Anh chot 4 viec governance. Detector 46->45 = DOI THANH-PHAN (-2 duong-gia
+1 duong-THAT), khong phai "flag giam". Mark moi RC-pqhuy1987-15-07-2026-17-23-10.
- backtick-guard H24-1: discriminator = ENCLOSURE (use vs mention), KHONG port
duoc charset-guard cua H24-2 vi vi-du byte-identical voi claim. Helper DUY-NHAT
Test-Quoted. Fault-inject 5/5 (2 anti-Goodhart).
- H24-3 session-label lag (MED, moi): va am-gia CHUNG-MINH-DUOC cua H24-1
(so NGAY ma ngay = moi nhat => 0 flag trong khi nhan lui 3 phien; tai-phat lan 4).
Fault-inject 6/6 + 6/6 sau fix.
- DUAL-ACCEPT (dang-3 RETIRED) + LUAT RETIRE LEGACY: go nhanh legacy khi tap
di-san RONG, giu khi CON nguoi thu-huong. Repo that 0 orphan/26. Fault-inject 7/7.
- tiep.md:66 stale-at-birth + sweep view-residual-asym 6/6 be-mat LUAT sach.
Reviewer PASS_WITH_FIXES bat 6 loi that, lead verify 4/4 doc-lap:
gen-2 citation-trap (lead viet 30 dong chung-minh dinh-luat roi de H24-3 KHONG
guard) - greedy .* lay CUOI khong phai MAX - ly-do retire ap cho dang-2 thi giet
C8 - "retire HOAN-THANH mark" = nguy-bien - "5/5" = 4/4.
Goodhart DO DUOC (ngoai diff): W4/S122 "va" permission-matrix:16 bang doi FORMAT
anchor => khop 0 pattern => H24-1 mat chinh positive-control no dung quanh;
flag-count GIAM nen trong nhu thanh-cong.
Outward: addendum R5 (DUNG adopt TRI-ACCEPT) + email hub ed3786a10f12
(selftest-stamp MATCH x2). _index reconcile: 2 email S122 gui ma chua log.
#53 garble x4/3 agent - harvest-curator ghi diary TRONG luc lam nen vot duoc tu
dia ngay; reviewer tu rut luat "ghi diary TRUOC return" tu garble-1 va nho dung
no ma garble-2 vot duoc. Prompt-dung KHONG chan duoc #53.
Lead sai 4 ca tron o truc dem-ve-minh: "25"!=26 - "5/5"!=4/4 - viet "7/7 PASS"
TRUOC khi chay - "0 proxy" sai.
State GIU NGUYEN: Mig 66 - 89 bang - 509 test - gotcha 82 - menu 54.
Con no: STATUS:6 CO Y chua bump (H24-3 dang FLAG, giu cho hien ra).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
PHIEN GOVERNANCE-ONLY: 0 prod-code, 0 mig, 0 FE => test 509 GIU (Phase 3.1 = N/A).
SAN-2 sentinel: dat @BUOC 0 (truoc moi flush) -> xoa @6.4 => RUNTIME-VERIFIED lan dau.
SAN-5 hau-kiem: chay THAT lan dau va TU BAT 3 BUG CUA CHINH NO (bug lead viet @W3):
(1) do sai COT: `git log -1 --format=%cI` = commit CUOI cham folder => bat "folder bi SUA
phien nay" thay vi "folder duoc TAO phien nay". Do that: S112-pe-signoff-close-review
(tao 07-12) tra ve 07-15 vi W3.0 vua them synthesis => 9/9 DUONG-GIA. Dung = `| tail -1`.
(2) soi sai CHO (nang hon, loi CAU-TRUC): chi grep WAL. Nhung WAL = so ghi-de <=40 dong VA
marker wf: bi xoa NGAY khi viec xong ([!]wf: -> [x]XONG). San-5 chay CUOI phien => luc do
marker DA BIEN MAT => soi mot so tam dang co lai de tim dau von thiet-ke de xoa di
=> KHONG THE dung. Spec v1:120 DA ghi "WAL/session-log" -- lead ROT nua sau ngay khi
viet chinh muc do. => session-log = append-only = cho dau BEN nam.
(3) BAY `grep -c` DINH LAN THU BA CUNG PHIEN: `|| echo 0` => grep in "0" VA exit 1 => echo
ban them => "0\n0" => syntax error. Lead DA ghi bay nay vao §5.0(a) VA gui hub R2(β)
-- cung phien -- roi VAN viet `|| echo 0`. Dung = `|| true`.
=> sau va: 1 run sinh phien nay, LECH=1 = TRUE-POSITIVE (marker thieu o session-log)
=> dong bang dong `wf:` trong session-log => LECH=0. Acceptance DAT.
🔸 San-5 sai duoc 3 lan VI no `informational` -- neu la cong-chan thi 9 duong-gia da chan
ca phien va nguoi se bypass ngay lan dau (dung cong-thuc R2 vua gui hub).
H24 counter: TICK dau tien 0->1, content-addressed neo HEAD-sha 2f068c5. Seed UNTICKED trung-thuc
giu duoc y nghia: counter=1 la THAT, khong phai so bia. light 1/6 · deep 1/15 · OVERDUE none
=> nhip audit dau tien ~S128. 2 vai H24 VAN CHUA CHAY lan nao.
RE-STAMP carry (§L.b(j)(iv), nghi-thuc moi lan dau ap):
truoc S122: 7 carry x 1 occurrence => streak≡1 => 0 fire VINH VIEN (45 logic-segment ma
carry-lines=1). Sau re-stamp: 6 carry con mo = 2 occurrence (seg S119 + seg S122) => streak
BAT DAU DEM DUOC. +2 carry moi (usermem-outside-repo, hook-vs-budget-cap, h23-precedence-fable).
carry s119-wave DONG (wave xong) -- 🔴 CO Y BO tag [carry:...]: tag = "dang MO"; giu tag tren
carry da dong => detector dem streak tuong no dang gia di => duong-gia. Lead suyt mac, tu bat.
🔴 Khai thang: carry mo TRUOC S122 co tuoi DO-THIEU (§Q3 no-retrofit).
Flush agent-memory: investigator-codebase +1 entry (7 lane retro-harvest, 6/6 neo SHA that
0 garble). 3 ky-thuat lane dang tai-dung ghi lai: do ordinal migration bang sorted-listing
(khong tin nhan doc) · phan-biet hash-lech vs invariant-vo · truy owner-decision VAO CODE.
19630 -> 22871 B (< autoinject cap 25600, < soft cap 30720 => KHONG curate).
🟡 XUNG-DOT khai de anh chot: PostToolUse hook doi nen MEMORY.md xuong 17.1KB, nhung
memory-budget.json (SO ANH DAT) = autoinject 25600 / soft 30720 + "DO NOT auto-reduce
(role_boundary_note + mark RC-...01-58-01: token-saving = forgetting work)". Hien 22871 B
= DUOI ca 2 cap => em KHONG tu nen, cho anh chot. [carry:hook-vs-budget-cap]
User-Mark CHOT: 8 Active-High (6 cu + 2 ky hom nay) · 0 Active · 0 Medium · 1 superseded (AN, P7).
Hot-feed cuoi phien: 325K/380K = 85.5% nap | headroom 14.5% (WIP 31.1 · loi-lap 24.2 ·
ton-dong 19.5 · quyet-dinh-cho 10.8). con-so = quyen anh.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
OWNER-RAISED: lead dang va TRIEU-CHUNG (hardcode $userMemDir) thi anh chi ra GOC:
"UserMem phai ghi trong thu-muc du-an chu ko phai o C: -- cai nay lau lau drift dinh mai".
DO DUOC:
| user-memory C:\Users\<u>\.claude\projects\<slug>\memory\ | 48 file · 151,671 B | 0 git | 0 Dropbox | 0 history
| agent-memory <repo>/.claude/agent-memory/ | 82 file tracked | git | Dropbox | history
=> BAT-DOI-XUNG khong co ly-do ky-thuat nao.
RUI-RO THAT (khong phai chuyen gon-gang):
bug #53 zero-byte Write -- da MAT INDEX THAT o S45 -- xay ra DUNG tai thu-muc
KHONG CO HISTORY de phuc-hoi. Cung bug do o agent-memory => git checkout la xong.
=> lop phong-thu hien tai = "verify byte>0" = KY-LUAT NGUOI dung thay VERSION-CONTROL.
settings.json (project + user) = 0 key cau-hinh memory-path => HARNESS EP.
SE CO Y KHONG TU DOI: doi tay => harness thoi auto-inject => MAT memory khoi context
= hong nang hon bug dang co. Cho hub tra loi 1 cau: doi duoc khong, va neu khong thi vi sao?
SE KHONG ket-luan "harness sai" -- co the co ly-do dung ma SE chua thay (secret?
cross-project? per-machine?). SE chi ket-luan: rui-ro la THAT va DO DUOC.
HARDCODE = HE-QUA PHU, do chinh xac:
sinh e70c046 2026-06-18 20:44 -> va c39ba9d 2026-07-15 15:12 = SONG 27 NGAY.
Co-che KHONG phai "tai-pham nhieu lan" ma la "sinh 1 lan roi SONG SOT qua ra":
git log -S bat 8 commit nhung 5/8 co ps1/js-touched=0 (chi doc/WAL NHAC toi path);
chi 3 dong vao .ps1/.js that -- va 1 trong do la ae957c4 "double-check x2 + finalize":
mot dot DOUBLE-CHECK da so DUNG FILE do va KHONG BAT DUOC.
🟢 Doi-chung: spawn-model-audit.ps1 (W1, HOM NAY) lam DUNG san + tu ghi-chu
"NOT a hardcoded absolute path" => fleet BIET cach dung; thieu LUAT nen file cu khong ai quet.
DE-XUAT: (1) memory song trong repo (doi-xung agent-memory) (2) hoac config path
(3) hoac toi-thieu document ro "khong duoc version-control, project tu lo backup"
+ doc-lap: (4) luat no-absolute-path (spawn-model-audit = mau san) (5) khao-sat fleet.
2 LOI LEAD ghi vao request (du-lieu ve quy-trinh, khong phai loi xin loi):
(a) va trieu-chung khong hoi goc -- feedback_root_cause_over_symptom DA nam trong
memory cua lead ma lead khong tu bat ra; anh phai chi.
(b) va dung cai duoc chi, khong quet cai khac -- WAL:30 neu 1 script, lead va roi DUNG;
anh hoi moi loi ra script thu 2 cung doc user-memory. Thoat vi MAY, khong vi quy-trinh.
Email: broadcasts/outbox/ai_infra/2026-07-15-se-to-ai_infra-r6-user-memory-outside-repo.md
content_sha256 d204973b0a2358fb19da2b7a3f24431ccf7c70e1c33c2df1af41ff7caf1c31b7
SELFTEST-STAMP PASS. (KHONG sua email cu -- no da dong hash; sua = pha selftest.)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
W5a -- harness-11-engine.md: 4 hit roster -> 0 occurrence (do bang grep -o|wc -l, KHONG grep -c).
:269 "12 sub tools:" -> "sub read-only tools:"
:322 "MOI vai roster 12" -> "MOI vai trong roster hien-hanh" + tro canonical
:332 GAP-1 "nhan ca 12 vai" -> "nhan TOAN roster" + lich-su 9->12->14 + tro canonical
:345 x2 -- BAY MEGA-LINE: sua phan "(i) Vai owner-gan" roi VAN con "VALID_ROLES = 12"
o doan SAU cua CHINH DONG DO. Sua 1 cho tuong xong = dung bay grep -c da ghi WAL 2 lan.
+ danh-sach vai khai ro la BAN SAO; nguon that = hmw.js VALID_ROLES :22-36; lech => tin hmw.js.
W5b -- scripts/governance-detectors.ps1:363 bug $userMemDir:
TRUOC: $userMemDir = 'C:\Users\pqhuy\.claude\projects\D--Dropbox-...\memory'
...nam NGAY DUOI comment ghi "Derive from this machine's project slug".
=> Comment mo-ta Y DINH; code hardcode ca path tuyet-doi LAN username. Loi noi doi
nam ngay canh dong no noi doi ve.
2 HAI CU-THE (khong phai style):
1) -RepoRoot <cay-tam> VAN doc user-memory THAT => fault-inject KHONG co lap duoc
=> teeth-test C1-wikilink bat-kha-thi => cong-cu dung de CHUNG-MINH-CO-RANG
lai khong co rang cua chinh no.
2) hardcode 'pqhuy' => may/acc khac se im lang roi xuong else-branch, va mot su
degrade IM LANG doc y het "sach".
SAU: $projectSlug = $RepoRoot -replace '[:\/_]', '-'
$userMemDir = Join-Path $env:USERPROFILE ".claude\projects\$projectSlug\memory"
VERIFY 2 CHIEU (do that, khong suy):
- slug derive tu RepoRoot that == literal hardcode cu, KHOP 100%; Test-Path = True
=> hanh-vi KHONG doi (TOTAL van 45, user-memory van duoc quet)
- -RepoRoot cay-tam => slug khac => "[note] user-memory path not reachable (...fake-repo\memory)"
=> CO LAP; ro path THAT = 0 hit.
SWEEP CUOI toan repo: 8 hit / 6 file, 0 cai thuoc nhom "doc dan-xuat khai so roster SAI
nhu su-that hien-hanh" => acceptance MOI FIX#6 DAT; nhom "chua toi luot" nay RONG sau W5.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
FILE 4 fable-clone.md -- GAP#6: lane ensemble PHAI mang tier:'opus'.
Thieu => inherit lead => lead=Fable thanh N x Fable = dot quota gap N lan VA pha dung
ly-do lenh ton tai (ensemble RE de THAY 1 luot Fable dat). lead=Opus thi tier:'opus'
≡ inherit => loi VO HINH, chi lo khi Fable UP (dung loi reviewer bat @S108).
+ khai CHUA VERIFY precedence spawn-param vs frontmatter (H23 §2(2)) => DEFER phien lead=Fable.
+ grep tier:'opus' = DIEU-KIEN CAN, KHONG DU (do CHU trong file, Goodhart-able 100%).
FILE 5 agents/README.md -- bo SO khoi 8 cho (khong doi so: doi thi roster ke lai stale).
File nay chinh la VI-DU minh-hoa cho class view-stale-role-desc trong lead-view-auditor.md:47.
+ canh-bao bay glob: `ls .claude/agents/*.md` bat LUON README.md => thua 1 (R2-C1).
+ khai: doi roster = doi 2 BE-MAT DOC-LAP (agents/*.md -> registry | VALID_ROLES -> agentType).
FILE 6 fable-real-runbook.md -- 14 hit (lead bao 8 = SAI, xem duoi). + hmw.js:22-30 -> :22-36 (stale line-ref).
FILE 7 sleep-recovery-memory-l2.md -- `all` tu hardcode 9 -> DAN-XUAT TU DIA (do ra 10).
Danh-sach cung 9 da ROT office-document (them S107) suot tu do. Tro-treu: chinh doc do
da ghi "luon quet dia that" cho con-so 4/9 ngay duoi, nhung hardcode roster phia tren.
FILE 8 workflows/README.md -- TRI-ACCEPT vao ORPHAN-AUTHORITY (:19-20) + B1 pointer.
FILE 9 ACTIVE-MARKS.md -- chu-thich cho mark RC-...20-42-01 (anh CHOT: giu ban ky nguyen ven,
them chu-thich; P4/P8). "roster 12" trong than mark = anh chup luc ky, KHONG phai gioi-han.
+ STATUS.md:25 -- STALE THAT trong chinh file CANONICAL: row ghi | Sub-agents | 14 | nhung
narrative CUNG DONG ghi "ca 12 sub model: inherit" (W2 sua row, bo sot narrative).
Bay mega-line TAI HIEN: grep -c = 1 vs grep -o|wc -l = 2.
+ spec v3-PATCH -- SUA ACCEPTANCE FIX#6 (ban goc BAT-KHA-THI, tien-le WAL:29):
"0 hit song" do CA phan CO Y khop => implementation DUNG van truot. Lan thu BA cung ho
R2-C1 (ls=14) + R3-M3 (TOTAL>=46). Acceptance moi = disposition TUNG DONG theo 6 nhom.
Sweep that sau W3: 14 hit song, 0 cai la stale-can-va (vi-du co chu-dich / trich lich-su /
ban da ky / so tam / W5 chua toi luot / canonical history-delta).
LEAD TU BAT 2 LOI DEM (deu o truc dem-ve-viec-minh, -> adap-report):
(a) bao "fable-real-runbook 8 hit" -- that la 14; lay output `head -40` DA BI CAT lam so tong.
(b) bao "do lai tai-hien CHINH XAC du-bao FIX#4" roi lay trung-khop lam cho dua, trong khi
CA FIX#4 LAN LEAD deu dang do TEN FILE. Con-so dung, huong do sai.
=> khop feedback_meta_count_selfcoverage_blindspot: lead DO tot, lead DEM VE MINH thi sai.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Wave adap-6-broadcast W2 = 1 OWNER / 1 COMMIT co chu dich. Cac manh phu-thuoc nhau, tach ra la vo
duong dang chay (R2-C3): gate o W2 ma co o W3 => moi /fable-clone >=3 lane THROW ngay truoc khi W3 kip va.
(1) hmw.js - 1 EDIT, 4 viec
- SAN-1 GATE co-khi-hoa: taskList>=3 && !args.run => THROW STOP-HARD.
Truoc S121 san nay chi la CHU trong doc ("script no-fs KHONG tu ep") => phu thuoc lead NHO.
Do that @S119: git grep args.run .claude/commands/ = 0 hit => 4/4 wrapper KHONG co => san danh-nghia.
Vi sao >=3: chet giua run dai ma khong co runs/<run-id>/ => per-turn returns mat theo phien,
CHI file tren dia song sot => /tiep §4 khong co vat-lieu cat-got => chay lai TU DAU (S118
raw-Agent 7-spawn => 0 run-folder). THROW chu khong fail-soft (fail-soft = dut am-tham).
- VALID_ROLES 12->14 (+lead-view-auditor +lead-omission-auditor).
- PA-2a: TIER2_EXPECTED_FULL_ID = 'claude-opus-4-8'. La HANG-SO KHAI-BAO, KHONG phai co-che neo
(neo-tai-spawn bat-kha-thi: param chi nhan alias; SE 0 full-id vi H8 all-inherit). Doc boi
scripts/spawn-model-audit.ps1 (W1b) - thieu hang-so => script FAIL-LOUD.
- H23 note CHUA-VERIFY giu nguyen nac: precedence spawn-param vs frontmatter khi CA HAI hien-dien
= CHUA TUNG TEST; phan-biet duoc CHI o phien lead=Fable => DEFER, khong ban qua nac. + fix#8a chua thu.
(2) 4 co wrapper CUNG COMMIT voi gate (San-1 (c))
fable-clone.md / fable-real.md / ultra-on.md => args.run: 0 -> 3 hit.
Wrapper thu 4 = raw-invoke em-main: KHONG co file de gan co => duoc GATE chan truc tiep
(chinh cu fault-inject duoi day di duong do). Khai that: gate chi phu hmw.js; nguong "hoac uoc
>5 phut" KHONG co-khi-hoa duoc (script khong do truoc thoi-luong) => van la ky-luat lead;
raw Workflow/Agent tool = ke CON-LAI khong gate duoc.
+ go so roster stale (view-stale-role-desc): "roster 12"/"12 sub"/"8-agent"/"9-agent" -> tro
canonical docs/STATUS.md §Sub-agents (B1). session-start.md con "roster 12" = W3 so-huu, KHONG dung.
(3) 2 vai MOI - H24 §2(1), cookie-cutter frontmatter monitor san
lead-view-auditor = view LECH source (5 class view-*)
lead-omission-auditor = cai BI THIEU (5 class gap-*)
model:inherit / memory:project / maxTurns:18 / 8 tool read-only / NO Write-Edit / propose-only.
KHONG gop vao tooling-auditor(H1)/harvest-curator(H2): H24 "gop la mat tieu-diem; can cap mat
CHI danh cho lead". Tu-vung view/omission chon tranh va-cham (detectors:15 da so-huu
derived-staleness; GAP qua-tai). 2 file 0-CR + block-scalar (giu ': ' N/A).
(4) memory-budget.json - single-source H24 §2(3)
h24_cadence { light_every:6, deep_every:15, jump_on_class_repeat:3 } (anh chot Q2).
lead_self_audit.flag_classes = enum DONG 10 class (5 view-* + 5 gap-*) - vai CAM tu che class
(v2 M4: enum song trong dau 1 lane => worker khong bao gio thay => tu che => loang thong-ke).
Honest-caveat giu de bao hub: hub dan "dung chep 3 con-so nay"; SE chon trung 6/15/3 = anh chot
CO CHU-DICH lam khoi-diem, KHONG phai chep vo-thuc; re-tune sau chu-ky-2.
(5) .claude/governance/.session-counter.json (NEW) - seed UNTICKED trung thuc
Content-based (idempotent-key = HEAD sha), KHONG blind-increment: hook wal-flush auto-commit
agent-memory/ MOI TURN => dem mu se vo nghia. Dat o .claude/governance/ CO CHU-DICH = ngoai
3 path hook (.claude/WAL.md, agent-memory/, workflows/runs/) => khong bi quet vao commit wal:.
counter=0 + last_ticked_*=null = SU THAT tai S121 (nghi-thuc tick land o W3); seed tick gia
se lam phep do cadence dau tien noi doi - dung thu H24 sinh ra de bat.
(6) STATUS.md 2 row - CUNG LANDING roster (R3-M2: lech => detector BAO tren chinh thay doi cua H24)
| Sub-agents | 12 -> 14 |
| Policies | 216 | ROW MOI - GAP-3 can no de resolve token 'policy'.
216 GROUND TU MA NGUON, khong chep tu spec: |MenuKeys.All| x |MenuKeys.Actions| = 54 x 4
(Program.cs:82-89 AddPolicy loop; MenuKeys.cs:167 Actions=[Read,Create,Update,Delete]).
=> Policies la DERIVED = Menu keys x 4 => 2 row BUOC doi cung nhau (ghi thang vao row).
VERIFY LEAD TU DO (khong tin return):
14/14/14 (roster / VALID_ROLES / agents-*.md tru README) = acceptance ② EOL.
Glob tho = 15 => xac nhan R2-C1: acceptance CU "ls agents/*.md = 14" se FAIL tren impl DUNG.
Hop-dong cheo W1<->W2 khep CA HAI chieu, do bang chinh script W1:
detector H24-2: "h24_cadence missing" -> "M = h24_cadence.light_every = 6 (read from config)"
spawn-model-audit: "expected constant missing" -> "[OK] expected = claude-opus-4-8 = owner-ratified"
GAP-3 policy: MISSING -> 216, va BAT NGAY permission-matrix/SKILL.md:3 "writes 240 policy but
canonical=216" (+:81 "writes 48") => TOTAL 49->50 (-1 fail-loud cadence, +2 policy) = so cong khop.
eol-check tu nhan 2 vai moi: scoped 37->39 (dem bang glob, khong hardcode).
FAULT-INJECT SAN-1 2 CHIEU (bai hoc W0.3: chi test 1 chieu thi dieu-kien viet nham van PASS):
(b) 3 task + KHONG args.run -> THROW, agent_count=0, subagent_tokens=0, 14ms (chan TRUOC spawn)
(a) 2 task + KHONG args.run -> gate IM, workflow launch binh thuong => khong over-fire, nguong
dung la >=3. Neu viet nham `if (!wave)` thieu nguong thi /fable-real 1-lane se chet oan.
CHUA VERIFY (khai that, KHONG gia vo):
14/14 spawn-probe SONG = PHAI chay SAU RESTART (registry = anh-chup khoi-phien; S120+S121 da do
2 lan xac nhan KHONG hot-reload agent MOI). Static-check KHONG du (broadcast ④d).
=> 2 vai moi hom nay moi chi TON TAI tren dia + trong VALID_ROLES, chua chung duoc SPAWN duoc.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Lo hong (reviewer S118 phat hien khi phan quyen PRO tra.bui): ReportsController chi co
[Authorize] tran (khong policy) -> MOI user dang nhap goi duoc GET /reports/dashboard (tong gia
tri HD dang chay, top NCC/du an theo gia tri, xu huong 12 thang) + GET /reports/contracts/export
(xuat toan bo HD ra Excel). Nguoc quyet dinh S92 "HD chi Admin thay" (menu an nhung API van mo,
go URL/API truc tiep lay duoc).
Fix (owner chot: chi Admin qua Reports.Read policy -- linh hoat mo role khac qua ma tran sau):
- Dashboard() + ExportContracts() -> them [Authorize(Policy = "Reports.Read")] per-method. Hien
chi Admin co Reports.Read -> non-admin 403. Admin bypass moi policy nhu cu.
- MyDashboard() GIU MO (chi [Authorize] class-level) -- scope theo currentUser, moi user chi thay
so cua CHINH MINH (draft/pending/SLA/gia tri draft cua minh), khong lo toan cong ty.
Test: +4 reflection authz regression (AuthorizePolicyRegressionTests, mirror gotcha #44 S45):
dashboard/export co Reports.Read; my-dashboard KHONG co action-policy (guard chong ai khoa nham
dashboard ca nhan). 505 -> 509. Gotcha #82 (menu-flag grant != quyen API that).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
