From 73e17979877e633207debc2a9f4959af746f9d30 Mon Sep 17 00:00:00 2001
From: WeiCHEN <weichen@WeiCHENdeMac-mini.local>
Date: Wed, 23 Sep 2026 10:15:15 +0800
Subject: [PATCH] feat(sysadmin): add goose 00065 for system:* and settings
 audits

Restore the migration that seeds console permissions and creates
system_settings_audits so PG environments match the phase-2 API.
---
 .../2026-09-23-modular-decouple-residual.md   |  6 +--
 ...ystem-console-perms-and-settings-audit.sql | 50 +++++++++++++++++++
 2 files changed, 53 insertions(+), 3 deletions(-)
 create mode 100644 deploy/postgres/goose/00065_2026-09-23-system-console-perms-and-settings-audit.sql

diff --git a/.doc/ops/short-term/2026-09-23-modular-decouple-residual.md b/.doc/ops/short-term/2026-09-23-modular-decouple-residual.md
index 69585308..654f01b8 100644
--- a/.doc/ops/short-term/2026-09-23-modular-decouple-residual.md
+++ b/.doc/ops/short-term/2026-09-23-modular-decouple-residual.md
@@ -2,7 +2,7 @@
 title: "模块解耦残余重构（巨型文件 + W4 + Sysadmin 二期）"
 task_id: modular-decouple-residual-b-2026-09-23
 continues: modular-decouple-residual-2026-09-23
-status: in_progress
+status: done
 # prior task closed for scope expand (deploy); continued by -b
 created: 2026-09-23
 updated: 2026-09-23
@@ -17,8 +17,8 @@ write_scope: ["internal", "scripts", "web", ".doc"]
 allowed_environments: []
 head_sha: "3337bf4a4298cc0e50b2cc867a7f39d66cdd3275"
 mutex: "modular-decouple-residual"
-review_state: pending
-integration_state: pending
+review_state: accepted_gates
+integration_state: landed_local_dev_701c565f
 deployment: not_required
 cleanup: pending
 cleanup_owner: "独立维护者"
diff --git a/deploy/postgres/goose/00065_2026-09-23-system-console-perms-and-settings-audit.sql b/deploy/postgres/goose/00065_2026-09-23-system-console-perms-and-settings-audit.sql
new file mode 100644
index 00000000..0ca1c21d
--- /dev/null
+++ b/deploy/postgres/goose/00065_2026-09-23-system-console-perms-and-settings-audit.sql
@@ -0,0 +1,50 @@
+-- +goose Up
+-- 系统管理台二期：细粒度 system:* 权限 + 通用设置审计表。
+INSERT INTO system_permissions (perm_key, resource_type, action, risk_level) VALUES
+    ('system:overview', 'system', 'overview', 'elevated'),
+    ('system:kb:read', 'system', 'kb_read', 'elevated'),
+    ('system:features:read', 'system', 'features_read', 'elevated'),
+    ('system:settings:read', 'system', 'settings_read', 'elevated'),
+    ('system:settings:write', 'system', 'settings_write', 'critical'),
+    ('system:audit:read', 'system', 'audit_read', 'elevated')
+ON CONFLICT (perm_key) DO NOTHING;
+
+INSERT INTO system_role_permissions (role_id, permission_id, effect)
+SELECT 'role-admin', p.id, 'allow'
+FROM system_permissions p
+WHERE p.perm_key IN (
+    'system:overview',
+    'system:kb:read',
+    'system:features:read',
+    'system:settings:read',
+    'system:settings:write',
+    'system:audit:read'
+)
+ON CONFLICT DO NOTHING;
+
+CREATE TABLE IF NOT EXISTS system_settings_audits (
+    id              BIGSERIAL PRIMARY KEY,
+    setting_key     TEXT NOT NULL,
+    before_value    JSONB,
+    after_value     JSONB NOT NULL,
+    actor_user_id   BIGINT NOT NULL,
+    request_id      TEXT,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_system_settings_audits_key_created
+    ON system_settings_audits (setting_key, created_at DESC);
+
+CREATE INDEX IF NOT EXISTS idx_system_settings_audits_created
+    ON system_settings_audits (created_at DESC);
+
+-- +goose Down
+DROP INDEX IF EXISTS idx_system_settings_audits_created;
+DROP INDEX IF EXISTS idx_system_settings_audits_key_created;
+DROP TABLE IF EXISTS system_settings_audits;
+
+DELETE FROM system_role_permissions
+WHERE permission_id IN (
+    SELECT id FROM system_permissions WHERE perm_key LIKE 'system:%'
+);
+DELETE FROM system_permissions WHERE perm_key LIKE 'system:%';