| event_payload |
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"832a54f24c1bf763ba06cf5513f7f7bd53b28e45","after":"748492c2a1013dbf03b6234f2a85dea73af7e9e6","compare_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/compare/832a54f24c1bf763ba06cf5513f7f7bd53b28e45...748492c2a1013dbf03b6234f2a85dea73af7e9e6","commits":[{"id":"748492c2a1013dbf03b6234f2a85dea73af7e9e6","message":"chore(reports): fact-pii / gate-flow / ci-mirror 三份回绑 @ bb26784\n\n经 governance/rebind-reports.mjs 在 HEAD 的临时干净检出里重跑，三份均绑 bb26784 /\nworktreeDirty=false：\n\n fact-pii 21 个 Fact / 116 个字段，0 处 PII 形状与开放结构，25 个自由文本登账待裁\n gate-flow 47 个脚本、35 个有消费入口（新门禁已被推导为在链上），12 个流外且已具名\n ci-mirror 规范化 462 行逐行相同（两份工作流同步加了 check:fact-pii）\n\n后两份的作用域含本轮改动的 package.json 与两份 workflow，故一并回绑。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/748492c2a1013dbf03b6234f2a85dea73af7e9e6","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T16:28:00-07:00","added":["reports/fact-pii.latest.json"],"removed":[],"modified":["reports/ci-mirror.latest.json","reports/gate-flow.latest.json"]},{"id":"bb26784b4f44517b57389d78fbfacac5915a0317","message":"feat(治理): 补上 check:fact-pii——仓纪律 4 的三件事里，Fact payload 禁 PII 此前无人守\n\n纪律 4 把三件事并列：禁 ^/~（check:pins 守）、禁跨模块 import（check:module-imports 守）、\nFact payload 禁止复制 PII（**没有任何机器在守**）。check:facts 只校验「声明的 Fact 类型是否\n登记」，从不看 payload 里装什么——往某个 Fact schema 加一个 user_email 字段，全链门禁一片绿。\nFact 是跨域流转的事件：个人信息应当留在权威域里按权限查，不随事件复制到每个消费者的\nInbox 与审计链上。\n\n两条判红：\n\n PII_SHAPED_KEY 字段名命中 PII 模式且未显式豁免。按 (^|_)pattern($|_) 的词边界匹配——\n 裸子串会让 principal_id（princ-ip-al）、storage_kind（stor-age）误报，\n 门禁第一天就会被当成坏了而绕过。测试钉住了这一条。\n UNBOUNDED_PAYLOAD 对象缺 properties 或未禁 additionalProperties。这条不是锦上添花：\n 开放结构能装任意键，键名规则对它完全无效，不堵住它前一条只是君子协定。\n\n一条**不判红**：unconstrainedText——无 enum/pattern/format 约束的字符串字段（现有 25 个，\nbuyer_snapshot 这种名字含糊、maxLength 200 的自由文本最典型）。它们确实是 PII 的入口，\n但「这个字段实际装什么」是业务语义。这 25 个字段**全部没有 description**，我写不出可靠的\n豁免理由，编造 25 条登记只会污染治理真源。如实登账进报告，留给人裁定。\n\n判据单源是 governance/fact-pii-rules.json（63 条模式 + 豁免登记），不写死在脚本里——\nPII 形状会随业务扩张，写死就意味着每次扩张都要改门禁代码并重跑它的测试。与 otel-attributes.json\n同思路。豁免按 \u003cFact\u003e:\u003c字段路径\u003e 登记，不是裸键名：同名字段在不同 Fact 里性质可以不同。\n\n扫描面含 contracts/candidates/facts——候选必须一起扫，否则 PII 字段可以先进候选、\n再随批准转正，绕开本门禁。不扫 compatibility/baselines：历史兼容基线按定义不可改，报红也无从修。\n\n接入：根 check 链（check:facts 之后）、两份 CI 工作流（check:ci-mirror 守逐行一致，462 行通过）、\nevidence-scopes 作用域登记。本机实测：21 个 Fact / 116 字段 0 违规；篡改必红两种形态\n（加 PII 字段、改开放结构）均 exit 1，还原后 exit 0；门禁测试 8 例全过。\n\n顺带把纪律 4 里 check:pins 的判据范围写明为 @juhai/* —— 原措辞未限定，读起来像全仓禁 ^/~。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/bb26784b4f44517b57389d78fbfacac5915a0317","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T16:26:28-07:00","added":["governance/check-fact-pii.mjs","governance/fact-pii-rules.json","governance/test/check-fact-pii.test.mjs"],"removed":[],"modified":[".gitea/workflows/platform.yml",".github/workflows/platform.yml","CLAUDE.md","governance/evidence-scopes.json","governance/rebind-reports.mjs","package.json"]}],"total_commits":0,"head_commit":{"id":"748492c2a1013dbf03b6234f2a85dea73af7e9e6","message":"chore(reports): fact-pii / gate-flow / ci-mirror 三份回绑 @ bb26784\n\n经 governance/rebind-reports.mjs 在 HEAD 的临时干净检出里重跑，三份均绑 bb26784 /\nworktreeDirty=false：\n\n fact-pii 21 个 Fact / 116 个字段，0 处 PII 形状与开放结构，25 个自由文本登账待裁\n gate-flow 47 个脚本、35 个有消费入口（新门禁已被推导为在链上），12 个流外且已具名\n ci-mirror 规范化 462 行逐行相同（两份工作流同步加了 check:fact-pii）\n\n后两份的作用域含本轮改动的 package.json 与两份 workflow，故一并回绑。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/748492c2a1013dbf03b6234f2a85dea73af7e9e6","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T16:28:00-07:00","added":["reports/fact-pii.latest.json"],"removed":[],"modified":["reports/ci-mirror.latest.json","reports/gate-flow.latest.json"]},"repository":{"id":116,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"enterprise-platform","full_name":"luoanwu/enterprise-platform","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":20917,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/languages","html_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/enterprise-platform.git","clone_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform.git","original_url":"","website":"","stars_count":0,"forks_count":0,"watchers_count":1,"branch_count":44,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-09-11T07:33:25+08:00","updated_at":"2026-09-19T07:26:10+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"}}... |