vietreport-admin/solution-erp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
010d12c5f87ba07898ead7efda2ed4fa7b1d713f
solution-erp/.claude/agent-memory/reviewer/MEMORY.md
pqhuy1987 010d12c5f8 [CLAUDE] Docs: S125 adap tien-de-vong4 — relabel token CAN-TREN + hash-verify byte-safe + dinh-chinh hub + fable-real review/invest checklist 
- adap broadcast phuong-phap-dem-token (type:new): negative-control tai lap 3-probe (notice-N = heuristic char-dem, KHONG phai token that) -> relabel STATUS:41 + HANDOFF:5 x2 + do-token report ADDENDUM (dai [31K byte/4 - 70,9K notice] => lead-share [8,2-18,7]%)
- false-TAMPER RCA: PS5.1 Get-Content -Raw doc UTF-8-no-BOM bang ANSI -> va check-email/send-email byte-safe + verifier-suspect-first; stamp hub verify OK bang stamp_verify.py (exit-0)
- email dinh-chinh hub (58f5afd8, selftest exit-0 x2) + adap-report + adap-request hash-verify-byte-safe-decode + FYI 2 broadcast no-stamp
- STAGE-2: git mv 7 broadcast processed -> inbox/ai_infra/ (root sach)
- fable-real review+invest (vai compound reviewer+inv-cb): run-trace + spec 3-muc + checklist A-D cho hmw @Opus 4.8 MAX; va stale all-inherit fable-real.md:37 + fable-clone.md:43
- hook-curate inv-cb MEMORY 23,9->16,9KB moved-not-cut (14 dong + 2 digest -> archive/2026-07.md)
- h18 memory +sibling-test-2-chieu; monitor self-compact S125-start + counter tick=4

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-16 13:29:43 +07:00

19 KiB
Raw Blame History

Reviewer Agent — Persistent Memory

Persistent diary cross-session. Auto-injected first ~200 lines at spawn (L1 HOT). Update BEFORE every stop. Tiered Memory v1: L1 HOT cap ~17KB (hook 24.4KB read-limit) · L2 archive/ on-demand · L3 RAG search_memory just-in-time. Keep entry ≤ 1.5K chars (gotcha #53). Full verbatim history pre-S40 → git d2f52ba + archive/2026-05-q1..q2.md; S51→S76 detail → archive/2026-06.md (S69/S70/S71/S80 curate). Archive map: archive/_INDEX.md + per-period .gist.md.

📁 Area memory (L2 on-demand — Read khi review vùng tương ứng)

🎯 Role baseline

Adversarial pre-commit reviewer SOLUTION_ERP. Read-only verify + live curl prod UAT (*.solutions.com.vn). Tools: Read, Grep, Glob, Bash (curl + git diff + sqlcmd read) + 5 RAG MCP. Skills: dependency-audit-erp + contract-workflow + permission-matrix. Output: PASS/FAIL + concrete issues file:line. NEVER write code.

🚨 Recurring bug patterns (catch priority)

  • #44 Silent 403 class-level Authorize quá strict — Drafter dropdown empty silent (TanStack catch silent → UI empty). Grep \[Authorize\(Policy=.*\)\] class-level + curl non-admin expect 200. Fix: class-level [Authorize] only (any authenticated); POST/PUT/DELETE giữ [Authorize(Policy="X.Create")].
  • #43 Step.Order ≠ index 0-based — Where(s=>s.Order==i) wrong row. Fix: EF query → in-memory OrderBy(Order).ToList() → index.
  • #42 Dual schema V1/V2 — Service phải branch — if (entity.ApprovalWorkflowId is Guid awId) ApproveV2Async else V1Legacy.
  • Wire BE claim — grep diff // Mock/alert(/no POST-PUT-DELETE call + live curl expect 2XX. Severity CRITICAL block.
  • #70 FE absolute-set stale-echo race — N fields cùng-cột share 1 mutation + echo sibling từ server-snapshot (bs) + invalidate() fire-and-forget (không await) → lưu 2 ô liên-tiếp đè mất. Window mở SAU isPending=false (btn re-enable), KHÔNG lúc in-flight. Catch: đếm field-cùng-cột share mutation + check invalidate awaited; fix = useIsFetching gate nút Lưu tới khi refetch land.
  • #71 enum proxy-predicate pollution — thêm enum value vào entity dùng-chung → UI/guard phân-loại theo PROXY-predicate (supplierId===null) thay vì enum tường minh → value mới lẫn nhầm phân-loại + false-pass guard. Catch: grep mọi field-proxy predicate, loại value mới tường minh; build-verify TỪNG app.
  • Cross-module security mirror (S29 Smart Friend) — khi mirror entity/Command cross-module (PE→Contract→Budget V2), focus data-shape MISS security guard. Pattern: aw.ApplicableType == ExpectedType validate ON Create BEFORE instantiation (mirror PurchaseEvaluationFeatures.cs:62-77). Attack: Drafter forge POST với approvalWorkflowId của module khác → FK Restrict chỉ check Id-existence NOT ApplicableType → wrong-scope pin. Re-verify IsActive+IsUserSelectable server-side. Password ≥12 chars. Severity MAJOR.
  • #17 EF migration 3-file — git diff --name-only | grep Migrations/ expect 3 (target + Designer + Snapshot).

📋 6-category checklist (EVERY review)

  • Cat 1 Wire BE/feature claim: grep mock markers diff + await api\.(post|put|delete|patch)\( + live curl POST/PUT/DELETE if deploy claim + status matrix.
  • Cat 2 Schema integrity: 3-file rule Mig + column types vs entity def. Reference docs/gotchas.md (71 active).
  • Cat 3 Security: [Authorize] class-level ALL new controllers + per-action policy admin-scoped (gotcha #44) + FE PermissionGuard + menuKeys.ts mirror BE MenuKeys.cs + FluentValidation + EF parameterized.
  • Cat 4 Code quality: dotnet build SolutionErp.slnx 0 err + npm run build × 2 app (TS6 strict) + tests baseline 354 PASS (Phase 9 UAT exception OK) + no --no-verify + anti-fiddle (scope drift >20% LOC = FAIL) + mirror 2 FE app §3.9.
  • Cat 5 Test coverage: new helper → xUnit · new endpoint → integration · bug → regression test-before-fix. Phase 9 UAT test-after default OK (feedback_uat_skip_verify). Baseline 354.
  • Cat 6 Writing-quality (Harness-7, S64): outward text (verdict gửi anh / report) = tiếng Việt câu hoàn-chỉnh đủ dấu đúng ngữ-pháp; describe issue + acceptance criteria, NOT code edits. Escalate disagreement explicit.

⚠️ Anti-patterns + 🛡️ Smart Friend guard

  1. ❌ Recommend code edits (only describe issue+criteria) · 2. ❌ Skip live curl if deploy claim · 3. ❌ Accept "wire" without grep proof · 4. ❌ Defer to em main authority (escalate explicit) · 5. ❌ Skip MEMORY · 6. ❌ Lower bar match em main (Smart Friend Cognition anti-pattern).

Smart Friend (Cognition): NEVER lower bar. Em main code fine → PASS. Em main issues → FAIL with specifics regardless social pressure. "Quality ceiling set by primary, not escalation." Value = raise quality through catch.

🧠 SOLUTION_ERP review essentials (S80 verified — re-ground từ docs/STATUS.md canonical)

  • Tests baseline: 354 PASS (45 Domain + 309 Infra · 0 fail/skip). Must increase khi feature added (§7); Phase 9 UAT exception (feedback_uat_skip_verify).
  • Gotchas: 71 active (docs/gotchas.md, format ### N.). Latest: #69 bundle-hash non-determ (deploy rebuild-FE-uncond rotate) · #70 FE stale-echo race (useIsFetching gate) · #71 enum proxy-predicate pollution · #66 Tailwind v4 unlayered h1-h4 color thắng utility · #58 EF read-modify-write lost-update→ExecuteUpdate atomic.
  • Migrations: 57 latest AddPeSuggestedPriceNotes (path src/Backend/SolutionErp.Infrastructure/Persistence/Migrations/). PE-budget: Mig 50 PeWorkItemBudgets per-gói-thầu (DROP module Budget cũ) · Mig 54 giá-đề-xuất PRO/CCM + giá-chốt · Mig 55 CcmNote · Mig 56 ProInitial/ProAdjust split · Mig 57 ghi-chú-giá PRO/CCM.
  • Endpoints: ~253 · 88 SQL tables.
  • Identity password ≥12 chars (reject 11-char). Test creds: admin admin@solutions.com.vn/Admin@123456 (full) · UAT nv.test@solutions.com.vn/TestUser@123456 (Drafter CCM).
  • Prod: api/admin/eoffice.solutions.com.vn. Bundle live admin CsJetgZH / user BVS0ApIm (Run #330). Pin: MediatR 12.4.1 (flag Version="14) · Swashbuckle 6.9.0 · Node CI 20.x.
  • Conventions: docs/rules.md (§1.1 outward writing, §3.9 mirror 2 FE, §5.2 commit, §6.5 docs narrative, §7 test timing, §2.8 pin).

📅 Recent activity (compressed — full verbatim → archive/2026-06.md + archive/2026-07.md via archive/_INDEX.md)

  • S124 L2 fidelity-to-source review, adap-wave plan — PWF (0 misread/1 MAJOR/3m): 5/6 broadcast-reading traps read-faithful (NOT-adopt→method/spirit · h17 4-floors-KEEP · r6 abs-path). MAJOR = push-guard "REFINEMENT ahead-of-broadcast" (spec:58) = OVERCLAIM: SE trailing-K is LOOSER than broadcast ahead-range-all-count, keeps sandwiched wal:→leak; NO dimension strictly ahead. run.md:15 + mark cl.4 already carry honest "noise-accepted no-rewrite" ⇒ spec contradicts own run.md+mark. Lesson: "ahead/refinement" = verify vs broadcast's ACTUAL requirement (looser≠ahead); spec+adap-report = shipped artifact → reconcile before hub-send. Verified: adap-reports at docs/governance/ not .claude/ (path-trap false-empty). → archive/2026-07.md.

  • S124 (2026-07-15) adap-wave-reply PLAN L3-lens — PASS_WITH_FIXES (0C/3M/2m): disk sub-reviewer-3.md. 🎯 do-token trap committed WHILE adopting do-token: spec "STATUS=26075 tok (real-N)" — I re-Read FULL → truncation = 70892 tok (tail-alone 33944 > 26075) ⇒ near-cap CHUNK mislabeled whole-file, 2.72× under, feeds owner re-tier. Lesson: verify do-token claim = re-Read full + read truncation line yourself; token count tokenizer-invariant ⇒ 2×+ gap = mis-measure not env. M2 meta-count "6 R1-R6"→5 (R5 highest-value dropped). M3 nấc "verified" on cadence NEVER-RAN (hub-expected = "đã đọc không đổi"). Positives held: authority-class owner-gated correct · harness_floor 55K self-audit honest · all-inherit 14/14. Anti-garble: full disk-write BEFORE return.

  • S125 (2026-07-16) do-token RELABEL correction (em-main on-behalf, B3 append): negative-control 3-probe ('a'×150K→notice "150,006 tokens" ~1,0/char · 'x'×150K→150,006 Y HỆT content-independent · mixed-ASCII 150K→143,251 ~0,955) ⇒ notice-N = heuristic họ-đếm-ký-tự = CẬN-TRÊN bảo-toàn, KHÔNG phải real-token (tokenizer thật nén chuỗi lặp ≪0,1/char). 70892 (dòng trên) đọc lại = cận-trên; dải thật STATUS [31K byte/4 — 70,9K notice]. Lesson sửa-frame: "token count tokenizer-invariant" chỉ đúng cho so-sánh chunk-vs-full CÙNG heuristic; nhãn "real-N" tự nó = mislabel-as-real — phải negative-control (chuỗi lặp) mới phân biệt heuristic/tokenizer. Nguồn: hub phuong-phap-dem-token-tien-de-vong4 + adap-report cùng tên.

  • S125 (2026-07-16) fable-real adap-review — PASS-WITH-SELF-FIXES [engine:fable-real · vai compound anh gán reviewer+inv-cb · inline-lead]: 2 near-miss TỰ BẮT trước khi ra ngoài: (1) false-TAMPER → RCA verifier: PS 5.1 Get-Content -Raw decode UTF-8-no-BOM bằng ANSI → mojibake → hash sai trên broadcast hub SẠCH; sibling-test 2 CHIỀU — sibling-MATCH⇒file-bệnh (tiền lệ S100) · sibling-CŨNG-FAIL⇒verifier-bệnh (S125); chốt bằng stamp_verify.py hub exit-0. (2) suýt claim-sai nguồn outward: draft adap-request viết "snippet hub dùng Get-Content -Raw" — mở hub check-email.md:18 thì snippet để HỞ decode ($txt không định nghĩa) + hub ĐÃ CÓ s76 script-verify → sửa email+request TRƯỚC stamp cuối; email edit-sau-stamp → RE-STAMP 58f5afd8 + selftest exit-0 ×2. Lesson: outward-claim về văn-bản bên kia = mở ĐÚNG file+dòng trước khi viết; email đã stamp mà cần sửa = sửa→re-stamp→re-selftest cùng lượt, đừng để stamp-then-edit sống. Bẫy tooling: Edit-tool 3× fail chèn escape BOM (pipeline sinh-chữ render escape thành U+FEFF thật) → build-from-codepoint. Evidence: runs/2026-07-16-S125-fable-real-adap-review/.

  • S123 governance 4-change review — PWF (3 must/1 MAJOR/3m): detail → topic. 🔴 #53 garble tại TAO; đĩa KHÔNG cứu vì chưa ghi diary ⇒ Luật: ghi diary TRƯỚC return. Bài: vá-1-lớp⇒grep MỌI detector cùng-lớp TRONG diff · fault-inject N/N chỉ chứng trục ĐÃ chạm ("trục nào KHÔNG có ca?") · luật-viết≠luật-làm · "N/N" trộn đo+dựng-lịch-sử=false-specificity · "fix" bằng đổi-format-cho-trượt-mẫu = Goodhart rời-tập-đo.

  • S117 PE negative-quote FE-only spec-review — PASS. Lesson: 2-tier guard = compare SUM EXPRESSION not comparator; derived-flag safety = trace what flag KEYED-ON (IsSelected sign-agnostic). → archive/2026-07.md.

  • S116 outward-email GATE H-22 WAL restart runtime — PASS (3m). Lesson: persist-claim on git-tracked WAL → verify tracked+0-drift; mechanism-proof lives at Stop-hook run, NOT git property. → archive/2026-07.md.

  • S115 presence-not-age spec-review — PWF (0C/2M/5m). Lesson: verify EACH regex-alt vs EACH target-line by hand; acceptance-grep can't detect its OWN deliverable's miss; skip-on-contiguous-prefix = correctness-inversion. → archive/2026-07.md.

  • S101 H19 WF2 Lane-A — PWC (closed @S102): marker WRITE-ONLY dead — persist-claim cần CẢ reader-side (verify consumer exists). → archive/2026-07.md.

  • S100 H18 WF2 synthesis+Lane-B — PWC: ledger revert-clean + ratio-band; anti-pattern HELD stale WF2 run-id NOT stamped. → archive/2026-07.md.

  • S98 3 verify-lane — PASS: fidelity-gate 3-lớp; Windows byte-verify = .NET ReadAllBytes/wc -c (MSYS strip \r báo sai). → archive/2026-07.md.

  • S97 PE finalize UAT + Mig 60/61 — PASS: default-flip byte-mirror SHA256 ×2; RUNTIME-flag grep-all + 4-projection. → archive/2026-07.md.

  • S93 Harness-16 MFE adopt — PASS: code-gate re-derived denom; WF1 caught vocab-fork H6.7≠H16. → adap-report + _INDEX.

  • S92 (2026-06-29) PROD-security hide 5 menu-groups admin-only (uncommitted) — PASS (1 note): A-E upheld; CatalogManager Danh-mục stripped (by-spec, 0 users). → project_s92_admin_only_modules_revoke.md.

  • June-2026 digest — LESSON-ONLY (verbatim → archive/2026-06.md 70KB + _INDEX; S89/S90/S91 PE FROZEN): merge-distill fabricates false-specificity ⇒ QUALITY gate AFTER presence · sha = self-declared frontmatter NOT recompute · spec-scope-framing can be FALSE ⇒ read changed-set · fail-closed guard BEFORE terminal-state + server-recompute no-trust-client · TRACKED = check-ignore ≠ git-ls-files(committed) · public-grant root NOT inherit-root · upgrade MUST MUTATE row NOT skip-existing; menu-hide ≠ API-lock · single→multi stops at display-layer.

  • S108 first-real-run H19 — FAIL (1C+4M+6m): email "đã sửa comment" khi hmw.js chưa sửa. Lesson: outward-claim "đã sửa X" phải cat X trước gate; grep stale-claim theo CLASS. → archive/2026-07.md.

  • S109 fidelity-gate 2 gist L2 — PWF (3): gist meta-count 15≠disk 14; delta tự-tính = false-specificity; fact-claim trong N/A verify như content. → archive/2026-07.md.

  • S111 H22 WAL adopt — PWF (0C/1M): CATCH "STAGED" còn khi N.3 nâng VERIFIED-RUNTIME = nâng-nấc-quên-sync cùng-diff; live-witness>forensics. → archive/2026-07.md.

  • S110 H21+MTv3 — PWF (0C/5M): doc "VALID_ROLES 12" code=10 → claim-về-code grep lại kể cả reword; supersede trỏ adap-report chưa tạo = dangling. → archive/2026-07.md.

  • S112 fable-real-single close-reviews+FINAL — GO 0-must: Import btn reuses sibling-menu guard but endpoint=Admin ⇒ derive guard from ENDPOINT authz; EDGE-5 gác FROM-state ở ĐỈNH method KHÔNG per-branch; self-flip token-test = internal NOT external-accept. → topic.

🔄 Curate trigger

  • Hook-cap >17.1KB (24.4KB read-limit — đổi từ ~30KB cũ, S109) → archive recent → L2 archive/<period>.md (append additive) + _INDEX.md substring pointer. Stale >3mo → remove.
  • S116 curate (self, 2026-07-13, hook 21.4KB→<17.1KB): moved S115+S116 verbatim → archive/2026-07.md (move-not-cut, batch-marker) + digest in L1; MERGED 12 June bullets (S65-S91) → 1 consolidated digest line (detail archive/2026-06.md+_INDEX); trimmed 4 PE-per-hạng-mục + S89-trio + S111 Area-pointers (detail in topic files on disk).
  • S113 curate (self, 2026-07-12, hook 21.3KB→~16KB): compressed 4 verbose S112 entries (2 close-review lines→1, BE-close+FINAL→1) + this curate-log in-place; NO file-move (lessons preserved inline). digest kept L1. +review-lane addendum: 4 verbatim ALSO moved → archive/2026-07.md + 4 _INDEX pointer (move-not-cut) + trimmed 2 digest.
  • S109 curate: moved 4 verbatim S100/S101 → archive/2026-07.md +4 pointer.
  • S102 recovery (em-main): cut-not-moved ×5 @f229b07 recovered từ git. Lesson: L1-shrink kèm claim "Detail→archive" = BẮT BUỘC grep moved-not-cut TRƯỚC khi trust digest.
  • Prev curates: S80 (moved 13 S65→S76 →archive/2026-06), S71 (moved 10), S70 (built _INDEX+.gist), S40.