| event_payload |
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"a8733b8670d68e423adf4595fb210d185c882afa","after":"7523bd04ab6e3606adf9d17c0b19b74e951e9dd5","compare_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/compare/a8733b8670d68e423adf4595fb210d185c882afa...7523bd04ab6e3606adf9d17c0b19b74e951e9dd5","commits":[{"id":"7523bd04ab6e3606adf9d17c0b19b74e951e9dd5","message":"docs(contracts): 注册中心取舍补双向交叉实测——放弃的那套有 4 个实缺陷，不是覆盖更全\n\n7f82399 的取舍此前只写了「按 Owner 裁断取远端」，没有实测支撑。补做交叉验证：两侧各自编译成 dist\n后互喂夹具与单测，不靠读代码比对。\n\n① 9ac9914 的 19 例夹具喂当前实现：13 通过 / 6 不通过。6 例里 5 例只是原因码改名、同一输入两侧都拒；\n 余 1 例是设计取向不同——大写摘要旧的拒，新的经 normalizeDigest 归一为小写，比较走 sameHexRef。\n 其 40 例单测喂当前实现：36 通过 / 4 不通过，失败集中在同样四个主题。\n② 反向，当前 25 例夹具喂 9ac9914：18 通过 / 7 不通过。3 例是改名的镜像，另外 4 例是被放弃那套的实缺陷：\n - N10-mutable-version-tag 返回 [] 即放行可变版本标签；\n - N11-leading-zero-version 拒了但拒错原因，其 \\d+\\.\\d+\\.\\d+ 收下了 1.02.0；\n - P03-same-digest-other-case 误拒——它自己的注释抱怨「同一摘要两种写法等于两个身份」，却只在入口拒大写，\n 升级比较那条路上仍把大小写变体当成两个摘要，它抱怨的 bug 它没修完；\n - P04-prerelease-precedes-its-release 误拒 1.0.0-rc.0，而平台自己正在发 1.0.0-rc.x。\n③ 根因是结构性的：被放弃那套三个文件各带一套版本文法，远端抽 registry-primitives.ts 正是为收敛这三套，\n 其抬头所述经比对属实。\n④ 覆盖面 19/40 → 25/49。旧的在 upgrade 规则上多 1 例，但 ① 已证明那 7 例在当前实现下无一失守。\n\n结论：放弃 9ac9914 未造成覆盖缺口，反而避开 4 个实缺陷；唯一差异是原因码命名，无需回捡。\n\n同条订正一处措辞：「报告另行回绑」已不成立，该报告已于 0ed7ee7 回绑 @ 7f82399，其后由后续会话在更新\nSHA 上重绑。本次只改 contracts/SOURCE.md，不在任何 evidence-scopes 作用域内，不影响报告新鲜度。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/7523bd04ab6e3606adf9d17c0b19b74e951e9dd5","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T15:58:50-07:00","added":[],"removed":[],"modified":["contracts/SOURCE.md"]},{"id":"3e1cc814eb2141710a42e4afdb865f937790436d","message":"docs(发布): 补记 rc.3 列车的本地旁路发布——证据取自产物内 provenance，并记下两处偏离\n\nrc.3 三包（contracts / governance / client-fact）2026-09-13 经旁路通道发出，当时没留记录。\n2026-09-18 做对抗验收、核对 CLAUDE.md 的 contracts 版本声明时，才从 Registry 实查发现\nrc.3 在架而仓内一字没有——provenance.json 随包分发、不入仓，漏写记录就等于这次发布\n在仓里不留任何痕迹。\n\n证据全部一手：Gitea Registry packument + 三个 rc.3 tarball 内的 provenance.json；\n下载产物的 sha512 与 Registry 登记的 integrity 三包逐一核对一致，确认读到的\nprovenance 出自架上那三个包。\n\n记下的事实：源 036a308（三包 package.json 在该提交上均已是 1.0.0-rc.3，符合「一组同版本包」），\n三份 provenance 均 worktreeDirty:false、runner:\"local\"、releaseChannel:\"local-bypass\"，\nverificationRun* 与 candidateSha256 全 null、reports:[]。实际动因是 client-fact 的 U-29；\ncontracts 从 rc.2 到 rc.3 **零内容变更**，只有版本号跟车。边界逐条继承 rc.2 那节，一个字不放宽。\n\n补记时一并发现两处偏离，都写进文档：\n\n1. 两趟车都没打 tag。CL-5 的口径是「一次发布 = 一个 tag = 一组同版本包」，而 rc.2 / rc.3\n 六份 provenance 的 tag 全是 null，仓里 packages-v* 也只到 packages-v1.0.0-rc.1。\n2. 上一节表格写 rc.2「源 eb3cf2c」，而 rc.2 产物内 provenance 记的是 6d3900a。\n **未擅改上一节表格**，只记录这个不一致，留给该次发布的执行者确认。\n\nCLAUDE.md 同步去掉上一条提交里标的「rc.3 无发布记录」缺口，改为指向本记录。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/3e1cc814eb2141710a42e4afdb865f937790436d","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T15:58:47-07:00","added":[],"removed":[],"modified":["CLAUDE.md","docs/G-12本地旁路发布记录-2026-09-13.md"]},{"id":"098263a175e453448d36f3f281522f7cd96040fe","message":"docs(部署): 记录补 §13——会话级临时目录里的密钥清干净\n\n§11.3 把 identity 的 env 从上一个会话的 /private/tmp scratchpad 搬进 .secrets/ 之后，\n那个 scratchpad 里还躺着三份带密文件。本节把它收口：一挪两删一剪，逐条记依据。\n\n要点不是「清理干净了」，是那个位置为什么放不得：会话级 scratchpad 随时会被清，\n而 launch.json 指着它（运行面下次起不来）、里面又有别处没有备份的凭证（东西就没了），\n两个隐患叠在一起。\n\n本轮新核实两件事，都写进记录：demo 租户管理员的明文口令**全工作区仅此一份**——\n连 .secrets/backups/ 里 09-17 那套交付备份的 platform_identity_dev.dump 也搜不到明文\n（库里存散列，账号能从备份恢复、明文不能），而同一租户只能 bootstrap 一次（runbook §2）；\n以及 git grep -F over HEAD 确认该口令**未出现在任何被跟踪文件**里（邮箱出现在 4 份，非机密）。\n\n删除与保留都留了判据：删前查引用与进程命令行，保留的三行用 sha256 前后比对证明逐字节未改。\n§13.4 登记单点风险：是否给 idp-demo-admin.txt 做仓外备份，留 Owner 判断。\n\n作用域 = 本机 dev 的仓外文件治理，不含代码与门禁证据。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/098263a175e453448d36f3f281522f7cd96040fe","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T15:58:32-07:00","added":[],"removed":[],"modified":["docs/dev部署运行重做记录-2026-09-18.md"]},{"id":"d950aa2f4b6f6bdcc3ccb7e4b0ba4bc69d6f7822","message":"test(contracts): 通知与 Webhook 的请求体检与出站 allowlist 前置——七条原因码只有实现没有用例\n\n按同一口径算覆盖（变异每个夹具用例的每个叶子字段 → 收集规则实际产出的原因码 → 查夹具声明与单测），\nnotification-webhook 有 7 条「哪里都没有」：\n\n WEBHOOK_TENANT_ID_REQUIRED WEBHOOK_INTENT_ID_REQUIRED\n WEBHOOK_DESTINATION_ID_REQUIRED WEBHOOK_TEMPLATE_ID_REQUIRED\n WEBHOOK_REQUESTED_BY_REQUIRED WEBHOOK_CLASSIFICATION_INVALID\n WEBHOOK_ALLOWED_HOSTS_REQUIRED\n\n前六条在 plan() 开头那段 try/catch 里：归属三件套（tenant / intent / requestedBy）与投递目标\n（destination / template）缺一即拒、分级必须在册。整段体检删掉，夹具与单测都不会红——原来那 17 个\n用例里没有一个喂缺字段的请求。\n\n第七条是快照前置：allowedHosts 缺失 / 空 / 非数组时 normalizeSnapshot 拒收整份策略。放行一个\n「没有出站约束」的路由比没有路由更危险，投递目标不再受任何主机限制，而这条同样零覆盖。\n\n补：夹具 17 → 24 例（N15–N21），单测 24 → 27 例（六个字段 × 五种脏值、分级四种、allowlist 三种）。\n补后重算：notification-webhook 的「哪里都没有」归 0。\n\n负向实测：把 N20 的声明原因改成不会产生的串 → 门禁 exit 1 并点名该例，恢复后转绿。\n\n本条只补覆盖，没有改任何判定；webhook-delivery-planner.ts / notification-effect.ts 一行未动。\n证据：在仅含本提交改动的导出树上 tsc 绿、定向 27/27、contract-notification-webhook 24/24。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/d950aa2f4b6f6bdcc3ccb7e4b0ba4bc69d6f7822","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T15:58:30-07:00","added":[],"removed":[],"modified":["contracts/SOURCE.md","contracts/test/fixtures/notification-webhook.fixtures.json","contracts/test/notification-webhook-domain.test.mjs"]}],"total_commits":0,"head_commit":{"id":"7523bd04ab6e3606adf9d17c0b19b74e951e9dd5","message":"docs(contracts): 注册中心取舍补双向交叉实测——放弃的那套有 4 个实缺陷，不是覆盖更全\n\n7f82399 的取舍此前只写了「按 Owner 裁断取远端」，没有实测支撑。补做交叉验证：两侧各自编译成 dist\n后互喂夹具与单测，不靠读代码比对。\n\n① 9ac9914 的 19 例夹具喂当前实现：13 通过 / 6 不通过。6 例里 5 例只是原因码改名、同一输入两侧都拒；\n 余 1 例是设计取向不同——大写摘要旧的拒，新的经 normalizeDigest 归一为小写，比较走 sameHexRef。\n 其 40 例单测喂当前实现：36 通过 / 4 不通过，失败集中在同样四个主题。\n② 反向，当前 25 例夹具喂 9ac9914：18 通过 / 7 不通过。3 例是改名的镜像，另外 4 例是被放弃那套的实缺陷：\n - N10-mutable-version-tag 返回 [] 即放行可变版本标签；\n - N11-leading-zero-version 拒了但拒错原因，其 \\d+\\.\\d+\\.\\d+ 收下了 1.02.0；\n - P03-same-digest-other-case 误拒——它自己的注释抱怨「同一摘要两种写法等于两个身份」，却只在入口拒大写，\n 升级比较那条路上仍把大小写变体当成两个摘要，它抱怨的 bug 它没修完；\n - P04-prerelease-precedes-its-release 误拒 1.0.0-rc.0，而平台自己正在发 1.0.0-rc.x。\n③ 根因是结构性的：被放弃那套三个文件各带一套版本文法，远端抽 registry-primitives.ts 正是为收敛这三套，\n 其抬头所述经比对属实。\n④ 覆盖面 19/40 → 25/49。旧的在 upgrade 规则上多 1 例，但 ① 已证明那 7 例在当前实现下无一失守。\n\n结论：放弃 9ac9914 未造成覆盖缺口，反而避开 4 个实缺陷；唯一差异是原因码命名，无需回捡。\n\n同条订正一处措辞：「报告另行回绑」已不成立，该报告已于 0ed7ee7 回绑 @ 7f82399，其后由后续会话在更新\nSHA 上重绑。本次只改 contracts/SOURCE.md，不在任何 evidence-scopes 作用域内，不影响报告新鲜度。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/7523bd04ab6e3606adf9d17c0b19b74e951e9dd5","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T15:58:50-07:00","added":[],"removed":[],"modified":["contracts/SOURCE.md"]},"repository":{"id":116,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"enterprise-platform","full_name":"luoanwu/enterprise-platform","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":19827,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/languages","html_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/enterprise-platform.git","clone_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform.git","original_url":"","website":"","stars_count":0,"forks_count":0,"watchers_count":1,"branch_count":43,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-09-11T07:33:25+08:00","updated_at":"2026-09-19T06:57:38+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"}}... |