docs: project docs, scripts, deployment configs, and evidence

2026-04-02 11:22:17 +08:00
parent 4718980ab5
commit bbeeb63dfa
396 changed files with 165018 additions and 0 deletions
--- a/docs/evidence/ops/2026-03-27/quality/QUALITY_AUDIT_20260327-182910.md
+++ b/docs/evidence/ops/2026-03-27/quality/QUALITY_AUDIT_20260327-182910.md
@@ -0,0 +1,804 @@
+# 2026-03-27 全量测试与质量审计
+
+## 1.3 2026-03-28 Q-004 latest remediation note XIII
+
+- `Q-004` was remediated further again after the previous addendum and still remains open.
+- Newly verified outcomes:
+  - frontend overall coverage is now `89.72 / 77.57 / 84.48 / 90.64`
+  - `src/app/App.tsx` is now `100 / 100 / 100 / 100`
+  - `src/app/RootLayout.tsx` is now `100 / 100 / 100 / 100`
+  - `src/components/common/ErrorBoundary/ErrorBoundary.tsx` is now `100 / 83.33 / 100 / 100`
+- The latest remediation closed three more previously real frontend hotspots:
+  - `App.tsx` is no longer an open `Q-004` gap
+  - `RootLayout.tsx` is no longer an open `Q-004` gap
+  - `ErrorBoundary.tsx` is no longer an open `Q-004` gap
+- The updated real boundary remains:
+  - `Q-004` still cannot be truthfully closed
+  - after the shell and boundary layer were closed, the remaining higher-value frontend gaps narrow further to router, dashboard, and shared page-state coverage
+- The validation hygiene note remains materially unchanged:
+  - `npm.cmd run test:coverage` passed again, but still emitted one post-summary jsdom `AggregateError` network-noise line
+- Latest evidence for this addendum:
+  - `docs/evidence/ops/2026-03-28/quality/COVERAGE_REMEDIATION_20260328-110341.md`
+
+## 1.2 2026-03-28 Q-004 latest remediation note XII
+
+- `Q-004` was remediated further again after the previous addendum and still remains open.
+- Newly verified outcomes:
+  - frontend overall coverage is now `89.06 / 77.14 / 83.56 / 89.96`
+  - `src/pages/auth/ForgotPasswordPage/ForgotPasswordPage.tsx` is now `100 / 75 / 100 / 100`
+  - `src/pages/auth/ResetPasswordPage/ResetPasswordPage.tsx` is now `95 / 94.44 / 100 / 95`
+- The latest remediation closed two more previously real frontend hotspots:
+  - `ForgotPasswordPage` is no longer an open `Q-004` gap
+  - `ResetPasswordPage` is no longer an open `Q-004` gap
+- The updated real boundary remains:
+  - `Q-004` still cannot be truthfully closed
+  - after the auth recovery pages were closed, the remaining higher-value frontend gaps shift more toward app shell, routing, error-boundary, and dashboard entry-point coverage
+- The validation hygiene note remains materially unchanged:
+  - `npm.cmd run test:coverage` passed again, but still emitted one post-summary jsdom `AggregateError` network-noise line
+- Latest evidence for this addendum:
+  - `docs/evidence/ops/2026-03-28/quality/COVERAGE_REMEDIATION_20260328-105226.md`
+
+## 1.1 2026-03-28 Q-004 latest remediation note XI
+
+- `Q-004` was remediated further again after the previous addendum and still remains open.
+- Newly verified outcomes:
+  - frontend overall coverage is now `85.89 / 74.91 / 81.87 / 86.71`
+  - `src/pages/admin/ProfileSecurityPage/ProfileSecurityPage.tsx` is now `90.35 / 75.51 / 92.45 / 90.13`
+- The latest remediation closed one more previously real frontend hotspot:
+  - `src/pages/admin/ProfileSecurityPage/ProfileSecurityPage.tsx` is no longer an open `Q-004` gap
+- The updated real boundary remains:
+  - `Q-004` still cannot be truthfully closed
+  - with `client.ts` and `ProfileSecurityPage` closed, the next highest-value frontend gaps now shift toward auth recovery pages such as `ForgotPasswordPage` and `ResetPasswordPage`
+- The validation hygiene note remains materially unchanged:
+  - `npm.cmd run test:coverage` passed again, but still emitted one post-summary jsdom `AggregateError` network-noise line
+- Latest evidence for this addendum:
+  - `docs/evidence/ops/2026-03-28/quality/COVERAGE_REMEDIATION_20260328-104341.md`
+
+## 1.0 2026-03-28 Q-004 latest remediation note X
+
+- `Q-004` was remediated further again after the previous addendum and still remains open.
+- Newly verified outcomes:
+  - frontend overall coverage is now `83.86 / 72.68 / 79.87 / 84.72`
+  - `src/lib/http/client.ts` is now `100 / 92.30 / 100 / 100`
+- The latest remediation closed one more previously real frontend hotspot:
+  - `src/lib/http/client.ts` is no longer an open `Q-004` gap
+- This pass also closed one real validation-hygiene defect in production code:
+  - cached shared refresh waiters no longer leave an unhandled rejected promise behind when refresh fails
+- The updated real boundary remains:
+  - `Q-004` still cannot be truthfully closed
+  - the remaining highest-value frontend gap is now more concentrated in deeper `ProfileSecurityPage`
+- The validation hygiene note remains materially unchanged:
+  - `npm.cmd run test:coverage` passed again, but still emitted one post-summary jsdom `AggregateError` network-noise line
+- Latest evidence for this addendum:
+  - `docs/evidence/ops/2026-03-28/quality/COVERAGE_REMEDIATION_20260328-102456.md`
+
+## 0.9 2026-03-28 Q-004 latest remediation note IX
+
+- `Q-004` was remediated further again after the previous addendum and still remains open.
+- Newly verified outcomes:
+  - frontend overall coverage is now `80.06 / 67.61 / 78.00 / 80.91`
+  - `src/lib/http/csrf.ts` is now `100 / 88.46 / 100 / 100`
+- The latest remediation closed one more previously real frontend hotspot:
+  - `src/lib/http/csrf.ts` is no longer an open `Q-004` gap
+- The updated real boundary remains:
+  - `Q-004` still cannot be truthfully closed
+  - the remaining highest-value frontend gaps are now more concentrated in `src/lib/http/client.ts` and deeper `ProfileSecurityPage`
+- The validation hygiene note remains materially unchanged:
+  - `npm.cmd run test:coverage` passed again, but still emitted one post-summary jsdom `AggregateError` network-noise line
+- Latest evidence for this addendum:
+  - `docs/evidence/ops/2026-03-28/quality/COVERAGE_REMEDIATION_20260328-083841.md`
+
+## 0.8 2026-03-28 Q-004 latest remediation note VIII
+
+- `Q-004` was remediated further again after the previous addendum and still remains open.
+- Newly verified outcomes:
+  - frontend overall coverage is now `78.91 / 66.06 / 77.07 / 79.73`
+  - `src/pages/auth/RegisterPage/RegisterPage.tsx` is now `93.42 / 85.24 / 87.5 / 95.89`
+- The latest remediation closed one more previously real frontend hotspot:
+  - `RegisterPage` is no longer an open `Q-004` gap
+- The updated real boundary remains:
+  - `Q-004` still cannot be truthfully closed
+  - the remaining highest-value frontend gaps are now more concentrated in deeper `ProfileSecurityPage` and `lib/http`
+- The validation hygiene note remains materially unchanged:
+  - `npm.cmd run test:coverage` passed again, but still emitted one post-summary jsdom `AggregateError` network-noise line
+- Latest evidence for this addendum:
+  - `docs/evidence/ops/2026-03-28/quality/COVERAGE_REMEDIATION_20260328-082843.md`
+
+## 0.7 2026-03-28 Q-004 latest remediation note VII
+
+- `Q-004` was remediated further again after the previous addendum and still remains open.
+- Newly verified outcomes:
+  - frontend overall coverage is now `78.38 / 64.77 / 76.92 / 79.19`
+  - `src/pages/auth/LoginPage/LoginPage.tsx` is now `92.56 / 84.09 / 86.2 / 95.61`
+- The latest remediation closed one more previously real frontend hotspot:
+  - `LoginPage` is no longer an open `Q-004` gap
+- The updated real boundary remains:
+  - `Q-004` still cannot be truthfully closed
+  - the remaining highest-value frontend gaps are now more concentrated in `RegisterPage`, deeper `ProfileSecurityPage`, and `lib/http`
+- The validation hygiene note remains materially unchanged:
+  - `npm.cmd run test:coverage` passed again, but still emitted one post-summary jsdom `AggregateError` network-noise line
+  - one concurrent `lint` + `build` attempt produced a transient Windows/Vite `index.html` emit-path failure, while the required standalone `build` rerun passed immediately afterward
+- Latest evidence for this addendum:
+  - `docs/evidence/ops/2026-03-28/quality/COVERAGE_REMEDIATION_20260328-081514.md`
+
+## 0.6 2026-03-28 Q-004 latest remediation note VI
+
+- `Q-004` was remediated further again after the previous addendum and still remains open.
+- Newly verified outcomes:
+  - frontend overall coverage is now `76.00 / 63.91 / 75.07 / 76.84`
+  - `src/app/providers` is now `96.38 / 93.75`
+  - `src/app/providers/AuthProvider.tsx` is now `100%`
+- The latest remediation closed one more previously real frontend hotspot:
+  - `AuthProvider` is no longer an open `Q-004` gap
+- The updated real boundary remains:
+  - `Q-004` still cannot be truthfully closed
+  - the remaining highest-value frontend gaps are now more concentrated in `LoginPage`, `RegisterPage`, deeper `ProfileSecurityPage`, and `lib/http`
+- The validation hygiene note remains unchanged:
+  - `npm.cmd run test:coverage` passed again, but still emitted one post-summary jsdom `AggregateError` network-noise line
+- Latest evidence for this addendum:
+  - `docs/evidence/ops/2026-03-28/quality/COVERAGE_REMEDIATION_20260328-075725.md`
+
+## 0.5 2026-03-28 Q-004 latest remediation note V
+
+- `Q-004` was remediated further again after the previous addendum and still remains open.
+- Newly verified outcomes:
+  - frontend overall coverage is now `74.54 / 63.57 / 74.61 / 75.35`
+  - `src/pages/admin/UsersPage` is now `95.06%`
+  - `src/pages/admin/WebhooksPage` is now `94.92%`
+  - `internal/repository` is now `67.1%`
+- The latest remediation closed two previously dominant frontend gap clusters:
+  - `UsersPage` drawers/modals are no longer one of the main remaining blockers
+  - `WebhooksPage` modal/drawer components are no longer one of the main remaining blockers
+- A new real backend defect pair was discovered and fixed during this pass:
+  - `internal/repository/role.go`
+    - explicit `status=0` role creation was previously persisted as enabled
+  - `internal/repository/permission.go`
+    - explicit `status=0` permission creation was previously persisted as enabled
+- The updated real boundary remains:
+  - `Q-004` still cannot be truthfully closed
+  - the remaining highest-value gaps are now more concentrated in deeper `ProfileSecurityPage`, `LoginPage`, `RegisterPage`, `AuthProvider`, `lib/http`, and still-remaining repository depth
+- The validation hygiene note remains unchanged:
+  - `npm.cmd run test:coverage` passed again, but still emitted one post-summary jsdom `AggregateError` network-noise line
+- Latest evidence for this addendum:
+  - `docs/evidence/ops/2026-03-28/quality/COVERAGE_REMEDIATION_20260328-011431.md`
+
+## 0.4 2026-03-28 Q-004 latest remediation note IV
+
+- `Q-004` was remediated further again after the previous addendum and still remains open.
+- Newly verified outcomes:
+  - frontend overall coverage is now `68.32 / 54.12 / 68.15 / 69.28`
+  - `src/pages/admin/RolesPage` is now at `94.53%`
+  - `src/pages/admin/PermissionsPage` is now at `93.51%`
+  - `src/pages/admin/ProfilePage/ProfilePage.tsx` is now at `91.42%`
+  - `internal/auth/providers` is now `80.6%`
+  - `internal/repository` remains `37.1%`
+- The latest remediation changed the real gap map materially:
+  - provider coverage is no longer one of the dominant blockers
+  - `RolesPage`, `PermissionsPage`, and `ProfilePage` are no longer dominant uncovered admin page clusters
+- The updated real boundary remains:
+  - `Q-004` still cannot be truthfully closed
+  - the remaining highest-value gaps are now concentrated in `internal/repository` depth plus still-uncovered frontend modal/drawer components, especially under `UsersPage` and `WebhooksPage`, and deeper remaining `ProfileSecurityPage` branches
+- The validation hygiene note remains unchanged:
+  - `npm.cmd run test:coverage` passed again, but still emitted one post-summary jsdom `AggregateError` network-noise line
+- Latest evidence for this addendum:
+  - `docs/evidence/ops/2026-03-28/quality/COVERAGE_REMEDIATION_20260328-003416.md`
+
+## 0.3 2026-03-27 Q-004 latest remediation note III
+
+- `Q-004` was remediated further again after the previous addendum and still remains open.
+- Newly verified outcomes:
+  - frontend overall coverage is now `56.81 / 44.67 / 57.38 / 57.57`
+  - `src/pages/admin/LoginLogsPage/LoginLogsPage.tsx` is now at `93.1%`
+  - `src/pages/admin/OperationLogsPage/OperationLogsPage.tsx` is now at `91.52%`
+  - frontend `services` coverage remains `86.2%`
+  - `internal/auth/providers` is now `28.7%`
+  - `internal/repository` remains `37.1%`
+- The latest remediation reduced two real gaps materially:
+  - admin log pages are no longer among the main page-level hotspots
+  - provider coverage is no longer extremely shallow, but it is still far from closure-grade depth
+- A new validation hygiene note also appeared during this pass:
+  - `npm.cmd run test:coverage` passed, but still emitted one post-summary jsdom `AggregateError` network-noise line
+  - this is not a failing gate for the current pass, but it is still real and should not be misrepresented as a perfectly clean run
+- The updated real boundary remains:
+  - `Q-004` still cannot be truthfully closed
+  - the main remaining gaps are now concentrated in deeper `internal/auth/providers` paths and still-uncovered admin pages/components
+- Latest evidence for this addendum:
+  - `docs/evidence/ops/2026-03-27/quality/COVERAGE_REMEDIATION_20260327-233824.md`
+
+## 0.2 2026-03-27 Q-004 latest remediation note II
+
+- `Q-004` was remediated further after the previous addendum and still remains open.
+- Newly verified outcomes:
+  - frontend overall coverage is now `52.05 / 42.86 / 51.84 / 52.69`
+  - frontend `services` coverage is now `86.2%`
+  - `internal/auth/providers` is now `15.2%`
+  - `internal/repository` remains `37.1%`
+- The latest remediation reduced the frontend service-layer gap substantially.
+- The updated real boundary is unchanged in principle:
+  - `internal/auth/providers` is still too shallow to truthfully mark `Q-004` closed
+  - there are still multiple uncovered admin pages/components outside the already-remediated `UsersPage` and `ProfileSecurityPage`
+- Latest evidence for this addendum:
+  - `docs/evidence/ops/2026-03-27/quality/COVERAGE_REMEDIATION_20260327-224352.md`
+
+## 0.1 2026-03-27 Q-004 latest remediation note
+
+- `Q-004` has been remediated further after this audit, but it is still not closed.
+- Newly verified outcomes:
+  - frontend overall coverage is now `49.18 / 42.86 / 44.92 / 49.79`
+  - `UsersPage.tsx` is now at `90.98%` statements and `68.75%` branches
+  - `ProfileSecurityPage.tsx` is now at `70.17%` statements and `48.97%` branches
+  - `internal/repository` is now at `37.1%`
+  - `internal/auth/providers` is now at `8.5%`
+- A new real defect was discovered and fixed during this remediation pass:
+  - `internal/repository/device.go`
+  - device create requests with explicit `status=0` were previously persisted as active because the DB default swallowed the zero value
+- Latest evidence for this addendum:
+  - `docs/evidence/ops/2026-03-27/quality/COVERAGE_REMEDIATION_20260327-221835.md`
+- Updated real boundary:
+  - `UsersPage` and `ProfileSecurityPage` are no longer the primary blockers they were at audit time
+  - `internal/auth/providers` still remains too shallow to truthfully mark `Q-004` closed
+
+## 0. 2026-03-27 优先级整改补充结论
+
+以下内容覆盖本报告中 Q-001 / Q-002 / Q-003 的“当前真实状态”：
+
+- Q-001 会话安全整改已完成并复验通过。
+  - 浏览器端不再把 access token、refresh token、用户信息、角色信息持久化到 `localStorage` / `sessionStorage`。
+  - refresh continuity 已切到后端 `HttpOnly` refresh cookie。
+  - 为避免无会话用户访问受保护页时盲打 `/auth/refresh` 产生浏览器 `400 Bad Request` console error，后端新增了非敏感会话存在标记 cookie，前端先判断是否值得恢复，再决定是否发起 refresh。
+- Q-002 OAuth 信任边界整改已完成并复验通过。
+  - `return_to` 不再基于 `X-Forwarded-*` 推导的 request origin 做隐式同源放行。
+  - 当前只接受绝对路径，或显式 allowlist origin。
+- Q-003 随机降级 fail-open 已完成整改并复验通过。
+  - `crypto/rand` 失败时不再静默退化到更弱随机源。
+- 本轮补充整改还关闭了一个真实回归：
+  - 鉴于会话模型从 Web Storage 切到 cookie + memory 后，真实浏览器 E2E 一度出现公开页/无会话访问时的刷新噪音与登录后路由竞态。
+  - 该问题现已通过“会话存在标记 cookie + AuthProvider 恢复策略收敛 + 认证态导出去竞态 + E2E 基座修正”收口。
+
+最新补充验证命令：
+
+```powershell
+go test ./... -count=1
+go vet ./...
+go build ./cmd/server
+
+cd D:\project\frontend\admin
+npm.cmd run test:run
+npm.cmd run lint
+npm.cmd run build
+powershell -ExecutionPolicy Bypass -File .\scripts\run-playwright-auth-e2e.ps1
+```
+
+最新补充真实结论：
+
+- Q-001 / Q-002 / Q-003 已不再是本项目“当前进行时”的开放问题。
+- Q-004 已完成一轮增补整改并通过真实复验，但当前仍是“部分收口、未完全关闭”状态。
+  - Frontend overall coverage 已从审计时的 `29.38 / 29.32 / 24.84 / 29.78` 提升到 `41.06 / 38.48 / 36.00 / 41.47`。
+  - 重点目标中：
+    - `router` 已到 `47.72%`
+    - `RequireAuth` / `RequireAdmin` 已到 `100%`
+    - `AdminLayout` 已到 `80.00%`
+    - `ImportExportPage` 已到 `83.58%`
+    - `WebhooksPage` 已到 `93.15%`
+    - `services/webhooks.ts` 已到 `100%`
+    - `internal/database` 已到 `83.2%`
+    - `internal/repository` 已到 `15.1%`
+  - 本轮还顺带关闭了一个真实构建问题：
+    - 在当前 Windows + `Vite 8` + `--configLoader native` 组合下，默认 HTML 输入会导致绝对路径 `index.html` 发射错误；现已通过显式 `rollupOptions.input = 'index.html'` 收口。
+  - 但 `internal/auth/providers` 仍仅 `4.0%`，前端 `UsersPage` / `ProfileSecurityPage` 仍有明显缺口。
+- 当前剩余真实缺口收敛为：
+  - Q-004 自动化覆盖率深度不足
+  - Q-005 dev toolchain SCA 未清零
+  - Q-006 外部告警交付证据未闭环
+
+补充证据：
+
+- [`docs/evidence/ops/2026-03-27/quality/AUTH_SESSION_REMEDIATION_20260327-194100.md`](/D:/project/docs/evidence/ops/2026-03-27/quality/AUTH_SESSION_REMEDIATION_20260327-194100.md)
+- [`docs/evidence/ops/2026-03-27/quality/COVERAGE_REMEDIATION_20260327-212336.md`](/D:/project/docs/evidence/ops/2026-03-27/quality/COVERAGE_REMEDIATION_20260327-212336.md)
+- [`docs/evidence/ops/2026-03-27/quality/COVERAGE_REMEDIATION_20260327-214422.md`](/D:/project/docs/evidence/ops/2026-03-27/quality/COVERAGE_REMEDIATION_20260327-214422.md)
+
+## 1. 审计方法
+
+- 会话内可用 skill 中没有现成的通用 testing/quality skill。
+- 使用 `skill-installer` 检索了可安装技能，识别到 `playwright` 与 `security-best-practices` 可覆盖真实浏览器验证与安全审计。
+- 由于当前沙箱对 skill 安装临时目录写入有限制，未能将 skill 正式安装到本地目录；本轮直接拉取并按其规范执行：
+  - `playwright`：以 CLI-first / real browser 为原则，沿用项目现有真实浏览器 E2E 路径验证。
+  - `security-best-practices`：按 Go backend + React/TypeScript frontend 的安全审计规则做证据化检查。
+- 同时严格按照项目自身质量基线执行：`docs/team/QUALITY_STANDARD.md`。
+
+## 2. 已执行门禁
+
+### 2.1 Backend
+
+```powershell
+go vet ./...
+go test ./... -count=1
+go build ./cmd/server
+go test ./... -cover
+```
+
+结论：通过。
+
+### 2.2 Frontend
+
+```powershell
+cd frontend/admin
+npm.cmd run lint
+npm.cmd run test:run
+npm.cmd run build
+npm.cmd run test:coverage
+```
+
+结论：通过。
+
+### 2.3 Real Browser E2E
+
+```powershell
+cd frontend/admin
+powershell -ExecutionPolicy Bypass -File .\scripts\run-playwright-auth-e2e.ps1
+```
+
+结论：通过。
+
+本轮真实浏览器场景包含：
+
+- `admin-bootstrap`
+- `public-registration`
+- `email-activation`
+- `login-surface`
+- `auth-workflow`
+- `responsive-login`
+- `desktop-mobile-navigation`
+
+### 2.4 运维治理与交付证据
+
+```powershell
+powershell -ExecutionPolicy Bypass -File .\scripts\ops\run-sca-evidence.ps1
+powershell -ExecutionPolicy Bypass -File .\scripts\ops\capture-local-baseline.ps1
+powershell -ExecutionPolicy Bypass -File .\scripts\ops\validate-alerting-package.ps1
+powershell -ExecutionPolicy Bypass -File .\scripts\ops\drill-alertmanager-render.ps1
+powershell -ExecutionPolicy Bypass -File .\scripts\ops\drill-sqlite-backup-restore.ps1
+powershell -ExecutionPolicy Bypass -File .\scripts\ops\drill-config-isolation.ps1
+powershell -ExecutionPolicy Bypass -File .\scripts\ops\drill-local-rollback.ps1
+powershell -ExecutionPolicy Bypass -File .\scripts\ops\validate-secret-boundary.ps1
+```
+
+结论：
+
+- SCA：生产依赖通过，完整依赖树未清零。
+- 本地观测基线：通过。
+- Alerting 包结构校验：通过，但外部通知闭环未完成。
+- Alertmanager 渲染演练：通过。
+- SQLite 备份恢复演练：通过。
+- 配置/环境隔离演练：通过。
+- 本地回滚演练：通过。
+- 密钥边界校验：通过。
+
+## 3. 正向结论
+
+- 当前项目“可执行质量门禁”整体较强：后端、前端、真实浏览器 E2E、本地治理演练都能真实跑通。
+- 真实浏览器链路已经不是 smoke 假闭环，而是可重复执行的产品级主链路验证。
+- 前端未发现明显高信号 DOM XSS 反模式：
+  - 未扫到 `dangerouslySetInnerHTML`
+  - 未扫到 `eval/new Function/document.write`
+- Release 模式下对 wildcard CORS 有显式拒绝测试，基础安全头中间件也已接入。
+
+## 4. 真实问题清单
+
+### Q-001 高风险：浏览器端仍将 access/refresh token 持久化到 Web Storage
+
+- 位置：
+  - `frontend/admin/src/lib/storage/token-storage.ts:4-5`
+  - `frontend/admin/src/lib/storage/token-storage.ts:25-27`
+  - `frontend/admin/src/lib/http/auth-session.ts:5-6`
+  - `frontend/admin/src/lib/http/auth-session.ts:121-123`
+  - `frontend/admin/src/lib/http/auth-session.ts:140`
+  - `frontend/admin/src/lib/http/auth-session.ts:153`
+- 证据：
+  - refresh token 落在 `localStorage`
+  - access token、用户信息、角色信息落在 `sessionStorage`
+- 影响：
+  - 一旦前端发生 XSS、浏览器扩展注入或同机恶意读取，令牌可被直接窃取。
+  - 这不符合企业级生产产品对会话凭证的保守策略。
+- 结论：
+  - 当前“功能可用”不等于“会话安全成熟”。
+  - 更稳妥的方向应是 `HttpOnly + Secure + SameSite` cookie，或 BFF / server session 模式。
+
+### Q-002 高风险：OAuth return_to 校验依赖未受信任代理证明的转发头
+
+- 位置：
+  - `internal/api/handler/auth.go:511-524`
+  - `internal/api/handler/auth.go:567-588`
+- 证据：
+  - `oauthRequestOrigin` 直接信任 `X-Forwarded-Proto` 与 `X-Forwarded-Host`
+  - `resolveOAuthReturnTo` 允许 `return_to` 与该 request origin 相同即通过
+- 影响：
+  - 如果边缘代理未明确剥离/重写这些头，攻击者可能伪造头值影响 OAuth 回跳来源判断。
+  - 该问题至少会造成 origin trust 边界不清；在配置失误时可退化为开放跳转/回跳接收面扩大。
+- 结论：
+  - 这是典型的“代码层看见依赖 forwarded headers，但仓内没有可信代理证明”的问题。
+  - 当前应视为高风险边界项，而不是默认安全。
+
+### Q-003 中风险：安全敏感随机值存在 fail-open 降级
+
+- 位置：
+  - `internal/auth/jwt.go:62-65`
+  - `internal/service/email.go:295-297`
+  - `internal/service/captcha.go:142-145`
+- 证据：
+  - `crypto/rand` 失败后，JWT JTI / email code / captcha ID 会退化到时间戳或 `math/rand`
+- 影响：
+  - 熵源异常时没有 fail closed，而是继续生成可预测性更强的值。
+  - 这不是主路径问题，但不符合严格生产安全设计。
+- 结论：
+  - 应改为显式报错并阻断相关安全流程，而不是静默降级。
+
+### Q-004 中风险：自动化覆盖率不足，回归安全网偏薄
+
+- Frontend 总覆盖率：
+  - statements `29.38%`
+  - branches `29.32%`
+  - functions `24.84%`
+  - lines `29.78%`
+- Backend 覆盖率示例：
+  - `internal/service` `51.8%`
+  - `internal/api/handler` `31.4%`
+  - `internal/auth` `34.3%`
+  - `internal/auth/providers` `1.5%`
+  - `internal/repository` `10.5%`
+  - `internal/database` `0.0%`
+- 影响：
+  - 当前 E2E 很强，但底层模块和异常分支的自动回归网仍然偏弱。
+
+### Q-005 中风险：完整依赖树 SCA 未清零
+
+- 结果：
+  - `npm audit production`: `0`
+  - `npm audit full`: `22`
+  - 其中 `21 moderate`，`1 high`
+  - `govulncheck reachable findings`: `0`
+- 主要链路：
+  - `picomatch` 高危
+  - `vite` / `vitest` / `typescript-eslint` / `eslint` 相关 dev toolchain 链路存在中危项
+- 影响：
+  - 生产依赖当前较干净。
+  - 但工程供应链本身还不能称为“完全收口”。
+
+### Q-006 中风险：外部告警交付证据未闭环
+
+- 结果：
+  - `Repo-level alerting package structurally ready: True`
+  - `Repo-level oncall/delivery package fully closed: False`
+- 影响：
+  - 仓内模板、结构、演练已具备。
+  - 但真实外部通知联系人/渠道的交付闭环证据还缺。
+
+## 5. 综合判断
+
+### 5.1 已达到的水平
+
+- 可以真实表述为：
+  - “项目当前可执行质量门禁整体通过，后端/前端/真实浏览器 E2E/本地治理演练已形成一轮真实闭环。”
+
+### 5.2 不能夸大的表述
+
+- 目前不能真实表述为：
+  - “已经完全达到企业级生产上线质量”
+  - “安全与治理材料全部闭环”
+  - “自动化测试覆盖已经充分”
+
+### 5.3 真实状态
+
+- 当前更准确的结论是：
+  - 执行层面很强，产品主链路和真实浏览器验证已明显成熟。
+  - 但安全会话模型、反向代理信任边界、覆盖率、dev 供应链漏洞、外部告警交付证据，仍是生产级质量的真实缺口。
+
+## 6. 下一步优先级
+
+1. 会话安全整改
+   - 移除 Web Storage 中的 access/refresh token 持久化。
+   - 切到 HttpOnly cookie 或 BFF / server session。
+2. OAuth 信任边界整改
+   - 不再直接信任 `X-Forwarded-*`。
+   - 显式配置 trusted proxy / trusted origin，并补 runtime 证据。
+3. fail-open 随机降级整改
+   - `crypto/rand` 失败即报错，不再退化到时间戳或 `math/rand`。
+4. 覆盖率提升
+   - Frontend 优先补 `AuthProvider`、`router`、`AdminLayout`、`UsersPage`、`WebhooksPage`、`ImportExportPage`
+   - Backend 优先补 `internal/auth/providers`、`internal/repository`、`internal/database`
+5. 清理 dev toolchain SCA
+   - 升级 `vite/vitest/eslint/typescript-eslint` 及其传递依赖，消除 `picomatch` 链路风险。
+6. 补齐真实外部告警交付证据
+   - 接入真实通知渠道并形成可审计投递记录。
+
+## 7. 本轮证据
+
+- `docs/team/QUALITY_STANDARD.md`
+- `docs/status/REAL_PROJECT_STATUS.md`
+- `docs/PROJECT_REVIEW_REPORT.md`
+- `docs/evidence/ops/2026-03-27/e2e/ADMIN_BOOTSTRAP_CLOSURE_20260327-173914.md`
+- `docs/evidence/ops/2026-03-27/sca/SCA_SUMMARY_20260327-181910.md`
+- `docs/evidence/ops/2026-03-27/observability/LOCAL_BASELINE_20260327-182005.md`
+- `docs/evidence/ops/2026-03-27/alerting/ALERTING_PACKAGE_20260327-182058.md`
+- `docs/evidence/ops/2026-03-27/backup-restore/20260327-182059/`
+- `docs/evidence/ops/2026-03-27/config-isolation/20260327-182059/`
+- `docs/evidence/ops/2026-03-27/rollback/20260327-182059/`
+- `docs/evidence/ops/2026-03-27/secret-boundary/20260327-181910/`
+
+## 8. 2026-03-28 Q-004 Closure Update
+
+- Real status update:
+  - `Q-004` is improved again, but still cannot be honestly declared closed.
+- Newly closed frontend hotspot:
+  - `frontend/admin/src/app/router.tsx` is now at `100 / 100 / 100 / 100`.
+- Validation evidence added:
+  - targeted router test
+  - full frontend `test:run`
+  - `lint`
+  - `build`
+  - full frontend `test:coverage`
+- Current frontend full coverage after this pass:
+  - statements `90.74%`
+  - branches `77.74%`
+  - functions `87.40%`
+  - lines `90.87%`
+- Main remaining `Q-004` frontend hotspots now narrow to:
+  - `src/pages/admin/DashboardPage/DashboardPage.tsx`
+  - `src/components/feedback/PageState/PageState.tsx`
+  - additional lower-coverage shared/admin surfaces outside this pass
+- Real hygiene gap still open:
+  - the successful frontend coverage run still prints one post-summary jsdom `AggregateError` network-noise line
+- Evidence:
+  - `docs/evidence/ops/2026-03-28/quality/COVERAGE_REMEDIATION_20260328-121611.md`
+
+## 9. 2026-03-28 Dashboard Closure Update
+
+- Real status update:
+  - `Q-004` improved again, but still cannot be honestly declared closed.
+- Newly closed frontend hotspot:
+  - `frontend/admin/src/pages/admin/DashboardPage/DashboardPage.tsx` is now at `100 / 100 / 100 / 100`.
+- Validation evidence added:
+  - targeted dashboard test
+  - `lint`
+  - `build`
+  - full frontend `test:coverage`
+- Current frontend full coverage after this pass:
+  - statements `91.66%`
+  - branches `78.26%`
+  - functions `87.86%`
+  - lines `91.82%`
+- Main remaining `Q-004` frontend hotspots now narrow to:
+  - `src/components/feedback/PageState/PageState.tsx`
+  - additional lower-coverage shared/admin surfaces outside this pass
+- Real hygiene gap still open:
+  - the successful frontend coverage run still prints one post-summary jsdom `AggregateError` network-noise line
+- Evidence:
+  - `docs/evidence/ops/2026-03-28/quality/COVERAGE_REMEDIATION_20260328-122517.md`
+
+## 10. 2026-03-28 PageState Closure Update
+
+- Real status update:
+  - `Q-004` improved again, but still cannot be honestly declared closed.
+- Newly closed frontend hotspot:
+  - `frontend/admin/src/components/feedback/PageState/PageState.tsx` is now at `100 / 100 / 100 / 100`.
+- Validation evidence added:
+  - targeted PageState test
+  - `lint`
+  - `build`
+  - full frontend `test:coverage`
+- Current frontend full coverage after this pass:
+  - statements `91.71%`
+  - branches `78.52%`
+  - functions `88.01%`
+  - lines `91.86%`
+- Main remaining `Q-004` frontend hotspots now narrow to:
+  - `src/layouts/AdminLayout/AdminLayout.tsx`
+  - `src/pages/admin/ImportExportPage/ImportExportPage.tsx`
+  - `src/lib/errors/AppError.ts`
+  - `src/lib/storage/token-storage.ts`
+  - additional lower-coverage shared/admin surfaces outside this pass
+- Real hygiene gap still open:
+  - the successful frontend coverage run still prints one post-summary jsdom `AggregateError` network-noise line
+- Evidence:
+  - `docs/evidence/ops/2026-03-28/quality/COVERAGE_REMEDIATION_20260328-123228.md`
+
+## 11. 2026-03-28 AdminLayout Closure Update
+
+- Real status update:
+  - `Q-004` improved again, but still cannot be honestly declared closed.
+- Newly closed frontend hotspot:
+  - `frontend/admin/src/layouts/AdminLayout/AdminLayout.tsx` is now at `100 / 100 / 100 / 100`.
+- Validation evidence added:
+  - targeted AdminLayout test
+  - `lint`
+  - `build`
+  - full frontend `test:coverage`
+- Current frontend full coverage after this pass:
+  - statements `92.06%`
+  - branches `79.29%`
+  - functions `89.09%`
+  - lines `92.22%`
+- Main remaining `Q-004` frontend hotspots now narrow to:
+  - `src/lib/storage/token-storage.ts`
+  - `src/lib/errors/AppError.ts`
+  - `src/pages/admin/ImportExportPage/ImportExportPage.tsx`
+  - `src/pages/NotFoundPage/NotFoundPage.tsx`
+  - additional lower-coverage shared/admin surfaces outside this pass
+- Real hygiene gap still open:
+  - the successful frontend coverage run still prints one post-summary jsdom `AggregateError` network-noise line
+- Evidence:
+  - `docs/evidence/ops/2026-03-28/quality/COVERAGE_REMEDIATION_20260328-124756.md`
+
+## 12. 2026-03-28 Token Storage Closure Update
+
+- Real status update:
+  - `Q-004` improved again, but still cannot be honestly declared closed.
+- Newly closed frontend hotspot:
+  - `frontend/admin/src/lib/storage/token-storage.ts` is now at `100 / 100 / 100 / 100`.
+- Validation evidence added:
+  - targeted token-storage test
+  - `lint`
+  - `build`
+  - full frontend `test:coverage`
+- Current frontend full coverage after this pass:
+  - statements `92.32%`
+  - branches `79.63%`
+  - functions `89.70%`
+  - lines `92.49%`
+- Main remaining `Q-004` frontend hotspots now narrow to:
+  - `src/lib/errors/AppError.ts`
+  - `src/pages/admin/ImportExportPage/ImportExportPage.tsx`
+  - `src/pages/NotFoundPage/NotFoundPage.tsx`
+  - additional lower-coverage shared/admin surfaces outside this pass
+- Real hygiene gap still open:
+  - the successful frontend coverage run still prints one post-summary jsdom `AggregateError` network-noise line
+- Evidence:
+  - `docs/evidence/ops/2026-03-28/quality/COVERAGE_REMEDIATION_20260328-125454.md`
+
+## 13. 2026-03-28 AppError Closure Update
+
+- Real status update:
+  - `Q-004` improved again, but still cannot be honestly declared closed.
+- Newly closed frontend hotspot:
+  - `frontend/admin/src/lib/errors/AppError.ts` is now at `100 / 100 / 100 / 100`.
+  - `frontend/admin/src/lib/errors/index.ts` is now at `100 / 100 / 100 / 100`.
+- Validation evidence added:
+  - targeted AppError module test
+  - `lint`
+  - `build`
+  - full frontend `test:coverage`
+- Current frontend full coverage after this pass:
+  - statements `93.07%`
+  - branches `81.35%`
+  - functions `90.32%`
+  - lines `93.26%`
+- Main remaining `Q-004` frontend hotspots now narrow to:
+  - `src/pages/admin/ImportExportPage/ImportExportPage.tsx`
+  - `src/pages/NotFoundPage/NotFoundPage.tsx`
+  - `src/lib/hooks/useBreadcrumbs.ts`
+  - `src/app/providers/ThemeProvider.tsx`
+  - additional lower-coverage shared/admin surfaces outside this pass
+- Real hygiene gap still open:
+  - the successful frontend coverage run still prints one post-summary jsdom `AggregateError` network-noise line
+- Evidence:
+  - `docs/evidence/ops/2026-03-28/quality/COVERAGE_REMEDIATION_20260328-140215.md`
+## 1.4 2026-03-28 Q-004 latest remediation note XIV
+
+- `Q-004` was remediated further again after the previous addendum and still remains open.
+- Newly verified outcomes:
+  - frontend overall coverage is now `93.56 / 81.95 / 90.93 / 93.71`
+  - `src/pages/admin/ImportExportPage/ImportExportPage.tsx` is now `100 / 100 / 100 / 100`
+- The latest remediation closed one more previously real frontend hotspot:
+  - `ImportExportPage.tsx` is no longer an open `Q-004` gap
+- The updated real boundary remains:
+  - `Q-004` still cannot be truthfully closed
+  - after the import/export page was closed, the remaining higher-value frontend gaps narrow further to `NotFoundPage`, `useBreadcrumbs`, `ThemeProvider`, and the still-open coverage-noise hygiene issue
+- The validation hygiene note changed slightly but remains materially open:
+  - `ImportExportPage` tests no longer emit the extra jsdom `window.getComputedStyle(..., pseudoElt)` noise from `rc-table`
+  - `npm.cmd run test:coverage` still passed again while emitting post-summary jsdom `AggregateError` network-noise lines
+- Latest evidence for this addendum:
+  - `docs/evidence/ops/2026-03-28/quality/COVERAGE_REMEDIATION_20260328-142248.md`
+## 1.5 2026-03-28 Q-004 latest remediation note XV
+
+- `Q-004` was remediated further again after the previous addendum and still remains open.
+- Newly verified outcomes:
+  - frontend overall coverage is now `93.69 / 81.95 / 91.24 / 93.85`
+  - `src/pages/NotFoundPage/NotFoundPage.tsx` is now `100 / 100 / 100 / 100`
+- The latest remediation closed one more previously real frontend hotspot:
+  - `NotFoundPage.tsx` is no longer an open `Q-004` gap
+- The updated real boundary remains:
+  - `Q-004` still cannot be truthfully closed
+  - after the 404 page was closed, the remaining higher-value frontend gaps narrow further to `useBreadcrumbs`, `ThemeProvider`, and the still-open coverage-noise hygiene issue
+- The validation hygiene note remains materially open:
+  - `npm.cmd run test:coverage` still passed again while emitting post-summary jsdom `AggregateError` network-noise lines
+- Latest evidence for this addendum:
+  - `docs/evidence/ops/2026-03-28/quality/COVERAGE_REMEDIATION_20260328-143209.md`
+## 1.6 2026-03-28 Q-004 latest remediation note XVI
+
+- `Q-004` was remediated further again after the previous addendum and still remains open.
+- Newly verified outcomes:
+  - frontend overall coverage is now `93.84 / 82.29 / 91.21 / 94.01`
+  - `src/lib/hooks/useBreadcrumbs.ts` is now `100 / 100 / 100 / 100`
+- The latest remediation closed one more previously real frontend hotspot:
+  - `useBreadcrumbs.ts` is no longer an open `Q-004` gap
+- This pass also removed one small piece of dead frontend complexity:
+  - the hook's parent-injection branch was redundant under the current route model and has been removed rather than artificially test-forced
+- The updated real boundary remains:
+  - `Q-004` still cannot be truthfully closed
+  - after the breadcrumb hook was closed, the remaining higher-value frontend gaps narrow further to `ThemeProvider` plus the still-open coverage-noise hygiene issue
+- The validation hygiene note remains materially open:
+  - `npm.cmd run test:coverage` still passed again while emitting post-summary jsdom `AggregateError` network-noise lines
+- Latest evidence for this addendum:
+  - `docs/evidence/ops/2026-03-28/quality/COVERAGE_REMEDIATION_20260328-144036.md`
+## 1.7 2026-03-28 Q-004 latest remediation note XVII
+
+- `Q-004` was remediated further again after the previous addendum and still remains open.
+- Newly verified outcomes:
+  - frontend overall coverage is now `93.93 / 82.29 / 91.37 / 94.10`
+  - `src/app/providers/ThemeProvider.tsx` is now `100 / 100 / 100 / 100`
+- The latest remediation closed one more previously real frontend hotspot:
+  - `ThemeProvider.tsx` is no longer an open `Q-004` gap
+- The updated real boundary remains:
+  - `Q-004` still cannot be truthfully closed
+  - after the theme provider was closed, the remaining frontend gap for this closure track narrows to the still-open post-summary jsdom `AggregateError` coverage-noise issue
+- The validation hygiene note remains materially open:
+  - `npm.cmd run test:coverage` still passed again while emitting post-summary jsdom `AggregateError` network-noise lines
+- Latest evidence for this addendum:
+  - `docs/evidence/ops/2026-03-28/quality/COVERAGE_REMEDIATION_20260328-144756.md`
+## 1.8 2026-03-28 Q-004 latest remediation note XVIII
+
+- `Q-004` for the `frontend/admin` closure track can now be truthfully closed.
+- Newly verified outcomes:
+  - frontend overall coverage is now `93.98 / 82.29 / 91.37 / 94.15`
+  - `src/app/router.tsx` remains `100 / 100 / 100 / 100` in the latest full-suite coverage run
+  - full frontend coverage completed with `54` passing test files and `248` passing tests
+- The final materially open blocker is now closed:
+  - the successful `npm.cmd run test:coverage` run no longer emits the previously recurring post-summary jsdom `AggregateError` network-noise lines
+- The real closure boundary is now:
+  - all previously identified frontend hotspots in this `Q-004` closure track remain closed
+  - the validation hygiene path is clean enough to honestly close `Q-004`
+  - a separate npm global config warning still prints after command completion, but it is external environment noise rather than a project-generated failure
+- Latest evidence for this addendum:
+  - `docs/evidence/ops/2026-03-28/quality/COVERAGE_REMEDIATION_20260328-151952.md`
+## 1.9 2026-03-28 Q-005 SCA closure note XIX
+
+- `Q-005` can now be truthfully closed.
+- Newly verified outcomes:
+  - `npm audit production` is now `0`
+  - `npm audit full` is now `0`
+  - `govulncheck reachable findings` remain `0`
+- The remediation that closed the dev-toolchain supply-chain gap was:
+  - upgrade `vite` to `8.0.3`
+  - upgrade `vitest` and `@vitest/coverage-v8` to `4.1.2`
+  - upgrade `typescript-eslint` to `8.57.2`
+  - pin vulnerable transitive chains with `overrides` for `picomatch` and `brace-expansion`
+- Re-verification after the dependency update also passed:
+  - `frontend/admin` `lint`
+  - `frontend/admin` production `build`
+  - full frontend `test:coverage`
+- The updated real boundary is now:
+  - `Q-004` and `Q-005` are both closed for the current closure track
+  - the next unclosed cross-cutting governance gap is `Q-006` external alert delivery evidence
+  - the separate product/external-proof boundary around live third-party OAuth provider browser evidence also still remains
+- Latest evidence for this addendum:
+  - `docs/evidence/ops/2026-03-28/sca/SCA_SUMMARY_20260328-220806.md`
+## 2.0 2026-03-29 Q-006 readiness note XX
+
+- `Q-006` still cannot be truthfully closed, but the repo-side closure path is stricter than before.
+- Newly verified outcomes:
+  - alerting package structural validation still passes on the latest run
+  - render drill still passes on the latest run
+  - a new strict live-delivery drill now exists and fails closed on placeholder/example values
+- The latest repo-side hardening for this gap is:
+  - add `scripts/ops/drill-alertmanager-live-delivery.ps1`
+  - refuse unresolved placeholders, `example.*` addresses/hosts, and placeholder secrets before any network attempt
+  - emit only redacted config artifacts and masked recipient evidence
+  - remove the date-rollover false blocker in `validate-alerting-package.ps1` by falling back to the latest available baseline evidence
+- The updated real boundary is now:
+  - repo-side alert delivery verification tooling is materially better prepared
+  - `Q-006` remains open because no real non-placeholder on-call delivery environment has been injected and no successful live SMTP acceptance evidence has yet been captured
+  - the remaining closure work is external-environment proof, not another repo-local template/rendering fix
+- Latest evidence for this addendum:
+  - `docs/evidence/ops/2026-03-29/alerting/ALERTING_PACKAGE_20260329-100316.md`
+  - `docs/evidence/ops/2026-03-29/alerting/20260329-100315/ALERTMANAGER_RENDER_DRILL.md`
+  - `docs/evidence/ops/2026-03-29/alerting/20260329-100315/ALERTMANAGER_LIVE_DELIVERY_DRILL.md`