W0.1 .gitattributes theo CLASS (khong va theo duoi-file-vua-can):
- `* text=auto eol=lf` = san chung. core.autocrlf=true @system lat LF->CRLF luc checkout;
attr nay ep blob LF + worktree LF, DOC-LAP autocrlf.
- Khai binary TUONG-MINH 13 duoi (zip/exe/dll/docx/xlsx/pptx/pdf/png/jpg/jpeg/ico/woff/woff2)
thay vi pho-thac heuristic NUL-byte-8000-dau: .docx "gay" co the lot thanh text -> mangle
OOXML -> hong file KHONG cuu duoc. Do that: repo co 19 binary (12 docx + 6 png + 1 xlsx).
- .svg = XML -> CO Y giu text. Giu 2 rule cu (broadcasts/** + *.sh) tuong-minh.
- Fault-inject chung rule CO RANG: go `*.docx binary` -> git coi .docx la `text: auto` (nguy
hiem that); khoi phuc -> `text: unset`. 19/19 binary co attr/-text.
- Acceptance PASS: agents/reviewer.md unspecified -> text:auto eol:lf.
W0.2 scoped-only (vacuous, KHAI THAT):
- scope-gate (agents+commands+skills) = 0 DA XANH SAN truoc khi lam gi -> KHONG tinh la thanh-tuu.
- repo-wide 188 (131 Migrations + 57 con lai) = INFORM-only. CAM mass rm+checkout phien nay.
- `git add --renormalize --dry-run .` = 0 file dirty; `git diff --cached --stat` = rong.
W0.3 hook rebase-interlock (anh ky S119 fix#8b = TRONG KHUNG, khong can adap-request):
- wal-flush.ps1: `if (Test-Path .git/rebase-merge -or .git/rebase-apply) { exit 0 }`.
- Dat SAU Set-Location $root, KHONG phai dau file: dat truoc thi Test-Path soi nham CWD.
- Chung RANG 2 CHIEU tren cay tam: (a) khong rebase-state -> hook VAN commit (guard khong
over-fire, WAL persist con song); (b) co rebase-state -> 0 commit, exit 0, worktree GIU dirty.
- Pure-ASCII giu nguyen (gotcha #30). Do lai bang tr sau khi phat hien `grep -P` false-pass
(loi locale -> output rong -> wc -l dem 0 = grep CHET, khong phai sach).
FIX #3-bis (MOI, ghi vao v3-PATCH) - dieu-kien re nhanh W0.3 test SAI THU:
- v2:92 re nhanh bang `NONWAL==0`; luat fix#3(c) noi phai test "wal: o DAY range". Hai thu khac nhau.
- Fault-inject 4 cay tam chung diem re o ca2 (shape base|wal:|[CLAUDE], NONWAL=1, day=wal:):
v2 -> nhanh-B REBASE; v3bis -> reset--soft. Chay that nhanh-B tren ca2: REBASE-EXIT=0 KHONG
crash, nhung commit gop THUA KE message "wal: flush 1" -> push-guard n=1 -> chan push ->
re-squash cung logic -> van "wal:" -> STOP VINH VIEN. Deadlock XAC NHAN bang thuc nghiem.
- +ca(0) MOI v2/v3 khong liet: K=0 range RONG (S119 da push 4727d16) -> NO-OP commit thang.
- 4 ca: (0) K=0 NO-OP · (1) day=wal: NONWAL=0 · (2) day=wal: NONWAL>0 -> (1)+(2) CUNG xu-ly
reset--soft origin/main CAM rebase · (3) day=commit-thuong -> rebase+fixup OK.
- Ca fire hom nay = ca(0). Commit-chot nay dat day range = commit thuong -> moi wal: sinh sau
deu roi vao ca(3) an-toan. Dung y do fix#3(a).
WAL reconcile (/tiep S120): ground-truth thang WAL 3 cho - (1) 7 broadcast "UNTRACKED co y"
da tracked+pushed trong 4727d16, W0.3 khong con viec gop; (2) "K troi 10->11" -> thuc te K=0
range RONG; (3) fix#8 tick mau-thuan -> owner-decisions xac nhan DA KY, gate-blocker=0.
0 prod-code, 0 migration, 0 FE, 0 test-change.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Lo hong (reviewer S118 phat hien khi phan quyen PRO tra.bui): ReportsController chi co
[Authorize] tran (khong policy) -> MOI user dang nhap goi duoc GET /reports/dashboard (tong gia
tri HD dang chay, top NCC/du an theo gia tri, xu huong 12 thang) + GET /reports/contracts/export
(xuat toan bo HD ra Excel). Nguoc quyet dinh S92 "HD chi Admin thay" (menu an nhung API van mo,
go URL/API truc tiep lay duoc).
Fix (owner chot: chi Admin qua Reports.Read policy -- linh hoat mo role khac qua ma tran sau):
- Dashboard() + ExportContracts() -> them [Authorize(Policy = "Reports.Read")] per-method. Hien
chi Admin co Reports.Read -> non-admin 403. Admin bypass moi policy nhu cu.
- MyDashboard() GIU MO (chi [Authorize] class-level) -- scope theo currentUser, moi user chi thay
so cua CHINH MINH (draft/pending/SLA/gia tri draft cua minh), khong lo toan cong ty.
Test: +4 reflection authz regression (AuthorizePolicyRegressionTests, mirror gotcha #44 S45):
dashboard/export co Reports.Read; my-dashboard KHONG co action-policy (guard chong ai khoa nham
dashboard ca nhan). 505 -> 509. Gotcha #82 (menu-flag grant != quyen API that).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Van de (UAT anh Kiet FDC, S118): user tra.bui (Bui Le Thuy Tra, Procurement TP) dang nhap khong
thay menu quan ly NCC/Suppliers. Nguyen nhan: seeder S92 RevokeTemporarilyHiddenModulesAsync (chay
moi startup) set CanRead=false cho Master/Suppliers/Projects/Departments/Catalog* voi moi role
non-Admin ("chi Admin thay").
Fix (owner chot mo ngoai-le CHI role Procurement, ben qua deploy):
- Them SeedProcurementMasterAccessAsync chay NGAY SAU revoke de THANG (mirror pattern Hrm S65 /
Office S69). Chi dung role Procurement -- S92 "chi Admin thay" GIU NGUYEN cho moi role khac.
- Grant 9 key: Suppliers (R+C+U -- quan ly + cong bo NCC, S113 publish can Suppliers.Update);
Master/Projects/Departments/Catalogs + 4 Catalog leaf (Read-only). KHONG Delete.
- Dashboard/Reports CO Y KHONG cap (reviewer bat: Reports lo tong gia tri HD + top NCC/du an theo
gia tri, nguoc S92; owner chot bo).
- Upgrade-only idempotent: nang co desired len true, khong ha co, khong dung role khac.
Test: +4 regression scope-isolation (ProcurementMasterAccessSeedTests) -- Procurement duoc nang
dung ma tran, role khac (DeptManager rieng) VAN bi revoke. 501 -> 505.
Reviewer PASS (scope cach-ly sach, no over-grant). Grant tam da ap prod (tra.bui verified 20 menu);
deploy nay = ban ben. Follow-up: gate ReportsController thieu policy (task rieng).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Hai chỉnh từ buổi UAT anh Kiệt FDC (S117):
1) Fix hiển thị lũy kế "duyệt rồi không bắt" — root cause là DISPLAY-LIE, không phải
lũy kế bug. endsBeforeCeo cho phiếu CHƯA DaDuyet nay POINTER-AWARE: chỉ báo "kết
thúc trước CEO" khi con-trỏ còn ở/trước cấp finalize. Phiếu đã đi QUA cấp finalize
(approver bỏ tick "Cấp này KẾT THÚC" → trình tiếp CEO) → false: sơ đồ hết làm mờ
Bước CEO + hết nói dối "Kết thúc tại Cấp X" khi phiếu đang chờ CEO. 3 site (detail
in-memory + list/inbox EF-subquery). Filter lũy kế GIỮ nguyên (đúng nguyên tắc
"duyệt rồi mới bắc"). BE-only — FE là consumer thuần nên tự render đúng.
2) Feature "duyệt theo KHOẢNG Min–Max": khi PRO có cả Min & Max, người duyệt cấp cuối
chọn CẢ HAI (radio "PRO — cả Min và Max", source=ProMinMax) → Min ở ApprovedPriceAmount
+ Max ở ApprovedPriceMaxAmount (Mig 66 AddColumn nullable, no backfill, phiếu cũ
nguyên vẹn). Bất-biến Max⟺ProMinMax, Min≤Max (guard ở service + validator). HĐ.GiaTri
KHÔNG đọc giá chốt (= SUM báo giá NCC được chọn) → range thuần record-of-decision
hiển thị, 0 tác động HĐ. FE 2-app SHA-mirror (Panel + DetailTabs).
Test 495 → 501 (+1 pointer-aware repro, +5 ProMinMax). Cả 2 điều tra qua /fable-real
engine-đắt (investigator-codebase deep-pass) theo yêu cầu anh Kiệt.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Runtime-verify H-22 WAL session-continuity qua restart may that (S116):
/tiep no-op-detect + /session-end no-op-closeout PASS. Reviewer-gated
(return-garble #53 recovered via SendMessage-resume). Honest caveat:
WAL rong -> chi verify persist-file + no-op + idempotent, CHUA content-recovery.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
