WorkBuddy 2d60f7899f docs(audit): ZC-MM-001 红娘角色权限差距审计报告 ...

- 基准：《善缘丹阳 V1.1 红娘角色权限正式决策与开发规则》（DEC-MATCHMAKER-001~006
  全部 LOCKED，A1/B1 已确认）
- 审计范围：backend matchmaker/referral/audit/security/auth、Flyway V001~V052、
  admin-web 红娘页面、现有测试、治理文档；全部结论带文件:行号证据
- 核心结论：A1 分配关系未建模（分配=工单指派）、claim/followup/complete 无归属校验、
  /pending 全局队列对全体红娘可见、无红娘组长角色、模块内越权拒绝不落审计
- P0×5 / P1×6 / P2×6 差距清单 + 可复用模块（CounselingService INV-012 范式、
  DataScopeGuard、recordSensitiveAccess）+ ZC-MM-002~007 实施顺序建议
- 首次建立 docs/audits/ 目录

2026-10-09 22:46:32 +08:00

..

api

docs: 幂等键检修报告；勘误 API_INVENTORY 与 HTTP 报告；同步 STATUS/JIRA

2026-09-18 16:37:47 +08:00

archive/design-v1.0

chore(docs): V1.0 前端设计文档归档至 docs/archive/design-v1.0；为仍被援引的 V1.0 总纲文档加取代头注

2026-09-18 20:25:58 +08:00

audits

docs(audit): ZC-MM-001 红娘角色权限差距审计报告

2026-10-09 22:46:32 +08:00

database

docs: 状态文件同步到 2026-09-18 实况（方案任务三）

2026-09-18 21:15:29 +08:00

decisions

docs(brand): 全仓库 Codex 署名统一为 WorkBuddy + 5 个文件重命名

2026-09-16 14:37:44 +08:00

gate-output

docs(gate): add phase 4 gate output artifacts

2026-09-14 11:44:02 +08:00

governance

feat(ci): 新增后端契约门禁 scripts/run-backend-contracts.mjs 并接入 CI

2026-09-30 16:21:25 +08:00

legal

docs: 数据保留 36 个月政策定稿 + 09-20 收尾状态 —— STATUS 版本演进表重排至 rc.20，隐私政策 §3.3/PIA §8 修订，UAT V1.1 用例 46 条（9 角色×7 路径），E2E 65/65 本机模拟 CI 登记

2026-09-20 22:30:44 +08:00

security

docs: 数据保留 36 个月政策定稿 + 09-20 收尾状态 —— STATUS 版本演进表重排至 rc.20，隐私政策 §3.3/PIA §8 修订，UAT V1.1 用例 46 条（9 角色×7 路径），E2E 65/65 本机模拟 CI 登记

2026-09-20 22:30:44 +08:00

superpowers

fix(organization): 修复创建机构审计缺操作人；补全机构修复的验证并部署 Docker 测试环境

2026-09-22 00:46:10 +08:00

ADMIN_REFERENCE_UI_QA_2026-09-13.md

test: verify admin reference UI fidelity

2026-09-13 22:09:15 +08:00

ANALYTICS_METRICS.md

fix(analytics): close Phase 20 KEEP-VERIFY — 20 defects (fake metric definitions, hardcoded zeros, systemic soft-delete leak, module-wide 403, fake-green tests); add MetricCatalog + unified calculator + V043 grants + 51 guard tests; full regression 648 green

2026-09-17 23:25:31 +08:00

ARCHITECTURE_BASELINE_V1.1.md

docs(brand): 全仓库 Codex 署名统一为 WorkBuddy + 5 个文件重命名

2026-09-16 14:37:44 +08:00

CODE-REVIEW-2026-09-24.md

chore(release): 冻结 v1.1.0 版本

2026-09-30 12:10:00 +08:00

DEMO_DATA.md

chore: establish V1.1 recovery baseline

2026-09-09 22:05:00 +08:00

HTTP语义检修报告-2026-09-18.md

docs: 幂等键检修报告；勘误 API_INVENTORY 与 HTTP 报告；同步 STATUS/JIRA

2026-09-18 16:37:47 +08:00

JIRA_BACKLOG.md

docs: 数据保留 36 个月政策定稿 + 09-20 收尾状态 —— STATUS 版本演进表重排至 rc.20，隐私政策 §3.3/PIA §8 修订，UAT V1.1 用例 46 条（9 角色×7 路径），E2E 65/65 本机模拟 CI 登记

2026-09-20 22:30:44 +08:00

OPS.md

chore: establish V1.1 recovery baseline

2026-09-09 22:05:00 +08:00

P0阻断项修复报告_2026-09-15.md

refactor(backend): P0 阻断修复 + 按最新修改时间收敛重复模块与契约

2026-09-15 22:29:26 +08:00

PENDING_DECISIONS.md

V1.0.1 配置与规则纠偏：照片上限配置化+强校验 / 活体开关闭环 / 推荐阈值快照+规则版本化 / governance 三表+漂移审计

2026-09-21 02:05:15 +08:00

PHASE26-GO-LIVE-CHECKLIST.md

docs(phase26): 上线清单 ⛔ 结论更正为仅第 2/5 项阻塞（第 4/6 项已闭环）+ 覆盖率数字更新

2026-09-23 14:46:03 +08:00

Phase-01-V11-Recovery-Completion-Report-2026-09-09.md

docs: 废止漏网报告 Phase-V11-Deployment-Completion-Report（原地重写）+ 修订两处引用

2026-09-18 21:34:33 +08:00

Phase-02-V11-Recovery-Completion-Report-2026-09-10.md

feat: complete phase 02 RBAC and data scope recovery

2026-09-10 10:58:43 +08:00

Phase-03-V11-Recovery-Completion-Report-2026-09-12.md

docs(brand): 全仓库 Codex 署名统一为 WorkBuddy + 5 个文件重命名

2026-09-16 14:37:44 +08:00

Phase-04-V11-Recovery-Completion-Report-2026-09-12.md

docs(brand): 全仓库 Codex 署名统一为 WorkBuddy + 5 个文件重命名

2026-09-16 14:37:44 +08:00

Phase-05-V11-Recovery-Completion-Report-2026-09-12.md

docs: add phase 04-06 recovery reports, gate outputs and execution plan

2026-09-14 10:01:41 +08:00

Phase-06-V11-Recovery-Completion-Report-2026-09-12.md

docs: add phase 04-06 recovery reports, gate outputs and execution plan

2026-09-14 10:01:41 +08:00

Phase-07-V11-Recovery-Completion-Report-2026-09-13.md

feat(api): 补齐 /me/* 命名空间，恢复 17 个 404 调用 + 修 /me/status 过期桩

2026-09-16 12:54:39 +08:00

Phase-08-V11-Recovery-Completion-Report-2026-09-16.md

fix(invariants): Phase 08 复验 —— 修复 INV-004 搜索/详情绕过 Block + matches.source 取值越界

2026-09-16 15:11:38 +08:00

Phase-09-V11-Recovery-Completion-Report-2026-09-16.md

fix(chat): Phase 09 复验 —— 修复 WebSocket 下行死链路 / Unmatch 后可发消息 / Block 未落库 / 聊天 IDOR

2026-09-16 16:42:48 +08:00

Phase-10-V11-Recovery-Completion-Report-2026-09-16.md

fix(safety): Phase 10 复验 —— 修复图片上传魔数校验死代码（生产故障）/ 高风险词写入日志

2026-09-16 21:00:52 +08:00

Phase-11-V11-Recovery-Completion-Report-2026-09-16.md

fix(notification): Phase 11 复验 —— 修复通知类型违反生产 CHECK 约束（生产故障）/ 幂等无库兜底 / 婚前辅导通知未接线

2026-09-16 21:50:56 +08:00

Phase-12-V11-Recovery-Completion-Report-2026-09-16.md

fix(relationship): Phase 12 复验 —— 修复实体↔生产迁移系统性漂移（生产故障族）/ 双路径 episode 与 NPE / 测试库缺表致首页零覆盖 / 计划项 2 未实现

2026-09-16 23:01:13 +08:00

Phase-13-V11-Recovery-Completion-Report-2026-09-16.md

fix(matchmaker,referral): close Phase 13 KEEP-VERIFY/EXTEND — 7 real defects

2026-09-17 00:01:53 +08:00

Phase-13A-V11-Completion-Report.md

docs: 废止漏网报告 Phase-V11-Deployment-Completion-Report（原地重写）+ 修订两处引用

2026-09-18 21:34:33 +08:00

Phase-13A-V11-Recovery-Completion-Report-2026-09-17.md

fix(counseling): close Phase 13A KEEP-VERIFY/EXTEND — 9 real defects + 4 test-infra defects

2026-09-17 01:25:12 +08:00

Phase-14-V11-Recovery-Completion-Report-2026-09-17.md

fix(activity): close Phase 14 KEEP-VERIFY/EXTEND — 11 backend + 3 frontend-contract + 2 test-fidelity defects

2026-09-17 14:02:00 +08:00

Phase-15-V11-Recovery-Completion-Report-2026-09-17.md

fix(activity): close Phase 15 KEEP-VERIFY/EXTEND — 2 critical + 14 other defects, 3 test-fidelity fixes

2026-09-17 15:07:52 +08:00

Phase-16-V11-Recovery-Completion-Report-2026-09-17.md

fix(activity-mutual): close Phase 16 KEEP-VERIFY/EXTEND — 7 defects + 1 hidden compile defect (reopenEpisode) + 1 test-fidelity; unify dual-impl to confirmActivityInterest; INV-006 fix; +7 tests (481 green)

2026-09-17 16:47:10 +08:00

Phase-17-V11-Recovery-Completion-Report-2026-09-17.md

fix(risk/report): close Phase 17 KEEP-VERIFY/EXTEND — 6 defects + 1 hidden compile defect (jakarta) + test-coverage blind zone (3 missing tables); add sensitive-access audit + ReportAndRiskPhase17IntegrationTest (7); full regression 488 green

2026-09-17 20:42:09 +08:00

Phase-18-V11-Recovery-Completion-Report-2026-09-17.md

fix(appeal): close Phase 18 KEEP-VERIFY — 8 defects (zero-coverage appeals table + 6 fake-green tests; operator-notification FK crash; appealType CHECK; escalated dead-end; processAppeal race; soft-delete filters; hardcoded resolved; evidence contract); add AppealPhase18IntegrationTest (15); full regression 494 green

2026-09-17 21:07:25 +08:00

Phase-19-V11-Recovery-Completion-Report-2026-09-17.md

docs(phase19): cite the recovery tag instead of a moving commit sha

2026-09-17 22:25:10 +08:00

Phase-20-V11-Recovery-Completion-Report-2026-09-17.md

fix(analytics): close Phase 20 KEEP-VERIFY — 20 defects (fake metric definitions, hardcoded zeros, systemic soft-delete leak, module-wide 403, fake-green tests); add MetricCatalog + unified calculator + V043 grants + 51 guard tests; full regression 648 green

2026-09-17 23:25:31 +08:00

Phase-21-V11-Recovery-Completion-Report-2026-09-18.md

fix(account-lifecycle): close Phase 21 KEEP-VERIFY — 6 real defects + fake-green tests

2026-09-18 10:12:34 +08:00

Phase-22-V11-Recovery-Completion-Report-2026-09-18.md

docs: 二次修正 features 断言失实（5 处）—— 原判据「*.yml 无 features 块」被证伪

2026-09-18 21:58:58 +08:00

Phase-23-V11-Recovery-Completion-Report-2026-09-18.md

test(phase23): KEEP-VERIFY — remove 44 pass shells + fake INV tests, add shell guard

2026-09-18 11:49:18 +08:00

Phase-23B-V11-E2E-Infrastructure-Completion-Report-2026-09-18.md

test(e2e): Phase 23B — rebuild E2E infrastructure; fix 6 real prod defects it exposed

2026-09-18 13:50:19 +08:00

Phase-V11-Deployment-Completion-Report.md

docs: 二次修正 features 断言失实（5 处）—— 原判据「*.yml 无 features 块」被证伪

2026-09-18 21:58:58 +08:00

PROGRESS-ASSESSMENT-2026-09-21.md

fix(organization): 修复创建机构审计缺操作人；补全机构修复的验证并部署 Docker 测试环境

2026-09-22 00:46:10 +08:00

STATUS.md

docs(phase26): 上线前准备 — 13 项手动验证清单 + 冒烟脚本骨架 + STATUS 文档矛盾清理

2026-09-23 11:57:07 +08:00

UAT-WALKTHROUGH-2026-09-23.md

fix(uat): 闭环 UAT 4 项硬阻塞（推荐恒空/保存即失败/越权端点/文档不一致）+ 小程序字段契约

2026-09-23 14:33:43 +08:00

UI_CLEANUP_INVENTORY_2026-09-13.md

docs(brand): 全仓库 Codex 署名统一为 WorkBuddy + 5 个文件重命名

2026-09-16 14:37:44 +08:00

UI_CLEANUP_REPORT_2026-09-13.md

docs(brand): 全仓库 Codex 署名统一为 WorkBuddy + 5 个文件重命名

2026-09-16 14:37:44 +08:00

UI_REDESIGN_PAGE_MATRIX_V1.1.md

feat(api): 补齐 /me/* 命名空间，恢复 17 个 404 调用 + 修 /me/status 过期桩

2026-09-16 12:54:39 +08:00

V1_0_TO_V1_1_GAP_ANALYSIS.md

docs(brand): 全仓库 Codex 署名统一为 WorkBuddy + 5 个文件重命名

2026-09-16 14:37:44 +08:00

V1_1_CHANGELOG.md

chore: establish V1.1 recovery baseline

2026-09-09 22:05:00 +08:00

善缘丹阳 V1.1 WorkBuddy 开发执行计划修订版.md

docs(brand): 全仓库 Codex 署名统一为 WorkBuddy + 5 个文件重命名

2026-09-16 14:37:44 +08:00

善缘丹阳 V1.1 WorkBuddy-Jira 最终开发任务增量清单.md

docs(brand): 全仓库 Codex 署名统一为 WorkBuddy + 5 个文件重命名

2026-09-16 14:37:44 +08:00

善缘丹阳 V1.1 WorkBuddy最终主启动提示词（整合版）.md

docs(brand): 全仓库 Codex 署名统一为 WorkBuddy + 5 个文件重命名

2026-09-16 14:37:44 +08:00

善缘丹阳 V1.1 客户需求基线增量开发与修复计划.md

docs(governance): JIRA Epic 总览表补全状态列（P01~P07 补 ✅ / P23~P26 如实标注）；基线计划 Phase 22 合并重复口径澄清块

2026-09-19 11:45:27 +08:00

善缘丹阳 V1.1 数据库与API增量设计.md

docs(brand): 全仓库 Codex 署名统一为 WorkBuddy + 5 个文件重命名

2026-09-16 14:37:44 +08:00

善缘丹阳 V1.1 页面级功能清单与交互流程修订版.md

docs(brand): 全仓库 Codex 署名统一为 WorkBuddy + 5 个文件重命名

2026-09-16 14:37:44 +08:00

幂等键检修报告-2026-09-18.md

docs(idempotency): 统一报告中的计数口径（25 处调用点 / 30 处声明）并补 CI E2E 缺陷到结论行

2026-09-18 16:40:09 +08:00

文档治理报告-2026-09-18.md

docs: 二次修正 features 断言失实（5 处）—— 原判据「*.yml 无 features 块」被证伪

2026-09-18 21:58:58 +08:00