|
24130
|
chore(reports): B2 的四十一份三级证据 回绑 @ d1eb586，刷新快照锚点
|
76
|
5
|
governance.yml
|
74
|
5
|
0
|
refs/heads/main
|
91b5257007ab9d588dcada5c5ca8d0c41a024bb9
|
0
|
0
|
0
|
push
|
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"3deb4ea37b83c2e2977c9c2b8e8166c101002860","after":"91b5257007ab9d588dcada5c5ca8d0c41a024bb9","compare_url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/compare/3deb4ea37b83c2e2977c9c2b8e8166c101002860...91b5257007ab9d588dcada5c5ca8d0c41a024bb9","commits":[{"id":"91b5257007ab9d588dcada5c5ca8d0c41a024bb9","message":"chore(reports): B2 的四十一份三级证据 回绑 @ d1eb586，刷新快照锚点\n\n本批次最后一个提交，按 C241 同时刷新快照锚点到 d1eb586（声明落后 0，本提交自身使实测\n落后 1，在 +1 自指窗内）。\n\n四十一份 reports/*.latest.json 全部 clean 绑定（gitSha=d1eb586、worktreeDirty:false）：\n静态 28 + 运行态 13。\n\n运行态实测与基线逐项持平，**tenantId 收敛在真实写链上行为中性**：\n testsPassed 733（基线 733）· behaviorParityCases 204（基线 204）· testFailures 0\n 87 项指标零违规\n静态整轮 28 步全执行、前 27 绿，末步 check:kernel-admission 仍是那 8 处已知诚实红。\n\n本批次跑了三轮 runtime，前两轮红，都不是 B2 的代码问题，如实记录：\n\n一、第一轮 outcomes.integration.test.ts「outcome not opened in time」（15 秒 E2E 超时）。\n 判为偶发，依据三条：该测试用 tenant-a-nestjs-outcome，在新 schema 下合法；整份日志里\n 新校验的拒绝消息 / ZodError / invalid_string **0 次命中**；同一份代码隔离重跑该文件\n 14/14 通过。第三轮整轮亦一次过。\n 顺带记一个行为：**失败的 runtime 会删掉 8 份运行态报告**（跑到一半中止、未重新生成）。\n\n二、第二轮测试全过（733 / 204-204 / 0 失败）但整轮记 failed，红在末尾的文档复核\n governance-kernel-boundary-number-consistency。根因是本会话的一次操作失误：\n `git restore reports/` 用了目录级范围，把已重新生成的 kernel-boundaries.latest.json\n 退回 HEAD 版（143/143），而 CLAUDE.md 已是 144/144。重跑静态后边界报告回到 144/144，\n 又撞上 governance-number-evidence-shape（要求一份 passed 的 runtime），于是必须再跑\n 第三轮才解环——这正是 CLAUDE.md 记载过的那个环。\n\n 同一次失误还抹掉了三份 reports/ui-*.latest.json 的未提交改动（不属本会话）。\n 已用 git fsck --lost-found 从游离 blob 全数找回并逐字核对：它们是 2026-09-15 的 UI 验收，\n 绑 c433d57 且 dirty=false。本提交仍未包含它们。\n 教训具体化：reports/ 下同时存在「本会话产出的」与「别人的」两类文件，任何范围操作都会\n 同时命中两类，**还原必须逐文件点名**。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/commit/91b5257007ab9d588dcada5c5ca8d0c41a024bb9","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:31:09-07:00","added":[],"removed":[],"modified":["CLAUDE.md","reports/agent-adapters.latest.json","reports/auth-startup.latest.json","reports/capacity-envelope.latest.json","reports/contract-consumers.latest.json","reports/db-credential-separation.latest.json","reports/dependency-resilience.latest.json","reports/docs-truth.latest.json","reports/dual-backend-behavior.latest.json","reports/dual-backend-parity.latest.json","reports/fixtures.latest.json","reports/fork-readiness.latest.json","reports/governance-docs.latest.json","reports/governance.latest.json","reports/kernel-admission.latest.json","reports/kernel-boundaries.latest.json","reports/kernel-downstream.latest.json","reports/kernel-extensions.latest.json","reports/kernel-packages.latest.json","reports/list-bounds.latest.json","reports/llm-eval.latest.json","reports/migrations.latest.json","reports/mobile-export.latest.json","reports/multi-instance.latest.json","reports/naming.latest.json","reports/operations.latest.json","reports/platform-dependency-provenance.latest.json","reports/product-acceptance-runtime.latest.json","reports/product-acceptance.latest.json","reports/product-extension-runtime.latest.json","reports/product-migrations-runtime.latest.json","reports/product-migrations.latest.json","reports/product-sql-runtime.latest.json","reports/report-transaction-lock.latest.json","reports/rls.latest.json","reports/runtime-acceptance.latest.json","reports/runtime-governance.latest.json","reports/schema-sync.latest.json","reports/statemachine-write-guard.latest.json","reports/tracing.latest.json","reports/validation-source.latest.json","reports/write-capacity.latest.json"]},{"id":"d1eb5860c4337cf457a03c76670d2551dc848cee","message":"feat(contracts): B2 迁入内核租户原语，收敛 tenantId 的三套口径为单源\n\n立项 B2 原写「净迁入六个」。开工时改了做法并写回立项：**净迁入的模块不该先暴露后接线**。\napi-error / replay-buffer / request-context / platform-ports / alert 只加到 barrel 而不接线，\n就是新增零消费者的 CORE 面——正是本仓 check:kernel-admission 的 K5 在盯、K4 判「声明无回执」\n的同型。改为**接线时才迁入**。六个里只有 tenant 是「迁入即能用」的，本批只做它。\n\n一、packages/contracts/src/tenant.ts 转发 @juhai/kernel 的 11 个租户解析原语。\n 这个名字是上一步 tenant.ts → authorization.ts 改名腾出来的；本仓此前**完全没有这一组**。\n\n二、用它收敛 tenantId 的三套口径（8 处 / 6 个文件）：\n z.string().min(1) × 6（无上限、无字符约束） → tenantIdSchema\n .max(128) × 2（有长度无形状） → tenantIdSchema\n ^ten_.+$（事实投影，自成一套） → **叠加**在内核形状之上，不再另起\n\n 判据直接委托 normalizeTenantId，不在仓内重写正则——重写就又是一套口径。\n 用 normalizeTenantId(v) === v 而非 !== undefined：后者放行带首尾空白的值\n （normalize 先 trim 再判），于是「校验通过的值」与「真正该存的值」不是同一个。\n\n收紧实测咬住 11/11。B2 之前 z.string().min(1) 会放行全部这些：\"\"、\" t1 \"、\"t/1\"、\n**\"t\\n1\"**、\"_t\"、129 字符。含换行符那条是框架注释点名的伪造日志行向量（NestJS 侧有字符串\n拼接日志）；129 字符那条对应 users 表 @@unique([tenantId, email]) 撞 Postgres btree 约\n2704 字节行上限打 500。也就是说本仓在此之前**没有任何 tenantId 形状与长度校验**。\n\n三处门禁如实红过再修，没有一处先改门禁：\n check:kernel-boundaries B3 新内核面未归类 → tenant.ts 归 CORE（contractModules 32）\n check:kernel-packages P7 公开面变更须伴随版本上调 → @repo/contracts 1.18.0 → 1.19.0\n check:kernel-admission K1 导出清单漂移 → 重签（40 模块 / 756 导出）\n连带同步接入手册下游锁行与 CLAUDE.md 边界数字 143/143 → 144/144。\n\n验证：contracts 312/312 · typecheck 13/13 · 整轮静态 28 步前 27 绿（末步仍是那 8 处已知红）。\n运行态另行重跑后回绑——本提交不含任何运行态报告。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/commit/d1eb5860c4337cf457a03c76670d2551dc848cee","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:04:17-07:00","added":["packages/contracts/src/tenant.ts"],"removed":[],"modified":["CLAUDE.md","docs/product-extension-guide.md","kernel.boundaries.json","kernel.downstream.lock.json","kernel.exports.lock.json","kernel.packages.json","kernel.packages.lock.json","packages/contracts/package.json","packages/contracts/src/employment-projection.ts","packages/contracts/src/identity.ts","packages/contracts/src/index.ts","packages/contracts/src/job.ts","packages/contracts/src/kernel.ts","packages/contracts/src/llm-governance.ts","packages/contracts/src/realtime.ts","packages/contracts/src/user.ts"]}],"total_commits":0,"head_commit":{"id":"91b5257007ab9d588dcada5c5ca8d0c41a024bb9","message":"chore(reports): B2 的四十一份三级证据 回绑 @ d1eb586，刷新快照锚点\n\n本批次最后一个提交，按 C241 同时刷新快照锚点到 d1eb586（声明落后 0，本提交自身使实测\n落后 1，在 +1 自指窗内）。\n\n四十一份 reports/*.latest.json 全部 clean 绑定（gitSha=d1eb586、worktreeDirty:false）：\n静态 28 + 运行态 13。\n\n运行态实测与基线逐项持平，**tenantId 收敛在真实写链上行为中性**：\n testsPassed 733（基线 733）· behaviorParityCases 204（基线 204）· testFailures 0\n 87 项指标零违规\n静态整轮 28 步全执行、前 27 绿，末步 check:kernel-admission 仍是那 8 处已知诚实红。\n\n本批次跑了三轮 runtime，前两轮红，都不是 B2 的代码问题，如实记录：\n\n一、第一轮 outcomes.integration.test.ts「outcome not opened in time」（15 秒 E2E 超时）。\n 判为偶发，依据三条：该测试用 tenant-a-nestjs-outcome，在新 schema 下合法；整份日志里\n 新校验的拒绝消息 / ZodError / invalid_string **0 次命中**；同一份代码隔离重跑该文件\n 14/14 通过。第三轮整轮亦一次过。\n 顺带记一个行为：**失败的 runtime 会删掉 8 份运行态报告**（跑到一半中止、未重新生成）。\n\n二、第二轮测试全过（733 / 204-204 / 0 失败）但整轮记 failed，红在末尾的文档复核\n governance-kernel-boundary-number-consistency。根因是本会话的一次操作失误：\n `git restore reports/` 用了目录级范围，把已重新生成的 kernel-boundaries.latest.json\n 退回 HEAD 版（143/143），而 CLAUDE.md 已是 144/144。重跑静态后边界报告回到 144/144，\n 又撞上 governance-number-evidence-shape（要求一份 passed 的 runtime），于是必须再跑\n 第三轮才解环——这正是 CLAUDE.md 记载过的那个环。\n\n 同一次失误还抹掉了三份 reports/ui-*.latest.json 的未提交改动（不属本会话）。\n 已用 git fsck --lost-found 从游离 blob 全数找回并逐字核对：它们是 2026-09-15 的 UI 验收，\n 绑 c433d57 且 dirty=false。本提交仍未包含它们。\n 教训具体化：reports/ 下同时存在「本会话产出的」与「别人的」两类文件，任何范围操作都会\n 同时命中两类，**还原必须逐文件点名**。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/commit/91b5257007ab9d588dcada5c5ca8d0c41a024bb9","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:31:09-07:00","added":[],"removed":[],"modified":["CLAUDE.md","reports/agent-adapters.latest.json","reports/auth-startup.latest.json","reports/capacity-envelope.latest.json","reports/contract-consumers.latest.json","reports/db-credential-separation.latest.json","reports/dependency-resilience.latest.json","reports/docs-truth.latest.json","reports/dual-backend-behavior.latest.json","reports/dual-backend-parity.latest.json","reports/fixtures.latest.json","reports/fork-readiness.latest.json","reports/governance-docs.latest.json","reports/governance.latest.json","reports/kernel-admission.latest.json","reports/kernel-boundaries.latest.json","reports/kernel-downstream.latest.json","reports/kernel-extensions.latest.json","reports/kernel-packages.latest.json","reports/list-bounds.latest.json","reports/llm-eval.latest.json","reports/migrations.latest.json","reports/mobile-export.latest.json","reports/multi-instance.latest.json","reports/naming.latest.json","reports/operations.latest.json","reports/platform-dependency-provenance.latest.json","reports/product-acceptance-runtime.latest.json","reports/product-acceptance.latest.json","reports/product-extension-runtime.latest.json","reports/product-migrations-runtime.latest.json","reports/product-migrations.latest.json","reports/product-sql-runtime.latest.json","reports/report-transaction-lock.latest.json","reports/rls.latest.json","reports/runtime-acceptance.latest.json","reports/runtime-governance.latest.json","reports/schema-sync.latest.json","reports/statemachine-write-guard.latest.json","reports/tracing.latest.json","reports/validation-source.latest.json","reports/write-capacity.latest.json"]},"repository":{"id":76,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"digital-employee-os","full_name":"luoanwu/digital-employee-os","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":87356,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/digital-employee-os/languages","html_url":"https://gitea.g-hi.com/luoanwu/digital-employee-os","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/digital-employee-os","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/digital-employee-os.git","clone_url":"https://gitea.g-hi.com/luoanwu/digital-employee-os.git","original_url":"","website":"","stars_count":0,"forks_count":1,"watchers_count":1,"branch_count":3,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-08-20T14:46:28+08:00","updated_at":"2026-09-18T17:38:56+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"}}...
|
push
|
2
|
36
|
1789741873
|
1789741882
|
0
|
1789741873
|
1789741896
|
group: governance-${{ github.workflow }}-${{ githu group: governance-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: "true"
...
|
governance-governance.yml-refs/heads/main
|
1
|
Edit
Delete
|
|
24131
|
chore(reports): B2 的四十一份三级证据 回绑 @ d1eb586，刷新快照锚点
|
76
|
5
|
platform-governance.yml
|
75
|
5
|
0
|
refs/heads/main
|
91b5257007ab9d588dcada5c5ca8d0c41a024bb9
|
0
|
0
|
0
|
push
|
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"3deb4ea37b83c2e2977c9c2b8e8166c101002860","after":"91b5257007ab9d588dcada5c5ca8d0c41a024bb9","compare_url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/compare/3deb4ea37b83c2e2977c9c2b8e8166c101002860...91b5257007ab9d588dcada5c5ca8d0c41a024bb9","commits":[{"id":"91b5257007ab9d588dcada5c5ca8d0c41a024bb9","message":"chore(reports): B2 的四十一份三级证据 回绑 @ d1eb586，刷新快照锚点\n\n本批次最后一个提交，按 C241 同时刷新快照锚点到 d1eb586（声明落后 0，本提交自身使实测\n落后 1，在 +1 自指窗内）。\n\n四十一份 reports/*.latest.json 全部 clean 绑定（gitSha=d1eb586、worktreeDirty:false）：\n静态 28 + 运行态 13。\n\n运行态实测与基线逐项持平，**tenantId 收敛在真实写链上行为中性**：\n testsPassed 733（基线 733）· behaviorParityCases 204（基线 204）· testFailures 0\n 87 项指标零违规\n静态整轮 28 步全执行、前 27 绿，末步 check:kernel-admission 仍是那 8 处已知诚实红。\n\n本批次跑了三轮 runtime，前两轮红，都不是 B2 的代码问题，如实记录：\n\n一、第一轮 outcomes.integration.test.ts「outcome not opened in time」（15 秒 E2E 超时）。\n 判为偶发，依据三条：该测试用 tenant-a-nestjs-outcome，在新 schema 下合法；整份日志里\n 新校验的拒绝消息 / ZodError / invalid_string **0 次命中**；同一份代码隔离重跑该文件\n 14/14 通过。第三轮整轮亦一次过。\n 顺带记一个行为：**失败的 runtime 会删掉 8 份运行态报告**（跑到一半中止、未重新生成）。\n\n二、第二轮测试全过（733 / 204-204 / 0 失败）但整轮记 failed，红在末尾的文档复核\n governance-kernel-boundary-number-consistency。根因是本会话的一次操作失误：\n `git restore reports/` 用了目录级范围，把已重新生成的 kernel-boundaries.latest.json\n 退回 HEAD 版（143/143），而 CLAUDE.md 已是 144/144。重跑静态后边界报告回到 144/144，\n 又撞上 governance-number-evidence-shape（要求一份 passed 的 runtime），于是必须再跑\n 第三轮才解环——这正是 CLAUDE.md 记载过的那个环。\n\n 同一次失误还抹掉了三份 reports/ui-*.latest.json 的未提交改动（不属本会话）。\n 已用 git fsck --lost-found 从游离 blob 全数找回并逐字核对：它们是 2026-09-15 的 UI 验收，\n 绑 c433d57 且 dirty=false。本提交仍未包含它们。\n 教训具体化：reports/ 下同时存在「本会话产出的」与「别人的」两类文件，任何范围操作都会\n 同时命中两类，**还原必须逐文件点名**。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/commit/91b5257007ab9d588dcada5c5ca8d0c41a024bb9","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:31:09-07:00","added":[],"removed":[],"modified":["CLAUDE.md","reports/agent-adapters.latest.json","reports/auth-startup.latest.json","reports/capacity-envelope.latest.json","reports/contract-consumers.latest.json","reports/db-credential-separation.latest.json","reports/dependency-resilience.latest.json","reports/docs-truth.latest.json","reports/dual-backend-behavior.latest.json","reports/dual-backend-parity.latest.json","reports/fixtures.latest.json","reports/fork-readiness.latest.json","reports/governance-docs.latest.json","reports/governance.latest.json","reports/kernel-admission.latest.json","reports/kernel-boundaries.latest.json","reports/kernel-downstream.latest.json","reports/kernel-extensions.latest.json","reports/kernel-packages.latest.json","reports/list-bounds.latest.json","reports/llm-eval.latest.json","reports/migrations.latest.json","reports/mobile-export.latest.json","reports/multi-instance.latest.json","reports/naming.latest.json","reports/operations.latest.json","reports/platform-dependency-provenance.latest.json","reports/product-acceptance-runtime.latest.json","reports/product-acceptance.latest.json","reports/product-extension-runtime.latest.json","reports/product-migrations-runtime.latest.json","reports/product-migrations.latest.json","reports/product-sql-runtime.latest.json","reports/report-transaction-lock.latest.json","reports/rls.latest.json","reports/runtime-acceptance.latest.json","reports/runtime-governance.latest.json","reports/schema-sync.latest.json","reports/statemachine-write-guard.latest.json","reports/tracing.latest.json","reports/validation-source.latest.json","reports/write-capacity.latest.json"]},{"id":"d1eb5860c4337cf457a03c76670d2551dc848cee","message":"feat(contracts): B2 迁入内核租户原语，收敛 tenantId 的三套口径为单源\n\n立项 B2 原写「净迁入六个」。开工时改了做法并写回立项：**净迁入的模块不该先暴露后接线**。\napi-error / replay-buffer / request-context / platform-ports / alert 只加到 barrel 而不接线，\n就是新增零消费者的 CORE 面——正是本仓 check:kernel-admission 的 K5 在盯、K4 判「声明无回执」\n的同型。改为**接线时才迁入**。六个里只有 tenant 是「迁入即能用」的，本批只做它。\n\n一、packages/contracts/src/tenant.ts 转发 @juhai/kernel 的 11 个租户解析原语。\n 这个名字是上一步 tenant.ts → authorization.ts 改名腾出来的；本仓此前**完全没有这一组**。\n\n二、用它收敛 tenantId 的三套口径（8 处 / 6 个文件）：\n z.string().min(1) × 6（无上限、无字符约束） → tenantIdSchema\n .max(128) × 2（有长度无形状） → tenantIdSchema\n ^ten_.+$（事实投影，自成一套） → **叠加**在内核形状之上，不再另起\n\n 判据直接委托 normalizeTenantId，不在仓内重写正则——重写就又是一套口径。\n 用 normalizeTenantId(v) === v 而非 !== undefined：后者放行带首尾空白的值\n （normalize 先 trim 再判），于是「校验通过的值」与「真正该存的值」不是同一个。\n\n收紧实测咬住 11/11。B2 之前 z.string().min(1) 会放行全部这些：\"\"、\" t1 \"、\"t/1\"、\n**\"t\\n1\"**、\"_t\"、129 字符。含换行符那条是框架注释点名的伪造日志行向量（NestJS 侧有字符串\n拼接日志）；129 字符那条对应 users 表 @@unique([tenantId, email]) 撞 Postgres btree 约\n2704 字节行上限打 500。也就是说本仓在此之前**没有任何 tenantId 形状与长度校验**。\n\n三处门禁如实红过再修，没有一处先改门禁：\n check:kernel-boundaries B3 新内核面未归类 → tenant.ts 归 CORE（contractModules 32）\n check:kernel-packages P7 公开面变更须伴随版本上调 → @repo/contracts 1.18.0 → 1.19.0\n check:kernel-admission K1 导出清单漂移 → 重签（40 模块 / 756 导出）\n连带同步接入手册下游锁行与 CLAUDE.md 边界数字 143/143 → 144/144。\n\n验证：contracts 312/312 · typecheck 13/13 · 整轮静态 28 步前 27 绿（末步仍是那 8 处已知红）。\n运行态另行重跑后回绑——本提交不含任何运行态报告。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/commit/d1eb5860c4337cf457a03c76670d2551dc848cee","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:04:17-07:00","added":["packages/contracts/src/tenant.ts"],"removed":[],"modified":["CLAUDE.md","docs/product-extension-guide.md","kernel.boundaries.json","kernel.downstream.lock.json","kernel.exports.lock.json","kernel.packages.json","kernel.packages.lock.json","packages/contracts/package.json","packages/contracts/src/employment-projection.ts","packages/contracts/src/identity.ts","packages/contracts/src/index.ts","packages/contracts/src/job.ts","packages/contracts/src/kernel.ts","packages/contracts/src/llm-governance.ts","packages/contracts/src/realtime.ts","packages/contracts/src/user.ts"]}],"total_commits":0,"head_commit":{"id":"91b5257007ab9d588dcada5c5ca8d0c41a024bb9","message":"chore(reports): B2 的四十一份三级证据 回绑 @ d1eb586，刷新快照锚点\n\n本批次最后一个提交，按 C241 同时刷新快照锚点到 d1eb586（声明落后 0，本提交自身使实测\n落后 1，在 +1 自指窗内）。\n\n四十一份 reports/*.latest.json 全部 clean 绑定（gitSha=d1eb586、worktreeDirty:false）：\n静态 28 + 运行态 13。\n\n运行态实测与基线逐项持平，**tenantId 收敛在真实写链上行为中性**：\n testsPassed 733（基线 733）· behaviorParityCases 204（基线 204）· testFailures 0\n 87 项指标零违规\n静态整轮 28 步全执行、前 27 绿，末步 check:kernel-admission 仍是那 8 处已知诚实红。\n\n本批次跑了三轮 runtime，前两轮红，都不是 B2 的代码问题，如实记录：\n\n一、第一轮 outcomes.integration.test.ts「outcome not opened in time」（15 秒 E2E 超时）。\n 判为偶发，依据三条：该测试用 tenant-a-nestjs-outcome，在新 schema 下合法；整份日志里\n 新校验的拒绝消息 / ZodError / invalid_string **0 次命中**；同一份代码隔离重跑该文件\n 14/14 通过。第三轮整轮亦一次过。\n 顺带记一个行为：**失败的 runtime 会删掉 8 份运行态报告**（跑到一半中止、未重新生成）。\n\n二、第二轮测试全过（733 / 204-204 / 0 失败）但整轮记 failed，红在末尾的文档复核\n governance-kernel-boundary-number-consistency。根因是本会话的一次操作失误：\n `git restore reports/` 用了目录级范围，把已重新生成的 kernel-boundaries.latest.json\n 退回 HEAD 版（143/143），而 CLAUDE.md 已是 144/144。重跑静态后边界报告回到 144/144，\n 又撞上 governance-number-evidence-shape（要求一份 passed 的 runtime），于是必须再跑\n 第三轮才解环——这正是 CLAUDE.md 记载过的那个环。\n\n 同一次失误还抹掉了三份 reports/ui-*.latest.json 的未提交改动（不属本会话）。\n 已用 git fsck --lost-found 从游离 blob 全数找回并逐字核对：它们是 2026-09-15 的 UI 验收，\n 绑 c433d57 且 dirty=false。本提交仍未包含它们。\n 教训具体化：reports/ 下同时存在「本会话产出的」与「别人的」两类文件，任何范围操作都会\n 同时命中两类，**还原必须逐文件点名**。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/commit/91b5257007ab9d588dcada5c5ca8d0c41a024bb9","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:31:09-07:00","added":[],"removed":[],"modified":["CLAUDE.md","reports/agent-adapters.latest.json","reports/auth-startup.latest.json","reports/capacity-envelope.latest.json","reports/contract-consumers.latest.json","reports/db-credential-separation.latest.json","reports/dependency-resilience.latest.json","reports/docs-truth.latest.json","reports/dual-backend-behavior.latest.json","reports/dual-backend-parity.latest.json","reports/fixtures.latest.json","reports/fork-readiness.latest.json","reports/governance-docs.latest.json","reports/governance.latest.json","reports/kernel-admission.latest.json","reports/kernel-boundaries.latest.json","reports/kernel-downstream.latest.json","reports/kernel-extensions.latest.json","reports/kernel-packages.latest.json","reports/list-bounds.latest.json","reports/llm-eval.latest.json","reports/migrations.latest.json","reports/mobile-export.latest.json","reports/multi-instance.latest.json","reports/naming.latest.json","reports/operations.latest.json","reports/platform-dependency-provenance.latest.json","reports/product-acceptance-runtime.latest.json","reports/product-acceptance.latest.json","reports/product-extension-runtime.latest.json","reports/product-migrations-runtime.latest.json","reports/product-migrations.latest.json","reports/product-sql-runtime.latest.json","reports/report-transaction-lock.latest.json","reports/rls.latest.json","reports/runtime-acceptance.latest.json","reports/runtime-governance.latest.json","reports/schema-sync.latest.json","reports/statemachine-write-guard.latest.json","reports/tracing.latest.json","reports/validation-source.latest.json","reports/write-capacity.latest.json"]},"repository":{"id":76,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"digital-employee-os","full_name":"luoanwu/digital-employee-os","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":87356,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/digital-employee-os/languages","html_url":"https://gitea.g-hi.com/luoanwu/digital-employee-os","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/digital-employee-os","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/digital-employee-os.git","clone_url":"https://gitea.g-hi.com/luoanwu/digital-employee-os.git","original_url":"","website":"","stars_count":0,"forks_count":1,"watchers_count":1,"branch_count":3,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-08-20T14:46:28+08:00","updated_at":"2026-09-18T17:38:56+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"}}...
|
push
|
2
|
8
|
1789741882
|
1789741891
|
0
|
1789741873
|
1789741896
|
|
|
0
|
Edit
Delete
|
|
24132
|
chore(reports): 静态链首次 28/28 全通过 回绑 @ 801d916，刷新快照锚 chore(reports): 静态链首次 28/28 全通过 回绑 @ 801d916，刷新快照锚点...
|
76
|
5
|
governance.yml
|
76
|
5
|
0
|
refs/heads/main
|
4da2c656ae691428be3f177563952cba66c37b88
|
0
|
0
|
0
|
push
|
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"91b5257007ab9d588dcada5c5ca8d0c41a024bb9","after":"4da2c656ae691428be3f177563952cba66c37b88","compare_url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/compare/91b5257007ab9d588dcada5c5ca8d0c41a024bb9...4da2c656ae691428be3f177563952cba66c37b88","commits":[{"id":"4da2c656ae691428be3f177563952cba66c37b88","message":"chore(reports): 静态链首次 28/28 全通过 回绑 @ 801d916，刷新快照锚点\n\n本批次最后一个提交，按 C241 同时刷新快照锚点到 801d916（声明落后 0，本提交自身使实测\n落后 1，在 +1 自指窗内）。\n\n二十八份 reports/*.latest.json 全部 clean 绑定（gitSha=801d916、worktreeDirty:false）。\n**pnpm check 退出码 0：28/28 个步骤通过**——自 check:kernel-admission 引入以来首次整链绿，\n也是本仓静态轴扩到 28 步后的首次。\n\n绿的成色写在实现提交里，此处只记边界：唯一没有机器回执的 CORE.crossProductRequired 走的是\nevidenceDeferred 五字段登记（期限 2026-12-18、触发条件＝第二个产品真实装载），它在报告里是\nobserved 一行，**不是绿，是登记在案的缺证**。到期不补即转红。\n\n运行态未受本批影响（只动门禁、注册表、夹具与文档，未动 apps/packages 运行代码），\nruntime 报告仍绑在上一批的 d1eb586，13 份运行态证据未重跑也未失效。\n\n工作区内三份 reports/ui-*.latest.json 的改动早于本批次，未提交也未还原。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/commit/4da2c656ae691428be3f177563952cba66c37b88","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:42:54-07:00","added":[],"removed":[],"modified":["CLAUDE.md","reports/agent-adapters.latest.json","reports/contract-consumers.latest.json","reports/docs-truth.latest.json","reports/dual-backend-parity.latest.json","reports/fixtures.latest.json","reports/fork-readiness.latest.json","reports/governance-docs.latest.json","reports/governance.latest.json","reports/kernel-admission.latest.json","reports/kernel-boundaries.latest.json","reports/kernel-downstream.latest.json","reports/kernel-extensions.latest.json","reports/kernel-packages.latest.json","reports/list-bounds.latest.json","reports/llm-eval.latest.json","reports/migrations.latest.json","reports/mobile-export.latest.json","reports/naming.latest.json","reports/operations.latest.json","reports/platform-dependency-provenance.latest.json","reports/product-acceptance.latest.json","reports/product-migrations.latest.json","reports/report-transaction-lock.latest.json","reports/rls.latest.json","reports/runtime-governance.latest.json","reports/schema-sync.latest.json","reports/statemachine-write-guard.latest.json","reports/validation-source.latest.json"]},{"id":"801d916f36af0ee32c77b2138ec9afcf14b34db7","message":"feat(governance): K3/K4 裁决——八处准入声明逐条补上真回执，静态链首次 28/28\n\ncheck:kernel-admission 引入时诚实红 8 处（K3 一处 + K4 七处）。本批逐条裁决并清零，\n**没有一处是把判据改松**——三条是补实体，一条是承认无法证明。\n\n一、K3（跨产品证据只有命名空间导入）→ 补实体\n 下游夹具此前只有 10 个 import * as，按构造在契约模块全空时同样通过。改为携带 5 个\n **真实被产品消费**的符号（ProductManifestInput / Composition / RuntimeContractCatalog /\n DataContractImplementation / EventContractImplementation，实测自唯一装载的 juhai.hr）的\n 具名类型导入并用于类型位置——编译通过才第一次构成「下游能按名字用上这些契约」的证据。\n\n二、K4 的结构性问题：两条门禁要求互相冲突，拆字段解决\n check-kernel-boundaries 的 B2 明令 evidenceSources **不得指 reports/**（运行产物随时重跑、\n 可被删除——本会话实测过：失败的 runtime 会删掉 8 份报告），而 K4 要求必须有机器回执。\n 两条各自成立，是同一件事的两半。改为两个字段：\n evidenceSources 持久判据源（脚本 / 词典 / 锁）——B2 判它\n evidenceReceipts 该判据源产出的机器回执——K4 判它\n K4 同时加强：回执须真实存在、带机器结论（status 或 violations）、带 provenance.gitSha、\n 且自身不是红盘。另加两条配套判据：\n · 禁止把**本门禁自己产出的报告**当回执（结构性自指：它只要有发现就是红的）\n · 确实无法被证据支撑时走 evidenceDeferred 五字段登记，降级 observed、过期转红\n\n三、逐条落点\n industryIndependent → kernel-boundaries（逐文件扫 CORE 源码不得内嵌已登记 Product\n 命名空间，check-kernel-boundaries.mjs:181）+ naming（业务词典）\n dualBackendGoverned → dual-backend-parity\n stableContract → kernel-packages\n crossProductRequired → **无回执，登记为「证据待补」**：本仓只装载一个产品，跨产品消费面\n 实测仅 5 个符号 / 34 个模块为零，该证据客观上无从产生。期限\n 2026-12-18，触发条件＝第二个产品真实装载；到期转红。\n 硬指一份回执等于把自证换个地方做，不做。\n\n四、订正一处我自己的误判\n 先前称「parity 对 employment 零断言」——**查错了地方**：断言在 governance.registry.json\n 的 employment.parityAssertions 里，由 check-dual-backend-parity.mjs:507 通用执行，本就有\n 10 条（消费者标识分区、new FactInbox、FACT_READ_NOT_CONFIGURED fail-closed、\n autoCommit:false、未配 broker 返回 null）。\n 据此我一度把新断言**硬编码**进脚本，被 check:fork-readiness 的 F2 当场抓住\n （「门禁不得硬编码已登记业务标识」）——F2 抓的是我的代码，抓得对。已撤回硬编码，\n 把两条新不变式（事件载荷与行映射必须走契约单源）按注册表形式补入，10 → 14 条。\n\nkernel.boundaries.json 新增 evidenceNotes：逐份回执记录**它到底判了什么**，含上述订正与\n「dual-backend-behavior 的 63 个矩阵用例不含 llm/employment，故两个 pack 不以它为据」这类边界。\n指针只说明有机器判过，不代表覆盖该词全部含义。\n\n自检 10 → 17 条（新增回执质量、自指、证据待补三组，含 1 条基线正例、2 条防过度判红）。\n整轮 pnpm check：**28/28 步骤全部通过**，退出码 0——自本门禁引入以来首次。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/commit/801d916f36af0ee32c77b2138ec9afcf14b34db7","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:41:16-07:00","added":[],"removed":[],"modified":["CLAUDE.md","governance.registry.json","kernel.boundaries.json","kernel.downstream.lock.json","scripts/check-dual-backend-parity.mjs","scripts/check-kernel-admission.mjs","tests/kernel-downstream-fixture/src/index.ts"]}],"total_commits":0,"head_commit":{"id":"4da2c656ae691428be3f177563952cba66c37b88","message":"chore(reports): 静态链首次 28/28 全通过 回绑 @ 801d916，刷新快照锚点\n\n本批次最后一个提交，按 C241 同时刷新快照锚点到 801d916（声明落后 0，本提交自身使实测\n落后 1，在 +1 自指窗内）。\n\n二十八份 reports/*.latest.json 全部 clean 绑定（gitSha=801d916、worktreeDirty:false）。\n**pnpm check 退出码 0：28/28 个步骤通过**——自 check:kernel-admission 引入以来首次整链绿，\n也是本仓静态轴扩到 28 步后的首次。\n\n绿的成色写在实现提交里，此处只记边界：唯一没有机器回执的 CORE.crossProductRequired 走的是\nevidenceDeferred 五字段登记（期限 2026-12-18、触发条件＝第二个产品真实装载），它在报告里是\nobserved 一行，**不是绿，是登记在案的缺证**。到期不补即转红。\n\n运行态未受本批影响（只动门禁、注册表、夹具与文档，未动 apps/packages 运行代码），\nruntime 报告仍绑在上一批的 d1eb586，13 份运行态证据未重跑也未失效。\n\n工作区内三份 reports/ui-*.latest.json 的改动早于本批次，未提交也未还原。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/commit/4da2c656ae691428be3f177563952cba66c37b88","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:42:54-07:00","added":[],"removed":[],"modified":["CLAUDE.md","reports/agent-adapters.latest.json","reports/contract-consumers.latest.json","reports/docs-truth.latest.json","reports/dual-backend-parity.latest.json","reports/fixtures.latest.json","reports/fork-readiness.latest.json","reports/governance-docs.latest.json","reports/governance.latest.json","reports/kernel-admission.latest.json","reports/kernel-boundaries.latest.json","reports/kernel-downstream.latest.json","reports/kernel-extensions.latest.json","reports/kernel-packages.latest.json","reports/list-bounds.latest.json","reports/llm-eval.latest.json","reports/migrations.latest.json","reports/mobile-export.latest.json","reports/naming.latest.json","reports/operations.latest.json","reports/platform-dependency-provenance.latest.json","reports/product-acceptance.latest.json","reports/product-migrations.latest.json","reports/report-transaction-lock.latest.json","reports/rls.latest.json","reports/runtime-governance.latest.json","reports/schema-sync.latest.json","reports/statemachine-write-guard.latest.json","reports/validation-source.latest.json"]},"repository":{"id":76,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"digital-employee-os","full_name":"luoanwu/digital-employee-os","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":87761,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/digital-employee-os/languages","html_url":"https://gitea.g-hi.com/luoanwu/digital-employee-os","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/digital-employee-os","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/digital-employee-os.git","clone_url":"https://gitea.g-hi.com/luoanwu/digital-employee-os.git","original_url":"","website":"","stars_count":0,"forks_count":1,"watchers_count":1,"branch_count":3,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-08-20T14:46:28+08:00","updated_at":"2026-09-18T22:31:13+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"}}...
|
push
|
2
|
36
|
1789742578
|
1789742587
|
0
|
1789742578
|
1789742601
|
group: governance-${{ github.workflow }}-${{ githu group: governance-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: "true"
...
|
governance-governance.yml-refs/heads/main
|
1
|
Edit
Delete
|
|
24133
|
chore(reports): 静态链首次 28/28 全通过 回绑 @ 801d916，刷新快照锚 chore(reports): 静态链首次 28/28 全通过 回绑 @ 801d916，刷新快照锚点...
|
76
|
5
|
platform-governance.yml
|
77
|
5
|
0
|
refs/heads/main
|
4da2c656ae691428be3f177563952cba66c37b88
|
0
|
0
|
0
|
push
|
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"91b5257007ab9d588dcada5c5ca8d0c41a024bb9","after":"4da2c656ae691428be3f177563952cba66c37b88","compare_url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/compare/91b5257007ab9d588dcada5c5ca8d0c41a024bb9...4da2c656ae691428be3f177563952cba66c37b88","commits":[{"id":"4da2c656ae691428be3f177563952cba66c37b88","message":"chore(reports): 静态链首次 28/28 全通过 回绑 @ 801d916，刷新快照锚点\n\n本批次最后一个提交，按 C241 同时刷新快照锚点到 801d916（声明落后 0，本提交自身使实测\n落后 1，在 +1 自指窗内）。\n\n二十八份 reports/*.latest.json 全部 clean 绑定（gitSha=801d916、worktreeDirty:false）。\n**pnpm check 退出码 0：28/28 个步骤通过**——自 check:kernel-admission 引入以来首次整链绿，\n也是本仓静态轴扩到 28 步后的首次。\n\n绿的成色写在实现提交里，此处只记边界：唯一没有机器回执的 CORE.crossProductRequired 走的是\nevidenceDeferred 五字段登记（期限 2026-12-18、触发条件＝第二个产品真实装载），它在报告里是\nobserved 一行，**不是绿，是登记在案的缺证**。到期不补即转红。\n\n运行态未受本批影响（只动门禁、注册表、夹具与文档，未动 apps/packages 运行代码），\nruntime 报告仍绑在上一批的 d1eb586，13 份运行态证据未重跑也未失效。\n\n工作区内三份 reports/ui-*.latest.json 的改动早于本批次，未提交也未还原。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/commit/4da2c656ae691428be3f177563952cba66c37b88","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:42:54-07:00","added":[],"removed":[],"modified":["CLAUDE.md","reports/agent-adapters.latest.json","reports/contract-consumers.latest.json","reports/docs-truth.latest.json","reports/dual-backend-parity.latest.json","reports/fixtures.latest.json","reports/fork-readiness.latest.json","reports/governance-docs.latest.json","reports/governance.latest.json","reports/kernel-admission.latest.json","reports/kernel-boundaries.latest.json","reports/kernel-downstream.latest.json","reports/kernel-extensions.latest.json","reports/kernel-packages.latest.json","reports/list-bounds.latest.json","reports/llm-eval.latest.json","reports/migrations.latest.json","reports/mobile-export.latest.json","reports/naming.latest.json","reports/operations.latest.json","reports/platform-dependency-provenance.latest.json","reports/product-acceptance.latest.json","reports/product-migrations.latest.json","reports/report-transaction-lock.latest.json","reports/rls.latest.json","reports/runtime-governance.latest.json","reports/schema-sync.latest.json","reports/statemachine-write-guard.latest.json","reports/validation-source.latest.json"]},{"id":"801d916f36af0ee32c77b2138ec9afcf14b34db7","message":"feat(governance): K3/K4 裁决——八处准入声明逐条补上真回执，静态链首次 28/28\n\ncheck:kernel-admission 引入时诚实红 8 处（K3 一处 + K4 七处）。本批逐条裁决并清零，\n**没有一处是把判据改松**——三条是补实体，一条是承认无法证明。\n\n一、K3（跨产品证据只有命名空间导入）→ 补实体\n 下游夹具此前只有 10 个 import * as，按构造在契约模块全空时同样通过。改为携带 5 个\n **真实被产品消费**的符号（ProductManifestInput / Composition / RuntimeContractCatalog /\n DataContractImplementation / EventContractImplementation，实测自唯一装载的 juhai.hr）的\n 具名类型导入并用于类型位置——编译通过才第一次构成「下游能按名字用上这些契约」的证据。\n\n二、K4 的结构性问题：两条门禁要求互相冲突，拆字段解决\n check-kernel-boundaries 的 B2 明令 evidenceSources **不得指 reports/**（运行产物随时重跑、\n 可被删除——本会话实测过：失败的 runtime 会删掉 8 份报告），而 K4 要求必须有机器回执。\n 两条各自成立，是同一件事的两半。改为两个字段：\n evidenceSources 持久判据源（脚本 / 词典 / 锁）——B2 判它\n evidenceReceipts 该判据源产出的机器回执——K4 判它\n K4 同时加强：回执须真实存在、带机器结论（status 或 violations）、带 provenance.gitSha、\n 且自身不是红盘。另加两条配套判据：\n · 禁止把**本门禁自己产出的报告**当回执（结构性自指：它只要有发现就是红的）\n · 确实无法被证据支撑时走 evidenceDeferred 五字段登记，降级 observed、过期转红\n\n三、逐条落点\n industryIndependent → kernel-boundaries（逐文件扫 CORE 源码不得内嵌已登记 Product\n 命名空间，check-kernel-boundaries.mjs:181）+ naming（业务词典）\n dualBackendGoverned → dual-backend-parity\n stableContract → kernel-packages\n crossProductRequired → **无回执，登记为「证据待补」**：本仓只装载一个产品，跨产品消费面\n 实测仅 5 个符号 / 34 个模块为零，该证据客观上无从产生。期限\n 2026-12-18，触发条件＝第二个产品真实装载；到期转红。\n 硬指一份回执等于把自证换个地方做，不做。\n\n四、订正一处我自己的误判\n 先前称「parity 对 employment 零断言」——**查错了地方**：断言在 governance.registry.json\n 的 employment.parityAssertions 里，由 check-dual-backend-parity.mjs:507 通用执行，本就有\n 10 条（消费者标识分区、new FactInbox、FACT_READ_NOT_CONFIGURED fail-closed、\n autoCommit:false、未配 broker 返回 null）。\n 据此我一度把新断言**硬编码**进脚本，被 check:fork-readiness 的 F2 当场抓住\n （「门禁不得硬编码已登记业务标识」）——F2 抓的是我的代码，抓得对。已撤回硬编码，\n 把两条新不变式（事件载荷与行映射必须走契约单源）按注册表形式补入，10 → 14 条。\n\nkernel.boundaries.json 新增 evidenceNotes：逐份回执记录**它到底判了什么**，含上述订正与\n「dual-backend-behavior 的 63 个矩阵用例不含 llm/employment，故两个 pack 不以它为据」这类边界。\n指针只说明有机器判过，不代表覆盖该词全部含义。\n\n自检 10 → 17 条（新增回执质量、自指、证据待补三组，含 1 条基线正例、2 条防过度判红）。\n整轮 pnpm check：**28/28 步骤全部通过**，退出码 0——自本门禁引入以来首次。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/commit/801d916f36af0ee32c77b2138ec9afcf14b34db7","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:41:16-07:00","added":[],"removed":[],"modified":["CLAUDE.md","governance.registry.json","kernel.boundaries.json","kernel.downstream.lock.json","scripts/check-dual-backend-parity.mjs","scripts/check-kernel-admission.mjs","tests/kernel-downstream-fixture/src/index.ts"]}],"total_commits":0,"head_commit":{"id":"4da2c656ae691428be3f177563952cba66c37b88","message":"chore(reports): 静态链首次 28/28 全通过 回绑 @ 801d916，刷新快照锚点\n\n本批次最后一个提交，按 C241 同时刷新快照锚点到 801d916（声明落后 0，本提交自身使实测\n落后 1，在 +1 自指窗内）。\n\n二十八份 reports/*.latest.json 全部 clean 绑定（gitSha=801d916、worktreeDirty:false）。\n**pnpm check 退出码 0：28/28 个步骤通过**——自 check:kernel-admission 引入以来首次整链绿，\n也是本仓静态轴扩到 28 步后的首次。\n\n绿的成色写在实现提交里，此处只记边界：唯一没有机器回执的 CORE.crossProductRequired 走的是\nevidenceDeferred 五字段登记（期限 2026-12-18、触发条件＝第二个产品真实装载），它在报告里是\nobserved 一行，**不是绿，是登记在案的缺证**。到期不补即转红。\n\n运行态未受本批影响（只动门禁、注册表、夹具与文档，未动 apps/packages 运行代码），\nruntime 报告仍绑在上一批的 d1eb586，13 份运行态证据未重跑也未失效。\n\n工作区内三份 reports/ui-*.latest.json 的改动早于本批次，未提交也未还原。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/commit/4da2c656ae691428be3f177563952cba66c37b88","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:42:54-07:00","added":[],"removed":[],"modified":["CLAUDE.md","reports/agent-adapters.latest.json","reports/contract-consumers.latest.json","reports/docs-truth.latest.json","reports/dual-backend-parity.latest.json","reports/fixtures.latest.json","reports/fork-readiness.latest.json","reports/governance-docs.latest.json","reports/governance.latest.json","reports/kernel-admission.latest.json","reports/kernel-boundaries.latest.json","reports/kernel-downstream.latest.json","reports/kernel-extensions.latest.json","reports/kernel-packages.latest.json","reports/list-bounds.latest.json","reports/llm-eval.latest.json","reports/migrations.latest.json","reports/mobile-export.latest.json","reports/naming.latest.json","reports/operations.latest.json","reports/platform-dependency-provenance.latest.json","reports/product-acceptance.latest.json","reports/product-migrations.latest.json","reports/report-transaction-lock.latest.json","reports/rls.latest.json","reports/runtime-governance.latest.json","reports/schema-sync.latest.json","reports/statemachine-write-guard.latest.json","reports/validation-source.latest.json"]},"repository":{"id":76,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"digital-employee-os","full_name":"luoanwu/digital-employee-os","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":87761,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/digital-employee-os/languages","html_url":"https://gitea.g-hi.com/luoanwu/digital-employee-os","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/digital-employee-os","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/digital-employee-os.git","clone_url":"https://gitea.g-hi.com/luoanwu/digital-employee-os.git","original_url":"","website":"","stars_count":0,"forks_count":1,"watchers_count":1,"branch_count":3,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-08-20T14:46:28+08:00","updated_at":"2026-09-18T22:31:13+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"}}...
|
push
|
2
|
8
|
1789742587
|
1789742596
|
0
|
1789742578
|
1789742601
|
|
|
0
|
Edit
Delete
|
|
24134
|
chore(reports): dev 常驻运行时切换后的部署门禁回绑 @ 06c3d4c
|
116
|
5
|
platform.yml
|
119
|
5
|
0
|
refs/heads/main
|
0c6a1918aa223b1779ce4653ba2c4e4609aea336
|
0
|
0
|
0
|
push
|
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"05e3826e9e9e4dbbdd753252c2134b8494b08f2b","after":"0c6a1918aa223b1779ce4653ba2c4e4609aea336","compare_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/compare/05e3826e9e9e4dbbdd753252c2134b8494b08f2b...0c6a1918aa223b1779ce4653ba2c4e4609aea336","commits":[{"id":"0c6a1918aa223b1779ce4653ba2c4e4609aea336","message":"chore(reports): dev 常驻运行时切换后的部署门禁回绑 @ 06c3d4c\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/0c6a1918aa223b1779ce4653ba2c4e4609aea336","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:34:13-07:00","added":[],"removed":[],"modified":["reports/deployed-runtime.latest.json"]},{"id":"06c3d4cb7fd09b2b44e621a56d7b14653bb8b445","message":"chore(reports): runtime 镜像重建与冒烟证据回绑 @ 05e3826\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/06c3d4cb7fd09b2b44e621a56d7b14653bb8b445","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:33:44-07:00","added":[],"removed":[],"modified":["reports/image-digest.json","reports/image-smoke.latest.json"]}],"total_commits":0,"head_commit":{"id":"0c6a1918aa223b1779ce4653ba2c4e4609aea336","message":"chore(reports): dev 常驻运行时切换后的部署门禁回绑 @ 06c3d4c\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/0c6a1918aa223b1779ce4653ba2c4e4609aea336","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:34:13-07:00","added":[],"removed":[],"modified":["reports/deployed-runtime.latest.json"]},"repository":{"id":116,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"enterprise-platform","full_name":"luoanwu/enterprise-platform","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":18767,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/languages","html_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/enterprise-platform.git","clone_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform.git","original_url":"","website":"","stars_count":0,"forks_count":0,"watchers_count":1,"branch_count":43,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-09-11T07:33:25+08:00","updated_at":"2026-09-18T22:42:51+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"}}...
|
push
|
2
|
30
|
1789742609
|
1789742647
|
0
|
1789742609
|
1789742676
|
group: platform-${{ github.workflow }}-${{ github. group: platform-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
...
|
platform-platform.yml-refs/heads/main
|
0
|
Edit
Delete
|
|
24135
|
fix(contracts): 通知与 Webhook 规则补入参体检——一处倒向放行、两处崩溃面与 fix(contracts): 通知与 Webhook 规则补入参体检——一处倒向放行、两处崩溃面与目标地址的同义写法...
|
116
|
5
|
platform.yml
|
120
|
5
|
0
|
refs/heads/main
|
c190a6ab5d2c50e4c90f027bbcca72f1f3050005
|
0
|
0
|
0
|
push
|
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"0c6a1918aa223b1779ce4653ba2c4e4609aea336","after":"c190a6ab5d2c50e4c90f027bbcca72f1f3050005","compare_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/compare/0c6a1918aa223b1779ce4653ba2c4e4609aea336...c190a6ab5d2c50e4c90f027bbcca72f1f3050005","commits":[{"id":"c190a6ab5d2c50e4c90f027bbcca72f1f3050005","message":"fix(contracts): 通知与 Webhook 规则补入参体检——一处倒向放行、两处崩溃面与目标地址的同义写法\n\n迁入版把策略快照一侧校验到底（normalizeSnapshot 逐字段抛），请求一侧、目标地址一侧与夹具评估器三处漏风。\n补强前对 dist 逐条实测：\n\n- 放行面（唯一一处方向倒向放行）：三个状态位按真值判，`replayAuthorized: \"false\"` 在 `!value` 下为 false，\n 未授权重放被判成已授权 → DELIVER；planner 原样透传这三位，计划面同样通。现在只认布尔字面量。\n- 崩溃面：classifyNotificationEffect(undefined) / classifyProviderOutcome(undefined) 抛 TypeError 而不是拒绝，\n 夹具的 effect / provider 两条规则都能直接触发——门禁那时拿到的是异常不是判定，落到消费侧是 500 不是拒绝。\n- 目标地址（C08.05 / 蓝图「私网地址失败关闭」）：isPrivateLiteral 只认四段十进制，2130706433 / 0x7f000001 /\n 0177.0.0.1 / 127.1 全判成公网；0.0.0.0/8、CGNAT 100.64/10、组播与保留段、.internal、末尾点均未覆盖。\n 现在数字形主机一律按 IP 字面量处理，只放行严格四段十进制的公网地址；allowedHosts 自己先过这道地板\n （WEBHOOK_ALLOWED_HOST_NOT_PUBLIC），小写归一后再查一次重名。\n- 本次唯一放宽的一处，据实登记：迁入版按字符串前缀 fc / fd / fe80 判私网 IPv6，fc-portal.example.com 这类\n 正常域名被误判成私网。改判后它可用，但仍须先进运营批准的 allowlist 且为 HTTPS，不构成新的可达面。\n- 死代码：WEBHOOK_TENANT_WILDCARD_FORBIDDEN 写在字符集校验之后，`*` 永远先报 WEBHOOK_ROUTE_TENANTS_INVALID，\n 蓝图写明的「tenant allowlist 禁止 *」从未以自己的名义拦下过。\n- 退避：decideProviderOutcome 原取 min(maximumBackoff, retryAfter)，供应商回一个 Retry-After: 0 即可把批准过的\n 退避清零。现在外部回执只能把退避拉长到策略上界，上界语义与既有用例逐字不变。\n- 夹具评估器把两种非放行当成放行：SKIP_DUPLICATE 与 DLQ 都没有 reasons 字段，被 `\"reasons\" in r` 判成空数组\n = ACCEPT，与该文件自己第一句「只有 DELIVER / DELIVERED 算放行」正相反。另补 refresh 规则。\n- effect_id 改为强校验：五段必须是规范标识符（因此不含 :），否则 a:b+c 与 a+b:c 会拼出同一个 id；\n 请求一侧的标识符不再先 trim 再判定。\n\n合法快照与合法请求的判定结果逐字不变：迁入的 14 例断言一条未改。单测 14 → 24 例；夹具 8 → 17 例，并修好\n名不副实的 N06-plan-without-policy-denies-all——它此前只喂了两个字段的请求，压根走不到「无策略即拒」那一步。\n\n核验（工作树 dirty，报告未回绑，只绑本地）：contracts build / typecheck 绿、本域单测 24/24、\ncontracts/test/*.test.mjs 330/330、check:fixtures 17 套件 236 例 0 失败 0 不可用（本域 17/17；用临时报告名跑，\n跑完删除，reports/ 未动）。负向实测两次：① 把 HEAD 版三支规则单独编译后喂新夹具，8 例新增负例全部不通过\n（N07/N10/N11 直接放行、N08/N09 抛 TypeError、N12 换原因、N13/N14 旧评估器不识别 refresh）；\n② 篡改 N10 的声明原因 → 门禁 exit 1 并点名该例，翻 expect → 被 id/expect 一致性先挡下，还原后 exit 0。\n\n未做：缺失模块完善清单 C12 的模板审批 / 多渠道 Provider / 签名防重放 / 渠道切换本仓仍一件没有（该行类型是\n「裁决」，前置是运行宿主 Q01），本轮仍是契约包形态，不代表通知服务上线；Catalog 登记未动（仍 module_e2，\ncode_truth 指工单仓 packages/notification-delivery）；三个消费仓的 packages/notification-delivery 未同步；\n入站回调验签（C12.05）与 UNKNOWN 回执（C12.04）属判定面扩张，只登记未实现。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/c190a6ab5d2c50e4c90f027bbcca72f1f3050005","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:43:48-07:00","added":["contracts/src/domain/notification-webhook/value-guards.ts"],"removed":[],"modified":["contracts/SOURCE.md","contracts/src/domain/notification-webhook/fixture-evaluator.ts","contracts/src/domain/notification-webhook/notification-effect.ts","contracts/src/domain/notification-webhook/webhook-delivery-planner.ts","contracts/test/fixtures/notification-webhook.fixtures.json","contracts/test/notification-webhook-domain.test.mjs"]},{"id":"9d13fb058d2a0356797f26d1d17a4b2149b6ab97","message":"docs(runbook): 订正 CORS 一句——服务端代理不解 CORS，工作台吃的是 :3101 那个进程的白名单\n\n原文「控制面 Web 与 identity dev 走服务端代理，不吃这条」把两件事混了。代理只是把上游的\nAccess-Control-Allow-Origin 原样回传，吃不吃只看浏览器所在页面的 origin 与被请求 origin\n是否同源：控制面 Web 的页面与它的 /api 代理同源，不吃；工作台 dev（:3010）经 :3098 代理\n打到 :3101，跨源，放行的必须是 :3101 那个进程的 CORS_ORIGIN，而不是容器的\nPLATFORM_CORS_ORIGIN——后者 2026-09-18 补过、前者一直缺，于是总览两块读面全被浏览器拦成\n「依赖故障」，而服务端日志里是一次正常 200。今天按这句话排查，方向被带偏过一次。\n\n同轮登记两处仓外事实：identity dev 的 env 文件位置（企业控制面/.secrets/\nenterprise-platform-identity-dev.env，已含 CORS_ORIGIN=http://localhost:3010），\n以及工作台 API 基地址的单一出处（apps/workbench/.env.local，launch.json 不再覆盖）。\n\n作用域 = 文档订正，不含代码与门禁证据。本机 dev 实测：预检 204 / 三个读面 200 /\nidentity 探针 database:up redis:up，证据只绑本地运行态。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/9d13fb058d2a0356797f26d1d17a4b2149b6ab97","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:42:44-07:00","added":[],"removed":[],"modified":["docs/runbook.md"]},{"id":"13c7eb7271af67df9d0b4e5223bda3eaa4ab7b10","message":"fix(contracts): 跨域流程规则补入参体检，并补上 FLOW-01 与 effect 幂等两条自己没做到的红线\n\n迁入版的判定在「入参可信」时是对的，但本能力的真实入口是 JSON：夹具评估器、approved 快照、\n未来的 Owner Adapter 载荷都从反序列化来，TS 类型只在编译期成立。四类问题均有 dist 实测，非读代码推断。\n\n1. 崩溃面八处抛 TypeError 而不是拒绝。assessWorkflowDefinition(undefined) →\n Cannot read properties of undefined (reading 'domains')；{}、domains 非数组、steps 非数组、\n 步骤缺 dependsOn、effectIdempotencyKey 是数字同理；LocalWorkflowPlanner.plan({}) →\n Cannot read properties of undefined (reading 'trim')。夹具 definition 与 plan 两条规则都能直接触发——\n 门禁那时拿到的是崩溃不是判定，落到消费侧是 500 不是拒绝。现在两侧都先按 unknown 体检：\n 定义非对象 → WORKFLOW_DEFINITION_INVALID，请求非对象或归属三件套非空串 → WORKFLOW_ATTRIBUTION_REQUIRED。\n\n2. 放行面三处脏值倒向合格。timeoutSeconds: \"abc\" 因 \"abc\" \u003c= 0 为 false 而合格；\n irreversibleEffect: 0 被当成可逆，整条不可逆效果的幂等键要求随之失效；steps: [] 的「流程」也合格，\n approved 快照喂进来就是一份零命令的 PLAN。现在 timeout 必须是正整数、irreversibleEffect 必须是布尔、\n 零步骤 → WORKFLOW_STEPS_REQUIRED。\n\n3. 判定面在两处确有扩张，都是本规则自己没做到自己的红线。FLOW-01 Eligibility 是开发计划写死的\n 第一道闸（「拒绝把域内定时任务和单域状态机迁入平台」），但迁入版只数 domains 声明了几个域，\n 不数步骤实际落在几个域——把单域状态机的 domains 写成两个即可整条绕过，实测\n {domains:[\"hr\",\"identity\"], steps:[两步都 ownerDomain:\"hr\"]} 判 ELIGIBLE。现在 Owner 面体检通过后\n 再数步骤真实跨度，沿用 NOT_CROSS_DOMAIN 不新增原因码。另一条红线写「不可逆外部效果使用独立\n effect idempotency，平台重放不得重复付款、通知」，但两个不可逆步骤共用同一把键时无人拦，\n 一次效果的幂等记录会压掉另一次 → 新增 EFFECT_IDEMPOTENCY_NOT_UNIQUE。\n\n4. 第三条扩张在 governed 步骤一侧：不可逆步骤既无同 Owner 补偿又不开人工接管时此前照常编进波次，\n 而退出门要求「每步唯一 Owner、timeout 和恢复责任明确」，这种步骤失败后没有任何恢复责任人 →\n STEP_RECOVERY_RESPONSIBILITY_REQUIRED。补偿仍是可选项：人工接管或补偿有其一即可，\n 可逆步骤不受约束，两条都有正向用例钉住。\n\n另修一处诊断损失：normalizeSnapshot 把定义体检的多条原因只抛第一条，改为逐条抛出。\n合法定义与合法请求的判定结果逐字不变，迁入的 11 例单测断言一条未改。\n\n覆盖：定向测试 11 → 22 例，补强用例另起两节；夹具 7 → 16 例（正 2 / 反 14），并给原 N01—N05\n补 reasons 声明——此前只断言「拒绝」，换一条原因拒绝也算过。\n\n未做（越界，已在 SOURCE.md 与蓝图增量节写明）：流程实例、持久调度、补偿执行器、Timer、\nOwner Adapter 与 M5 分工一件未建，按缺失模块完善清单 C15 卡在运行宿主 Q01 与 G4，本轮仍是契约包形态，\n不代表编排平台上线；Catalog 登记一律未动（仍 candidate_e0 / E0）；步骤 Permission 的资源归属仍不校验\n（ownerDomain \"hr\" 的步骤声明 identity 资源照样编进计划，而资源名与域的绑定在本包里没有可判定的真源，\n纯规则读不到 catalogs/permissions.json）；commandIdempotencyKey 含定义版本号，同一实例升版重放会换键，\n不可逆效果由不含版本的 effectIdempotencyKey 兜底，改它属运行宿主裁决时一并定的事。\n\n证据：在仅含本提交改动的导出树上 tsc 与 typecheck 绿、定向 22/22、contract-cross-domain-workflow\n夹具 16/16；负向实测把 N07-declared-domains-without-real-owner-span 的声明原因改成 WORKFLOW_CYCLE，\n门禁 exit 1 并点名该例（reasons=[\"NOT_CROSS_DOMAIN\"]），还原后转绿。导出树里 governance-linter.test.mjs\n因 /tmp 下工作区根不可解析而失败，pristine HEAD 导出树同样失败，与本次改动无关；真实工作树\ncontracts:check:local 330/330、check:fixtures 17 套件 227 例 0 失败。工作树另有并行会话的 WIP，\n故本次不回绑任何 reports/。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/13c7eb7271af67df9d0b4e5223bda3eaa4ab7b10","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:42:22-07:00","added":[],"removed":[],"modified":["contracts/SOURCE.md","contracts/src/domain/cross-domain-workflow/workflow-definition.ts","contracts/src/domain/cross-domain-workflow/workflow-planner.ts","contracts/test/cross-domain-workflow-domain.test.mjs","contracts/test/fixtures/cross-domain-workflow.fixtures.json","docs/domain/workflow-definition-blueprint.md"]},{"id":"5720165763b35035e6778fe9a802493a16eb5aca","message":"fix(contracts): 会话准入规则补入参体检——四条 fail-open 与一处「兜底自己会抛」收口\n\n九项契约包自 2026-09-14 迁入以来一直是「原样迁入、未改语义」，本条是第一次动判定。\n起因是对 collaboration-messaging 逐条实测而非读代码：迁入版把策略快照一侧校验到底\n（normalizeSnapshot 逐字段抛并被工厂捕获），请求一侧整个信任声明类型，而声明类型\n约束不了 HTTP 与夹具送进来的 JSON。五条缺陷均可复现，且都打在该能力自己 README 的\n「最小验收」与蓝图的「失败闭合」上：\n\n1. 抛而不拒。三个导出在畸形 JSON 下抛 TypeError 而不是返回 REJECT。兜底的 bundled\n deny-all 也不例外——createRuntimeConversationAdmissionPlanner().plan({}) 抛异常，\n 即「什么都不放行」的最后一道在畸形入参下等于没有。\n\n2. 未知 senderType 放行，且 \"AI_AGENT\"（只改大小写）同样放行。AI_ATTRIBUTION_REQUIRED\n 只在严格等于 ai_agent 时触发，于是「AI 不得冒充人员」有一条改大小写就能走的绕过路径。\n 不做大小写归一化——归一化等于替冒充者补齐形状。\n\n3. 游标不绑定会话。ConversationAppendState 有 expectedTenantId 却没有会话标识，拿 conv-1\n 的游标判 conv-9 的消息得到 APPEND，planner 直接 ADMIT 并按 conv-9 生成幂等键；重复与\n 序列 Gap 判定全程可能在读另一个会话的账本。\n\n4. processedMessageIds 传成字符串时 includes 退化为子串判断，幂等两个方向都错：\n \"msg-1\" 不含 \"msg-2\" 则漏判重复，\"msg-1,msg-2\" 含则误判重复。\n\n5. memberActive 传成真值字符串即算在籍（原判据 !state.memberActive，\"false\" 是真值）。\n\n附带：hasAttachment 非布尔即拒。此前缺字段时 attachmentAuthorizationRequired 是\nundefined，下游 if (plan.attachmentAuthorizationRequired) 就跳过公共文件平台重新授权，\n等于「缺字段 = 不需要授权」。\n\n改法只收紧失败一侧，合法输入的判定结果逐字不变：迁入的 16 例断言一条未改，只给游标补了\n新的必填字段。expectedConversationId 做成必填而不是「在场才查」——可选只能拦住已经想起来\n要绑定的调用方，拦不住忘了的那个，而忘了的那个正是第 3 条的全部成因；破坏面可枚举且全在\n仓内（本包测试与夹具各一处），Catalog 上该项 candidate_e0 / code_truth 指向本目录 /\n上层真实消费者为零。ConversationAppendDecision 新增 CONVERSATION_BINDING_REQUIRED /\nCONVERSATION_MISMATCH / STATE_INVALID 三档（原先「序列非整数」复用 REJECT，与「消息体检\n未过」同码，改后 REJECT 专指后者）；planner 新增 REQUEST_SHAPE_INVALID /\nATTACHMENT_FLAG_INVALID 两条原因与两条映射。新增原因一律排在既有原因之后判定，既有原因码\n的优先级未动。\n\n顺带修一条证据登记缺口：reports/fixtures.latest.json 的作用域只写到 runtime/modules，\n九个契约包套件的两类输入整个在作用域外——夹具用例在 contracts/test/fixtures/，判定用的\nevaluateFixturePayload 在 contracts/src/domain/。作用域写于只有运行时模块有夹具的时候，\n2026-09-14 迁入时没随迁，后果是改夹具或改规则都不会让这份报告过期，而它正是这九项在\nCatalog 上登记的证据之一。实据不用构造：本轮改动与并行会话的 public-file 改动同时在树上，\ncheck:evidence 仍不点它。补两条后该报告立刻转 EVIDENCE_WORKTREE_CHANGED，check:evidence\n由 4 条过期变 6 条——多出来的不是新问题，是此前看不见的问题。\n\n核验：contracts test 285 → 292（我的增量 +7，既有断言未改；树上现读 330，多出的是并行会话\n在途改动）；check:fixtures 本套件 8 → 14 例（正 2 / 反 12）0 失败；负向实做：把 N11 的声明\n原因改成不会产生的串，门禁 exit 1 并点名该例，还原后 exit 0；governance 测试 340/340；\n工作区一致性 L4 / L10 / L13 均 0。\n\n未做（越界）：会话 / 成员 / 消息账本、长连接服务、Fact、独立运行服务一件未建——按缺失模块\n完善清单 C16 卡在「裁决 · 实现」，前置是 Owner ADR、三消费者与 G4。Catalog 的\nimplementation_state / evidence_level / code_truth / evidence 一律未动（改登记须 CHG）。\n蓝图迁入原文逐字未改，硬化增量另起一节附在其后。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/5720165763b35035e6778fe9a802493a16eb5aca","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:41:37-07:00","added":[],"removed":[],"modified":["contracts/SOURCE.md","contracts/src/domain/collaboration-messaging/conversation-admission-planner.ts","contracts/src/domain/collaboration-messaging/conversation-message.ts","contracts/src/domain/collaboration-messaging/fixture-evaluator.ts","contracts/test/collaboration-messaging-domain.test.mjs","contracts/test/fixtures/collaboration-messaging.fixtures.json","docs/domain/conversation-message-blueprint.md","governance/evidence-scopes.json"]},{"id":"793d0a106f07c2b9974991a2a5953fdebc5be1b3","message":"fix(contracts): 公共文件规则补入参体检——plan 遇畸形请求此前抛 TypeError，非布尔授权位此前被判成放行\n\n迁入版本在「入参可信」的前提下是对的，但本能力的实际入口是 JSON：夹具评估器、策略快照、\n三个消费仓的载荷都从反序列化来，TS 类型只在编译期成立。判定面没有扩张，改的只是拿到脏值时往哪边倒。\n\n三个缺口（均有实测，非读代码推断）：\n\n1. `LocalPublicFileAccessPlanner.plan()` 遇畸形请求抛 TypeError 而不是拒绝。补强前 dist 实测\n `plan({})` → `TypeError: Cannot read properties of undefined (reading 'trim')`，`plan(null)`\n 与缺 `file` 的请求同理。蓝图写的「失败闭合」只覆盖快照畸形（bundled deny-all），没覆盖请求畸形——\n 抛异常落到消费侧是 500，不是拒绝。现按同包 `webhook-delivery-planner.plan()` 的既有先例先体检请求：\n 非对象 → FILE_ACCESS_REQUEST_INVALID，归属三件套缺失或非字符串 → FILE_ACCESS_ATTRIBUTION_REQUIRED，\n `file` 不是对象 → FILE_REFERENCE_INVALID。\n\n2. 非布尔的授权位被判成放行。`if (!context.permissionGranted)` 对 \"false\" / 1 / {} 全部放行；\n `authorizationVersion \u003c requiredAuthorizationVersion` 与 `expiresAt \u003c= now` 在另一端缺失时都是 false，\n 即「比不出来」被当成「比过了」。现在授权位只认字面 true，两个比较的两端都必须是整数。\n\n3. `PublicFileRef.version` 声明为 \"v1\" 却从来没被校验，换版本的引用会被 v1 判定顺带放行。\n 加 FILE_REF_VERSION_UNSUPPORTED。\n\n覆盖：夹具评估器不再先把缺字段补成 \"\" / NaN（那层补齐等于夹具永远喂不进脏值，而脏值正是这次要固定的\n那一侧），payload 原样交给规则；新增 refresh 规则——planner 第三个公开方法此前在门禁上零覆盖。\n夹具 13 → 29 例（正 4 / 反 25），补齐六条此前只有单测、门禁上没有的策略白名单原因，以及\nFILE_ACCESS_ATTRIBUTION_REQUIRED / FILE_TENANT_NOT_ALLOWED 两条此前任何地方都没覆盖的原因；\n定向测试 15 → 22 例，迁入的 15 例一条未改。\n\n未做（需 CHG，已在 index.ts 抬头与 SOURCE.md 写明，不再沿用旧措辞）：\nschemas/public-file-ref.v1.schema.json（version=1 数字 + ownerEntity*/storageRef）与本目录的\nPublicFileRef（version=\"v1\" 字符串 + sha256/size/mimeType/scanStatus）不是同一个对象——一份通得过\nSchema 的引用喂不进 assessPublicFileRef，反之亦然。合并属契约变更，不在本次范围。Catalog 登记未动\n（public-file 仍 module_e2、code_truth 指向工单仓 packages/attachments），三个消费仓的副本未同步本次补强。\n\n证据：在仅含本提交改动的导出树上 tsc 绿、定向 22/22、contract-public-file 夹具 29/29；\n工作树另有并行会话的 WIP，故本次不回绑任何 reports/。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/793d0a106f07c2b9974991a2a5953fdebc5be1b3","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:38:28-07:00","added":[],"removed":[],"modified":["contracts/SOURCE.md","contracts/src/domain/public-file/fixture-evaluator.ts","contracts/src/domain/public-file/index.ts","contracts/src/domain/public-file/public-file-access-planner.ts","contracts/src/domain/public-file/public-file-ref.ts","contracts/test/fixtures/public-file.fixtures.json","contracts/test/public-file-domain.test.mjs","docs/domain/public-file-ref-blueprint.md"]}],"total_commits":0,"head_commit":{"id":"c190a6ab5d2c50e4c90f027bbcca72f1f3050005","message":"fix(contracts): 通知与 Webhook 规则补入参体检——一处倒向放行、两处崩溃面与目标地址的同义写法\n\n迁入版把策略快照一侧校验到底（normalizeSnapshot 逐字段抛），请求一侧、目标地址一侧与夹具评估器三处漏风。\n补强前对 dist 逐条实测：\n\n- 放行面（唯一一处方向倒向放行）：三个状态位按真值判，`replayAuthorized: \"false\"` 在 `!value` 下为 false，\n 未授权重放被判成已授权 → DELIVER；planner 原样透传这三位，计划面同样通。现在只认布尔字面量。\n- 崩溃面：classifyNotificationEffect(undefined) / classifyProviderOutcome(undefined) 抛 TypeError 而不是拒绝，\n 夹具的 effect / provider 两条规则都能直接触发——门禁那时拿到的是异常不是判定，落到消费侧是 500 不是拒绝。\n- 目标地址（C08.05 / 蓝图「私网地址失败关闭」）：isPrivateLiteral 只认四段十进制，2130706433 / 0x7f000001 /\n 0177.0.0.1 / 127.1 全判成公网；0.0.0.0/8、CGNAT 100.64/10、组播与保留段、.internal、末尾点均未覆盖。\n 现在数字形主机一律按 IP 字面量处理，只放行严格四段十进制的公网地址；allowedHosts 自己先过这道地板\n （WEBHOOK_ALLOWED_HOST_NOT_PUBLIC），小写归一后再查一次重名。\n- 本次唯一放宽的一处，据实登记：迁入版按字符串前缀 fc / fd / fe80 判私网 IPv6，fc-portal.example.com 这类\n 正常域名被误判成私网。改判后它可用，但仍须先进运营批准的 allowlist 且为 HTTPS，不构成新的可达面。\n- 死代码：WEBHOOK_TENANT_WILDCARD_FORBIDDEN 写在字符集校验之后，`*` 永远先报 WEBHOOK_ROUTE_TENANTS_INVALID，\n 蓝图写明的「tenant allowlist 禁止 *」从未以自己的名义拦下过。\n- 退避：decideProviderOutcome 原取 min(maximumBackoff, retryAfter)，供应商回一个 Retry-After: 0 即可把批准过的\n 退避清零。现在外部回执只能把退避拉长到策略上界，上界语义与既有用例逐字不变。\n- 夹具评估器把两种非放行当成放行：SKIP_DUPLICATE 与 DLQ 都没有 reasons 字段，被 `\"reasons\" in r` 判成空数组\n = ACCEPT，与该文件自己第一句「只有 DELIVER / DELIVERED 算放行」正相反。另补 refresh 规则。\n- effect_id 改为强校验：五段必须是规范标识符（因此不含 :），否则 a:b+c 与 a+b:c 会拼出同一个 id；\n 请求一侧的标识符不再先 trim 再判定。\n\n合法快照与合法请求的判定结果逐字不变：迁入的 14 例断言一条未改。单测 14 → 24 例；夹具 8 → 17 例，并修好\n名不副实的 N06-plan-without-policy-denies-all——它此前只喂了两个字段的请求，压根走不到「无策略即拒」那一步。\n\n核验（工作树 dirty，报告未回绑，只绑本地）：contracts build / typecheck 绿、本域单测 24/24、\ncontracts/test/*.test.mjs 330/330、check:fixtures 17 套件 236 例 0 失败 0 不可用（本域 17/17；用临时报告名跑，\n跑完删除，reports/ 未动）。负向实测两次：① 把 HEAD 版三支规则单独编译后喂新夹具，8 例新增负例全部不通过\n（N07/N10/N11 直接放行、N08/N09 抛 TypeError、N12 换原因、N13/N14 旧评估器不识别 refresh）；\n② 篡改 N10 的声明原因 → 门禁 exit 1 并点名该例，翻 expect → 被 id/expect 一致性先挡下，还原后 exit 0。\n\n未做：缺失模块完善清单 C12 的模板审批 / 多渠道 Provider / 签名防重放 / 渠道切换本仓仍一件没有（该行类型是\n「裁决」，前置是运行宿主 Q01），本轮仍是契约包形态，不代表通知服务上线；Catalog 登记未动（仍 module_e2，\ncode_truth 指工单仓 packages/notification-delivery）；三个消费仓的 packages/notification-delivery 未同步；\n入站回调验签（C12.05）与 UNKNOWN 回执（C12.04）属判定面扩张，只登记未实现。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/c190a6ab5d2c50e4c90f027bbcca72f1f3050005","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:43:48-07:00","added":["contracts/src/domain/notification-webhook/value-guards.ts"],"removed":[],"modified":["contracts/SOURCE.md","contracts/src/domain/notification-webhook/fixture-evaluator.ts","contracts/src/domain/notification-webhook/notification-effect.ts","contracts/src/domain/notification-webhook/webhook-delivery-planner.ts","contracts/test/fixtures/notification-webhook.fixtures.json","contracts/test/notification-webhook-domain.test.mjs"]},"repository":{"id":116,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"enterprise-platform","full_name":"luoanwu/enterprise-platform","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":18768,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/languages","html_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/enterprise-platform.git","clone_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform.git","original_url":"","website":"","stars_count":0,"forks_count":0,"watchers_count":1,"branch_count":43,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-09-11T07:33:25+08:00","updated_at":"2026-09-18T22:43:29+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"}}...
|
push
|
2
|
34
|
1789742678
|
1789742716
|
0
|
1789742672
|
1789742745
|
group: platform-${{ github.workflow }}-${{ github. group: platform-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
...
|
platform-platform.yml-refs/heads/main
|
0
|
Edit
Delete
|
|
24136
|
chore(reports): 入口门禁与工作台两份快照回绑 @ a9abcbe
|
116
|
5
|
platform.yml
|
121
|
5
|
0
|
refs/heads/main
|
e8fda74e279a5884440d5efaac2265e513c814b6
|
0
|
0
|
0
|
push
|
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"c190a6ab5d2c50e4c90f027bbcca72f1f3050005","after":"e8fda74e279a5884440d5efaac2265e513c814b6","compare_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/compare/c190a6ab5d2c50e4c90f027bbcca72f1f3050005...e8fda74e279a5884440d5efaac2265e513c814b6","commits":[{"id":"e8fda74e279a5884440d5efaac2265e513c814b6","message":"chore(reports): 入口门禁与工作台两份快照回绑 @ a9abcbe\n\n在 a9abcbe 的干净 detached 检出里重跑（governance/rebind-reports.mjs --gates caddy,workbench-snapshots，\n带 CHECK_CADDY_DOCKER=1），三份均 provenance.gitSha=a9abcbe / worktreeDirty=false。\n\n- reports/caddy.latest.json：0 违规。12 个 HTTP 契约前缀 × 2 profile 全覆盖；新增的 routing 段逐条记下\n 模拟出来的块链，13 条登记前缀（11 个去重契约前缀 + 2 个长连接前缀）全部到达 {$PLATFORM_API_UPSTREAM}；\n workbenchGuard.reached=true / conditionalBefore=0；语法校验 dev / staging 均 passed，via docker，\n 镜像 caddy@sha256:5f5c8640…d58648（compose 锁定的那一个，不再是浮动 tag）。\n- reports/workbench-catalog-snapshot.latest.json：只有 provenance 变。caddy-routes.json 进了它的作用域\n （新增 validate / mount 段），被 check:evidence 判过期，但快照只吃 routes.contracts，内容逐字未变——\n 重建后与旧版按字段比对一致，已实测。\n- reports/workbench-ops-snapshot.latest.json：与 catalog 同一脚本产出，必须一起带回（分开会绑不同提交）。\n 它有一处内容变化不由本轮改动引起：image 段从 d8f09205 / sha256:fe418667… 更新到 05e3826e /\n sha256:c0869934…，来源是 06c3d4c 已提交的 reports/image-digest.json——此前那份快照相对该提交是旧的。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/e8fda74e279a5884440d5efaac2265e513c814b6","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:46:25-07:00","added":[],"removed":[],"modified":["reports/caddy.latest.json","reports/workbench-catalog-snapshot.latest.json","reports/workbench-ops-snapshot.latest.json"]},{"id":"a9abcbe392de8a903512ab4b25529a6e277113ee","message":"feat(gateway): 入口门禁改为解析块树后模拟路由——「文件里配了」不等于「这条路径上生效」\n\nC08 应用群网关是采纳形态，判定在 Caddyfile 这份配置里，由 check-caddy 守。它此前是逐行正则：\n某条指令在文件里出现过就算配了。本轮不动入口运行行为（两份 Caddyfile 一个字没改），只把它\n自己在注释里写明判不了的那一类失效变成静态判定。\n\n逐行正则判不出来的三件事：\n- 有个更靠前的 handle 块把 /api/platform/* 截走——入口鉴权配得好好的，请求根本走不到它。\n caddy-routes.json 的 workbench.note 原文是「这种绕过只能靠运行态探针发现」。\n- 请求体上限 / 上游超时 / request-id 注入写在别的块里，门禁全绿，平台路由上一层保护都没有。\n BODY_LIMIT_MISSING 这类规则问的是「文件里有没有」，不是「这条路由上有没有」。\n- 契约前缀有匹配器、但请求先被别人服务了：ROUTE_UNCOVERED 绿，流量到不了 API。\n\n新增块树解析（tokenizeLine / parseCaddyfile：`{` 只有作为行末独立 token 才开块，占位符\n{$VAR} 与 {http.request.uuid} 是 token 内部的花括号）与路由模拟（按 Caddy 的 handle 互斥语义\n与指令序，逐层并入命名匹配器），据此新增：\n- ROUTE_SHADOWED 前缀有匹配器但被更靠前的 handler 截走，到不了 {$PLATFORM_API_UPSTREAM}\n- WORKBENCH_AUTH_BYPASS 被守护前缀在到达 forward_auth 所在块之前就被别的 handler 服务了；\n 更靠前的 handler 若条件不是纯路径（header / method / file），按「可能截走」同样判红\n- INGRESS_GUARD_OUT_OF_SCOPE 入口约定在文件里有，却不在服务该前缀的那条块链上\n- STREAMING_ROUTE_UNCOVERED 登记的长连接前缀没被路由到上游（与「禁 read_timeout」凑成一对）\n- CADDYFILE_UNPARSED 花括号不配平 / 没有站点块——判不了就报，不静默通过\n\n同轮补三条登记面的：\n- PROFILE_MOUNT_UNBOUND profile 的 Caddyfile 没被登记的 compose 挂进入口容器。staging 那份此前\n 只被校验、没人核对它有没有被 overlay 加载；校验一份没人加载的配置等于没校验。\n- CADDY_IMAGE_UNPINNED compose 的入口镜像不是 digest 锁定。docker 校验原先写死浮动 tag\n caddy:2-alpine，而跑的是锁定镜像——拿另一个版本的 Caddy 校验，过了也\n 不代表运行的那个认它。现在从 compose 取镜像，取不到即 skipped，不退回浮动 tag。\n- ROUTE_MAPPING_ORPHANED 登记表映射了 modules.json 里已不存在的契约（CONTRACT_UNMAPPED 的反向死登记）\n\nstripComments 按 Caddy 口径重写：引号内的 # 是字面量，# 只有在 token 开头才起注释——原先一刀切到\n第一个 #，会把 respond \"a#b\" 这类值截半，反过来让门禁看不见后面真实生效的指令。\nevidence-scopes 的 caddy 作用域补进 stack/compose.yaml 与 stack/overlays/staging.yaml：结论现在\n也取决于「挂没挂进容器」和「校验用的是不是那个镜像」，这两个输入一改结论就可能不再成立。\n\n核验（工作树 dirty，报告未回绑，只绑本地）：\n- CHECK_CADDY_DOCKER=1 check:caddy exit 0：12 个 HTTP 契约前缀 × 2 profile 全覆盖；模拟路由 13 条\n 前缀（11 个去重契约前缀 + 2 个长连接前缀）全部到达上游且入口约定就在各自链上；\n workbenchGuard.reached=true；两份 Caddyfile 语法均 passed，镜像 caddy@sha256:5f5c8640…d58648\n （= compose 锁定、dev 常驻容器正在跑的那一个）。\n- check-caddy.test.mjs 19 → 37 例，每条新规则都有篡改夹具且夹具断言「确实改到了」。两例专门对照\n 旧规则：插入抢先的 handle 后 evaluateCaddyfile / evaluateWorkbench 仍全绿，新规则判红。\n- 与真实 Caddy 对照（同一 digest 镜像，两个一次性容器，上游指向死端口）：真实基线\n GET /api/platform/probe → 502（forward_auth 去校验，没放行）；插入抢先 handle 的那份 → 200\n 「bypassed」，门禁判红。同一份里 /api/v1/decisions 仍 502，截走范围与模拟一致。\n- 一处自测抓到的实现缺陷：scopeNodes 顶层那一跳没挡 handler 分支，\"别的块里配了也算数\"——\n 正是要判的那种失效；已修并由「请求体上限挪到别的块」一例钉住。另一例钉住命名匹配器声明在\n 里层块时必须判得动（撤掉修复即落在 reverse_proxy 而非 respond，实测过）。\n- 回归：governance 全套 340/340；工作区一致性门禁只余既有 L9 compose 重名 1 条，与本轮无关。\n\n未做：G-3 限流要 caddy-ratelimit 插件即自建镜像，会打破 digest 锁定的官方镜像，是 stack 决策；\nHTTP 方法白名单归属 2026-09-16 已裁为不阻塞退役、转 stack 待办；C08.04 East-West 身份、C08.05\nWebhook ingress 与 Egress SSRF、C08.06 外发 / WAF / HA 全无落点（Q03）。静态判定的边界据实登记：\n非路径条件只能判「可能」，route 只作近似，每个前缀只探一条代表路径（/t/\u003ctenant\u003e/login 这类\n「有意分流一部分」不在判定范围），入口鉴权仍挡不住文档导航——运行态探针仍是必要补充。\n\n报告回绑另起 chore(reports) 提交（仓纪律 5）。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/a9abcbe392de8a903512ab4b25529a6e277113ee","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:45:36-07:00","added":["docs/应用群网关门禁结构感知-2026-09-18.md"],"removed":[],"modified":["docs/工作台同源托管与入口鉴权实现记录-2026-09-18.md","governance/caddy-routes.json","governance/check-caddy.mjs","governance/evidence-scopes.json","governance/test/check-caddy.test.mjs"]}],"total_commits":0,"head_commit":{"id":"e8fda74e279a5884440d5efaac2265e513c814b6","message":"chore(reports): 入口门禁与工作台两份快照回绑 @ a9abcbe\n\n在 a9abcbe 的干净 detached 检出里重跑（governance/rebind-reports.mjs --gates caddy,workbench-snapshots，\n带 CHECK_CADDY_DOCKER=1），三份均 provenance.gitSha=a9abcbe / worktreeDirty=false。\n\n- reports/caddy.latest.json：0 违规。12 个 HTTP 契约前缀 × 2 profile 全覆盖；新增的 routing 段逐条记下\n 模拟出来的块链，13 条登记前缀（11 个去重契约前缀 + 2 个长连接前缀）全部到达 {$PLATFORM_API_UPSTREAM}；\n workbenchGuard.reached=true / conditionalBefore=0；语法校验 dev / staging 均 passed，via docker，\n 镜像 caddy@sha256:5f5c8640…d58648（compose 锁定的那一个，不再是浮动 tag）。\n- reports/workbench-catalog-snapshot.latest.json：只有 provenance 变。caddy-routes.json 进了它的作用域\n （新增 validate / mount 段），被 check:evidence 判过期，但快照只吃 routes.contracts，内容逐字未变——\n 重建后与旧版按字段比对一致，已实测。\n- reports/workbench-ops-snapshot.latest.json：与 catalog 同一脚本产出，必须一起带回（分开会绑不同提交）。\n 它有一处内容变化不由本轮改动引起：image 段从 d8f09205 / sha256:fe418667… 更新到 05e3826e /\n sha256:c0869934…，来源是 06c3d4c 已提交的 reports/image-digest.json——此前那份快照相对该提交是旧的。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/e8fda74e279a5884440d5efaac2265e513c814b6","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:46:25-07:00","added":[],"removed":[],"modified":["reports/caddy.latest.json","reports/workbench-catalog-snapshot.latest.json","reports/workbench-ops-snapshot.latest.json"]},"repository":{"id":116,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"enterprise-platform","full_name":"luoanwu/enterprise-platform","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":18935,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/languages","html_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/enterprise-platform.git","clone_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform.git","original_url":"","website":"","stars_count":0,"forks_count":0,"watchers_count":1,"branch_count":43,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-09-11T07:33:25+08:00","updated_at":"2026-09-18T22:44:32+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"}}...
|
push
|
3
|
29
|
1789742875
|
1789742912
|
0
|
1789742873
|
1789742926
|
group: platform-${{ github.workflow }}-${{ github. group: platform-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
...
|
platform-platform.yml-refs/heads/main
|
0
|
Edit
Delete
|
|
24137
|
fix(contracts): 注册中心规则补失败关闭与摘要规范化——三个入口此前抛 TypeErr fix(contracts): 注册中心规则补失败关闭与摘要规范化——三个入口此前抛 TypeError，同一摘要的两种写法此前分叉成两个复核键...
|
116
|
5
|
platform.yml
|
122
|
5
|
0
|
refs/pull/1/head
|
92a6b8e647c2c4d764c1fcdb8448bfc48a4dc4ed
|
0
|
0
|
0
|
pull_request
|
{"action":"opened","number" {"action":"opened","number":1,"pull_request":{"id":163,"url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/pulls/1","number":1,"user":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"title":"fix(contracts): 注册中心规则补失败关闭与摘要规范化——三个入口此前抛 TypeError，同一摘要的两种写法此前分叉成两个复核键","body":"蓝图 docs/domain/registry-snapshot-blueprint.md 从迁入起就写着「失败关闭」与\r\n「review key 仅用于人工复核幂等」两条不变量，实测三处不成立。本次按蓝图自己的口径补齐，\r\n改动只在 contracts/src/domain/application-contract-registry/：不新增写入点、不新增宿主、\r\n不动 Catalog 与 Schema，每条输出仍固定 activationAllowed=false / registryWriteAllowed=false /\r\nhumanApprovalRequired=true。\r\n\r\n1. 失败关闭：assessRegistrySnapshot / assessRegistryTransition /\r\n reviewCandidateSnapshotUpgrade 对畸形输入抛 TypeError（快照缺字段、now 不是 Date、\r\n decisions 整个缺失都会抛），四个入口里只有 LocalManifestAdmissionPlanner.plan 是\r\n 失败关闭的。现四个入口一致返回 REJECT + 原因码。这不是洁癖：check-fixtures 把抛出当\r\n 配置错误处理，实测一次 TypeError 会让整套 15 例逐例判定塌成一条 configuration 失败。\r\n\r\n2. 十六进制引用规范化：digest / commit 的正则带 /i 收大小写两种写法，比较与入键却\r\n 大小写敏感——同一摘要写成大写会得到另一个 reviewIdempotencyKey，同版本大小写翻转被判成\r\n SAME_VERSION_DIGEST_CHANGED，大写回滚 pin 被判成 ROLLBACK_PIN_MUST_MATCH_CURRENT。\r\n 现一律规范化为小写后再比较、再入键，ACCEPT 回吐规范化后的值。\r\n\r\n3. 版本文法收敛：一个模块三套（快照流与清单准入用 \\d+\\.\\d+\\.\\d+，升级复核用严格 SemVer），\r\n 新增 registry-primitives.ts 作单一来源，含预发布序；DEC-009—012 此前在两份文件各写一份，\r\n 一并收敛。snapshot-upgrade-review.ts 因此净减约 60 行重复实现。\r\n\r\n两处语义变化（蓝图新增一节已如实登记）：\r\n- 收紧：1.02.0 这类前导零版本此前被放行，现在拒；assessRegistrySnapshot 另开始拒 latest\r\n 这类可变标签——此前它能过体检却必然过不了迁移规则。\r\n- 放宽：1.0.0-rc.1 这类预发布版本此前被快照流整条挡在外面，现在按 SemVer 序参与迁移。\r\n 平台自己发的就是 1.0.0-rc.N，升级复核那一侧本来就这么判。风险面有限：本模块所有出口\r\n 都不激活、不写 Registry，多进人工复核队列不等于多放行制品。\r\n\r\n证据（本分支隔离工作树，clean）：注册中心单测 44/44（原 34 + 加固 10）；\r\ncontracts check:local 302/302；check:fixtures 九个契约域套件 100 例 0 失败，\r\n其中本套件 15 例（正 4 / 反 11，原 8 例）。篡改必红实测两次：sameHexRef 退回大小写敏感\r\n→ 单测 1 红 + 夹具 P03 红；去掉快照入口守卫 → 整套塌成 0 例 1 配置失败。\r\n\r\n仍为仓内候选 sdk_e2，不代表正式 Registry、Snapshot 发布或跨仓 Required Check 已上线。\r\n清单登记的 C01.04 / C01.06 是「接线」型缺口且前置 Q01 运行宿主未裁，本次未动。\r\nreports/fixtures.latest.json 未回绑：它是 17 套件的聚合报告，只跑 9 个套件去覆盖会缩小结论面，\r\n应在整批（含并行会话的 public-file / IM / 跨域流程改动）落定后统一重跑回绑。\r\n\r\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e","labels":[],"milestone":null,"assignee":null,"assignees":[],"requested_reviewers":[],"requested_reviewers_teams":[],"state":"open","draft":false,"is_locked":false,"comments":0,"additions":520,"deletions":144,"changed_files":9,"html_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/pulls/1","diff_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/pulls/1.diff","patch_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/pulls/1.patch","mergeable":true,"merged":false,"merged_at":null,"merge_commit_sha":null,"merged_by":null,"allow_maintainer_edit":false,"base":{"label":"main","ref":"main","sha":"e8fda74e279a5884440d5efaac2265e513c814b6","repo_id":116,"repo":{"id":116,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"enterprise-platform","full_name":"luoanwu/enterprise-platform","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":19008,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/languages","html_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/enterprise-platform.git","clone_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform.git","original_url":"","website":"","stars_count":0,"forks_count":0,"watchers_count":1,"branch_count":43,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-09-11T07:33:25+08:00","updated_at":"2026-09-18T22:47:53+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":false,"push":false,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]}},"head":{"label":"feat/registry-rule-hardening","ref":"feat/registry-rule-hardening","sha":"92a6b8e647c2c4d764c1fcdb8448bfc48a4dc4ed","repo_id":116,"repo":{"id":116,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"enterprise-platform","full_name":"luoanwu/enterprise-platform","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":19008,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/languages","html_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/enterprise-platform.git","clone_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform.git","original_url":"","website":"","stars_count":0,"forks_count":0,"watchers_count":1,"branch_count":43,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-09-11T07:33:25+08:00","updated_at":"2026-09-18T22:47:53+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":false,"push":false,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]}},"merge_base":"793d0a106f07c2b9974991a2a5953fdebc5be1b3","due_date":null,"created_at":"2026-09-18T22:48:38+08:00","updated_at":"2026-09-18T22:48:38+08:00","closed_at":null,"pin_order":0},"requested_reviewer":null,"repository":{"id":116,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"enterprise-platform","full_name":"luoanwu/enterprise-platform","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":19008,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/languages","html_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/enterprise-platform.git","clone_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform.git","original_url":"","website":"","stars_count":0,"forks_count":0,"watchers_count":1,"branch_count":43,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-09-11T07:33:25+08:00","updated_at":"2026-09-18T22:47:53+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"commit_id":"","review":null}...
|
pull_request
|
2
|
30
|
1789742924
|
1789742961
|
0
|
1789742918
|
1789743036
|
group: platform-${{ github.workflow }}-${{ github. group: platform-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
...
|
platform-platform.yml-refs/pull/1/head
|
1
|
Edit
Delete
|
|
24138
|
Merge pull request 'fix(contracts): 注册中心规则补失败关 Merge pull request 'fix(contracts): 注册中心规则补失败关闭与摘要规范化——三个入口此前抛 TypeError，同一摘要的两种写法此前分叉成两个复核键' (#1) from feat/registry-rule-hardening into main...
|
116
|
5
|
platform.yml
|
123
|
5
|
0
|
refs/heads/main
|
b62945890987b341b65684046c6e4d8ae612c529
|
0
|
0
|
0
|
push
|
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"e8fda74e279a5884440d5efaac2265e513c814b6","after":"b62945890987b341b65684046c6e4d8ae612c529","compare_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/compare/e8fda74e279a5884440d5efaac2265e513c814b6...b62945890987b341b65684046c6e4d8ae612c529","commits":[{"id":"b62945890987b341b65684046c6e4d8ae612c529","message":"Merge pull request 'fix(contracts): 注册中心规则补失败关闭与摘要规范化——三个入口此前抛 TypeError，同一摘要的两种写法此前分叉成两个复核键' (#1) from feat/registry-rule-hardening into main\n\nReviewed-on: https://gitea.g-hi.com/luoanwu/enterprise-platform/pulls/1\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/b62945890987b341b65684046c6e4d8ae612c529","author":{"name":"luoanwu","email":"law@g-hi.com","username":"luoanwu"},"committer":{"name":"luoanwu","email":"law@g-hi.com","username":"luoanwu"},"verification":null,"timestamp":"2026-09-18T22:48:44+08:00","added":["contracts/src/domain/application-contract-registry/registry-primitives.ts"],"removed":[],"modified":["contracts/src/domain/application-contract-registry/fixture-evaluator.ts","contracts/src/domain/application-contract-registry/index.ts","contracts/src/domain/application-contract-registry/manifest-admission-planner.ts","contracts/src/domain/application-contract-registry/registry-snapshot.ts","contracts/src/domain/application-contract-registry/snapshot-upgrade-review.ts","contracts/test/application-contract-registry-domain.test.mjs","contracts/test/fixtures/application-contract-registry.fixtures.json","docs/domain/registry-snapshot-blueprint.md"]},{"id":"92a6b8e647c2c4d764c1fcdb8448bfc48a4dc4ed","message":"fix(contracts): 注册中心规则补失败关闭与摘要规范化——三个入口此前抛 TypeError，同一摘要的两种写法此前分叉成两个复核键\n\n蓝图 docs/domain/registry-snapshot-blueprint.md 从迁入起就写着「失败关闭」与\n「review key 仅用于人工复核幂等」两条不变量，实测三处不成立。本次按蓝图自己的口径补齐，\n改动只在 contracts/src/domain/application-contract-registry/：不新增写入点、不新增宿主、\n不动 Catalog 与 Schema，每条输出仍固定 activationAllowed=false / registryWriteAllowed=false /\nhumanApprovalRequired=true。\n\n1. 失败关闭：assessRegistrySnapshot / assessRegistryTransition /\n reviewCandidateSnapshotUpgrade 对畸形输入抛 TypeError（快照缺字段、now 不是 Date、\n decisions 整个缺失都会抛），四个入口里只有 LocalManifestAdmissionPlanner.plan 是\n 失败关闭的。现四个入口一致返回 REJECT + 原因码。这不是洁癖：check-fixtures 把抛出当\n 配置错误处理，实测一次 TypeError 会让整套 15 例逐例判定塌成一条 configuration 失败。\n\n2. 十六进制引用规范化：digest / commit 的正则带 /i 收大小写两种写法，比较与入键却\n 大小写敏感——同一摘要写成大写会得到另一个 reviewIdempotencyKey，同版本大小写翻转被判成\n SAME_VERSION_DIGEST_CHANGED，大写回滚 pin 被判成 ROLLBACK_PIN_MUST_MATCH_CURRENT。\n 现一律规范化为小写后再比较、再入键，ACCEPT 回吐规范化后的值。\n\n3. 版本文法收敛：一个模块三套（快照流与清单准入用 \\d+\\.\\d+\\.\\d+，升级复核用严格 SemVer），\n 新增 registry-primitives.ts 作单一来源，含预发布序；DEC-009—012 此前在两份文件各写一份，\n 一并收敛。snapshot-upgrade-review.ts 因此净减约 60 行重复实现。\n\n两处语义变化（蓝图新增一节已如实登记）：\n- 收紧：1.02.0 这类前导零版本此前被放行，现在拒；assessRegistrySnapshot 另开始拒 latest\n 这类可变标签——此前它能过体检却必然过不了迁移规则。\n- 放宽：1.0.0-rc.1 这类预发布版本此前被快照流整条挡在外面，现在按 SemVer 序参与迁移。\n 平台自己发的就是 1.0.0-rc.N，升级复核那一侧本来就这么判。风险面有限：本模块所有出口\n 都不激活、不写 Registry，多进人工复核队列不等于多放行制品。\n\n证据（本分支隔离工作树，clean）：注册中心单测 44/44（原 34 + 加固 10）；\ncontracts check:local 302/302；check:fixtures 九个契约域套件 100 例 0 失败，\n其中本套件 15 例（正 4 / 反 11，原 8 例）。篡改必红实测两次：sameHexRef 退回大小写敏感\n→ 单测 1 红 + 夹具 P03 红；去掉快照入口守卫 → 整套塌成 0 例 1 配置失败。\n\n仍为仓内候选 sdk_e2，不代表正式 Registry、Snapshot 发布或跨仓 Required Check 已上线。\n清单登记的 C01.04 / C01.06 是「接线」型缺口且前置 Q01 运行宿主未裁，本次未动。\nreports/fixtures.latest.json 未回绑：它是 17 套件的聚合报告，只跑 9 个套件去覆盖会缩小结论面，\n应在整批（含并行会话的 public-file / IM / 跨域流程改动）落定后统一重跑回绑。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/92a6b8e647c2c4d764c1fcdb8448bfc48a4dc4ed","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:40:10-07:00","added":["contracts/src/domain/application-contract-registry/registry-primitives.ts"],"removed":[],"modified":["contracts/src/domain/application-contract-registry/fixture-evaluator.ts","contracts/src/domain/application-contract-registry/index.ts","contracts/src/domain/application-contract-registry/manifest-admission-planner.ts","contracts/src/domain/application-contract-registry/registry-snapshot.ts","contracts/src/domain/application-contract-registry/snapshot-upgrade-review.ts","contracts/test/application-contract-registry-domain.test.mjs","contracts/test/fixtures/application-contract-registry.fixtures.json","docs/domain/registry-snapshot-blueprint.md"]}],"total_commits":0,"head_commit":{"id":"b62945890987b341b65684046c6e4d8ae612c529","message":"Merge pull request 'fix(contracts): 注册中心规则补失败关闭与摘要规范化——三个入口此前抛 TypeError，同一摘要的两种写法此前分叉成两个复核键' (#1) from feat/registry-rule-hardening into main\n\nReviewed-on: https://gitea.g-hi.com/luoanwu/enterprise-platform/pulls/1\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/b62945890987b341b65684046c6e4d8ae612c529","author":{"name":"luoanwu","email":"law@g-hi.com","username":"luoanwu"},"committer":{"name":"luoanwu","email":"law@g-hi.com","username":"luoanwu"},"verification":null,"timestamp":"2026-09-18T22:48:44+08:00","added":["contracts/src/domain/application-contract-registry/registry-primitives.ts"],"removed":[],"modified":["contracts/src/domain/application-contract-registry/fixture-evaluator.ts","contracts/src/domain/application-contract-registry/index.ts","contracts/src/domain/application-contract-registry/manifest-admission-planner.ts","contracts/src/domain/application-contract-registry/registry-snapshot.ts","contracts/src/domain/application-contract-registry/snapshot-upgrade-review.ts","contracts/test/application-contract-registry-domain.test.mjs","contracts/test/fixtures/application-contract-registry.fixtures.json","docs/domain/registry-snapshot-blueprint.md"]},"repository":{"id":116,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"enterprise-platform","full_name":"luoanwu/enterprise-platform","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":19008,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/languages","html_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/enterprise-platform.git","clone_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform.git","original_url":"","website":"","stars_count":0,"forks_count":0,"watchers_count":1,"branch_count":43,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-09-11T07:33:25+08:00","updated_at":"2026-09-18T22:47:53+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"}}...
|
push
|
2
|
30
|
1789742961
|
1789742999
|
0
|
1789742926
|
1789743053
|
group: platform-${{ github.workflow }}-${{ github. group: platform-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
...
|
platform-platform.yml-refs/heads/main
|
0
|
Edit
Delete
|
|
24139
|
chore(reports): check:fixtures 回绑 @ 7f82399
|
116
|
5
|
platform.yml
|
124
|
5
|
0
|
refs/heads/main
|
0ed7ee700a678dd6bea6879c5c575bd03cdb612c
|
0
|
0
|
0
|
push
|
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"b62945890987b341b65684046c6e4d8ae612c529","after":"0ed7ee700a678dd6bea6879c5c575bd03cdb612c","compare_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/compare/b62945890987b341b65684046c6e4d8ae612c529...0ed7ee700a678dd6bea6879c5c575bd03cdb612c","commits":[{"id":"0ed7ee700a678dd6bea6879c5c575bd03cdb612c","message":"chore(reports): check:fixtures 回绑 @ 7f82399\n\n合并后重跑并重新绑定。上一份绑的是 532e807，其注册中心一栏计的是本地 9ac9914 那套夹具（19 例），\n该实现已在 7f82399 的合并中整体放弃，报告随之失真，故在合并提交上重跑。\n\n在 .worktrees/merge-registry-remote 的干净检出（HEAD=7f82399）跑全 17 套件：\n296 例，失败 0，不可用 0，configurationError 0；provenance worktreeDirty=false、runner=local。\n与上一份的差异只在注册中心一栏：19 例（本地实现）→ 15 例（远端实现），总数 300 → 296。\n\ncontracts/dist 由该检出自己 tsc 构建；runtime 九个模块经 turbo 全量缓存命中\n（runtime/ 自上次绑定以来无任何提交，构建输入哈希一致）。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/0ed7ee700a678dd6bea6879c5c575bd03cdb612c","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T08:07:24-07:00","added":[],"removed":[],"modified":["reports/fixtures.latest.json"]},{"id":"7f82399ee801c5d5a740ef8a85366ea9f086650e","message":"Merge remote-tracking branch 'origin/main' —— 注册中心取远端那套，本地 9ac9914 的实现整体放弃\n\n本域被两个并行会话各补强了一遍：Gitea 上经 PR #1 合入的 92a6b8e（抽出 registry-primitives.ts、\n重写 snapshot-upgrade-review.ts），与本地未推送的 9ac9914（守卫内联在 registry-snapshot.ts）。\n二者是对同一批规则的两套独立实现，合并时 5 个文件 11 处冲突，冲突内容是两套失败关闭实现之间的取舍。\n\n按 Owner 裁断取远端。解法不是逐块挑，而是把整个域按 origin/main 逐字取入——包括自动合并成功的\nfixture-evaluator.ts / index.ts / manifest-admission-planner.ts，避免留下两套写法拼起来的中间产物：\n\n git checkout origin/main -- contracts/src/domain/application-contract-registry \\\n contracts/test/application-contract-registry-domain.test.mjs \\\n contracts/test/fixtures/application-contract-registry.fixtures.json \\\n docs/domain/registry-snapshot-blueprint.md\n\n取入后逐文件与 origin/main 比对，九个文件全部无差异；目录内容与 origin/main 的 tree 一致\n（本地那套没有引入远端没有的文件，不存在残留）。\n\ncontracts/SOURCE.md 未被远端改动，故不在冲突里，但 9ac9914 在其中写的注册中心条目描述的是已被放弃的实现，\n留着即是假记录。该条目已替换为取舍记录：说明两套实现的来历、裁断结果与核验数字，并注明 PR #1 未在\nSOURCE.md 留条目、其缺陷清单以提交信息与蓝图增量节为准，不替它复述未经本会话核验的细节。\n\n核验（合并后，工作树 dirty，报告另行回绑）：\n- node --test contracts/test/*.test.mjs 361/361\n- 定向 contracts/test/application-contract-registry-domain.test.mjs 44/44\n- check:fixtures 17 套件 296 例，失败 0，不可用 0，configurationError 0\n （contract-application-contract-registry 15 例；本地那套的 19 例随实现一并放弃，故总数由 300 降至 296）\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/7f82399ee801c5d5a740ef8a85366ea9f086650e","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T08:07:00-07:00","added":["contracts/src/domain/application-contract-registry/registry-primitives.ts"],"removed":[],"modified":["contracts/SOURCE.md","contracts/src/domain/application-contract-registry/fixture-evaluator.ts","contracts/src/domain/application-contract-registry/index.ts","contracts/src/domain/application-contract-registry/manifest-admission-planner.ts","contracts/src/domain/application-contract-registry/registry-snapshot.ts","contracts/src/domain/application-contract-registry/snapshot-upgrade-review.ts","contracts/test/application-contract-registry-domain.test.mjs","contracts/test/fixtures/application-contract-registry.fixtures.json","docs/domain/registry-snapshot-blueprint.md"]},{"id":"33d84b86199f79c639208042c77816b597eeceb1","message":"chore(reports): check:fixtures 回绑 @ 532e807\n\n在 .worktrees/evidence-fixtures 开 detached 干净检出（HEAD=532e807）跑全 17 套件：\n17 套件 300 例，失败 0，不可用 0，configurationError 0；provenance worktreeDirty=false、runner=local。\n\n为什么另开检出：主检出有并行会话未提交的 governance/check-module-imports.mjs，worktreeDirty 恒为 true，\n报告只能绑本地、不能回绑。依赖用符号链接接过来——runtime/.gitignore 的 node_modules 与 dist 不带斜杠，\n符号链接同样被忽略；根 .gitignore 的 node_modules/ 带斜杠不匹配符号链接，故 contracts/node_modules\n建成真目录、内部逐项链接，跑门禁前 git status --porcelain --untracked-files=all 实测为空。\ncontracts/dist 由该检出自己 tsc 构建；runtime 九个模块经 turbo 全量缓存命中（runtime/ 自上次绑定以来\n无任何提交，构建输入哈希一致）。\n\n案例数由上次绑定（765300b，189 例）升至 300 例，增量来自本轮九个契约包域的入参硬化：\nconfiguration-feature-flags 10→17 是本次提交带来的，其余由并行会话的同批提交带来\n（public-file 13→29、data-analytics 8→27、cost-capacity 9→32、application-contract-registry 8→19、\nenterprise-experience 6→17、notification-webhook 8→17、collaboration-messaging 8→14、\ncross-domain-workflow 7→16）。本次一并回绑，不逐仓拆分。\n\n其余 stale 报告不在本次范围，且都不由本次提交引起：release-manifest / sbom / image-smoke 的作用域变更是\nreports/image-digest.json 与 stack/compose.yaml；runtime/reports/naming 与 fork-readiness 是工作台四个文件；\nreports/module-imports.latest.json 处于 EVIDENCE_WORKTREE_CHANGED，须等并行会话提交\ngovernance/check-module-imports.mjs 后由其重跑回绑。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/33d84b86199f79c639208042c77816b597eeceb1","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T08:01:21-07:00","added":[],"removed":[],"modified":["reports/fixtures.latest.json"]},{"id":"532e8072ab29d24da41fae7717985c2bcc771cd9","message":"fix(contracts): 配置与功能开关规则补入参体检——三处倒向「开 / 采纳」、四处崩溃面与免检的兜底快照\n\n迁入版在入参可信的前提下是对的，但本能力的真实入口全是 JSON——夹具 payload、\ncreateRuntimeConfigurationClient(rawSnapshot) 收的快照文本、远端下发的开关规则都从反序列化来，\nTS 类型只在编译期成立。补强前对 dist 逐条实测，问题分六类：\n\n- 版本闸门形同虚设：rule.version \u003c context.minimumVersion 两端都不校验类型，缺任一端时 `\u003c` 恒为 false，\n 「比不出来」被当成「没过期」。version: undefined / version: \"3\" / minimumVersion: undefined\n 三种输入都直接 { enabled: true, reason: \"PERCENTAGE\" }——版本下限是配置回滚时唯一的保护。\n- 租户白名单退化成子串匹配：allowTenantIds 传成字符串时 .includes() 走的是 String.prototype.includes，\n \"xtenant-1x\" 让租户 tenant-1 命中 ALLOWLIST 并开启——不在白名单里的租户被开了灰度。\n- 未批准的配置快照被采纳：snapshotUsable 对 approved / schemaValid / containsPlaintextSecret 按真值判，\n approved: \"false\" 与 schemaValid: 1 都返回 USE_CANDIDATE；开关位 enabled: 1 同样被判成开启。\n 现在四个前提只认字面值，开关位只认布尔字面量。\n- 崩溃面：evaluateFeatureFlag(undefined, ctx) / (rule, undefined) / key: null / allowTenantIds: null 与\n selectConfigurationSnapshot(undefined, …) 全部抛 TypeError。夹具评估器两条规则各自只要少写一个键就能触发，\n 而 check:fixtures 对抛出物的处理是把整个套件记成 configurationError（0 例、报错文本当理由），\n 等于夹具门禁自己先倒了，不是多红一条。\n- 兜底快照免检：create(candidate, lastKnownGood) 对第二个参数只有声明类型，\n { version: 9, approved: \"yes\", schemaValid: 1, digest: \"zz\", values: \"nope\" } 可直接以 last_known_good 上岗——\n 它恰恰是候选不可用时的兜底，越是兜底越不能免检。现在 LKG 与候选走同一道 normalizeSnapshot，\n 参数类型也从 RuntimeConfigurationSnapshot 放宽成 unknown：这是入口，写成强类型挡不住任何东西。\n- 配置值穿透原型链：values 经 Object.fromEntries 建在 Object.prototype 上，get(\"constructor\") 返回一个函数，\n 消费侧一句 get(key) ?? fallback 就会拿函数当配置值。现在用 Object.create(null) 承载再冻结。\n 顺带收紧：version 必须是整数（原 typeof \"number\" 放过 NaN / 1.5），配置值里的数字必须有限。\n\n夹具评估器一并订正：Number(p[\"minimumVersion\"]) 会把夹具里写的 \"5\" 悄悄转成 5，\n夹具证明的是转换后的输入而不是自己写的那份。评估器应当是传声筒，现在原值直传。\n\n判定面与原因码面都没有扩张——FeatureFlagDecision 仍是那五个 reason、SnapshotSelection 仍是那三个 kind，\n没有新增任何原因码，整份改动只改「拿到脏值时往哪边倒」；迁入的 10 例单测断言一条未改。\nrefresh() 的 KEPT 分支放宽到 !== USE_CANDIDATE 并补上版本下限属防御性改动，它不修任何已知缺陷、\n对现有任何输入都不改变输出，已在 SOURCE.md 据实登记。\n\n覆盖：定向单测 10 → 20 例，夹具 10 → 17 例（正 4 / 反 13），新增目录内部件 value-guards.ts（不经 index.ts 导出）。\n负向实测三次：① 把 HEAD 版四个文件单独编到临时目录再喂新夹具，7 例全部不通过——\nN07 / N08 / N09 / N11 / N13 五例直接放行（reasons: [] = ACCEPT），N10 / N12 两例抛 TypeError；\n② 篡改 N11 的声明原因 → check-fixtures exit 1 并点名该例，把 id/expect 翻成 ACCEPT 仍 exit 1，还原后 exit 0；\n③ 源码侧还原 enabled 的布尔判定与 allowTenantIds 的数组判定 → 单测 20 例中 3 例转红，还原后 20/20。\n工作树 dirty（同期有并行会话在改其他契约包域），报告未回绑，本次用临时报告名跑完即删。\n\n未做：Catalog 登记一律未动（仍 module_e2、code_truth 指工单仓 packages/configuration-client），改登记需 CHG；\ndigest 只校验形状不校验内容、明文密钥只按顶层键名正则判、缺失模块完善清单 C13 的分桶 / 发布状态机 / kill switch\n均属判定面扩张或运行宿主（Q01），只登记未做。本轮仍是契约包形态，不代表配置中心上线。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/532e8072ab29d24da41fae7717985c2bcc771cd9","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:57:18-07:00","added":["contracts/src/domain/configuration-feature-flags/value-guards.ts"],"removed":[],"modified":["contracts/SOURCE.md","contracts/src/domain/configuration-feature-flags/configuration-client.ts","contracts/src/domain/configuration-feature-flags/feature-flag.ts","contracts/src/domain/configuration-feature-flags/fixture-evaluator.ts","contracts/test/configuration-feature-flags-domain.test.mjs","contracts/test/fixtures/configuration-feature-flags.fixtures.json","docs/domain/feature-flag-blueprint.md"]},{"id":"9ac9914ce25315472d3634c9d6d4d64e72dbe98f","message":"fix(contracts): 注册中心规则补入参体检——393 行升级复核此前零门禁覆盖，四条就绪闸门被真值字符串顶开\n\n九个契约包里最后一个未补强的。三类问题，均先对 dist 实测再改。\n\n一、崩溃面。assessRegistrySnapshot(undefined) 与 assessRegistrySnapshot({}) 抛\nTypeError（后者停在 snapshot.appId.trim()）；assessRegistryTransition 任一侧非对象即抛；\nreviewCandidateSnapshotUpgrade 在 request / context 非对象、currentPin 或 impactEvidence\n缺失、context.now 非 Date 时抛；夹具评估器的 snapshot / transition 两条跟着抛。补\nSNAPSHOT_SHAPE_INVALID / UPGRADE_REQUEST_INVALID / UPGRADE_REVIEW_CONTEXT_INVALID\n三个稳定原因码。LocalManifestAdmissionPlanner.plan() 改前就已失败关闭，本轮一行未动。\n\n二、四条就绪闸门被真值字符串顶开。independentGitSourceReady / codeownersReady /\nrequiredCheckEvidenceReady / rollbackEvidenceReady 写作 !context.x，传 \"false\" 一律\n判为就绪并直达 READY_FOR_CONSUMER_UPGRADE_REVIEW。同一文件的 sourceWorktreeDirty !== false\n与 compatible / manualReviewRequired 本来就是严格写法，本次把这四条统一成它。\n\n三、两处身份判定过宽。\n\n blockedBy 传成字符串时 .length 是字符数——\"\" 等于「无阻塞」，带阻塞的快照会被放行。\n 现要求字符串数组，否则 BLOCKERS_SHAPE_INVALID。\n\n 摘要与提交 SHA 的正则带 i，大小写两收。摘要是制品的身份：两种写法都认等于同一制品\n 有两个身份，而后续每一处 !== 比较（SAME_VERSION_DIGEST_CHANGED、pin 与 target 的摘要\n 对齐、fromDigest / toDigest 对齐）都会把它们当成两件不同的东西。现只收小写；仓内\n Catalog 与夹具无任何大写摘要在用，实测无影响面。\n\n门禁覆盖：snapshot-upgrade-review.ts 整份 393 行此前在门禁上零覆盖（评估器只有\nsnapshot / transition / plan 三条规则），而它持有上述四条闸门与全部证据新鲜度判定。\n补 upgrade 规则，BLOCKED 不算放行。\n\n核验：定向 34 → 40 例；迁入的 34 例在硬化后的 dist 上 0 失败，即合法输入的判定结果\n逐字未变；夹具 8 → 19 例（正 3 / 反 16）0 失败；负向实做：把\nN13-truthy-string-must-not-mark-the-git-source-ready 的声明原因改成不会产生的串，\n门禁 exit 1 并点名该例，还原后 exit 0。仍不发布、不改消费者 pin、不写 Registry；\nCatalog 登记未动（改登记须 CHG）。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/9ac9914ce25315472d3634c9d6d4d64e72dbe98f","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T07:52:43-07:00","added":[],"removed":[],"modified":["contracts/SOURCE.md","contracts/src/domain/application-contract-registry/fixture-evaluator.ts","contracts/src/domain/application-contract-registry/registry-snapshot.ts","contracts/src/domain/application-contract-registry/snapshot-upgrade-review.ts","contracts/test/application-contract-registry-domain.test.mjs","contracts/test/fixtures/application-contract-registry.fixtures.json","docs/domain/registry-snapshot-blueprint.md"]}],"total_commits":0,"head_commit":{"id":"0ed7ee700a678dd6bea6879c5c575bd03cdb612c","message":"chore(reports): check:fixtures 回绑 @ 7f82399\n\n合并后重跑并重新绑定。上一份绑的是 532e807，其注册中心一栏计的是本地 9ac9914 那套夹具（19 例），\n该实现已在 7f82399 的合并中整体放弃，报告随之失真，故在合并提交上重跑。\n\n在 .worktrees/merge-registry-remote 的干净检出（HEAD=7f82399）跑全 17 套件：\n296 例，失败 0，不可用 0，configurationError 0；provenance worktreeDirty=false、runner=local。\n与上一份的差异只在注册中心一栏：19 例（本地实现）→ 15 例（远端实现），总数 300 → 296。\n\ncontracts/dist 由该检出自己 tsc 构建；runtime 九个模块经 turbo 全量缓存命中\n（runtime/ 自上次绑定以来无任何提交，构建输入哈希一致）。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/0ed7ee700a678dd6bea6879c5c575bd03cdb612c","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T08:07:24-07:00","added":[],"removed":[],"modified":["reports/fixtures.latest.json"]},"repository":{"id":116,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"enterprise-platform","full_name":"luoanwu/enterprise-platform","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":19014,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/languages","html_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/enterprise-platform.git","clone_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform.git","original_url":"","website":"","stars_count":0,"forks_count":0,"watchers_count":1,"branch_count":43,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-09-11T07:33:25+08:00","updated_at":"2026-09-18T22:48:47+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"}}...
|
push
|
2
|
30
|
1789744065
|
1789744103
|
0
|
1789744064
|
1789744132
|
group: platform-${{ github.workflow }}-${{ github. group: platform-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
...
|
platform-platform.yml-refs/heads/main
|
0
|
Edit
Delete
|
|
24140
|
docs(部署): 记录补 §12——三个 dev 运行面重启复验与读写面 curl 取证
|
116
|
5
|
platform.yml
|
125
|
5
|
0
|
refs/heads/main
|
34403ffdfeda4af776b5f4063a40b9b04340895a
|
0
|
0
|
0
|
push
|
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"0ed7ee700a678dd6bea6879c5c575bd03cdb612c","after":"34403ffdfeda4af776b5f4063a40b9b04340895a","compare_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/compare/0ed7ee700a678dd6bea6879c5c575bd03cdb612c...34403ffdfeda4af776b5f4063a40b9b04340895a","commits":[{"id":"34403ffdfeda4af776b5f4063a40b9b04340895a","message":"docs(部署): 记录补 §12——三个 dev 运行面重启复验与读写面 curl 取证\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/34403ffdfeda4af776b5f4063a40b9b04340895a","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T08:07:48-07:00","added":[],"removed":[],"modified":["docs/dev部署运行重做记录-2026-09-18.md"]}],"total_commits":0,"head_commit":{"id":"34403ffdfeda4af776b5f4063a40b9b04340895a","message":"docs(部署): 记录补 §12——三个 dev 运行面重启复验与读写面 curl 取证\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/34403ffdfeda4af776b5f4063a40b9b04340895a","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T08:07:48-07:00","added":[],"removed":[],"modified":["docs/dev部署运行重做记录-2026-09-18.md"]},"repository":{"id":116,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"enterprise-platform","full_name":"luoanwu/enterprise-platform","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":19363,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/languages","html_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/enterprise-platform.git","clone_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform.git","original_url":"","website":"","stars_count":0,"forks_count":0,"watchers_count":1,"branch_count":43,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-09-11T07:33:25+08:00","updated_at":"2026-09-18T23:07:44+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"}}...
|
push
|
2
|
34
|
1789744134
|
1789744171
|
0
|
1789744129
|
1789744199
|
group: platform-${{ github.workflow }}-${{ github. group: platform-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
...
|
platform-platform.yml-refs/heads/main
|
0
|
Edit
Delete
|
|
24141
|
chore(reports): B3′ 的四十一份三级证据 回绑 @ df72512，刷新快照锚点
|
76
|
5
|
governance.yml
|
78
|
5
|
0
|
refs/heads/main
|
74c732d8d4b88957365dd80770032bab706e84e2
|
0
|
0
|
0
|
push
|
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"4da2c656ae691428be3f177563952cba66c37b88","after":"74c732d8d4b88957365dd80770032bab706e84e2","compare_url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/compare/4da2c656ae691428be3f177563952cba66c37b88...74c732d8d4b88957365dd80770032bab706e84e2","commits":[{"id":"74c732d8d4b88957365dd80770032bab706e84e2","message":"chore(reports): B3′ 的四十一份三级证据 回绑 @ df72512，刷新快照锚点\n\n本批次最后一个提交，按 C241 同时刷新快照锚点到 df72512（声明落后 0，本提交自身使实测\n落后 1，在 +1 自指窗内）。\n\n四十一份 reports/*.latest.json 全部 clean 绑定（gitSha=df72512、worktreeDirty:false）：\n静态 28 + 运行态 13。静态整轮 **28/28 步骤全部通过**（退出码 0），运行态 733 tests /\n行为矩阵 204/204 / 87 项指标零违规。\n\n本批改的是两后端的 WS 传输层与 replay 查询，两个预设风险点均未兑现：\n- 16 KiB 传输层上限**未挡住任何测试**——正常控制帧远在其下，上限值选得合适\n- outbox 查询由 findFirst 改为 aggregate(_min/_max) 后，在 RLS enforce 下行为与原先一致\n\nruntime 跑了两轮，**数字完全一致**（733 / 204-204 / 零违规），无非确定性；第一轮因改动\n尚未提交而 worktreeDirty:true，按仓规矩只绑定本地、不能作阶段门证据，故提交实现后重跑。\n这是顺序问题不是结果问题——记下来是为了下次先提交再跑，省一轮 20 分钟。\n\n工作区内三份 reports/ui-*.latest.json 的改动早于本批次，未提交也未还原。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/commit/74c732d8d4b88957365dd80770032bab706e84e2","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T08:15:17-07:00","added":[],"removed":[],"modified":["CLAUDE.md","reports/agent-adapters.latest.json","reports/auth-startup.latest.json","reports/capacity-envelope.latest.json","reports/contract-consumers.latest.json","reports/db-credential-separation.latest.json","reports/dependency-resilience.latest.json","reports/docs-truth.latest.json","reports/dual-backend-behavior.latest.json","reports/dual-backend-parity.latest.json","reports/fixtures.latest.json","reports/fork-readiness.latest.json","reports/governance-docs.latest.json","reports/governance.latest.json","reports/kernel-admission.latest.json","reports/kernel-boundaries.latest.json","reports/kernel-downstream.latest.json","reports/kernel-extensions.latest.json","reports/kernel-packages.latest.json","reports/list-bounds.latest.json","reports/llm-eval.latest.json","reports/migrations.latest.json","reports/mobile-export.latest.json","reports/multi-instance.latest.json","reports/naming.latest.json","reports/operations.latest.json","reports/platform-dependency-provenance.latest.json","reports/product-acceptance-runtime.latest.json","reports/product-acceptance.latest.json","reports/product-extension-runtime.latest.json","reports/product-migrations-runtime.latest.json","reports/product-migrations.latest.json","reports/product-sql-runtime.latest.json","reports/report-transaction-lock.latest.json","reports/rls.latest.json","reports/runtime-acceptance.latest.json","reports/runtime-governance.latest.json","reports/schema-sync.latest.json","reports/statemachine-write-guard.latest.json","reports/tracing.latest.json","reports/validation-source.latest.json","reports/write-capacity.latest.json"]},{"id":"df72512110999b668b00c5cbf94ce0691ec7f3af","message":"feat(realtime): B3′ 采纳上游两处加固——重放游标缺口判定与 WS 传输层单帧上限\n\n立项 §2 的「采纳上游加固 4」批次。逐个比对后实收两处真加固、一处口径收敛，另有两处\n开工时的判断被实测推翻，一并更正在代码注释里。\n\n一、replay 转发到 @juhai/kernel，补上 cursor-unknown\n\n本仓的 replay.ts 是框架 0.1.0 时代的拷贝，导出名与框架一致但实现落后一代，缺\n`maxSeq` 与策略「游标超前于现存最大 seq ⇒ 报缺口」。旧实现下，客户端报一个本租户\n从未产生过的游标（伪造 / 串号 / DB 被重置）会命中 pendingCount === 0 而返回 none——\n「已追平」与「真的没有新事件」在数值上无从区分，客户端**永远停在一个不存在的进度上、\n再也收不到补发**，与本仓「绝不静默缺口」的判据直接冲突。\n\n实证（打转发后的实现）：\n since=999999, maxSeq=42 → {\"kind\":\"gap\",\"reason\":\"cursor-unknown\"}\n since=42, maxSeq=42 → {\"kind\":\"none\"} ← 真已追平，无误报\n\n框架同时修了契约文件内部的自相矛盾：pendingCount 旧注释写「且已投递」，与两后端刻意\n选定的账本语义相反（outbox 是「发生过什么」的账本，补发范围是全部留存行，重叠由客户端\n按信封 id 去重）——docs-truth 扫不到这类矛盾。\n\n两后端各改一处查询：findFirst(minSeq) → aggregate(_min/_max)，一次拿两个边界，\n比原先还少一次往返。\n\n二、WS 传输层单帧上限（REALTIME_WS_MAX_PAYLOAD_BYTES = 16 KiB）\n\n框架注释记了一次真实事故，而**本仓此前正处在那个状态**：只有应用层的\nREALTIME_MAX_COMMAND_BYTES = 4096，没有接线传输层，而 ws 的默认 maxPayload 是 100MiB\n——任意客户端反复发 100MiB 帧即可制造内存压力，而「防撑爆」的守卫在内存被完整缓冲\n之后才生效。本批同时接线两后端并取同值（G17）：\n Fastify app.register(websocket, { options: { maxPayload: … } })\n NestJS @WebSocketGateway({ path: \"/ws\", maxPayload: … })\n传输层 16384 比应用层 4096 留一档余量，使「超协议约束」与「超传输上限」成为两种可区分\n的失败：4096~16384 的帧仍拿到语义清晰的 connection.error(too-large)，真正的巨帧在协议层\n即被 close 1009 掐断。**只加常量不接线正是该注释批评的形态**，故两者同批落地。\n\n三、两处开工判断被实测推翻，已更正在注释里\n\n1) 「订阅列表无上限」不成立：本仓原本就有 .max(50) / .max(200)，只是写成字面量，\n 值与框架一致。本批只是把魔法数字收敛成具名单源，不是补安全缺口。\n2) subscription 不是单纯落后，而是**互有领先**：框架有那两个上限，本仓有\n `envelope.resourceRefs` 这条「新事件唯一扩展协议」（禁止为产品主键继续追加字段名猜测，\n 否则行业对象会反向污染内核），框架那份仍是「取第一个以 Id 结尾的键」的启发式。\n 整份转发会删掉本仓这个设计，故**不转发**——按迁移手册 §6 走分歧账本，只取上限、\n 保留本仓实现。这是三个模块里唯一的合并式采纳。\n\n@repo/contracts 1.19.0 → 1.20.0。注意 P7 **没有要求**这次升版：根与 kernel 两个 barrel 的\nexport 行都没变，而 apiDigest 只哈希入口 .d.ts。但公开面实际多了 3 个符号，按语义应升——\n真正记录这次面变化的是 K1 锁（replay.ts 的 4 个导出转移给内核包、另两处各 +1/+2，\n40 模块 / 755 导出）。\n\n验证：contracts 312/312 · typecheck 13/13 · 静态整轮 28/28 · runtime 733 / 行为矩阵 204/204 /\n零违规（16 KiB 上限未挡住任何测试，aggregate 在 RLS enforce 下行为与 findFirst 一致）。\nruntime 报告在本提交后重跑回绑。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/commit/df72512110999b668b00c5cbf94ce0691ec7f3af","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T08:03:00-07:00","added":[],"removed":[],"modified":["CLAUDE.md","apps/api-fastify/src/app.ts","apps/api-fastify/src/modules/replay.ts","apps/api-nestjs/src/events/events.gateway.ts","apps/api-nestjs/src/events/replay.service.ts","docs/product-extension-guide.md","kernel.downstream.lock.json","kernel.exports.lock.json","kernel.packages.json","kernel.packages.lock.json","packages/contracts/package.json","packages/contracts/src/realtime-command.ts","packages/contracts/src/replay.ts","packages/contracts/src/subscription.ts"]}],"total_commits":0,"head_commit":{"id":"74c732d8d4b88957365dd80770032bab706e84e2","message":"chore(reports): B3′ 的四十一份三级证据 回绑 @ df72512，刷新快照锚点\n\n本批次最后一个提交，按 C241 同时刷新快照锚点到 df72512（声明落后 0，本提交自身使实测\n落后 1，在 +1 自指窗内）。\n\n四十一份 reports/*.latest.json 全部 clean 绑定（gitSha=df72512、worktreeDirty:false）：\n静态 28 + 运行态 13。静态整轮 **28/28 步骤全部通过**（退出码 0），运行态 733 tests /\n行为矩阵 204/204 / 87 项指标零违规。\n\n本批改的是两后端的 WS 传输层与 replay 查询，两个预设风险点均未兑现：\n- 16 KiB 传输层上限**未挡住任何测试**——正常控制帧远在其下，上限值选得合适\n- outbox 查询由 findFirst 改为 aggregate(_min/_max) 后，在 RLS enforce 下行为与原先一致\n\nruntime 跑了两轮，**数字完全一致**（733 / 204-204 / 零违规），无非确定性；第一轮因改动\n尚未提交而 worktreeDirty:true，按仓规矩只绑定本地、不能作阶段门证据，故提交实现后重跑。\n这是顺序问题不是结果问题——记下来是为了下次先提交再跑，省一轮 20 分钟。\n\n工作区内三份 reports/ui-*.latest.json 的改动早于本批次，未提交也未还原。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/commit/74c732d8d4b88957365dd80770032bab706e84e2","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T08:15:17-07:00","added":[],"removed":[],"modified":["CLAUDE.md","reports/agent-adapters.latest.json","reports/auth-startup.latest.json","reports/capacity-envelope.latest.json","reports/contract-consumers.latest.json","reports/db-credential-separation.latest.json","reports/dependency-resilience.latest.json","reports/docs-truth.latest.json","reports/dual-backend-behavior.latest.json","reports/dual-backend-parity.latest.json","reports/fixtures.latest.json","reports/fork-readiness.latest.json","reports/governance-docs.latest.json","reports/governance.latest.json","reports/kernel-admission.latest.json","reports/kernel-boundaries.latest.json","reports/kernel-downstream.latest.json","reports/kernel-extensions.latest.json","reports/kernel-packages.latest.json","reports/list-bounds.latest.json","reports/llm-eval.latest.json","reports/migrations.latest.json","reports/mobile-export.latest.json","reports/multi-instance.latest.json","reports/naming.latest.json","reports/operations.latest.json","reports/platform-dependency-provenance.latest.json","reports/product-acceptance-runtime.latest.json","reports/product-acceptance.latest.json","reports/product-extension-runtime.latest.json","reports/product-migrations-runtime.latest.json","reports/product-migrations.latest.json","reports/product-sql-runtime.latest.json","reports/report-transaction-lock.latest.json","reports/rls.latest.json","reports/runtime-acceptance.latest.json","reports/runtime-governance.latest.json","reports/schema-sync.latest.json","reports/statemachine-write-guard.latest.json","reports/tracing.latest.json","reports/validation-source.latest.json","reports/write-capacity.latest.json"]},"repository":{"id":76,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"digital-employee-os","full_name":"luoanwu/digital-employee-os","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":88055,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/digital-employee-os/languages","html_url":"https://gitea.g-hi.com/luoanwu/digital-employee-os","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/digital-employee-os","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/digital-employee-os.git","clone_url":"https://gitea.g-hi.com/luoanwu/digital-employee-os.git","original_url":"","website":"","stars_count":0,"forks_count":1,"watchers_count":1,"branch_count":3,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-08-20T14:46:28+08:00","updated_at":"2026-09-18T22:42:58+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"}}...
|
push
|
2
|
36
|
1789744521
|
1789744530
|
0
|
1789744520
|
1789744543
|
group: governance-${{ github.workflow }}-${{ githu group: governance-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: "true"
...
|
governance-governance.yml-refs/heads/main
|
1
|
Edit
Delete
|
|
24142
|
chore(reports): B3′ 的四十一份三级证据 回绑 @ df72512，刷新快照锚点
|
76
|
5
|
platform-governance.yml
|
79
|
5
|
0
|
refs/heads/main
|
74c732d8d4b88957365dd80770032bab706e84e2
|
0
|
0
|
0
|
push
|
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"4da2c656ae691428be3f177563952cba66c37b88","after":"74c732d8d4b88957365dd80770032bab706e84e2","compare_url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/compare/4da2c656ae691428be3f177563952cba66c37b88...74c732d8d4b88957365dd80770032bab706e84e2","commits":[{"id":"74c732d8d4b88957365dd80770032bab706e84e2","message":"chore(reports): B3′ 的四十一份三级证据 回绑 @ df72512，刷新快照锚点\n\n本批次最后一个提交，按 C241 同时刷新快照锚点到 df72512（声明落后 0，本提交自身使实测\n落后 1，在 +1 自指窗内）。\n\n四十一份 reports/*.latest.json 全部 clean 绑定（gitSha=df72512、worktreeDirty:false）：\n静态 28 + 运行态 13。静态整轮 **28/28 步骤全部通过**（退出码 0），运行态 733 tests /\n行为矩阵 204/204 / 87 项指标零违规。\n\n本批改的是两后端的 WS 传输层与 replay 查询，两个预设风险点均未兑现：\n- 16 KiB 传输层上限**未挡住任何测试**——正常控制帧远在其下，上限值选得合适\n- outbox 查询由 findFirst 改为 aggregate(_min/_max) 后，在 RLS enforce 下行为与原先一致\n\nruntime 跑了两轮，**数字完全一致**（733 / 204-204 / 零违规），无非确定性；第一轮因改动\n尚未提交而 worktreeDirty:true，按仓规矩只绑定本地、不能作阶段门证据，故提交实现后重跑。\n这是顺序问题不是结果问题——记下来是为了下次先提交再跑，省一轮 20 分钟。\n\n工作区内三份 reports/ui-*.latest.json 的改动早于本批次，未提交也未还原。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/commit/74c732d8d4b88957365dd80770032bab706e84e2","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T08:15:17-07:00","added":[],"removed":[],"modified":["CLAUDE.md","reports/agent-adapters.latest.json","reports/auth-startup.latest.json","reports/capacity-envelope.latest.json","reports/contract-consumers.latest.json","reports/db-credential-separation.latest.json","reports/dependency-resilience.latest.json","reports/docs-truth.latest.json","reports/dual-backend-behavior.latest.json","reports/dual-backend-parity.latest.json","reports/fixtures.latest.json","reports/fork-readiness.latest.json","reports/governance-docs.latest.json","reports/governance.latest.json","reports/kernel-admission.latest.json","reports/kernel-boundaries.latest.json","reports/kernel-downstream.latest.json","reports/kernel-extensions.latest.json","reports/kernel-packages.latest.json","reports/list-bounds.latest.json","reports/llm-eval.latest.json","reports/migrations.latest.json","reports/mobile-export.latest.json","reports/multi-instance.latest.json","reports/naming.latest.json","reports/operations.latest.json","reports/platform-dependency-provenance.latest.json","reports/product-acceptance-runtime.latest.json","reports/product-acceptance.latest.json","reports/product-extension-runtime.latest.json","reports/product-migrations-runtime.latest.json","reports/product-migrations.latest.json","reports/product-sql-runtime.latest.json","reports/report-transaction-lock.latest.json","reports/rls.latest.json","reports/runtime-acceptance.latest.json","reports/runtime-governance.latest.json","reports/schema-sync.latest.json","reports/statemachine-write-guard.latest.json","reports/tracing.latest.json","reports/validation-source.latest.json","reports/write-capacity.latest.json"]},{"id":"df72512110999b668b00c5cbf94ce0691ec7f3af","message":"feat(realtime): B3′ 采纳上游两处加固——重放游标缺口判定与 WS 传输层单帧上限\n\n立项 §2 的「采纳上游加固 4」批次。逐个比对后实收两处真加固、一处口径收敛，另有两处\n开工时的判断被实测推翻，一并更正在代码注释里。\n\n一、replay 转发到 @juhai/kernel，补上 cursor-unknown\n\n本仓的 replay.ts 是框架 0.1.0 时代的拷贝，导出名与框架一致但实现落后一代，缺\n`maxSeq` 与策略「游标超前于现存最大 seq ⇒ 报缺口」。旧实现下，客户端报一个本租户\n从未产生过的游标（伪造 / 串号 / DB 被重置）会命中 pendingCount === 0 而返回 none——\n「已追平」与「真的没有新事件」在数值上无从区分，客户端**永远停在一个不存在的进度上、\n再也收不到补发**，与本仓「绝不静默缺口」的判据直接冲突。\n\n实证（打转发后的实现）：\n since=999999, maxSeq=42 → {\"kind\":\"gap\",\"reason\":\"cursor-unknown\"}\n since=42, maxSeq=42 → {\"kind\":\"none\"} ← 真已追平，无误报\n\n框架同时修了契约文件内部的自相矛盾：pendingCount 旧注释写「且已投递」，与两后端刻意\n选定的账本语义相反（outbox 是「发生过什么」的账本，补发范围是全部留存行，重叠由客户端\n按信封 id 去重）——docs-truth 扫不到这类矛盾。\n\n两后端各改一处查询：findFirst(minSeq) → aggregate(_min/_max)，一次拿两个边界，\n比原先还少一次往返。\n\n二、WS 传输层单帧上限（REALTIME_WS_MAX_PAYLOAD_BYTES = 16 KiB）\n\n框架注释记了一次真实事故，而**本仓此前正处在那个状态**：只有应用层的\nREALTIME_MAX_COMMAND_BYTES = 4096，没有接线传输层，而 ws 的默认 maxPayload 是 100MiB\n——任意客户端反复发 100MiB 帧即可制造内存压力，而「防撑爆」的守卫在内存被完整缓冲\n之后才生效。本批同时接线两后端并取同值（G17）：\n Fastify app.register(websocket, { options: { maxPayload: … } })\n NestJS @WebSocketGateway({ path: \"/ws\", maxPayload: … })\n传输层 16384 比应用层 4096 留一档余量，使「超协议约束」与「超传输上限」成为两种可区分\n的失败：4096~16384 的帧仍拿到语义清晰的 connection.error(too-large)，真正的巨帧在协议层\n即被 close 1009 掐断。**只加常量不接线正是该注释批评的形态**，故两者同批落地。\n\n三、两处开工判断被实测推翻，已更正在注释里\n\n1) 「订阅列表无上限」不成立：本仓原本就有 .max(50) / .max(200)，只是写成字面量，\n 值与框架一致。本批只是把魔法数字收敛成具名单源，不是补安全缺口。\n2) subscription 不是单纯落后，而是**互有领先**：框架有那两个上限，本仓有\n `envelope.resourceRefs` 这条「新事件唯一扩展协议」（禁止为产品主键继续追加字段名猜测，\n 否则行业对象会反向污染内核），框架那份仍是「取第一个以 Id 结尾的键」的启发式。\n 整份转发会删掉本仓这个设计，故**不转发**——按迁移手册 §6 走分歧账本，只取上限、\n 保留本仓实现。这是三个模块里唯一的合并式采纳。\n\n@repo/contracts 1.19.0 → 1.20.0。注意 P7 **没有要求**这次升版：根与 kernel 两个 barrel 的\nexport 行都没变，而 apiDigest 只哈希入口 .d.ts。但公开面实际多了 3 个符号，按语义应升——\n真正记录这次面变化的是 K1 锁（replay.ts 的 4 个导出转移给内核包、另两处各 +1/+2，\n40 模块 / 755 导出）。\n\n验证：contracts 312/312 · typecheck 13/13 · 静态整轮 28/28 · runtime 733 / 行为矩阵 204/204 /\n零违规（16 KiB 上限未挡住任何测试，aggregate 在 RLS enforce 下行为与 findFirst 一致）。\nruntime 报告在本提交后重跑回绑。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/commit/df72512110999b668b00c5cbf94ce0691ec7f3af","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T08:03:00-07:00","added":[],"removed":[],"modified":["CLAUDE.md","apps/api-fastify/src/app.ts","apps/api-fastify/src/modules/replay.ts","apps/api-nestjs/src/events/events.gateway.ts","apps/api-nestjs/src/events/replay.service.ts","docs/product-extension-guide.md","kernel.downstream.lock.json","kernel.exports.lock.json","kernel.packages.json","kernel.packages.lock.json","packages/contracts/package.json","packages/contracts/src/realtime-command.ts","packages/contracts/src/replay.ts","packages/contracts/src/subscription.ts"]}],"total_commits":0,"head_commit":{"id":"74c732d8d4b88957365dd80770032bab706e84e2","message":"chore(reports): B3′ 的四十一份三级证据 回绑 @ df72512，刷新快照锚点\n\n本批次最后一个提交，按 C241 同时刷新快照锚点到 df72512（声明落后 0，本提交自身使实测\n落后 1，在 +1 自指窗内）。\n\n四十一份 reports/*.latest.json 全部 clean 绑定（gitSha=df72512、worktreeDirty:false）：\n静态 28 + 运行态 13。静态整轮 **28/28 步骤全部通过**（退出码 0），运行态 733 tests /\n行为矩阵 204/204 / 87 项指标零违规。\n\n本批改的是两后端的 WS 传输层与 replay 查询，两个预设风险点均未兑现：\n- 16 KiB 传输层上限**未挡住任何测试**——正常控制帧远在其下，上限值选得合适\n- outbox 查询由 findFirst 改为 aggregate(_min/_max) 后，在 RLS enforce 下行为与原先一致\n\nruntime 跑了两轮，**数字完全一致**（733 / 204-204 / 零违规），无非确定性；第一轮因改动\n尚未提交而 worktreeDirty:true，按仓规矩只绑定本地、不能作阶段门证据，故提交实现后重跑。\n这是顺序问题不是结果问题——记下来是为了下次先提交再跑，省一轮 20 分钟。\n\n工作区内三份 reports/ui-*.latest.json 的改动早于本批次，未提交也未还原。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/digital-employee-os/commit/74c732d8d4b88957365dd80770032bab706e84e2","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T08:15:17-07:00","added":[],"removed":[],"modified":["CLAUDE.md","reports/agent-adapters.latest.json","reports/auth-startup.latest.json","reports/capacity-envelope.latest.json","reports/contract-consumers.latest.json","reports/db-credential-separation.latest.json","reports/dependency-resilience.latest.json","reports/docs-truth.latest.json","reports/dual-backend-behavior.latest.json","reports/dual-backend-parity.latest.json","reports/fixtures.latest.json","reports/fork-readiness.latest.json","reports/governance-docs.latest.json","reports/governance.latest.json","reports/kernel-admission.latest.json","reports/kernel-boundaries.latest.json","reports/kernel-downstream.latest.json","reports/kernel-extensions.latest.json","reports/kernel-packages.latest.json","reports/list-bounds.latest.json","reports/llm-eval.latest.json","reports/migrations.latest.json","reports/mobile-export.latest.json","reports/multi-instance.latest.json","reports/naming.latest.json","reports/operations.latest.json","reports/platform-dependency-provenance.latest.json","reports/product-acceptance-runtime.latest.json","reports/product-acceptance.latest.json","reports/product-extension-runtime.latest.json","reports/product-migrations-runtime.latest.json","reports/product-migrations.latest.json","reports/product-sql-runtime.latest.json","reports/report-transaction-lock.latest.json","reports/rls.latest.json","reports/runtime-acceptance.latest.json","reports/runtime-governance.latest.json","reports/schema-sync.latest.json","reports/statemachine-write-guard.latest.json","reports/tracing.latest.json","reports/validation-source.latest.json","reports/write-capacity.latest.json"]},"repository":{"id":76,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"digital-employee-os","full_name":"luoanwu/digital-employee-os","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":88055,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/digital-employee-os/languages","html_url":"https://gitea.g-hi.com/luoanwu/digital-employee-os","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/digital-employee-os","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/digital-employee-os.git","clone_url":"https://gitea.g-hi.com/luoanwu/digital-employee-os.git","original_url":"","website":"","stars_count":0,"forks_count":1,"watchers_count":1,"branch_count":3,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-08-20T14:46:28+08:00","updated_at":"2026-09-18T22:42:58+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"}}...
|
push
|
2
|
8
|
1789744530
|
1789744538
|
0
|
1789744521
|
1789744544
|
|
|
0
|
Edit
Delete
|