weichen 6a3a0dc201 fix(security): harden bypass authz, gate blind spot, command exec, validated_only (review P0/P1) ...

- FIND-SEC-01: GetUserContext requires session ownership (handler 403 +
  SQL/memory owner filter); in-memory HTTP + isolated-PG regressions
- FIND-ARCH-01: archtest fails closed on untracked table writes (+noise
  exemption) and registers 50 existing writer tables in table_owners
- FIND-SEC-02: Authorizer without pool denies by default; explicit
  NewInMemoryAuthorizer seam opt-in via ALLOW_IN_MEMORY at composition
- FIND-SEC-03: swboot commands run argv-exec (no sh -c) with exact
  basename allowlist match; prefix-spoof and no-shell-eval tests
- FIND-FLOW-01: confirm rejects validated_only plans; ExecuteClaimed
  hard-refuses validated_only steps (new error codes + HTTP mapping)
- FIND-QUAL-01: intentflow.ValidateFlagConsistency fail-fast at Assemble

2026-09-26 02:00:14 +00:00

..

access_log_middleware_test.go

feat(trace): strengthen T2/T3 evidence and access-log design

2026-09-22 21:51:19 +08:00

access_log_middleware.go

feat(trace): strengthen T2/T3 evidence and access-log design

2026-09-22 21:51:19 +08:00

admin_permissions_handlers.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

admin_roles_handlers.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

admin_system_handlers_test.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

admin_system_handlers.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

admin_template_handlers.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

admin_workflow_handlers.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

asset_handlers_test.go

test: cover dedup hint, reparse guard, store gate and CoW contract

2026-09-21 09:47:06 +00:00

asset_handlers.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

auth_gate_a_test.go

test(server): adapt fixtures to IAM dual-gate fail-closed

2026-09-16 09:42:07 +00:00

auth_handlers_test.go

feat(auth): admin password reset API and credential guards

2026-09-24 04:18:58 +00:00

auth_handlers.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

auth_helpers.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

auth_middleware.go

feat(server): public /maintenance/site-status route + tests; P9 evidence

2026-09-25 16:33:58 +00:00

auth_phase1_test.go

test(server): adapt fixtures to IAM dual-gate fail-closed

2026-09-16 09:42:07 +00:00

background_loop.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

bizdev_stage_gate.go

feat(collab): free-lane chat, claim-on-view, lease ownership, notify inbox

2026-09-24 11:49:43 +00:00

body_limit_middleware_test.go

feat(taskrun): resume interrupted runs and harden P1 security gaps

2026-09-13 02:50:23 +00:00

body_limit_middleware.go

feat(upload): reuse MIME validator for workflow template uploads.

2026-09-13 02:50:23 +00:00

chat_digest_api.go

feat(chatflow): authorize rolling summary and surface digest freshness

2026-09-16 15:37:50 +00:00

chat_document_reader_test.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

chat_document_reader.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

chat_export_api.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

chat_history_api_test.go

feat(bizdev): snapshot collaborators onto Runtime and Server ports

2026-09-15 13:00:33 +00:00

chat_history_auth.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

chat_history_refresh_pg_test.go

merge: sync origin/dev into local dev (closeout batch)

2026-09-23 12:45:30 +00:00

chat_project_access_authz_test.go

fix(api): require project membership before chat and chat SSE

2026-09-13 12:25:22 +00:00

chat_recategorize_api_test.go

fix(authz): close preference, session project, and recategorize IDOR gaps

2026-09-20 10:42:58 +00:00

chat_recategorize_api.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

chat_restore_test.go

fix(authz): close preference, session project, and recategorize IDOR gaps

2026-09-20 10:42:58 +00:00

chat_search_and_digest_api_test.go

feat(bizdev): snapshot collaborators onto Runtime and Server ports

2026-09-15 13:00:33 +00:00

chat_search_api.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

chat_session_ownership_pg_test.go

test(server): 跨用户会话挂靠负例测试（PG + 内存双实现）

2026-09-18 03:39:08 +00:00

chat_session_ownership_test.go

fix(web): version chat window cache and cover cross-user session list

2026-09-19 09:28:11 +00:00

chat_stream_get_message_test.go

feat(docgov): complete review lifecycle gaps for lock/notify/comment/reopen

2026-09-25 20:08:56 +00:00

chat_turn_api.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

chat_turn_sweeper.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

chat_unread_and_export_api_test.go

feat(bizdev): snapshot collaborators onto Runtime and Server ports

2026-09-15 13:00:33 +00:00

chat_unread_api.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

chat_window_api_test.go

fix(server): fail-closed chat import when Env is empty

2026-09-17 17:03:08 +00:00

chat_window_api.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

chat_workflow_adapter.go

feat(server): 接线对话 workflow.run 并补 P0 验证记录

2026-09-25 14:37:11 +00:00

chatflow_http.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

cors.go

fix(authz): harden permissions, chat gate, and project create idempotency

2026-09-20 07:04:57 +00:00

docgov_comment_audit_nonmember_pg_test.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

document_revision_access.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

document_revision_authz_test.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

document_revision_duty_write_test.go

fix(security): harden bypass authz, gate blind spot, command exec, validated_only (review P0/P1)

2026-09-26 02:00:14 +00:00

document_revision_handlers.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

document_revision_patch_order_test.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

document_revision_upload_register_test.go

feat(api): expose POST /freeform-documents for upload registration

2026-09-13 11:12:03 +00:00

domain_http_test.go

feat(collab): free-lane chat, claim-on-view, lease ownership, notify inbox

2026-09-24 11:49:43 +00:00

domain_http.go

feat(collab): free-lane chat, claim-on-view, lease ownership, notify inbox

2026-09-24 11:49:43 +00:00

duty_reassign_handlers.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

e2e_test.go

feat(security): complete P0 release blocking remediation

2026-09-13 02:50:22 +00:00

e2e_workflow_governance_test.go

test(pg): isolate PG integration tests from shared dev database

2026-09-22 01:10:17 +00:00

free_lane_test.go

feat(collab): free-lane chat, claim-on-view, lease ownership, notify inbox

2026-09-24 11:49:43 +00:00

free_lane.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

freeform_create_authz_test.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

freeform_create_nonmember_pg_test.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

freeform_doc_api_test.go

feat(api): add additive HTTP/SSE error envelopes

2026-09-15 14:40:56 +00:00

freeform_doc_api.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

handlers_chat_history.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

handlers_chat_task.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

handlers_context.go

fix(security): harden bypass authz, gate blind spot, command exec, validated_only (review P0/P1)

2026-09-26 02:00:14 +00:00

handlers_docgov_lease.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

handlers_docgov.go

chore(server): log docgov approver decision failures (envelope redacts internals)

2026-09-26 00:22:15 +00:00

handlers_health.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

handlers_http.go

refactor(server): split handlers.go by domain

2026-09-23 09:54:18 +08:00

handlers.go

feat(dev): single-binary no-docker runtime with managed localpg

2026-09-24 15:53:50 +00:00

idor_hotfixes_test.go

fix(security): harden bypass authz, gate blind spot, command exec, validated_only (review P0/P1)

2026-09-26 02:00:14 +00:00

intent_plan_handlers_test.go

fix(security): harden bypass authz, gate blind spot, command exec, validated_only (review P0/P1)

2026-09-26 02:00:14 +00:00

intent_plan_handlers.go

fix(security): harden bypass authz, gate blind spot, command exec, validated_only (review P0/P1)

2026-09-26 02:00:14 +00:00

lease_concurrency_test.go

feat(bizdev): snapshot collaborators onto Runtime and Server ports

2026-09-15 13:00:33 +00:00

lease_owner.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

lineage_access_test.go

fix(authz): separate capability readiness from configured flags

2026-09-20 03:45:16 +00:00

lineage_access.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

login_rate_limit_test.go

fix(server): login/register rate limiting + compose secret hygiene (H4/H8/M8)

2026-09-19 06:00:30 +00:00

login_rate_limit_xff_test.go

feat(db,server): T20-S2 hardening batch B1/B4/B7 (XFF trust, pool statement_timeout, shutdown drain)

2026-09-25 04:45:49 +00:00

login_rate_limit.go

feat(db,server): T20-S2 hardening batch B1/B4/B7 (XFF trust, pool statement_timeout, shutdown drain)

2026-09-25 04:45:49 +00:00

maintenance_handlers.go

feat(maintenance): wire sysadmin ui.* whitelist settings to public site status

2026-09-25 16:33:56 +00:00

maintenance_site_status_test.go

feat(server): public /maintenance/site-status route + tests; P9 evidence

2026-09-25 16:33:58 +00:00

me_settings_handlers.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

multi_intent_u8_piagent_pg_test.go

test(server): add Wave 2 real-PI evidence for U8 and full/none

2026-09-16 10:42:20 +00:00

non_author_member_access_piagent_pg_test.go

feat(collab): free-lane chat, claim-on-view, lease ownership, notify inbox

2026-09-24 11:49:43 +00:00

notification_handlers.go

feat(docgov): complete review lifecycle gaps for lock/notify/comment/reopen

2026-09-25 20:08:56 +00:00

notification_list_all_test.go

feat(collab): free-lane chat, claim-on-view, lease ownership, notify inbox

2026-09-24 11:49:43 +00:00

notification_reminder_loop.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

phase5_acceptance_pg_test.go

merge: sync origin/dev into local dev (closeout batch)

2026-09-23 12:45:30 +00:00

phase5_fault_injection_pg_test.go

merge: sync origin/dev into local dev (closeout batch)

2026-09-23 12:45:30 +00:00

phase5_finalize_fault_pg_test.go

test: align official bd_intake task key and scoped task-run fixtures

2026-09-22 18:15:29 +08:00

phase5_soak_test.go

feat(ops): compose runner auth, upload MIME validation, and test soak

2026-09-13 02:50:23 +00:00

pi_agent_datadir_test.go

fix(test): pin real-PI DATA_DIR to runner-mounted data/dev

2026-09-22 19:40:28 +08:00

piagent_e2e_test.go

fix(kb): return offline client instead of Fatalf under require-online

2026-09-17 02:04:51 +00:00

principal_context.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

project_create_pg_test.go

fix(projectworkflow): generate UTF-8 safe project codes for Chinese names

2026-09-13 02:50:23 +00:00

project_doc_content_error_test.go

feat(docquery): serve ledger when projection is missing

2026-09-14 14:07:05 +00:00

project_doc_handlers.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

project_handlers_test.go

fix(security): harden bypass authz, gate blind spot, command exec, validated_only (review P0/P1)

2026-09-26 02:00:14 +00:00

project_handlers.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

project_members_authz_test.go

test+arch: unblock production gate (import SSOT + isolated test DSN)

2026-09-22 18:04:02 +08:00

project_members_handlers.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

project_members_role_test.go

fix(authz): clear reviewer/approver slots in the member-write transaction

2026-09-13 22:37:24 +00:00

project_settings_author_only_error_test.go

test(projectinstance): cover author_only planning and activation

2026-09-17 09:39:59 +00:00

project_settings_handlers.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

project_workflow_api_test.go

fix(authz): separate capability readiness from configured flags

2026-09-20 03:45:16 +00:00

reconcile_handlers.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

reply_export_api_test.go

merge: integrate final-artifact-vault into local_dev (authorized exception)

2026-09-23 13:57:08 +00:00

reply_export_api.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

runtime_accessors.go

feat(docgov): complete review lifecycle gaps for lock/notify/comment/reopen

2026-09-25 20:08:56 +00:00

security_p0_test.go

fix(authz): harden permissions, chat gate, and project create idempotency

2026-09-20 07:04:57 +00:00

security_penetration_test.go

test(server): adapt fixtures to IAM dual-gate fail-closed

2026-09-16 09:42:07 +00:00

server_test.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

server.go

feat(swboot): wire SWBOOT-10 controlled patch executor (fail-closed)

2026-09-26 00:56:59 +00:00

session_cap_test.go

fix(coordinator): use the caller name and reject non-decimal user ids

2026-09-19 09:19:36 +00:00

software_project_handlers.go

feat(swboot): wire SWBOOT-10 controlled patch executor (fail-closed)

2026-09-26 00:56:59 +00:00

sse_wave0_test.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

sse.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

stage_access_helpers_test.go

feat(api): duty-check canonical docs before they are persisted

2026-09-14 08:39:44 +00:00

stage_access_helpers.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

static_assets_test.go

feat(server): negotiate static compression and fix asset SPA fallback

2026-09-17 08:18:11 +00:00

static_assets.go

fix(web): tolerate absent dist at compile time via LookupDist

2026-09-24 16:13:47 +00:00

supplement_impact_adapter.go

feat(docgov): complete review lifecycle gaps for lock/notify/comment/reopen

2026-09-25 20:08:56 +00:00

supplement_impact_handlers.go

feat(docgov): complete review lifecycle gaps for lock/notify/comment/reopen

2026-09-25 20:08:56 +00:00

swboot_handlers.go

fix(server): read bound repo from project_source_bindings.source_ref

2026-09-26 01:00:37 +00:00

task_conflict_cards_test.go

feat(ctx): surface dialogue conflict confirmation cards to triggering user

2026-09-25 21:01:37 +00:00

task_conflict_cards.go

feat(ctx): surface dialogue conflict confirmation cards to triggering user

2026-09-25 21:01:37 +00:00

task_finalize_fav_test.go

merge: integrate final-artifact-vault into local_dev (authorized exception)

2026-09-23 13:57:08 +00:00

task_finalize_test.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

task_finalize.go

feat(ctx): surface dialogue conflict confirmation cards to triggering user

2026-09-25 21:01:37 +00:00

task_run_auth.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

task_run_authz_pg_test.go

fix(api): 任务同步与SSE入口补齐项目成员鉴权

2026-09-13 02:50:23 +00:00

task_run_busy_preflight_test.go

fix(security): harden bypass authz, gate blind spot, command exec, validated_only (review P0/P1)

2026-09-26 02:00:14 +00:00

task_run_handlers.go

feat(ctx): surface dialogue conflict confirmation cards to triggering user

2026-09-25 21:01:37 +00:00

task_run_idempotent_sse_test.go

fix(security): harden bypass authz, gate blind spot, command exec, validated_only (review P0/P1)

2026-09-26 02:00:14 +00:00

task_run_json_test.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

task_run_observer_test.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

task_run_persistence_pg_test.go

merge: sync origin/dev into local dev (closeout batch)

2026-09-23 12:45:30 +00:00

task_run_request_build_test.go

fix(docgov): pass dynamic StageKey into document ledger create

2026-09-17 09:46:09 +00:00

task_run_resume_pg_test.go

merge: sync origin/dev into local dev (closeout batch)

2026-09-23 12:45:30 +00:00

taskstream_test.go

fix(web): bind task assistant bubble to serverId and harden error actions

2026-09-23 11:12:50 +08:00

test_auth_helper_test.go

feat(security): complete P0 release blocking remediation

2026-09-13 02:50:22 +00:00

test_auth_helpers.go

fix(auth): restrict demo seed users to dev/test environments

2026-09-13 02:50:22 +00:00

test_helpers_test.go

merge: sync origin/dev into local dev (closeout batch)

2026-09-23 12:45:30 +00:00

trace_handlers.go

fix(land): 适配 dev 现行结构 — gov()/authorizer() 访问器、去 app/docnotify stream 依赖（arch 基线）、测试 stub 重名

2026-09-25 20:17:20 +00:00

user_directory_handlers.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

user_profile_directory_test.go

merge: integrate final-artifact-vault into local_dev (authorized exception)

2026-09-23 13:57:08 +00:00

vault_nowrite_test.go

feat(artifactvault): close same-tx staging, recover-apply, and GET zero-write gaps

2026-09-14 12:52:28 +00:00

vault_test.go

merge: integrate final-artifact-vault into local_dev (authorized exception)

2026-09-23 13:57:08 +00:00

vault.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

web_assets_test.go

test(server): adapt fixtures to IAM dual-gate fail-closed

2026-09-16 09:42:07 +00:00

workflow_approval_hook.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

workflow_catalog_handlers.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

workflow_governance_full_none_piagent_pg_test.go

test: use official bd_intake key in FullNone real-PI fixture

2026-09-22 19:20:11 +08:00

workflow_governance_pg_test.go

test: align official bd_intake task key and scoped task-run fixtures

2026-09-22 18:15:29 +08:00

workflow_governance_piagent_pg_test.go

fix(test): unique project names for pi-agent FullChain e2e

2026-09-24 03:24:13 +00:00

workflow_instance_handlers.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

workflow_terminate_handlers.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00

workspace_admin_handlers_test.go

feat(workspace): register workspaces and gate cleanup by receipts

2026-09-21 14:58:21 +00:00

workspace_admin_handlers.go

refactor(server): remove 24 mirrored Runtime fields via nil-safe accessors; fix Shutdown-vs-background-loop DATA RACE and goose 00071 duplicate version

2026-09-25 13:17:22 +00:00