本地工作区 dirty\n（并发会话 approval-inbox 切片二在途），本提交只含这 3 个文件。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-01T20:18:46-07:00"}],"HeadCommit":{"Sha1":"7619cf79681794bf28a8dceeb606c9dcfec21a5c","Message":"Merge pull request #7 from laoluojuhai/feat/solution-tier-multi-product\n\nfeat(approval-inbox): 跨域待办审批中心切片二——不可自批 6/6 道闭环","AuthorEmail":"158980461+laoluojuhai@users.noreply.github.com","AuthorName":"laoluojuhai","CommitterEmail":"noreply@github.com","CommitterName":"GitHub","Timestamp":"2026-08-01T22:08:17-07:00"},"CompareURL":"luoanwu/juhai-quotation-system/compare/9618d78da3e668f14e3c1611d7090f45eef0c085...7619cf79681794bf28a8dceeb606c9dcfec21a5c","Len":31}...
|
1785647350
|
Edit
Delete
|
|
20292
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/feat/solution-tier-multi-product
|
0
|
{"Commits":[{"Sha1":"06495232f {"Commits":[{"Sha1":"06495232f1936d9e221f7745216962379994b261","Message":"chore: 合并 main 后刷新治理报告\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-01T20:45:47-07:00"},{"Sha1":"ae1046edf9b030e1a67c30235ddd345590e61fdf","Message":"Merge remote-tracking branch 'github/main' into feat/solution-tier-multi-product\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-01T20:42:40-07:00"},{"Sha1":"8ab2314d69f1885d49bbbf1fc3c5b3c6cccb6711","Message":"Merge pull request #6 from laoluojuhai/feat/solution-tier-multi-product\n\nfeat(solution): 三档方案每档多商品 + 数量默认取包房总数","AuthorEmail":"158980461+laoluojuhai@users.noreply.github.com","AuthorName":"laoluojuhai","CommitterEmail":"noreply@github.com","CommitterName":"GitHub","Timestamp":"2026-08-01T20:09:43-07:00"}],"HeadCommit":{"Sha1":"06495232f1936d9e221f7745216962379994b261","Message":"chore: 合并 main 后刷新治理报告\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-01T20:45:47-07:00"},"CompareURL":"luoanwu/juhai-quotation-system/compare/479c742208b50c7e788cb4eea1b6b878fcfe615e...06495232f1936d9e221f7745216962379994b261","Len":3}...
|
1785642353
|
Edit
Delete
|
|
20291
|
5
|
5
|
5
|
72
|
0
|
0
|
refs/heads/feat/solution-tier-multi-product
|
0
|
{"Commits":[{"Sha1":"479c74220 {"Commits":[{"Sha1":"479c742208b50c7e788cb4eea1b6b878fcfe615e","Message":"feat(approval-inbox): 切片二收口——报价审批补发起人，不可自批 6/6 道闭环\n\n上一轮避让并发会话对报价域的改动，留下 ApprovalRequest 这最后一道。\n现该域已干净（其工作已合入 b15cb54），补齐收口。\n\n## 改动\n- ApprovalRequest.requestedBy（两后端 schema 对等 + 迁移，nullable）\n- requestApproval 落发起人；decideApproval 校验 approver ≠ requester\n → 403 + code=SELF_APPROVAL_FORBIDDEN，与其余五道口径一致\n- actor 串进两后端的 request-approval / approve / reject-approval\n （Fastify 的 request-approval 因此脱离无 actor 的 noBodyAction）\n- contracts 描述表 QUOTATION_APPROVAL.selfRequestedKnown → true；\n 聚合把 PENDING 子行的 requestedBy 带出来，自批过滤在报价审批上真正生效\n- UI 文案去掉「报价审批暂未记录发起人」的例外说明\n\n## 至此不可自批覆盖 6/6 道真审批\n报价 / 方案技术复核 / 方案经理批准 / 采购 / 盘点 / 红冲 / 退款\n（仅剩的两类 selfRequestedKnown=false 是「客户决定后的待办」，本就无发起人概念）\n\n## 诚实边界（未因本片改变）\n- 列均 nullable：建列前的存量行判不了就不判，**不假装判过**\n- 仍受 G8 制约：Bearer 未验签、actor 取不到时兜底 `role:\u003cROLE\u003e`，\n 所以这是「防误操作」不是「防抵赖」，**不得宣称为审计级职责分离**\n\n## 证据（本地工作区 2026-08-01）\n- pnpm check 0 / check:runtime 296 / check:ui 10\n- 两后端各 +1 条报价自批 403 断言，并各配一条「换个审批人即通过」的反证\n ——只断言 403 无法区分「拦对了」与「谁都批不了」的误杀\n- 负向实跑判红后恢复：拔掉报价不可自批校验 → 期望 403 实得 200\n- 回灌：CLAUDE.md 真源地图新增「跨域待办审批与不可自批」条目 +\n 证据新鲜度/棘轮行更新；蓝图 §4 缺口 1、2 标记闭环\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-01T20:28:00-07:00"}],"HeadCommit":{"Sha1":"479c742208b50c7e788cb4eea1b6b878fcfe615e","Message":"feat(approval-inbox): 切片二收口——报价审批补发起人，不可自批 6/6 道闭环\n\n上一轮避让并发会话对报价域的改动，留下 ApprovalRequest 这最后一道。\n现该域已干净（其工作已合入 b15cb54），补齐收口。\n\n## 改动\n- ApprovalRequest.requestedBy（两后端 schema 对等 + 迁移，nullable）\n- requestApproval 落发起人；decideApproval 校验 approver ≠ requester\n → 403 + code=SELF_APPROVAL_FORBIDDEN，与其余五道口径一致\n- actor 串进两后端的 request-approval / approve / reject-approval\n （Fastify 的 request-approval 因此脱离无 actor 的 noBodyAction）\n- contracts 描述表 QUOTATION_APPROVAL.selfRequestedKnown → true；\n 聚合把 PENDING 子行的 requestedBy 带出来，自批过滤在报价审批上真正生效\n- UI 文案去掉「报价审批暂未记录发起人」的例外说明\n\n## 至此不可自批覆盖 6/6 道真审批\n报价 / 方案技术复核 / 方案经理批准 / 采购 / 盘点 / 红冲 / 退款\n（仅剩的两类 selfRequestedKnown=false 是「客户决定后的待办」，本就无发起人概念）\n\n## 诚实边界（未因本片改变）\n- 列均 nullable：建列前的存量行判不了就不判，**不假装判过**\n- 仍受 G8 制约：Bearer 未验签、actor 取不到时兜底 `role:\u003cROLE\u003e`，\n 所以这是「防误操作」不是「防抵赖」，**不得宣称为审计级职责分离**\n\n## 证据（本地工作区 2026-08-01）\n- pnpm check 0 / check:runtime 296 / check:ui 10\n- 两后端各 +1 条报价自批 403 断言，并各配一条「换个审批人即通过」的反证\n ——只断言 403 无法区分「拦对了」与「谁都批不了」的误杀\n- 负向实跑判红后恢复：拔掉报价不可自批校验 → 期望 403 实得 200\n- 回灌：CLAUDE.md 真源地图新增「跨域待办审批与不可自批」条目 +\n 证据新鲜度/棘轮行更新；蓝图 §4 缺口 1、2 标记闭环\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-01T20:28:00-07:00"},"CompareURL":"luoanwu/juhai-quotation-system/compare/fbdc3680f4ef53e824738ca8cbf8f0e6deefce55...479c742208b50c7e788cb4eea1b6b878fcfe615e","Len":1}...
|
1785641286
|
Edit
Delete
|