# K3-BE: IN-PROGRESS — build · test · roster-live ?

> Sub: implementer-backend-0 (wave K3). Bat dau 2026-07-31.
> ARTIFACT chong #53 — ghi LIEN TUC tung muc, KHONG doi den cuoi.

## Trang thai khoi dong
- git branch: main, HEAD `0779f2d` ([CLAUDE] Contract: K2 SP-002 ... Mig 71)
- git status truoc khi minh Write: 12 M + 2 ?? (khong co file BE code nao dirty) — snapshot ghi o duoi.

```
 M .claude/WAL.md
 M .claude/agents/README.md
 M .claude/auto-memory/MEMORY.md
 M .claude/auto-memory/feedback_agent_return_garble_recover.md
 M .claude/commands/session-end.md
 M .claude/commands/session-start.md
 M .claude/governance/.session-counter.json
 M .claude/skills/README.md
 M .claude/skills/permission-matrix/SKILL.md
 M .claude/workflows/runs/2026-07-31-S164-4gd-khkk-fanout/sub-reviewer-gate-k2.md
 M CLAUDE.md
 M docs/governance/ctx-soft-memory-se-draft.md
?? .claude/auto-memory/feedback_may_rong_ui_hep.md
?? .claude/auto-memory/project_sol_ccm_sp002_signing_matrix.md
?? .claude/workflows/runs/2026-07-31-S164-4gd-khkk-fanout/sub-cicd-verify-k2.md
```

## Tick 0-8 (cap nhat dan)
- [x] 0. FAIL-CLOSED verify doi-hinh LIVE prod (OG-2) — **THAY: workflow LIVE ton tai** (chi tiet duoi)
- [ ] 1. Seed 8 workflow KHKK-N1..N8 type-10
- [ ] 2. Port nhanh LEVEL-FINALIZE vao ContractSigningPlanWorkflowService
- [ ] 3. Sweep ep-false va-3 (>=3 site BE)
- [ ] 4. Validator phieu-pin-dung-nhom (QD-3)
- [ ] 5. Seed AllowApproverFinalize=true cap CCM
- [ ] 6. MenuKeys +8 AwV2_KhkkN1..N8 + menu-row
- [ ] 7. Va-12 comment supersede-S155
- [ ] 8. build 0W/0E + test FULL (baseline 609)

---

# Muc 0 — FAIL-CLOSED verify doi-hinh LIVE (OG-2) — **PASS, workflow LIVE co that**

## Cach do (READ-ONLY, 0 ghi prod)
`ssh vietreport-vps` → `sqlcmd -S '.\SQLEXPRESS' -d SolutionErp -E` (integrated auth `-E`, KHONG cham password vrapp — khuon S147).
Nhan tieng Viet doc qua `CONVERT(varchar(N), CAST(col AS varbinary(N)), 2)` → hex → decode `utf-16-le` phia client
(khuon cicd-verify-dot2: sqlcmd mangle `Duy?t` khong phan biet duoc dau).

⚠️ 3 lech vs tai lieu, da tu sua khi do (khong bao "khong query duoc"):
1. De-bai ghi `QT-DN-V2-001` **type 3** → LIVE la **ApplicableType=1** (DuyetNcc). Type 3 = `QT-HD-V2-001` (HD). Doi-hinh dung van la QT-DN-V2-001.
2. Bang Identity ten **`Users`** khong phai `AspNetUsers` (rename Mig 1).
3. FK ten **`ApprovalWorkflowLevels.ApprovalWorkflowStepId`** khong phai `StepId`.

## Ban do LIVE — `QT-DN-V2-001` **Version 4** (IsActive=1)

Chung "khong phai archived": 3 version tren prod — v2 `IsActive=0`, v3 `IsActive=0`, **v4 `IsActive=1` + IsUserSelectable=1**.
```
QT-DN-V2-001|2|1|0|0
QT-DN-V2-001|3|1|0|0
QT-DN-V2-001|4|1|1|1     <- LIVE
```

### BANG ROSTER NGUYEN VAN (11 slot, decode tu hex)

| Ver | Buoc | Dept | Cap | Email | Fin | Skp | Bud | Ho ten (LIVE) | Chuc danh (LIVE) |
|---|---|---|---|---|---|---|---|---|---|
| 4 | 1 | PRO | 1 | `binh.lethanh@solutions.com.vn` | 0 | 0 | 1 | Binh Le Thanh | Nhân viên |
| 4 | 1 | PRO | 1 | `duy.nguyen@solutions.com.vn` | 0 | 0 | 1 | Nguyễn Văn Duy | Nhân viên Cung ứng |
| 4 | 1 | PRO | 1 | `long.chau@solutions.com.vn` | 0 | 0 | 1 | Châu Tạ Kim Long | Nhân viên Cung ứng |
| 4 | 1 | PRO | 1 | `phuong.nguyen@solutions.com.vn` | 0 | 0 | 1 | Nguyễn Thị Bích Phượng | Nhân viên Cung ứng |
| 4 | 1 | PRO | 2 | `tra.bui@solutions.com.vn` | 0 | 1 | 1 | Bùi Lê Thủy Trà | TP Cung ứng |
| 4 | 2 | CCM | 1 | `binh.le@solutions.com.vn` | 0 | 0 | 1 | Lê Văn Bình | Nhân viên Kiểm soát Chi phí |
| 4 | 2 | CCM | 1 | `luu.tran@solutions.com.vn` | 0 | 0 | 1 | Trần Xuân Lưu | Nhân viên Kiểm soát Chi phí |
| 4 | 2 | CCM | 1 | `nguyen.ho@solutions.com.vn` | 0 | 0 | 1 | Hồ Thị Nữ Nguyên | Nhân viên Kiểm soát Chi phí |
| 4 | 2 | CCM | 1 | `truong.letrandang@solutions.com.vn` | 0 | 0 | 1 | Lê Trần Đăng Trường | Nhân viên |
| 4 | 2 | CCM | 2 | `chuong.phan@solutions.com.vn` | **1** | 1 | 1 | Phan Văn Chương | TP Kiểm soát Chi phí |
| 4 | 3 | BOD | 1 | `truong.nguyen@solutions.com.vn` | 0 | 1 | 1 | Nguyễn Văn Trường | Tổng Giám đốc (CEO) |

⇒ Hinh dang = **PRO C1 OR-of-4 + C2 ×1 · CCM C1 OR-of-4 + C2 ×1 · BOD C1 ×1** — KHOP y nguyen K3.a nen.
⇒ `AllowApproverFinalize=1` **DA CO SAN tren prod** dung o chuong.phan (CCM C2) — tien le song, khong phai co-che moi.
⇒ Ten Buoc tren LIVE la "Phòng 1/2/3" (nhat nheo); K3.a nen dat ten mo-ta ("Phòng Cung ứng"/"Phòng KSCP"/"Ban Giám đốc") — **ten = display-only, danh tinh = Dept + ApproverUserId** ⇒ dung ten nen, khai lech o day.

## VA-11 — DO DANH TINH 2 CAP GAN-TRUNG: **CA 2 DEU LA TRUNG-TAI-KHOAN THAT tren prod**

Phat hien nang: **prod co 2 tai khoan cho CUNG 1 nguoi**, va **workflow LIVE dung tai khoan TAO TAY, khong phai tai khoan seeder**.

| Cap | Tai khoan A (DbInitializer seed) | Tai khoan B (tao tay tren prod) | LIVE workflow dung | Phan giai |
|---|---|---|---|---|
| PRO "Thanh/Bình" | `thanh.lethanh@` — PRO — "Lê Thanh Bình" — *Nhân viên Cung ứng* (`DbInitializer.cs:1617`) | `binh.lethanh@` — PRO — "Binh Le Thanh" (**khong dau**) — *Nhân viên* | **B `binh.lethanh@`** | Cung dept PRO, cung nguoi; chuc danh khac ("Cung ứng" vs tran). Phan giai bang **bang LIVE**: slot Buoc1/Cap1 tro toi B. |
| CCM "Trưởng" | `truong.le@` — CCM — "Lê Trần Đăng Trường" — *Nhân viên Kiểm soát Chi phí* (`DbInitializer.cs:1626`) | `truong.letrandang@` — CCM — "Lê Trần Đăng Trường" (**ten y het**) — *Nhân viên* | **B `truong.letrandang@`** | Ten TRUNG KHIT ⇒ khong the match bang ten. Phan giai bang **bang LIVE**: slot Buoc2/Cap1 tro toi B. |

3 ung vien nhieu loan da loai dut khoat bang **dept**:
- `tring.le@` = "Lê Tự Đăng Trình" (CCM) — **nguoi KHAC han**, KHONG co trong workflow LIVE ⇒ loai.
- `truong.nguyen@` = "Nguyễn Văn Trường" (**BOD**, CEO) — o Buoc 3, khong phai CCM ⇒ khong nham voi `truong.le*`.
- `binh.le@` = "Lê Văn Bình" (**CCM**) vs `binh.lethanh@` (**PRO**) — tach bang dept, ca 2 DEU trong roster nhung khac buoc.

Kiem ton tai + active (prod): **11/11 email = IsActive 1**. 3 dept `PRO`/`CCM`/`BOD` deu `IsDeleted=0`.

### 🔴 QUYET-DINH ky thuat rut ra (khai de owner soi)
Seeder **KHONG the hardcode 1 email duy nhat/slot**: email LIVE (`binh.lethanh@`, `truong.letrandang@`) **khong ton tai tren Dev/local/test** (DbInitializer chi tao `thanh.lethanh@`/`truong.le@`) ⇒ seed se fail-soft bo qua toan bo, Dev 0 workflow.
⇒ Dung **chuoi uu-tien alias/slot**: thu email LIVE TRUOC, khong co thi lui ve email seeder. Prod → khop dung nguoi dang duyet that; Dev/test → khop tai khoan seeder. Ca 2 vang mat moi fail-soft. Moi lan dung alias-du-phong deu `LogWarning` neu ro → co dau vet.
⚠️ Day KHONG phai quyet dinh danh-tinh moi: uu tien 1 = **dung nguoi tren ban LIVE** (OG-2). Chi la duong lui cho moi truong khong co ban sao tay.
⚠️ De-xuat cho owner (NGOAI pham vi wave nay, khong tu lam): don trung 2 cap tai khoan tren prod (vo hieu 1 ben) — hien 1 nguoi 2 tai khoan la nguon nham lan that.

## Muc 0 — VERDICT
**PASS** — workflow LIVE `QT-DN-V2-001` v4 ton tai (IsActive=1, khong archived), roster 11 slot ghi nguyen van o tren,
2 cap gan-trung phan giai xong bang dept + chuc danh + vi tri slot tren ban LIVE. **Duoc phep seed.**
Doi chung nen: prod hien **0** workflow `ApplicableType=10`, **0** Code `KHKK-N%` ⇒ seed lan dau se tao dung 8.

---
