esz135888 · May 23, 2026 23:23
diff --git a/artifact-url-or-pr.md b/artifact-url-or-pr.md
diff --git a/data-model.md b/data-model.md
diff --git a/decision-record.md b/decision-record.md
diff --git a/e2e-verification.md b/e2e-verification.md
diff --git a/learning-memory.json b/learning-memory.json
 {
  "job_id": "0973965a-7a9a-4ed6-a7bb-e8c4a5246ec0",
  "topic_key": "github-delivery-and-repo-context",
  "project_name": "言文字（共學空間）",
  "commit_sha": "a531cba",
  "actor": "Hsu-Pei-Chun",
  "learning": [
    "Company-level repo delivery signals include auth-sensitive commits that need security release gates, not only project status summaries.",
    "Admin password reset delivery should always carry owner, audit, temporary credential handling, forced-change proof, and rollback.",
    "When PLS context lacks repo/PR/deploy URLs, produce a release-readiness artifact and clearly mark code verification as pending."
  ],
  "next_round": [
    "Ask PLS to include repo URL, PR URL, deploy target, and test artifacts in GitHub delivery jobs.",
    "Create reusable auth-sensitive delivery checklist for password reset, login, role, and member access changes.",
    "If auth-sensitive commits repeat, upgrade project pack into watchdog or governance workflow."
  ]
 }

diff --git a/market-maturity.md b/market-maturity.md
diff --git a/people-sync.md b/people-sync.md
diff --git a/production-acceptance.md b/production-acceptance.md
diff --git a/production-brief.md b/production-brief.md
diff --git a/project-management-pack.md b/project-management-pack.md
diff --git a/release-scorecard.csv b/release-scorecard.csv
diff --git a/repo-delivery-card.html b/repo-delivery-card.html
 <!doctype html>
 <html lang="zh-Hant">
 <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Auth-Sensitive Repo Delivery</title>
  <style>
    body { margin: 0; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; background: #f6f8fb; color: #1f2937; }
    main { max-width: 920px; margin: 0 auto; padding: 28px 18px; }
    section { background: #fff; border: 1px solid #d7dce5; border-radius: 8px; padding: 22px; }
    h1 { margin: 0 0 8px; font-size: 24px; line-height: 1.25; }
    h2 { margin: 22px 0 8px; font-size: 16px; }
    p, li { font-size: 15px; line-height: 1.55; }
    .badge { display: inline-block; border: 1px solid #d7a44a; color: #8a5a00; border-radius: 999px; padding: 4px 10px; font-size: 13px; font-weight: 650; }
    .grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(190px, 1fr)); gap: 10px; margin: 18px 0; }
    .cell { border: 1px solid #d7dce5; border-radius: 6px; padding: 10px; background: #fbfcff; }
    .label { display: block; color: #667085; font-size: 12px; margin-bottom: 4px; }
    code { font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; font-size: 13px; }
    .reply { background: #fff8e8; border-left: 4px solid #d7a44a; border-radius: 4px; padding: 12px 14px; }
  </style>
 </head>
 <body>
  <main>
    <section>
      <span class="badge">Security-sensitive release gate</span>
      <h1>言文字 admin password reset delivery</h1>
      <p>Commit <code>a531cba</code> by Hsu-Pei-Chun adds admin reset for member passwords, temporary password generation, and <code>must_change_password</code> forced change after login.</p>
      <div class="grid">
        <div class="cell"><span class="label">Project</span>言文字（共學空間）</div>
        <div class="cell"><span class="label">Owner</span>Product + engineering + admin/support</div>
        <div class="cell"><span class="label">Due</span>2026-05-24 18:00</div>
        <div class="cell"><span class="label">Decision</span>pass / limited / block</div>
      </div>
      <h2>D1 Evidence Needed</h2>
      <ul>
        <li>Admin-only permission test.</li>
        <li>Temporary password expiry and non-plain storage proof.</li>
        <li><code>must_change_password</code> blocks normal use until change.</li>
        <li>Audit log with admin, member, reason, timestamp, completion.</li>
        <li>Rollback path to disable route and invalidate temporary credentials.</li>
      </ul>
      <h2>Reply Format</h2>
      <div class="reply"><code>status=pass|limited|block; evidence=&lt;url/screenshot&gt;; blocker=&lt;none/text&gt;; owner=&lt;name&gt;; due=&lt;date&gt;</code></div>
    </section>
  </main>
 </body>
 </html>

diff --git a/signal-annotations.md b/signal-annotations.md
diff --git a/skill-usage.md b/skill-usage.md
diff --git a/solution-selection.md b/solution-selection.md
	{
	"job_id": "0973965a-7a9a-4ed6-a7bb-e8c4a5246ec0",
	"topic_key": "github-delivery-and-repo-context",
	"project_name": "言文字（共學空間）",
	"commit_sha": "a531cba",
	"actor": "Hsu-Pei-Chun",
	"learning": [
	"Company-level repo delivery signals include auth-sensitive commits that need security release gates, not only project status summaries.",
	"Admin password reset delivery should always carry owner, audit, temporary credential handling, forced-change proof, and rollback.",
	"When PLS context lacks repo/PR/deploy URLs, produce a release-readiness artifact and clearly mark code verification as pending."
	],
	"next_round": [
	"Ask PLS to include repo URL, PR URL, deploy target, and test artifacts in GitHub delivery jobs.",
	"Create reusable auth-sensitive delivery checklist for password reset, login, role, and member access changes.",
	"If auth-sensitive commits repeat, upgrade project pack into watchdog or governance workflow."
	]
	}
Risk	Severity	Owner	Mitigation	Gate
Temporary password exposed	High	Engineering	Expiry, one-time use, safe delivery channel	D1
Admin abuse	High	Product owner	Role check and audit trail	D1
Missing forced change	High	Engineering	`must_change_password` blocks normal app use	D1
Weak password policy	Medium	Engineering	Block common/compromised secrets where available	D7
Support confusion	Medium	Admin/support	SOP and LINE/admin script	D7
item	owner	status	evidence_ref	due	gate
admin_only_route	Hsu-Pei-Chun	pending		2026-05-24	D1
temporary_password_expiry	Hsu-Pei-Chun	pending		2026-05-24	D1
must_change_password_enforced	Hsu-Pei-Chun	pending		2026-05-24	D1
audit_log_fields	product_owner	pending		2026-05-24	D1
support_sop	admin_support_owner	pending		2026-05-31	D7
rollback_plan	engineering_owner	pending		2026-05-31	D7
	<!doctype html>
	<html lang="zh-Hant">
	<head>
	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1">
	<title>Auth-Sensitive Repo Delivery</title>
	<style>
	body { margin: 0; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; background: #f6f8fb; color: #1f2937; }
	main { max-width: 920px; margin: 0 auto; padding: 28px 18px; }
	section { background: #fff; border: 1px solid #d7dce5; border-radius: 8px; padding: 22px; }
	h1 { margin: 0 0 8px; font-size: 24px; line-height: 1.25; }
	h2 { margin: 22px 0 8px; font-size: 16px; }
	p, li { font-size: 15px; line-height: 1.55; }
	.badge { display: inline-block; border: 1px solid #d7a44a; color: #8a5a00; border-radius: 999px; padding: 4px 10px; font-size: 13px; font-weight: 650; }
	.grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(190px, 1fr)); gap: 10px; margin: 18px 0; }
	.cell { border: 1px solid #d7dce5; border-radius: 6px; padding: 10px; background: #fbfcff; }
	.label { display: block; color: #667085; font-size: 12px; margin-bottom: 4px; }
	code { font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; font-size: 13px; }
	.reply { background: #fff8e8; border-left: 4px solid #d7a44a; border-radius: 4px; padding: 12px 14px; }
	</style>
	</head>
	<body>
	<main>
	<section>
	<span class="badge">Security-sensitive release gate</span>
	<h1>言文字 admin password reset delivery</h1>
	<p>Commit <code>a531cba</code> by Hsu-Pei-Chun adds admin reset for member passwords, temporary password generation, and <code>must_change_password</code> forced change after login.</p>
	<div class="grid">
	<div class="cell"><span class="label">Project</span>言文字（共學空間）</div>
	<div class="cell"><span class="label">Owner</span>Product + engineering + admin/support</div>
	<div class="cell"><span class="label">Due</span>2026-05-24 18:00</div>
	<div class="cell"><span class="label">Decision</span>pass / limited / block</div>
	</div>
	<h2>D1 Evidence Needed</h2>
	<ul>
	<li>Admin-only permission test.</li>
	<li>Temporary password expiry and non-plain storage proof.</li>
	<li><code>must_change_password</code> blocks normal use until change.</li>
	<li>Audit log with admin, member, reason, timestamp, completion.</li>
	<li>Rollback path to disable route and invalidate temporary credentials.</li>
	</ul>
	<h2>Reply Format</h2>
	<div class="reply"><code>status=pass\|limited\|block; evidence=<url/screenshot>; blocker=<none/text>; owner=<name>; due=<date></code></div>
	</section>
	</main>
	</body>
	</html>