# 审计 — 2026-06-04 Code Review 生产部署

## Step 3 规则扫描

| H | 规则 | 结论 |
|---|------|------|
| H1 | P0/P1 batch1 | FIXED — sync session、install token、源路径、refresh、schedule、primary lock |
| H2 | P1/P2 batch2 | FIXED — webssh tv、retry/schedule lock、agent fail-closed、bing、install status |
| H3 | P1/P2 batch3 | FIXED — script session、settings 脱敏、agent unknown server、WS 4401 |
| H4 | 风险接受 | DOC — risk-acceptance-single-operator.md |

## Closure

| H | 判定 | 依据 |
|---|------|------|
| H1-H3 | FIXED | docs/changelog/2026-06-04-code-review-*.md |
| H4 | ACCEPTED | 单人运维 WS ADR-011 + Agent global legacy |

## 改动文件清单（Gate 7）

### 后端
- sync_engine_v2.py
- posix_paths.py
- install.py
- auth_service.py
- sync_v2.py
- main.py
- schedule_runner.py
- retry_runner.py
- agent.py
- settings.py
- websocket.py
- webssh.py
- script_service.py

### 前端
- LoginPage.vue
- usePushProgress.ts
- useServerList.ts
- CommandsPage.vue
- CredentialsPage.vue
- DashboardPage.vue
- ScriptsPage.vue
- SettingsPage.vue
- api.ts

### 静态 / 测试
- install.html
- test_security_unit.py
- test_retry_runner_outcome.py

### 部署
- deploy-production.sh

## DoD

- [x] ruff / pytest 28 passed（.venv）
- [x] vue-tsc 通过
- [x] changelog + audit 齐全
- [ ] 生产 /health + /app/ 200（部署后）