| event_payload |
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"1e6f71d846a9ad3bcbd04a3f2b5fdb3f69ca1884","after":"32ad69a15ceb55e1cbcb170d7fdd47897e50c01b","compare_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/compare/1e6f71d846a9ad3bcbd04a3f2b5fdb3f69ca1884...32ad69a15ceb55e1cbcb170d7fdd47897e50c01b","commits":[{"id":"32ad69a15ceb55e1cbcb170d7fdd47897e50c01b","message":"chore(reports): check:caddy 回绑 @ 426a7df\n\n干净检出（.worktrees/rebind-426a7df）重跑，worktreeDirty=false；\n两个 profile 各 0 违规，caddy validate 经 docker 两份都 passed（不是 skipped）。\n报告新增 workbench 段，其中 guardsDocumentNavigation=false 是登记事实：\n入口鉴权只挡带 Authorization 头的数据面，纯静态 SPA 的文档导航挡不住。\n\n主工作区有并行会话 WIP，本次只还原本任务改动的这一份报告。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/32ad69a15ceb55e1cbcb170d7fdd47897e50c01b","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T02:05:49-07:00","added":[],"removed":[],"modified":["reports/caddy.latest.json"]},{"id":"588e5ab9459d1df433f3a32b44a4afe589b6a9b7","message":"chore(reports): check:gate-flow 回绑 @ aaf43ee\n\ncontracts:check 由 tool 订正为 gate 后重跑：46 个脚本、34 个有消费入口、\n12 个流外（门禁 5 / 工具 7）、0 违规。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/588e5ab9459d1df433f3a32b44a4afe589b6a9b7","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T02:04:43-07:00","added":[],"removed":[],"modified":["reports/gate-flow.latest.json"]},{"id":"426a7df100b7b8c2c82179f2b184ed066f6ceba6","message":"feat(stack,governance,workbench): 工作台同源托管与 /api/platform/* 入口鉴权（CHG-018 阶段 ②）\n\nCaddy 两个 profile 同步改：根路径托管工作台静态产物（产物未挂载时回原占位响应），\n/_next/* 先在产物里找文件、找不到才回身份 Web，@platform 块内对 /api/platform/*\n做 forward_auth → /t/{$PLATFORM_WORKBENCH_TENANT}/oidc/userinfo。租户空值即\n/t//oidc/userinfo → 上游 404 → 整段拒绝，不配置 = 不放行，与 PLATFORM_OPS_* 同纪律。\n\n入口只挡带 Authorization 头的数据面，挡不住文档导航：工作台是纯静态 SPA，令牌进\nsessionStorage 不进 cookie，浏览器发文档请求时网关手上没有可校验的凭据。要挡住静态壳\n就得有个发 cookie 的边缘会话组件，与 CHG-018 §5.1 已裁的形态相抵，须另起 CHG。这条\n边界写进 caddy-routes.json 的登记与报告的 guardsDocumentNavigation，不靠读代码猜。\n\n连带修好取数链路：三个读面的 accessToken 此前从没有调用方传过值（读面本来公开），\n入口挡上后工作台登录了也会永远 401。现改为必填形参；hooks 从 session store 取令牌，\n身份（不是令牌）进 queryKey，补水前不发请求，退出时清缓存。\n\ncheck:caddy 增 workbench 段与四条规则，两 profile 各 0 违规、caddy validate 经 docker\n两份都 passed；六条负向用例逐条先红后绿。另修一条已失效的旧夹具：UPSTREAM_MISSING 那条\n用 String.replace 只换第一处，forward_auth 引入同名变量后它再也换不到 reverse_proxy，\n改 replaceAll 并补一条「确实解绑了上游」的断言。\n\ndev 运行态取证与未闭环项（D-8 判责码语义、D-9 门禁守不住的绕过、D-10 issuer 不一致、\n带有效令牌的 200 分支未实测）见 docs/工作台同源托管与入口鉴权实现记录-2026-09-18.md。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/426a7df100b7b8c2c82179f2b184ed066f6ceba6","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T02:04:42-07:00","added":["docs/工作台同源托管与入口鉴权实现记录-2026-09-18.md"],"removed":[],"modified":["governance/caddy-routes.json","governance/check-caddy.mjs","governance/test/check-caddy.test.mjs","runtime/apps/workbench/src/app/login/page.tsx","runtime/apps/workbench/src/features/platform/api.ts","runtime/apps/workbench/src/features/platform/hooks.ts","stack/caddy/Caddyfile","stack/caddy/Caddyfile.staging","stack/compose.yaml"]},{"id":"aaf43ee0442d5b4a5d36325a92c1ae5bbff3c76b","message":"chore(reports): 工作台目录与运维快照回绑 @ 8a53c39\n\n在 8a53c39 的临时干净检出里重跑 `node governance/build-workbench-snapshots.mjs`\n（主工作树有并行会话的在途改动，就地跑只能产出 worktreeDirty=true 的绑定）。\n\n目录快照：schemaVersion 2，21 条 → stale 7 / not-in-manifest 14，conflicts 0。\n运维快照：schemaVersion 仍为 1，内容未变，只因生成脚本进了它的作用域而一并回绑。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/aaf43ee0442d5b4a5d36325a92c1ae5bbff3c76b","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T02:04:29-07:00","added":[],"removed":[],"modified":["reports/workbench-catalog-snapshot.latest.json","reports/workbench-ops-snapshot.latest.json"]},{"id":"90f3b99b5976b58431097147662a1253b096840c","message":"fix(governance): 订正 gate-flow 把 contracts:check 登记成 tool——它是一道有人写、没人跑的门禁\n\n昨天登记它时我写的是「role: tool，组成部分已被消费：check:local 在根 check 链与 CI\nstatic job 里」。**那是错的。** `contracts check` 比 `check:local` 多跑一个\n`scripts/check.mjs`，而那正是**对真实 Catalog 跑治理 linter** 的那一道：checkRegistry\n校验 8 份 Catalog、决议状态、应用清单、Fact 与权限命名、scopes 的阻断引用。\n`check:local` 只跑 schema-compatibility / impact-graph / check:generated / build / test。\n根链与 CI 用的都是 check:local，所以真实 Catalog 的治理判定**不在任何自动流里**，\n只有人手动敲 `pnpm contracts:check` 才会发生。\n\n技术原因不是疏忽：linter 需要工作区根（Catalog 的 directory / code_truth / evidence 与\n决议 source 都是相对工作区的路径），CI 只 checkout 本仓，接进根链会以\nWORKSPACE_ROOT_UNRESOLVED 退出 2——check:local 正是为此存在。\n\n**但挡它在链外的历史理由已经不成立。** CLAUDE.md 当前状态节写着「`check` 余 6 项\nPLATFORM_PROJECT_UNREGISTERED 待 CHG-001」，2026-09-18 实测**已全部通过**：\n17 draft apps / 168 governed entity / 11 draft fact / 9 permission resource /\n39 decisions（32 approved / 3 pending）/ 21 platform projects（19 in goal scope），\nschema 兼容 11/11 immutable，影响图 258 节点 297 边。又一次「条件早已满足而无人察觉」。\n\n已改为 role: gate，带 reason / wireInWhen / conditionReviewBy（2026-10-31）：剩下的\n只是工作区可达性，两条路二选一需裁决——给 CI 一条能取到工作区的 job（或把 linter 需要\n的工作区事实快照进本仓），或在工作区侧另起 workspace-only 链由治理层消费。\nCLAUDE.md 那句已划掉并补上实测与原因，免得下一个会话照着旧结论重走一遍。\n\n流外分布随之 4 门禁 / 8 工具 → 5 门禁 / 7 工具。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/90f3b99b5976b58431097147662a1253b096840c","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T02:04:23-07:00","added":[],"removed":[],"modified":["CLAUDE.md","governance/gate-flow.json"]}],"total_commits":0,"head_commit":{"id":"32ad69a15ceb55e1cbcb170d7fdd47897e50c01b","message":"chore(reports): check:caddy 回绑 @ 426a7df\n\n干净检出（.worktrees/rebind-426a7df）重跑，worktreeDirty=false；\n两个 profile 各 0 违规，caddy validate 经 docker 两份都 passed（不是 skipped）。\n报告新增 workbench 段，其中 guardsDocumentNavigation=false 是登记事实：\n入口鉴权只挡带 Authorization 头的数据面，纯静态 SPA 的文档导航挡不住。\n\n主工作区有并行会话 WIP，本次只还原本任务改动的这一份报告。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/32ad69a15ceb55e1cbcb170d7fdd47897e50c01b","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T02:05:49-07:00","added":[],"removed":[],"modified":["reports/caddy.latest.json"]},"repository":{"id":116,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"enterprise-platform","full_name":"luoanwu/enterprise-platform","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":18304,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/languages","html_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/enterprise-platform.git","clone_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform.git","original_url":"","website":"","stars_count":0,"forks_count":0,"watchers_count":1,"branch_count":42,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-09-11T07:33:25+08:00","updated_at":"2026-09-18T16:20:07+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"}}... |