| event_payload |
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"849a0460c229611a1afa4b798be51fbc72408273","after":"890186f6ced6dcb9f3ed0cf8181953c468022255","compare_url":"https://gitea.g-hi.com/luoanwu/juhai-ai-hr-system/compare/849a0460c229611a1afa4b798be51fbc72408273...890186f6ced6dcb9f3ed0cf8181953c468022255","commits":[{"id":"890186f6ced6dcb9f3ed0cf8181953c468022255","message":"chore(reports): 静态门禁与聚合报告回绑 @ bf81e72\n\n在 clean bf81e72 上一次 check:governance 运行：naming / schema-sync / validation-source / contract-consumers / dual-backend-parity / statemachine-write-guard / fork-readiness / app-manifest / migrations / database-rls / os-product-layer / governance-docs / docs-truth / runtime-governance 与 governance 聚合共享同一 runId。\n\n聚合棘轮仍红，两项均早于 A1—A3 存在：osProductLayerViolations 0→1（O18：OS 宿主 UI 报告相对当前产品验收与 OS Web 源已陈旧）；reportProvenanceViolations 0→6（runtime / UI / 双后端行为等验收报告源码指纹仍属 d338bf1）。本提交只记录事实，不放宽基线。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/juhai-ai-hr-system/commit/890186f6ced6dcb9f3ed0cf8181953c468022255","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-26T07:07:11-07:00","added":[],"removed":[],"modified":["reports/app-manifest.latest.json","reports/contract-consumers.latest.json","reports/database-rls.latest.json","reports/docs-truth.latest.json","reports/dual-backend-parity.latest.json","reports/fork-readiness.latest.json","reports/governance-docs.latest.json","reports/governance.latest.json","reports/migrations.latest.json","reports/naming.latest.json","reports/os-product-layer.latest.json","reports/runtime-governance.latest.json","reports/schema-sync.latest.json","reports/statemachine-write-guard.latest.json","reports/validation-source.latest.json"]},{"id":"bf81e722bdb0bee4347e23613d3f787ad187b39c","message":"feat(auth): 企业 IdP 令牌 profile——按租户 issuer 白名单与 JWKS、at+jwt、单值 aud、tenant_id 绑定 issuer、scope 收窄、租户头一致性（G23 / 控制面接入蓝图 A3，关 H3）\n\n- @repo/auth 新增 AUTH_TOKEN_PROFILE=enterprise-idp，与既有 local-jwt 互斥并存：issuer 白名单由 PLATFORM_IDENTITY_BASE_URL（IdP 规范 origin，不带路径）+ PLATFORM_IDENTITY_TENANT_SLUGS_JSON 派生为 {origin}/t/{slug}；每租户 issuer 一份 {issuer}/oauth2/jwks 缓存，启动强制发现、周期刷新、最大陈旧窗口，任一租户刷新失败整体不替换；未验签 payload 的 iss 只在白名单内路由。校验 RS256、typ=at+jwt、单值 aud（字符串或恰一元素数组）、sub/jti/sid/grant_id/scope 必需、iat 不在未来、tenant_id 必须等于 issuer 对应租户、actor_type 若存在必须 human（403）、x-tenant-id / 实时 ?tenantId= 若存在必须一致（401 TENANT_HEADER_MISMATCH）；角色只经 AUTH_SCOPE_ROLES_JSON 显式收窄；撤销沿用权威快照（可选）。与 AUTH_JWT_ISSUER / AUTH_JWKS_URL / 静态密钥互斥，非 RS256、非 TLS、带路径 origin、畸形映射均拒绝启动。两后端接线零改动：startRemoteJwksRefresh / authenticateHttp / authenticateRealtime 按 profile 分派，HTTP / SSE / WS 同口径；authenticate* 增加 nowSeconds 测试时钟 seam\n- @repo/contracts 新增 platform-identity.ts：tenant ↔ IdP slug 映射校验 / 解析与租户 issuer 派生单源（slug 规则取契约 v1 issuer pattern）；enterprise-fact-publisher 改为消费该单源（A2 出站与 A3 入站共用一份映射）\n- 测试：控制面《企业 IdP 访问令牌契约》夹具复制件（2 正向 / 10 负向，packages/auth/src/__fixtures__，标明来源）逐条驱动 + HR 侧规则 7 例，auth 包 45/45；NestJS auth.enterprise-idp.http.test.ts 2/2（生产装配 + 隔离 PostgreSQL 62 迁移）与 local-jwt JWKS 回归 1/1；Fastify 同名 2/2 与回归 1/1；contracts 2/2；publisher 11/11。变异探针（禁用 typ 检查）使夹具 neg-id-token-as-access-token 与 HR 规则用例准确红\n- turbo.json 登记 AUTH_TOKEN_PROFILE、AUTH_SCOPE_ROLES_JSON；CLAUDE.md 真源地图 / G23 与蓝图 §10 回灌\n\n本地证据（2026-09-26）：双后端 typecheck、lint；naming / validation / contract-consumers / dual-backend / write-guard / fork-readiness / governance-docs / docs-truth 通过。真实企业 IdP、逐次 introspection 与 dev / 生产验收仍为 0。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/juhai-ai-hr-system/commit/bf81e722bdb0bee4347e23613d3f787ad187b39c","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-26T07:06:43-07:00","added":["apps/api-fastify/test/auth.enterprise-idp.http.test.ts","apps/api-nestjs/test/auth.enterprise-idp.http.test.ts","packages/auth/src/__fixtures__/enterprise-idp-access-token.contract-fixtures.json","packages/auth/src/enterprise-idp.test.ts","packages/contracts/src/platform-identity.test.ts","packages/contracts/src/platform-identity.ts"],"removed":[],"modified":["CLAUDE.md","docs/domain/enterprise-control-plane-integration-blueprint.md","packages/auth/src/index.ts","packages/contracts/src/index.ts","packages/enterprise-fact-publisher/src/index.test.ts","packages/enterprise-fact-publisher/src/index.ts","turbo.json"]},{"id":"21a33f1f621387b11f6ee8b53a58bdeca4e2106e","message":"chore(reports): 静态门禁与聚合报告回绑 @ 0beede4\n\n在 clean 0beede4 上一次 check:governance 运行：naming / schema-sync / validation-source / contract-consumers / dual-backend-parity / statemachine-write-guard / fork-readiness / app-manifest / migrations / database-rls / os-product-layer / governance-docs / docs-truth / runtime-governance 与 governance 聚合共享同一 runId；appManifestViolations=0、appManifestChecks=14。\n\n聚合棘轮仍红，两项均早于 A1/A2 存在：osProductLayerViolations 0→1（O18：OS 宿主 UI 报告相对当前产品验收与 OS Web 源已陈旧，需重跑宿主 UI 验收）；reportProvenanceViolations 0→6（runtime / UI / 双后端行为等验收报告源码指纹仍属 d338bf1，需重跑真实 DB 与浏览器验收）。本提交只记录事实，不放宽基线。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/juhai-ai-hr-system/commit/21a33f1f621387b11f6ee8b53a58bdeca4e2106e","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-26T06:27:51-07:00","added":[],"removed":[],"modified":["reports/app-manifest.latest.json","reports/contract-consumers.latest.json","reports/database-rls.latest.json","reports/docs-truth.latest.json","reports/dual-backend-parity.latest.json","reports/fork-readiness.latest.json","reports/governance-docs.latest.json","reports/governance.latest.json","reports/migrations.latest.json","reports/naming.latest.json","reports/os-product-layer.latest.json","reports/runtime-governance.latest.json","reports/schema-sync.latest.json","reports/statemachine-write-guard.latest.json","reports/validation-source.latest.json"]},{"id":"0beede4f795c180c0591e4877873763707e62797","message":"feat(facts): 出站令牌按租户取——client_credentials 服务身份与静态令牌租户绑定，凭据失败不消耗死信配额（G23 / 控制面接入蓝图 A2，关 H2）\n\n- packages/enterprise-fact-publisher：PlatformFactCredentialProvider 成为出站令牌单源，publisher 按 envelope.tenant_id 取令牌、绝不跨租户复用。createClientCredentialsProvider 向企业 IdP POST {PLATFORM_IDENTITY_BASE_URL}/t/{tenantSlug}/oauth2/token（client_secret_basic，grant_type/audience/scope 表单，与控制面 identity MachineIdentity.issue 契约对齐），每租户缓存、到期前刷新、同租户并发合并、失败冷却，非 localhost 强制 TLS；createTenantBoundStaticCredential 让 PLATFORM_FACT_TOKEN 只服务其 tenant_id/tenantId 声明的租户，NODE_ENV=production 禁止。两种模式互斥，同时配置或都缺失均拒绝启动；ten_… → slug 映射经 PLATFORM_IDENTITY_TENANT_SLUGS_JSON 由 IdP Owner 给出，缺映射失败关闭\n- 双后端 relay：PlatformCredentialError（PLATFORM_CREDENTIAL_UNAVAILABLE/REJECTED/TENANT_UNMAPPED/TENANT_UNBOUND）不递增 attempts、不进死信，按 ENTERPRISE_FACT_CREDENTIAL_RETRY_MS（默认 30s）重排并写 last_error_code；事实本身的发布失败仍走指数退避与十次死信；dispatcher/plugin 传入 credentialRetryMs\n- 测试：publisher 单测 11 例；NestJS/Fastify enterprise-fact-relay 各 12 例（新增凭据失败不消耗配额并恢复后同 fact_id 投递、多租户各用本租户令牌且未映射租户失败关闭），隔离 PostgreSQL 空库 62 迁移首次部署后通过；变异探针（破坏凭据分类）使两条新用例准确红。跨仓 e2e 的 HS256 演示令牌带 tenantId，静态绑定路径保持兼容；platform-fact-delivery.acceptance 改用 createTenantBoundStaticCredential\n- turbo.json 登记全部新环境变量（C23）；README、enterprise-fact-delivery.md、platform-shared-dev.md、蓝图 §10 与 CLAUDE.md 真源地图 / G23 回灌\n\n本地证据（2026-09-26）：双后端 typecheck、lint；naming/validation/contract-consumers/dual-backend/write-guard/fork-readiness/governance-docs/docs-truth 通过。真实企业 IdP 签发、slug 映射输入与 dev/生产传输仍为 0；全量 check:runtime 与控制面跨仓 e2e 本轮未重跑。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/juhai-ai-hr-system/commit/0beede4f795c180c0591e4877873763707e62797","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-26T06:27:20-07:00","added":[],"removed":[],"modified":["CLAUDE.md","apps/api-fastify/src/modules/enterprise-fact-relay.ts","apps/api-fastify/src/plugins/enterprise-fact-relay.ts","apps/api-fastify/test/enterprise-fact-relay.test.ts","apps/api-nestjs/src/events/enterprise-fact-relay-dispatcher.service.ts","apps/api-nestjs/src/events/enterprise-fact-relay.service.ts","apps/api-nestjs/test/enterprise-fact-relay.test.ts","apps/api-nestjs/test/platform-fact-delivery.acceptance.test.ts","docs/domain/enterprise-control-plane-integration-blueprint.md","docs/enterprise-fact-delivery.md","docs/platform-shared-dev.md","packages/enterprise-fact-publisher/README.md","packages/enterprise-fact-publisher/src/index.test.ts","packages/enterprise-fact-publisher/src/index.ts","turbo.json"]}],"total_commits":0,"head_commit":{"id":"890186f6ced6dcb9f3ed0cf8181953c468022255","message":"chore(reports): 静态门禁与聚合报告回绑 @ bf81e72\n\n在 clean bf81e72 上一次 check:governance 运行：naming / schema-sync / validation-source / contract-consumers / dual-backend-parity / statemachine-write-guard / fork-readiness / app-manifest / migrations / database-rls / os-product-layer / governance-docs / docs-truth / runtime-governance 与 governance 聚合共享同一 runId。\n\n聚合棘轮仍红，两项均早于 A1—A3 存在：osProductLayerViolations 0→1（O18：OS 宿主 UI 报告相对当前产品验收与 OS Web 源已陈旧）；reportProvenanceViolations 0→6（runtime / UI / 双后端行为等验收报告源码指纹仍属 d338bf1）。本提交只记录事实，不放宽基线。\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/juhai-ai-hr-system/commit/890186f6ced6dcb9f3ed0cf8181953c468022255","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-26T07:07:11-07:00","added":[],"removed":[],"modified":["reports/app-manifest.latest.json","reports/contract-consumers.latest.json","reports/database-rls.latest.json","reports/docs-truth.latest.json","reports/dual-backend-parity.latest.json","reports/fork-readiness.latest.json","reports/governance-docs.latest.json","reports/governance.latest.json","reports/migrations.latest.json","reports/naming.latest.json","reports/os-product-layer.latest.json","reports/runtime-governance.latest.json","reports/schema-sync.latest.json","reports/statemachine-write-guard.latest.json","reports/validation-source.latest.json"]},"repository":{"id":83,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"juhai-ai-hr-system","full_name":"luoanwu/juhai-ai-hr-system","description":"巨嗨 AI 人事系统：受治理全栈基础框架","empty":false,"private":true,"fork":false,"template":false,"mirror":false,"size":8165,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/juhai-ai-hr-system/languages","html_url":"https://gitea.g-hi.com/luoanwu/juhai-ai-hr-system","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/juhai-ai-hr-system","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/juhai-ai-hr-system.git","clone_url":"https://gitea.g-hi.com/luoanwu/juhai-ai-hr-system.git","original_url":"","website":"","stars_count":0,"forks_count":0,"watchers_count":1,"branch_count":3,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-08-26T09:35:18+08:00","updated_at":"2026-09-26T21:05:02+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"}}... |