| event_payload |
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"eb275b10c470d5db1907473c40e6c831d1e7a1c6","after":"21d7c1aaae83d8d5e40aa185b1bd86d3a8d8d99f","compare_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/compare/eb275b10c470d5db1907473c40e6c831d1e7a1c6...21d7c1aaae83d8d5e40aa185b1bd86d3a8d8d99f","commits":[{"id":"21d7c1aaae83d8d5e40aa185b1bd86d3a8d8d99f","message":"docs(部署,runbook): 记录补 §16——D-13 从推断变成实测、订正并复验，另登记 D-15\n\nD-13 此前只是读代码推断（判定链对不上）。本轮先做成可证伪的实测：用 dev 的 HS256 密钥\n手工签发三个只差 sub 的 token 打 GET /api/platform/ops/definitions——\n\n sub = users.subject（IdP 令牌的实际形态） 订正前 403 OPS_FORBIDDEN → 订正后 200\n sub = users.id（白名单原值） 订正前 200 → 订正后 403\n 同上但不带 platform:ops（对照） 两次都是 403 OPS_SCOPE_REQUIRED\n\n第三行是对照组，证明守卫顺序是 scope 在前、白名单在后，前两行的差异确实出在白名单这一关。\nsub 的实际形态取自 §14 那次真实登录的令牌，不是猜的。\n\n订正落在仓外 .secrets（PLATFORM_OPS_ADMIN_SUBJECTS 由 users.id 改为 users.subject，\n并在键上方留三行注释说明判定链），force-recreate 重建 runtime 容器后复验，健康探针 200。\nD-13 闭环。\n\n同时订正一个我自己此前过于保守的判断：原以为「必须等 canonical 租户分支合并后与 D-4 一并验」，\n实际 D-4 挡的是执行那一步，定义面的读取不受影响，守卫这一层现在就能独立验证。\n\n新登记 D-15：当前没有任何 OIDC 客户端的 allowedScopes 含 platform:ops（三个客户端全是\nopenid profile [idp:manage]），真实 IdP 令牌因此卡在 scope 关——不是白名单、也不是 D-4。\n给客户端放这个 scope 等于把平台运维权发给浏览器里的公开客户端，属安全裁决，留 Owner。\n\nrunbook §2.1 的警告块同步更新：那处现已订正，并指向 §16 与 D-15。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/21d7c1aaae83d8d5e40aa185b1bd86d3a8d8d99f","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T16:58:15-07:00","added":[],"removed":[],"modified":["docs/dev部署运行重做记录-2026-09-18.md","docs/runbook.md"]},{"id":"f28f8f9935231e083402f5fa47269576a96eb38d","message":"test(runtime): credential 的租约 planner 整支不在门禁上——补 lease-plan / lease-refresh，10 处未接线的第 3 处\n\n结构比对报出 LocalMachineCredentialLeasePlanner（308 行、三个公开方法）整支未接线：本模块此前只有\nlease-request 一条规则，走的是 preflight 纯规则；planner 的策略快照准入、主体登记、受众 / Scope\nallowlist、TTL 上限、授权版本水位与热更一条都不在门禁上。判定逻辑一行未改。\n\n判定按 kind：MachineCredentialLeaseResult 的 BLOCKED 携带 blockers 而非 reasons。\n\n接上规则后照例先变差：冒出 6 条「夹具与单测都没有」（归属三件套、授权版本、请求时钟，以及 refresh\n侧的版本 / 修订 / 主体策略），逐条钉完回到 0。\n\n覆盖：夹具 10 → 27 例（正 4 / 反 23），规则 1 → 3；三档（都没有 / 仅单测 / 未接线）均为 0。\n新钉住的策略面包括 AUDIENCE_NOT_ALLOWED / SCOPE_NOT_ALLOWED / TTL_OUT_OF_POLICY / STALE_AUTHORIZATION\n/ MACHINE_PRINCIPAL_NOT_REGISTERED / AI_DELEGATION_REQUIRED——凭据签发的准入闸门此前在门禁上一条没有。\n\n证据：pnpm --dir runtime --filter @juhai/module-credential test 46/46、该套件夹具 27/27 失败 0、\nfixture-coverage 三档全 0。本次不回绑任何 reports/。\n\n进度：10 处未接线已收 3 处（跨域流程 refresh、scope、credential）。余 7 处在 ai-gateway 2 /\npermission 3 / audit / fact 各 1。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/f28f8f9935231e083402f5fa47269576a96eb38d","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T16:57:26-07:00","added":[],"removed":[],"modified":["runtime/modules/credential/src/domain/fixture-evaluator.ts","runtime/modules/credential/test/fixtures/credential.fixtures.json"]},{"id":"7eadfb1a5af353077f1a32eef51389f4a6f7fbfa","message":"chore(release): 三包推到 1.0.0-rc.6——check:fact-pii 这次真的随包出去\n\nrc.5 发的时候 check-fact-pii.mjs 还不在 governance 包的 files 里，消费者拿到的 rc.5 不含它。\neb275b1 把它与 fact-pii-rules.json 加进 files、在 CLI 注册 check:fact-pii 子命令，\n并补上了让它在消费者仓真跑得起来的两处（--dir 指定 Fact schema 目录、判据回落到包内自带）。\n这趟车就是为了把那些送出去。\n\n自 rc.5 源 cf05344 起的随车内容：\n governance 7 文件 / 2 提交（fact-pii 进包 + 消费者可用性）\n contracts 3 文件 / 1 提交\n runtime/clients/fact 0 文件 / 0 提交 —— **完全没有变化，纯跟车**（同 rc.5）\n\n通道：本地旁路（G-12 第五次）。2026-09-18 实测 GitHub Actions 仍停在 run 35404565689\n（failure，计费），没有新 run；GitHub 镜像落后 35 条。正道仍不可满足。\n\n按 CL-5 打 tag packages-v1.0.0-rc.6（连续第三趟）。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/7eadfb1a5af353077f1a32eef51389f4a6f7fbfa","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T16:56:38-07:00","added":[],"removed":[],"modified":["contracts/package.json","governance/package.json","runtime/clients/fact/package.json"]},{"id":"a2a86a7161102dba3d3ef227b89545ea65612273","message":"test(runtime): scope 的 410 行 planner 整支不在门禁上——补 plan / refresh 两条规则，10 处未接线的第 2 处\n\n结构比对报出 LocalScopeResolutionPlanner（三个公开方法）整支未接线：本模块此前只有 snapshot 一条规则，\nplanner 的请求体检、应用登记、目录版本、路由匹配与热更一条都不在门禁上。判定逻辑一行未改。\n\n判定按 kind 而不是 `\"reasons\" in`：ScopeResolutionPlanResult 的 BLOCKED 携带的是 blockers，\n按字段存在与否判会被当成放行——注册中心那次就是这么漏的，这里一开始就避开。\n\n接上规则后覆盖度先变差，同样是预期的：plan / refresh 两面第一次被变异探针走到，冒出 15 条\n「夹具与单测都没有」（十条请求字段守卫 + 路由未登记 + refresh 侧四条），逐条钉完回到 0。\n\n覆盖：夹具 8 → 35 例（正 4 / 反 31），规则 1 → 3；该套件三档（都没有 / 仅单测 / 未接线）均为 0。\n模块夹具与 test/negative/*.fixtures.test.ts 同源（it.each 直接遍历夹具文件），单测随夹具自动同步。\n\n证据：pnpm --dir runtime --filter @juhai/module-scope test 53/53、typecheck 绿、\n该套件夹具 35/35 失败 0、fixture-coverage 三档全 0。本次不回绑任何 reports/。\n\n进度：10 处未接线已收 2 处（跨域流程 refresh、scope）。余 8 处在 ai-gateway 2 / permission 3 /\naudit / credential / fact 各 1，planner 308—734 行，按模块逐个收。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/a2a86a7161102dba3d3ef227b89545ea65612273","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T16:56:05-07:00","added":[],"removed":[],"modified":["runtime/modules/scope/src/domain/fixture-evaluator.ts","runtime/modules/scope/test/fixtures/scope.fixtures.json"]}],"total_commits":0,"head_commit":{"id":"21d7c1aaae83d8d5e40aa185b1bd86d3a8d8d99f","message":"docs(部署,runbook): 记录补 §16——D-13 从推断变成实测、订正并复验，另登记 D-15\n\nD-13 此前只是读代码推断（判定链对不上）。本轮先做成可证伪的实测：用 dev 的 HS256 密钥\n手工签发三个只差 sub 的 token 打 GET /api/platform/ops/definitions——\n\n sub = users.subject（IdP 令牌的实际形态） 订正前 403 OPS_FORBIDDEN → 订正后 200\n sub = users.id（白名单原值） 订正前 200 → 订正后 403\n 同上但不带 platform:ops（对照） 两次都是 403 OPS_SCOPE_REQUIRED\n\n第三行是对照组，证明守卫顺序是 scope 在前、白名单在后，前两行的差异确实出在白名单这一关。\nsub 的实际形态取自 §14 那次真实登录的令牌，不是猜的。\n\n订正落在仓外 .secrets（PLATFORM_OPS_ADMIN_SUBJECTS 由 users.id 改为 users.subject，\n并在键上方留三行注释说明判定链），force-recreate 重建 runtime 容器后复验，健康探针 200。\nD-13 闭环。\n\n同时订正一个我自己此前过于保守的判断：原以为「必须等 canonical 租户分支合并后与 D-4 一并验」，\n实际 D-4 挡的是执行那一步，定义面的读取不受影响，守卫这一层现在就能独立验证。\n\n新登记 D-15：当前没有任何 OIDC 客户端的 allowedScopes 含 platform:ops（三个客户端全是\nopenid profile [idp:manage]），真实 IdP 令牌因此卡在 scope 关——不是白名单、也不是 D-4。\n给客户端放这个 scope 等于把平台运维权发给浏览器里的公开客户端，属安全裁决，留 Owner。\n\nrunbook §2.1 的警告块同步更新：那处现已订正，并指向 §16 与 D-15。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/21d7c1aaae83d8d5e40aa185b1bd86d3a8d8d99f","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T16:58:15-07:00","added":[],"removed":[],"modified":["docs/dev部署运行重做记录-2026-09-18.md","docs/runbook.md"]},"repository":{"id":116,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"enterprise-platform","full_name":"luoanwu/enterprise-platform","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":21469,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/languages","html_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/enterprise-platform.git","clone_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform.git","original_url":"","website":"","stars_count":0,"forks_count":0,"watchers_count":1,"branch_count":44,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-09-11T07:33:25+08:00","updated_at":"2026-09-19T07:55:10+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"}}... |