merge: feature/chore-history-rewrite — history rewrite tooling and docs

.doc/archive/ops/2026-09-13-git-history-epic-rewrite.md

@@ -0,0 +1,22 @@
+# Git 历史史诗重组执行记录
+
+**日期**: 2026-09-13  
+**status**: done
+
+## 结果
+
+- 358 线性 commit → 14 史诗 × (`feature/*`|`fix/*` + `merge --no-ff`) + 1 root anchor = **373 commit**
+- `git diff backup/pre-rewrite-2026-09-13 dev` 为空
+- `go test -short ./...` PASS
+- 旧历史：`dev-old-linear`、`backup/pre-rewrite-2026-09-13`
+
+## 产物
+
+- [`scripts/history-epic-manifest.tsv`](../../../scripts/history-epic-manifest.tsv)
+- [`scripts/rewrite-history-epics.sh`](../../../scripts/rewrite-history-epics.sh)
+- [`scripts/generate-commit-rewrite-map.py`](../../../scripts/generate-commit-rewrite-map.py)
+- [`reference/commit-rewrite-map-2026-09-13.md`](../reference/commit-rewrite-map-2026-09-13.md)
+
+## 远端
+
+- `origin/dev|test|main` force-with-lease 同步至重组后 HEAD

.doc/archive/ops/checklists/2026-09-13-codex-audit-p0-remediation.md

@@ -10,20 +10,20 @@ related_task: short-term/2026-09-13-codex-audit-p0-remediation.md
 
 ## Wave 0 — Agent 文档
 
-- [x] AGENTS.md / PROJECT.md / CLAUDE.md — commit 31fe607
+- [x] AGENTS.md / PROJECT.md / CLAUDE.md — commit 0d10c9a（原 31fe607，见 [rewrite map](../../reference/commit-rewrite-map-2026-09-13.md)）
 - [x] .cursor/rules — agent-collaboration + git-secrets
 - [x] .doc/ops templates + CURRENT
 
 ## Wave A — P0
 
-- [x] AUTH tasks/run + stream — commit d82021e；`task_run_authz_pg_test.go`
-- [x] DB 00025 — commit b13ced6；dev/test setval
+- [x] AUTH tasks/run + stream — commit 3b7b49c（原 d82021e）；`task_run_authz_pg_test.go`
+- [x] DB 00025 — commit 8c5dd97（原 b13ced6）；dev/test setval
 - [x] DATA lifecycle — dev UPDATE 47 → 0
 - [x] DATA test wf — UPDATE 5 retired
 
 ## Wave B — Go 门禁
 
-- [x] go vet ./... PASS — commit 91985a2
+- [x] go vet ./... PASS — commit 3d09bd6（原 91985a2）
 - [x] go test -short ./... PASS
 - [x] AdvisorBrief / V0.5 / chat / kb / health / asset
 
@@ -32,7 +32,7 @@ related_task: short-term/2026-09-13-codex-audit-p0-remediation.md
 - [x] test rebuild schema 25 — health 8081
 - [x] dev docker app schema 25 — health 8080
 - [x] main 冒烟 — health/ready 8000 schema 25；restart 恢复
-- [x] HTTP 超时 + env status 只读 — commit 505c419
+- [x] HTTP 超时 + env status 只读 — commit 0547bd5（原 505c419）
 - [x] .env.dev/.env.test chmod 600
 
 ## Wave D — 文档

.doc/archive/reference/commit-rewrite-map-2026-09-13.md

@@ -0,0 +1,43 @@
+# Commit SHA 重写对照表（2026-09-13）
+
+> **背景**：2026-09-13 将 358 个线性 `dev` commit 按 14 个功能史诗重放为 `feature/*` / `fix/*` + `merge --no-ff` 拓扑（策略 A）。  
+> **代码树**：`git diff backup/pre-rewrite-2026-09-13 dev` 为空——HEAD 实现与重写前一致。  
+> **旧线性历史**：本地保留于分支 `dev-old-linear` 与 tag `backup/pre-rewrite-2026-09-13`。
+
+## 对照规则
+
+- 匹配键：`subject | author | email | committer date`（重写前后一致）
+- 下列「旧 SHA」来自 `dev-old-linear`；「新 SHA」来自重组后 `dev`
+- 6 条缺 scope 的 message 已在重写中修正（如 `fix:` → `fix(quality):`）
+
+## 关键引用（checklist / test-report）
+
+| 旧 SHA | 新 SHA | 说明 |
+|--------|--------|------|
+| `d27b0ad` | `ee18e54` | 首 commit → `docs(ops):` 建立仓库基础架构 |
+| `31fe607` | `0d10c9a` | AGENTS / PROJECT / CLAUDE 入口 |
+| `d82021e` | `3b7b49c` | AUTH tasks/run + stream |
+| `b13ced6` | `8c5dd97` | DB 00025 种子序列 |
+| `91985a2` | `3d09bd6` | Go 质量门禁（message 修正为 `fix(quality):`） |
+| `505c419` | `0547bd5` | HTTP 超时 + env status 只读 |
+| `8f3aa0f` | `c605993` | pi-agent MiniMax 模型对齐 |
+| `abd0893e` | `f75e509` | StepEvaluator 实现 |
+| `bb3f3a1` | `73bf082` | pi-agent E2E v5 PASS |
+| `99e0d4a` | `096dc8a` | long-task recovery UX |
+| `56fb318` | `d03d939` | chat SSE wiring scope |
+| `33b1b8b` | `511864b` | doc taxonomy scaffold |
+| `5e5bc1f` | `f30886e` | 策略 A 分支规范 |
+
+## 新历史拓扑
+
+- 1 个 root anchor + 358 原子 commit + 14 个 `merge --no-ff` = **373 commit**
+- 史诗清单：[`scripts/history-epic-manifest.tsv`](../../../scripts/history-epic-manifest.tsv)
+- 重放脚本：[`scripts/rewrite-history-epics.sh`](../../../scripts/rewrite-history-epics.sh)
+
+## 全量映射生成
+
+```bash
+python3 scripts/generate-commit-rewrite-map.py > /tmp/full-map.tsv
+```
+
+（脚本随 `feature/chore-history-rewrite` 一并入库）

scripts/generate-commit-rewrite-map.py

@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+"""Print old->new commit SHA map by matching subject|author|email|date."""
+from __future__ import annotations
+
+import subprocess
+import sys
+
+ROOT = subprocess.check_output(["git", "rev-parse", "--show-toplevel"], text=True).strip()
+
+
+def git(*args: str) -> str:
+    return subprocess.check_output(["git", "-C", ROOT, *args], text=True).strip()
+
+
+def signature(commit: str) -> str:
+    return git("log", "-1", "--format=%s|%an|%ae|%ad", commit, "--date=iso-strict")
+
+
+def main() -> int:
+    old_hashes = git("log", "dev-old-linear", "--format=%H").splitlines()
+    new_by_sig: dict[str, str] = {}
+    for h in git("log", "dev", "--format=%H").splitlines():
+        new_by_sig[signature(h)] = h
+
+    print("old_sha\tnew_sha\tsubject")
+    for old in reversed(old_hashes):
+        sig = signature(old)
+        new = new_by_sig.get(sig, "")
+        subj = git("log", "-1", "--format=%s", old)
+        print(f"{old[:12]}\t{new[:12] if new else 'NOT_FOUND'}\t{subj}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/git-workflow-helper.sh

@@ -33,8 +33,8 @@ case "${COMMAND}" in
         echo ""
         case "${CURRENT_BRANCH}" in
             dev)
-                echo "状态: 正处于【开发分支】。"
-                echo "提示: 可直接在此分支进行小功能渐进式提交，或创建 feature/<name> 进行复杂功能开发。"
+                echo "状态: 正处于【开发合入基线】。"
+                echo "提示: 禁止直接 commit。请从最新 dev 创建 feature/<name> 或 fix/<name>，自测后占集成槽位 merge --no-ff 合回。"
                 ;;
             test)
                 echo "状态: 正处于【测试分支】。"

scripts/history-epic-manifest.tsv

@@ -0,0 +1,15 @@
+epic_slug	branch_type	start_commit	end_commit	merge_message
+foundation	feature	d27b0ad	40a25f9	merge: feature/foundation — repo scaffold and env baseline
+bizdev-core	feature	6f44916	8dc315b	merge: feature/bizdev-core — bizdev MVP stack
+agent-infra	feature	8405417	cd39a52	merge: feature/agent-infra — pi-agent Tavily and docker
+squad-intent	feature	b0142ab	d8a7254	merge: feature/squad-intent — squad engine intent and adaptive planning
+backend-platform	feature	0f21060	a695334	merge: feature/backend-platform — KB memory docgov API and chat history
+web-workbench	feature	0b62403	dcc0650	merge: feature/web-workbench — three-column workbench MVP
+web-features	feature	db238a4	2745e89	merge: feature/web-features — intent funnel export and templates
+rbac-auth	feature	3d75471	1c7320b	merge: feature/rbac-auth — dynamic RBAC and auth settings
+web-chat-ux	feature	a8701bc	8c8fa47	merge: feature/web-chat-ux — SSE chat longtask history workflow and seed data
+chat-idempotency-task	feature	f4da2f1	ba249a5	merge: feature/chat-idempotency-task — turn idempotency and task materials
+security-iam	feature	28faa49	a9828c6	merge: feature/security-iam — P0 security and IAM Phase 0-1
+workflow-abac-taskrun	feature	7951b0f	bb3f3a1	merge: feature/workflow-abac-taskrun — workflow ABAC taskrun and QA
+governance-v2-codex	fix	899a0e6	3596109	merge: fix/governance-v2-codex — three-workflow governance and Codex P0
+agent-docs-system	feature	33b1b8b	5e5bc1f	merge: feature/agent-docs-system — doc taxonomy and branch policy

scripts/rewrite-history-epics.sh

@@ -0,0 +1,104 @@
+#!/usr/bin/env bash
+# Replay linear dev history as feature/fix branches with merge --no-ff.
+# Requires: scripts/history-epic-manifest.tsv and tag backup/pre-rewrite-2026-09-13
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+MANIFEST="${ROOT_DIR}/scripts/history-epic-manifest.tsv"
+BACKUP_TAG="backup/pre-rewrite-2026-09-13"
+SOURCE_BRANCH="dev"
+TARGET_BRANCH="dev-rewritten"
+DRY_RUN="${DRY_RUN:-0}"
+
+declare -A MSG_OVERRIDE=(
+  [d27b0ad]="docs(ops): 建立仓库基础架构、三分支规范与环境运行文档"
+  [91985a2]="fix(quality): 闭环 Go 质量门禁（鉴权富化/V0.5/vet/health/KB gate/记忆轮询）"
+  [546de52]="ci(qa): add QA-001 gate with go vet, short tests, and migration check."
+  [e82b624]="docs(plan): add production governance plan and Phase 0 authz matrix"
+  [77d3da1]="docs(plan): add Phase 1 IAM and authorization implementation plan"
+  [ba249a5]="chore(scripts): fix backfill script import and run projection for ws_intake"
+)
+
+log() { echo "[rewrite] $*"; }
+die() { echo "[rewrite] ERROR: $*" >&2; exit 1; }
+
+[[ -f "${MANIFEST}" ]] || die "missing manifest: ${MANIFEST}"
+git rev-parse "${BACKUP_TAG}" >/dev/null 2>&1 || die "missing backup tag ${BACKUP_TAG}"
+
+cd "${ROOT_DIR}"
+
+if [[ "${DRY_RUN}" == "1" ]]; then
+  log "DRY_RUN=1 — manifest entries:"
+  tail -n +2 "${MANIFEST}"
+  exit 0
+fi
+
+current_branch="$(git branch --show-current)"
+[[ "${current_branch}" == "${SOURCE_BRANCH}" ]] || die "checkout ${SOURCE_BRANCH} first (on ${current_branch})"
+
+if git show-ref --verify --quiet "refs/heads/${TARGET_BRANCH}"; then
+  die "branch ${TARGET_BRANCH} already exists; delete it before rerun"
+fi
+
+log "creating orphan branch ${TARGET_BRANCH}"
+git checkout --orphan "${TARGET_BRANCH}"
+git rm -rf . >/dev/null 2>&1 || true
+git commit --allow-empty -m "chore: history rewrite root anchor"
+
+commit_range() {
+  local start="$1" end="$2"
+  if [[ "${start}" == "${end}" ]]; then
+    echo "${start}"
+    return
+  fi
+  if git rev-parse "${start}^" >/dev/null 2>&1; then
+    git rev-list --reverse "${start}^..${end}"
+  else
+    echo "${start}"
+    git rev-list --reverse "${start}..${end}"
+  fi
+}
+
+cherry_pick_commit() {
+  local hash="$1"
+  if ! git cherry-pick "${hash}"; then
+    die "cherry-pick failed at ${hash}; run git cherry-pick --abort and fix manifest/script"
+  fi
+  if [[ -n "${MSG_OVERRIDE[${hash}]+x}" ]]; then
+    git commit --amend -m "${MSG_OVERRIDE[${hash}]}"
+  fi
+}
+
+cherry_pick_range() {
+  local start="$1" end="$2"
+  local hash
+  while read -r hash; do
+    [[ -n "${hash}" ]] || continue
+    log "  cherry-pick ${hash}"
+    cherry_pick_commit "${hash}"
+  done < <(commit_range "${start}" "${end}")
+}
+
+while IFS=$'\t' read -r slug branch_type start end merge_msg; do
+  branch="${branch_type}/${slug}"
+  log "epic ${slug}: ${branch} (${start}..${end})"
+
+  git checkout -b "${branch}" "${TARGET_BRANCH}"
+  cherry_pick_range "${start}" "${end}"
+
+  git checkout "${TARGET_BRANCH}"
+  git merge --no-ff "${branch}" -m "${merge_msg}"
+  git branch -d "${branch}"
+done < <(tail -n +2 "${MANIFEST}")
+
+log "verifying tree matches ${BACKUP_TAG}"
+if ! git diff --quiet "${BACKUP_TAG}" HEAD; then
+  die "tree mismatch after rewrite — aborting before branch swap"
+fi
+
+log "replacing ${SOURCE_BRANCH} with rewritten history"
+git branch -m "${SOURCE_BRANCH}" "${SOURCE_BRANCH}-old-linear"
+git branch -m "${TARGET_BRANCH}" "${SOURCE_BRANCH}"
+
+log "done. old linear history preserved on ${SOURCE_BRANCH}-old-linear"
+log "verify: git diff ${BACKUP_TAG} ${SOURCE_BRANCH}  (should be empty)"