| content |
{"Commits":[{"Sha1":"a4f30da58 {"Commits":[{"Sha1":"a4f30da58c8016b72afc8fe44d54723abd5266c0","Message":"chore(evidence): rebind seven native levels to docs-only commit 6ab5636 (KC-SR-V4-F10)\n\nThe doc change in 6ab5636 is a provenance input and evidence is inherited\nonly across report-only commits, so pnpm check went red with 7 stale\nreports. Reran on clean 6ab5636: runtime 276/0, parity 28/0, UI 5/5,\nDR 11 tables, containers, deployment 13 steps, production acceptance 14\nsteps all exit 0; pnpm check exit 0 (0 stale / 0 failed); lint+typecheck\n--force exit 0. Image levels used a zero-byte npm config (no credentials)\nand the local BuildKit cache. No source changed versus 39dd298.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-10-28T09:59:08-07:00"},{"Sha1":"6ab563608644cb458237bdeffa8a8e8e9fd9911c","Message":"docs(realtime): fix JWKS cache TTL statement and register forged-kid JWKS amplification (KC-SR-V4-F10)\n\nDocs only. The batch section no longer claims AUTH_JWKS_CACHE_TTL_MS only\naffects HTTP and the handshake: since KC-SR-V3-F9 the periodic revalidation\nshares the same cache rule during an IdP outage. The \"未覆盖与后续\" section\nnow actually registers the pre-existing issue (claimed but missing in the\nprevious round): an unknown kid forces one JWKS fetch per handshake / HTTP\nrequest with no single-flight or rate limit, amplifying IdP load; suggested\nfollow-up is a separate @repo/auth slice (single-flight + minimum interval).\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-10-28T09:51:23-07:00"},{"Sha1":"9d75e2a6b50943c283f80b15c43f8a80fdad57ca","Message":"chore(evidence): session revalidation round 4 — seven native levels on clean 39dd298\n\nReport-only successor of 39dd298 (verifier finding KC-SR-V3-F9).\nRuntime 276/0 (floor 207), parity 28/0, UI 5/5, DR 11 tables, containers,\ndeployment 13 steps, production acceptance 14 steps all exit 0; pnpm check\nexit 0 with 0 stale / 0 failed; lint+typecheck --force exit 0. Image levels\nused a zero-byte npm config (no credentials) and the local BuildKit cache.\nReceipt: reports/session-revalidation.latest.json (round 4; rounds 1-3 kept).\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-10-28T09:19:28-07:00"},{"Sha1":"39dd2985bf54b7a2ccc7019dc2f3516f5aef5d07","Message":"fix(realtime): one outage rule for revalidation and handshake; no backoff reset on brief opens (KC-SR-V3-F9)\n\nDuring a persistent JWKS outage the batch revalidation closed every\nconnection 1013 while the handshake still accepted cached-kid tokens for up\nto AUTH_JWKS_CACHE_TTL_MS, so clients churned connect -\u003e 1013 -\u003e reconnect.\nNow @repo/auth refreshSigningKeys({ tolerateCachedOnFailure }) keeps a\ncached key set that is still within its TTL (returns \"cached\"), and\nfetchKeys:false treats an expired cache as unavailable. Revalidation uses\nit: while the cache is valid connections stay open (same rule as HTTP and\nthe handshake); after expiry WS closes 1013 / SSE ends without a named\nevent and new handshakes are also 1013. The web client's backoff no longer\nresets on open: only a stable open of \u003e= 30 s followed by a non-outage close\nresets it (contracts realtimeReconnectAttempt / realtimeReconnectDelayMs).\nDoc records the outage behaviour and registers the pre-existing unthrottled\nJWKS fetch on forged kids (not fixed here).\n\nRed first on 19989d2: contracts 3, auth 1, integration 1 failed.\nOwn round-1 demo assertion updated: refreshSigningKeys now reports \"fresh\".\nDirty-tree feedback: runtime 276/0, docs-truth/auth gates and\nlint/typecheck --force green; native levels follow on this commit.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-10-28T09:11:44-07:00"},{"Sha1":"19989d2ec5c008128c1ed29e9cbf36cf11e538fd","Message":"chore(evidence): session revalidation round 3 — seven native levels on clean 1a0a8bb\n\nReport-only successor of 1a0a8bb (verifier findings KC-SR-V2-F7/F8).\nRuntime 272/0 (floor 207), parity 28/0, UI 5/5, DR 11 tables, containers,\ndeployment 13 steps, production acceptance 14 steps all exit 0; pnpm check\nexit 0 with 0 stale / 0 failed; lint+typecheck --force exit 0. Image levels\nused a zero-byte npm config (no credentials) and the local BuildKit cache.\nReceipt: reports/session-revalidation.latest.json (round 3; rounds 1-2 kept).\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-10-28T08:29:03-07:00"}],"HeadCommit":{"Sha1":"a4f30da58c8016b72afc8fe44d54723abd5266c0","Message":"chore(evidence): rebind seven native levels to docs-only commit 6ab5636 (KC-SR-V4-F10)\n\nThe doc change in 6ab5636 is a provenance input and evidence is inherited\nonly across report-only commits, so pnpm check went red with 7 stale\nreports. Reran on clean 6ab5636: runtime 276/0, parity 28/0, UI 5/5,\nDR 11 tables, containers, deployment 13 steps, production acceptance 14\nsteps all exit 0; pnpm check exit 0 (0 stale / 0 failed); lint+typecheck\n--force exit 0. Image levels used a zero-byte npm config (no credentials)\nand the local BuildKit cache. No source changed versus 39dd298.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n","AuthorEmail":"hillao@juhailaoluodeMacBook-Pro.local","AuthorName":"juhailaoluo pro","CommitterEmail":"hillao@juhailaoluodeMacBook-Pro.local","CommitterName":"juhailaoluo pro","Timestamp":"2026-10-28T09:59:08-07:00"},"CompareURL":"luoanwu/juhai-knowledge-cloud/compare/883a3e660c313ea02daba8067ed6bb9208d31a25...a4f30da58c8016b72afc8fe44d54723abd5266c0","Len":21}... |