| content |
{"Commits":[{"Sha1":"623a58d18 {"Commits":[{"Sha1":"623a58d184232de4493761b6612202abae6561c0","Message":"chore(reports): evidence-freshness 回绑 @ 3be0bb7 —— 41 份新鲜 / 4 份过期 / 0 error\n\n余 4 条告警都要真实底座或镜像：sbom、runtime-acceptance、ui-acceptance、deployed-runtime。\nmainline-acceptance 随 A15 的六套件重跑已转新鲜。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-19T00:06:02-07:00"},{"Sha1":"3be0bb7a8ae0ccbecf762475be4425a7eced5038","Message":"chore(reports): 工作台两份快照 / doc-claims / caddy / otel 回绑 @ 5ef56d0\n\n两件事各一半：\n- 并行会话的 `bd2a5c3` 改了 `docs/runbook.md`，它在 workbench-ops-snapshot 的作用域里，\n `check:evidence` 因此判其过期（本轮唯一一条 error）。\n- 本会话把 `docs/runbook.md` / `README.md` / `reports/otel.latest.json` 加进了 doc-claims\n 的作用域，该报告随之要重绑。\n\ncaddy / otel 一并带上（同一次干净检出里顺手跑，判词不变）。四份全部 dirty=false。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-19T00:05:43-07:00"},{"Sha1":"5ef56d011b28e1000e575b67d354594f53249039","Message":"chore(reports): mainline-acceptance 与 revocation-sla 回绑 @ 51f100b —— 首份六套件 72 例\n\nA15 接线后首次在干净树上跑完整主线（专用 Broker `enterprise-platform-ms23-redpanda-1`\n:59093 + 6 个隔离库，全部非超级用户角色）：\n\n| 套件 | 例数 |\n|---|---|\n| fact-read-http | 11 |\n| fact-persistence | 17 |\n| audit-tamper | 19 |\n| mainline-revocation-chaos | 18 |\n| **permission-ops**（新） | **2** |\n| **ai-route-persistence**（新） | **5** |\n\n合计 72 例、0 失败、0 skipped/todo，`validateMainlineReport` 通过。revocation-sla 仍\n`partial`：cacheBound 与 invalidationPush 各 20 个真实样本，后者的传输仍是 test-harness\nledger poll，生产传输未接线——定性不变。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-19T00:05:16-07:00"},{"Sha1":"51f100b42bb2cb89db3609bf69f88835c26aa236","Message":"feat(governance): 两支无门禁消费的 integration 套件接进主线（A15），并补齐 A14 的作用域\n\n**缺口**：四个模块有 `vitest.integration.config.ts`，但 `check-mainline.mjs` 只消费 fact 与\naudit 两支；`permission` 的 `ops.integration.ts`（OPS-1 受控命令 permission.invalidation 的\n真实库验收）与 `ai-gateway` 的 `persistence.integration.ts`（ai-route 权威账本）**没有任何\n门禁消费**，只能靠人手工 `pnpm test:integration`——写了验收却没有任何东西会在它坏掉时叫。\n\n- `check-mainline.mjs` 增两支套件：`permission-ops`、`ai-route-persistence`。它们要的正是\n 本文件已经在准备的那套隔离库，接进来不需要新底座。\n- `lib/mainline-evidence.mjs` 登记地板（按首次隔离库实测，非超级用户角色）：2 例 / 5 例。\n 该表同时供 runner 与 `verify:candidate` 使用，`validateMainlineReport` 要求套件数与本表\n 一致——所以「接线」和「候选可晋级核验」是同一件事，不会只改一半。\n- `prepare-mainline.mjs` 增 `aigateway` 一档：`platform_aigateway_ms23` 此前不存在（只有 dev\n 库），ai-gateway 的 integration 套件因此在任何隔离环境里都跑不起来。顺带修一处会绊下一个\n 人的坑——**库名的 kind 与模块目录名不总是同一个词**（`aigateway` ↔ `ai-gateway`），改为显式\n `moduleDir` 映射，不靠字符串等同。\n- `evidence-scopes.json` 补 A14 漏的一半：`doc-claims` 的 scope 加 `README.md`、\n `docs/runbook.md`、`reports/otel.latest.json`。扩了扫描面却没扩作用域，等于那三处一变\n 本报告也不会被判过期。\n\n**实测**（`enterprise-platform-ms23` 专用 Broker :59093 + 6 个隔离库，非超级用户）：\n六套件全过 11 / 17 / 19 / 18 / **2** / **5** = 72 例，`mainline:check` 退出 0，\n`validateMainlineReport` 通过。报告回绑另起提交（本次运行时工作树是脏的）。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-19T00:02:22-07:00"},{"Sha1":"bd2a5c39496b0dda12afc98c321119609780f519","Message":"docs(运维): runbook 补工作台「缺配置」的形态判别与入口形态登录的三道坎\n\n入口托管产物按约定摘掉 .env.local 构建，两个 NEXT_PUBLIC_WORKBENCH_* 一起\n没进产物，登录页显示「缺配置」是这份产物的预期结果、不是漏配；写清判形态\n的办法，并点明不该靠「带着 .env.local 重建」去修（那是拿同源形态换登录页）。\n\n入口形态的登录补配置也修不通：构建带变量、补登记入口 origin 回调都可做，\n但换令牌必失败——常驻容器 NODE_ENV=production 而 loadLocalSigningKey 只认\ntest / development，且容器 IDP_CANONICAL_ORIGIN=http://localhost:3098 使入口\n上取到的 discovery issuer 与端点全指 :3098。结论落在等目标环境的真签名源，\n并明写把容器降成 development 是安全面倒退。\n\n同段末句「在那之前不要把工作台挂到网关根路径」已被 426a7df 落地的同源托管与\nforward_auth 超越，改为陈述现状，免得与新段自相矛盾。\n\ncheck:doc-claims ✓（报告经 GOV_REPORT_DIR 导出仓外，仓内 reports/ 未改）；\n工作区根 check-workspace-consistency.mjs CLEAN。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-18T23:53:37-07:00"}],"HeadCommit":{"Sha1":"623a58d184232de4493761b6612202abae6561c0","Message":"chore(reports): evidence-freshness 回绑 @ 3be0bb7 —— 41 份新鲜 / 4 份过期 / 0 error\n\n余 4 条告警都要真实底座或镜像：sbom、runtime-acceptance、ui-acceptance、deployed-runtime。\nmainline-acceptance 随 A15 的六套件重跑已转新鲜。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-09-19T00:06:02-07:00"},"CompareURL":"luoanwu/enterprise-platform/compare/928345d27ed7ade91e7257238a55e64e9f9c6fad...623a58d184232de4493761b6612202abae6561c0","Len":13}... |