From 1a214dd7649cc34ff86ec1483e68d099b69ff2e7 Mon Sep 17 00:00:00 2001 From: Sergey Krylov Date: Mon, 24 Aug 2026 19:57:56 +0300 Subject: [PATCH] docs: record governance completion evidence --- development/audit-remediation.md | 44 ++++++++++++++++++++------------ 1 file changed, 27 insertions(+), 17 deletions(-) diff --git a/development/audit-remediation.md b/development/audit-remediation.md index ce8c056..641612e 100644 --- a/development/audit-remediation.md +++ b/development/audit-remediation.md @@ -15,16 +15,16 @@ ## Текущее состояние workflow - Bootstrap change: [`2026-08-23-establish-audit-remediation-workflow`](../../specs/openspec/changes/archive/2026-08-23-establish-audit-remediation-workflow/) — `archived`; это process foundation и не закрывает ни одного Audit ID. -- Последний завершённый audit remediation change: [`2026-08-24-tighten-frontend-quality-guardrails`](../../specs/openspec/changes/archive/2026-08-24-tighten-frontend-quality-guardrails/) — `archived`; WL-P3-02, WL-P3-03, WL-P3-05 и WL-P3-06 закрыты. -- Единственный active change: [`harden-agent-sdd-governance`](../../specs/openspec/changes/harden-agent-sdd-governance/) — AUD24-01 и AUD24-03–AUD24-09, а также A-14–A-16 и A-18. +- Последний завершённый audit remediation change: [`2026-08-24-harden-agent-sdd-governance`](../../specs/openspec/changes/archive/2026-08-24-harden-agent-sdd-governance/) — `archived`; AUD24-01 и AUD24-03–AUD24-09, а также A-14–A-16 и A-18 закрыты. +- Единственный active change: отсутствует. ## Текущая задача -Завершить `harden-agent-sdd-governance`. Пока change active, новый remediation change не создаётся. +Создать `assess-auth-platform-options` для AUD24-02. ## Следующая рекомендуемая задача -`assess-auth-platform-options` для AUD24-02. Она начинается только после archive текущего active change, применяет Solution Assessment к существующей реализации и зрелым auth platforms, включая Better Auth, и не предрешает миграцию. +`assess-auth-platform-options` для AUD24-02. Change применяет Solution Assessment к существующей реализации и зрелым auth platforms, включая Better Auth, и не предрешает миграцию. ## Реестр findings @@ -45,25 +45,25 @@ | A-11 | done | Исправлено и подтверждено самим snapshot 13.08.2026. | Transport tests и единый Bearer owner. | | A-12 | done | Исправлено в snapshot; дополнительно защищено WL-P3-03. | Dependency boundary fixture passed, 2026-08-24. | | A-13 | deferred | Frontend behavior закрыт; backend e2e зависит от WL-P2-05. | Тот же stable Prisma trigger, что у WL-P2-05. | -| A-14 | active | `harden-agent-sdd-governance`. | Completion Evidence только после archive. | -| A-15 | active | `harden-agent-sdd-governance`. | Обновить current-state ADR и links. | -| A-16 | active | `harden-agent-sdd-governance`. | Слоистые AGENTS и onboarding. | +| A-14 | done | [`2026-08-24-harden-agent-sdd-governance`](../../specs/openspec/changes/archive/2026-08-24-harden-agent-sdd-governance/). | 2026-08-24; canonical SDD governance, local guardrails and completion evidence protocol verified. | +| A-15 | done | [`2026-08-24-harden-agent-sdd-governance`](../../specs/openspec/changes/archive/2026-08-24-harden-agent-sdd-governance/). | 2026-08-24; current-state ADR/spec contradictions fixed and strict specs passed. | +| A-16 | done | [`2026-08-24-harden-agent-sdd-governance`](../../specs/openspec/changes/archive/2026-08-24-harden-agent-sdd-governance/). | 2026-08-24; layered AGENTS and onboarding verified. | | A-17 | deferred | Совпадает с accessibility scope WL-P3-04. | Пересмотреть при включении accessibility/second locale в MVP scope. | -| A-18 | active | `harden-agent-sdd-governance`. | Нормализовать H1 main spec и пройти strict validation. | +| A-18 | done | [`2026-08-24-harden-agent-sdd-governance`](../../specs/openspec/changes/archive/2026-08-24-harden-agent-sdd-governance/). | 2026-08-24; main spec H1 normalized and strict validation passed. | ### Аудит 24.08.2026 | Audit ID | Цель | Статус | Связанный change | Следующее действие / evidence | | --- | --- | --- | --- | --- | -| AUD24-01 | Ввести risk-based testing без тестов ради файла или coverage. | active | [`harden-agent-sdd-governance`](../../specs/openspec/changes/harden-agent-sdd-governance/) | Завершить gates и archive. | -| AUD24-02 | Оценивать mature solutions и ретроспективно проверить auth platform. | planned | `assess-auth-platform-options` | Начать только после active governance change; миграция не предрешена. | -| AUD24-03 | Закрепить строгий artifact graph и роли OpenSpec. | active | [`harden-agent-sdd-governance`](../../specs/openspec/changes/harden-agent-sdd-governance/) | Завершить gates и archive. | -| AUD24-04 | Синхронизировать agent projection и hard archive blockers. | active | [`harden-agent-sdd-governance`](../../specs/openspec/changes/harden-agent-sdd-governance/) | Завершить gates и archive. | -| AUD24-05 | Добавить canonical repo gates и workspace dispatcher. | active | [`harden-agent-sdd-governance`](../../specs/openspec/changes/harden-agent-sdd-governance/) | Завершить gates и archive. | -| AUD24-06 | Ввести docs-as-code gate и authoritative process policy. | active | [`harden-agent-sdd-governance`](../../specs/openspec/changes/harden-agent-sdd-governance/) | Завершить gates и archive. | -| AUD24-07 | Сделать AGENTS компактными routing/enforcement layers. | active | [`harden-agent-sdd-governance`](../../specs/openspec/changes/harden-agent-sdd-governance/) | Завершить gates и archive. | -| AUD24-08 | Охватить одним registry все audit snapshots и исправить stale status. | active | [`harden-agent-sdd-governance`](../../specs/openspec/changes/harden-agent-sdd-governance/) | Завершить gates и archive. | -| AUD24-09 | Исправить current-state ADR/spec contradictions. | active | [`harden-agent-sdd-governance`](../../specs/openspec/changes/harden-agent-sdd-governance/) | Завершить gates и archive. | +| AUD24-01 | Ввести risk-based testing без тестов ради файла или coverage. | done | [`2026-08-24-harden-agent-sdd-governance`](../../specs/openspec/changes/archive/2026-08-24-harden-agent-sdd-governance/) | 2026-08-24; risk-based testing policy and gates recorded. | +| AUD24-02 | Оценивать mature solutions и ретроспективно проверить auth platform. | planned | `assess-auth-platform-options` | Готово к созданию change; миграция не предрешена. | +| AUD24-03 | Закрепить строгий artifact graph и роли OpenSpec. | done | [`2026-08-24-harden-agent-sdd-governance`](../../specs/openspec/changes/archive/2026-08-24-harden-agent-sdd-governance/) | 2026-08-24; one-artifact approvals, cascade reapproval and artifact roles verified. | +| AUD24-04 | Синхронизировать agent projection и hard archive blockers. | done | [`2026-08-24-harden-agent-sdd-governance`](../../specs/openspec/changes/archive/2026-08-24-harden-agent-sdd-governance/) | 2026-08-24; project entrypoints and authority verifier reject bypass cases. | +| AUD24-05 | Добавить canonical repo gates и workspace dispatcher. | done | [`2026-08-24-harden-agent-sdd-governance`](../../specs/openspec/changes/archive/2026-08-24-harden-agent-sdd-governance/) | 2026-08-24; workspace dispatcher ran all affected gates and runtime OpenAPI. | +| AUD24-06 | Ввести docs-as-code gate и authoritative process policy. | done | [`2026-08-24-harden-agent-sdd-governance`](../../specs/openspec/changes/archive/2026-08-24-harden-agent-sdd-governance/) | 2026-08-24; docs `npm run verify` passed and engineering governance is durable docs. | +| AUD24-07 | Сделать AGENTS компактными routing/enforcement layers. | done | [`2026-08-24-harden-agent-sdd-governance`](../../specs/openspec/changes/archive/2026-08-24-harden-agent-sdd-governance/) | 2026-08-24; root and repository AGENTS layers verified. | +| AUD24-08 | Охватить одним registry все audit snapshots и исправить stale status. | done | [`2026-08-24-harden-agent-sdd-governance`](../../specs/openspec/changes/archive/2026-08-24-harden-agent-sdd-governance/) | 2026-08-24; registry covers all 53 audit IDs with one snapshot source each. | +| AUD24-09 | Исправить current-state ADR/spec contradictions. | done | [`2026-08-24-harden-agent-sdd-governance`](../../specs/openspec/changes/archive/2026-08-24-harden-agent-sdd-governance/) | 2026-08-24; ADR/spec contradictions fixed without editing audit snapshots. | ### P1 @@ -110,6 +110,16 @@ Terminal evidence добавляется сюда только после завершения соответствующего change. +### 2026-08-24 — AUD24-01, AUD24-03–AUD24-09, A-14–A-16, A-18: done + +Change синхронизирован в canonical specs и архивирован в [`2026-08-24-harden-agent-sdd-governance`](../../specs/openspec/changes/archive/2026-08-24-harden-agent-sdd-governance/). + +- Delivery Map: frontend affected, backend affected, specs affected, docs affected; runtime OpenAPI contract gate required because frontend/backend contract verification pipelines changed. Workspace root `.opencode` projection and root `AGENTS.md` were updated locally; the workspace root is not a Git repository. +- Затронутые Git-репозитории: frontend `11be786943024699a4eccf91a8d1ad32a6d29e5f` (`chore: codify frontend local verification`), backend `2772d53647132e6119e411c6d18234db4301e541` (`chore: codify backend local verification`), specs `0006aea56207ad2192c678ced562feabf1a21c45` (`chore: harden SDD governance workflow`), docs delivery `1944f2fc970db2bdc292981e01b1aca549f9ac52` (`docs: record AI governance audit`); terminal evidence фиксируется следующим docs commit. +- `bash specs/scripts/verify-workspace-change.sh harden-agent-sdd-governance` под Node 22.21.0 — passed: Delivery Map verified for all four areas, OpenSpec CLI 1.10.0 verified, schema valid, change valid before archive, main specs 18/18 before sync, authority verified, frontend `npm run verify` passed (17 test files / 56 tests, coverage 82.57% statements / 76.08% branches / 77.35% functions / 83.48% lines, production build, initial JS 509,165 B), backend `npm run verify` passed (19 suites / 59 tests, build), docs `npm run verify` passed (34 Markdown files, 0 issues), runtime OpenAPI SHA-256 matched snapshot `96744da5f307b37ee3d9233b3259043425f65e49bcc60f78b46c585a78251db4`. +- После sync/archive `openspec validate --specs --strict --store wealth-ledger-specs` — 20 passed, 0 failed; `git diff --check` в frontend, backend, specs и docs — exit 0 before delivery commits. +- Semantic verification: Proposal, all 19 Delta Spec requirements, Design and 25/25 tasks matched implementation. Independent read-only re-review after fixes: Spec review 19/19, 0 Critical, 0 Important, 0 Minor semantic findings; Standards review final — no findings. + ### 2026-08-24 — WL-P3-02, WL-P3-03, WL-P3-05, WL-P3-06: done Change синхронизирован в canonical specs и архивирован в [`2026-08-24-tighten-frontend-quality-guardrails`](../../specs/openspec/changes/archive/2026-08-24-tighten-frontend-quality-guardrails/).