diff --git a/.doc/audit/2026-09-17-docgov-modification-proposal-http-gap.md b/.doc/audit/2026-09-17-docgov-modification-proposal-http-gap.md new file mode 100644 index 00000000..72cd75bd --- /dev/null +++ b/.doc/audit/2026-09-17-docgov-modification-proposal-http-gap.md @@ -0,0 +1,44 @@ +--- +title: "docgov 变更提案缺少 HTTP 路由" +status: open +created: 2026-09-17 +updated: 2026-09-17 +severity: medium +--- + +# docgov 变更提案缺少 HTTP 路由 + +## 现象 + +引擎侧存在 `docgov.ProposeModification` / `DecideModificationProposal`,但 `internal/server/server.go` 未注册对应 HTTP 路由。前端 `App.tsx`「变更方案提议」(`pendingProposal`)仍为本地模拟,不写库、不审计。 + +该缺口与 `duty_policy=author_only` 无关,影响全部受控文档的变更提案闭环。 + +## 根因分析 + +U6 排查审批闭环时确认:生命周期三接口(submit-review / review-decision / approver-decision)与 claim 已注册并可真实调用;变更提案路径从未暴露为 HTTP,前后端契约缺失。 + +证据: + +- `rg "ProposeModification|DecideModification|/docgov/.*proposal"`(路由层无匹配) +- `App.tsx` pendingProposal 本地状态分支 + +## 严重度 + +`medium` — 不阻塞编制→审核→批准主链;阻塞「认领后小队修改须提案确认」的真实治理。 + +## 关联整改 + +- 建议后续单独立项(不并入 author-only remediation U6) +- 相关:`.doc/remediation/2026-09-17-document-author-only-plan.md` 发现 3 + +## 证据 + +- U6 计划与测试报告中的「非目标」声明 +- 本笔记创建于 U6 实施期间 + +## 建议下一步 + +1. 设计 `POST /api/v1/docgov/propose-modification` 与 decide 路由及 ABAC; +2. 前端替换本地 `pendingProposal` 模拟; +3. 补真实 PI + 浏览器验收报告。 diff --git a/.doc/ops/CURRENT.md b/.doc/ops/CURRENT.md index 6bcfb0f8..5530e8df 100644 --- a/.doc/ops/CURRENT.md +++ b/.doc/ops/CURRENT.md @@ -13,6 +13,7 @@ | owner | task | branch | worktree | mutex | status | |-------|------|--------|----------|-------|--------| +| Cursor | 2026-09-17-document-author-only-u6 | feature/document-author-only-plan | .worktrees/feature-document-author-only-plan | web + document-duty-policy | done | | Cursor | 2026-09-17-document-author-only-u5 | feature/document-author-only-plan | .worktrees/feature-document-author-only-plan | web + document-duty-policy | done | | Cursor | 2026-09-17-document-author-only-u4 | feature/document-author-only-plan | .worktrees/feature-document-author-only-plan | projectinstance + docgov + document-duty-policy | done | | Cursor | 2026-09-17-document-author-only-u3 | feature/document-author-only-plan | .worktrees/feature-document-author-only-plan | docgov + docduty + bizdev + document-duty-policy | done | diff --git a/.doc/ops/short-term/2026-09-17-document-author-only-u6.md b/.doc/ops/short-term/2026-09-17-document-author-only-u6.md new file mode 100644 index 00000000..7e598b17 --- /dev/null +++ b/.doc/ops/short-term/2026-09-17-document-author-only-u6.md @@ -0,0 +1,55 @@ +--- +title: "文档编制人兼任:U6 多职责动作与真实闭环" +status: done +created: 2026-09-17 +updated: 2026-09-17 +owner: Cursor +branch: feature/document-author-only-plan +worktree: ".worktrees/feature-document-author-only-plan" +mutex: web + document-duty-policy +--- + +# 文档编制人兼任:U6 多职责动作与真实闭环 + +## 目标 + +去掉 author-first 动作短路,把认领/送审/审核/批准接到真实 docgov HTTP,完成 author_only 端到端验收。 + +## 范围 + +- `web/src/api/docgov.ts` 四接口客户端 +- `docGovActionVisibility` / `holdsDocDuty` +- `App.tsx` 真实 handler + 快捷指令 +- `duty_policy` 透传与「编制人兼任」徽标 +- 单测 + 真实闭环报告 + +## 非目标 + +- 变更提案 HTTP 路由(另记 audit) +- 合入 `dev` / 推送远端(未授权不推) + +## 步骤 + +1. [x] API 客户端 +2. [x] ID 直判可见性 +3. [x] App 接线 + 驳回批准修正 +4. [x] duty_policy 徽标透传 +5. [x] 单测 / tsc +6. [x] 真实闭环与报告 + +## 验收标准 + +- [x] author_only 下 A 可见三动作;非 A 403 +- [x] 真实 API 闭环写库与审计含 duty_policy +- [x] 浏览器可见「编制人兼任」徽标 +- [x] 测试报告归档 + +## 相关链接 + +- Test report: [../../test-reports/2026-09-17-document-author-only-u6-test-report.md](../../test-reports/2026-09-17-document-author-only-u6-test-report.md) +- Remediation U6: [../../remediation/2026-09-17-document-author-only-plan.md](../../remediation/2026-09-17-document-author-only-plan.md) + +## 证据 / 备注 + +- `npm test` 390 pass;`tsc --noEmit` clean +- assets: `test-reports/assets/2026-09-17-document-author-only-u6/` diff --git a/.doc/status/FEATURE-MATRIX.md b/.doc/status/FEATURE-MATRIX.md index 29d6e5af..ae79c9e9 100644 --- a/.doc/status/FEATURE-MATRIX.md +++ b/.doc/status/FEATURE-MATRIX.md @@ -97,4 +97,4 @@ ## 2026-09-17 文档编制人兼任方案 -新增能力 **planned(仅方案,未实现)**:[方案](../remediation/2026-09-17-document-author-only-plan.md) · [源码核查](../audit/2026-09-17-document-author-only-analysis.md)。管理员总授权 + 创建者逐文档配置;生命周期 R9/R10 待审核。既有工作流治理 done 与发布门禁结论不变。mutex `document-duty-policy-plan`。 +新增能力 **done(U1–U6)**:[方案](../remediation/2026-09-17-document-author-only-plan.md) · [源码核查](../audit/2026-09-17-document-author-only-analysis.md) · [U6 验收](../test-reports/2026-09-17-document-author-only-u6-test-report.md)。管理员总授权 + 创建者逐文档 `author_only`;ABAC/投影/设置 UI/多职责真实闭环已落地。变更提案 HTTP 仍缺([audit](../audit/2026-09-17-docgov-modification-proposal-http-gap.md))。既有工作流治理 done 与发布门禁结论不变。mutex `document-duty-policy`。