| event_payload |
{"ref":"refs/heads/main","befo {"ref":"refs/heads/main","before":"d7d9fe5adc753a199dba41ec4be184d3db5053c4","after":"e3b9d12525448038fd8d8ac3f3c1470552ce4ff7","compare_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/compare/d7d9fe5adc753a199dba41ec4be184d3db5053c4...e3b9d12525448038fd8d8ac3f3c1470552ce4ff7","commits":[{"id":"e3b9d12525448038fd8d8ac3f3c1470552ce4ff7","message":"chore(reports): sbom 回绑——包清单一字未变，因为镜像还是 106 个提交前那个\n\nlockfile 模式扫 reports/image-digest.json 指向的镜像（sha256:c0869934…，本机 docker 里还在），\n268 个包，worktreeDirty=false。\n\n**这次回绑没有改变任何实质结论：** 触发过期的是 63ff31f 改的 runtime/pnpm-lock.yaml（把 clients\n三包的 devDeps pin 成 exact），而 SBOM 描述的是镜像里的物料——镜像绑的源提交 05e3826 距当前 HEAD\n106 个提交，那些改动根本还没进镜像。逐包比对确认：新旧两份的包清单完全一致，变的只有 SPDX 生成时间戳。\n\n诚实读法：**provenance.gitSha 说「我是在哪跑的」，sourceSha 说「我描述的是 05e3826 的镜像」——\n两者相距 106 个提交。** 作用域纳入 runtime/pnpm-lock.yaml，是为了在锁文件变动时提醒「SBOM 可能\n不再反映当前源码」；正确回应是**重建镜像**（需 BuildKit + Gitea token，不在本机这轮范围），\n而不是重跑一遍生成器。回绑只是让证据链不挂着一条无人处理的红，没有解决镜像落后本身。\n\ncoverage 仍是 partial：只含 /srv/runtime/apps/api-nestjs 的 Node 依赖，不含基础镜像的 Debian 包。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/e3b9d12525448038fd8d8ac3f3c1470552ce4ff7","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T17:22:33-07:00","added":[],"removed":[],"modified":["reports/sbom.latest.json","reports/sbom.spdx.json"]},{"id":"a48cbd69d9411a1c7bc85e0fb97520c4392d1e73","message":"docs(证据): 补 identity/reports 的扫描面处置说明，并修掉它已造成的一处数字漂移\n\n全仓盲区复核查出的唯一真发现：check-evidence-freshness.mjs 只扫 reports/ 与\nruntime/reports/ 两个目录（写死在源码里），identity/reports/ 的 15 份报告既不在作用域\n登记里、也不在未登记账里——不是「未登记」，是压根没被看见。\n\nidentity 是 PF-07 阶段 1 的过渡工作区，按仓纪律 7 其三级门禁不进根 pnpm check 链，这层\n分离是有意的；但报告新鲜度的失察不是：那 15 份确实被当证据用（verify:candidate 从\nidentity/reports/baseline.json 读测试地板，docs/项目完整能力表.md E03 直接引用两份），\n而 identity 自带的 check:docs-truth 有 0 条 freshness-sha-* 断言（runtime 版有 4 条），\n于是「报告往前跑了、文档没跟上」这类漂移没有任何一道门禁能发现。\n\n它已经真的发生了。三处文档写 runtime 255 / UI 12 @ 85d538b，而报告实际绑：\nruntime-acceptance @ 25ead3e（2026-09-12，261 项 / 地板 255）、ui-acceptance @ 90cda56\n（2026-09-13，12 项）、dual-backend-behavior @ 25ead3e（差分 0）。三处按文档既有的\n「当前 + 历史」体例改正，85d538b 那轮移入历史；该次报告未记录的细节（新 UI 运行的\nWeb / API 端口）不补写，明示未记录。\n\n处置说明写进 undeclaredNote，含二选一出口（纳入扫描面逐份登记，或给 identity 的\ncheck-docs-truth 补 freshness-sha-* 断言）并注明 PF-07 阶段 2 后此条作废——但在那之前\n不得把「将来会消失」当作现在不管的理由。归门禁 Owner 裁。\n\n核验：check:evidence 未登记账仍 10 份 0 份无说明；identity check:governance-docs 与\ncheck:docs-truth 均绿；工作区一致性 L4 / L10 / L13 均 0。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/a48cbd69d9411a1c7bc85e0fb97520c4392d1e73","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T17:20:16-07:00","added":[],"removed":[],"modified":["CLAUDE.md","docs/项目完整能力表.md","governance/evidence-scopes.json","identity/CLAUDE.md"]}],"total_commits":0,"head_commit":{"id":"e3b9d12525448038fd8d8ac3f3c1470552ce4ff7","message":"chore(reports): sbom 回绑——包清单一字未变，因为镜像还是 106 个提交前那个\n\nlockfile 模式扫 reports/image-digest.json 指向的镜像（sha256:c0869934…，本机 docker 里还在），\n268 个包，worktreeDirty=false。\n\n**这次回绑没有改变任何实质结论：** 触发过期的是 63ff31f 改的 runtime/pnpm-lock.yaml（把 clients\n三包的 devDeps pin 成 exact），而 SBOM 描述的是镜像里的物料——镜像绑的源提交 05e3826 距当前 HEAD\n106 个提交，那些改动根本还没进镜像。逐包比对确认：新旧两份的包清单完全一致，变的只有 SPDX 生成时间戳。\n\n诚实读法：**provenance.gitSha 说「我是在哪跑的」，sourceSha 说「我描述的是 05e3826 的镜像」——\n两者相距 106 个提交。** 作用域纳入 runtime/pnpm-lock.yaml，是为了在锁文件变动时提醒「SBOM 可能\n不再反映当前源码」；正确回应是**重建镜像**（需 BuildKit + Gitea token，不在本机这轮范围），\n而不是重跑一遍生成器。回绑只是让证据链不挂着一条无人处理的红，没有解决镜像落后本身。\n\ncoverage 仍是 partial：只含 /srv/runtime/apps/api-nestjs 的 Node 依赖，不含基础镜像的 Debian 包。\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n","url":"https://gitea.g-hi.com/luoanwu/enterprise-platform/commit/e3b9d12525448038fd8d8ac3f3c1470552ce4ff7","author":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"committer":{"name":"juhailaoluo pro","email":"hillao@juhailaoluodeMacBook-Pro.local","username":""},"verification":null,"timestamp":"2026-09-18T17:22:33-07:00","added":[],"removed":[],"modified":["reports/sbom.latest.json","reports/sbom.spdx.json"]},"repository":{"id":116,"owner":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"law@g-hi.com","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"name":"enterprise-platform","full_name":"luoanwu/enterprise-platform","description":"","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":21838,"language":"","languages_url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform/languages","html_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform","url":"https://gitea.g-hi.com/api/v1/repos/luoanwu/enterprise-platform","link":"","ssh_url":"git@gitea.g-hi.com:luoanwu/enterprise-platform.git","clone_url":"https://gitea.g-hi.com/luoanwu/enterprise-platform.git","original_url":"","website":"","stars_count":0,"forks_count":0,"watchers_count":1,"branch_count":44,"open_issues_count":0,"open_pr_counter":0,"release_counter":0,"default_branch":"main","archived":false,"created_at":"2026-09-11T07:33:25+08:00","updated_at":"2026-09-19T08:18:45+08:00","archived_at":"1970-01-01T08:00:00+08:00","permissions":{"admin":true,"push":true,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"all","has_releases":true,"has_packages":true,"has_actions":true,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":true,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":true,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":[],"licenses":[]},"pusher":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"},"sender":{"id":5,"login":"luoanwu","login_name":"","source_id":0,"full_name":"","email":"5+luoanwu@noreply.localhost","avatar_url":"https://gitea.g-hi.com/avatar/627574a890388a2aadc80ab38d22f3a0","html_url":"https://gitea.g-hi.com/luoanwu","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-01-30T16:28:30+08:00","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"luoanwu"}}... |