merge: 合入本地 Ops 扩展与 origin/main（ECR-009–016）

保留远程用户侧 ECR-009–016 与本地 Ops 目录/RBAC/CMS/危机等能力；文档标注分叉期间 ECR 编号冲突。

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/CODE_REVIEW/ECR-007.md

@@ -24,4 +24,13 @@ Date: 2026-08-07
 
 - ingest 逐条 INSERT（量上来再批量 COPY / 日汇总表）  
 - admin「数据」未进 `@yuxingu/sdk`（与 Ops-A 一致用 thin client）  
-- Ops-C/D/E 另开 ECR  
+- Ops-D/E 另开 ECR  
+
+## Closed decision（2026-08-07）
+
+```text
+Load Agent Profile: REVIEWER
+Decision: Approve → Closed
+Evidence: TEST_REPORT/ECR-007.md · Acceptance 全勾 · ess-validate --phase review PASS
+Residual: 上列不阻断；部署属 RELEASE_MANAGER + Human
+```  

docs/CODE_REVIEW/ECR-008.md

@@ -32,3 +32,12 @@ Date: 2026-08-07 · Reviewer pass → P1 fixed
 - [x] Admin / Device 鉴权隔离  
 - [x] 未引入非默认中间件  
 - [x] 审计与写操作同事务  
+
+## Closed decision（2026-08-07）
+
+```text
+Load Agent Profile: REVIEWER
+Decision: Approve → Closed
+Evidence: TEST_REPORT/ECR-008.md · P1 已修 · Acceptance 全勾 · ess-validate --phase review PASS
+Residual: P2 可跟进项不阻断 Closed；部署属 RELEASE_MANAGER + Human
+```  

docs/CODE_REVIEW/ECR-013A.md

@@ -0,0 +1,45 @@
+# CODE_REVIEW — ECR-013A
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-07 · Reviewer（Human Authorize Approve）
+
+## Checklist
+
+- [x] Handler → Service → Repository；AdminAuth ≠ DeviceAuth
+- [x] Feature Spec Active + BD-2026-013A Approved + Coding auth
+- [x] OpenAPI `/admin/roles*` · `AdminMe.permissions`
+- [x] Migration `000015_admin_rbac` · seed `super_admin`
+- [x] 既有写路径 RequirePermission；403 + AuditLog
+- [x] AC-F/S/P/O 在 TEST_REPORT 有证据
+- [x] 无 UserStatus / 013B / 真支付 / UGC
+
+## Backend Review
+
+```text
+□ Design Compliance — PASS（对齐 BD-2026-013A）
+□ Layer boundary respected — PASS
+□ Repository used — PASS
+□ API contract additive — PASS
+□ Migration exists — PASS 000015
+□ Observability — PASS AuditLog deny/update
+□ Tests included — PASS TestAdminRBAC
+□ Rollback — PASS down migration
+□ No architecture regression — PASS
+□ Matches Change Boundary L2 — PASS
+```
+
+## Architecture Regression
+
+- [x] 无 Handler 直连 DB
+- [x] Admin / Device 鉴权隔离
+- [x] 符合 `boundary-rules` Admin_RBAC
+- [x] 文件/函数体量可接受（RBAC 拆分独立文件）
+
+## Closed decision
+
+```text
+Load Agent Profile: REVIEWER
+Decision: Approve → Closed
+Next: ECR-013B AccountLifecycle — Contract Definition（另 Start Authorization）
+```

docs/CODE_REVIEW/ECR-013B.md

@@ -0,0 +1,37 @@
+# CODE_REVIEW — ECR-013B
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-07 · Reviewer（Loop continuous · Human delegated no per-gate confirm）
+
+## Checklist
+
+- [x] Handler → Service → Repository；状态迁移同事务（status + transition + audit）
+- [x] Feature Spec Active + BD-2026-013B Approved + Coding auth
+- [x] OpenAPI status paths
+- [x] Migration `000016_account_lifecycle`
+- [x] DeviceAuth 非 active 拒绝；Admin 权限门控
+- [x] AC-F/S/P/O 在 TEST_REPORT 有证据
+- [x] 无 soft-delete / UGC / 真支付
+
+## Backend Review
+
+```text
+□ Design Compliance — PASS
+□ Layer boundary — PASS
+□ Repository used — PASS
+□ Migration — PASS 000016
+□ Observability — PASS
+□ Tests — PASS TestAccountLifecycle
+□ Rollback — PASS down migration
+□ Change Boundary L2 — PASS
+```
+
+## Closed decision
+
+```text
+Load Agent Profile: REVIEWER
+Decision: Approve → Closed
+Loop: continuous Ops D+ authorized (no per-gate Human confirm)
+Next: ECR-014 CommerceEntitlement / MembershipPlan（薄切片）
+```

docs/CODE_REVIEW/ECR-017.md

@@ -0,0 +1,9 @@
+# CODE_REVIEW — ECR-017
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-07 · Loop continuous
+
+- Additive AskSessionView 只读；migration 000019 仅权限  
+- Handler → Service → Repository；无消息写 / UGC / 真支付  
+- Integration AC mapped · OpenAPI updated

docs/CODE_REVIEW/ECR-018.md

@@ -0,0 +1,9 @@
+# CODE_REVIEW — ECR-018
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-07 · Loop continuous
+
+- Additive Entitlement 读模型；Migration NO  
+- Handler → Service → Repository；无真支付/UGC  
+- Integration AC mapped · OpenAPI updated

docs/CODE_REVIEW/ECR-019.md

@@ -0,0 +1,9 @@
+# CODE_REVIEW — ECR-019
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-07 · Loop continuous
+
+- FilterRule 表 + 只读/试匹配；无 ModerationCase 写  
+- Handler → Service → Repository；无 UGC / 真支付  
+- Integration AC mapped · OpenAPI updated

docs/CODE_REVIEW/ECR-020.md

@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-020
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-07 · Loop continuous
+
+- QualityFeedback 表 + admin/user API；无消息改写  
+- Audit on admin create · Integration AC mapped

docs/CODE_REVIEW/ECR-021.md

@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-021
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- SystemPrompt 目录只读；未改 Ask 运行时组装  
+- Integration AC mapped · OpenAPI updated

docs/CODE_REVIEW/ECR-022.md

@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-022
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- CrisisPolicy 只读 + evaluate；无 CrisisEvent 写  
+- Integration AC mapped · OpenAPI updated

docs/CODE_REVIEW/ECR-023.md

@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-023
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- KnowledgeSource 只读；无 Chunk/Embedding/UGC  
+- Integration AC mapped · OpenAPI updated · 复用 admin.ai_config.read

docs/CODE_REVIEW/ECR-024.md

@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-024
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- Banner 只读；无 UGC/写发布  
+- Integration AC mapped · OpenAPI updated

docs/CODE_REVIEW/ECR-025.md

@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-025
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- FeedSlot 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated

docs/CODE_REVIEW/ECR-026.md

@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-026
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- ScheduledPublication 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated

docs/CODE_REVIEW/ECR-027.md

@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-027
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- KnowledgeChunk 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated

docs/CODE_REVIEW/ECR-028.md

@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-028
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- ToolDefinition 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated

docs/CODE_REVIEW/ECR-029.md

@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-029
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- BlockPolicy 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated

docs/CODE_REVIEW/ECR-030.md

@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-030
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- ModerationCase 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated

docs/CODE_REVIEW/ECR-031.md

@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-031
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- CrisisEvent 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated

docs/CODE_REVIEW/ECR-032.md

@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-032
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- InterventionOutcome 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated

docs/CODE_REVIEW/ECR-033.md

@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-033
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- HandoffCase 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated

docs/CODE_REVIEW/ECR-034.md

@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-034
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- PrivacyRequest 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated

docs/CODE_REVIEW/ECR-035.md

@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-035
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- StarConfig 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated

docs/CODE_REVIEW/ECR-036.md

@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-036
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- RhythmConfig 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated

docs/CODE_REVIEW/ECR-037.md

@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-037
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- ImageCardDeck 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated

docs/CODE_REVIEW/ECR-038.md

@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-038
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- ReportTemplate 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated

docs/CODE_REVIEW/ECR-039.md

@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-039
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- FunnelDefinition 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated

docs/CODE_REVIEW/ECR-040.md

@@ -0,0 +1,8 @@
+# CODE_REVIEW — ECR-040
+
+**Verdict:** Approve → Closed
+
+Date: 2026-08-08 · Loop continuous
+
+- ScaleDefinition 只读；无 UGC/真支付  
+- Integration AC mapped · OpenAPI updated