Files

T

Nexus Deploy 0100ab2582 docs: consolidate archive, SSOT guide, and agent entry stubs

Move line-walk/delta/phase2/frontend audits and legacy memory into
docs/archive/, add functional development SSOT, thin AGENTS/CLAUDE stubs,
and regenerate changelog/audit indexes via consolidate_docs.py.

2026-06-04 23:01:03 +08:00

3.2 KiB

Raw Blame History

Phase 1 Delta 审计 — Wave D7（Deploy / 本地验证脚本）

日期: 2026-06-04
范围: 门控脚本 + 本地 dev/verify + docker-compose
标准: 变更审查（运维/门控；非业务 API 8 步，沿用 Closure 表格式）

登记

#	文件	语言	行数 N	Read 范围
1	`deploy/pre_deploy_check.sh`	Bash	299	1–299 全文
2	`scripts/local_verify.sh`	Bash	25	1–25 全文
3	`scripts/local_integration_smoke.sh`	Bash	91	1–91 全文
4	`scripts/start-dev.sh`	Bash	90	1–90 全文
5	`docker-compose.yml`	YAML	89	1–89 全文

Step 3 — 规则扫描 H（摘要）

文件	H 命中
pre_deploy_check.sh	H-Gate, H-Secret, H-Git
local_verify.sh	H-Chain
local_integration_smoke.sh	H-Health, H-Auth
start-dev.sh	H-DevBind, H-Env
docker-compose.yml	H-Port, H-DefaultCreds

入口表（脚本调用链）

local_verify.sh
  → start-dev.sh (docker mysql+redis, uvicorn :8600)
  → local_integration_smoke.sh (/health, JWT 401, unit tests)
  → tests/test_api.py
  → ruff check server/ -F

pre_deploy_check.sh (独立 L3 门控，7+2 pre-flight)

Closure 表

H	文件:行号	判定	理由
H-Gate	pre_deploy_check.sh:50-74	SAFE	Changelog 日期+≥10 行
H-Gate	pre_deploy_check.sh:76-105	RISK	审计路径 `docs/audit/`；delta 报告在 `docs/reports/` 不自动过 Gate2
H-Gate	pre_deploy_check.sh:107-131	SAFE	test_api 必须存在且通过
H-Gate	pre_deploy_check.sh:134-160	SAFE	ruff F；未装则 SKIP
H-Gate	pre_deploy_check.sh:194-218	RISK	bandit `-ll` 仅 HIGH；文档写 HIGH/MEDIUM 有漂移
H-Gate	pre_deploy_check.sh:221-258	RISK	Gate7 用 `HEAD~1` diff；未 commit 改动可能漏检
H-Gate	pre_deploy_check.sh:261-284	SAFE	shell/text EOL pre-flight
H-Chain	local_verify.sh:10-22	SAFE	固定顺序 smoke→test_api→ruff
H-Health	local_integration_smoke.sh:67-70	SAFE	/health 200
H-Auth	local_integration_smoke.sh:72-75	SAFE	/api/servers/ 无 JWT → 401
H-DevBind	start-dev.sh:75-76	RISK	uvicorn `--host 0.0.0.0` 仅本地 dev
H-Env	start-dev.sh:29-32	SAFE	无 .env 时 generate_env，不写 git
H-Port	docker-compose.yml:40-41	SAFE	Redis publish 6379 修复本机 uvicorn 连 Redis
H-Port	docker-compose.yml:26-27	RISK	MySQL 3306 暴露主机；dev 惯例
H-DefaultCreds	docker-compose.yml:14-17	RISK	默认 dev 密码；非生产 compose
H-Secret	docker-compose.yml:68-70	SAFE	SECRET/API/ENCRYPTION 从 env 注入，无硬编码

len(H)=16, Closure=16

FINDING

无 P0/P1 新 FINDING。

运维备注（非阻塞）：

Phase1 delta 报告在 docs/reports/audit-delta-*.md；部署前若只跑 pre_deploy，需另备 docs/audit/YYYY-MM-DD-*.md 或调整 Gate2 路径。
生产部署仍走 SSH + handoff，不依赖本 compose 默认密码。

DoD

len(H) == Closure
五文件全文 Read
local_verify 链路可复现

验证

bash scripts/local_verify.sh — 全绿

3.2 KiB Raw Blame History Unescape Escape