| event_payload |
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"2dfbcb9148a7beabb926462eebb82645e548c10a","after":"314c179366fb02a53485f4efbd0e3d3e88cd5470","compare_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/compare/2dfbcb9148a7beabb926462eebb82645e548c10a...314c179366fb02a53485f4efbd0e3d3e88cd5470","commits":[{"id":"314c179366fb02a53485f4efbd0e3d3e88cd5470","message":"chore(reports): 回绑 @ 71b306f，登记面 33 → 35 全新鲜\n\nrelease-manifest 与 sbom 首次带嵌套 provenance 并受新鲜度保护。\n\nManifest 刷新后缺项 4 → 6，多出的两条都是真的、被旧快照藏了四天：\n- images.stack.*：compose 启用 runtime 服务后镜像是变量 ${PLATFORM_RUNTIME_IMAGE:?}，\n 未按 digest 锁定（PF-05 / PF-23 晋级前解决）\n- sbom：局部 lockfile 清单（268 包，仅 Node 依赖，不含基础镜像 Debian 包）\n 不满足 D-2 的完整 SBOM 要求\n\ncheck:evidence passed：35 份已登记全部新鲜，0 过期 / 0 例外 / 0 告警。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/314c179366fb02a53485f4efbd0e3d3e88cd5470","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-17T19:21:00-07:00","added":[],"removed":[],"modified":["reports/caddy.latest.json","reports/catalog-drift.latest.json","reports/catalog-reconciliation.latest.json","reports/evidence-freshness.latest.json","reports/facts.latest.json","reports/fixtures.latest.json","reports/migration-decs.latest.json","reports/module-imports.latest.json","reports/otel.latest.json","reports/release-manifest.latest.json","reports/sbom.latest.json","reports/sbom.spdx.json","runtime/reports/agent-adapters.latest.json","runtime/reports/conformance-matrix.latest.json","runtime/reports/contract-consumers.latest.json","runtime/reports/docs-truth.latest.json","runtime/reports/dual-backend-parity.latest.json","runtime/reports/fork-readiness.latest.json","runtime/reports/governance-docs.latest.json","runtime/reports/governance-rules.latest.json","runtime/reports/governance-status.latest.json","runtime/reports/governance.latest.json","runtime/reports/migrations.latest.json","runtime/reports/naming.latest.json","runtime/reports/permission-catalog.latest.json","runtime/reports/platform-ops-definitions.latest.json","runtime/reports/runtime-governance.latest.json","runtime/reports/schema-sync.latest.json","runtime/reports/statemachine-write-guard.latest.json","runtime/reports/validation-source.latest.json"]},{"id":"71b306f53390e6119590b5225b660cd4effcd3b5","message":"chore(governance): 登记 release-manifest 与 sbom 进 evidence-scopes（35 条）\n\n承 c5d9897。三份补了嵌套 provenance 之后，其中两份现在就能登记：\n\n- release-manifest（warn）：作用域 = compose、image-digest.json、四类包的\n package.json、runtime/modules、生成器与 schema。**这是 MS-4 退出条件的判据\n 输入**，此前无人监控其新鲜度\n- sbom（warn）：作用域 = image-digest.json、生成器、runtime 锁文件\n\nimage-smoke 本轮不登记：生成器已修，但要补上形状得起真实容器重跑（脚本强制\n--env-file，需 DB/Redis），不值得为补一个形状去起一套底座——待其下一次真实\n运行后登记。note 里写明了这一条与 mainline-dev-deployment 的区别（后者没有\n生成脚本，属手工记录那一类，不是形状问题）。\n\n同时修正 note 里 ① 类的描述：原写「没有 provenance.gitSha，要先让产生脚本写\nprovenance」，对这四份是不准确的——数据早就有。\n\ngovernance 测试 277/277。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/71b306f53390e6119590b5225b660cd4effcd3b5","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-17T19:20:23-07:00","added":[],"removed":[],"modified":["governance/evidence-scopes.json"]},{"id":"c5d98975f8c466d035550a4f38899db325d8b806","message":"feat(governance): 三份报告补嵌套 provenance，让 MS-4 判据输入受新鲜度保护\n\n2026-09-17 目录负责人裁决：补嵌套 provenance，四份有 SHA 的全做。\n\n问题：release-manifest / sbom / image-smoke / mainline-dev-deployment 都写了\n源 SHA，但是**平铺**在顶层（sourceSha），而 check:evidence 只认嵌套的\nprovenance.gitSha。于是它们登记不进 evidence-scopes，游离在新鲜度之外。\n此前 evidence-scopes 的口径说明把它们归为「没有 provenance.gitSha，要先让\n产生脚本写 provenance」——对其中四份是不准确的：数据早就有，缺的是形状。\n\n实锤这不是理论风险：Manifest 绑 ac3683d（2026-09-14），其后它的结论输入改了\n10 个文件（contracts/governance 的 package.json、image-digest.json、\ncompose.yaml、client-fact 全套），四天无人报警。重跑后缺项 4 → 6，多出的两条\n都是真的——compose 启用 runtime 服务后镜像是变量未按 digest 锁定；SBOM 未随\n19150ae 镜像重生成。**一份过期的 Manifest 一直在少报，而 MS-4 的退出条件正是\n读它**（status=complete 且 runner 为 CI）。\n\n改动：\n- stack/release-manifest.schema.json 增可选 provenance 对象（不进 required，\n 向后兼容；additionalProperties:false 故必须显式加），并写明与顶层三项同源\n- release-manifest.mjs 同时写 provenance 与顶层兼容字段，实测两者一致\n- sbom.mjs / smoke-image.mjs 增 provenance: gitProvenance(root)。注意它们原有的\n sourceSha 是**镜像的**源提交，与「本报告在哪个提交产出」不是一回事，两者都留\n\nmainline-dev-deployment 做不了：全仓搜索确认它没有生成脚本，是第四份手工记录\n（与今日退役的三份同类），不是形状问题。另行处置。\n\ngovernance 测试 277/277。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/c5d98975f8c466d035550a4f38899db325d8b806","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-17T19:19:03-07:00","added":[],"removed":[],"modified":["governance/release-manifest.mjs","governance/sbom.mjs","governance/smoke-image.mjs","stack/release-manifest.schema.json"]}],"total_commits":0,"head_commit":{"id":"314c179366fb02a53485f4efbd0e3d3e88cd5470","message":"chore(reports): 回绑 @ 71b306f，登记面 33 → 35 全新鲜\n\nrelease-manifest 与 sbom 首次带嵌套 provenance 并受新鲜度保护。\n\nManifest 刷新后缺项 4 → 6，多出的两条都是真的、被旧快照藏了四天：\n- images.stack.*：compose 启用 runtime 服务后镜像是变量 ${PLATFORM_RUNTIME_IMAGE:?}，\n 未按 digest 锁定（PF-05 / PF-23 晋级前解决）\n- sbom：局部 lockfile 清单（268 包，仅 Node 依赖，不含基础镜像 Debian 包）\n 不满足 D-2 的完整 SBOM 要求\n\ncheck:evidence passed：35 份已登记全部新鲜，0 过期 / 0 例外 / 0 告警。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/314c179366fb02a53485f4efbd0e3d3e88cd5470","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-17T19:21:00-07:00","added":[],"removed":[],"modified":["reports/caddy.latest.json","reports/catalog-drift.latest.json","reports/catalog-reconciliation.latest.json","reports/evidence-freshness.latest.json","reports/facts.latest.json","reports/fixtures.latest.json","reports/migration-decs.latest.json","reports/module-imports.latest.json","reports/otel.latest.json","reports/release-manifest.latest.json","reports/sbom.latest.json","reports/sbom.spdx.json","runtime/reports/agent-adapters.latest.json","runtime/reports/conformance-matrix.latest.json","runtime/reports/contract-consumers.latest.json","runtime/reports/docs-truth.latest.json","runtime/reports/dual-backend-parity.latest.json","runtime/reports/fork-readiness.latest.json","runtime/reports/governance-docs.latest.json","runtime/reports/governance-rules.latest.json","runtime/reports/governance-status.latest.json","runtime/reports/governance.latest.json","runtime/reports/migrations.latest.json","runtime/reports/naming.latest.json","runtime/reports/permission-catalog.latest.json","runtime/reports/platform-ops-definitions.latest.json","runtime/reports/runtime-governance.latest.json","runtime/reports/schema-sync.latest.json","runtime/reports/statemachine-write-guard.latest.json","runtime/reports/validation-source.latest.json"]},"repository":{"id":116,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"enterprise-platform","full_name":"luoanwu/enterprise-platform","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":17470,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/languages","html_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/enterprise-platform.git","clone_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform.git","original_url":"","website":"","stars_count":0,"forks_count":0,"watchers_count":1,"branch_count":42,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-09-11T07:33:25+08:00","updated_at":"2026-09-18T10:00:56+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"}}... |