[CLAUDE] Docs: chốt session 2026-04-23 — skill governance + cron audit

- Session log 2026-04-23-0900-skill-governance.md (A→E):
  khảo sát alirezarezvani/claude-skills + quyết định không bulk-clone,
  3 skill ops mới (dependency-audit-erp, ef-core-migration,
  iis-deploy-runbook), rules §9 + audit cadence cron 1/tháng,
  touch-points 6 file index
- STATUS: Recently Done 2 row mới (b904a25 governance + 661f859
  3 skill), header phase = "Tier 3 + skill governance",
  session log count → 12 file, link skills README.md
- HANDOFF: Last updated → 2026-04-23 09:30, TL;DR mention skill
  governance setup, table phase tier thêm row Skill governance ✅,
  Skills callout "PHẢI dùng khi task khớp" + audit cron next 2026-05-01,
  git state cập nhật 3 commit gần nhất

Cron task verified live qua list_scheduled_tasks: nextRunAt =
2026-05-01T02:05:48.000Z (jitter 348s).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/STATUS.md

@@ -2,9 +2,9 @@
 
 > **Update rule:** trước khi bắt đầu 1 task → ghi row vào `🔥 In Progress`. Xong → chuyển sang `✅ Recently Done`.
 
-**Last updated:** 2026-04-22 03:00 (post-Tier-3-feature-complete + versioned workflow)
+**Last updated:** 2026-04-23 09:30 (post-skill-governance + cron audit định kỳ)
 
-## 📍 Phase hiện tại: **Tier 3 feature-complete** — Prod live, tất cả module lớn xong. Còn: UAT thật + Email outbox (chờ SMTP) + rotate creds.
+## 📍 Phase hiện tại: **Tier 3 feature-complete + skill governance** — Prod live, 6 skill project-level + audit cron 1/tháng. Còn: UAT thật + Email outbox (chờ SMTP) + rotate creds.
 
 ### 🌐 Production URLs
 
@@ -16,12 +16,14 @@
 
 ## 🔥 In Progress
 
-_(không có — Tier 3 đóng gói xong, chờ UAT để quyết Tier 4)_
+_(không có — Tier 3 + skill governance đóng gói xong, chờ UAT + chờ cron audit fire 2026-05-01)_
 
 ## ✅ Recently Done (newest on top)
 
 | Ngày | Ai | Task | Commit |
 |---|---|---|---|
+| 2026-04-23 | Claude | **Skill governance + audit định kỳ** — `docs/rules.md §9` mới (6 skill bảng, nguyên tắc tạo project-specific, format SKILL.md bắt buộc, workflow audit 7 bước, 4 anti-patterns). Cron task `solution-erp-skill-audit-monthly` fire 9:00 AM ngày 1 mỗi tháng (next 2026-05-01) — self-contained prompt cold-start, auto-refresh stale nhỏ + đề xuất add/archive cho human approve, log vào `docs/changelog/skill-audit-{YYYY-MM}.md`, ABORT nếu repo dirty. Touch-points: CLAUDE.md callout + HANDOFF A1 + migration-todos checkbox + skill scope commit | `b904a25` |
+| 2026-04-23 | Claude | **3 skill ops project-specific** — Khảo sát alirezarezvani/claude-skills, quyết định KHÔNG bulk-clone (skill global đã cover phần generic, repo còn lại doc-dump không có when-to-use). Viết 3 skill mới encode SOLUTION_ERP-only: `dependency-audit-erp` (npm/dotnet CVE scan respect MediatR 12.4.1 + Swashbuckle 6.9.0 pin), `ef-core-migration` (8 migration history + 3-file rule + DesignTimeDbContextFactory + 6 pitfalls cụ thể), `iis-deploy-runbook` (3 IIS site + win-acme + NSSM gitea-runner + LibreOffice + debug playbook 500/502/SignalR). Total skill project-level = 6 (3 domain + 3 ops) | `661f859` |
 | 2026-04-22 | Claude | **PermissionsPage 3-panel layout** — Grid `lg:grid-cols-[280px_1fr_300px]`: Panel 1 Role list click-to-select (active ring-brand), Panel 2 Menu×CRUD matrix sticky thead + search + column bulk-toggle + brand-tinted hover, Panel 3 Granted progress bar + CRUD breakdown color badges (slate/emerald/amber/red) + Tip | `91b2da1` |
 | 2026-04-22 | Claude | **Admin Workflows tabs → sidebar menu items** — Seed 7 `Wf_<Code>` leaf dưới group `Workflows`. Layout resolvePath `Wf_<Code>` → `/system/workflows/<code>`. WorkflowsPage bỏ tab bar, URL param drives type selection. Landing 7-card grid khi click top-level `Quy trình HĐ`. Inheritance: `Workflows.Read` perm → tất cả 7 leaves auto-visible. | `f216169` |
 | 2026-04-22 | Claude | **Versioned workflow per ContractType** — 3 entity mới: WorkflowDefinition (Code+Version+IsActive+ContractType), WorkflowStep (Order+Phase+Name+SlaDays), WorkflowStepApprover (Role/User + AssignmentValue). Contract.WorkflowDefinitionId nullable FK pin tại create. Migration `AddVersionedWorkflows`. Seed v01 per 7 ContractType. `WorkflowPolicyRegistry.FromDefinition()` build runtime policy từ DB. ContractWorkflowService load pinned definition. Admin `/system/workflows/:typeCode` Designer modal (create new version, clone, add/remove step, +Role/+User approvers). POST /api/workflows auto-increment Version + deactivate old. Invariant: HĐ cũ pin v01 giữ nguyên khi v02 active. E2E verified: QT-MB-v02 active, HĐ cũ vẫn chạy v01. | `e7e5f2d` + `355bbe3` |
@@ -52,7 +54,7 @@ _(không có — Tier 3 đóng gói xong, chờ UAT để quyết Tier 4)_
 | 2026-04-21 | Claude | **Phase 1 foundation** + Docs addition | `702411f` + `49a5f57` |
 | 2026-04-21 | Claude | **Phase 0** | `25dad7f` |
 
-Session logs: [P0](changelog/sessions/2026-04-21-1045-phase0-scaffold.md) · [P1f](changelog/sessions/2026-04-21-1100-phase1-foundation.md) · [P1.2](changelog/sessions/2026-04-21-1130-phase1-cruds-permission.md) · [P2](changelog/sessions/2026-04-21-1200-phase2-form-engine.md) · [P3](changelog/sessions/2026-04-21-1330-phase3-workflow.md) · [P4](changelog/sessions/2026-04-21-1430-phase4-report.md) · [P5prep](changelog/sessions/2026-04-21-1530-phase5-prep.md) · [**Tier 3**](changelog/sessions/2026-04-22-0300-tier3-feature-complete.md)
+Session logs: [P0](changelog/sessions/2026-04-21-1045-phase0-scaffold.md) · [P1f](changelog/sessions/2026-04-21-1100-phase1-foundation.md) · [P1.2](changelog/sessions/2026-04-21-1130-phase1-cruds-permission.md) · [P2](changelog/sessions/2026-04-21-1200-phase2-form-engine.md) · [P3](changelog/sessions/2026-04-21-1330-phase3-workflow.md) · [P4](changelog/sessions/2026-04-21-1430-phase4-report.md) · [P5prep](changelog/sessions/2026-04-21-1530-phase5-prep.md) · [Tier 3](changelog/sessions/2026-04-22-0300-tier3-feature-complete.md) · [**Skill gov**](changelog/sessions/2026-04-23-0900-skill-governance.md)
 
 **Docs entry points:**
 
@@ -60,7 +62,8 @@ Session logs: [P0](changelog/sessions/2026-04-21-1045-phase0-scaffold.md) · [P1
 - [`workflow-contract.md`](workflow-contract.md) · [`forms-spec.md`](forms-spec.md)
 - [`database/database-guide.md`](database/database-guide.md) · [`database/schema-diagram.md`](database/schema-diagram.md)
 - [`flows/`](flows/) (7 file) · [`guides/`](guides/) (4 file) · [`gotchas.md`](gotchas.md)
-- [`changelog/migration-todos.md`](changelog/migration-todos.md) · [`changelog/sessions/`](changelog/sessions/) (8 file)
+- [`changelog/migration-todos.md`](changelog/migration-todos.md) · [`changelog/sessions/`](changelog/sessions/) (12 file)
+- [`.claude/skills/README.md`](../.claude/skills/README.md) — 6 skill (3 domain + 3 ops) · audit định kỳ 1/tháng (cron `solution-erp-skill-audit-monthly`)
 
 ## 🎯 Next up