sxbh_admin/cma-management
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
397 Commits 6 Branches 0 Tags
9b3a131070311f0ab5018e16c3cabb15141969d4
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Hermes CI Fix 9b3a131070 fix(cma): cashflow statements importer + auto_verify/alert_generator observability 
- add backend/scripts/import_cashflow_statements.py: load zxt cashflow stat (CNY) into cashflow_statements in 10k CNY, dry-run default, --apply gated

- auto_verify_cron: per-reason skip counters + legacy-condition rule now resolves kpi_code via plan.kpi_id (was unreachable) + --dry-run

- alert_generator: coverage self-check warns when current-month KPI values are absent (0 alerts != no trigger)

task: finance-20260916-cma-health-gaps-3items (items 1/2/3)
 2026-09-16 23:46:48 +08:00
Hermes CI Fix 27d3e1cd73 feat(cma): strategy map lane KR delete entry (cma-map-kr-delete-entry-20260916) 
- MapNode.vue: hover trash icon per KR row emitting delete-kr (inline SVG, no emoji)

- StrategyLayer.vue / MapCanvas.vue: passthrough + MyDialog second confirm + okrApi.deleteKr + whole-map save

- MapsDialog: single-KR policy hint (keep at least 1 KR per objective)
 2026-09-16 15:26:38 +08:00
Hermes CI Fix 7c73204ade fix(cma): treasury_limits 种子补 status='active'（引擎按 active 过滤→原 NULL 被排除）
ci/woodpecker/push/main Pipeline failed
Details 
种子 INSERT 未写 status → 6 行授权档 status=NULL → _limits_strictest 过滤 active 时全排除
→ 多档取最严(T11)取不到 limits 档。补 status='active' + ODKU 同步。自验电池 18/18。

Ref: 0-P0-project-20260915-cma-treasury-stage1
 2026-09-16 14:59:02 +08:00
Hermes CI Fix 2ca53b272a fix(cma): AU-001 day_cum_amount 返回日累计(day_total) 而非拆单累计
ci/woodpecker/push/main Pipeline was canceled
Details 
day_cum_amount 原返回 cum_same(同收款方拆单累计)，与字段语义(日累计)不符；
日累计升级用例 T8 期望 day_cum=当日同提交人累计。改为 day_total。

Ref: 0-P0-project-20260915-cma-treasury-stage1 自验 T8
 2026-09-16 14:56:57 +08:00
Hermes CI Fix 3a59b1ccb9 fix(cma): NP-001 无预算走补录流程(不 block)——口径②
ci/woodpecker/push/main Pipeline was canceled
Details 
按任总口径②：e1 无匹配预算 → verdict=warn（走指定/补录预算流程，不硬卡死）；
仅「有预算且超」才 block。修正后无预算付款可正常进 pending_approval，
不再阻塞 AU-001 拆单累计/日累计（T7/T8）。

Ref: 0-P0-project-20260915-cma-treasury-stage1
 2026-09-16 14:54:11 +08:00
Hermes CI Fix 06c23927aa fix(cma): KR 名称污染存量清理 + 透传点护栏 (cma-kr-name-pollution-cleanup-20260916)
ci/woodpecker/push/main Pipeline was canceled
Details 
- kr_name.py/krName.ts: sanitize_kr_name 判据（尾部≥/≤数字≠目标值→截断；==目标值→保留）
- maps.py/okr.py/okr_templates.py: 模板名/JSON→krs.title 透传点护栏
- test: 28 passed（独立复核）
- 原会话因迭代上限停手，本提交代收口（工作已复核完成）
 2026-09-16 14:48:06 +08:00
Hermes CI Fix 09fb11d86f fix(cma): NP-001 verdict 口径统一(block→blocked)——命中即置 check_result=blocked 
_eval_np001 原将 verdict 直取 severity('block')，而 check_result 汇总只认 'blocked'
→ e1 命中不生效、check_result 恒 pass，T4 豁免级联失败。改为 severity=='block'→'blocked'。

Ref: 0-P0-project-20260915-cma-treasury-stage1 自验电池 T3/T3b/T4
 2026-09-16 14:44:06 +08:00
Hermes CI Fix f1fa781e08 feat(cma): 司库阶段1 DDL 并入特权迁移步 + cma_api 授权
ci/woodpecker/push/main Pipeline was canceled
Details 
- db_migrate.py: create_all 后调用 run_structural() → 复用 treasury_migrate（幂等、特权连接）
- treasury_migrate.py: 换特权连接（CMA_MIGRATE_DB_USER 或本机 root socket，禁 cma_api）；up() 增 grant_app_account()（cma_api 对 6 张 treasury 表 DML，双 host）
- 效果：deploy 链由特权账号一次性完成 建表+补列(cash_plans 4列/1索引)+种子(8规则/6限额)+授权

Ref: 0-P0-project-20260915-cma-treasury-stage1
 2026-09-16 14:39:54 +08:00
Hermes CI Fix 443a779ece fix(cma): DDL 与启动剥离 —— 关闭启动 create_all + 部署链特权迁移步 (cma-create-all-minpriv-rootfix-20260916)
ci/woodpecker/push/main Pipeline failed
Details 
根治 2026-09-16 发布中断（新增模型触发启动 create_all，cma_api 无 CREATE → 崩溃循环）：

- backend/app/database.py: 新增 CMA_AUTO_CREATE 开关（**默认关**），生产启动不再执行 DDL；
  运行库账号因此无需 CREATE（最小权限可保持）
- backend/scripts/db_migrate.py: 特权迁移步（--check/--apply/--rollback/--status）；
  幂等（checkfirst）+ journal 留痕 + 可回滚（dump 失败/表有数据即拒绝，fail-closed）；
  显式拒绝用应用运行账号 cma_api 执行
- deploy.sh: 新增 [4b] 结构迁移（**重启前**执行；失败即中止部署，后端旧码继续服务）
- backend/scripts/tests/db-migrate-sim-e2e.sh: 17 项 scratch 复现/验收（负控制复现 CREATE command denied）
- docs/db-migration-runbook.md: 运行手册（含 cma_api CREATE 回收步骤）

验收：scratch E2E 17/17；pytest 1113 passed/1 xfailed；生产 --check 缺失表 0 / 列级差异 0；
--apply 幂等空跑 created_new=0（journal 留痕）
 2026-09-16 06:53:28 +08:00
Hermes CI Fix d54ffaf531 fix(cma): T4 residual bugs - predict 500 + reports restateDiffClass (cma-t4-residual-bugs-20260916)
ci/woodpecker/push/main Pipeline failed
Details 
B1: /api/cma/dashboard/predict hand-rolled threshold parsing called float() on the whole

expression -> ValueError on multi-clause thresholds like '<=36|>=124' -> 500. Now routes

through app.utils.threshold_parser.eval_threshold (single source of truth; red then yellow,

invalid/blank expr -> False, no crash).

B2: ReportCenter.vue restatement tab template called restateDiffClass while the script

defines restatementDiffClass (name mismatch since ec6af75) -> TypeError on render.

Verified: predict 200 on new code vs 500 on live code; /reports A/B browser run shows 0 vs 3

occurrences of the TypeError; pytest 1113 passed / 1 xfailed; vite build OK.
 2026-09-16 02:07:42 +08:00
Hermes CI Fix ae6f71dbc0 feat(cma-report): 建账期初层 + 方向判定可信度 + 权益行科目集（M1/M2/M7，规则表 v1.1） 
- M1 时点报表口径：余额 = 期初(report_opening_balances) + 累计发生额；期初只作用于取数层
  （不生成凭证/不写 voucher_details/不改 kpi_values）；basis=period 不套期初；受 effective_date 约束
- M2 期初未补 → direction_check_unreliable=true：报表/底稿带"期初未补，方向判定不可信"水印，
  重分类触发只进底稿诊断（diagnostic_only），不落地对外行项目
- M7 权益行科目集 = {3001,3002,3101,3103,3104,3105}（含 4001/4002/4101/4103/4104 别名）：补实收资本 3001
- 1901 待处理财产损溢过渡列报「其他流动资产」以保恒等式（M6 归因文案）
- 只读验收脚本 + 幂等导入器（dry-run 默认，--commit 门控）
 2026-09-16 01:17:09 +08:00
wecom-project db3c42f766 ci(deploy): [0] 脏检查忽略未跟踪文件（git pull 不丢未跟踪；防并发临时脚本误阻部署）(cma-deploy-untracked-fix-20260916)
ci/woodpecker/push/main Pipeline was successful
Details
2026-09-16 01:06:21 +08:00
Hermes CI Fix ba85e03f2f feat(cma-report): 资产负债表取数层重分类 R1~R12（调表不调账）
ci/woodpecker/push/main Pipeline failed
Details 
依据《CMA 资产负债表重分类规则表 v1》（wecom-finance，任总 2026-09-16 批准落地）。

新增 backend/app/services/report_reclass.py：12 条规则挂 CMA 真实科目编码的取数层重分类引擎
- 余额方向规范化：资产 sum(借-贷) / 负债·权益 sum(贷-借)，正常余额一律为正
- 触发判定全部基于原始余额（单遍、幂等），R3/R4 等互为镜像的规则互不干扰
- 科目取数前缀匹配（1122% 覆盖 112201 明细）；备抵科目 1602 反向取数（修正固定资产净额虚增 2 倍折旧）
- 只读 voucher_details + 作废守卫，不生成记账凭证
- 输出：触发条目 / 不变量 / 负数清单 / 模板待核 / 未列报科目 / 损益未结转 诊断

reports.py：
- /balance-sheet 接入重分类；新增 basis 参数（end=期末余额累计为默认 / period=本期发生额兼容回退）
- 有凭证明细时不再混入示例数据（展示口径与落库口径同源）；行项目增 raw_value/reclass_adjustment 可追溯
- 规则落位项目（模板未单列）按虚拟行列报；补「长期待摊费用(1801)」行、未分配利润补 3103/3104 别名
- 新增 /balance-sheet/reclass-working-paper(+ /export) 底稿 JSON/Excel；statutory 导出新增「重分类底稿」Sheet

测试 tests/test_report_reclass.py 14 例（触发/不变量/幂等/多租户/口径/底稿/虚拟行/阻塞规则）
全量 pytest：1108 passed, 1 xfailed。现网只读验收 scripts/verify_reclass_live_20260916.py（酣客 entity1 2026-08）
 2026-09-16 00:38:01 +08:00
Hermes CI Fix 7b74736980 refactor(cma-frontend): route all API calls through shared axios instance (cma-frontend-axios-unify-20260915) 
api/index.ts: add permissionApi.getModules/getConfig/saveConfig + alignmentApi.config/tree.

views: replace 13 raw fetch calls and 6 local axios.create instances (each hand-building the Authorization header, without the shared 401 redirect / timeout toast) with the shared instance from api/index.ts.

KPIAlignment: fixes a live bug - the header value was the string literal 'Bearer ' + token, so /alignment/tree always returned 401 (reproduced against the production bundle).

Unwrap semantics preserved: the shared response interceptor returns response.data, so call sites that used res.data were adjusted accordingly.

Verified: scan-frontend-tokenless RAW-TOKENLESS=0; vite build ok; headless A/B (new dist vs production bundle, 8 affected pages, real login) -> identical rendered rows and identical pre-existing error profile, /alignment 401->200.

Push not executed: main is ahead 4 with other tickets' gated commits (see cma-main-ahead3-push-gate-notice-20260915).
 2026-09-15 22:21:56 +08:00
Hermes CI Fix e5eb092d20 feat(cma): treasury stage-1 MVP - migration, models, endpoints, rules, 2 pages 
G1 review fixes P0-1/P0-2/P1-3/P1-4/P1-5/P2-6/P2-7/P2-8 applied:
- up() filters comment lines then asserts missing_tables == [] (CREATE hits 6/6)
- created counter = new-object diff via information_schema (idempotent second run = 0)
- down() drops columns per-column, dumps via write-path creds + fail-closed
- seeds expanded to 8 rules + 6 limits; data_status DEFAULT estimated
- no physical FK (app-layer checks), amount FLOAT wan-yuan, round(x,4)

Scope: 6 treasury_* tables + cash_plans 4 added columns; cash.py untouched.
Not pushed: deploy is approval-gated (de851257).
 2026-09-15 20:02:56 +08:00
Hermes CI Fix fdf805ab8f test(cma): clear 10 pre-existing baseline failures (cma-baseline-tests-cleanup-20260915) 
No production code changed. Root causes were all test-side staleness:

- test_cash TestVoucherImport: fixture filename contained 'test' -> rejected by the intentional import guard (d71c7fe); renamed, and missing-columns case now asserts the column check is what returns 400

- test_budget_tech_improve TestP1ValueCollect: seeded voucher_details source rows; collector deliberately skips empty aggregates since d71c7fe (no more implicit 0), and preview call now passes an explicit period

- test_roadmap_r2r5 / test_budget / test_ai_suggestions: seeds hardcoded 2026-08 (authoring month) while detectors/rule engine use the current month -> replaced with current-period seeds

pytest tests/ -q -rf: 1094 passed, 1 xfailed, 0 failed (baseline was 10 failed, 1084 passed, 1 xfailed)
 2026-09-15 18:36:46 +08:00
Hermes CI Fix 9d9a79545a feat(cma): external input ledgers for M2 capability eval (tax/hr/licence) 
3 new tables + idempotent DDL migration (prod guard: refuses DB name cma without approval): tax_filing_log (P_TAX_TIMELY), hr_monthly_ledger (L_EMPLOYEE_TURNOVER), licence_ledger (P_LICENCE_OK).

Entry API /api/cma/ext-ledger: create / CSV batch import / query by entity+period / derive trigger. on_time is server-derived only; HR rows rejected when end != begin + hires - separations.

Deriver writes kpi_values only (source_type=derived, idempotent upsert); denominator 0 returns None and writes nothing; never creates or changes kpi_definitions.

Tests: 22 new pytest cases (22 passed); scratch-DB e2e battery 28 assertions PASS with zero production write.
 2026-09-15 18:12:05 +08:00
Hermes CI Fix 5d0884cc3b fix(kpi): single source of truth for REVERSE_INDICATORS + drop F_FACTORY_REBATE_RATE from reverse set 
P-6 (M2 gate 2, FIN-CE-REVIEW-20260915-01): kpis.REVERSE_INDICATORS is now the only authoritative direction definition; dashboard.py imports it instead of carrying a literal copy; bot_kpis.py derives REVERSE_BOT_INDICATORS from it (dead import removed).

F_FACTORY_REBATE_RATE (upstream factory rebate rate, higher=better) was wrongly treated as reverse: 278.7% vs target 80 scored 1/danger, now 5/success and workbench three-color red -> green. No DB write, no scoring-engine logic change, no data_level/frontend touch.
 2026-09-15 17:48:56 +08:00
Hermes CI Fix b796897f8c fix(auth): unify site-wide 401/403 semantics (cma-auth-401-403-unify-20260915) 
require_auth now uses HTTPBearer(auto_error=False) and raises 401 explicitly
when the Authorization header is missing or non-Bearer, matching
require_auth_401. Unauthenticated requests are 401 for every user endpoint;
authenticated-but-forbidden (cross-entity / role) stays 403.

- app/auth_middleware.py: single optional bearer, 401 on missing token
  (require_auth_401 kept as a compatibility alias)
- tests: update 4 pre-existing cases that asserted 403 without a token
  (test_auth, test_reports, test_kpi_causality, test_expenses,
  test_api_auth_surface_20260914) - intentional behavior change
- add tests/test_auth_401_unification_20260915.py: sample + full sweep
  (all AUTHED GET routes -> 401), invalid token -> 401, cross-entity and
  role-denied still 403, bot channel (X-BOT-KEY) and public paths unchanged
 2026-09-15 17:00:52 +08:00
wecom-project f1d61f337a ci(deploy): 鉴权面审计接入部署闸门 — B类缺口存在即中止部署 (t1-cma-audit-gate-deployhook-20260915) 2026-09-15 16:52:15 +08:00
Hermes CI Fix 1f7be6b5ae fix(cash): select cash-balance sync targets by explicit kpi_code whitelist 
The voucher-import linkage branch picked write targets by kpi_name LIKE '%cash%' and wrote the monetary-fund ledger balance (yuan) into derived KPIs (F_OP_CFLOW / F_FCF / F_BEP_REVENUE_CASH / F_BEP_COVER_CASH). Replace with an explicit kpi_code whitelist plus a unit/caliber gate that refuses writes on mismatch and reports them via kpi_sync_skipped.

Read-only equivalence probe (real function + intercepted writes + rollback) before/after: before wrote 4 derived KPIs, after writes only F_CASH_SAFETY. tests: +9 new cases; pytest failure set identical to baseline (15/15 same ids).
 2026-09-14 20:37:12 +08:00
Hermes CI Fix 8693c8e342 feat(kpi): route all voucher_details consumers through single void-mark guard 
Single source: app/utils/voucher_guard.py (NOT EXISTS on voucher_void_marks,

key = entity_id+voucher_no+voucher_date and revoked_at IS NULL; same caliber as

the DB view cma.v_voucher_details_active). No hardcoded voucher numbers.

Consumers now guarded: cash.py import linkage (2 fns), reports.py subject/BS

amount (2 sites, also entity_id isolation added), dashboard.py _bep_sum_field,

alert_attribution.py build_subject_attribution. kpi_value_collector.py now

delegates to the shared guard (removes the previous duplicate implementation).

Tests: new tests/test_void_marker_consumers_20260914.py (6 cases).
 2026-09-14 19:05:16 +08:00
Hermes CI Fix a8a82ff837 feat(kpi): 归集侧接作废/撤单标记过滤（voucher_void_marks） 
- kpi_value_collector: 所有消费 voucher_details 的归集路径统一排除已作废凭证
  (NOT EXISTS voucher_void_marks, entity_id+voucher_no+voucher_date+revoked_at IS NULL),
  与 DB 视图 v_voucher_details_active 定义一致；标记表不存在时自动跳过（兼容旧库）
- 禁硬编码：凭证号不出现在代码/配置，撤单只需写标记表
- verify_cashflow_direct_caliber: 2026-08 从已知差异放行改为硬断言（8 期逐期一致）
- tests/test_void_marker_filter_20260914.py: 标记表在/不在 两分支 3 例
 2026-09-14 18:44:39 +08:00
Hermes CI Fix 4d918f5786 docs(kpi): mark R7 gate thresholds as president-confirmed formal rule 
Comment-only change: AMOUNT_MIN_YUAN=1000.0 / AMOUNT_PCT=0.005 / RATIO_PP=0.005 and RULE_VERSION unchanged. No logic or value change.
 2026-09-14 18:21:33 +08:00
Hermes CI Fix 8fa6c7f520 feat(kpi): auto_collect review gate (finance ruling 2026-09-14) 
R2 rule-gate auto-promotion + R3 exception interception in the same collect transaction; merge duplicate rows, keep single verified main per (kpi_id, period); reuse kpi_bep_deriver._is_period_closed; no schema change (data_status/remark only).

Task: finance-20260914-autocollect-reviewflow-impl
 2026-09-14 18:12:38 +08:00
Hermes CI Fix 45832cbf45 feat(kpi): collect cashflow-direct caliber for F_OP_CFLOW/F_FCF 
- kpi_value_collector: new calc=cashflow_direct branch (line-level counterpart

  classification: cash vouchers -> operating/financing/investing buckets),

  no hardcoded voucher numbers; optional minus_capex for FCF

- verify_cashflow_direct_caliber.py: 8-period reconcile + identity + negative

  control (voucher-level classification would overstate 2026-06 by 18,700)

task: yanxue-budget-cashflow-kpi-activate-20260914
 2026-09-14 18:01:57 +08:00
Hermes CI Fix ec58efa20b fix(budget): 偏差检查同 KPI 多计划去重（deviation-check 补 db.flush） 
autoflush=False 下，check_budget_deviation 循环内 existing_alert 去重查询
查不到本次刚 add 未 flush 的行 → 同期间同 KPI 多 active 预算计划会重复告警。
add 后补 db.flush() 使其对下一次循环可见。附回归测试。

Ref: yanxue-20260914-budget-p13p14-activation 遗留②试跑发现的缺陷
 2026-09-14 17:56:26 +08:00
Hermes CI Fix 40d522cd34 fix(security): retire default-credential surface (yanxue-20260914-cma-defaultcred-code-fix) 
- Login.vue: no prefilled default creds; no anonymous entity enumeration on mount

- deploy.sh: readiness polling (0.5s/30s cap) replaces fixed sleep 3; login smoke reads same-source 600 secret file, missing file = explicit abort

- 19 verify/check/gen_report scripts: shared _admin_creds() loader (CMA_ADMIN_ENV -> ops .secrets -> profile copy); no hardcoded creds

- tests: single TEST_USER_PASSWORD fixture constant; docs: pointer to 600 secret file; removed 4 legacy .bak + pycache residue
 2026-09-14 17:39:53 +08:00
Hermes CI Fix 8adc783501 fix(budget): attribution backfill computes in-process and previews on dry-run (yanxue-20260914-budget-p13p14-activation) 2026-09-14 17:25:49 +08:00
Hermes CI Fix aac1bd1df1 fix(security): retire check-governance + scope /reports/dupont to session entity 
- data_quality.py: remove GET /check-governance (no caller repo-wide; its
  entity_id param had no session auth -> cross-tenant read; duplicate of
  governance-check) -> the path now returns 404
- reports.py: /reports/dupont resolves the analysis target from the session
  account (assert_entity_slug_scope / resolve_session_slug); explicit
  cross-entity entity param -> 403, illegal value -> 400; the 2026-08-31
  cross-entity exemption is revoked (docstring updated)
- frontend: drop the checkGovernance api definition; DupontAnalysis.vue
  entity radio group -> read-only session entity tag, request without param
- tests: TestCheckGovernanceRetired (404 x2), TestDupontSessionScope (3),
  TestDupont reworked to account-bound tokens (8 tests)
- docs/api-verification-split.md: drop the retired row, note 334/404 -> 333/403

pytest: 10 failed / 957 passed / 1 xfailed vs HEAD baseline 10 failed /
951 passed / 1 xfailed (identical failure set -> zero regression)

(cma-residual-cross-entity-cleanup-20260914)
 2026-09-14 12:09:04 +08:00
Hermes CI Fix 72c1bbce16 chore(ui): drop remaining emoji in ReportCenter header block 
Same page header as the P3-1 item; keeps the header free of emoji.

(cma-entity-selectors-converge-6pages-20260914)
 2026-09-14 11:38:17 +08:00
Hermes CI Fix e6dd8f61f0 feat(ui): converge 6 page-level entity selectors to read-only session tag 
- DataQuality / ProductMatrix / AlertList / ActionPlanLibrary /
  views.GrowthQuality / PredictAccuracy: drop entity el-select
  (including the "all entities" option), show read-only session
  entity tag (not clickable), same style as the top bar tag
- drop page-level entity param from those requests; backend resolves
  entity from the session token (assert_entity_scope / get_entity_id)
- utils/entity.ts: add sessionEntityName() (cma_entity_name else id map)
- P3: ReportCenter header emoji removed; components/GrowthQuality
  detail drill-down el-dialog -> MyDialog

(cma-entity-selectors-converge-6pages-20260914)
 2026-09-14 11:32:52 +08:00
Hermes CI Fix 115a0ec755 fix(security): 4端点补跨租户鉴权 — 实体1会话读实体2数据(200)→403 (cma-cross-entity-endpoints-auth-20260914) 
背景（项目Bot 补充复验 §四#2）：以下 4 个只读端点未做会话账套鉴权，
用 entity=1(酣客) 会话 token + 显式 entity 参数可读到 entity=2(博海) 数据（HTTP 200）：
  - GET /data-quality/governance-check?entity_id=2   → 200 score=88（对照 entity1=72）
  - GET /products/matrix?entity_id=2                 → 200
  - GET /alerts/risk-matrix?entity=bohai             → 200 博海风险矩阵
  - GET /action-plans/coso-checklist?entity=bohai    → 200 博海 COSO total_score=55
另：risk-matrix / coso-checklist 在非法实体值下静默回落酣客数据，UI 标签与数据不一致。

改动：
1. deps.py 新增统一防护入口 assert_entity_scope / assert_entity_slug_scope /
   get_session_entity / resolve_session_slug（文案对齐 get_entity_id：无权访问企业 entity_id=X（当前账套: Y））
2. governance-check / products/matrix：entity_id 须等于会话账套，否则 403；
   缺省按会话账套（governance-check 原缺省 0=全部 → 登录态下按账套收敛）
3. risk-matrix / coso-checklist：entity 须等于会话账套，否则 403；
   非法值 → 400 显式报错（不再静默回落酣客）
4. P3：POST /auth/switch-entity 加 DEPRECATED 注释（前端已无调用，保留不删）
5. 测试：tests/test_security_multitenant.py 新增 TestCrossEntityEndpointAuth 15 例
   （跨实体 403 / 同实体 200 / 缺省按账套 / 非法显式报错 / 参照端点行为不变）

验证：pytest tests/ -q → 951 passed（10 项失败为改动前既有基线，已 stash 对照确认）；
      真实后端冒烟 19/19 PASS（entity=1 会话 4 端点跨实体全 403）。
 2026-09-14 11:19:05 +08:00
Hermes CI Fix 1b73dbb272 feat(ui): remove in-app entity switcher, entity fixed at login 
- MainLayout/ReportCenter: drop switch-entity switcher, keep read-only entity tag
- KPIList/PredictDashboard/GrowthQuality: entity selectors locked to session entity
- api/index.ts: drop switchEntity/myEntities wrappers (endpoint kept for compat)
- sidebar brand now shows logged-in entity name

(cma-remove-inapp-entity-switcher-20260914)
 2026-09-14 10:15:23 +08:00
wecom-fullstack 53c642b644 chore(docs): cash-plan-alerts 手册回填 F4b commit 哈希 (dama-cashplan-zombie-alert-cleanup-20260913) 2026-09-13 07:39:06 +08:00
wecom-fullstack e159db058a fix(alerts): F4b 展示口径与落库口径同源 — summary/suggestions/upcoming_7d 按快照批次 mode 过滤 + raw/excluded/batches 可见 (dama-cashplan-zombie-alert-cleanup-20260913) 2026-09-13 07:38:58 +08:00
Hermes CI Fix 75309ffcaa chore(docs): cash-plan-alerts 手册回填 commit 哈希 (dama-cashplan-alert-engine-fix-20260913) 2026-09-13 00:39:22 +08:00
Hermes CI Fix 59e65a68b9 fix(alerts): cash_plan 到期未收款预警引擎修复 — entity归属/KPI实体感知/余额快照批次/去重刷新/端点鉴权 (dama-cashplan-alert-engine-fix-20260913) 
F1 两处 KPIAlert 显式写 entity_id（列默认 1 → 博海预警错挂酣客）；顺带修 deviation_engine/
   alert_generator/deviation_push/bot_bridge/bot_bridge_v2 同表创建点
F2 KPI 选择实体感知：候选码 ∪ 实体前缀后缀码（_AR_BALANCE/_CASH_BALANCE/_AP_BALANCE）
   + 兜底 ORDER BY id（此前命中 uk_entity_kpi 必中 BH_ADM_EXPENSE 437 管理费用）
F3 去重命中改为刷新 alert_message/等级/suggestion.days_late/归属（此前 continue → 文本冻结首版）
F4 余额快照批次（bohai_*_20260630 / receivables_migrate）开关：默认 skip 不逐户，另备
   aggregate(按批次聚合1条) / per_customer(旧行为)
F5 POST /api/cma/admin/alerts/check 补鉴权（无 token 401）+ 可选 entity_id 只跑指定账套
 2026-09-13 00:37:10 +08:00
Hermes CI Fix a145ab1da1 fix(ui): 首屏加载超时兜底 — 页面10s未挂载则提示重试，消除整页刷新偶发卡死(BUG-001) (cma-bug001-boot-timeout-20260912) 2026-09-12 23:35:27 +08:00
Hermes CI Fix b8f4a3d543 chore(security): 凭据治理收口 — 清除硬编码DB账号/口令，脚本与API统一从 backend/.env 读取(无明文兜底)；取消跟踪 .pyc 构建产物 (credential-governance-20260912) 2026-09-12 23:34:35 +08:00
Hermes CI Fix 4f7058f1ea chore(verify): BEP 阈值验收脚本改动态断言(按数据归属实体登录)+历史快照归档加运行守卫 (concurrent-duplicate-session-and-stale-verify-script-20260912) 2026-09-12 20:35:20 +08:00
Hermes CI Fix ce2f6bfe33 fix(bep): pick target period by period-closed signal, sales threshold as fallback only 
Defect: _pick_target_period treated "month sales < 30% of 6-month avg" as
"period not closed", so 2026-08 (actually closed: 3103 carry-forward vouchers
present) was skipped because of a low-sales off-season month, pinning the five
F_BEP* KPIs at 2026-07.

Fix: add _is_period_closed() - primary signal voucher_details
(carry_forward=1 AND subject_code='3103'), secondary signal
ZXT_LANDING_DIR/{YYYY.MM}/check.md containing both "issue PASS" and
"P&L carry-forward PASS". _pick_target_period now scans candidate months desc
and returns the first closed one, with no sales filtering; the old sales
threshold path is kept only as a fallback (warns "sales-threshold fallback").

Scope: run_derive() formulas, collector, kpi_definitions and cron untouched.

Verified: period=2026-08; 167.5 / 60.4 / 39.6 / 118.7 / 85.2;
F_BEP_COVER 2026-08 red pending, 2026-07 pending resolved; idempotent on re-run.
 2026-09-12 20:08:31 +08:00
Hermes CI Fix 46fc1a4ecc fix(bot-bridge): subjects category 白名单补齐库内实况 revenue/profit_loss — 消除库内合法值被400拒 (dama-cma-subjects-category-whitelist-20260912) 2026-09-12 11:09:16 +08:00
Hermes CI Fix ca2832b698 fix(bot-bridge): subjects 写入端点编码长度收敛到 DB 列宽20 — 21~32字符编码原穿过校验触发 MySQL 1406 整批500, 改为400拒绝 (dama-cma-subjects-write-endpoint-20260912 复核) 2026-09-12 10:46:57 +08:00
Hermes CI Fix 840d98765d feat(bot-bridge): 新增会计科目写入端点 POST /api/cma/bot/subjects — 行级全量校验+按subject_code幂等UPSERT(dry_run/update_existing开关)+L3留痕, 绝不DELETE (dama-cma-subjects-write-endpoint-20260912) 2026-09-12 10:42:46 +08:00
Hermes CI Fix af541e9043 feat(bot-bridge): 新增智享通科目字典写入端点 POST /api/cma/bot/dict/zxt-account — 幂等UPSERT(JSON/CSV)+L3分级+audit留痕, 解除 ops 管道 API 迁移阻塞 (ops-cma-dict-write-endpoint-20260912) 2026-09-12 10:07:20 +08:00
Hermes CI Fix 998da4ebd4 fix(okr): 季度复盘提醒审计口径与失败感知加固 — dry_run/sent/failed/skipped 状态语义 + 失败本地留痕+中继告警+退出码契约(0/1/2) (fullstack-okr-reminder-hardening-20260911) 2026-09-12 01:03:31 +08:00
Hermes CI Fix 38968750a3 feat(okr): OKR模板库 tags 多值标签 — 表结构+回填36模板+API过滤 (fullstack-okr-tags-20260911) 
- okr_templates 新增 tags JSON 字段（function/cycle/goal_type 固定枚举）
- 回填脚本幂等：36/36 模板 tags 补齐，二次运行跳过
- API: GET /okr-templates 支持 function/cycle/goal_type/tag 过滤，新增 GET /tags/schema
- API: POST 创建 + 新增 PUT 更新接受 tags（非法值 400）
- dimension 四泳道主分类路径不变（回归 11/8/9/8 一致）
 2026-09-11 19:33:52 +08:00
Hermes CI Fix e2d2a1c165 feat(okr): 季度复盘提醒机制 — objectives active 清单经企微中继推送 + notification_logs 留痕 (fullstack-okr-kpi-gap-fix) 2026-09-11 19:20:42 +08:00
Hermes CI Fix c928d59f60 fix(maps): KR 目标值逐键输入污染名称根治 — 移除 formatTargetValue 回写名称 + 只读预览拼接 (project-20260911-kr-name-pollution) 2026-09-11 19:15:31 +08:00
Hermes CI Fix e22093256b fix(kpi): suggest 保留历史默认口径 middle_best — 修复未知编码被误判为 higher_better（C_REBATE_RATE/BH_SALES_10 建议退化） (project-20260911-threshold-fix) 2026-09-11 17:27:12 +08:00
Hermes CI Fix 4c6fb85cf5 fix(kpi): 阈值红黄绿读写/填写规则修复 — 统一解析器+红灯优先+建议可解析+前端校验+存量修正 (project-20260911-threshold-fix) 
① 新建 app/utils/threshold_parser.py 统一解析/判定（单一事实源）：
   - 支持负数（>=-100000）、闭区间 A~B、多条件 C1|C2；空串=未设置
   - 判定顺序 red→green→yellow：红灯优先（消除宽黄灯遮蔽红灯），
     green 先于 yellow（green 是主条件，yellow 是更宽兜底带）
② kpis.py / alert_generator.py 双实现收敛到统一解析器（消除重复维护）
③ thresholds.py suggest 输出可解析表达式（原黄色/适中型生成 `52.33~107.67`、`偏离55%` 等
   区间/文字 → 用户点"自动建议"填入后静默失效；另修复大数目标生成 1.6e+06 科学计数法）
④ KPIDetail.vue 三个阈值输入加 placeholder/tooltip/帮助文案 + 保存前格式校验（非法即拒）
⑤ 存量 4 个不可解析表达式修正（id=46 C_REBATE_RATE / id=327 BH_SALES_10），
   改前 mysqldump 备份 backend/scripts/backups/kpi_definitions.bak-20260911.sql +
   threshold_rows_before_20260911.json（可回滚）；不可解析 5→0
⑥ 单测 97 条 + 红黄绿判定回归 367 判定点（旧→新差异 14 条，含差异说明）
 2026-09-11 17:25:24 +08:00
Hermes CI Fix f61b6ce604 fix(cash): 智享通凭证行级幂等键剔除派生period + period_conflict留痕 + 批内行序防吞行 (dama-zxt-idemkey-period-20260911) 
缺陷: 行级幂等键含 period(日期派生属性)，summary口径切主表VoucherDate后判重失效→重复入库(实测V17756 6行)。修: 幂等键=(entity_id,voucher_no,subject_code,debit,credit,summary)；命中且period不同→period_conflict计数仅留痕不覆盖；同键多行按载荷内出现次序编号防跨批次吞行；返回体/日志补计数。回归测试10项 + 真实快照41830行复推实证(测试库)。
 2026-09-11 17:13:07 +08:00
Hermes CI Fix 286238811b fix(cash): 智享通凭证导入放开负数金额(红字记账)+日期来源三级优先(行内voucher_date优先) — 修复423张凭证整张拒收 (dama-zxt-import-endpoint-fix-20260908) 2026-09-11 16:24:41 +08:00
Hermes CI Fix 9822fbd9ba feat(alerts): 新增客户集中度预警规则 customer_concentration + 预测偏差规则启用/联动每日预警生成 
- alert_rules: 新增 rule_type=customer_concentration（单一/前N客户收入占比超阈值触发，黄=超阈值/红=阈值x倍数）
  数据源 zxt_masterbill 客户(往来单位)收入聚合，unit_id<=0 占位剔除；无客户数据可回退 KPI 口径
  复用现有 KPIAlert 生成链路：check-all 内联分支 + 专用端点 POST /run-customer-concentration
- alert_generator(每日9:00): 新增规则引擎步骤，复用上述检查函数跑 forecast_deviation/customer_concentration
- AlertList.vue: 规则类型筛选/编辑项 + 参数表单 + 客户集中度检查按钮
- 测试: tests/test_customer_concentration_rule.py 17 条（规则注册/聚合/双数据源/黄红灯/去重/check-all）
- 验证脚本: scripts/verify_forecast_deviation_rules_e2e.py / verify_customer_concentration_rule_e2e.py
 2026-09-10 09:56:50 +08:00
Hermes CI Fix f8688713db feat(data): 清理遗留ERP数据源配置标注收尾 — 移除DataManage遗留标签/告警, 空态引导真实zxt通道 (project-20260908-data-source-cleanup) 2026-09-08 21:10:32 +08:00
Hermes CI Fix aa81cee009 fix(maps): MapCanvas onMounted 忽略路由 :id 恒取第一张地图 — 修复 /maps/canvas/53 打开显示54空图、新增节点落错地图 2026-09-08 20:35:51 +08:00
Hermes CI Fix 265714341c fix(maps): _auto_snapshot 补 entity_id 继承地图企业 — 修复 entity2 地图发布后版本行落 entity1 致版本列表为空 (project-20260908-map-versions-page) 2026-09-08 20:24:44 +08:00
Hermes CI Fix 534f6328ed chore: components.d.ts 注册表同步 (MapVersions) 2026-09-08 20:12:17 +08:00
Hermes CI Fix a223211782 chore: components.d.ts 自动注册补提交 (MapVersions) 2026-09-08 20:12:03 +08:00
Hermes CI Fix 397c365263 feat(maps): 战略地图版本管理完整实现（方案B）— versions API列表/详情/回滚带自动备份/备注 + MapVersions独立版本页 + 路由注册 + 版本弹窗接真实数据 (project-20260908-map-versions-page) 2026-09-08 20:11:59 +08:00
Hermes CI Fix fcc511d3b9 fix(budget): 版本差异对比弹窗字段对齐后端契约(version_a/version_b/diff) + diff_rate前端计算 + 移除无意义period列 (project-20260908-budget-diff-empty) 2026-09-08 16:31:49 +08:00
Hermes CI Fix 54e39b5493 chore(kpi): BEP阈值+现金口径修复验收脚本 verify_bep_threshold_fix.py (fin-fix-bep-threshold-20260908) 2026-09-08 15:59:41 +08:00
Hermes CI Fix 5bcc65b47f fix(kpi): BEP保本KPI阈值按>=85口径修正 + 新增现金口径派生KPI(剔除折旧560213) + bep-card现金读派生单一事实源 (fin-fix-bep-threshold-20260908) 2026-09-08 15:57:47 +08:00
Hermes CI Fix cf81ee0ccd fix(dashboard): BEP卡片现金口径公式文案修正（按口径切换显示完整推导） 2026-09-08 14:02:33 +08:00
Hermes CI Fix ef0f542292 chore: 组件自动注册 components.d.ts 补提交 (BEPBreakEvenCard, 阻塞CI纪律检查) 2026-09-08 13:58:11 +08:00
Hermes CI Fix 9eb38cfa89 feat(dashboard): 经营看板「本量利·保本点」卡片 + 只读BEP概览端点 (cma-bep-kpi Phase2) 
- 新增 GET /api/cma/dashboard/bep-card：账面/现金双口径只读数据
  (5001月销113.6/5602管理费26.1/折旧560213 7.51/渠补率84.61%)
  账面: 保本169.9万 覆盖率66.9%(黄) 缺口33.1%; 现金: 保本121.0万 覆盖率93.9%
- 新增 components/BEPBreakEvenCard.vue：主指标覆盖率红黄绿圆点+副指标
  并排+下钻面板(公式/输入KPI/双口径切换/解读)，A区只读
- Dashboard.vue CEO/财务视图顶部引入卡片
 2026-09-08 13:58:01 +08:00
Hermes CI Fix 1a5356a2d1 feat(kpi): CMA保本点派生KPI F_BEP_REVENUE/COVER/GAP + 每日派生执行器 + 红黄绿静态阈值判定 
- kpi_definitions entity1 新增3条派生KPI(456/457/458, formula/threshold/unit齐全)
- 新增 scripts/kpi_bep_deriver.py: 从 voucher_details 按财务口径聚合
  (5001销售收入/5602管理费 YTD月均, 渠补率政策84.61%) → 计算保本销售额/
  覆盖率/缺口 → upsert kpi_values source_type='derived' 幂等 + 同步yellow/red预警
- cron 06:35 注册(紧随 collector 06:30); 自动选最近完整月(8月未结账自动回退7月)
- kpis.py get_kpi: F_BEP_* 派生KPI按静态阈值文本判红黄绿(66.9→黄), 不走target比率
- 阈值经财务Bot 2026-09-08裁决: COVER >=100绿 50~100黄 <50红; GAP <=0绿 <=50黄 >50红
 2026-09-08 13:43:20 +08:00
Hermes CI Fix ebe0962c09 feat(frontend): Phase C 固定企业模式 - VITE_FIXED_ENTITY_ID 支持登录无下拉/隐藏切换器 
- 新增 src/utils/entity.ts: isFixedEntity/getFixedEntityId/effectiveEntityId
- Login.vue: 固定企业版隐藏企业下拉显示只读徽标, 登录直接带固定 entity_id
- MainLayout.vue: 切换器加 !isFixedEntity() 守卫, 固定版顶部显示企业 tag, logo 带企业名
- ReportCenter.vue: 页内企业切换下拉加守卫, getEntityId 固定版恒取构建锁定值
- .env.example: VITE_FIXED_ENTITY_ID 示例与说明
- 验证脚本 backend/scripts/verify_phase_c_fixed_entity_e2e.py (22项, 双build E2E全过)
 2026-09-08 11:27:01 +08:00
Hermes CI Fix 193061cf4d fix(data): 数据管理模块脱节修复 — Excel导入/sources端点 entity 隔离 + ERP直连通道诚实化(410) + 真实zxt链路展示 
- import_excel/import_excel_smart KPI字典按 entity_id 过滤（防跨账套匹配串写，P0安全）
- import_excel_smart 自动建KPI编码防冲突（_next_code 循环取号）
- sources list/create/update/delete 全部按 entity_id 隔离（create 写入当前账套）
- sync-kpis + admin/erp-sync 下线返回410（erp-gateway DB凭据2026-08-31已删，真实通道=zxt智享通注入）
- 新增 GET /data/channel-status：展示真实zxt取数通道状态+遗留ERP数据源清单（诚实化）
- DataManage.vue：数据源tab顶部展示真实通道(最近注入period/时间/行数/落盘目录mtime)、ERP遗留源标注'非当前通道'、实际取数映射(kpi_value_sources)表格
- 新增 test_data_entity_isolation_20260908.py（8条：双账套导入隔离/CRUD隔离/sync-kpis 410/channel-status）
 2026-09-08 11:19:38 +08:00
Hermes CI Fix bdcfa2500e docs(manuals): 提交手册模板 _template.md（6段结构，随首批手册入库） 2026-09-07 16:08:55 +08:00
Hermes CI Fix b4071fd1c5 docs(manuals): CMA首批3模块操作手册（budget-version/multitenant-isolation/mydashboard 修复后状态） 2026-09-07 16:08:44 +08:00
Hermes CI Fix 616f444564 fix(verify): 预算版本UI浏览器验证脚本加 tab 导航等待 (about:blank竞态,复跑必挂修复) 2026-09-07 11:34:56 +08:00
Hermes CI Fix f8018aa471 chore(verify): 预算版本管理UI修复验证脚本（API+浏览器双录，可复跑） 2026-09-07 11:04:35 +08:00
Hermes CI Fix b01a108874 fix(budget): 版本管理UI字段/状态机对齐 active→draft映射+plan_count/last_updated别名 
- list_budget_versions 输出 approval_status(active映射draft)+plan_count+last_updated
- 保留 status/kpi_count/updated_at 原字段兼容（下拉'当前'标记/测试契约）
- 前端提交审批按钮兜底 active（双端保险）
- 修复: 版本行仅复选框无按钮/状态恒草稿/条目数空白/最后更新空白
 2026-09-07 11:01:56 +08:00
Hermes CI Fix 1fa08364ad chore: ignore cma.db/cma_import.db 根目录SQLite产物 (防 CI deploy hook 被未跟踪文件误挡) 2026-09-07 10:23:23 +08:00
Hermes CI Fix ac645a56ee fix(security): ai_analysis多租户隔离缺口 + dashboard预警计数 + bot_kpis归属 + cost账套过滤 + kpis create白名单 (OpenCode审查20260907) 
- ai_analysis: generate_rule_suggestions pending预警按entity过滤; kpi_analysis归属校验404;
  dashboard-analysis-stream/ask/review-plans 补 get_entity_id + KPI/ActionPlan/KPIAlert 全按账套过滤;
  stream cache key 含 entity_id (原跨企业串缓存)
- dashboard: summary alert_count 补 KPIAlert.entity_id 过滤 (kpi_total 已有)
- bot_kpis: update_bot_kpi_value 归属校验 404 (原任意登录可改他企 bot KPI)
- cost: ActualCost/StandardCost 确认多企业共用 → cost_overview/variance/breakdown/dashboard
  补 entity 过滤(engine 函数加 entity_id 透传); dashboard total_cost 既有 KeyError 修复
- kpis: create_kpi 字段白名单 (仿 UPDATE_KPI_WHITELIST+kpi_code), 拦截 status/important_flag 注入
- tests: 新增 test_multitenant_ai_20260907.py 11条越权用例 (跨entity 404/空返回断言)
- 全量 pytest: 745 passed / 10 failed(与基线 HEAD 一致, 存量问题非本次引入) / 1 xfailed
 2026-09-07 10:22:24 +08:00
Hermes CI Fix d71c7fef67 fix(data): 自动归集空汇总不写0 + Excel导入示例文件防线 (DAMA审计20260906代码类) 2026-09-06 16:57:03 +08:00
Hermes CI Fix 594bb00a38 fix(cash): vouchers-json batch改为纯内容指纹(不含时间戳) — 快照每10分钟重推必须幂等命中 
- batch=zxt-{sha1前10}，同内容任意时刻重推 → 同一batch → already_imported跳过
- 原带秒级时间戳导致指纹去重失效(靠行级防重兜底,但会产生噪音import_logs)
- 验收脚本补用例4b(三次重发batch不变+already_imported), 13/13 PASS
 2026-09-06 16:47:25 +08:00
Hermes CI Fix 3db805db4e feat(cash): 智享通凭证JSON直传导入端点 vouchers-json (zxt-cma-import-v1) 
- 新端点 POST /api/cma/cash/import/vouchers-json (X-BOT-KEY鉴权, 独立router避开require_role)
- 兼容三种body: 裸rows数组 / {rows} / {datasets[0].rows} 整包
- 凭证级借贷平衡(替代批级, 已知单边30694记异常拒收), 结转行summary识别
- 日期从summary前缀解析, 无日期行pending拒收(不冒充文件时间)
- 科目解析: 行内subject → DB zxt_account_dict → body subject_map, 未命中拒收
- 幂等: 内容指纹batch + import_logs去重 + 行级业务键防重复
- entity默认1(陕西酣客), active校验; 不触发现金流联动(凭证未证实权威)
- 验收脚本 scripts/verify_zxt_vouchers_json.py 12/12 PASS (SQLite本地)
 2026-09-06 16:45:03 +08:00
Hermes CI Fix f884fa5a18 fix(scripts): E2E验证脚本 actual_costs 无remark列, 存量internal计数改前缀排除 (cma-rd-dimension) 2026-09-05 09:11:27 +08:00
Hermes CI Fix 696f8bc934 feat(cost): 成本模型加研发归集维度 research_flag/project_type (cma-rd-dimension-20260905) 
- StandardCost/ActualCost 增加 research_flag(int,idx)/project_type(varchar30,idx)
  project_type: platform_dev平台研发/client_delivery客户交付/internal内部管理
- 生产库两表 ALTER 完成, 存量 29+134 行默认 internal(保守防误归研发)
- API: create/update 支持写入维度, 未传默认 client_delivery(录入默认),
  research_flag 未显式传入按 project_type 联动(platform_dev=1);
  create/update/delete 绑定 entity_id(token优先, 防跨账套)
- API: standard/actual 列表支持 project_type/research_flag 过滤
- 前端 CostDashboard: 表单加归集类型下拉(默认客户交付+研发提示),
  列表加归集类型列(标签), 工具栏按归集类型过滤
- tests: test_cost.py +6 用例(默认值/联动/过滤/更新)
- scripts: verify_cost_research_dimension_e2e.py 生产E2E(标记+清理+回查)
 2026-09-05 09:10:35 +08:00
Hermes CI Fix 46096e8f84 fix(budget): loadVersions解包bug-后端返回裸数组被r.data吞掉致版本列表永远为空 2026-09-04 10:03:16 +08:00
Hermes CI Fix 7ea0d2e564 fix(dashboard): MyDashboard 显示实际值期间+空值区分暂无数据 (period-label) 2026-09-04 09:33:52 +08:00
Hermes CI Fix 88ec021a58 chore: 清理误提交的.bak备份文件（git历史可恢复，源文件均在） 2026-09-04 00:09:57 +08:00
Hermes CI Fix 9eab9bb8a1 Revert "fix(knowledge): articles共享层语义对齐评审方案——entity_id=0系统共享(替代NULL) (entity-memory-partition 复核对齐)" 
This reverts commit 5e96d15888.
 2026-09-03 23:09:58 +08:00
Hermes CI Fix 5e96d15888 fix(knowledge): articles共享层语义对齐评审方案——entity_id=0系统共享(替代NULL) (entity-memory-partition 复核对齐) 2026-09-03 23:09:04 +08:00
Hermes CI Fix 1a1be3001d docs(knowledge): 研学评审回执——决策点A-D确认(entity-memory-partition) 2026-09-03 23:06:12 +08:00
Hermes CI Fix 96844f0002 test(knowledge): 生产E2E越权验证脚本入库 verify_knowledge_partition_e2e.py (entity-memory-partition) 2026-09-03 23:01:33 +08:00
Hermes CI Fix e22e1702f8 feat(knowledge): 企业记忆分区——知识三表entity_id多租户隔离 (entity-memory-partition P1) 
- knowledge_events/knowledge_summaries: entity_id NOT NULL DEFAULT 1 + 索引（企业记忆抽屉）
- knowledge_articles: entity_id 可空——NULL=全局共享(CMA教学知识), 有值=企业专属
- knowledge_service 全链路 entity_id: extract_events(KPIAlert直过滤+OperationLog经user_entities归属)/_kpi_snapshot(修跨企业KPI泄漏)/generate_summary/get_last_summary/run_*/sync
- api/knowledge.py 8端点 Depends(get_entity_id) 强制过滤；详情越权404
- api/knowledge_articles.py 全局∪本企业查询；企业专属越权404
- 生产DB三表ALTER+索引已完成; 存量38篇教学文章保持NULL全局共享
- 测试 test_security_knowledge_partition.py 8条(双实体互查越权/生成自动带entity/全局文章双可见)
- 方案文档 docs/knowledge-entity-partition-plan-20260903.md（附评审决策点）
 2026-09-03 23:00:15 +08:00
Hermes CI Fix a3111a25f6 test(frontend): BUG-001验收脚本 3页面x10连刷无卡加载中 (入库留存,2026-09-03) 2026-09-03 18:41:44 +08:00
Hermes CI Fix 45cacedfdd fix(frontend): BUG-001慢API超时兜底+BUG-002清理views残留.bak (产品打磨批次1 2026-09-03) 
- api/index.ts: axios网络层错误(超时ECONNABORTED/断连)3s节流ElMessage提示,页面不再静默加载失败
- views: 删除6个.bak历史备份(BudgetManagement/CMAKnowledge/DeviationDashboard/KPIList/MapCanvas/MapReview),均已git跟踪可回溯
- nginx缓存策略另改(不进git): /assets/ immutable长缓存+index.html etag条件请求
 2026-09-03 18:32:24 +08:00
Hermes CI Fix 9a823e80a6 test(bot-tier): UI实证脚本 SuggestionCenter 默认未应用+类型过滤 (P0-②) 
CDP登录→/ai-suggestions→待批列表默认unapplied且可见Bot建议卡+过滤芯片DOM全命中
临时建议SUG_ID=300已清理(回查0)
 2026-09-03 18:19:58 +08:00
Hermes CI Fix be71c2296e test(bot-tier): M4 生产E2E实证脚本 verify_bot_write_tiering_e2e.py (P0-②) 
全PASS: Bot建议→unapplied→人apply→目标生效+apply_detail before/after→低危kpi-result source_batch落库→audit L2留痕→清理回查=0
 2026-09-03 18:15:47 +08:00
Hermes CI Fix 960cd15268 fix(daily-push): 补提交分企业推送 v2——daily-push-split 任务(11:45 .done)漏commit，阻塞CI deploy hook；.gitignore 忽略 *.bak-* (2026-09-03) 2026-09-03 18:15:05 +08:00
Hermes CI Fix d89a5ab777 feat(frontend): M3 AI建议中心默认未应用+类型过滤+Bot来源标签 (P0-②) 
- 待批列表默认 status=unapplied(高危建议=人拍板入口)
- 新增 suggestion_type 过滤(全部/kpi_target/budget_adjust/action_plan)
- sourceLabel 补 bot: 'Bot建议'
 2026-09-03 18:08:30 +08:00
Hermes CI Fix ea2baa098e docs(bot-tier): M2 分层授权审计清单 docs/bot-write-tiering-20260903.md (P0-②) 
逐端点low/high归类+L1-L4正交关系+目标值直写审计结论(收口说明)+P1待办
 2026-09-03 18:08:30 +08:00
Hermes CI Fix 80fbc11cba feat(bot-tier): M1 Bot侧高危建议创建通道+目标值直写收口 (P0-②分层授权) 
- 新增 POST /api/cma/bot/ai/suggestions (bot_suggestions.py, X-BOT-KEY鉴权, L2)
  高危建议(kpi_target/budget_adjust/action_plan) status恒unapplied 等人审批
  source白名单(bot/rule)防冒充manual; entity多租户归属校验; 幂等防重
- risk_levels.py: API_RISK_MAP加新端点 + 文件头补写操作语义分级low/high说明
- 收口: bot/kpis/create-with-links 拒绝直写非零target_value(显式置0, 考核基准=人拍板)
- test_risk_levels: L2计数5→6; 新增test_bot_suggestion_channel 12条(鉴权/语义/多租户/幂等/审批闭环/审计)
 2026-09-03 18:08:27 +08:00
Hermes CI Fix c45848bb34 chore(zone): components.d.ts 自动注册 BotSourceTag（M3构建产物，three-zone P0-①） 2026-09-03 18:03:58 +08:00
Hermes CI Fix a8de53a4c2 feat(zone): 三区标记M3后端——KPI values/bot-kpis响应补calculated_at时间字段(updated_at/value_updated_at/source_batch)，供BotSourceTag展示 (three-zone P0-①) 2026-09-03 17:52:36 +08:00