# Phase 1 Delta 审计 — Wave D7（Deploy / 本地验证脚本）

**日期**: 2026-06-04  
**范围**: 门控脚本 + 本地 dev/verify + docker-compose  
**标准**: 变更审查（运维/门控；非业务 API 8 步，沿用 Closure 表格式）

## 登记

| # | 文件 | 语言 | 行数 N | Read 范围 |
|---|------|------|--------|-----------|
| 1 | `deploy/pre_deploy_check.sh` | Bash | 299 | 1–299 全文 |
| 2 | `scripts/local_verify.sh` | Bash | 25 | 1–25 全文 |
| 3 | `scripts/local_integration_smoke.sh` | Bash | 91 | 1–91 全文 |
| 4 | `scripts/start-dev.sh` | Bash | 90 | 1–90 全文 |
| 5 | `docker-compose.yml` | YAML | 89 | 1–89 全文 |

## Step 3 — 规则扫描 H（摘要）

| 文件 | H 命中 |
|------|--------|
| pre_deploy_check.sh | H-Gate, H-Secret, H-Git |
| local_verify.sh | H-Chain |
| local_integration_smoke.sh | H-Health, H-Auth |
| start-dev.sh | H-DevBind, H-Env |
| docker-compose.yml | H-Port, H-DefaultCreds |

## 入口表（脚本调用链）

```
local_verify.sh
  → start-dev.sh (docker mysql+redis, uvicorn :8600)
  → local_integration_smoke.sh (/health, JWT 401, unit tests)
  → tests/test_api.py
  → ruff check server/ -F

pre_deploy_check.sh (独立 L3 门控，7+2 pre-flight)
```

## Closure 表

| H | 文件:行号 | 判定 | 理由 |
|---|-----------|------|------|
| H-Gate | pre_deploy_check.sh:50-74 | SAFE | Changelog 日期+≥10 行 |
| H-Gate | pre_deploy_check.sh:76-105 | RISK | 审计路径 `docs/audit/`；delta 报告在 `docs/reports/` 不自动过 Gate2 |
| H-Gate | pre_deploy_check.sh:107-131 | SAFE | test_api 必须存在且通过 |
| H-Gate | pre_deploy_check.sh:134-160 | SAFE | ruff F；未装则 SKIP |
| H-Gate | pre_deploy_check.sh:194-218 | RISK | bandit `-ll` 仅 HIGH；文档写 HIGH/MEDIUM 有漂移 |
| H-Gate | pre_deploy_check.sh:221-258 | RISK | Gate7 用 `HEAD~1` diff；未 commit 改动可能漏检 |
| H-Gate | pre_deploy_check.sh:261-284 | SAFE | shell/text EOL pre-flight |
| H-Chain | local_verify.sh:10-22 | SAFE | 固定顺序 smoke→test_api→ruff |
| H-Health | local_integration_smoke.sh:67-70 | SAFE | /health 200 |
| H-Auth | local_integration_smoke.sh:72-75 | SAFE | /api/servers/ 无 JWT → 401 |
| H-DevBind | start-dev.sh:75-76 | RISK | uvicorn `--host 0.0.0.0` 仅本地 dev |
| H-Env | start-dev.sh:29-32 | SAFE | 无 .env 时 generate_env，不写 git |
| H-Port | docker-compose.yml:40-41 | SAFE | Redis publish 6379 修复本机 uvicorn 连 Redis |
| H-Port | docker-compose.yml:26-27 | RISK | MySQL 3306 暴露主机；dev 惯例 |
| H-DefaultCreds | docker-compose.yml:14-17 | RISK | 默认 dev 密码；非生产 compose |
| H-Secret | docker-compose.yml:68-70 | SAFE | SECRET/API/ENCRYPTION 从 env 注入，无硬编码 |

**len(H)=16, Closure=16**

## FINDING

无 P0/P1 新 FINDING。

**运维备注（非阻塞）**：
- Phase1 delta 报告在 `docs/reports/audit-delta-*.md`；部署前若只跑 pre_deploy，需另备 `docs/audit/YYYY-MM-DD-*.md` 或调整 Gate2 路径。
- 生产部署仍走 SSH + handoff，不依赖本 compose 默认密码。

## DoD

- [x] len(H) == Closure
- [x] 五文件全文 Read
- [x] local_verify 链路可复现

## 验证

`bash scripts/local_verify.sh` — 全绿