| content |
{"Commits":[{"Sha1":"d433548ec {"Commits":[{"Sha1":"d433548ec7561644062b04334161019919ea233d","Message":"fix(governance)+fix(ci)+feat(gates): 治理体检轮 C227–C236 收口——CI 修红、门禁增强与全量三级门禁本地绿\n\nC227 产品验收 runner 缺 dist(run 33164556968 判责):两后端 build 前移 + A12 前置违规(负向实红)+ standalone 自含构建/:run 拆分\nC229 libssl CVE-2026-14456:RUNTIME_IMAGE 升级至含 3.5.7-1~deb13u2 的 distroless digest(升级前实查基座 dpkg)\nC230 网关限流塌缩:real_ip 信任链(默认回环)+ limit_req/conn_status 429 + O4 六断言\nC231 docs-truth 批间时序:--assert-only 复验接入 runtime 编排与 UI 聚合收尾\nC232 快照机器锚点:祖先关系 + 实测落后数离线核对(±1 自指窗,负向实红)\nC233 check:ci-gate:G14 现状机器化(当前诚实红 protected:false)+ CODEOWNERS\nC234 验收源卫生:mobile-ios 豁免绑 darwin、agedAcceptanceReports 14 天时效、untrack deploy-probe/QA v2–v10/pyc\nC236 juhai.hr 浏览器用例冻结日期时间炸弹:16 处日期改 UTC 动态锚定(两连红→trace 判责 409 RANGE_INVALID→修复后 31/31×2)\nC235 重号修正(原第二个 C216);O3/O32 断言按 C180 合并语义收敛(401=logoutSession+可见原因)\nG24 登记:无界列表清单/应用层租户配额/CLAUDE.md 瘦身/凭据轮换待办;D-3 留存草案与 target-env 13 条签收清单落盘\n\n本地证据(dirty 工作区,绑定各报告 provenance):pnpm check 24/24;check:runtime 683 tests/矩阵 204/204;check:ui 31/31×2 共 62;check:mobile 26 文件+iOS 自测 5/5\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-08-29T20:14:39-07:00"},{"Sha1":"0daede71c4a95f23270c088939ea1492f33d3040","Message":"merge: 汇合 GitHub main 治理大波次(32f574b, C177–C219)与本地 OIDC 修复/凭据止血线\n\n两远端自 4a222fb 分叉:GitHub 侧携带 juhai.hr HR 产品与 C177–C219 治理波次\n(供应链镜像重建/Alloy 移除/会话跨tab登出/WS-SSE exp 强断/三态查询全面收口),\n本地侧携带 cf9f65d/fcbd389 生产 OIDC 修复与 1b4bbef 凭据止血。\n冲突裁决:reports 取 GitHub 侧(阶段2全量重生成);api.ts 401 合并为\nlogoutSession()+友好错误;compose 取 GitHub 侧(Alloy 已由 C179 移除);\n.gitignore 再补 .env.production.* 派生副本与 tmp/ops-config/ 整目录。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-08-29T18:59:22-07:00"},{"Sha1":"1b4bbef5e9b640e9b2a99df54a246ecf7fc7c6cd","Message":"fix(security): untrack 已入库运维凭据并将 O9 升级为全索引 secret 反扫\n\nC177 阶段0止血:tmp/ops-config/.env.production 与 metrics-token.txt 自 4f2e17b 起\n被 git 跟踪并已推送——C159 只补了 gitignore 模式(对已跟踪文件无效),O9 只断言\n字面路径 deploy/production/.env.production,形成假生效门禁。本提交:\n- git rm --cached 两份凭据文件与两个 __pycache__ 字节码\n- .gitignore 补 metrics-token*.txt / __pycache__/ / *.pyc\n- O9 改为双层反扫:gitignore 命中仍在索引即红 + secret 形状兜底(*.example 豁免)\n 负向测试两腿均已实红(metrics-token 双命中、probe-token 形状腿单命中)后恢复绿\n- CLAUDE.md 增补「提交上传=双推 Gitea+GitHub」会话术语约定(用户拍板)\n凭据轮换候选已生成于 tmp/ops-config/*.rotated-20260829*(不入库),由用户执行替换。\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-08-29T18:51:33-07:00"},{"Sha1":"32f574b8462910b04586d4d9fdc2f7ce277d9c1a","Message":"feat(platform): integrate governed HR product and runtime hardening\n","AuthorEmail":"luoguoguo@gmail.com","AuthorName":"luoguoguo","CommitterEmail":"luoguoguo@gmail.com","CommitterName":"luoguoguo","Timestamp":"2026-08-28T03:45:04-07:00"}],"HeadCommit":{"Sha1":"d433548ec7561644062b04334161019919ea233d","Message":"fix(governance)+fix(ci)+feat(gates): 治理体检轮 C227–C236 收口——CI 修红、门禁增强与全量三级门禁本地绿\n\nC227 产品验收 runner 缺 dist(run 33164556968 判责):两后端 build 前移 + A12 前置违规(负向实红)+ standalone 自含构建/:run 拆分\nC229 libssl CVE-2026-14456:RUNTIME_IMAGE 升级至含 3.5.7-1~deb13u2 的 distroless digest(升级前实查基座 dpkg)\nC230 网关限流塌缩:real_ip 信任链(默认回环)+ limit_req/conn_status 429 + O4 六断言\nC231 docs-truth 批间时序:--assert-only 复验接入 runtime 编排与 UI 聚合收尾\nC232 快照机器锚点:祖先关系 + 实测落后数离线核对(±1 自指窗,负向实红)\nC233 check:ci-gate:G14 现状机器化(当前诚实红 protected:false)+ CODEOWNERS\nC234 验收源卫生:mobile-ios 豁免绑 darwin、agedAcceptanceReports 14 天时效、untrack deploy-probe/QA v2–v10/pyc\nC236 juhai.hr 浏览器用例冻结日期时间炸弹:16 处日期改 UTC 动态锚定(两连红→trace 判责 409 RANGE_INVALID→修复后 31/31×2)\nC235 重号修正(原第二个 C216);O3/O32 断言按 C180 合并语义收敛(401=logoutSession+可见原因)\nG24 登记:无界列表清单/应用层租户配额/CLAUDE.md 瘦身/凭据轮换待办;D-3 留存草案与 target-env 13 条签收清单落盘\n\n本地证据(dirty 工作区,绑定各报告 provenance):pnpm check 24/24;check:runtime 683 tests/矩阵 204/204;check:ui 31/31×2 共 62;check:mobile 26 文件+iOS 自测 5/5\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-08-29T20:14:39-07:00"},"CompareURL":"luoanwu/digital-employee-os/compare/fcbd389107386fa0a13d0abd3c8d7c272cc2a7f7...d433548ec7561644062b04334161019919ea233d","Len":4}... |