Why: GET /api/commands/audit returns every tenant's audit rows; the regression test pins the desired owner-scoped behavior before the fix.
Evidence: go test ./internal/server -run TestCommandAuditOwnerScoping FAIL (owner alice sees bob's row; output recorded on the task card).
Impact: Test only; suite red on this commit by design.
Refs: Task card R1; U0 proposal section 5 C7 security finding.
Why: GET /api/commands/audit leaked every tenant's audit rows (command ids, entrances, conversation ids, param digests) to any authenticated user; owner was never recorded nor filtered.
Evidence: Red run at a7cc69b FAIL (alice sees bob's row); after fix go test ./... 32/32 packages ok, including TestCommandAuditOwnerScoping and the v18 backfill test (rows recorded on the task card).
Impact: v18 migration adds command_audit.owner with actor-based backfill (empty-actor rows stay invisible via API, kept in-table); AppendAudit/ListAudits gain owner params; cmdbus port and fakes updated; handler passes authenticated owner. No public extension surface change.
Refs: Task card R1; U0 proposal section 5 C7 finding.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
问题
GET /api/commands/audit无租户过滤：store.ListAudits无 owner 条件、command_audit表无 owner 列——多用户认证档下任何登录用户可读全租户命令审计（命令 ID、入口、会话 ID、参数摘要、状态）。发现与引证见 Dev 仓任务卡（feature/command-audit-owner-scoping）与 RDM 仓 U0 提案 §5 C7。修复（红测先行）
command_audit_owner：加owner列（两方言）+ 存量回填COALESCE(payload.actor,'')（修复前 Actor 是唯一归属线索）+ 索引(owner, conversation_id, time)；down 先删索引再 DROP COLUMN（sqlite 被索引列直接 DROP 会报错）。AppendAudit(owner, env)/ListAudits(owner, conversationID, limit)按租户写入与过滤；owner 为空=无作用域（纵深防御）。cmdbus.AuditStore端口与auditReceipt传req.Owner；server.listAudits传认证注入的 owner；测试假体同步。验证（SELF；CI 为权威 GATE）
红：
a7cc69bFAIL（alice 查到 bob 行）；绿：e0b1c27go test ./...32/32 包 ok（含TestCommandAuditOwnerScoping与 v18 回填测试）。既有迁移测试期望更新至 v18。关联
Dev gitlink bump PR 随任务卡推进（本 PR 为组件侧）。不合入，待评审。
Pull request closed