| event_payload |
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"daf18132e7691ba0af8b3d0028fdcd031e159eb4","after":"9f04d912fe1dc62ef8d4eec1de5e18eed606cc97","compare_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/compare/daf18132e7691ba0af8b3d0028fdcd031e159eb4...9f04d912fe1dc62ef8d4eec1de5e18eed606cc97","commits":[{"id":"9f04d912fe1dc62ef8d4eec1de5e18eed606cc97","message":"fix(governance): 迁移扫描器改用词法预处理，堵住 MIGRATION_DML_UNDER_FORCE_RLS 六种绕过（第四轮对抗验收 M-1）\n\n第四轮对抗验收 M-1（docs/对抗性验收-2026-09-24.md）：`DO LANGUAGE plpgsql $$…$$`、未引号大写表名、MERGE、\nDO 块内 SELECT 守卫判空再 DROP、CTAS / INSERT…SELECT、字符串里的假 NO FORCE，六种片段在 FORCE 下 owner 执行\n均静默 0 行而门禁判绿。\n\n- lexMigration：注释、非 DO 的 dollar 体、单引号字符串内容等长抹空，DDL 正则只在真语句上匹配；\n 策略表达式回原文按同一位置重取（表达式本身含 current_setting('app.…')）\n- 未引号表名按 PostgreSQL 规则折小写；DO 块认 `DO [LANGUAGE x] $$`\n- findImmediateTableRefs：按顶层语句切分，DML / 裸查询 / CTE / COPY / CTAS / 物化视图与 DO 体内的\n UPDATE / DELETE / MERGE / INSERT / COPY / FROM / JOIN 引用都算当场读写；视图定义、策略表达式、函数体不算\n- 被 DROP 的表若曾在 FORCE 下被读写，以 dropped: true 保留 forcedDml 发现，不再判其 RLS 缺口\n- 规则说明与判红文案改为「当场读写」\n\nH-1 的策略三分与运行时 pg_policy 判定以并行会话 ed62a8be 为准，本提交不再重做。\n测试：治理 42/42（新增 M-1 八种片段 + 字符串 / dollar 体伪造状态负例 + 视图与策略表达式不误报）；\n真登记 check:modules 16 模块仍绿。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/9f04d912fe1dc62ef8d4eec1de5e18eed606cc97","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-24T16:32:25-07:00","added":[],"removed":[],"modified":["governance/lib/authority-basis.mjs","governance/test/check-modules-authority.test.mjs"]},{"id":"eb40c479570a2ffcc78b5719c540eb4a3d66c511","message":"fix(enterprise-experience): 登记归属须等于调用方应用——堵住同租户跨应用改写登记（第四轮对抗验收 H-5）\n\nsubmit 的权限 resourceId 是租户级，content.appId 从请求体来却从未与 principal.appId 比对：\n同租户任一持 submit 权限的应用都能把别家已批准的登记改回 draft、清掉批准、让四方签收按版本失效，\n并借 deepLinkPrefix 抢占路径（docs/对抗性验收-2026-09-24.md H-5，confirmed）。\n\n- experience-runtime.ts：assess 之后、落库之前比对 appId，不等即 REJECT（REGISTRATION_APP_MISMATCH），不落账\n- experience-contribution-api.v2.openapi.json：原因码枚举与 submit 说明补 REGISTRATION_APP_MISMATCH\n- 单测：冒名提交被拒且已批准登记 / 签收 / 账本原样；归属自己的登记仍可改版\n- README 记下这条边界\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/eb40c479570a2ffcc78b5719c540eb4a3d66c511","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-24T16:27:23-07:00","added":[],"removed":[],"modified":["contracts/contracts/experience-contribution-api.v2.openapi.json","runtime/modules/enterprise-experience/README.md","runtime/modules/enterprise-experience/src/http/experience-runtime.test.ts","runtime/modules/enterprise-experience/src/http/experience-runtime.ts"]}],"total_commits":0,"head_commit":{"id":"9f04d912fe1dc62ef8d4eec1de5e18eed606cc97","message":"fix(governance): 迁移扫描器改用词法预处理，堵住 MIGRATION_DML_UNDER_FORCE_RLS 六种绕过（第四轮对抗验收 M-1）\n\n第四轮对抗验收 M-1（docs/对抗性验收-2026-09-24.md）：`DO LANGUAGE plpgsql $$…$$`、未引号大写表名、MERGE、\nDO 块内 SELECT 守卫判空再 DROP、CTAS / INSERT…SELECT、字符串里的假 NO FORCE，六种片段在 FORCE 下 owner 执行\n均静默 0 行而门禁判绿。\n\n- lexMigration：注释、非 DO 的 dollar 体、单引号字符串内容等长抹空，DDL 正则只在真语句上匹配；\n 策略表达式回原文按同一位置重取（表达式本身含 current_setting('app.…')）\n- 未引号表名按 PostgreSQL 规则折小写；DO 块认 `DO [LANGUAGE x] $$`\n- findImmediateTableRefs：按顶层语句切分，DML / 裸查询 / CTE / COPY / CTAS / 物化视图与 DO 体内的\n UPDATE / DELETE / MERGE / INSERT / COPY / FROM / JOIN 引用都算当场读写；视图定义、策略表达式、函数体不算\n- 被 DROP 的表若曾在 FORCE 下被读写，以 dropped: true 保留 forcedDml 发现，不再判其 RLS 缺口\n- 规则说明与判红文案改为「当场读写」\n\nH-1 的策略三分与运行时 pg_policy 判定以并行会话 ed62a8be 为准，本提交不再重做。\n测试：治理 42/42（新增 M-1 八种片段 + 字符串 / dollar 体伪造状态负例 + 视图与策略表达式不误报）；\n真登记 check:modules 16 模块仍绿。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/9f04d912fe1dc62ef8d4eec1de5e18eed606cc97","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-24T16:32:25-07:00","added":[],"removed":[],"modified":["governance/lib/authority-basis.mjs","governance/test/check-modules-authority.test.mjs"]},"repository":{"id":116,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"enterprise-platform","full_name":"luoanwu/enterprise-platform","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":18204,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/languages","html_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/enterprise-platform.git","clone_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform.git","original_url":"","website":"","stars_count":0,"forks_count":0,"watchers_count":1,"branch_count":40,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-09-11T07:33:25+08:00","updated_at":"2026-09-25T07:31:32+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"}}... |