W0.4 workflows/README.md - go claim STALE dang CHE San-1:
- Ban cu tuyen SE "tailored-out" khoi lop anti-bypass detector + coi mat-lach gan-nhu-khong-co.
BI BAC x3 BANG SU-KIEN (khong phai ly-le):
(i) S72 RECURRED: chay REVIEW qua raw Workflow tool -> khong inject writeGuard -> reviewer
tu ghi MEMORY +2850B over-cap -> git-status bat @session-end + revert. Nguyen-van
feedback_harness10_run_trace.md:20 "dung RAW Workflow tool = MAT governance project-wrapper".
(ii) S118 raw-Agent 7-spawn -> 0 run-folder (viec rot khoi so).
(iii) CHINH run S119 di raw Workflow tool.
- Ban moi khai 3 DUONG phong, chi 1 gate duoc: /ultra-on->hmw.js (gate) | raw Workflow (KHONG)
| raw Agent (KHONG). + khai KE CON-LAI: lach o SE KHONG can CLI-launcher, goi thang tool
harness la xong => 3 nguyen-tac detector (whitelist launcher / path-variant / anchor launch-key)
N/A VI KHONG CO LAUNCHER DE WHITELIST, khong phai vi "khong co ke". Containment THAT =
em-main single-writer + git-diff + chunk-count = PHAT-HIEN-SAU, KHONG NGAN-CHAN-TRUOC (G-015).
- Neu de nguyen claim cu: co "tailored-out" se (sai) bien-minh cho viec skip luon San-1 (F2 v1).
W0.5 baseline orphan - FIX#4 (bo mtime, dung git log %cI):
- Moc closeout cuoi = 3fde8af @ 2026-07-14T16:29:55+07.
- 3 phep do doi chung: naive(chi flat)=13 | dual-accept(+harvest/)=8 | dual+scoped(%cI>moc)=1={S119}.
- Khop CHINH XAC du-bao FIX#4 (13 / 8 / {S119}). Chenh 13-8 = 5 folder S71 h10/h910 dung
harvest/<stage>-synthesis.md -> KHONG duoc flag (C8 README:19). Chenh 8-1 = 7 ton-dong cu
-> loai bang SCOPE, KHONG tao *-synthesis.md gia (Goodhart, R3 flag).
- {S119} bi flag la DUNG: run chua dong, se dong o W6 khi co synthesis that.
- REGRESSED da va: v2 chot scope theo mtime; Dropbox resync GHI DE mtime => khong ben (R3-m5).
W0-evidence-15-07-2026.md - capture stdout THAT vao run-folder (fix #9c: bang-chung
time-anchored thay "reviewer chung-kien" lam neo duy-nhat). Gom: ground-truth /tiep 3 cho stale
+ W0.0-W0.5 so do + 2 fault-inject + nac trung-thuc.
2 LOI LEAD TU MAC o W0.4 (ghi vao evidence, di nguyen vao adap-report, KHONG im):
1. Gate tu-tham-chieu: lead trich NGUYEN-VAN claim cu lam bang-chung -> grep bat trung chinh
cau trich -> FAIL tren ban sua DUNG. Roi lead viet LITERAL mau regex cua gate vao ghi-chu
-> mau tu khop chinh no -> FAIL lan 2. => gate grep-chuoi chay tren chinh file no kiem =
TU-THAM-CHIEU, can neo bang dau-hieu khac. Cung ho R2-C1.
2. Meta-count tai-pham: bang tong-ket cua lead IN SAN chu "PASS" trong khi phep do ngay canh
tra "1 hit" = FAIL. Dung lop v3 §Nac-trung-thuc "lead DO tot; lead DEM VE CHINH MINH thi sai".
=> pass/fail phai TINH tu so do, cam in nhan cung. Da ap dung o lan do lai.
0 prod-code, 0 migration, 0 FE, 0 test-change.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
W0.1 .gitattributes theo CLASS (khong va theo duoi-file-vua-can):
- `* text=auto eol=lf` = san chung. core.autocrlf=true @system lat LF->CRLF luc checkout;
attr nay ep blob LF + worktree LF, DOC-LAP autocrlf.
- Khai binary TUONG-MINH 13 duoi (zip/exe/dll/docx/xlsx/pptx/pdf/png/jpg/jpeg/ico/woff/woff2)
thay vi pho-thac heuristic NUL-byte-8000-dau: .docx "gay" co the lot thanh text -> mangle
OOXML -> hong file KHONG cuu duoc. Do that: repo co 19 binary (12 docx + 6 png + 1 xlsx).
- .svg = XML -> CO Y giu text. Giu 2 rule cu (broadcasts/** + *.sh) tuong-minh.
- Fault-inject chung rule CO RANG: go `*.docx binary` -> git coi .docx la `text: auto` (nguy
hiem that); khoi phuc -> `text: unset`. 19/19 binary co attr/-text.
- Acceptance PASS: agents/reviewer.md unspecified -> text:auto eol:lf.
W0.2 scoped-only (vacuous, KHAI THAT):
- scope-gate (agents+commands+skills) = 0 DA XANH SAN truoc khi lam gi -> KHONG tinh la thanh-tuu.
- repo-wide 188 (131 Migrations + 57 con lai) = INFORM-only. CAM mass rm+checkout phien nay.
- `git add --renormalize --dry-run .` = 0 file dirty; `git diff --cached --stat` = rong.
W0.3 hook rebase-interlock (anh ky S119 fix#8b = TRONG KHUNG, khong can adap-request):
- wal-flush.ps1: `if (Test-Path .git/rebase-merge -or .git/rebase-apply) { exit 0 }`.
- Dat SAU Set-Location $root, KHONG phai dau file: dat truoc thi Test-Path soi nham CWD.
- Chung RANG 2 CHIEU tren cay tam: (a) khong rebase-state -> hook VAN commit (guard khong
over-fire, WAL persist con song); (b) co rebase-state -> 0 commit, exit 0, worktree GIU dirty.
- Pure-ASCII giu nguyen (gotcha #30). Do lai bang tr sau khi phat hien `grep -P` false-pass
(loi locale -> output rong -> wc -l dem 0 = grep CHET, khong phai sach).
FIX #3-bis (MOI, ghi vao v3-PATCH) - dieu-kien re nhanh W0.3 test SAI THU:
- v2:92 re nhanh bang `NONWAL==0`; luat fix#3(c) noi phai test "wal: o DAY range". Hai thu khac nhau.
- Fault-inject 4 cay tam chung diem re o ca2 (shape base|wal:|[CLAUDE], NONWAL=1, day=wal:):
v2 -> nhanh-B REBASE; v3bis -> reset--soft. Chay that nhanh-B tren ca2: REBASE-EXIT=0 KHONG
crash, nhung commit gop THUA KE message "wal: flush 1" -> push-guard n=1 -> chan push ->
re-squash cung logic -> van "wal:" -> STOP VINH VIEN. Deadlock XAC NHAN bang thuc nghiem.
- +ca(0) MOI v2/v3 khong liet: K=0 range RONG (S119 da push 4727d16) -> NO-OP commit thang.
- 4 ca: (0) K=0 NO-OP · (1) day=wal: NONWAL=0 · (2) day=wal: NONWAL>0 -> (1)+(2) CUNG xu-ly
reset--soft origin/main CAM rebase · (3) day=commit-thuong -> rebase+fixup OK.
- Ca fire hom nay = ca(0). Commit-chot nay dat day range = commit thuong -> moi wal: sinh sau
deu roi vao ca(3) an-toan. Dung y do fix#3(a).
WAL reconcile (/tiep S120): ground-truth thang WAL 3 cho - (1) 7 broadcast "UNTRACKED co y"
da tracked+pushed trong 4727d16, W0.3 khong con viec gop; (2) "K troi 10->11" -> thuc te K=0
range RONG; (3) fix#8 tick mau-thuan -> owner-decisions xac nhan DA KY, gate-blocker=0.
0 prod-code, 0 migration, 0 FE, 0 test-change.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Lo hong (reviewer S118 phat hien khi phan quyen PRO tra.bui): ReportsController chi co
[Authorize] tran (khong policy) -> MOI user dang nhap goi duoc GET /reports/dashboard (tong gia
tri HD dang chay, top NCC/du an theo gia tri, xu huong 12 thang) + GET /reports/contracts/export
(xuat toan bo HD ra Excel). Nguoc quyet dinh S92 "HD chi Admin thay" (menu an nhung API van mo,
go URL/API truc tiep lay duoc).
Fix (owner chot: chi Admin qua Reports.Read policy -- linh hoat mo role khac qua ma tran sau):
- Dashboard() + ExportContracts() -> them [Authorize(Policy = "Reports.Read")] per-method. Hien
chi Admin co Reports.Read -> non-admin 403. Admin bypass moi policy nhu cu.
- MyDashboard() GIU MO (chi [Authorize] class-level) -- scope theo currentUser, moi user chi thay
so cua CHINH MINH (draft/pending/SLA/gia tri draft cua minh), khong lo toan cong ty.
Test: +4 reflection authz regression (AuthorizePolicyRegressionTests, mirror gotcha #44 S45):
dashboard/export co Reports.Read; my-dashboard KHONG co action-policy (guard chong ai khoa nham
dashboard ca nhan). 505 -> 509. Gotcha #82 (menu-flag grant != quyen API that).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Van de (UAT anh Kiet FDC, S118): user tra.bui (Bui Le Thuy Tra, Procurement TP) dang nhap khong
thay menu quan ly NCC/Suppliers. Nguyen nhan: seeder S92 RevokeTemporarilyHiddenModulesAsync (chay
moi startup) set CanRead=false cho Master/Suppliers/Projects/Departments/Catalog* voi moi role
non-Admin ("chi Admin thay").
Fix (owner chot mo ngoai-le CHI role Procurement, ben qua deploy):
- Them SeedProcurementMasterAccessAsync chay NGAY SAU revoke de THANG (mirror pattern Hrm S65 /
Office S69). Chi dung role Procurement -- S92 "chi Admin thay" GIU NGUYEN cho moi role khac.
- Grant 9 key: Suppliers (R+C+U -- quan ly + cong bo NCC, S113 publish can Suppliers.Update);
Master/Projects/Departments/Catalogs + 4 Catalog leaf (Read-only). KHONG Delete.
- Dashboard/Reports CO Y KHONG cap (reviewer bat: Reports lo tong gia tri HD + top NCC/du an theo
gia tri, nguoc S92; owner chot bo).
- Upgrade-only idempotent: nang co desired len true, khong ha co, khong dung role khac.
Test: +4 regression scope-isolation (ProcurementMasterAccessSeedTests) -- Procurement duoc nang
dung ma tran, role khac (DeptManager rieng) VAN bi revoke. 501 -> 505.
Reviewer PASS (scope cach-ly sach, no over-grant). Grant tam da ap prod (tra.bui verified 20 menu);
deploy nay = ban ben. Follow-up: gate ReportsController thieu policy (task rieng).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Hai chỉnh từ buổi UAT anh Kiệt FDC (S117):
1) Fix hiển thị lũy kế "duyệt rồi không bắt" — root cause là DISPLAY-LIE, không phải
lũy kế bug. endsBeforeCeo cho phiếu CHƯA DaDuyet nay POINTER-AWARE: chỉ báo "kết
thúc trước CEO" khi con-trỏ còn ở/trước cấp finalize. Phiếu đã đi QUA cấp finalize
(approver bỏ tick "Cấp này KẾT THÚC" → trình tiếp CEO) → false: sơ đồ hết làm mờ
Bước CEO + hết nói dối "Kết thúc tại Cấp X" khi phiếu đang chờ CEO. 3 site (detail
in-memory + list/inbox EF-subquery). Filter lũy kế GIỮ nguyên (đúng nguyên tắc
"duyệt rồi mới bắc"). BE-only — FE là consumer thuần nên tự render đúng.
2) Feature "duyệt theo KHOẢNG Min–Max": khi PRO có cả Min & Max, người duyệt cấp cuối
chọn CẢ HAI (radio "PRO — cả Min và Max", source=ProMinMax) → Min ở ApprovedPriceAmount
+ Max ở ApprovedPriceMaxAmount (Mig 66 AddColumn nullable, no backfill, phiếu cũ
nguyên vẹn). Bất-biến Max⟺ProMinMax, Min≤Max (guard ở service + validator). HĐ.GiaTri
KHÔNG đọc giá chốt (= SUM báo giá NCC được chọn) → range thuần record-of-decision
hiển thị, 0 tác động HĐ. FE 2-app SHA-mirror (Panel + DetailTabs).
Test 495 → 501 (+1 pointer-aware repro, +5 ProMinMax). Cả 2 điều tra qua /fable-real
engine-đắt (investigator-codebase deep-pass) theo yêu cầu anh Kiệt.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Runtime-verify H-22 WAL session-continuity qua restart may that (S116):
/tiep no-op-detect + /session-end no-op-closeout PASS. Reviewer-gated
(return-garble #53 recovered via SendMessage-resume). Honest caveat:
WAL rong -> chi verify persist-file + no-op + idempotent, CHUA content-recovery.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
