cma-management

451 Commits 6 Branches 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
Hermes CI Fix	df2be301b3	fix(cma): treasury grant step follows whitelist min set and converges - spec read from _cma_write_table_whitelist.json table_ops (single source of truth) - revoke non-whitelist table privs before grant (idempotent; 1141 handled as no-op) - add zero-DB --grant-plan mode; post-apply convergence assertion via information_schema - task: yanxue-20260918-treasury-grant-idempotent-fix	2026-09-18 06:04:48 +08:00
Hermes CI Fix	f1fa781e08	feat(cma): 司库阶段1 DDL 并入特权迁移步 + cma_api 授权 ci/woodpecker/push/main Pipeline was canceled Details - db_migrate.py: create_all 后调用 run_structural() → 复用 treasury_migrate（幂等、特权连接） - treasury_migrate.py: 换特权连接（CMA_MIGRATE_DB_USER 或本机 root socket，禁 cma_api）；up() 增 grant_app_account()（cma_api 对 6 张 treasury 表 DML，双 host） - 效果：deploy 链由特权账号一次性完成建表+补列(cash_plans 4列/1索引)+种子(8规则/6限额)+授权 Ref: 0-P0-project-20260915-cma-treasury-stage1	2026-09-16 14:39:54 +08:00
Hermes CI Fix	e5eb092d20	feat(cma): treasury stage-1 MVP - migration, models, endpoints, rules, 2 pages G1 review fixes P0-1/P0-2/P1-3/P1-4/P1-5/P2-6/P2-7/P2-8 applied: - up() filters comment lines then asserts missing_tables == [] (CREATE hits 6/6) - created counter = new-object diff via information_schema (idempotent second run = 0) - down() drops columns per-column, dumps via write-path creds + fail-closed - seeds expanded to 8 rules + 6 limits; data_status DEFAULT estimated - no physical FK (app-layer checks), amount FLOAT wan-yuan, round(x,4) Scope: 6 treasury_* tables + cash_plans 4 added columns; cash.py untouched. Not pushed: deploy is approval-gated (de851257).	2026-09-15 20:02:56 +08:00

Author

SHA1

Message

Date

Hermes CI Fix

df2be301b3

fix(cma): treasury grant step follows whitelist min set and converges

- spec read from _cma_write_table_whitelist.json table_ops (single source of truth)

- revoke non-whitelist table privs before grant (idempotent; 1141 handled as no-op)

- add zero-DB --grant-plan mode; post-apply convergence assertion via information_schema

- task: yanxue-20260918-treasury-grant-idempotent-fix

2026-09-18 06:04:48 +08:00

Hermes CI Fix

f1fa781e08

feat(cma): 司库阶段1 DDL 并入特权迁移步 + cma_api 授权

ci/woodpecker/push/main Pipeline was canceled

Details

- db_migrate.py: create_all 后调用 run_structural() → 复用 treasury_migrate（幂等、特权连接）
- treasury_migrate.py: 换特权连接（CMA_MIGRATE_DB_USER 或本机 root socket，禁 cma_api）；up() 增 grant_app_account()（cma_api 对 6 张 treasury 表 DML，双 host）
- 效果：deploy 链由特权账号一次性完成 建表+补列(cash_plans 4列/1索引)+种子(8规则/6限额)+授权

Ref: 0-P0-project-20260915-cma-treasury-stage1

2026-09-16 14:39:54 +08:00

Hermes CI Fix

e5eb092d20

feat(cma): treasury stage-1 MVP - migration, models, endpoints, rules, 2 pages

G1 review fixes P0-1/P0-2/P1-3/P1-4/P1-5/P2-6/P2-7/P2-8 applied:
- up() filters comment lines then asserts missing_tables == [] (CREATE hits 6/6)
- created counter = new-object diff via information_schema (idempotent second run = 0)
- down() drops columns per-column, dumps via write-path creds + fail-closed
- seeds expanded to 8 rules + 6 limits; data_status DEFAULT estimated
- no physical FK (app-layer checks), amount FLOAT wan-yuan, round(x,4)

Scope: 6 treasury_* tables + cash_plans 4 added columns; cash.py untouched.
Not pushed: deploy is approval-gated (de851257).

2026-09-15 20:02:56 +08:00