|
30621
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"e9ee9c763 {"Commits":[{"Sha1":"e9ee9c7634e301d18908a21ce30741b93de2fdac","Message":"docs(平台): 完善公共基础交付与独立工作台设计\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T04:20:28-07:00"}],"HeadCommit":{"Sha1":"e9ee9c7634e301d18908a21ce30741b93de2fdac","Message":"docs(平台): 完善公共基础交付与独立工作台设计\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T04:20:28-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/fcd2bcd410d622e7d8e4768c67d1803231f93dda...e9ee9c7634e301d18908a21ce30741b93de2fdac","Len":1}...
|
1789644041
|
Edit
Delete
|
|
30672
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"26b9b2578 {"Commits":[{"Sha1":"26b9b2578237a047c841b32ca6b1633669b8ee10","Message":"docs(平台): owner-matrix 增工作台维护者拟设行\n\n对外交付设计 §2 声明维护责任沿用 owner-matrix,设计方案 §23 已增「工作台维护者」岗位,本表补一行:路径拟为 runtime/apps/workbench(本轮不改 CODEOWNERS),待其动作按对外交付设计 §8 阶段 ②/③ 列出,实名与 slug 待签收。其余角色行未重列。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T05:17:55-07:00"}],"HeadCommit":{"Sha1":"26b9b2578237a047c841b32ca6b1633669b8ee10","Message":"docs(平台): owner-matrix 增工作台维护者拟设行\n\n对外交付设计 §2 声明维护责任沿用 owner-matrix,设计方案 §23 已增「工作台维护者」岗位,本表补一行:路径拟为 runtime/apps/workbench(本轮不改 CODEOWNERS),待其动作按对外交付设计 §8 阶段 ②/③ 列出,实名与 slug 待签收。其余角色行未重列。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T05:17:55-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/e9ee9c7634e301d18908a21ce30741b93de2fdac...26b9b2578237a047c841b32ca6b1633669b8ee10","Len":1}...
|
1789647479
|
Edit
Delete
|
|
30674
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"2002c24c8 {"Commits":[{"Sha1":"2002c24c8cc0fd770334f4cc11eaeb34a8b45802","Message":"docs(平台): 三份实施设计补 09-17 修订说明、X02 增工作台兼容类、收口顺序收窄 C11—C19\n\n- 域内 / 横切实施设计头部补 2026-09-17 修订说明:模块档位以 modules.json 为准(不再「均为 shape」),点明本轮只改 C18 / C23 / X09 / X02。\n- X02 兼容记录增第五类「管理 API ↔ 工作台」,X02-A 验收补服务端与工作台支持版本组合混跑。\n- 收口方案实施顺序第 5 行 C11—C23 收窄为 C11—C19(C20—C23 已随 CHG-015 撤销);09-17 修订说明补:决策批次 C-9 与本修订的关系由 CHG-018 处理,签署前 C-9 原文仍生效。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T05:25:20-07:00"}],"HeadCommit":{"Sha1":"2002c24c8cc0fd770334f4cc11eaeb34a8b45802","Message":"docs(平台): 三份实施设计补 09-17 修订说明、X02 增工作台兼容类、收口顺序收窄 C11—C19\n\n- 域内 / 横切实施设计头部补 2026-09-17 修订说明:模块档位以 modules.json 为准(不再「均为 shape」),点明本轮只改 C18 / C23 / X09 / X02。\n- X02 兼容记录增第五类「管理 API ↔ 工作台」,X02-A 验收补服务端与工作台支持版本组合混跑。\n- 收口方案实施顺序第 5 行 C11—C23 收窄为 C11—C19(C20—C23 已随 CHG-015 撤销);09-17 修订说明补:决策批次 C-9 与本修订的关系由 CHG-018 处理,签署前 C-9 原文仍生效。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T05:25:20-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/26b9b2578237a047c841b32ca6b1633669b8ee10...2002c24c8cc0fd770334f4cc11eaeb34a8b45802","Len":1}...
|
1789647923
|
Edit
Delete
|
|
30677
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"00af476af {"Commits":[{"Sha1":"00af476afd906241cd46d200852bc871b5d8b52e","Message":"docs(平台): 应用 CHG-018 签署——阶段 ② 开工前置改为缺失接口验收 / 维护者实名 / 技术栈另裁\n\n目录负责人 2026-09-17 签署 CHG-018(approve-with-conditions,luoanwu 代签):C-9「不建第二个 Portal」细分为「不建企业业务 Portal;平台入口由本仓独立工作台承载」。回写:\n- 对外交付设计 §5.1 技术栈改为「按条件 E 另行裁决,不沿用现有 Next.js/React」,§8 阶段 ② 增三项开工前置。\n- 收口方案 09-17 说明改为「C-9 已按 CHG-018 修正」。\n- owner-matrix 工作台维护者实名改为阶段 ② 开工前置(条件 D,不代签)。\nCatalog、modules.json、CODEOWNERS 不动,工作台目录未创建。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T07:29:38-07:00"}],"HeadCommit":{"Sha1":"00af476afd906241cd46d200852bc871b5d8b52e","Message":"docs(平台): 应用 CHG-018 签署——阶段 ② 开工前置改为缺失接口验收 / 维护者实名 / 技术栈另裁\n\n目录负责人 2026-09-17 签署 CHG-018(approve-with-conditions,luoanwu 代签):C-9「不建第二个 Portal」细分为「不建企业业务 Portal;平台入口由本仓独立工作台承载」。回写:\n- 对外交付设计 §5.1 技术栈改为「按条件 E 另行裁决,不沿用现有 Next.js/React」,§8 阶段 ② 增三项开工前置。\n- 收口方案 09-17 说明改为「C-9 已按 CHG-018 修正」。\n- owner-matrix 工作台维护者实名改为阶段 ② 开工前置(条件 D,不代签)。\nCatalog、modules.json、CODEOWNERS 不动,工作台目录未创建。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T07:29:38-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/2002c24c8cc0fd770334f4cc11eaeb34a8b45802...00af476afd906241cd46d200852bc871b5d8b52e","Len":1}...
|
1789655382
|
Edit
Delete
|
|
30679
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"2d4b11719 {"Commits":[{"Sha1":"2d4b117195b8ae318438b9dbd31beec6fefc9e67","Message":"docs(平台): CHG-018 条件 E 撤回——工作台技术栈裁定为 Next.js 静态导出 + React + TypeScript 纯静态 SPA\n\n目录负责人 2026-09-17 第二次答复:沿用现有 Next.js/React/TypeScript,形态取纯静态 SPA。对外交付设计 §5.1 登记技术栈(output: export、无 Node 进程、Caddy 托管、OIDC 公开客户端 + PKCE、组件规范沿用 apps/web、不用 SSR / API routes / middleware),§8 阶段 ② 前置余 A、D;收口方案与 owner-matrix 同步。工作台目录仍未创建。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T07:37:14-07:00"}],"HeadCommit":{"Sha1":"2d4b117195b8ae318438b9dbd31beec6fefc9e67","Message":"docs(平台): CHG-018 条件 E 撤回——工作台技术栈裁定为 Next.js 静态导出 + React + TypeScript 纯静态 SPA\n\n目录负责人 2026-09-17 第二次答复:沿用现有 Next.js/React/TypeScript,形态取纯静态 SPA。对外交付设计 §5.1 登记技术栈(output: export、无 Node 进程、Caddy 托管、OIDC 公开客户端 + PKCE、组件规范沿用 apps/web、不用 SSR / API routes / middleware),§8 阶段 ② 前置余 A、D;收口方案与 owner-matrix 同步。工作台目录仍未创建。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T07:37:14-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/00af476afd906241cd46d200852bc871b5d8b52e...2d4b117195b8ae318438b9dbd31beec6fefc9e67","Len":1}...
|
1789655838
|
Edit
Delete
|
|
30681
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"d6f2f059f {"Commits":[{"Sha1":"d6f2f059f527db47617b61a8bb0f41f015960974","Message":"chore(governance): CHG-018 条件 D 落实——工作台维护者实名 luoguoguo,CODEOWNERS 增 /runtime/apps/workbench/ 行\n\n目录负责人 2026-09-17 指定工作台维护者实名 luoguoguo。CODEOWNERS 新增 /runtime/apps/workbench/ luoguoguo@gmail.com(目录拟建;其余占位 slug 不动,仍按 B-1 代签),头注登记该例外;owner-matrix 工作台行改实名、变更记录加行;对外交付设计 §8 与收口方案把阶段 ② 前置收窄为条件 A。codeowners.test 2/2 通过。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T07:41:31-07:00"}],"HeadCommit":{"Sha1":"d6f2f059f527db47617b61a8bb0f41f015960974","Message":"chore(governance): CHG-018 条件 D 落实——工作台维护者实名 luoguoguo,CODEOWNERS 增 /runtime/apps/workbench/ 行\n\n目录负责人 2026-09-17 指定工作台维护者实名 luoguoguo。CODEOWNERS 新增 /runtime/apps/workbench/ luoguoguo@gmail.com(目录拟建;其余占位 slug 不动,仍按 B-1 代签),头注登记该例外;owner-matrix 工作台行改实名、变更记录加行;对外交付设计 §8 与收口方案把阶段 ② 前置收窄为条件 A。codeowners.test 2/2 通过。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T07:41:31-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/2d4b117195b8ae318438b9dbd31beec6fefc9e67...d6f2f059f527db47617b61a8bb0f41f015960974","Len":1}...
|
1789656094
|
Edit
Delete
|
|
30683
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"4b0385474 {"Commits":[{"Sha1":"4b038547435ddfcb662cee0487ae3681af170211","Message":"chore(reports): 工作台两份快照首次生成 + 静态门禁回绑 @ 8ced3d1\n\nclean 树上:pnpm workbench:snapshots(catalog ok 21 项 / 7 模块映射 / 0 冲突;ops release=partial image=local-only promotion=unknown evidence=partial alerts=8 controlled_operations=unavailable);实现提交使 module-imports(error)与 runtime 六份静态报告过期,逐一重跑回绑:module-imports 0 违规、naming / validation / dual-backend / write-guard / fork-readiness / migrations / docs-truth 全过。check:evidence 回到 partial(fresh 24 / stale 9,余 9 份均为此前需真实库或容器重跑的 warn 级)。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T07:57:59-07:00"},{"Sha1":"8ced3d1ccf7224795cbd9aa2da3157c67efa9728","Message":"feat(governance,runtime): 工作台服务目录与运维证据只读面(CHG-018 条件 A)\n\n- governance/build-workbench-snapshots.mjs(pnpm workbench:snapshots):从 Catalog × modules.json(映射真源 catalog-map.json)× Release Manifest 生成 reports/workbench-catalog-snapshot.latest.json;从 Manifest / 镜像摘要 / 晋级记录 / 证据新鲜度 / 告警规则 / stack/reports / runbook 生成 reports/workbench-ops-snapshot.latest.json。设计 / 实现档位 / 发布版本 / 环境四列分开,环境固定 unknown;来源冲突记 conflicts;派生仓退役记录不当能力退役;controlled_operations 在 CHG-005 审批前固定 unavailable。负向测试 8/8。\n- runtime api-nestjs:GET /api/platform/catalog(装配事实 + PLATFORM_CATALOG_SNAPSHOT_PATH 指向的治理快照;缺失 / 非法即 unavailable;modules.json 与描述符档位不一致记 state_drift)。vitest 4/4,typecheck 与 check:module-imports 通过。\n- evidence-scopes 登记两份快照(error);README 命令表、对外交付设计 §6 两行更新;实现记录 docs/工作台管理接口实现记录-2026-09-17.md(受控执行面因 CHG-005 阻塞,条件 A 部分满足)。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T07:56:52-07:00"}],"HeadCommit":{"Sha1":"4b038547435ddfcb662cee0487ae3681af170211","Message":"chore(reports): 工作台两份快照首次生成 + 静态门禁回绑 @ 8ced3d1\n\nclean 树上:pnpm workbench:snapshots(catalog ok 21 项 / 7 模块映射 / 0 冲突;ops release=partial image=local-only promotion=unknown evidence=partial alerts=8 controlled_operations=unavailable);实现提交使 module-imports(error)与 runtime 六份静态报告过期,逐一重跑回绑:module-imports 0 违规、naming / validation / dual-backend / write-guard / fork-readiness / migrations / docs-truth 全过。check:evidence 回到 partial(fresh 24 / stale 9,余 9 份均为此前需真实库或容器重跑的 warn 级)。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T07:57:59-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/d6f2f059f527db47617b61a8bb0f41f015960974...4b038547435ddfcb662cee0487ae3681af170211","Len":2}...
|
1789657083
|
Edit
Delete
|
|
30685
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"7f55ca25c {"Commits":[{"Sha1":"7f55ca25c007541ec07d552b14dd4c3cc1ca1626","Message":"chore(reports): facts / catalog / catalog:drift / evidence 回绑 @ 7b4c3ed(CHG-007 应用后)\n\ncheck:facts 16/16 可追溯、check:catalog 7 模块一致、catalog:drift error 0 / drift 0;check:evidence 回到 partial(余 9 份既有 warn 级过期)。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T08:03:42-07:00"},{"Sha1":"7b4c3edf8fe9943cd56b9cf43bbaff3bdb9c3c7e","Message":"feat(contracts): 应用 CHG-007——EmploymentTransferred 过期阻塞从 blocked_by 迁到 decided_by(方案 B)\n\n决策批次 2026-09-16 A-1 批准合并。facts.json:blocked_by [DEC-010, DEC-012, DEC-032](三条均 approved)原位改为 decided_by,maturity 保持 draft;impact-graph 为 decided_by 画 GOVERNED_BY 边(edges 仍 215);governance-linter 对 decided_by 里的 DEC 同样校验已登记;两条钉着过期阻塞的测试改为断言溯源已迁移、负例自带阻塞。contracts 测试 283/283、check:facts 16/16、check:catalog 一致。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T08:03:22-07:00"}],"HeadCommit":{"Sha1":"7f55ca25c007541ec07d552b14dd4c3cc1ca1626","Message":"chore(reports): facts / catalog / catalog:drift / evidence 回绑 @ 7b4c3ed(CHG-007 应用后)\n\ncheck:facts 16/16 可追溯、check:catalog 7 模块一致、catalog:drift error 0 / drift 0;check:evidence 回到 partial(余 9 份既有 warn 级过期)。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T08:03:42-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/4b038547435ddfcb662cee0487ae3681af170211...7f55ca25c007541ec07d552b14dd4c3cc1ca1626","Len":2}...
|
1789657425
|
Edit
Delete
|
|
30687
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"bf9f835d9 {"Commits":[{"Sha1":"bf9f835d9c1c1dbc594212999b0e61fb036c9942","Message":"chore(reports): CHG-002 应用后八份报告回绑 @ 73959f8\n\ncaddy 12 前缀覆盖、migration-decs 42 迁移 0 违规、fixtures 17 套件 189 例 0 失败、catalog / catalog:drift(21 项目 / 39 裁决,drift 0)、facts 16、工作台两份快照重生成(catalog 7/7 映射 0 冲突);check:evidence 回到 partial(余 9 份既有 warn 级)。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T08:09:31-07:00"},{"Sha1":"73959f8dee8b1a57c4a2403e4cd727571ed53a57","Message":"feat(contracts): 应用 CHG-002(重基线到活跃 Catalog)——拓扑登记三字段、21 项 form/hosted_by、DEC-037—039 登记为 pending\n\n决策批次 2026-09-16 A-2 批准串行合并 CHG-002 → 003 → 006;CHG-002 模拟器基线(冻结副本)已退役,本次按其四份 delta 直接应用到活跃 Catalog 并逐项核对:\n- schema:项目条目增 form / hosted_by / archived_tag 三个可选字段;generated 类型同步。\n- platform-projects:21 项 form(7 runtime-module / 9 contract / 3 adopted / 2 asset)与 hosted_by;add_blockers 原样应用(idp +032;权限 +010/012/032;Scope +032/039;干线 +032;注册中心 +031/032;交付 +031;AI 治理 +007;OS +009/010/012/032)。\n- 重基线调整:archived_tag 取 Catalog retirement.derived_repo_tag(派生仓 09-15/16 已退役,不再写 09-10 的常量);OS 条目 evidence「数字员工OS/CLAUDE.md」不存在,保留现值;tests.delta 的 pendingDecisions 锚点按活跃基线 0 → 3。\n- decisions:+DEC-037 / 038 / 039(pending,source 指向草案);modules.json scope.blocked_by += DEC-039 与 Catalog 一致。\ncontracts 测试 283/283、check:generated 一致;根 check:modules / check:catalog(21 项目 / 39 裁决)/ catalog:drift 0 / check:facts 16 通过;governance 265/265;domain-layer 13 条与应用前完全相同。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T08:08:50-07:00"}],"HeadCommit":{"Sha1":"bf9f835d9c1c1dbc594212999b0e61fb036c9942","Message":"chore(reports): CHG-002 应用后八份报告回绑 @ 73959f8\n\ncaddy 12 前缀覆盖、migration-decs 42 迁移 0 违规、fixtures 17 套件 189 例 0 失败、catalog / catalog:drift(21 项目 / 39 裁决,drift 0)、facts 16、工作台两份快照重生成(catalog 7/7 映射 0 冲突);check:evidence 回到 partial(余 9 份既有 warn 级)。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T08:09:31-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/7f55ca25c007541ec07d552b14dd4c3cc1ca1626...bf9f835d9c1c1dbc594212999b0e61fb036c9942","Len":2}...
|
1789657774
|
Edit
Delete
|
|
30689
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"b994fb357 {"Commits":[{"Sha1":"b994fb35767d4bf107edd51dcbd5b6366d032ca2","Message":"chore(reports): CHG-004 应用后十份报告回绑 @ d88c3f1\n\nfacts(Catalog 11 / 候选 5)、catalog / catalog:drift、caddy、fixtures 189/189、migration-decs、module-imports、工作台两份快照(catalog 7/7 映射 0 冲突);check:evidence partial(余 9 份既有 warn 级)。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T08:19:51-07:00"},{"Sha1":"d88c3f1636f2a19dd3a2d4f4ab61158ce2fa4e51","Message":"feat(contracts): 应用 CHG-004 阶段 2(重基线到活跃契约)——10 条平台事实登记为 draft、7 实体、5 份模块 AppManifest、5 份候选 OpenAPI\n\n决策批次 2026-09-16 A-7 批准。simulate-chg-004 增 --contracts=active / --apply(镜像活跃契约、跳过已落地的 CHG-001—003),镜像验证 passed(check 0 错误、17 apps / 168 entities / 11 facts、schema-compatibility 11/11、impact 257 节点 / 297 边、测试 283/283)后同一组 ops 应用到活跃契约:46 个文件(15 份事实 Schema + party-canonical-ids、5 份 AppManifest、2 份 AppManifest 补丁、entities +7、facts +10、decisions 11 项 source 改指、compatibility baseline +10 与 10 份不可变快照、5 份候选 OpenAPI、4 份测试锚点)。5 条业务域事实保持 deferred(候选目录保留)。\ncompanion:删除 10 条已登记候选;七模块 src/facts/facts.json 相应 produces 改 registered;重基线两处:① validators.test 的 AppManifest 文件数锚点 12 → 17(该测试晚于冻结基线);② 10 条新登记事实里已批准的 blocked_by 按 CHG-007 方案 B 迁到 decided_by(D5 STALE_FACT_BLOCK 9 → 0;TenantProvisioned 仍 blocked_by DEC-039),maturity 一律 draft 不变。\n应用后:contracts 283/283、check:generated 一致、check:facts 16(Catalog 11 / 候选 5)、check:catalog 一致、drift 0、fixtures 189/189、governance 265/265、domain-layer 回到 13 条(与应用前相同)。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T08:19:31-07:00"}],"HeadCommit":{"Sha1":"b994fb35767d4bf107edd51dcbd5b6366d032ca2","Message":"chore(reports): CHG-004 应用后十份报告回绑 @ d88c3f1\n\nfacts(Catalog 11 / 候选 5)、catalog / catalog:drift、caddy、fixtures 189/189、migration-decs、module-imports、工作台两份快照(catalog 7/7 映射 0 冲突);check:evidence partial(余 9 份既有 warn 级)。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T08:19:51-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/bf9f835d9c1c1dbc594212999b0e61fb036c9942...b994fb35767d4bf107edd51dcbd5b6366d032ca2","Len":2}...
|
1789658394
|
Edit
Delete
|
|
30691
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"b54eccb01 {"Commits":[{"Sha1":"b54eccb01afc84bc640e987a599840b3f645e167","Message":"chore(reports): CHG-005 应用后 catalog / drift / facts / fixtures / 工作台快照 / evidence 回绑 @ 255dc31\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T08:28:43-07:00"},{"Sha1":"255dc31e193ad4e83aefce8d78c80259c1032161","Message":"feat(contracts): 应用 CHG-005——permissions.json 新增 platform.operations 资源;平台运维命令候选契约入仓\n\n目录负责人 2026-09-17 批准 CHG-005(Catalog Owner / 企业架构负责人 / Security 三份代签回执见材料)。simulate-chg-005 --contracts=active 镜像活跃契约验证 passed(permissionResources 9、impact 258 / 297、283/283、无新错误码)后 --apply:permissions.json 增 platform.operations(owner_domain=platform,maturity=draft,八动作),两处测试锚点同步。候选契约 platform-ops-api.v1 OpenAPI / 五个 OperationDefinition / catalog-delta 拷入 contracts/candidates/contracts(A-7 第二批 platform-ops-api 项)。audit-seeds 与运行时守卫另行实施。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T08:28:38-07:00"}],"HeadCommit":{"Sha1":"b54eccb01afc84bc640e987a599840b3f645e167","Message":"chore(reports): CHG-005 应用后 catalog / drift / facts / fixtures / 工作台快照 / evidence 回绑 @ 255dc31\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T08:28:43-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/b994fb35767d4bf107edd51dcbd5b6366d032ca2...b54eccb01afc84bc640e987a599840b3f645e167","Len":2}...
|
1789658927
|
Edit
Delete
|
|
30693
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"7ca595293 {"Commits":[{"Sha1":"7ca595293cae2a013f38280665e3ad8135c5d3c3","Message":"chore(reports): CHG-019 应用后 catalog / drift / fixtures / 工作台快照 / evidence 回绑 @ bde8af9\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T08:34:28-07:00"},{"Sha1":"bde8af9ca8d2191cd8a05fc10121ef108f6ce67e","Message":"feat(contracts): 应用 CHG-019(A-6)——permissions.json 八项应用域资源升 active,Linter 成熟度合法集扩为 draft | active\n\n决策批次 2026-09-16 A-6 批准「8 项离开 draft」,目录负责人 2026-09-17 选定终态 active。Linter PERMISSION_RESOURCE_METADATA_INVALID 改为 maturity ∈ {draft, active} 且 owner_domain 必填;hr.employment / identity.tenant-administration / knowledge.content / device.asset / quotation.operations / service.operations / execution.operations / material.production 改 active;platform.operations(CHG-005)保持 draft 至 OPS 命令验收。测试补成熟度负例与八项 active 基线断言,285/285;check:generated 一致;catalog / drift / fixtures 通过。运行时接线(P-4)随后单独提交。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T08:34:24-07:00"}],"HeadCommit":{"Sha1":"7ca595293cae2a013f38280665e3ad8135c5d3c3","Message":"chore(reports): CHG-019 应用后 catalog / drift / fixtures / 工作台快照 / evidence 回绑 @ bde8af9\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T08:34:28-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/b54eccb01afc84bc640e987a599840b3f645e167...7ca595293cae2a013f38280665e3ad8135c5d3c3","Len":2}...
|
1789659271
|
Edit
Delete
|
|
30694
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"05c96b7f6 {"Commits":[{"Sha1":"05c96b7f6c43acc654b182a9e08cdd55f02ed8ee","Message":"chore(reports): runtime 静态门禁(含新增 permission-catalog)与 module-imports / evidence 回绑 @ a51ad37\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T08:39:35-07:00"},{"Sha1":"a51ad37404e4a474389e5cccc3f6876a0cc18a20","Message":"feat(runtime): CHG-019 / P-4 运行时接线——权限目录构建期快照喂装配点,decide 先过目录准入\n\n- scripts/sync-permission-catalog.mjs:把 contracts/catalogs/permissions.json 渲染为 packages/contracts/src/permission-catalog.ts(PERMISSION_CATALOG_ROUTES,57 条 resource:action,带 source sha256);--check 进 runtime check 链(check:permission-catalog,负向已验证:改一条 active 为 draft 即 exit 1),reports/permission-catalog.latest.json 登记进 check:evidence 作用域。\n- module-kit PlatformModuleDeps.permissionCatalog;permission 模块 domain/catalog-admission.ts(CATALOG_UNAVAILABLE / RESOURCE_NOT_IN_CATALOG / RESOURCE_NOT_ACTIVE;生产一律强制,其他环境 PLATFORM_PERMISSION_CATALOG_ENFORCE=1),PermissionStore.decide 在任何租户授权查询之前先过准入;装配点从 @repo/contracts 传入快照。\n- 5 例负向单测;api-nestjs 21 例装配单测、typecheck、check:module-imports、runtime 14 项静态门禁全过。runbook §2 增环境行;缺失清单 P-4 标已接线;runtime/CLAUDE.md 基线表增 permission-catalog 行。真实库下的拒绝用例待 check:runtime 重跑。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T08:39:26-07:00"}],"HeadCommit":{"Sha1":"05c96b7f6c43acc654b182a9e08cdd55f02ed8ee","Message":"chore(reports): runtime 静态门禁(含新增 permission-catalog)与 module-imports / evidence 回绑 @ a51ad37\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T08:39:35-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/7ca595293cae2a013f38280665e3ad8135c5d3c3...05c96b7f6c43acc654b182a9e08cdd55f02ed8ee","Len":2}...
|
1789659579
|
Edit
Delete
|
|
30696
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"908cf2d86 {"Commits":[{"Sha1":"908cf2d862dd87d195567ab8b87bee0f487755af","Message":"chore(reports): fixtures / facts / migration-decs / 工作台快照 / evidence 回绑 @ a51ad37(permission 模块源码变更后)\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T08:40:15-07:00"}],"HeadCommit":{"Sha1":"908cf2d862dd87d195567ab8b87bee0f487755af","Message":"chore(reports): fixtures / facts / migration-decs / 工作台快照 / evidence 回绑 @ a51ad37(permission 模块源码变更后)\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T08:40:15-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/05c96b7f6c43acc654b182a9e08cdd55f02ed8ee...908cf2d862dd87d195567ab8b87bee0f487755af","Len":1}...
|
1789659619
|
Edit
Delete
|
|
30697
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"1ccb3b69c {"Commits":[{"Sha1":"1ccb3b69c365de2f80a4032ee4035a6999253197","Message":"chore(reports): OPS-1 应用后门禁回绑 @ 6378b6f\n\nruntime 16 项静态门禁(含新增 check:platform-ops-definitions)、module-imports 0、fixtures 189/189、facts 16、catalog / drift、migration-decs、caddy、工作台两份快照(controlled_operations=recorded,5 条定义 1 条已实现);check:evidence partial(fresh 26 / stale 9,余 9 份均为需真实库或容器重跑的 warn 级)。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T15:59:06-07:00"},{"Sha1":"6378b6fbbdc70f947a007c7a644eea2929ed8484","Message":"feat(runtime,contracts): OPS-1 平台运维命令 API 首条命令 permission.invalidation(CHG-005 / X09;CHG-018 条件 A 受控执行面)\n\n目录负责人 2026-09-17 批准 CHG-005 并点选「登记 + 契约 + 实现第一条命令」。\n- 候选 Schema:contracts/candidates/schemas/platform-ops/{operation-definitions,operation-request,operation-receipt}.v1.schema.json(补齐 OpenAPI 原引用的三份缺文件)。\n- 定义快照:runtime/scripts/sync-platform-ops-definitions.mjs → packages/contracts/src/platform-ops-definitions.ts(5 条),check:platform-ops-definitions 进 runtime check 链(负向已验证:改一条 risk 即 exit 1)。\n- 线上形状:packages/contracts/src/platform-ops.ts(请求 / 回执 Zod、ReasonCode、opr_ 编码、规范化 JSON),单测 4/4。\n- 模块接口:module-kit PlatformOpsRuntime(plan / execute / receipt)+ PlatformModule.opsRuntime 钩子;M3 实现以 operationId 为账本幂等键(invalidation_ledger.fact_id),审计经既有 outbox 中继(details 带 operation_id / definition_id / reason_code)。\n- 装配点:/api/platform/ops/{definitions,{definitionId},receipts/{operationId}},三重守卫(platform:ops scope ∧ 管理客户端 ∧ 管理员白名单,未配置即失败关闭)、Idempotency-Key、dry-run、plan_digest、executable 判定;auth 增 token scope/scp → AuthContext.scopes。\n- 工作台运维快照:controlled_operations 由固定 unavailable 改为登记五条定义与本仓实现状态,不声称任何环境可执行。\n验收:contracts 4/4、装配点纯函数 6/6、permission 隔离库集成 2/2(platform_permission_test,非超级用户角色)、真实 HTTP 4/4(内核库 + Redis :56379/7 + AUTH_MODE=jwt,覆盖 401/403/URL 凭证/executable/planned/缺键 400/409 不可执行/succeeded→replayed→409 冲突/回执一致/跨租户 404)、governance 265/265、runtime 静态门禁全过。记录见 docs/平台运维命令OPS-1实现记录-2026-09-17.md。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T15:58:44-07:00"}],"HeadCommit":{"Sha1":"1ccb3b69c365de2f80a4032ee4035a6999253197","Message":"chore(reports): OPS-1 应用后门禁回绑 @ 6378b6f\n\nruntime 16 项静态门禁(含新增 check:platform-ops-definitions)、module-imports 0、fixtures 189/189、facts 16、catalog / drift、migration-decs、caddy、工作台两份快照(controlled_operations=recorded,5 条定义 1 条已实现);check:evidence partial(fresh 26 / stale 9,余 9 份均为需真实库或容器重跑的 warn 级)。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T15:59:06-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/908cf2d862dd87d195567ab8b87bee0f487755af...1ccb3b69c365de2f80a4032ee4035a6999253197","Len":2}...
|
1789685949
|
Edit
Delete
|
|
30700
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"361a0e418 {"Commits":[{"Sha1":"361a0e418fa5c6c648f95625c7829a0c46a76cde","Message":"docs(交付设计): 补部署单元拆分触发条件、管理面不入业务同步依赖链、按应用/租户限额三处约束;§4.1 增制品覆盖对账表\n\n- §5.1:拆出独立部署单元须满足独立扩容 / 故障隔离 / 发布节奏冲突任一条件,由该模块 Owner 提出,走变更包且不改既有契约与端口签名\n- §7.2:表前增同步依赖链约束(业务请求路径只允许权限判定 / 凭据校验 / 事实受理 / 审计追加 / AI 路由五类运行接口);表增「单个应用或租户流量激增」一行,按应用身份限额须待 M2 凭据达 authority 后签收\n- §4.1:按磁盘核对七条能力线的模块档位 / 客户端包 / 正式 OpenAPI,SDK 覆盖 3 / 7;凭据与数据范围有正式规范无权威实现,身份有权威实现无正式规范\n\n治理层 check-workspace-consistency 报 ISSUES 3 条(L8 冻结补丁布局、L9 compose project 撞名、L12 内核 pin 落后),均为既有项,与本次改动无关;本文件不在 evidence-scopes 内,不触发报告回绑。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T16:00:07-07:00"}],"HeadCommit":{"Sha1":"361a0e418fa5c6c648f95625c7829a0c46a76cde","Message":"docs(交付设计): 补部署单元拆分触发条件、管理面不入业务同步依赖链、按应用/租户限额三处约束;§4.1 增制品覆盖对账表\n\n- §5.1:拆出独立部署单元须满足独立扩容 / 故障隔离 / 发布节奏冲突任一条件,由该模块 Owner 提出,走变更包且不改既有契约与端口签名\n- §7.2:表前增同步依赖链约束(业务请求路径只允许权限判定 / 凭据校验 / 事实受理 / 审计追加 / AI 路由五类运行接口);表增「单个应用或租户流量激增」一行,按应用身份限额须待 M2 凭据达 authority 后签收\n- §4.1:按磁盘核对七条能力线的模块档位 / 客户端包 / 正式 OpenAPI,SDK 覆盖 3 / 7;凭据与数据范围有正式规范无权威实现,身份有权威实现无正式规范\n\n治理层 check-workspace-consistency 报 ISSUES 3 条(L8 冻结补丁布局、L9 compose project 撞名、L12 内核 pin 落后),均为既有项,与本次改动无关;本文件不在 evidence-scopes 内,不触发报告回绑。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T16:00:07-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/1ccb3b69c365de2f80a4032ee4035a6999253197...361a0e418fa5c6c648f95625c7829a0c46a76cde","Len":1}...
|
1789686091
|
Edit
Delete
|
|
30704
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"460cfe907 {"Commits":[{"Sha1":"460cfe907dba69936a3bec815b177f2f96ba8790","Message":"feat(runtime): WB-1 工作台脚手架——runtime/apps/workbench 纯静态 SPA 与四页只读面\n\n按 CHG-018 §5.1 已裁技术栈建独立应用:Next.js output=export + React + TypeScript,\n无 SSR / API routes / middleware,产物 out/ 由 Caddy 托管(入口鉴权与部署注入属 SRE,未做)。\n\n- 四页:总览(运行时装配事实)、服务目录(构建期快照)、只读运行信息(模块与 health 探针)、登录(OIDC 公开客户端 Authorization Code + PKCE,带 state / nonce,令牌只入 sessionStorage 且只走 Authorization 头)\n- StateBlock 把缺接口 / 缺凭证 / 缺权限 / 依赖故障 / 响应不可解析 / 空数据分别成状态显示,不以模拟数据或空成功掩盖(§5.2)\n- 不静态 import 任何 @juhai/module-*,只经公开 HTTP 只读面取数;catalog / modules 响应形状在 features/platform/types.ts 作浏览器侧镜像并注明真源文件\n- 目录快照经 scripts/copy-snapshots.mjs 于构建期复制为静态资产;缺快照时页面显示「未随构建附带」而非空目录\n- 环境列固定 unknown、装载成功不渲染为健康、空 health 明示不等于业务健康\n- check:fork-readiness 的 F7 / F9 忽略表补 out(静态导出产物,与 dist / .next 同类)——本仓首个静态导出应用暴露的缺口\n\n本机验收(dev 服务 :3010,API 指向容器 127.0.0.1:53001):服务目录页渲染真实快照 21 条目、\n快照来源显示绑定 6378b6f;总览与运行信息页因跨源被拦,如实显示依赖故障;登录页显示缺配置。\nruntime 静态门禁 31 项通过(含 workbench typecheck / lint);check:naming、check:module-imports、\ncheck:fork-readiness 通过。目标环境验收未做:运行容器源码为 19150ae,早于目录读面与 OPS-1,\n/api/platform/catalog 与 /api/platform/ops/definitions 实测 404。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T16:14:34-07:00"},{"Sha1":"41ca98813d6661f799d6cd4f8674fbc265a5cf6c","Message":"docs(runtime): PF-03 ⑤ 回灌——GOVERNANCE-BASELINE 表与发布快照不再冒充框架仓事实\n\n偏差 #11:runtime/CLAUDE.md 的动态区「证据新鲜度」已回灌为本仓事实(652 /\n7e26a50 / 2026-09-13),其下的 GOVERNANCE-BASELINE 表却仍写着框架仓的\n288 tests @ 17b8276 与 4 组合 UI,同一文件里两份真源打架——而该文件自己\n规定「判定治理状态只认动态区 + reports」。\n\n四行按 runtime-acceptance / ui-acceptance 两份报告回灌:\n\n- runtime-acceptance:288 @ 17b8276 → 652 @ 7e26a50,证据描述改本仓底座\n (PG :55471 / Redis :56380/7 / Redpanda :59093 + platform_identity_test)\n- tests-passing:288 → 652,地板改指 reports/baseline.json\n- tenant-rls:clean SHA 17b8276 → 7e26a50,去掉框架的「两后端各 6 例」\n- ui-acceptance:4 组合 × 11 用例 → 1 组合(nestjs × ws)5 用例,地板 11 → 5\n\n「发布状态快照」一段描述的是框架仓 base-framework 的两个远端与 CI run,\n随 scaffold 带入本仓,在此读起来像本仓状态:加归属标注并指向开发计划 §1\n仓与远端行,保留原文作版本轴溯源,不删。\n\ncheck:docs-truth 通过(动态区两行 SHA 断言未受影响)、check:governance-docs\n通过(AGENTS.md 符号链接一致)。\n\n报告未回绑:工作区有并行会话在途的 pnpm-lock / check-fork-readiness /\napps/workbench,拿不到干净树。作用域内四份报告(docs-truth、governance-docs、\nagent-adapters、dual-backend-parity,均 warn 级)待干净树的 chore(reports)。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T16:14:02-07:00"}],"HeadCommit":{"Sha1":"460cfe907dba69936a3bec815b177f2f96ba8790","Message":"feat(runtime): WB-1 工作台脚手架——runtime/apps/workbench 纯静态 SPA 与四页只读面\n\n按 CHG-018 §5.1 已裁技术栈建独立应用:Next.js output=export + React + TypeScript,\n无 SSR / API routes / middleware,产物 out/ 由 Caddy 托管(入口鉴权与部署注入属 SRE,未做)。\n\n- 四页:总览(运行时装配事实)、服务目录(构建期快照)、只读运行信息(模块与 health 探针)、登录(OIDC 公开客户端 Authorization Code + PKCE,带 state / nonce,令牌只入 sessionStorage 且只走 Authorization 头)\n- StateBlock 把缺接口 / 缺凭证 / 缺权限 / 依赖故障 / 响应不可解析 / 空数据分别成状态显示,不以模拟数据或空成功掩盖(§5.2)\n- 不静态 import 任何 @juhai/module-*,只经公开 HTTP 只读面取数;catalog / modules 响应形状在 features/platform/types.ts 作浏览器侧镜像并注明真源文件\n- 目录快照经 scripts/copy-snapshots.mjs 于构建期复制为静态资产;缺快照时页面显示「未随构建附带」而非空目录\n- 环境列固定 unknown、装载成功不渲染为健康、空 health 明示不等于业务健康\n- check:fork-readiness 的 F7 / F9 忽略表补 out(静态导出产物,与 dist / .next 同类)——本仓首个静态导出应用暴露的缺口\n\n本机验收(dev 服务 :3010,API 指向容器 127.0.0.1:53001):服务目录页渲染真实快照 21 条目、\n快照来源显示绑定 6378b6f;总览与运行信息页因跨源被拦,如实显示依赖故障;登录页显示缺配置。\nruntime 静态门禁 31 项通过(含 workbench typecheck / lint);check:naming、check:module-imports、\ncheck:fork-readiness 通过。目标环境验收未做:运行容器源码为 19150ae,早于目录读面与 OPS-1,\n/api/platform/catalog 与 /api/platform/ops/definitions 实测 404。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T16:14:34-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/361a0e418fa5c6c648f95625c7829a0c46a76cde...460cfe907dba69936a3bec815b177f2f96ba8790","Len":2}...
|
1789686902
|
Edit
Delete
|
|
30705
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"9a111b33b {"Commits":[{"Sha1":"9a111b33be8f5471c74e5c9310cb8acdc8fbdeb1","Message":"chore(reports): WB-1 脚手架后门禁回绑 @ 460cfe9\n\n仓根 pnpm check 在 clean 树上退出码 0:pins / modules / module-imports(409 源文件 0 跨模块 import)/\ncatalog / drift / fixtures 17 套件 189 例 / facts / migration-decs / caddy / otel / governance 265 测试 0 失败 /\ncontracts check:local / runtime 静态门禁 31 项(含 workbench typecheck 与 lint)/ evidence。\n\ncheck:evidence 仍 partial:36 份登记中 26 新鲜、9 过期、1 例外。9 份过期全部是需真实环境的验收类报告\n(port-conformance / runtime-acceptance / ui-acceptance / revocation-sla / mainline-acceptance /\nidentity-http / identity-ui / mainline-restore / mainline-candidate-regression),与本次新增前端无关。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T16:15:35-07:00"}],"HeadCommit":{"Sha1":"9a111b33be8f5471c74e5c9310cb8acdc8fbdeb1","Message":"chore(reports): WB-1 脚手架后门禁回绑 @ 460cfe9\n\n仓根 pnpm check 在 clean 树上退出码 0:pins / modules / module-imports(409 源文件 0 跨模块 import)/\ncatalog / drift / fixtures 17 套件 189 例 / facts / migration-decs / caddy / otel / governance 265 测试 0 失败 /\ncontracts check:local / runtime 静态门禁 31 项(含 workbench typecheck 与 lint)/ evidence。\n\ncheck:evidence 仍 partial:36 份登记中 26 新鲜、9 过期、1 例外。9 份过期全部是需真实环境的验收类报告\n(port-conformance / runtime-acceptance / ui-acceptance / revocation-sla / mainline-acceptance /\nidentity-http / identity-ui / mainline-restore / mainline-candidate-regression),与本次新增前端无关。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T16:15:35-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/460cfe907dba69936a3bec815b177f2f96ba8790...9a111b33be8f5471c74e5c9310cb8acdc8fbdeb1","Len":1}...
|
1789686947
|
Edit
Delete
|
|
30706
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"8dae61f91 {"Commits":[{"Sha1":"8dae61f91b56f708b1c76e66f07d98efa4828a36","Message":"docs(runtime): WB-1 工作台脚手架实现记录——本机验收范围、口径落点与未做项归属\n\n明确本记录不构成阶段 ② 验收:Caddy 托管 / 入口鉴权 / 快照与 PLATFORM_OPS_* 进部署 / 镜像注入\nPLATFORM_SOURCE_SHA / 目标环境四页验收 / 工作台制品入 Manifest 均未做,逐项标注归属。\n记录部署侧既知阻碍:容器镜像源码 19150ae 早于 8ced3d1 与 6378b6f,catalog 与 ops/definitions 实测 404。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T16:16:11-07:00"}],"HeadCommit":{"Sha1":"8dae61f91b56f708b1c76e66f07d98efa4828a36","Message":"docs(runtime): WB-1 工作台脚手架实现记录——本机验收范围、口径落点与未做项归属\n\n明确本记录不构成阶段 ② 验收:Caddy 托管 / 入口鉴权 / 快照与 PLATFORM_OPS_* 进部署 / 镜像注入\nPLATFORM_SOURCE_SHA / 目标环境四页验收 / 工作台制品入 Manifest 均未做,逐项标注归属。\n记录部署侧既知阻碍:容器镜像源码 19150ae 早于 8ced3d1 与 6378b6f,catalog 与 ops/definitions 实测 404。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T16:16:11-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/9a111b33be8f5471c74e5c9310cb8acdc8fbdeb1...8dae61f91b56f708b1c76e66f07d98efa4828a36","Len":1}...
|
1789686980
|
Edit
Delete
|
|
30713
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"a7a19ec54 {"Commits":[{"Sha1":"a7a19ec54a9f4ed81c770afa85a19125130e85a5","Message":"chore(reports): PF-03 ⑤ 回灌后静态门禁回绑 @ a084c5e\n\n干净树上重跑根 pnpm check(31 个 turbo 任务全过),26 份报告绑定\na084c5e / worktreeDirty=false。同时结清 41ca988 当时因并行会话在途、\n拿不到干净树而欠下的四份文档作用域报告(docs-truth、governance-docs、\nagent-adapters、dual-backend-parity)。\n\ncheck:evidence 仍为 partial:36 份已登记,26 新鲜 / 9 过期 / 1 例外。\n九条过期均为既有项,都需要真实环境重跑才能消除,不在本轮范围:\nport-conformance、runtime/ui-acceptance、revocation-sla、\nmainline-acceptance、mainline-restore、mainline-candidate-regression、\nidentity-http、identity-ui。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T16:18:40-07:00"},{"Sha1":"a084c5e5f61f25a4f70efca3c42a763a1e7c9b8d","Message":"docs(runtime): PF-03 ⑤ 收口——README 与 CHANGELOG 声明本目录身份与版本轴归属\n\n承 41ca988。这两份随 scaffold 带入的框架文档不含错误的验收数字,问题是\n身份:读者落到 runtime/ 会以为自己在基础框架仓。\n\nREADME:\n- 标题由「基础框架 / Base Framework」改为「enterprise-platform/runtime\n (基础框架 v0.16.1 的 scaffold 实例)」,开篇说明下文绝大部分是框架原文\n 且仍准确,并划清三条界线——版本轴属框架、状态只认本仓报告与 CLAUDE.md\n 动态区、领取顺序在开发计划不设第二份\n- 目录结构补上此前完全缺失的本仓特有部分:modules/(kit + 七模块,\n modules.json + PLATFORM_PROFILES + 一模块一库)、clients/(@juhai/client-*)、\n test/(platform-tests),apps/ 补 workbench 与 api-nestjs 的平台装配点\n\nCHANGELOG:加一段说明这份轴属于框架、随 scaffold 带入,package.json 的\n0.16.1 读作「本运行时基于框架 0.16.1」而非平台版本;平台自己的发布轴是\nRelease Manifest、@juhai/* 包版本与开发计划 §2 的里程碑,平台侧新增能力\n不在此登记。\n\n框架原文的门禁、命令与 ADR 一律未动。check:docs-truth 与\ncheck:governance-docs 均通过(README 的信封形状与 api-fastify 定位断言\n未受影响)。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T16:17:59-07:00"}],"HeadCommit":{"Sha1":"a7a19ec54a9f4ed81c770afa85a19125130e85a5","Message":"chore(reports): PF-03 ⑤ 回灌后静态门禁回绑 @ a084c5e\n\n干净树上重跑根 pnpm check(31 个 turbo 任务全过),26 份报告绑定\na084c5e / worktreeDirty=false。同时结清 41ca988 当时因并行会话在途、\n拿不到干净树而欠下的四份文档作用域报告(docs-truth、governance-docs、\nagent-adapters、dual-backend-parity)。\n\ncheck:evidence 仍为 partial:36 份已登记,26 新鲜 / 9 过期 / 1 例外。\n九条过期均为既有项,都需要真实环境重跑才能消除,不在本轮范围:\nport-conformance、runtime/ui-acceptance、revocation-sla、\nmainline-acceptance、mainline-restore、mainline-candidate-regression、\nidentity-http、identity-ui。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T16:18:40-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/8dae61f91b56f708b1c76e66f07d98efa4828a36...a7a19ec54a9f4ed81c770afa85a19125130e85a5","Len":2}...
|
1789687171
|
Edit
Delete
|
|
30715
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"bd625a1a1 {"Commits":[{"Sha1":"bd625a1a1535a34e265b11424a646618c543ffef","Message":"chore(reports): catalog:drift 升档后全量回绑 @ 8382c04(干净树)\n\n根 check 链 exit 0(catalog:drift 升档后 error 0 / drift 0 仍通过)、runtime 16 项静态门禁、工作台两份快照重生成。\n\n顺带清掉 7 条 EVIDENCE_BOUND_DIRTY:caddy / fixtures / facts / migration-decs / module-imports / catalog-reconciliation / otel 此前由 a7a19ec(PF-03 ⑤ 回绑)带进干净树时绑在脏树上,本次在干净树重跑后绑定 8382c04 / worktreeDirty=false。check:evidence 由 failed 回到 partial(新鲜 26 / 过期 9 / 无效 0),余 9 条过期均为需真实库或容器重跑的 warn 级。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T16:22:31-07:00"},{"Sha1":"8382c0432e3c0cc2f2c6f379a2374d5f6e2cc9d1","Message":"feat(governance): catalog:drift 升档为阻断(决策批次 2026-09-16 C-12)\n\nC-12 的两个前置都已满足:A-2 已应用(CHG-002 于本轮落地),drift 已清零(error 0 / drift 0 / info 5 / unknown 0)。\n\n升档前的实况比\"能发现、不能阻断\"更弱:只有 `--strict` 才对 `error` 阻断,而根 `pnpm check` 从不传该开关、全仓也没有任何调用方传过——这道门禁装上之后一次都没拦过。现改为 `error` 与 `drift` 一律 exit 1,不再需要开关;`info`(authority≠E2 的刻意保留)与 `unknown`(独立克隆缺仓外资料)不阻断,独立克隆的失败关闭由 contracts check:local 与完整 check 承担。输出行的 ✓/✗ 同步按两档判。\n\n测试补 CLI 层四段:干净 exit 0、drift exit 1(升档前此处为 0)、error exit 1、工作区不可用只记 unknown 不阻断。check-catalog-drift 6/6。\n\n另修工作台运维快照:evidence 一档原样透传 check:evidence 的结论,passed / partial / failed 都是合法取值,此前允许集合漏了 failed——证据一过期就把快照测试打红,而不是让快照如实显示过期。规则行与测试同步补上,仍不含 available / healthy 这类会被误读成\"环境可用\"的词。governance 266/266。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T16:21:32-07:00"}],"HeadCommit":{"Sha1":"bd625a1a1535a34e265b11424a646618c543ffef","Message":"chore(reports): catalog:drift 升档后全量回绑 @ 8382c04(干净树)\n\n根 check 链 exit 0(catalog:drift 升档后 error 0 / drift 0 仍通过)、runtime 16 项静态门禁、工作台两份快照重生成。\n\n顺带清掉 7 条 EVIDENCE_BOUND_DIRTY:caddy / fixtures / facts / migration-decs / module-imports / catalog-reconciliation / otel 此前由 a7a19ec(PF-03 ⑤ 回绑)带进干净树时绑在脏树上,本次在干净树重跑后绑定 8382c04 / worktreeDirty=false。check:evidence 由 failed 回到 partial(新鲜 26 / 过期 9 / 无效 0),余 9 条过期均为需真实库或容器重跑的 warn 级。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T16:22:31-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/a7a19ec54a9f4ed81c770afa85a19125130e85a5...bd625a1a1535a34e265b11424a646618c543ffef","Len":2}...
|
1789687353
|
Edit
Delete
|
|
30719
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"ac396a0f2 {"Commits":[{"Sha1":"ac396a0f27fd673e02fc0c2f5887ea7f06b879b4","Message":"chore(governance): evidence-scopes 口径说明补第五类——有 provenance 但无生成脚本的一次性记录\n\n那段说明自 2026-09-15 起写「余 15 份未登记,都是有意不登」并逐类枚举,\n但今天实测是 16 份,且 client-identity 与 governance-truth-validation 两份\n不在任何一类里——说明本身成了过期声明,而它正是「为什么不登」的唯一依据。\n\n全仓搜索确认这两份没有生成脚本(与 caddy / workbench-snapshots 这类有\ngenerator 的登记项相反),属手工一次性记录:可以有合法 provenance,但不可\n重跑,登记后必然过期且只能靠例外掩盖。故新增第五类并写明:\n\n- 与 reports/stack-image-pins.latest.json 同因不同果——后者当年登记了,\n 于是只能挂一条带出口的例外;第五类因未登记而无需例外\n- 出口同样二选一:补生成脚本后转正式登记,或退役该报告\n- 在此之前它们只是记录,不得被引用为可重跑的机器证据\n\n计数改为带日期的复核快照。未新增或删除任何作用域登记,未改判据,未动文件\n其余格式(差异 1 行)。check:evidence 仍 partial(26 新鲜 / 9 过期 / 1 例外,\n与改前逐项相同);governance 测试 266/266。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T16:23:44-07:00"}],"HeadCommit":{"Sha1":"ac396a0f27fd673e02fc0c2f5887ea7f06b879b4","Message":"chore(governance): evidence-scopes 口径说明补第五类——有 provenance 但无生成脚本的一次性记录\n\n那段说明自 2026-09-15 起写「余 15 份未登记,都是有意不登」并逐类枚举,\n但今天实测是 16 份,且 client-identity 与 governance-truth-validation 两份\n不在任何一类里——说明本身成了过期声明,而它正是「为什么不登」的唯一依据。\n\n全仓搜索确认这两份没有生成脚本(与 caddy / workbench-snapshots 这类有\ngenerator 的登记项相反),属手工一次性记录:可以有合法 provenance,但不可\n重跑,登记后必然过期且只能靠例外掩盖。故新增第五类并写明:\n\n- 与 reports/stack-image-pins.latest.json 同因不同果——后者当年登记了,\n 于是只能挂一条带出口的例外;第五类因未登记而无需例外\n- 出口同样二选一:补生成脚本后转正式登记,或退役该报告\n- 在此之前它们只是记录,不得被引用为可重跑的机器证据\n\n计数改为带日期的复核快照。未新增或删除任何作用域登记,未改判据,未动文件\n其余格式(差异 1 行)。check:evidence 仍 partial(26 新鲜 / 9 过期 / 1 例外,\n与改前逐项相同);governance 测试 266/266。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T16:23:44-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/bd625a1a1535a34e265b11424a646618c543ffef...ac396a0f27fd673e02fc0c2f5887ea7f06b879b4","Len":1}...
|
1789687513
|
Edit
Delete
|
|
30720
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"0c5d0b09b {"Commits":[{"Sha1":"0c5d0b09bc2d1c4baddfd59b484c5fdcbe0917ab","Message":"fix(runtime): 框架残留 compose 补 project 名——退出 api-nestjs 撞名(C-13 / 一致性门禁 L9)\n\nruntime/apps/api-nestjs/docker-compose.yml 未声明顶层 name,docker compose 按目录名推导为\napi-nestjs,与工作区内另外 8 个仓的同名 compose 共用容器与具名卷(api-nestjs_pgdata /\nredisdata / miniodata);后 up 的那个会复用前一个的数据。框架仓同名文件已写成\n`name: ${COMPOSE_PROJECT_NAME:-base-framework}`,本仓这份是更早版本的残留。\n\n按同一写法补上,默认值取本仓专属 enterprise-platform-runtime-dev(不沿用框架默认,否则\n改为与框架仓撞名)。本文件是框架默认 dev compose,其端口 5432 / 6379 与本仓实际底座\n(stack/compose.yaml,project enterprise-platform-stack)无关,改名不影响任何在跑的服务。\n\n一致性门禁 L9 参与仓 9 → 8;余 8 个仓在业务应用层与企业领域应用层,按 C-13 由各仓 Owner\n与 SRE 处置。三组卷现状:api-nestjs_* 与 enterprise-idp_* 共 5 个卷,所属容器均为\ncreated / exited 非运行态;C-13 要求的 pg_dump 尚未做(仓备份-2026-09-16/ 目前只有 4 个 git bundle)。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T16:25:43-07:00"}],"HeadCommit":{"Sha1":"0c5d0b09bc2d1c4baddfd59b484c5fdcbe0917ab","Message":"fix(runtime): 框架残留 compose 补 project 名——退出 api-nestjs 撞名(C-13 / 一致性门禁 L9)\n\nruntime/apps/api-nestjs/docker-compose.yml 未声明顶层 name,docker compose 按目录名推导为\napi-nestjs,与工作区内另外 8 个仓的同名 compose 共用容器与具名卷(api-nestjs_pgdata /\nredisdata / miniodata);后 up 的那个会复用前一个的数据。框架仓同名文件已写成\n`name: ${COMPOSE_PROJECT_NAME:-base-framework}`,本仓这份是更早版本的残留。\n\n按同一写法补上,默认值取本仓专属 enterprise-platform-runtime-dev(不沿用框架默认,否则\n改为与框架仓撞名)。本文件是框架默认 dev compose,其端口 5432 / 6379 与本仓实际底座\n(stack/compose.yaml,project enterprise-platform-stack)无关,改名不影响任何在跑的服务。\n\n一致性门禁 L9 参与仓 9 → 8;余 8 个仓在业务应用层与企业领域应用层,按 C-13 由各仓 Owner\n与 SRE 处置。三组卷现状:api-nestjs_* 与 enterprise-idp_* 共 5 个卷,所属容器均为\ncreated / exited 非运行态;C-13 要求的 pg_dump 尚未做(仓备份-2026-09-16/ 目前只有 4 个 git bundle)。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T16:25:43-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/ac396a0f27fd673e02fc0c2f5887ea7f06b879b4...0c5d0b09bc2d1c4baddfd59b484c5fdcbe0917ab","Len":1}...
|
1789687572
|
Edit
Delete
|
|
30723
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"4b067cd4a {"Commits":[{"Sha1":"4b067cd4a76bfced89f76e979cf7bd36d3521a91","Message":"chore(reports): otel 回绑 @ e5cc39f(首次用 pnpm reports:rebind 产出)\n\n在主工作区有并行会话未提交改动的情况下,经 HEAD 干净检出生成,\nprovenance 绑 e5cc39f / worktreeDirty=false——偏差 #34-A 裁决实现的首次实用。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T16:32:14-07:00"},{"Sha1":"e5cc39f4dc74d56bce2b1861b15f8822ec3fdc3e","Message":"feat(governance): 偏差 #34 裁决实现——干净检出回绑工具 + 脏绑判定不再断言未核实的事\n\n2026-09-17 目录负责人裁决:A 走「干净 worktree 生成报告」(不动判据),\nB「修正断言」。\n\n#34-A|新增 governance/rebind-reports.mjs(pnpm reports:rebind)\nprovenance.worktreeDirty 由全仓 git status 算,而 check:evidence 判过期是按\n每份报告自己的作用域算。口径不一致,导致只要仓里任何无关文件脏着就没法回绑\n任何报告——本工作区常有 2—3 个并行会话,干净窗口稀少,这是过期证据难清零的\n结构性成因。裁决不放宽 worktreeDirty,改为换个干净的地方生成:在 HEAD 开\ngit worktree 检出,在那里跑门禁,只把「绑 HEAD 且 dirty=false」的报告拷回。\n\n可行前提是 governance/ 零依赖(package.json 无 dependencies/devDependencies),\n临时检出不需要 pnpm install。实测:主工作区有 7 项未提交时,otel 报告仍绑到\n0c5d0b0 / dirty=false。\n\n三条护栏,都有负向用例:\n- 作用域内有未提交输入的门禁跳过(否则是拿 HEAD 的结论覆盖当前工作区)\n- 目标报告自己未提交的跳过(并行会话的在途产物,覆盖即销毁;--force 才 override)\n- 产出 provenance 不是干净 HEAD 绑定就不带回\n范围外的说清楚不假装:check:fixtures / check:port-conformance 与 runtime、\ncontracts 的检查需要构建产物,必须在装好依赖的检出里跑。\n\n顺带记一条坑:入口判定不能写 `import.meta.url === file://${argv[1]}`——本仓\n路径含中文,import.meta.url 是百分号编码的,比较永远不等,脚本会静默不做事。\n\n#34-B|check-evidence-freshness 的 EVIDENCE_BOUND_DIRTY\n该分支读的是工作区里的报告文件,定级却用 currentTreeDirty,而后者走\ngitProvenance() 并显式排除 *.latest.json。于是并行会话跑门禁、只有报告文件脏\n时,当前树被算作干净,4 份未提交的在途报告被判 error 并输出「脏绑报告被提交\n了」——该断言为假(那 4 份的 HEAD 版本干净绑 8382c04)。现按报告文件自身是否\n未提交区分:在途产物降 info 并如实描述;确系已提交的脏绑仍是 error。判据未放宽,\n两条负向用例分别钉住这两侧。\n\ngovernance 测试 266 → 275。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T16:32:04-07:00"}],"HeadCommit":{"Sha1":"4b067cd4a76bfced89f76e979cf7bd36d3521a91","Message":"chore(reports): otel 回绑 @ e5cc39f(首次用 pnpm reports:rebind 产出)\n\n在主工作区有并行会话未提交改动的情况下,经 HEAD 干净检出生成,\nprovenance 绑 e5cc39f / worktreeDirty=false——偏差 #34-A 裁决实现的首次实用。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T16:32:14-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/0c5d0b09bc2d1c4baddfd59b484c5fdcbe0917ab...4b067cd4a76bfced89f76e979cf7bd36d3521a91","Len":2}...
|
1789687994
|
Edit
Delete
|
|
30728
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"f9cb19531 {"Commits":[{"Sha1":"f9cb195319422eac06bd2111e1034e956ebcafb0","Message":"chore(reports): 工作台两份快照回绑 @ e94ad17\n\n经 pnpm reports:rebind 的多报告路径产出,两份同绑同一提交。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T18:22:33-07:00"},{"Sha1":"e94ad17db981932c5d0b08f2b99f2a786bdf36d7","Message":"feat(governance): rebind-reports 支持一个门禁多份报告,纳入工作台两份快照\n\nworkbench-catalog-snapshot 与 workbench-ops-snapshot 由同一个\nbuild-workbench-snapshots.mjs 产出,且它只 import node 内置与\ngovernance/lib/provenance.mjs——同样零依赖,本该在工具覆盖范围内。\n\n注册表 report:string → reports:string[],三处判定与执行循环随之改为按份遍历。\n新增一条语义约束:同一门禁的多份报告要么全带回、要么一份都不带,否则两份会\n绑到不同提交,而它们描述的是同一次运行。两条负向用例分别钉住「任一份在途即\n整体跳过」与「任一份作用域有未提交输入即整体跳过」。\n\n实跑验证:两份快照同绑 aaf4836 / dirty=false。\ngovernance 测试 275 → 277。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T18:22:24-07:00"},{"Sha1":"aaf483645e83337d5d0a8a50b95df678adf0fb76","Message":"chore(reports): 过期证据 13 → 8,全部 error 清零 @ 4b067cd\n\n按偏差 #34 裁决落地后的第一轮清理。源码树干净(仅并行会话的 4 份 latest\n报告未提交,worktreeDirty 本就排除 *.latest.json),故可就地重跑并绑定。\n\n- port-conformance:41/41 passed,由 defd9d7 重绑 4b067cd。这是 09-17 那次\n 「跑通了却因无关文件脏着而不能采信」的收口\n- runtime 静态链 31 任务全过:naming / dual-backend-parity / fork-readiness /\n migrations 四份此前因并行会话提交 WB-1、runtime/apps 多出 workbench 而落进\n 作用域,现已重绑\n- workbench 两份快照重新生成(catalog projects=21 mapped=7/7 conflicts=0;\n ops controlled_operations=recorded)\n\ncheck:evidence 由 failed 转 partial:27 新鲜 / 8 过期 / 1 例外,0 error。\n余下 8 份全部需要真实环境才能重跑,不是本机静态能解决的:\nruntime-acceptance、ui-acceptance、revocation-sla、mainline-acceptance、\nmainline-restore、mainline-candidate-regression、identity-http、identity-ui。\n\n未触碰并行会话在途的 caddy / facts / migration-decs / module-imports 四份。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T18:21:25-07:00"}],"HeadCommit":{"Sha1":"f9cb195319422eac06bd2111e1034e956ebcafb0","Message":"chore(reports): 工作台两份快照回绑 @ e94ad17\n\n经 pnpm reports:rebind 的多报告路径产出,两份同绑同一提交。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T18:22:33-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/4b067cd4a76bfced89f76e979cf7bd36d3521a91...f9cb195319422eac06bd2111e1034e956ebcafb0","Len":3}...
|
1789694573
|
Edit
Delete
|
|
30729
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"36e0423ef {"Commits":[{"Sha1":"36e0423efe0ddc105136d193bfb594efb9838d62","Message":"chore(reports): 全链回绑 @ 1af0f22,证据零过期零告警\n\n干净树重跑根 pnpm check。check:evidence:34 份已登记,**33 份新鲜 / 0 过期 /\n0 输入未提交 / 0 告警 / 1 例外**(stack-image-pins,其例外自带出口)。\n\n这是本轮治理完善的收口:从九份过期、error 级判定,到零过期零告警。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T18:56:42-07:00"},{"Sha1":"1af0f2210a8ac041a26a97ff5f4965461398ebf1","Message":"feat(governance): 测试地板 652 → 775;动态区回灌今日三级验收\n\ncheck:docs-truth 抓出报告已刷新而动态区未跟上——正是今天修过的那类双真源\n漂移,这次由门禁自己拦住。\n\n- 动态区「真实 DB」:2026-09-13 / 7e26a50 / 652 → 2026-09-18 / 6108357 /\n 775,并写明隔离栈与「破坏性注入只认 ms23-ci 类专用工程」的边界\n- 动态区「浏览器」:2026-09-13 / 7e26a50 → 2026-09-18 / 003aadd,端口如实\n- 棘轮:testsPassed 652 → 775(本轮实测),ownTests 35 → 40、\n ownTestCases 185 → 212(静态 runner 自己抬的,它刻意不动其他 runner 的地板)\n\n棘轮只收紧不放宽:775 是今天真实跑出来的数,此后低于它即红。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T18:56:07-07:00"},{"Sha1":"23281b8f814b350af20b95ab6a4176cdbaf25b0a","Message":"chore(governance): 退役两份无生成脚本的报告,过期证据归零\n\n2026-09-17 目录负责人裁决:两份都退役(删文件 + 撤登记,不留例外)。\n\n两份都是 09-12 手工拼的一次性记录,仓内没有任何脚本能产出它们,因此永远\n无法重跑、只会一直过期;而它们的结论现在都由自动化门禁产出并正确绑定:\n\n- identity-http(8 例):逐条比对确认与 runtime/test/e2e/identity-profile.test.ts\n 同名,今日已在 check:runtime 的 775 例里跑过并绑 6108357。其自述的\n provenanceMethod 就写着「Post-run source inspection」,本就不是门禁产物\n- mainline-candidate-regression(155 例):作用域即 governance/{lib,test} 与\n 两个检查器,结论由 node --test governance/test/*.test.mjs 产出,今日 277/277。\n 155 这个数字自 09-12 起无人维护,保留它只会让人以为另有一道独立的候选回归门禁\n\n退役前已核:release-manifest.mjs 与 build-workbench-snapshots.mjs 都不引用\n这两份;其余引用只在 09-12 的历史记录文档与生成式快照字段里,会随重跑更新。\n\nevidence-scopes 登记 36 → 34,note 补记本次裁决与口径(同 stack-image-pins\n例外里写的「倾向 ① 退役」)。\n\ncheck:evidence:33 新鲜 / **0 过期** / 1 例外(stack-image-pins,另有出口)。\ngovernance 测试 277/277。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T18:54:10-07:00"},{"Sha1":"95d0ac8860038d4af6a3d15d4ca35ff0eff52749","Message":"chore(reports): 主线验收与恢复演练重跑通过 @ bc978a8\n\n在专用隔离栈 enterprise-platform-ms23-ci(PG :55485 / Redis :56395 /\nRedpanda :59105)上重跑,源库经 mainline:prepare 新建(platform_{fact,\npermission,audit,owner,consumer}_ci,全部非超级用户 / NOBYPASSRLS)。\n\n- mainline-acceptance passed,四套件 11 / 17 / 19 / 18:fact-read-http、\n fact-persistence、audit-tamper、mainline-revocation-chaos(含重复投递、\n 非连续乱序版本、毒消息 DLQ 与 broker 停机恢复)\n- mainline-restore passed,3 个库逐库 dump + 还原到新建 drill 库,表数\n 12 / 6 / …,逐库 SHA-256 一致;不删除、不重置源库与既往 drill\n- revocation-sla 随之刷新,仍 partial:invalidationPush 的 verdict 依旧是\n measured-with-harness-transport,生产传输未接线\n\n为什么换栈:恢复演练与 Redpanda 混沌用例的 allowlist 只认\nenterprise-platform-{ms23,ms23-ci,adversarial} 三个 compose 工程,\n共享的 ep-delivery 与 dev 常驻 stack 永远不匹配——这是故意的护栏,\n破坏性注入不得指向共享底座。dev 常驻栈全程未被触碰。\n\ncheck:evidence 过期 4 → 2,余下两份都没有生成脚本,另行处置。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T18:50:15-07:00"},{"Sha1":"bc978a8a99636b34e0bc69b018ee6ce8bd6192b9","Message":"chore(reports): identity 模块 UI 验收重跑通过 @ 828f178\n\n真实统一 Next 前端 + identity profile + 专用 PostgreSQL/Redis,2 个浏览器级\n用例全绿,由 90cda56 重绑 828f178(作用域内此前累计 21 个文件变更)。\n端口 web :7352 / api :7353。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T18:43:48-07:00"}],"HeadCommit":{"Sha1":"36e0423efe0ddc105136d193bfb594efb9838d62","Message":"chore(reports): 全链回绑 @ 1af0f22,证据零过期零告警\n\n干净树重跑根 pnpm check。check:evidence:34 份已登记,**33 份新鲜 / 0 过期 /\n0 输入未提交 / 0 告警 / 1 例外**(stack-image-pins,其例外自带出口)。\n\n这是本轮治理完善的收口:从九份过期、error 级判定,到零过期零告警。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T18:56:42-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/f9cb195319422eac06bd2111e1034e956ebcafb0...36e0423efe0ddc105136d193bfb594efb9838d62","Len":8}...
|
1789696615
|
Edit
Delete
|
|
30730
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"e6d286b4f {"Commits":[{"Sha1":"e6d286b4f61d0227fa7f42cd0f5f40e624540dbf","Message":"docs: 修复退役报告导致的断链(一致性门禁 L4)\n\n09-12 的候选校验记录链向 reports/mainline-candidate-regression.latest.json,\n该报告已随 23281b8 退役,治理层一致性门禁 L4 随即报断链。改为文字说明:\n报告已退役、退役理由、结论现由 governance 测试产出(今 277/277),当时的\n154/0/1 保留为历史记录,不改写历史结论。\n\nL4 / L10 / L13 恢复 CLEAN。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T18:58:04-07:00"}],"HeadCommit":{"Sha1":"e6d286b4f61d0227fa7f42cd0f5f40e624540dbf","Message":"docs: 修复退役报告导致的断链(一致性门禁 L4)\n\n09-12 的候选校验记录链向 reports/mainline-candidate-regression.latest.json,\n该报告已随 23281b8 退役,治理层一致性门禁 L4 随即报断链。改为文字说明:\n报告已退役、退役理由、结论现由 governance 测试产出(今 277/277),当时的\n154/0/1 保留为历史记录,不改写历史结论。\n\nL4 / L10 / L13 恢复 CLEAN。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T18:58:04-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/36e0423efe0ddc105136d193bfb594efb9838d62...e6d286b4f61d0227fa7f42cd0f5f40e624540dbf","Len":1}...
|
1789696688
|
Edit
Delete
|
|
30740
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"2dfbcb914 {"Commits":[{"Sha1":"2dfbcb9148a7beabb926462eebb82645e548c10a","Message":"chore(reports): 回绑 @ a9fd6e8,check:evidence 全绿\n\n33 份已登记全部新鲜,0 过期 / 0 未提交输入 / 0 例外 / 0 告警。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T19:00:52-07:00"},{"Sha1":"a9fd6e826db77532ac3abfc149a9de822e40ea12","Message":"chore(governance): 退役 stack-image-pins,check:evidence 首次转 passed\n\n目录负责人裁决:按该报告自己的例外里写的「倾向 ① 退役」执行。\n\n它与今日退役的另两份同类:仓内无生成脚本(2026-09-14 全仓搜索确认),是\n一次性手工产物,永远无法重跑,只能靠例外掩盖。其结论「compose 12 个镜像\n是否全按 digest 锁定」已由 governance/release-manifest.mjs 的\nparseComposeImages 完整覆盖——实测同为 12 条、0 未锁,且未锁时进 missing,\n由真脚本产出、自动保鲜,严格优于被退役的手工快照。\n\n- evidence-scopes:entries 34 → 33,exceptions 1 → 0(自此为空)\n- check-evidence-freshness 的成因注释保留 2026-09-14 那条实锤(它正是本门禁\n 存在的理由),但标注该报告已退役,免得后人去找一个不存在的文件\n\ncheck:evidence:**passed**,33 新鲜 / 0 过期 / 0 输入未提交 / 0 例外。\n这是它第一次不是 partial。governance 测试 277/277。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T19:00:17-07:00"}],"HeadCommit":{"Sha1":"2dfbcb9148a7beabb926462eebb82645e548c10a","Message":"chore(reports): 回绑 @ a9fd6e8,check:evidence 全绿\n\n33 份已登记全部新鲜,0 过期 / 0 未提交输入 / 0 例外 / 0 告警。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T19:00:52-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/e6d286b4f61d0227fa7f42cd0f5f40e624540dbf...2dfbcb9148a7beabb926462eebb82645e548c10a","Len":2}...
|
1789696855
|
Edit
Delete
|
|
30745
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"314c17936 {"Commits":[{"Sha1":"314c179366fb02a53485f4efbd0e3d3e88cd5470","Message":"chore(reports): 回绑 @ 71b306f,登记面 33 → 35 全新鲜\n\nrelease-manifest 与 sbom 首次带嵌套 provenance 并受新鲜度保护。\n\nManifest 刷新后缺项 4 → 6,多出的两条都是真的、被旧快照藏了四天:\n- images.stack.*:compose 启用 runtime 服务后镜像是变量 ${PLATFORM_RUNTIME_IMAGE:?},\n 未按 digest 锁定(PF-05 / PF-23 晋级前解决)\n- sbom:局部 lockfile 清单(268 包,仅 Node 依赖,不含基础镜像 Debian 包)\n 不满足 D-2 的完整 SBOM 要求\n\ncheck:evidence passed:35 份已登记全部新鲜,0 过期 / 0 例外 / 0 告警。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T19:21:00-07:00"},{"Sha1":"71b306f53390e6119590b5225b660cd4effcd3b5","Message":"chore(governance): 登记 release-manifest 与 sbom 进 evidence-scopes(35 条)\n\n承 c5d9897。三份补了嵌套 provenance 之后,其中两份现在就能登记:\n\n- release-manifest(warn):作用域 = compose、image-digest.json、四类包的\n package.json、runtime/modules、生成器与 schema。**这是 MS-4 退出条件的判据\n 输入**,此前无人监控其新鲜度\n- sbom(warn):作用域 = image-digest.json、生成器、runtime 锁文件\n\nimage-smoke 本轮不登记:生成器已修,但要补上形状得起真实容器重跑(脚本强制\n--env-file,需 DB/Redis),不值得为补一个形状去起一套底座——待其下一次真实\n运行后登记。note 里写明了这一条与 mainline-dev-deployment 的区别(后者没有\n生成脚本,属手工记录那一类,不是形状问题)。\n\n同时修正 note 里 ① 类的描述:原写「没有 provenance.gitSha,要先让产生脚本写\nprovenance」,对这四份是不准确的——数据早就有。\n\ngovernance 测试 277/277。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T19:20:23-07:00"},{"Sha1":"c5d98975f8c466d035550a4f38899db325d8b806","Message":"feat(governance): 三份报告补嵌套 provenance,让 MS-4 判据输入受新鲜度保护\n\n2026-09-17 目录负责人裁决:补嵌套 provenance,四份有 SHA 的全做。\n\n问题:release-manifest / sbom / image-smoke / mainline-dev-deployment 都写了\n源 SHA,但是**平铺**在顶层(sourceSha),而 check:evidence 只认嵌套的\nprovenance.gitSha。于是它们登记不进 evidence-scopes,游离在新鲜度之外。\n此前 evidence-scopes 的口径说明把它们归为「没有 provenance.gitSha,要先让\n产生脚本写 provenance」——对其中四份是不准确的:数据早就有,缺的是形状。\n\n实锤这不是理论风险:Manifest 绑 ac3683d(2026-09-14),其后它的结论输入改了\n10 个文件(contracts/governance 的 package.json、image-digest.json、\ncompose.yaml、client-fact 全套),四天无人报警。重跑后缺项 4 → 6,多出的两条\n都是真的——compose 启用 runtime 服务后镜像是变量未按 digest 锁定;SBOM 未随\n19150ae 镜像重生成。**一份过期的 Manifest 一直在少报,而 MS-4 的退出条件正是\n读它**(status=complete 且 runner 为 CI)。\n\n改动:\n- stack/release-manifest.schema.json 增可选 provenance 对象(不进 required,\n 向后兼容;additionalProperties:false 故必须显式加),并写明与顶层三项同源\n- release-manifest.mjs 同时写 provenance 与顶层兼容字段,实测两者一致\n- sbom.mjs / smoke-image.mjs 增 provenance: gitProvenance(root)。注意它们原有的\n sourceSha 是**镜像的**源提交,与「本报告在哪个提交产出」不是一回事,两者都留\n\nmainline-dev-deployment 做不了:全仓搜索确认它没有生成脚本,是第四份手工记录\n(与今日退役的三份同类),不是形状问题。另行处置。\n\ngovernance 测试 277/277。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T19:19:03-07:00"}],"HeadCommit":{"Sha1":"314c179366fb02a53485f4efbd0e3d3e88cd5470","Message":"chore(reports): 回绑 @ 71b306f,登记面 33 → 35 全新鲜\n\nrelease-manifest 与 sbom 首次带嵌套 provenance 并受新鲜度保护。\n\nManifest 刷新后缺项 4 → 6,多出的两条都是真的、被旧快照藏了四天:\n- images.stack.*:compose 启用 runtime 服务后镜像是变量 ${PLATFORM_RUNTIME_IMAGE:?},\n 未按 digest 锁定(PF-05 / PF-23 晋级前解决)\n- sbom:局部 lockfile 清单(268 包,仅 Node 依赖,不含基础镜像 Debian 包)\n 不满足 D-2 的完整 SBOM 要求\n\ncheck:evidence passed:35 份已登记全部新鲜,0 过期 / 0 例外 / 0 告警。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T19:21:00-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/2dfbcb9148a7beabb926462eebb82645e548c10a...314c179366fb02a53485f4efbd0e3d3e88cd5470","Len":3}...
|
1789698065
|
Edit
Delete
|
|
30747
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"96bfdde50 {"Commits":[{"Sha1":"96bfdde508464b4b0e1e3fb05f77a9f488492fc0","Message":"chore(reports): 回绑 @ 903f019\n\ncheck:evidence passed:35 份已登记全部新鲜,0 过期 / 0 例外 / 0 告警;\n未登记 13 份(四份手工记录退役后的稳定态)。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T19:23:58-07:00"},{"Sha1":"903f019dc8033d3042cc0446e054e2665782fedc","Message":"chore(governance): 退役 mainline-dev-deployment,四份手工记录清零\n\n目录负责人裁决:与今日退役的另三份同类处置。\n\n它只记 09-12 在 dev 栈启用 Redpanda 这一件事(自述 scope「Redpanda only」),\n仓内无生成脚本、不可重跑。该结论现由三处覆盖且都会自动保鲜:\n\n- stack/compose.yaml 的 redpanda 已是启用状态(非候选注释块),MS-2 的机器\n 判定直接读它\n- stack/reports/runtime-up.*.json:四份更新的 dev 运行记录(09-14 / 09-16 ×3)\n- pnpm check:deployed:活体核验运行镜像与源提交\n\ndev 栈此后已重建多轮,09-12 那份快照描述的容器与端点早已不是当前事实。\n\nevidence-scopes note 补记本次裁决(它本就未登记,无条目可撤);\n09-12 的执行记录里那处纯文本引用补一句退役说明——L4 不报(不是 markdown\n链接),但读者会去找一个不存在的文件。\n\n至此四份无生成脚本的手工记录全部退役:identity-http、\nmainline-candidate-regression、stack-image-pins、mainline-dev-deployment。\n\ncheck:evidence passed:35 份已登记全部新鲜,未登记 14 → 13。\ngovernance 测试 277/277。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T19:23:31-07:00"}],"HeadCommit":{"Sha1":"96bfdde508464b4b0e1e3fb05f77a9f488492fc0","Message":"chore(reports): 回绑 @ 903f019\n\ncheck:evidence passed:35 份已登记全部新鲜,0 过期 / 0 例外 / 0 告警;\n未登记 13 份(四份手工记录退役后的稳定态)。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T19:23:58-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/314c179366fb02a53485f4efbd0e3d3e88cd5470...96bfdde508464b4b0e1e3fb05f77a9f488492fc0","Len":2}...
|
1789698242
|
Edit
Delete
|
|
30823
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"d24b762cd {"Commits":[{"Sha1":"d24b762cd6740f0bce850ae3fffcc84e8a279c28","Message":"chore(reports): 框架同步 0.16.1 → 0.22.0 后全套验收回绑 @ 765300b\n\n三级验收全部在干净树重跑,与升级前逐项持平:\n\n- runtime-acceptance **775 / 775 passed**,租户 RLS enforce(地板 775 未降)\n- ui-acceptance 5 / 5,1 组合\n- mainline-acceptance 四套件 11 / 17 / 19 / 18\n- mainline-restore passed,port-conformance 41 / 41\n- revocation-sla partial(invalidationPush 仍是 harness 传输,生产未接线)\n- release-manifest / sbom / identity-ui 随后重跑\n\ncheck:evidence **passed:35 份全新鲜 / 0 过期 / 0 例外**。\n\n过程中一处自伤已修复:曾用 git checkout -- runtime/reports 还原「跑门禁弄脏\n的报告」,连带把真跑出的六份验收证据还原成旧版,已在干净树重跑全套找回。\n教训:还原前必须按 provenance.gitSha 分辨本轮产出与脏绑,不可整目录 checkout。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T22:38:56-07:00"},{"Sha1":"d66f63659bc07fa65ac84685335a0f3c5e15af5d","Message":"docs(runtime): 动态区 SHA 回灌至 765300b(重跑后的验收绑定)\n\n上一轮误用 git checkout -- runtime/reports 把真跑出的六份验收报告还原成了\n旧版,已在干净树重跑全套(runtime 775/775、UI 5/5、主线 11/17/19/18、恢复\n演练、端口一致性 41/41),六份统一绑 765300b / dirty=false。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T22:36:52-07:00"},{"Sha1":"765300b962ca658d112ac6064f925d82d0579dfd","Message":"docs(runtime): 动态区回灌框架同步后的三级验收 @ 56e78df\n\ncheck:docs-truth 再次拦下「报告已刷新而动态区未跟上」。\n\n- 真实 DB:775 tests / 0 failures clean 56e78df——框架同步 0.16.1 → 0.22.0 后\n 首跑,测试数与升级前持平、租户 RLS 仍 enforce\n- 浏览器:5 用例 / 1 组合 clean 56e78df\n- 环境如实记:隔离栈 enterprise-platform-ms23-ci(PG :55485 / Redis :56395 /\n Redpanda :59105)+ 验收库 enterprise_platform_acceptance_fwsync\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T22:29:47-07:00"},{"Sha1":"56e78dfa4fb1001fad92e6d93b0e3bb2f7569594","Message":"fix(runtime): 修正 CHANGELOG 并入六段后的跨仓断链(一致性门禁 L4)\n\n框架 CHANGELOG 0.17.0—0.22.0 六段里的 ../\u003c框架变更请求\u003e.md 指的是框架仓同级,\n并入本仓后全部失效,L4 报 5 条。改为 ../../../工程基础框架/\u003c文件\u003e 跨仓路径。\n\n这是框架同步的真实副作用:并入上游文档时,其相对链接的锚点也跟着换了仓。\nL4 / L10 / L13 恢复 CLEAN。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T21:38:33-07:00"},{"Sha1":"b30ddd94965db4c6686a249d280ce579a879fc65","Message":"feat(runtime): 框架同步 0.16.1 → 0.22.0 主体(F-2b / F-3 / F-4)\n\nC-14 的实际形态。本轮把版本轴与两后端行为接线一次做完,部署两级按目录负责人\n裁决走「改判据 + 提 FR-6」。\n\nF-3 版本轴\n- 12 处 @juhai/kernel pin、runtime/package.json.version、packages/contracts\n version 全部 0.16.1 → 0.22.0;**F11 转绿**(这是抬 pin 一直卡住的门禁)\n- CHANGELOG 并入框架 0.17.0—0.22.0 六段,版本序连续;COMPATIBILITY.md 取 0.22.0\n\nF-4 两后端接线(C34 / C35 / C39 绊网全绿)\n- 直取六个未改过的文件:health.controller / health.module / health-checks.registry\n / request-log.middleware / logger / routes/health,另 types.ts、四个 C39 文件\n- 两处真三方合并:\n · api-fastify/src/app.ts:取 0.22.0 后按 sample-domain 标记剥离三个示例域块\n (本仓以 --strip-sample 建仓,本仓对该文件的唯一定制就是这三处剥离)\n · api-nestjs/src/create-app.ts:两侧改动不重叠——本仓加平台模块装载、框架加\n 访问日志中间件,合并保留两者\n\nF-2b 门禁脚本\n- check-dual-backend-parity / check-docs-truth / check-runtime-acceptance 取 0.22.0\n\ndocs-truth 四级新鲜度的本地修正(已提 FR-6)\n框架 0.22.0 把新鲜度断言由两级扩到四级,新增的部署 / 生产两级在本仓无法成立:\n其验收链要求 apps/api-nestjs/Dockerfile,而那份里写着 COPY packages/kernel/\npackage.json——本仓**不 vendor 内核**(pin 已发布包,packages/kernel 不存在),\n实测构建必然失败。本仓自己的制品镜像是 D-1 的 runtime/Dockerfile,与框架那套\n并存会变成两条镜像路径。判据改为「只对本仓真正接线了的级别断言」,未接线的\n打印 SKIPPED 而非伪装通过——不接受占位报告,与框架 doctrine「诚实的空」一致。\n已撤回全部 F-5 部署物与失败留下的半截报告。\n\n治理测试锚点 0.16.1 → 0.22.0。\n\n验收:turbo build 17/17、typecheck 31/31、runtime check 全链通过(两级 SKIPPED\n如实打印)、governance 测试 277/277。**真实三级验收随后在 clean 树重跑并回绑**\n——check:evidence 已如实报出 20 份证据的输入被本轮改动,不得只回绑静态报告。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T21:23:29-07:00"}],"HeadCommit":{"Sha1":"d24b762cd6740f0bce850ae3fffcc84e8a279c28","Message":"chore(reports): 框架同步 0.16.1 → 0.22.0 后全套验收回绑 @ 765300b\n\n三级验收全部在干净树重跑,与升级前逐项持平:\n\n- runtime-acceptance **775 / 775 passed**,租户 RLS enforce(地板 775 未降)\n- ui-acceptance 5 / 5,1 组合\n- mainline-acceptance 四套件 11 / 17 / 19 / 18\n- mainline-restore passed,port-conformance 41 / 41\n- revocation-sla partial(invalidationPush 仍是 harness 传输,生产未接线)\n- release-manifest / sbom / identity-ui 随后重跑\n\ncheck:evidence **passed:35 份全新鲜 / 0 过期 / 0 例外**。\n\n过程中一处自伤已修复:曾用 git checkout -- runtime/reports 还原「跑门禁弄脏\n的报告」,连带把真跑出的六份验收证据还原成旧版,已在干净树重跑全套找回。\n教训:还原前必须按 provenance.gitSha 分辨本轮产出与脏绑,不可整目录 checkout。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T22:38:56-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/96bfdde508464b4b0e1e3fb05f77a9f488492fc0...d24b762cd6740f0bce850ae3fffcc84e8a279c28","Len":6}...
|
1789709941
|
Edit
Delete
|
|
30824
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"a63414ab0 {"Commits":[{"Sha1":"a63414ab085268e9570c6f51816a92718f2effeb","Message":"chore(reports): F-7 收口——框架迁移凭证 frameworkVersion 0.22.0\n\npnpm migration:record --mode sync:source=base-framework 0.22.0 @ df53867 →\ntarget=enterprise-platform 0.22.0,runId cb50e485。\n\n**一致性门禁 L12 清零**(内核 pin 落后六个 minor 的常驻问题)。常驻问题由\nL9 / L12 两条降为 L9 一条——后者是 8 个上层应用仓的 compose 身份,待 N-11\n裁决扩散路径,与本仓无关。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T22:39:42-07:00"}],"HeadCommit":{"Sha1":"a63414ab085268e9570c6f51816a92718f2effeb","Message":"chore(reports): F-7 收口——框架迁移凭证 frameworkVersion 0.22.0\n\npnpm migration:record --mode sync:source=base-framework 0.22.0 @ df53867 →\ntarget=enterprise-platform 0.22.0,runId cb50e485。\n\n**一致性门禁 L12 清零**(内核 pin 落后六个 minor 的常驻问题)。常驻问题由\nL9 / L12 两条降为 L9 一条——后者是 8 个上层应用仓的 compose 身份,待 N-11\n裁决扩散路径,与本仓无关。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T22:39:42-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/d24b762cd6740f0bce850ae3fffcc84e8a279c28...a63414ab085268e9570c6f51816a92718f2effeb","Len":1}...
|
1789709986
|
Edit
Delete
|
|
30851
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"c9e0f59d1 {"Commits":[{"Sha1":"c9e0f59d11a533e7e5e3386f80eff8fb6d6ba6c8","Message":"test(identity): 给「模块故障不传导到宿主健康」的成对断言补设计说明\n\n2026-09-18 目录负责人裁决「维持分离」(开发计划 §6 偏差 #36):模块依赖故障\n≠ 宿主运行时不健康。模块健康只在 GET /api/platform/modules[/:id/health] 可见,\n/api/health 只反映宿主自己的依赖。\n\n这条用例第 188—189 行的 degraded 与 200 是成对断言,此前没有注释说明它守的是\n一个有意的设计选择,读起来像实现欠账——于是框架 0.19.0 受理本仓 FR-1 后,我\n想当然地把模块 health() 汇入 /api/health,真实 DB 验收当场由 775 跌到 561,\n正是被这两行拦下的。\n\n补注释写明裁决出处与那次实锤,并点出「FR 被受理 ≠ 它解锁的工作就该做」。\n只加注释,断言与逻辑一字未动;typecheck 14/14。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T23:49:14-07:00"}],"HeadCommit":{"Sha1":"c9e0f59d11a533e7e5e3386f80eff8fb6d6ba6c8","Message":"test(identity): 给「模块故障不传导到宿主健康」的成对断言补设计说明\n\n2026-09-18 目录负责人裁决「维持分离」(开发计划 §6 偏差 #36):模块依赖故障\n≠ 宿主运行时不健康。模块健康只在 GET /api/platform/modules[/:id/health] 可见,\n/api/health 只反映宿主自己的依赖。\n\n这条用例第 188—189 行的 degraded 与 200 是成对断言,此前没有注释说明它守的是\n一个有意的设计选择,读起来像实现欠账——于是框架 0.19.0 受理本仓 FR-1 后,我\n想当然地把模块 health() 汇入 /api/health,真实 DB 验收当场由 775 跌到 561,\n正是被这两行拦下的。\n\n补注释写明裁决出处与那次实锤,并点出「FR 被受理 ≠ 它解锁的工作就该做」。\n只加注释,断言与逻辑一字未动;typecheck 14/14。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-17T23:49:14-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/a63414ab085268e9570c6f51816a92718f2effeb...c9e0f59d11a533e7e5e3386f80eff8fb6d6ba6c8","Len":1}...
|
1789714158
|
Edit
Delete
|
|
30872
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"df678ac14 {"Commits":[{"Sha1":"df678ac14f88628a7bc48ce3b53e248f1b257e8b","Message":"chore(reports): check:evidence 回绑 @ e9d0779\n\n37 份已登记(+2:runtime-governance error、conformance-differential warn)、34 份新鲜、\n11 份未登记且全部有处置说明、evidenceUnaccounted=0。3 条 warn 为待重跑的验收报告。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T00:14:15-07:00"},{"Sha1":"e9d07790cee2a6780ecc755cb6b6efe70890a727","Message":"feat(governance): 未登记的报告也要逐条记账——把散文口径搬成机器判据,并订正两处误归类\n\ncheck:evidence 的 SCOPE_UNDECLARED 是 info,本身不拦任何东西。于是「未登记作用域」\n这一类可以无声增长,而它恰恰是新鲜度门禁完全看不见的那部分:实测 48 份报告里 13 份\n在此,占 27%。这 13 份为什么不登,此前只写在 evidence-scopes.json 的 note 散文里,\n没有任何机器核对——明天多出一份新报告,它会自动落进这个黑箱,全链门禁一片绿。\n\n按例外机制的同一纪律(G-13:自带出口)把口径搬成逐条登记的 undeclared:\n UNDECLARED_UNACCOUNTED 报告存在,既无作用域也无账(新洞的唯一入口,判红)\n UNDECLARED_STALE 账指向的报告已登记作用域,或文件已不存在(判红)\n UNDECLARED_INCOMPLETE 缺 report/class/reason/recordedAt/resolveBy,或 class 非法\nclass 只允许 self / aggregate / provenance-missing / one-off-snapshot / no-generator。\n记账不是豁免:后两类的出口只有「补生成脚本后转正式登记」或「退役该报告」二选一。\n\n逐份走读生成脚本时发现 note 的 ③「聚合报告」类有两处归错,两份因此一直不受监控:\n runtime-governance 不聚合任何报告,直接走读 apps/ 源码与两份 prisma schema\n 判租户接线、outbox 事务、直写发布;纯静态零容器 → error\n conformance-differential 在 apps/api-nestjs 真跑 vitest,用例同时 import 了\n NestJS 与 Fastify 两个后端的装配;要真 DB → warn\n两份均已转入 entries(35 → 37 条),③ 实际只剩 governance 与 governance-status。\n\nclass=self 不查文件存在性:本门禁的报告是判定跑完之后才写的,判定当时它可以合法地\n不存在。这是集成用例抓出来的——起初一视同仁地查,临时仓第一次运行就被自己判红。\n\n门禁测试 277 → 283(新增 6 条负向用例,含「新报告悄悄落进 reports/ 必须判红」的\n集成证明)。pnpm check 全链通过;check:evidence 37 份已登记、34 份新鲜、11 份未登记\n且全部有处置说明、0 份无说明。余 3 份过期是注释提交 c9e0f59 落进验收作用域所致,\n须重跑重绑,不在本提交。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T00:13:43-07:00"}],"HeadCommit":{"Sha1":"df678ac14f88628a7bc48ce3b53e248f1b257e8b","Message":"chore(reports): check:evidence 回绑 @ e9d0779\n\n37 份已登记(+2:runtime-governance error、conformance-differential warn)、34 份新鲜、\n11 份未登记且全部有处置说明、evidenceUnaccounted=0。3 条 warn 为待重跑的验收报告。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T00:14:15-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/c9e0f59d11a533e7e5e3386f80eff8fb6d6ba6c8...df678ac14f88628a7bc48ce3b53e248f1b257e8b","Len":2}...
|
1789715664
|
Edit
Delete
|
|
30882
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"0abd15c28 {"Commits":[{"Sha1":"0abd15c28dd2b92c583289934db660363b202fd4","Message":"chore(reports): check:evidence 回绑 @ 34fresh\n\n37 份已登记、34 份新鲜、0 error;余 3 份过期为需真实容器重跑的验收报告\n(runtime-acceptance / mainline-acceptance / revocation-sla,warn 按设计)。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T00:28:32-07:00"},{"Sha1":"a4b3d356f9d2f7a831198787a5b19194f4f763c8","Message":"chore(reports): 双后端差分验收重跑回绑 @ 746f323\n\n本轮把 conformance-differential 从「未登记的聚合报告」订正为登记条目后,它第一次\n被新鲜度门禁判为过期——触发者正是同轮改到的 check-conformance-differential.mjs,\n说明登记的作用域是对的。真实 DB + Redis 重跑:7 checkpoints × 2 backends,\n逐字段 0 differences。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T00:28:10-07:00"},{"Sha1":"746f323c203531c4ced5f3ca60ea29a4c53c7c4d","Message":"chore(reports): 工作台两份快照回绑 @ adda76a\n\nrunbook §7 的订正落在运维快照作用域内(docs/runbook.md),经 reports:rebind 在\nHEAD 的干净检出里重跑,两份同源快照一并带回。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T00:27:33-07:00"},{"Sha1":"adda76acfd8fa046e1f2a320c15b5384b4ddef73","Message":"fix(runtime): 前置守卫失败不得覆盖验收报告,并补「一模块一库」检查\n\n按 docs/runbook.md §7 的配方逐字重跑 runtime 验收,当场复现两个缺陷。\n\n一、配方本身是错的。§7 只写了 DATABASE_URL 与 REDIS_URL,而七个模块的\nprisma/schema.prisma 各自写死 url = env(\"DATABASE_URL_\u003cMODULE\u003e\")。照它执行时,\n前两步 nestjs/fastify-migrate-deploy 会通过,第三步 migrate-status 才以\nPrisma P1012 \"Environment variable not found\" 失败——报错指向 wasm 校验,\n完全看不出是环境没配齐。§7 已补齐七个变量,并写明 prepare-mainline.mjs\n只供给主线验收要的 5 个(fact/permission/audit/owner/consumer),差的四个要自己建。\n\n二、更要紧的:那次失败把 runtime-acceptance.latest.json 覆盖成了 status:failed。\n775/775 那份真实结论就此丢失,靠 git checkout 才救回——差一点被当作真实回归提交上去。\n根因是三个 runner 都无条件 writeFileSync:前置守卫失败意味着**验收根本没跑**,\n此时写一份 failed 报告不是诚实,是用操作者的环境问题顶替代码的结论,\n并且顺手销毁了上一次真的跑过的证据。三个 runner 统一改为前置失败即退出、不碰报告:\n check-runtime-acceptance 实测:报告 sha256 前后一致\n check-ui-acceptance 实测:缺 REDIS_URL 时报告 sha256 前后一致\n check-conformance-differential 实测:同上\n\n新增 preflightModuleDatabases + requiredModuleDatabaseEnvNames,把缺失的七个\n变量在动任何东西之前一次列清。变量名**现取自各模块 prisma/schema.prisma**,\n不写死清单:模块增减自动跟上,也避免抄错 ai-gateway 那个没有下划线的\nDATABASE_URL_AIGATEWAY。该检查只接进 runtime 验收——UI 与差分验收跑的是\n两个 app,不走一模块一库。\n\npnpm check 全链通过。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T00:26:48-07:00"}],"HeadCommit":{"Sha1":"0abd15c28dd2b92c583289934db660363b202fd4","Message":"chore(reports): check:evidence 回绑 @ 34fresh\n\n37 份已登记、34 份新鲜、0 error;余 3 份过期为需真实容器重跑的验收报告\n(runtime-acceptance / mainline-acceptance / revocation-sla,warn 按设计)。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T00:28:32-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/df678ac14f88628a7bc48ce3b53e248f1b257e8b...0abd15c28dd2b92c583289934db660363b202fd4","Len":4}...
|
1789716516
|
Edit
Delete
|
|
31055
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"2d4b55254 {"Commits":[{"Sha1":"2d4b55254cd0b38f4ae1750038d4a6d9e2ebb30a","Message":"chore(reports): check:gate-flow 回绑 @ 574cfb7\n\n45 个脚本、33 个有消费入口、12 个流外且全部具名(门禁 4 / 工具 8)、0 违规。\n并行会话正在本仓改 Dockerfile 与底座,主工作区非干净树——经 reports:rebind 在\nHEAD 的干净检出里生成,未触及对方在途文件。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T01:09:55-07:00"},{"Sha1":"f3ae97f3460699338d08efe3dd60ea69a3d49fa4","Message":"feat(stack,runtime): dev 常驻运行时接上受控执行面与统一服务目录快照(CHG-018 条件 A 的目标环境半边)\n\ncompose 的 runtime 服务此前没有 PLATFORM_OPS_ENABLED / _CLIENT_IDS / _ADMIN_SUBJECTS,也没有\nPLATFORM_CATALOG_SNAPSHOT_PATH:OPS-1 的命令面在 dev 容器里根本不存在(定义 executable=false),\n/api/platform/catalog 的 snapshot 恒为 unavailable。仓内验收过的两个面没有任何一条路径到达运行环境,\nOPS-1 记录里「目标环境验收留阶段 ②」说的就是这一段。\n\n- stack/compose.yaml:四个键全部空默认值——不配置 = 不开命令面,而不是开着没人管\n- stack/overlays/dev.yaml:reports/workbench-catalog-snapshot.latest.json 只读挂到\n /srv/runtime/catalog-snapshot.json,快照绑的是它自己的 gitSha,不是本进程\n- runtime/Dockerfile:ENV PLATFORM_SOURCE_SHA=${SOURCE_SHA},与 OCI revision 标签同源;\n 缺它时目录读面只能报 source_sha_status=unknown,不从文件系统猜\n- docs/runbook.md:§2 环境表补两行,并写明改这四个键必须重建容器(restart 带不上新环境)\n\n本提交只改配置与镜像环境变量;镜像重建、容器切换与探针结果另行取证提交。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T01:09:52-07:00"},{"Sha1":"574cfb754278102c1588009c4af3a66dc2201777","Message":"feat(governance): 补 check:gate-flow——每个门禁的失败信号有谁在看?\n\n治理层 2026-09-14 就为自己建了 `门禁消费登记.json` 逐条回答这个问题,并写明了病因:\n一个门禁若既不在统一流内、也不在任何 CI 链里,它就停在「永远红」或「永远绿」,\n两种都不再携带信息。本仓一直没问过这个问题。\n\n实测:根 package.json 44 个脚本里 12 个既不在 `pnpm check` 链、CI 也不调用。\n多数是工具与开发者聚合入口(已逐条核实其组成部分确被消费),但其中三个是真门禁:\n\n image:smoke CI 的 image job 构建镜像、生成 SBOM、签名,**却从不启动它一次**。\n 而开发计划把这六项冒烟写成 D-1 的退出条件。更要紧的是\n `image-smoke.latest.json` 在 evidence-scopes 的未登记账里写着\n 「待其下一次真实运行后登记」——而没有任何东西会触发那次运行,\n 于是那条搁置根本没有出口。本轮把它写成带复核期的具名条件。\n promotion:check DEC-024 / DEC-026 的晋级判据,事件驱动,硬接进 check 链只会恒绿\n check:deployed 活体核验,CI runner 上没有长驻底座,接进去等于加一个恒定跳过\n\n三个各有理由,但理由此前只散在 CLAUDE.md / README 的散文里,没有一条有复核期。\n\n**消费关系一律自动推导,不接受声明。** 治理层那套让登记表自报 consumption 再用 G3\n去源码里证伪;本仓直接从 check 链的递归展开与两份 CI 工作流现取——声明会撒谎,\n推导不会。CI 有几处绕开 pnpm 直接 `node governance/build-image.mjs`,因此除按名匹配\n外还按脚本里出现的 .mjs 路径匹配(用例钉住这两条与正则转义)。\n`governance/gate-flow.json` 因此只装推不出来的那些:随接线逐条变少(F2 会拦下\n已被消费却还留着的腐烂登记),也不能无声变多(F1 拦下任何新出现的未说明脚本)。\n\nF4 守的是日期不是条件:接入条件多半含人的判断(「Secret 到位后」「首次晋级时」),\n不可能机器化;能机器化的是必须有人按期回来看一眼。同形判据已在治理层\ngate-registry-core 的 G6 与 domain-layer-baseline 的 B4 上验证过:缓期不是豁免。\n\n已串进 `pnpm check`(放 check:evidence 之前,纯静态先跑先报),报告登记进\nevidence-scopes(severity=error,作用域逐条对应它实际读的文件),并加入\nreports:rebind 的零依赖清单——本仓常有并行会话,脏树上拿不到干净绑定。\n\n治理测试 283 → 298。当前:45 个脚本,33 个有消费入口,12 个流外且全部具名\n(门禁 4 / 工具 8)。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T01:09:11-07:00"}],"HeadCommit":{"Sha1":"2d4b55254cd0b38f4ae1750038d4a6d9e2ebb30a","Message":"chore(reports): check:gate-flow 回绑 @ 574cfb7\n\n45 个脚本、33 个有消费入口、12 个流外且全部具名(门禁 4 / 工具 8)、0 违规。\n并行会话正在本仓改 Dockerfile 与底座,主工作区非干净树——经 reports:rebind 在\nHEAD 的干净检出里生成,未触及对方在途文件。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T01:09:55-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/0abd15c28dd2b92c583289934db660363b202fd4...2d4b55254cd0b38f4ae1750038d4a6d9e2ebb30a","Len":3}...
|
1789719017
|
Edit
Delete
|
|
31067
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"1e6f71d84 {"Commits":[{"Sha1":"1e6f71d846a9ad3bcbd04a3f2b5fdb3f69ca1884","Message":"chore(reports): check:gate-flow 回绑 @ 5003319\n\n剥注释后判定结果不变:45 个脚本、33 个有消费入口、12 个流外且全部具名、0 违规。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T01:20:03-07:00"},{"Sha1":"5003319dcea673584371b081f59f4e347a33c4ae","Message":"fix(governance): check:gate-flow 先剥 CI 注释再匹配——否则它会亲手把自己的发现消音\n\n推导层原本直接在 CI 原文上按名匹配。工作流里本来就有\n`# static → 私有包认证 … + 根 pnpm check(含 runtime 静态门禁)` 这样的说明行,\n它没被误判纯属侥幸:`check` 后面跟的是中文括号,不是空白。只要有人写下\n「待 Secret 后加 pnpm image:smoke 这一步」,不剥注释就会把这个门禁**最实的那条发现**\n判成已被消费,随后 F2 还会反过来要求删掉那条登记。\n\n剥注释的代价是可能漏判(shell 里 `#` 之后的真命令被切掉),而漏判只会多要一条登记、\n逼人看一眼,是安全的那一侧。\n\n同时把两条刻意的保守取舍写进文件头,并在登记表 note 里记下测量结论,免得被\"优化\"掉:\n\n一、**不扫脚本正文**。消费确实可能发生在脚本内部,但天真地按名扫正文更糟——实测\n本仓 `lib/gate-flow-core.mjs` 自己的注释里就写着 image:smoke / promotion:check /\ncheck:deployed 三个名字,扫正文会把这个门禁要报的三条发现全部判成已消费。\n\n二、**扫描面只有根 package.json,这是量过之后的决定**。另外三个 pnpm 根逐个测过,\n没有真空缺:runtime 的 check:conformance:differential 被 check-runtime-acceptance\n的 plan 数组 spawn;check-runtime-governance 与 generate-governance-status 被 profile\n运行器与 governance-report 调用;check:kernel / :production / :conformance 是框架给的\nprofile 分组、其成分检查已逐条在 runtime 的 check 链里;identity 的\ncheck:dual-backend-behavior 被该仓 check-runtime-acceptance 调用。这些消费全在脚本\n正文内部,要判它们就得解析 spawn 的实参数组,而那正是第一条否掉的方向。\n\ngate-flow 测试 15 → 18,治理测试 298 → 301。判定结果不变:45 个脚本 / 33 有消费入口 /\n12 流外且全部具名。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T01:19:48-07:00"},{"Sha1":"dbc608b892652e920970ea5368a57a02263d9915","Message":"chore(reports): 工作台两份快照回绑 @ b1c2c0d\n\n本轮部署证据落进运维快照作用域(image-digest / image-smoke / deployed-runtime / runtime-up),\n经 reports:rebind 在 HEAD 的干净检出里重跑,两份同源快照一并带回。\n\n顺带实测:dev overlay 把目录快照按路径只读挂进容器,rebind 带回新文件后\nGET /api/platform/catalog 立刻报出新的 snapshot.provenance.gitSha=b1c2c0d,无需重建容器。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T01:19:18-07:00"},{"Sha1":"b1c2c0dc197166f41437f03707ad0a1bd11448c1","Message":"chore(reports): dev 重新部署证据回绑 @ d8f0920 / 759e559\n\n- image-digest:干净检出构建的 d8f09205c8a5(worktreeDirty=false,contextMode=head)\n- image-smoke:6/6(scope 单 profile、Redis 逻辑库 15、:53009)\n- pg-dump.2026-09-18:切换前七个模块库快照上传 MinIO\n- runtime-up.2026-09-18:22 条读面探针 + 4 条受控执行探针 + 3 条非 canonical 对照,\n 8 条 findings(4 修 4 留裁决),可观测三后端切换后仍有信号\n- deployed-runtime:passed / IMAGE_SOURCE_EQUIVALENT\n\nprovenance.worktreeDirty=true:本工作区有并行会话 WIP,运行面记录只绑定本地;\n镜像证据独立绑定干净检出(image.worktreeDirty=false)。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T01:18:59-07:00"},{"Sha1":"709cd94cfc5cd138b5539053554ef1b4d4dcd4ff","Message":"docs(部署): dev 常驻运行时重新部署与三个运行面取证记录(2026-09-18)\n\ncheck:deployed 从 BUILT_IMAGE_SOURCE_BEHIND 转 passed 的完整过程:四个部署缺口、\n一个被吞掉的真实缺陷、受控执行面的 dev 验收,以及六条仍未闭环的事实。\n作用域只到本机 dev,不外推目标环境签收。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T01:18:52-07:00"}],"HeadCommit":{"Sha1":"1e6f71d846a9ad3bcbd04a3f2b5fdb3f69ca1884","Message":"chore(reports): check:gate-flow 回绑 @ 5003319\n\n剥注释后判定结果不变:45 个脚本、33 个有消费入口、12 个流外且全部具名、0 违规。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T01:20:03-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/2d4b55254cd0b38f4ae1750038d4a6d9e2ebb30a...1e6f71d846a9ad3bcbd04a3f2b5fdb3f69ca1884","Len":7}...
|
1789719607
|
Edit
Delete
|
|
31100
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"32ad69a15 {"Commits":[{"Sha1":"32ad69a15ceb55e1cbcb170d7fdd47897e50c01b","Message":"chore(reports): check:caddy 回绑 @ 426a7df\n\n干净检出(.worktrees/rebind-426a7df)重跑,worktreeDirty=false;\n两个 profile 各 0 违规,caddy validate 经 docker 两份都 passed(不是 skipped)。\n报告新增 workbench 段,其中 guardsDocumentNavigation=false 是登记事实:\n入口鉴权只挡带 Authorization 头的数据面,纯静态 SPA 的文档导航挡不住。\n\n主工作区有并行会话 WIP,本次只还原本任务改动的这一份报告。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T02:05:49-07:00"},{"Sha1":"588e5ab9459d1df433f3a32b44a4afe589b6a9b7","Message":"chore(reports): check:gate-flow 回绑 @ aaf43ee\n\ncontracts:check 由 tool 订正为 gate 后重跑:46 个脚本、34 个有消费入口、\n12 个流外(门禁 5 / 工具 7)、0 违规。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T02:04:43-07:00"},{"Sha1":"426a7df100b7b8c2c82179f2b184ed066f6ceba6","Message":"feat(stack,governance,workbench): 工作台同源托管与 /api/platform/* 入口鉴权(CHG-018 阶段 ②)\n\nCaddy 两个 profile 同步改:根路径托管工作台静态产物(产物未挂载时回原占位响应),\n/_next/* 先在产物里找文件、找不到才回身份 Web,@platform 块内对 /api/platform/*\n做 forward_auth → /t/{$PLATFORM_WORKBENCH_TENANT}/oidc/userinfo。租户空值即\n/t//oidc/userinfo → 上游 404 → 整段拒绝,不配置 = 不放行,与 PLATFORM_OPS_* 同纪律。\n\n入口只挡带 Authorization 头的数据面,挡不住文档导航:工作台是纯静态 SPA,令牌进\nsessionStorage 不进 cookie,浏览器发文档请求时网关手上没有可校验的凭据。要挡住静态壳\n就得有个发 cookie 的边缘会话组件,与 CHG-018 §5.1 已裁的形态相抵,须另起 CHG。这条\n边界写进 caddy-routes.json 的登记与报告的 guardsDocumentNavigation,不靠读代码猜。\n\n连带修好取数链路:三个读面的 accessToken 此前从没有调用方传过值(读面本来公开),\n入口挡上后工作台登录了也会永远 401。现改为必填形参;hooks 从 session store 取令牌,\n身份(不是令牌)进 queryKey,补水前不发请求,退出时清缓存。\n\ncheck:caddy 增 workbench 段与四条规则,两 profile 各 0 违规、caddy validate 经 docker\n两份都 passed;六条负向用例逐条先红后绿。另修一条已失效的旧夹具:UPSTREAM_MISSING 那条\n用 String.replace 只换第一处,forward_auth 引入同名变量后它再也换不到 reverse_proxy,\n改 replaceAll 并补一条「确实解绑了上游」的断言。\n\ndev 运行态取证与未闭环项(D-8 判责码语义、D-9 门禁守不住的绕过、D-10 issuer 不一致、\n带有效令牌的 200 分支未实测)见 docs/工作台同源托管与入口鉴权实现记录-2026-09-18.md。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T02:04:42-07:00"},{"Sha1":"aaf43ee0442d5b4a5d36325a92c1ae5bbff3c76b","Message":"chore(reports): 工作台目录与运维快照回绑 @ 8a53c39\n\n在 8a53c39 的临时干净检出里重跑 `node governance/build-workbench-snapshots.mjs`\n(主工作树有并行会话的在途改动,就地跑只能产出 worktreeDirty=true 的绑定)。\n\n目录快照:schemaVersion 2,21 条 → stale 7 / not-in-manifest 14,conflicts 0。\n运维快照:schemaVersion 仍为 1,内容未变,只因生成脚本进了它的作用域而一并回绑。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T02:04:29-07:00"},{"Sha1":"90f3b99b5976b58431097147662a1253b096840c","Message":"fix(governance): 订正 gate-flow 把 contracts:check 登记成 tool——它是一道有人写、没人跑的门禁\n\n昨天登记它时我写的是「role: tool,组成部分已被消费:check:local 在根 check 链与 CI\nstatic job 里」。**那是错的。** `contracts check` 比 `check:local` 多跑一个\n`scripts/check.mjs`,而那正是**对真实 Catalog 跑治理 linter** 的那一道:checkRegistry\n校验 8 份 Catalog、决议状态、应用清单、Fact 与权限命名、scopes 的阻断引用。\n`check:local` 只跑 schema-compatibility / impact-graph / check:generated / build / test。\n根链与 CI 用的都是 check:local,所以真实 Catalog 的治理判定**不在任何自动流里**,\n只有人手动敲 `pnpm contracts:check` 才会发生。\n\n技术原因不是疏忽:linter 需要工作区根(Catalog 的 directory / code_truth / evidence 与\n决议 source 都是相对工作区的路径),CI 只 checkout 本仓,接进根链会以\nWORKSPACE_ROOT_UNRESOLVED 退出 2——check:local 正是为此存在。\n\n**但挡它在链外的历史理由已经不成立。** CLAUDE.md 当前状态节写着「`check` 余 6 项\nPLATFORM_PROJECT_UNREGISTERED 待 CHG-001」,2026-09-18 实测**已全部通过**:\n17 draft apps / 168 governed entity / 11 draft fact / 9 permission resource /\n39 decisions(32 approved / 3 pending)/ 21 platform projects(19 in goal scope),\nschema 兼容 11/11 immutable,影响图 258 节点 297 边。又一次「条件早已满足而无人察觉」。\n\n已改为 role: gate,带 reason / wireInWhen / conditionReviewBy(2026-10-31):剩下的\n只是工作区可达性,两条路二选一需裁决——给 CI 一条能取到工作区的 job(或把 linter 需要\n的工作区事实快照进本仓),或在工作区侧另起 workspace-only 链由治理层消费。\nCLAUDE.md 那句已划掉并补上实测与原因,免得下一个会话照着旧结论重走一遍。\n\n流外分布随之 4 门禁 / 8 工具 → 5 门禁 / 7 工具。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T02:04:23-07:00"}],"HeadCommit":{"Sha1":"32ad69a15ceb55e1cbcb170d7fdd47897e50c01b","Message":"chore(reports): check:caddy 回绑 @ 426a7df\n\n干净检出(.worktrees/rebind-426a7df)重跑,worktreeDirty=false;\n两个 profile 各 0 违规,caddy validate 经 docker 两份都 passed(不是 skipped)。\n报告新增 workbench 段,其中 guardsDocumentNavigation=false 是登记事实:\n入口鉴权只挡带 Authorization 头的数据面,纯静态 SPA 的文档导航挡不住。\n\n主工作区有并行会话 WIP,本次只还原本任务改动的这一份报告。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T02:05:49-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/1e6f71d846a9ad3bcbd04a3f2b5fdb3f69ca1884...32ad69a15ceb55e1cbcb170d7fdd47897e50c01b","Len":11}...
|
1789722432
|
Edit
Delete
|
|
31102
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"1b2328540 {"Commits":[{"Sha1":"1b2328540134f0118d2e3ed9abe10095e2ae4679","Message":"chore(reports): 工作台两份快照回绑 @ 956c7b6\n\ndocs/runbook.md 在 workbench-ops-snapshot 的作用域里(error 级),上一条 §7 补注把它打成\n过期;同时 bc44b4a 改了 build-workbench-snapshots.mjs,两份快照的作用域都被碰到。经\npnpm reports:rebind --gates workbench-snapshots 在 HEAD 干净检出里重跑带回,两份均绑\n956c7b6 / worktreeDirty=false / status=ok。\n\n只提交这两份报告;工作区其余在途改动属并行会话,未触碰。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T02:15:12-07:00"},{"Sha1":"d9664ca9989ad3ea59399f95b6fcd56544170c52","Message":"chore(reports): check:module-imports 与 runtime-governance 回绑 @ bc44b4a\n\n两道门禁都在 bc44b4a 的临时干净检出里重跑(主工作树有并行会话的在途改动):\ncheck:module-imports 扫 387 个源文件 0 处跨模块 import;runtime-governance 走读\napps/ 源码,tenant/outbox 五项接线指标均为 0。两份 provenance 均 worktreeDirty=false。\n\n两条限制写在这里,别把绑定当成这两道门禁现在是绿的:\n1. module-imports 的作用域含 governance/check-module-imports.mjs,该文件此刻仍是未提交\n 状态(并行会话在改),所以 check:evidence 仍会按 EVIDENCE_WORKTREE_CHANGED 记它,\n 要等那份改动落盘后再回绑一次。\n2. runtime-governance 是单跑一道,runId 与 runtime/reports 里同批的其余静态子报告不同。\n runtime 的 check:governance 要求静态子报告同一 SHA/dirty/runner/runId,重新对齐只能靠\n 一次完整的 pnpm --dir runtime check;本次只保证它自己的作用域新鲜度。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T02:14:40-07:00"},{"Sha1":"956c7b6ad393ce44aa9aae0d647ae59fbc61ec56","Message":"docs(runbook): §7 补第四处「前置失败销毁好证据」——revocation-sla 由用例自己在 beforeAll 写 failed\n\n§7 现有那条 2026-09-18 警告说的是三个 runner(adda76a 已修前置守卫段)。同族还有第四处,\n且是唯一一处在测试代码里的:reports/revocation-sla.latest.json 的写入者不是 runner,而是\nruntime/test/e2e/revocation-sla.test.ts 自己(check-mainline.mjs 全文只写 mainline-acceptance)。\n\n要害在时机——该文件 beforeAll 的第一句(:68)就无条件写下 RUN_NOT_COMPLETED,下一句才做\nisolated() 库名校验(mainline-support.ts:11 要求 /platform_\u003ckind\u003e_(ms23|test|ci))。先毁证据\n再校验前置,正是 adda76a 修掉的那个毛病。\n\n触发面不止 mainline:check:runtime/test 是工作区包 platform-tests,pnpm runtime:check:runtime\n第 5 步 turbo run test 就会跑到它。2026-09-18 实测:七个模块库建成 platform_\u003cm\u003e_acc0918 时\ne2e/chaos 整片以 MAINLINE_ISOLATED_DATABASE_REQUIRED 失败,该报告同时被清空。故「前置守卫段\n已修复、只有跑到一半才会写 failed」对本处不成立,本条一并写明救回方式。\n\n代码修复尚未做且本轮不做:runtime/test 正在三份验收报告的作用域里,重跑期间改它等于把刚跑出\n的绑定再作废一次。已登记在治理仓开发计划 §8 变更记录(2026-09-18)。\n\n本次只改本文件;工作区其余在途改动属并行会话,未触碰。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T02:13:53-07:00"},{"Sha1":"bc44b4a3ccbdd4d16bd479c15f78c321a273e243","Message":"fix(governance): 工作台目录快照单列采纳形态,并按 Catalog 证据现算托管消费者数\n\n无运行时模块的 14 条 Catalog 条目此前被快照压成两类说法,两处都低报了 Catalog 已有的事实。\n\n一、form=adopted 的三条 P0(应用群网关 / 统一交付平台 / 集中观测平台)code_truth=null、\n无运行时模块,落进 none 分支后 note 写成「只保留历史设计引用,不可调用」。实际落点是本仓\n采纳的入口、collector 与发布/晋级门禁,evidence 里逐条登记(Caddyfile + check-caddy、\notel collector + check-otel、release-manifest + check-promotion),2026-09-16 经\nCHG-009 / 011 / 012 由 Owner 裁决改指采纳形态落点。新增 consumption.kind =\nadopted-infrastructure,判据取 Catalog 的 form,排在 code_truth 推断之前——这类能力本就\n不会有 runtime/modules 或契约包路径。当前 Catalog 下 none 归零。\n\n二、三条 module_e2 共用一句「迁出需三消费者 + G4 证据」,而 evidence 本就记着差别:\n公共文件 3 个、通知与 Webhook 3 个、配置与功能开关 1 个(与 contracts/README.md\n「配置平台尤其仍缺第二、第三消费者」一致)。hostedConsumerEvidence 按 evidence 里本仓之外的\n*acceptance*.json 依消费方仓去重计数,写进 consumption.consumers,note 按是否达到三消费者\n分开说。count \u003e= 3 只说明消费者验收证据齐,不代表 G4 已裁决。\n\n数据全部取自既有 Catalog 字段,不新设人工台账、不改 contracts/catalogs/、不动 Schema;\ndesign 只增透传的 form。consumption.kind 取值域扩了一个,枚举穷尽的消费者须回看,\nCATALOG_SCHEMA_VERSION 2 -\u003e 3,rules 两条措辞同步改。\n\n测试 8 -\u003e 9:真实输入用例断言三条采纳形态不落 none、三条托管条目的消费者数与 note 各不相同;\n新增一例专测消费者计数(同仓多份验收只算一个、本仓门禁产物不算、非 acceptance 不算)。\n篡改必红实测:短路 adopted 分支与阈值后 3 例转红。治理全量 323/323。\n\n报告回绑单独成提交,跟在本提交之后。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T02:10:08-07:00"}],"HeadCommit":{"Sha1":"1b2328540134f0118d2e3ed9abe10095e2ae4679","Message":"chore(reports): 工作台两份快照回绑 @ 956c7b6\n\ndocs/runbook.md 在 workbench-ops-snapshot 的作用域里(error 级),上一条 §7 补注把它打成\n过期;同时 bc44b4a 改了 build-workbench-snapshots.mjs,两份快照的作用域都被碰到。经\npnpm reports:rebind --gates workbench-snapshots 在 HEAD 干净检出里重跑带回,两份均绑\n956c7b6 / worktreeDirty=false / status=ok。\n\n只提交这两份报告;工作区其余在途改动属并行会话,未触碰。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T02:15:12-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/32ad69a15ceb55e1cbcb170d7fdd47897e50c01b...1b2328540134f0118d2e3ed9abe10095e2ae4679","Len":4}...
|
1789723947
|
Edit
Delete
|
|
31140
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"05e3826e9 {"Commits":[{"Sha1":"05e3826e9e9e4dbbdd753252c2134b8494b08f2b","Message":"chore(reports): 工作台两份快照回绑 @ dfd4832\n\ndocs/runbook.md 在 workbench-ops-snapshot 的作用域里且是 error 级——改 §7 那段就会当场\n把 check:evidence 打红。经 reports:rebind 在 HEAD 的干净检出里重跑,两份同源快照一并带回。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:11:36-07:00"},{"Sha1":"dfd483287cee48db9791915cf33e037c4f758f6f","Message":"chore(reports): :68 修复波及的四份验收重跑回绑 @ 08c3788\n\n作用域含 runtime/test 的三份(runtime-acceptance / mainline-acceptance / revocation-sla)\n加上连带重写的 conformance-differential,在 HEAD 的干净检出 + 隔离栈 enterprise-platform-ms23\n重跑,全部 worktreeDirty=false:\n\n- runtime-acceptance passed(7 步全绿)\n- conformance-differential passed\n- mainline-acceptance passed(fact-read-http 11 / fact-persistence 17 / audit-tamper 19 /\n mainline-revocation-chaos 18)\n- revocation-sla partial(p95 5036 ms,20 样本)\n\n结果与修复前一致,说明这次动的只是写报告的时机,没有动判据。\nui-acceptance / identity-ui 作用域不含 runtime/test,未受影响,保持原绑定。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:11:12-07:00"},{"Sha1":"925eee8195821074b0e2a699acc87b4af2ea35c4","Message":"docs(部署,runbook): 记录补 §10——:68 已修、两个方向的负向实测与隔离栈会被清空的教训\n\n- runbook §7 第四处那段的收尾从「代码修复尚未做」改成已落 08c3788,并写清改的是调用点不是\n 删掉占位写;那句「跑之前先确认这份报告已提交」现在只对「跑到一半失败」成立\n- 部署记录补 §10:负向实测两个方向(旧代码毁报告 / 新代码 sha256 不变)、正向确认 t+85s\n 仍写 RUN_NOT_COMPLETED、四份重跑结果,以及中途踩的一脚——enterprise-platform-ms23 是\n 具名共享验收栈且无卷,库和角色会被别的会话清掉,每轮开跑前重新供给比事后排查便宜\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:11:12-07:00"},{"Sha1":"08c3788da42c5e8a4949daa8d5c7f23d30016205","Message":"fix(runtime): revocation-sla 的「已开跑」标记挪到前置校验之后——先毁证据再校验是反的\n\nadda76a 把三个验收 runner 改成「前置失败即退出、不碰报告」,但 revocation-sla 的报告不是\nrunner 写的,是用例自己写的,所以那次没覆盖到它——这是同病的第四处(runbook §7,2026-09-18 补注)。\n\n原形态:beforeAll 的**第一句**就无条件写 status=failed / RUN_NOT_COMPLETED,**下一句**才做\nisolated() 白名单校验。于是「环境没配对、这一轮根本没开始」也会先把上一轮的好报告毁掉。\n2026-09-18 重跑六份验收时第一次就踩到:模块库用了不在白名单里的名字,绑 765300b 的 partial\n当场没了(只因为跑在独立检出里才幸存)。\n\n改法不是删掉这个标记——「跑起来但没跑完」确实该在盘上留 RUN_NOT_COMPLETED 而不是上一轮的\npartial,这是用例自己写报告带来的责任。改的是**调用点**:挪到全部前置都满足之后,即模块库白名单\n通过、真实连库建好动作、API 子进程起来且 /health 就绪的那一刻。\n\n负向实测(两个方向都做了,确认这条改动真的有牙):\n- 同一条件下跑旧代码:报告被改写成 RUN_NOT_COMPLETED(sha256 变化,好报告已毁)\n- 同一条件下跑新代码:测试照样以 MAINLINE_ISOLATED_DATABASE_REQUIRED 失败,报告 sha256 逐字节不变\n两次都用 DATABASE_URL_PERMISSION=…/platform_permission_notallowed 触发,5 例 skipped。\n\ntypecheck 通过(platform-tests 无 lint 配置,只有 test / typecheck 两个脚本)。\n受影响报告(runtime-acceptance / mainline-acceptance / revocation-sla,作用域含 runtime/test)\n随后在干净检出重跑回绑。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T02:51:53-07:00"},{"Sha1":"1f6fa2521e4d947ecd0ee43b18e691f836522049","Message":"docs(部署): 记录补 §9——六份验收在隔离栈重跑的结果与三个未写全的前置\n\n六份全部真跑回来(4 passed / 1 partial 设计内 / 1 passed),check:evidence 36 新鲜 / 4 过期。\n补上 runbook §7 没写全的三条:模块库后缀白名单、必须非超级用户角色、模块迁移要先 deploy。\n并登记 revocation-sla.test.ts:68 先毁证据再校验前置的缺陷与不在本轮修的理由。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T02:47:01-07:00"}],"HeadCommit":{"Sha1":"05e3826e9e9e4dbbdd753252c2134b8494b08f2b","Message":"chore(reports): 工作台两份快照回绑 @ dfd4832\n\ndocs/runbook.md 在 workbench-ops-snapshot 的作用域里且是 error 级——改 §7 那段就会当场\n把 check:evidence 打红。经 reports:rebind 在 HEAD 的干净检出里重跑,两份同源快照一并带回。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:11:36-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/1b2328540134f0118d2e3ed9abe10095e2ae4679...05e3826e9e9e4dbbdd753252c2134b8494b08f2b","Len":6}...
|
1789740912
|
Edit
Delete
|
|
31144
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/feat/registry-rule-hardening
|
0
|
|
1789742570
|
Edit
Delete
|
|
31145
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/feat/registry-rule-hardening
|
0
|
{"Commits":[{"Sha1":"92a6b8e64 {"Commits":[{"Sha1":"92a6b8e647c2c4d764c1fcdb8448bfc48a4dc4ed","Message":"fix(contracts): 注册中心规则补失败关闭与摘要规范化——三个入口此前抛 TypeError,同一摘要的两种写法此前分叉成两个复核键\n\n蓝图 docs/domain/registry-snapshot-blueprint.md 从迁入起就写着「失败关闭」与\n「review key 仅用于人工复核幂等」两条不变量,实测三处不成立。本次按蓝图自己的口径补齐,\n改动只在 contracts/src/domain/application-contract-registry/:不新增写入点、不新增宿主、\n不动 Catalog 与 Schema,每条输出仍固定 activationAllowed=false / registryWriteAllowed=false /\nhumanApprovalRequired=true。\n\n1. 失败关闭:assessRegistrySnapshot / assessRegistryTransition /\n reviewCandidateSnapshotUpgrade 对畸形输入抛 TypeError(快照缺字段、now 不是 Date、\n decisions 整个缺失都会抛),四个入口里只有 LocalManifestAdmissionPlanner.plan 是\n 失败关闭的。现四个入口一致返回 REJECT + 原因码。这不是洁癖:check-fixtures 把抛出当\n 配置错误处理,实测一次 TypeError 会让整套 15 例逐例判定塌成一条 configuration 失败。\n\n2. 十六进制引用规范化:digest / commit 的正则带 /i 收大小写两种写法,比较与入键却\n 大小写敏感——同一摘要写成大写会得到另一个 reviewIdempotencyKey,同版本大小写翻转被判成\n SAME_VERSION_DIGEST_CHANGED,大写回滚 pin 被判成 ROLLBACK_PIN_MUST_MATCH_CURRENT。\n 现一律规范化为小写后再比较、再入键,ACCEPT 回吐规范化后的值。\n\n3. 版本文法收敛:一个模块三套(快照流与清单准入用 \\d+\\.\\d+\\.\\d+,升级复核用严格 SemVer),\n 新增 registry-primitives.ts 作单一来源,含预发布序;DEC-009—012 此前在两份文件各写一份,\n 一并收敛。snapshot-upgrade-review.ts 因此净减约 60 行重复实现。\n\n两处语义变化(蓝图新增一节已如实登记):\n- 收紧:1.02.0 这类前导零版本此前被放行,现在拒;assessRegistrySnapshot 另开始拒 latest\n 这类可变标签——此前它能过体检却必然过不了迁移规则。\n- 放宽:1.0.0-rc.1 这类预发布版本此前被快照流整条挡在外面,现在按 SemVer 序参与迁移。\n 平台自己发的就是 1.0.0-rc.N,升级复核那一侧本来就这么判。风险面有限:本模块所有出口\n 都不激活、不写 Registry,多进人工复核队列不等于多放行制品。\n\n证据(本分支隔离工作树,clean):注册中心单测 44/44(原 34 + 加固 10);\ncontracts check:local 302/302;check:fixtures 九个契约域套件 100 例 0 失败,\n其中本套件 15 例(正 4 / 反 11,原 8 例)。篡改必红实测两次:sameHexRef 退回大小写敏感\n→ 单测 1 红 + 夹具 P03 红;去掉快照入口守卫 → 整套塌成 0 例 1 配置失败。\n\n仍为仓内候选 sdk_e2,不代表正式 Registry、Snapshot 发布或跨仓 Required Check 已上线。\n清单登记的 C01.04 / C01.06 是「接线」型缺口且前置 Q01 运行宿主未裁,本次未动。\nreports/fixtures.latest.json 未回绑:它是 17 套件的聚合报告,只跑 9 个套件去覆盖会缩小结论面,\n应在整批(含并行会话的 public-file / IM / 跨域流程改动)落定后统一重跑回绑。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:40:10-07:00"},{"Sha1":"793d0a106f07c2b9974991a2a5953fdebc5be1b3","Message":"fix(contracts): 公共文件规则补入参体检——plan 遇畸形请求此前抛 TypeError,非布尔授权位此前被判成放行\n\n迁入版本在「入参可信」的前提下是对的,但本能力的实际入口是 JSON:夹具评估器、策略快照、\n三个消费仓的载荷都从反序列化来,TS 类型只在编译期成立。判定面没有扩张,改的只是拿到脏值时往哪边倒。\n\n三个缺口(均有实测,非读代码推断):\n\n1. `LocalPublicFileAccessPlanner.plan()` 遇畸形请求抛 TypeError 而不是拒绝。补强前 dist 实测\n `plan({})` → `TypeError: Cannot read properties of undefined (reading 'trim')`,`plan(null)`\n 与缺 `file` 的请求同理。蓝图写的「失败闭合」只覆盖快照畸形(bundled deny-all),没覆盖请求畸形——\n 抛异常落到消费侧是 500,不是拒绝。现按同包 `webhook-delivery-planner.plan()` 的既有先例先体检请求:\n 非对象 → FILE_ACCESS_REQUEST_INVALID,归属三件套缺失或非字符串 → FILE_ACCESS_ATTRIBUTION_REQUIRED,\n `file` 不是对象 → FILE_REFERENCE_INVALID。\n\n2. 非布尔的授权位被判成放行。`if (!context.permissionGranted)` 对 \"false\" / 1 / {} 全部放行;\n `authorizationVersion \u003c requiredAuthorizationVersion` 与 `expiresAt \u003c= now` 在另一端缺失时都是 false,\n 即「比不出来」被当成「比过了」。现在授权位只认字面 true,两个比较的两端都必须是整数。\n\n3. `PublicFileRef.version` 声明为 \"v1\" 却从来没被校验,换版本的引用会被 v1 判定顺带放行。\n 加 FILE_REF_VERSION_UNSUPPORTED。\n\n覆盖:夹具评估器不再先把缺字段补成 \"\" / NaN(那层补齐等于夹具永远喂不进脏值,而脏值正是这次要固定的\n那一侧),payload 原样交给规则;新增 refresh 规则——planner 第三个公开方法此前在门禁上零覆盖。\n夹具 13 → 29 例(正 4 / 反 25),补齐六条此前只有单测、门禁上没有的策略白名单原因,以及\nFILE_ACCESS_ATTRIBUTION_REQUIRED / FILE_TENANT_NOT_ALLOWED 两条此前任何地方都没覆盖的原因;\n定向测试 15 → 22 例,迁入的 15 例一条未改。\n\n未做(需 CHG,已在 index.ts 抬头与 SOURCE.md 写明,不再沿用旧措辞):\nschemas/public-file-ref.v1.schema.json(version=1 数字 + ownerEntity*/storageRef)与本目录的\nPublicFileRef(version=\"v1\" 字符串 + sha256/size/mimeType/scanStatus)不是同一个对象——一份通得过\nSchema 的引用喂不进 assessPublicFileRef,反之亦然。合并属契约变更,不在本次范围。Catalog 登记未动\n(public-file 仍 module_e2、code_truth 指向工单仓 packages/attachments),三个消费仓的副本未同步本次补强。\n\n证据:在仅含本提交改动的导出树上 tsc 绿、定向 22/22、contract-public-file 夹具 29/29;\n工作树另有并行会话的 WIP,故本次不回绑任何 reports/。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:38:28-07:00"},{"Sha1":"0c6a1918aa223b1779ce4653ba2c4e4609aea336","Message":"chore(reports): dev 常驻运行时切换后的部署门禁回绑 @ 06c3d4c\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:34:13-07:00"},{"Sha1":"06c3d4cb7fd09b2b44e621a56d7b14653bb8b445","Message":"chore(reports): runtime 镜像重建与冒烟证据回绑 @ 05e3826\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:33:44-07:00"}],"HeadCommit":{"Sha1":"92a6b8e647c2c4d764c1fcdb8448bfc48a4dc4ed","Message":"fix(contracts): 注册中心规则补失败关闭与摘要规范化——三个入口此前抛 TypeError,同一摘要的两种写法此前分叉成两个复核键\n\n蓝图 docs/domain/registry-snapshot-blueprint.md 从迁入起就写着「失败关闭」与\n「review key 仅用于人工复核幂等」两条不变量,实测三处不成立。本次按蓝图自己的口径补齐,\n改动只在 contracts/src/domain/application-contract-registry/:不新增写入点、不新增宿主、\n不动 Catalog 与 Schema,每条输出仍固定 activationAllowed=false / registryWriteAllowed=false /\nhumanApprovalRequired=true。\n\n1. 失败关闭:assessRegistrySnapshot / assessRegistryTransition /\n reviewCandidateSnapshotUpgrade 对畸形输入抛 TypeError(快照缺字段、now 不是 Date、\n decisions 整个缺失都会抛),四个入口里只有 LocalManifestAdmissionPlanner.plan 是\n 失败关闭的。现四个入口一致返回 REJECT + 原因码。这不是洁癖:check-fixtures 把抛出当\n 配置错误处理,实测一次 TypeError 会让整套 15 例逐例判定塌成一条 configuration 失败。\n\n2. 十六进制引用规范化:digest / commit 的正则带 /i 收大小写两种写法,比较与入键却\n 大小写敏感——同一摘要写成大写会得到另一个 reviewIdempotencyKey,同版本大小写翻转被判成\n SAME_VERSION_DIGEST_CHANGED,大写回滚 pin 被判成 ROLLBACK_PIN_MUST_MATCH_CURRENT。\n 现一律规范化为小写后再比较、再入键,ACCEPT 回吐规范化后的值。\n\n3. 版本文法收敛:一个模块三套(快照流与清单准入用 \\d+\\.\\d+\\.\\d+,升级复核用严格 SemVer),\n 新增 registry-primitives.ts 作单一来源,含预发布序;DEC-009—012 此前在两份文件各写一份,\n 一并收敛。snapshot-upgrade-review.ts 因此净减约 60 行重复实现。\n\n两处语义变化(蓝图新增一节已如实登记):\n- 收紧:1.02.0 这类前导零版本此前被放行,现在拒;assessRegistrySnapshot 另开始拒 latest\n 这类可变标签——此前它能过体检却必然过不了迁移规则。\n- 放宽:1.0.0-rc.1 这类预发布版本此前被快照流整条挡在外面,现在按 SemVer 序参与迁移。\n 平台自己发的就是 1.0.0-rc.N,升级复核那一侧本来就这么判。风险面有限:本模块所有出口\n 都不激活、不写 Registry,多进人工复核队列不等于多放行制品。\n\n证据(本分支隔离工作树,clean):注册中心单测 44/44(原 34 + 加固 10);\ncontracts check:local 302/302;check:fixtures 九个契约域套件 100 例 0 失败,\n其中本套件 15 例(正 4 / 反 11,原 8 例)。篡改必红实测两次:sameHexRef 退回大小写敏感\n→ 单测 1 红 + 夹具 P03 红;去掉快照入口守卫 → 整套塌成 0 例 1 配置失败。\n\n仍为仓内候选 sdk_e2,不代表正式 Registry、Snapshot 发布或跨仓 Required Check 已上线。\n清单登记的 C01.04 / C01.06 是「接线」型缺口且前置 Q01 运行宿主未裁,本次未动。\nreports/fixtures.latest.json 未回绑:它是 17 套件的聚合报告,只跑 9 个套件去覆盖会缩小结论面,\n应在整批(含并行会话的 public-file / IM / 跨域流程改动)落定后统一重跑回绑。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:40:10-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/05e3826e9e9e4dbbdd753252c2134b8494b08f2b...92a6b8e647c2c4d764c1fcdb8448bfc48a4dc4ed","Len":4}...
|
1789742570
|
Edit
Delete
|
|
31147
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"0c6a1918a {"Commits":[{"Sha1":"0c6a1918aa223b1779ce4653ba2c4e4609aea336","Message":"chore(reports): dev 常驻运行时切换后的部署门禁回绑 @ 06c3d4c\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:34:13-07:00"},{"Sha1":"06c3d4cb7fd09b2b44e621a56d7b14653bb8b445","Message":"chore(reports): runtime 镜像重建与冒烟证据回绑 @ 05e3826\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:33:44-07:00"}],"HeadCommit":{"Sha1":"0c6a1918aa223b1779ce4653ba2c4e4609aea336","Message":"chore(reports): dev 常驻运行时切换后的部署门禁回绑 @ 06c3d4c\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:34:13-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/05e3826e9e9e4dbbdd753252c2134b8494b08f2b...0c6a1918aa223b1779ce4653ba2c4e4609aea336","Len":2}...
|
1789742609
|
Edit
Delete
|
|
31148
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"c190a6ab5 {"Commits":[{"Sha1":"c190a6ab5d2c50e4c90f027bbcca72f1f3050005","Message":"fix(contracts): 通知与 Webhook 规则补入参体检——一处倒向放行、两处崩溃面与目标地址的同义写法\n\n迁入版把策略快照一侧校验到底(normalizeSnapshot 逐字段抛),请求一侧、目标地址一侧与夹具评估器三处漏风。\n补强前对 dist 逐条实测:\n\n- 放行面(唯一一处方向倒向放行):三个状态位按真值判,`replayAuthorized: \"false\"` 在 `!value` 下为 false,\n 未授权重放被判成已授权 → DELIVER;planner 原样透传这三位,计划面同样通。现在只认布尔字面量。\n- 崩溃面:classifyNotificationEffect(undefined) / classifyProviderOutcome(undefined) 抛 TypeError 而不是拒绝,\n 夹具的 effect / provider 两条规则都能直接触发——门禁那时拿到的是异常不是判定,落到消费侧是 500 不是拒绝。\n- 目标地址(C08.05 / 蓝图「私网地址失败关闭」):isPrivateLiteral 只认四段十进制,2130706433 / 0x7f000001 /\n 0177.0.0.1 / 127.1 全判成公网;0.0.0.0/8、CGNAT 100.64/10、组播与保留段、.internal、末尾点均未覆盖。\n 现在数字形主机一律按 IP 字面量处理,只放行严格四段十进制的公网地址;allowedHosts 自己先过这道地板\n (WEBHOOK_ALLOWED_HOST_NOT_PUBLIC),小写归一后再查一次重名。\n- 本次唯一放宽的一处,据实登记:迁入版按字符串前缀 fc / fd / fe80 判私网 IPv6,fc-portal.example.com 这类\n 正常域名被误判成私网。改判后它可用,但仍须先进运营批准的 allowlist 且为 HTTPS,不构成新的可达面。\n- 死代码:WEBHOOK_TENANT_WILDCARD_FORBIDDEN 写在字符集校验之后,`*` 永远先报 WEBHOOK_ROUTE_TENANTS_INVALID,\n 蓝图写明的「tenant allowlist 禁止 *」从未以自己的名义拦下过。\n- 退避:decideProviderOutcome 原取 min(maximumBackoff, retryAfter),供应商回一个 Retry-After: 0 即可把批准过的\n 退避清零。现在外部回执只能把退避拉长到策略上界,上界语义与既有用例逐字不变。\n- 夹具评估器把两种非放行当成放行:SKIP_DUPLICATE 与 DLQ 都没有 reasons 字段,被 `\"reasons\" in r` 判成空数组\n = ACCEPT,与该文件自己第一句「只有 DELIVER / DELIVERED 算放行」正相反。另补 refresh 规则。\n- effect_id 改为强校验:五段必须是规范标识符(因此不含 :),否则 a:b+c 与 a+b:c 会拼出同一个 id;\n 请求一侧的标识符不再先 trim 再判定。\n\n合法快照与合法请求的判定结果逐字不变:迁入的 14 例断言一条未改。单测 14 → 24 例;夹具 8 → 17 例,并修好\n名不副实的 N06-plan-without-policy-denies-all——它此前只喂了两个字段的请求,压根走不到「无策略即拒」那一步。\n\n核验(工作树 dirty,报告未回绑,只绑本地):contracts build / typecheck 绿、本域单测 24/24、\ncontracts/test/*.test.mjs 330/330、check:fixtures 17 套件 236 例 0 失败 0 不可用(本域 17/17;用临时报告名跑,\n跑完删除,reports/ 未动)。负向实测两次:① 把 HEAD 版三支规则单独编译后喂新夹具,8 例新增负例全部不通过\n(N07/N10/N11 直接放行、N08/N09 抛 TypeError、N12 换原因、N13/N14 旧评估器不识别 refresh);\n② 篡改 N10 的声明原因 → 门禁 exit 1 并点名该例,翻 expect → 被 id/expect 一致性先挡下,还原后 exit 0。\n\n未做:缺失模块完善清单 C12 的模板审批 / 多渠道 Provider / 签名防重放 / 渠道切换本仓仍一件没有(该行类型是\n「裁决」,前置是运行宿主 Q01),本轮仍是契约包形态,不代表通知服务上线;Catalog 登记未动(仍 module_e2,\ncode_truth 指工单仓 packages/notification-delivery);三个消费仓的 packages/notification-delivery 未同步;\n入站回调验签(C12.05)与 UNKNOWN 回执(C12.04)属判定面扩张,只登记未实现。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:43:48-07:00"},{"Sha1":"9d13fb058d2a0356797f26d1d17a4b2149b6ab97","Message":"docs(runbook): 订正 CORS 一句——服务端代理不解 CORS,工作台吃的是 :3101 那个进程的白名单\n\n原文「控制面 Web 与 identity dev 走服务端代理,不吃这条」把两件事混了。代理只是把上游的\nAccess-Control-Allow-Origin 原样回传,吃不吃只看浏览器所在页面的 origin 与被请求 origin\n是否同源:控制面 Web 的页面与它的 /api 代理同源,不吃;工作台 dev(:3010)经 :3098 代理\n打到 :3101,跨源,放行的必须是 :3101 那个进程的 CORS_ORIGIN,而不是容器的\nPLATFORM_CORS_ORIGIN——后者 2026-09-18 补过、前者一直缺,于是总览两块读面全被浏览器拦成\n「依赖故障」,而服务端日志里是一次正常 200。今天按这句话排查,方向被带偏过一次。\n\n同轮登记两处仓外事实:identity dev 的 env 文件位置(企业控制面/.secrets/\nenterprise-platform-identity-dev.env,已含 CORS_ORIGIN=http://localhost:3010),\n以及工作台 API 基地址的单一出处(apps/workbench/.env.local,launch.json 不再覆盖)。\n\n作用域 = 文档订正,不含代码与门禁证据。本机 dev 实测:预检 204 / 三个读面 200 /\nidentity 探针 database:up redis:up,证据只绑本地运行态。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:42:44-07:00"},{"Sha1":"13c7eb7271af67df9d0b4e5223bda3eaa4ab7b10","Message":"fix(contracts): 跨域流程规则补入参体检,并补上 FLOW-01 与 effect 幂等两条自己没做到的红线\n\n迁入版的判定在「入参可信」时是对的,但本能力的真实入口是 JSON:夹具评估器、approved 快照、\n未来的 Owner Adapter 载荷都从反序列化来,TS 类型只在编译期成立。四类问题均有 dist 实测,非读代码推断。\n\n1. 崩溃面八处抛 TypeError 而不是拒绝。assessWorkflowDefinition(undefined) →\n Cannot read properties of undefined (reading 'domains');{}、domains 非数组、steps 非数组、\n 步骤缺 dependsOn、effectIdempotencyKey 是数字同理;LocalWorkflowPlanner.plan({}) →\n Cannot read properties of undefined (reading 'trim')。夹具 definition 与 plan 两条规则都能直接触发——\n 门禁那时拿到的是崩溃不是判定,落到消费侧是 500 不是拒绝。现在两侧都先按 unknown 体检:\n 定义非对象 → WORKFLOW_DEFINITION_INVALID,请求非对象或归属三件套非空串 → WORKFLOW_ATTRIBUTION_REQUIRED。\n\n2. 放行面三处脏值倒向合格。timeoutSeconds: \"abc\" 因 \"abc\" \u003c= 0 为 false 而合格;\n irreversibleEffect: 0 被当成可逆,整条不可逆效果的幂等键要求随之失效;steps: [] 的「流程」也合格,\n approved 快照喂进来就是一份零命令的 PLAN。现在 timeout 必须是正整数、irreversibleEffect 必须是布尔、\n 零步骤 → WORKFLOW_STEPS_REQUIRED。\n\n3. 判定面在两处确有扩张,都是本规则自己没做到自己的红线。FLOW-01 Eligibility 是开发计划写死的\n 第一道闸(「拒绝把域内定时任务和单域状态机迁入平台」),但迁入版只数 domains 声明了几个域,\n 不数步骤实际落在几个域——把单域状态机的 domains 写成两个即可整条绕过,实测\n {domains:[\"hr\",\"identity\"], steps:[两步都 ownerDomain:\"hr\"]} 判 ELIGIBLE。现在 Owner 面体检通过后\n 再数步骤真实跨度,沿用 NOT_CROSS_DOMAIN 不新增原因码。另一条红线写「不可逆外部效果使用独立\n effect idempotency,平台重放不得重复付款、通知」,但两个不可逆步骤共用同一把键时无人拦,\n 一次效果的幂等记录会压掉另一次 → 新增 EFFECT_IDEMPOTENCY_NOT_UNIQUE。\n\n4. 第三条扩张在 governed 步骤一侧:不可逆步骤既无同 Owner 补偿又不开人工接管时此前照常编进波次,\n 而退出门要求「每步唯一 Owner、timeout 和恢复责任明确」,这种步骤失败后没有任何恢复责任人 →\n STEP_RECOVERY_RESPONSIBILITY_REQUIRED。补偿仍是可选项:人工接管或补偿有其一即可,\n 可逆步骤不受约束,两条都有正向用例钉住。\n\n另修一处诊断损失:normalizeSnapshot 把定义体检的多条原因只抛第一条,改为逐条抛出。\n合法定义与合法请求的判定结果逐字不变,迁入的 11 例单测断言一条未改。\n\n覆盖:定向测试 11 → 22 例,补强用例另起两节;夹具 7 → 16 例(正 2 / 反 14),并给原 N01—N05\n补 reasons 声明——此前只断言「拒绝」,换一条原因拒绝也算过。\n\n未做(越界,已在 SOURCE.md 与蓝图增量节写明):流程实例、持久调度、补偿执行器、Timer、\nOwner Adapter 与 M5 分工一件未建,按缺失模块完善清单 C15 卡在运行宿主 Q01 与 G4,本轮仍是契约包形态,\n不代表编排平台上线;Catalog 登记一律未动(仍 candidate_e0 / E0);步骤 Permission 的资源归属仍不校验\n(ownerDomain \"hr\" 的步骤声明 identity 资源照样编进计划,而资源名与域的绑定在本包里没有可判定的真源,\n纯规则读不到 catalogs/permissions.json);commandIdempotencyKey 含定义版本号,同一实例升版重放会换键,\n不可逆效果由不含版本的 effectIdempotencyKey 兜底,改它属运行宿主裁决时一并定的事。\n\n证据:在仅含本提交改动的导出树上 tsc 与 typecheck 绿、定向 22/22、contract-cross-domain-workflow\n夹具 16/16;负向实测把 N07-declared-domains-without-real-owner-span 的声明原因改成 WORKFLOW_CYCLE,\n门禁 exit 1 并点名该例(reasons=[\"NOT_CROSS_DOMAIN\"]),还原后转绿。导出树里 governance-linter.test.mjs\n因 /tmp 下工作区根不可解析而失败,pristine HEAD 导出树同样失败,与本次改动无关;真实工作树\ncontracts:check:local 330/330、check:fixtures 17 套件 227 例 0 失败。工作树另有并行会话的 WIP,\n故本次不回绑任何 reports/。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:42:22-07:00"},{"Sha1":"5720165763b35035e6778fe9a802493a16eb5aca","Message":"fix(contracts): 会话准入规则补入参体检——四条 fail-open 与一处「兜底自己会抛」收口\n\n九项契约包自 2026-09-14 迁入以来一直是「原样迁入、未改语义」,本条是第一次动判定。\n起因是对 collaboration-messaging 逐条实测而非读代码:迁入版把策略快照一侧校验到底\n(normalizeSnapshot 逐字段抛并被工厂捕获),请求一侧整个信任声明类型,而声明类型\n约束不了 HTTP 与夹具送进来的 JSON。五条缺陷均可复现,且都打在该能力自己 README 的\n「最小验收」与蓝图的「失败闭合」上:\n\n1. 抛而不拒。三个导出在畸形 JSON 下抛 TypeError 而不是返回 REJECT。兜底的 bundled\n deny-all 也不例外——createRuntimeConversationAdmissionPlanner().plan({}) 抛异常,\n 即「什么都不放行」的最后一道在畸形入参下等于没有。\n\n2. 未知 senderType 放行,且 \"AI_AGENT\"(只改大小写)同样放行。AI_ATTRIBUTION_REQUIRED\n 只在严格等于 ai_agent 时触发,于是「AI 不得冒充人员」有一条改大小写就能走的绕过路径。\n 不做大小写归一化——归一化等于替冒充者补齐形状。\n\n3. 游标不绑定会话。ConversationAppendState 有 expectedTenantId 却没有会话标识,拿 conv-1\n 的游标判 conv-9 的消息得到 APPEND,planner 直接 ADMIT 并按 conv-9 生成幂等键;重复与\n 序列 Gap 判定全程可能在读另一个会话的账本。\n\n4. processedMessageIds 传成字符串时 includes 退化为子串判断,幂等两个方向都错:\n \"msg-1\" 不含 \"msg-2\" 则漏判重复,\"msg-1,msg-2\" 含则误判重复。\n\n5. memberActive 传成真值字符串即算在籍(原判据 !state.memberActive,\"false\" 是真值)。\n\n附带:hasAttachment 非布尔即拒。此前缺字段时 attachmentAuthorizationRequired 是\nundefined,下游 if (plan.attachmentAuthorizationRequired) 就跳过公共文件平台重新授权,\n等于「缺字段 = 不需要授权」。\n\n改法只收紧失败一侧,合法输入的判定结果逐字不变:迁入的 16 例断言一条未改,只给游标补了\n新的必填字段。expectedConversationId 做成必填而不是「在场才查」——可选只能拦住已经想起来\n要绑定的调用方,拦不住忘了的那个,而忘了的那个正是第 3 条的全部成因;破坏面可枚举且全在\n仓内(本包测试与夹具各一处),Catalog 上该项 candidate_e0 / code_truth 指向本目录 /\n上层真实消费者为零。ConversationAppendDecision 新增 CONVERSATION_BINDING_REQUIRED /\nCONVERSATION_MISMATCH / STATE_INVALID 三档(原先「序列非整数」复用 REJECT,与「消息体检\n未过」同码,改后 REJECT 专指后者);planner 新增 REQUEST_SHAPE_INVALID /\nATTACHMENT_FLAG_INVALID 两条原因与两条映射。新增原因一律排在既有原因之后判定,既有原因码\n的优先级未动。\n\n顺带修一条证据登记缺口:reports/fixtures.latest.json 的作用域只写到 runtime/modules,\n九个契约包套件的两类输入整个在作用域外——夹具用例在 contracts/test/fixtures/,判定用的\nevaluateFixturePayload 在 contracts/src/domain/。作用域写于只有运行时模块有夹具的时候,\n2026-09-14 迁入时没随迁,后果是改夹具或改规则都不会让这份报告过期,而它正是这九项在\nCatalog 上登记的证据之一。实据不用构造:本轮改动与并行会话的 public-file 改动同时在树上,\ncheck:evidence 仍不点它。补两条后该报告立刻转 EVIDENCE_WORKTREE_CHANGED,check:evidence\n由 4 条过期变 6 条——多出来的不是新问题,是此前看不见的问题。\n\n核验:contracts test 285 → 292(我的增量 +7,既有断言未改;树上现读 330,多出的是并行会话\n在途改动);check:fixtures 本套件 8 → 14 例(正 2 / 反 12)0 失败;负向实做:把 N11 的声明\n原因改成不会产生的串,门禁 exit 1 并点名该例,还原后 exit 0;governance 测试 340/340;\n工作区一致性 L4 / L10 / L13 均 0。\n\n未做(越界):会话 / 成员 / 消息账本、长连接服务、Fact、独立运行服务一件未建——按缺失模块\n完善清单 C16 卡在「裁决 · 实现」,前置是 Owner ADR、三消费者与 G4。Catalog 的\nimplementation_state / evidence_level / code_truth / evidence 一律未动(改登记须 CHG)。\n蓝图迁入原文逐字未改,硬化增量另起一节附在其后。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:41:37-07:00"},{"Sha1":"793d0a106f07c2b9974991a2a5953fdebc5be1b3","Message":"fix(contracts): 公共文件规则补入参体检——plan 遇畸形请求此前抛 TypeError,非布尔授权位此前被判成放行\n\n迁入版本在「入参可信」的前提下是对的,但本能力的实际入口是 JSON:夹具评估器、策略快照、\n三个消费仓的载荷都从反序列化来,TS 类型只在编译期成立。判定面没有扩张,改的只是拿到脏值时往哪边倒。\n\n三个缺口(均有实测,非读代码推断):\n\n1. `LocalPublicFileAccessPlanner.plan()` 遇畸形请求抛 TypeError 而不是拒绝。补强前 dist 实测\n `plan({})` → `TypeError: Cannot read properties of undefined (reading 'trim')`,`plan(null)`\n 与缺 `file` 的请求同理。蓝图写的「失败闭合」只覆盖快照畸形(bundled deny-all),没覆盖请求畸形——\n 抛异常落到消费侧是 500,不是拒绝。现按同包 `webhook-delivery-planner.plan()` 的既有先例先体检请求:\n 非对象 → FILE_ACCESS_REQUEST_INVALID,归属三件套缺失或非字符串 → FILE_ACCESS_ATTRIBUTION_REQUIRED,\n `file` 不是对象 → FILE_REFERENCE_INVALID。\n\n2. 非布尔的授权位被判成放行。`if (!context.permissionGranted)` 对 \"false\" / 1 / {} 全部放行;\n `authorizationVersion \u003c requiredAuthorizationVersion` 与 `expiresAt \u003c= now` 在另一端缺失时都是 false,\n 即「比不出来」被当成「比过了」。现在授权位只认字面 true,两个比较的两端都必须是整数。\n\n3. `PublicFileRef.version` 声明为 \"v1\" 却从来没被校验,换版本的引用会被 v1 判定顺带放行。\n 加 FILE_REF_VERSION_UNSUPPORTED。\n\n覆盖:夹具评估器不再先把缺字段补成 \"\" / NaN(那层补齐等于夹具永远喂不进脏值,而脏值正是这次要固定的\n那一侧),payload 原样交给规则;新增 refresh 规则——planner 第三个公开方法此前在门禁上零覆盖。\n夹具 13 → 29 例(正 4 / 反 25),补齐六条此前只有单测、门禁上没有的策略白名单原因,以及\nFILE_ACCESS_ATTRIBUTION_REQUIRED / FILE_TENANT_NOT_ALLOWED 两条此前任何地方都没覆盖的原因;\n定向测试 15 → 22 例,迁入的 15 例一条未改。\n\n未做(需 CHG,已在 index.ts 抬头与 SOURCE.md 写明,不再沿用旧措辞):\nschemas/public-file-ref.v1.schema.json(version=1 数字 + ownerEntity*/storageRef)与本目录的\nPublicFileRef(version=\"v1\" 字符串 + sha256/size/mimeType/scanStatus)不是同一个对象——一份通得过\nSchema 的引用喂不进 assessPublicFileRef,反之亦然。合并属契约变更,不在本次范围。Catalog 登记未动\n(public-file 仍 module_e2、code_truth 指向工单仓 packages/attachments),三个消费仓的副本未同步本次补强。\n\n证据:在仅含本提交改动的导出树上 tsc 绿、定向 22/22、contract-public-file 夹具 29/29;\n工作树另有并行会话的 WIP,故本次不回绑任何 reports/。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:38:28-07:00"}],"HeadCommit":{"Sha1":"c190a6ab5d2c50e4c90f027bbcca72f1f3050005","Message":"fix(contracts): 通知与 Webhook 规则补入参体检——一处倒向放行、两处崩溃面与目标地址的同义写法\n\n迁入版把策略快照一侧校验到底(normalizeSnapshot 逐字段抛),请求一侧、目标地址一侧与夹具评估器三处漏风。\n补强前对 dist 逐条实测:\n\n- 放行面(唯一一处方向倒向放行):三个状态位按真值判,`replayAuthorized: \"false\"` 在 `!value` 下为 false,\n 未授权重放被判成已授权 → DELIVER;planner 原样透传这三位,计划面同样通。现在只认布尔字面量。\n- 崩溃面:classifyNotificationEffect(undefined) / classifyProviderOutcome(undefined) 抛 TypeError 而不是拒绝,\n 夹具的 effect / provider 两条规则都能直接触发——门禁那时拿到的是异常不是判定,落到消费侧是 500 不是拒绝。\n- 目标地址(C08.05 / 蓝图「私网地址失败关闭」):isPrivateLiteral 只认四段十进制,2130706433 / 0x7f000001 /\n 0177.0.0.1 / 127.1 全判成公网;0.0.0.0/8、CGNAT 100.64/10、组播与保留段、.internal、末尾点均未覆盖。\n 现在数字形主机一律按 IP 字面量处理,只放行严格四段十进制的公网地址;allowedHosts 自己先过这道地板\n (WEBHOOK_ALLOWED_HOST_NOT_PUBLIC),小写归一后再查一次重名。\n- 本次唯一放宽的一处,据实登记:迁入版按字符串前缀 fc / fd / fe80 判私网 IPv6,fc-portal.example.com 这类\n 正常域名被误判成私网。改判后它可用,但仍须先进运营批准的 allowlist 且为 HTTPS,不构成新的可达面。\n- 死代码:WEBHOOK_TENANT_WILDCARD_FORBIDDEN 写在字符集校验之后,`*` 永远先报 WEBHOOK_ROUTE_TENANTS_INVALID,\n 蓝图写明的「tenant allowlist 禁止 *」从未以自己的名义拦下过。\n- 退避:decideProviderOutcome 原取 min(maximumBackoff, retryAfter),供应商回一个 Retry-After: 0 即可把批准过的\n 退避清零。现在外部回执只能把退避拉长到策略上界,上界语义与既有用例逐字不变。\n- 夹具评估器把两种非放行当成放行:SKIP_DUPLICATE 与 DLQ 都没有 reasons 字段,被 `\"reasons\" in r` 判成空数组\n = ACCEPT,与该文件自己第一句「只有 DELIVER / DELIVERED 算放行」正相反。另补 refresh 规则。\n- effect_id 改为强校验:五段必须是规范标识符(因此不含 :),否则 a:b+c 与 a+b:c 会拼出同一个 id;\n 请求一侧的标识符不再先 trim 再判定。\n\n合法快照与合法请求的判定结果逐字不变:迁入的 14 例断言一条未改。单测 14 → 24 例;夹具 8 → 17 例,并修好\n名不副实的 N06-plan-without-policy-denies-all——它此前只喂了两个字段的请求,压根走不到「无策略即拒」那一步。\n\n核验(工作树 dirty,报告未回绑,只绑本地):contracts build / typecheck 绿、本域单测 24/24、\ncontracts/test/*.test.mjs 330/330、check:fixtures 17 套件 236 例 0 失败 0 不可用(本域 17/17;用临时报告名跑,\n跑完删除,reports/ 未动)。负向实测两次:① 把 HEAD 版三支规则单独编译后喂新夹具,8 例新增负例全部不通过\n(N07/N10/N11 直接放行、N08/N09 抛 TypeError、N12 换原因、N13/N14 旧评估器不识别 refresh);\n② 篡改 N10 的声明原因 → 门禁 exit 1 并点名该例,翻 expect → 被 id/expect 一致性先挡下,还原后 exit 0。\n\n未做:缺失模块完善清单 C12 的模板审批 / 多渠道 Provider / 签名防重放 / 渠道切换本仓仍一件没有(该行类型是\n「裁决」,前置是运行宿主 Q01),本轮仍是契约包形态,不代表通知服务上线;Catalog 登记未动(仍 module_e2,\ncode_truth 指工单仓 packages/notification-delivery);三个消费仓的 packages/notification-delivery 未同步;\n入站回调验签(C12.05)与 UNKNOWN 回执(C12.04)属判定面扩张,只登记未实现。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:43:48-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/0c6a1918aa223b1779ce4653ba2c4e4609aea336...c190a6ab5d2c50e4c90f027bbcca72f1f3050005","Len":5}...
|
1789742672
|
Edit
Delete
|
|
31149
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"e8fda74e2 {"Commits":[{"Sha1":"e8fda74e279a5884440d5efaac2265e513c814b6","Message":"chore(reports): 入口门禁与工作台两份快照回绑 @ a9abcbe\n\n在 a9abcbe 的干净 detached 检出里重跑(governance/rebind-reports.mjs --gates caddy,workbench-snapshots,\n带 CHECK_CADDY_DOCKER=1),三份均 provenance.gitSha=a9abcbe / worktreeDirty=false。\n\n- reports/caddy.latest.json:0 违规。12 个 HTTP 契约前缀 × 2 profile 全覆盖;新增的 routing 段逐条记下\n 模拟出来的块链,13 条登记前缀(11 个去重契约前缀 + 2 个长连接前缀)全部到达 {$PLATFORM_API_UPSTREAM};\n workbenchGuard.reached=true / conditionalBefore=0;语法校验 dev / staging 均 passed,via docker,\n 镜像 caddy@sha256:5f5c8640…d58648(compose 锁定的那一个,不再是浮动 tag)。\n- reports/workbench-catalog-snapshot.latest.json:只有 provenance 变。caddy-routes.json 进了它的作用域\n (新增 validate / mount 段),被 check:evidence 判过期,但快照只吃 routes.contracts,内容逐字未变——\n 重建后与旧版按字段比对一致,已实测。\n- reports/workbench-ops-snapshot.latest.json:与 catalog 同一脚本产出,必须一起带回(分开会绑不同提交)。\n 它有一处内容变化不由本轮改动引起:image 段从 d8f09205 / sha256:fe418667… 更新到 05e3826e /\n sha256:c0869934…,来源是 06c3d4c 已提交的 reports/image-digest.json——此前那份快照相对该提交是旧的。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:46:25-07:00"},{"Sha1":"a9abcbe392de8a903512ab4b25529a6e277113ee","Message":"feat(gateway): 入口门禁改为解析块树后模拟路由——「文件里配了」不等于「这条路径上生效」\n\nC08 应用群网关是采纳形态,判定在 Caddyfile 这份配置里,由 check-caddy 守。它此前是逐行正则:\n某条指令在文件里出现过就算配了。本轮不动入口运行行为(两份 Caddyfile 一个字没改),只把它\n自己在注释里写明判不了的那一类失效变成静态判定。\n\n逐行正则判不出来的三件事:\n- 有个更靠前的 handle 块把 /api/platform/* 截走——入口鉴权配得好好的,请求根本走不到它。\n caddy-routes.json 的 workbench.note 原文是「这种绕过只能靠运行态探针发现」。\n- 请求体上限 / 上游超时 / request-id 注入写在别的块里,门禁全绿,平台路由上一层保护都没有。\n BODY_LIMIT_MISSING 这类规则问的是「文件里有没有」,不是「这条路由上有没有」。\n- 契约前缀有匹配器、但请求先被别人服务了:ROUTE_UNCOVERED 绿,流量到不了 API。\n\n新增块树解析(tokenizeLine / parseCaddyfile:`{` 只有作为行末独立 token 才开块,占位符\n{$VAR} 与 {http.request.uuid} 是 token 内部的花括号)与路由模拟(按 Caddy 的 handle 互斥语义\n与指令序,逐层并入命名匹配器),据此新增:\n- ROUTE_SHADOWED 前缀有匹配器但被更靠前的 handler 截走,到不了 {$PLATFORM_API_UPSTREAM}\n- WORKBENCH_AUTH_BYPASS 被守护前缀在到达 forward_auth 所在块之前就被别的 handler 服务了;\n 更靠前的 handler 若条件不是纯路径(header / method / file),按「可能截走」同样判红\n- INGRESS_GUARD_OUT_OF_SCOPE 入口约定在文件里有,却不在服务该前缀的那条块链上\n- STREAMING_ROUTE_UNCOVERED 登记的长连接前缀没被路由到上游(与「禁 read_timeout」凑成一对)\n- CADDYFILE_UNPARSED 花括号不配平 / 没有站点块——判不了就报,不静默通过\n\n同轮补三条登记面的:\n- PROFILE_MOUNT_UNBOUND profile 的 Caddyfile 没被登记的 compose 挂进入口容器。staging 那份此前\n 只被校验、没人核对它有没有被 overlay 加载;校验一份没人加载的配置等于没校验。\n- CADDY_IMAGE_UNPINNED compose 的入口镜像不是 digest 锁定。docker 校验原先写死浮动 tag\n caddy:2-alpine,而跑的是锁定镜像——拿另一个版本的 Caddy 校验,过了也\n 不代表运行的那个认它。现在从 compose 取镜像,取不到即 skipped,不退回浮动 tag。\n- ROUTE_MAPPING_ORPHANED 登记表映射了 modules.json 里已不存在的契约(CONTRACT_UNMAPPED 的反向死登记)\n\nstripComments 按 Caddy 口径重写:引号内的 # 是字面量,# 只有在 token 开头才起注释——原先一刀切到\n第一个 #,会把 respond \"a#b\" 这类值截半,反过来让门禁看不见后面真实生效的指令。\nevidence-scopes 的 caddy 作用域补进 stack/compose.yaml 与 stack/overlays/staging.yaml:结论现在\n也取决于「挂没挂进容器」和「校验用的是不是那个镜像」,这两个输入一改结论就可能不再成立。\n\n核验(工作树 dirty,报告未回绑,只绑本地):\n- CHECK_CADDY_DOCKER=1 check:caddy exit 0:12 个 HTTP 契约前缀 × 2 profile 全覆盖;模拟路由 13 条\n 前缀(11 个去重契约前缀 + 2 个长连接前缀)全部到达上游且入口约定就在各自链上;\n workbenchGuard.reached=true;两份 Caddyfile 语法均 passed,镜像 caddy@sha256:5f5c8640…d58648\n (= compose 锁定、dev 常驻容器正在跑的那一个)。\n- check-caddy.test.mjs 19 → 37 例,每条新规则都有篡改夹具且夹具断言「确实改到了」。两例专门对照\n 旧规则:插入抢先的 handle 后 evaluateCaddyfile / evaluateWorkbench 仍全绿,新规则判红。\n- 与真实 Caddy 对照(同一 digest 镜像,两个一次性容器,上游指向死端口):真实基线\n GET /api/platform/probe → 502(forward_auth 去校验,没放行);插入抢先 handle 的那份 → 200\n 「bypassed」,门禁判红。同一份里 /api/v1/decisions 仍 502,截走范围与模拟一致。\n- 一处自测抓到的实现缺陷:scopeNodes 顶层那一跳没挡 handler 分支,\"别的块里配了也算数\"——\n 正是要判的那种失效;已修并由「请求体上限挪到别的块」一例钉住。另一例钉住命名匹配器声明在\n 里层块时必须判得动(撤掉修复即落在 reverse_proxy 而非 respond,实测过)。\n- 回归:governance 全套 340/340;工作区一致性门禁只余既有 L9 compose 重名 1 条,与本轮无关。\n\n未做:G-3 限流要 caddy-ratelimit 插件即自建镜像,会打破 digest 锁定的官方镜像,是 stack 决策;\nHTTP 方法白名单归属 2026-09-16 已裁为不阻塞退役、转 stack 待办;C08.04 East-West 身份、C08.05\nWebhook ingress 与 Egress SSRF、C08.06 外发 / WAF / HA 全无落点(Q03)。静态判定的边界据实登记:\n非路径条件只能判「可能」,route 只作近似,每个前缀只探一条代表路径(/t/\u003ctenant\u003e/login 这类\n「有意分流一部分」不在判定范围),入口鉴权仍挡不住文档导航——运行态探针仍是必要补充。\n\n报告回绑另起 chore(reports) 提交(仓纪律 5)。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:45:36-07:00"}],"HeadCommit":{"Sha1":"e8fda74e279a5884440d5efaac2265e513c814b6","Message":"chore(reports): 入口门禁与工作台两份快照回绑 @ a9abcbe\n\n在 a9abcbe 的干净 detached 检出里重跑(governance/rebind-reports.mjs --gates caddy,workbench-snapshots,\n带 CHECK_CADDY_DOCKER=1),三份均 provenance.gitSha=a9abcbe / worktreeDirty=false。\n\n- reports/caddy.latest.json:0 违规。12 个 HTTP 契约前缀 × 2 profile 全覆盖;新增的 routing 段逐条记下\n 模拟出来的块链,13 条登记前缀(11 个去重契约前缀 + 2 个长连接前缀)全部到达 {$PLATFORM_API_UPSTREAM};\n workbenchGuard.reached=true / conditionalBefore=0;语法校验 dev / staging 均 passed,via docker,\n 镜像 caddy@sha256:5f5c8640…d58648(compose 锁定的那一个,不再是浮动 tag)。\n- reports/workbench-catalog-snapshot.latest.json:只有 provenance 变。caddy-routes.json 进了它的作用域\n (新增 validate / mount 段),被 check:evidence 判过期,但快照只吃 routes.contracts,内容逐字未变——\n 重建后与旧版按字段比对一致,已实测。\n- reports/workbench-ops-snapshot.latest.json:与 catalog 同一脚本产出,必须一起带回(分开会绑不同提交)。\n 它有一处内容变化不由本轮改动引起:image 段从 d8f09205 / sha256:fe418667… 更新到 05e3826e /\n sha256:c0869934…,来源是 06c3d4c 已提交的 reports/image-digest.json——此前那份快照相对该提交是旧的。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:46:25-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/c190a6ab5d2c50e4c90f027bbcca72f1f3050005...e8fda74e279a5884440d5efaac2265e513c814b6","Len":2}...
|
1789742873
|
Edit
Delete
|
|
31150
|
5
|
7
|
5
|
116
|
0
|
0
|
|
0
|
1|fix(contracts): 注册中心规则补失败关闭与摘要规范化——三个入口此前抛 TypeE 1|fix(contracts): 注册中心规则补失败关闭与摘要规范化——三个入口此前抛 TypeError,同一摘要的两种写法此前分叉成两个复核键...
|
1789742918
|
Edit
Delete
|
|
31151
|
5
|
11
|
5
|
116
|
0
|
0
|
|
0
|
1|fix(contracts): 注册中心规则补失败关闭与摘要规范化——三个入口此前抛 TypeE 1|fix(contracts): 注册中心规则补失败关闭与摘要规范化——三个入口此前抛 TypeError,同一摘要的两种写法此前分叉成两个复核键...
|
1789742925
|
Edit
Delete
|
|
31152
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"b62945890 {"Commits":[{"Sha1":"b62945890987b341b65684046c6e4d8ae612c529","Message":"Merge pull request 'fix(contracts): 注册中心规则补失败关闭与摘要规范化——三个入口此前抛 TypeError,同一摘要的两种写法此前分叉成两个复核键' (#1) from feat/registry-rule-hardening into main\n\nReviewed-on: https://gitea.g-hi.com/luoanwu/enterprise-platform/pulls/1\n","AuthorEmail":"law@g-hi.com","AuthorName":"luoanwu","CommitterEmail":"law@g-hi.com","CommitterName":"luoanwu","Timestamp":"2026-09-18T22:48:44+08:00"},{"Sha1":"92a6b8e647c2c4d764c1fcdb8448bfc48a4dc4ed","Message":"fix(contracts): 注册中心规则补失败关闭与摘要规范化——三个入口此前抛 TypeError,同一摘要的两种写法此前分叉成两个复核键\n\n蓝图 docs/domain/registry-snapshot-blueprint.md 从迁入起就写着「失败关闭」与\n「review key 仅用于人工复核幂等」两条不变量,实测三处不成立。本次按蓝图自己的口径补齐,\n改动只在 contracts/src/domain/application-contract-registry/:不新增写入点、不新增宿主、\n不动 Catalog 与 Schema,每条输出仍固定 activationAllowed=false / registryWriteAllowed=false /\nhumanApprovalRequired=true。\n\n1. 失败关闭:assessRegistrySnapshot / assessRegistryTransition /\n reviewCandidateSnapshotUpgrade 对畸形输入抛 TypeError(快照缺字段、now 不是 Date、\n decisions 整个缺失都会抛),四个入口里只有 LocalManifestAdmissionPlanner.plan 是\n 失败关闭的。现四个入口一致返回 REJECT + 原因码。这不是洁癖:check-fixtures 把抛出当\n 配置错误处理,实测一次 TypeError 会让整套 15 例逐例判定塌成一条 configuration 失败。\n\n2. 十六进制引用规范化:digest / commit 的正则带 /i 收大小写两种写法,比较与入键却\n 大小写敏感——同一摘要写成大写会得到另一个 reviewIdempotencyKey,同版本大小写翻转被判成\n SAME_VERSION_DIGEST_CHANGED,大写回滚 pin 被判成 ROLLBACK_PIN_MUST_MATCH_CURRENT。\n 现一律规范化为小写后再比较、再入键,ACCEPT 回吐规范化后的值。\n\n3. 版本文法收敛:一个模块三套(快照流与清单准入用 \\d+\\.\\d+\\.\\d+,升级复核用严格 SemVer),\n 新增 registry-primitives.ts 作单一来源,含预发布序;DEC-009—012 此前在两份文件各写一份,\n 一并收敛。snapshot-upgrade-review.ts 因此净减约 60 行重复实现。\n\n两处语义变化(蓝图新增一节已如实登记):\n- 收紧:1.02.0 这类前导零版本此前被放行,现在拒;assessRegistrySnapshot 另开始拒 latest\n 这类可变标签——此前它能过体检却必然过不了迁移规则。\n- 放宽:1.0.0-rc.1 这类预发布版本此前被快照流整条挡在外面,现在按 SemVer 序参与迁移。\n 平台自己发的就是 1.0.0-rc.N,升级复核那一侧本来就这么判。风险面有限:本模块所有出口\n 都不激活、不写 Registry,多进人工复核队列不等于多放行制品。\n\n证据(本分支隔离工作树,clean):注册中心单测 44/44(原 34 + 加固 10);\ncontracts check:local 302/302;check:fixtures 九个契约域套件 100 例 0 失败,\n其中本套件 15 例(正 4 / 反 11,原 8 例)。篡改必红实测两次:sameHexRef 退回大小写敏感\n→ 单测 1 红 + 夹具 P03 红;去掉快照入口守卫 → 整套塌成 0 例 1 配置失败。\n\n仍为仓内候选 sdk_e2,不代表正式 Registry、Snapshot 发布或跨仓 Required Check 已上线。\n清单登记的 C01.04 / C01.06 是「接线」型缺口且前置 Q01 运行宿主未裁,本次未动。\nreports/fixtures.latest.json 未回绑:它是 17 套件的聚合报告,只跑 9 个套件去覆盖会缩小结论面,\n应在整批(含并行会话的 public-file / IM / 跨域流程改动)落定后统一重跑回绑。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:40:10-07:00"}],"HeadCommit":{"Sha1":"b62945890987b341b65684046c6e4d8ae612c529","Message":"Merge pull request 'fix(contracts): 注册中心规则补失败关闭与摘要规范化——三个入口此前抛 TypeError,同一摘要的两种写法此前分叉成两个复核键' (#1) from feat/registry-rule-hardening into main\n\nReviewed-on: https://gitea.g-hi.com/luoanwu/enterprise-platform/pulls/1\n","AuthorEmail":"law@g-hi.com","AuthorName":"luoanwu","CommitterEmail":"law@g-hi.com","CommitterName":"luoanwu","Timestamp":"2026-09-18T22:48:44+08:00"},"CompareURL":"luoanwu/enterprise-platform/compare/e8fda74e279a5884440d5efaac2265e513c814b6...b62945890987b341b65684046c6e4d8ae612c529","Len":2}...
|
1789742926
|
Edit
Delete
|
|
31153
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"0ed7ee700 {"Commits":[{"Sha1":"0ed7ee700a678dd6bea6879c5c575bd03cdb612c","Message":"chore(reports): check:fixtures 回绑 @ 7f82399\n\n合并后重跑并重新绑定。上一份绑的是 532e807,其注册中心一栏计的是本地 9ac9914 那套夹具(19 例),\n该实现已在 7f82399 的合并中整体放弃,报告随之失真,故在合并提交上重跑。\n\n在 .worktrees/merge-registry-remote 的干净检出(HEAD=7f82399)跑全 17 套件:\n296 例,失败 0,不可用 0,configurationError 0;provenance worktreeDirty=false、runner=local。\n与上一份的差异只在注册中心一栏:19 例(本地实现)→ 15 例(远端实现),总数 300 → 296。\n\ncontracts/dist 由该检出自己 tsc 构建;runtime 九个模块经 turbo 全量缓存命中\n(runtime/ 自上次绑定以来无任何提交,构建输入哈希一致)。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T08:07:24-07:00"},{"Sha1":"7f82399ee801c5d5a740ef8a85366ea9f086650e","Message":"Merge remote-tracking branch 'origin/main' —— 注册中心取远端那套,本地 9ac9914 的实现整体放弃\n\n本域被两个并行会话各补强了一遍:Gitea 上经 PR #1 合入的 92a6b8e(抽出 registry-primitives.ts、\n重写 snapshot-upgrade-review.ts),与本地未推送的 9ac9914(守卫内联在 registry-snapshot.ts)。\n二者是对同一批规则的两套独立实现,合并时 5 个文件 11 处冲突,冲突内容是两套失败关闭实现之间的取舍。\n\n按 Owner 裁断取远端。解法不是逐块挑,而是把整个域按 origin/main 逐字取入——包括自动合并成功的\nfixture-evaluator.ts / index.ts / manifest-admission-planner.ts,避免留下两套写法拼起来的中间产物:\n\n git checkout origin/main -- contracts/src/domain/application-contract-registry \\\n contracts/test/application-contract-registry-domain.test.mjs \\\n contracts/test/fixtures/application-contract-registry.fixtures.json \\\n docs/domain/registry-snapshot-blueprint.md\n\n取入后逐文件与 origin/main 比对,九个文件全部无差异;目录内容与 origin/main 的 tree 一致\n(本地那套没有引入远端没有的文件,不存在残留)。\n\ncontracts/SOURCE.md 未被远端改动,故不在冲突里,但 9ac9914 在其中写的注册中心条目描述的是已被放弃的实现,\n留着即是假记录。该条目已替换为取舍记录:说明两套实现的来历、裁断结果与核验数字,并注明 PR #1 未在\nSOURCE.md 留条目、其缺陷清单以提交信息与蓝图增量节为准,不替它复述未经本会话核验的细节。\n\n核验(合并后,工作树 dirty,报告另行回绑):\n- node --test contracts/test/*.test.mjs 361/361\n- 定向 contracts/test/application-contract-registry-domain.test.mjs 44/44\n- check:fixtures 17 套件 296 例,失败 0,不可用 0,configurationError 0\n (contract-application-contract-registry 15 例;本地那套的 19 例随实现一并放弃,故总数由 300 降至 296)\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T08:07:00-07:00"},{"Sha1":"33d84b86199f79c639208042c77816b597eeceb1","Message":"chore(reports): check:fixtures 回绑 @ 532e807\n\n在 .worktrees/evidence-fixtures 开 detached 干净检出(HEAD=532e807)跑全 17 套件:\n17 套件 300 例,失败 0,不可用 0,configurationError 0;provenance worktreeDirty=false、runner=local。\n\n为什么另开检出:主检出有并行会话未提交的 governance/check-module-imports.mjs,worktreeDirty 恒为 true,\n报告只能绑本地、不能回绑。依赖用符号链接接过来——runtime/.gitignore 的 node_modules 与 dist 不带斜杠,\n符号链接同样被忽略;根 .gitignore 的 node_modules/ 带斜杠不匹配符号链接,故 contracts/node_modules\n建成真目录、内部逐项链接,跑门禁前 git status --porcelain --untracked-files=all 实测为空。\ncontracts/dist 由该检出自己 tsc 构建;runtime 九个模块经 turbo 全量缓存命中(runtime/ 自上次绑定以来\n无任何提交,构建输入哈希一致)。\n\n案例数由上次绑定(765300b,189 例)升至 300 例,增量来自本轮九个契约包域的入参硬化:\nconfiguration-feature-flags 10→17 是本次提交带来的,其余由并行会话的同批提交带来\n(public-file 13→29、data-analytics 8→27、cost-capacity 9→32、application-contract-registry 8→19、\nenterprise-experience 6→17、notification-webhook 8→17、collaboration-messaging 8→14、\ncross-domain-workflow 7→16)。本次一并回绑,不逐仓拆分。\n\n其余 stale 报告不在本次范围,且都不由本次提交引起:release-manifest / sbom / image-smoke 的作用域变更是\nreports/image-digest.json 与 stack/compose.yaml;runtime/reports/naming 与 fork-readiness 是工作台四个文件;\nreports/module-imports.latest.json 处于 EVIDENCE_WORKTREE_CHANGED,须等并行会话提交\ngovernance/check-module-imports.mjs 后由其重跑回绑。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T08:01:21-07:00"},{"Sha1":"532e8072ab29d24da41fae7717985c2bcc771cd9","Message":"fix(contracts): 配置与功能开关规则补入参体检——三处倒向「开 / 采纳」、四处崩溃面与免检的兜底快照\n\n迁入版在入参可信的前提下是对的,但本能力的真实入口全是 JSON——夹具 payload、\ncreateRuntimeConfigurationClient(rawSnapshot) 收的快照文本、远端下发的开关规则都从反序列化来,\nTS 类型只在编译期成立。补强前对 dist 逐条实测,问题分六类:\n\n- 版本闸门形同虚设:rule.version \u003c context.minimumVersion 两端都不校验类型,缺任一端时 `\u003c` 恒为 false,\n 「比不出来」被当成「没过期」。version: undefined / version: \"3\" / minimumVersion: undefined\n 三种输入都直接 { enabled: true, reason: \"PERCENTAGE\" }——版本下限是配置回滚时唯一的保护。\n- 租户白名单退化成子串匹配:allowTenantIds 传成字符串时 .includes() 走的是 String.prototype.includes,\n \"xtenant-1x\" 让租户 tenant-1 命中 ALLOWLIST 并开启——不在白名单里的租户被开了灰度。\n- 未批准的配置快照被采纳:snapshotUsable 对 approved / schemaValid / containsPlaintextSecret 按真值判,\n approved: \"false\" 与 schemaValid: 1 都返回 USE_CANDIDATE;开关位 enabled: 1 同样被判成开启。\n 现在四个前提只认字面值,开关位只认布尔字面量。\n- 崩溃面:evaluateFeatureFlag(undefined, ctx) / (rule, undefined) / key: null / allowTenantIds: null 与\n selectConfigurationSnapshot(undefined, …) 全部抛 TypeError。夹具评估器两条规则各自只要少写一个键就能触发,\n 而 check:fixtures 对抛出物的处理是把整个套件记成 configurationError(0 例、报错文本当理由),\n 等于夹具门禁自己先倒了,不是多红一条。\n- 兜底快照免检:create(candidate, lastKnownGood) 对第二个参数只有声明类型,\n { version: 9, approved: \"yes\", schemaValid: 1, digest: \"zz\", values: \"nope\" } 可直接以 last_known_good 上岗——\n 它恰恰是候选不可用时的兜底,越是兜底越不能免检。现在 LKG 与候选走同一道 normalizeSnapshot,\n 参数类型也从 RuntimeConfigurationSnapshot 放宽成 unknown:这是入口,写成强类型挡不住任何东西。\n- 配置值穿透原型链:values 经 Object.fromEntries 建在 Object.prototype 上,get(\"constructor\") 返回一个函数,\n 消费侧一句 get(key) ?? fallback 就会拿函数当配置值。现在用 Object.create(null) 承载再冻结。\n 顺带收紧:version 必须是整数(原 typeof \"number\" 放过 NaN / 1.5),配置值里的数字必须有限。\n\n夹具评估器一并订正:Number(p[\"minimumVersion\"]) 会把夹具里写的 \"5\" 悄悄转成 5,\n夹具证明的是转换后的输入而不是自己写的那份。评估器应当是传声筒,现在原值直传。\n\n判定面与原因码面都没有扩张——FeatureFlagDecision 仍是那五个 reason、SnapshotSelection 仍是那三个 kind,\n没有新增任何原因码,整份改动只改「拿到脏值时往哪边倒」;迁入的 10 例单测断言一条未改。\nrefresh() 的 KEPT 分支放宽到 !== USE_CANDIDATE 并补上版本下限属防御性改动,它不修任何已知缺陷、\n对现有任何输入都不改变输出,已在 SOURCE.md 据实登记。\n\n覆盖:定向单测 10 → 20 例,夹具 10 → 17 例(正 4 / 反 13),新增目录内部件 value-guards.ts(不经 index.ts 导出)。\n负向实测三次:① 把 HEAD 版四个文件单独编到临时目录再喂新夹具,7 例全部不通过——\nN07 / N08 / N09 / N11 / N13 五例直接放行(reasons: [] = ACCEPT),N10 / N12 两例抛 TypeError;\n② 篡改 N11 的声明原因 → check-fixtures exit 1 并点名该例,把 id/expect 翻成 ACCEPT 仍 exit 1,还原后 exit 0;\n③ 源码侧还原 enabled 的布尔判定与 allowTenantIds 的数组判定 → 单测 20 例中 3 例转红,还原后 20/20。\n工作树 dirty(同期有并行会话在改其他契约包域),报告未回绑,本次用临时报告名跑完即删。\n\n未做:Catalog 登记一律未动(仍 module_e2、code_truth 指工单仓 packages/configuration-client),改登记需 CHG;\ndigest 只校验形状不校验内容、明文密钥只按顶层键名正则判、缺失模块完善清单 C13 的分桶 / 发布状态机 / kill switch\n均属判定面扩张或运行宿主(Q01),只登记未做。本轮仍是契约包形态,不代表配置中心上线。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:57:18-07:00"},{"Sha1":"9ac9914ce25315472d3634c9d6d4d64e72dbe98f","Message":"fix(contracts): 注册中心规则补入参体检——393 行升级复核此前零门禁覆盖,四条就绪闸门被真值字符串顶开\n\n九个契约包里最后一个未补强的。三类问题,均先对 dist 实测再改。\n\n一、崩溃面。assessRegistrySnapshot(undefined) 与 assessRegistrySnapshot({}) 抛\nTypeError(后者停在 snapshot.appId.trim());assessRegistryTransition 任一侧非对象即抛;\nreviewCandidateSnapshotUpgrade 在 request / context 非对象、currentPin 或 impactEvidence\n缺失、context.now 非 Date 时抛;夹具评估器的 snapshot / transition 两条跟着抛。补\nSNAPSHOT_SHAPE_INVALID / UPGRADE_REQUEST_INVALID / UPGRADE_REVIEW_CONTEXT_INVALID\n三个稳定原因码。LocalManifestAdmissionPlanner.plan() 改前就已失败关闭,本轮一行未动。\n\n二、四条就绪闸门被真值字符串顶开。independentGitSourceReady / codeownersReady /\nrequiredCheckEvidenceReady / rollbackEvidenceReady 写作 !context.x,传 \"false\" 一律\n判为就绪并直达 READY_FOR_CONSUMER_UPGRADE_REVIEW。同一文件的 sourceWorktreeDirty !== false\n与 compatible / manualReviewRequired 本来就是严格写法,本次把这四条统一成它。\n\n三、两处身份判定过宽。\n\n blockedBy 传成字符串时 .length 是字符数——\"\" 等于「无阻塞」,带阻塞的快照会被放行。\n 现要求字符串数组,否则 BLOCKERS_SHAPE_INVALID。\n\n 摘要与提交 SHA 的正则带 i,大小写两收。摘要是制品的身份:两种写法都认等于同一制品\n 有两个身份,而后续每一处 !== 比较(SAME_VERSION_DIGEST_CHANGED、pin 与 target 的摘要\n 对齐、fromDigest / toDigest 对齐)都会把它们当成两件不同的东西。现只收小写;仓内\n Catalog 与夹具无任何大写摘要在用,实测无影响面。\n\n门禁覆盖:snapshot-upgrade-review.ts 整份 393 行此前在门禁上零覆盖(评估器只有\nsnapshot / transition / plan 三条规则),而它持有上述四条闸门与全部证据新鲜度判定。\n补 upgrade 规则,BLOCKED 不算放行。\n\n核验:定向 34 → 40 例;迁入的 34 例在硬化后的 dist 上 0 失败,即合法输入的判定结果\n逐字未变;夹具 8 → 19 例(正 3 / 反 16)0 失败;负向实做:把\nN13-truthy-string-must-not-mark-the-git-source-ready 的声明原因改成不会产生的串,\n门禁 exit 1 并点名该例,还原后 exit 0。仍不发布、不改消费者 pin、不写 Registry;\nCatalog 登记未动(改登记须 CHG)。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T07:52:43-07:00"}],"HeadCommit":{"Sha1":"0ed7ee700a678dd6bea6879c5c575bd03cdb612c","Message":"chore(reports): check:fixtures 回绑 @ 7f82399\n\n合并后重跑并重新绑定。上一份绑的是 532e807,其注册中心一栏计的是本地 9ac9914 那套夹具(19 例),\n该实现已在 7f82399 的合并中整体放弃,报告随之失真,故在合并提交上重跑。\n\n在 .worktrees/merge-registry-remote 的干净检出(HEAD=7f82399)跑全 17 套件:\n296 例,失败 0,不可用 0,configurationError 0;provenance worktreeDirty=false、runner=local。\n与上一份的差异只在注册中心一栏:19 例(本地实现)→ 15 例(远端实现),总数 300 → 296。\n\ncontracts/dist 由该检出自己 tsc 构建;runtime 九个模块经 turbo 全量缓存命中\n(runtime/ 自上次绑定以来无任何提交,构建输入哈希一致)。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T08:07:24-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/b62945890987b341b65684046c6e4d8ae612c529...0ed7ee700a678dd6bea6879c5c575bd03cdb612c","Len":9}...
|
1789744064
|
Edit
Delete
|
|
31154
|
5
|
5
|
5
|
116
|
0
|
0
|
refs/heads/main
|
0
|
{"Commits":[{"Sha1":"34403ffdf {"Commits":[{"Sha1":"34403ffdfeda4af776b5f4063a40b9b04340895a","Message":"docs(部署): 记录补 §12——三个 dev 运行面重启复验与读写面 curl 取证\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T08:07:48-07:00"}],"HeadCommit":{"Sha1":"34403ffdfeda4af776b5f4063a40b9b04340895a","Message":"docs(部署): 记录补 §12——三个 dev 运行面重启复验与读写面 curl 取证\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T08:07:48-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/0ed7ee700a678dd6bea6879c5c575bd03cdb612c...34403ffdfeda4af776b5f4063a40b9b04340895a","Len":1}...
|
1789744129
|
Edit
Delete
|