chore(state): 合并后更新 D1 闸门、CI 与覆盖率指针

STATE.yaml

@@ -1,5 +1,5 @@
-version: 21
-last_updated: '2026-10-25T23:45:00+08:00'
+version: 22
+last_updated: '2026-10-26T15:27:00+08:00'
 project:
   name: MAREF
   current_release: 0.54.3
@@ -56,24 +56,24 @@ track_b:
   branch_protection: enabled
   ci_status:
     value: green
-    run_id: 40197782331
+    run_id: 40283282776
     workflow: MAREF CI
-    sha: 27978a4fcac9f638eeadc9870f3c7dff3bbfa396
-    verified_at: '2026-10-25T13:28:43Z'
+    sha: 820f17d10c42df1952287ff8c101fb6cca1fe0a5
+    verified_at: '2026-10-26T07:25:56Z'
   security_scan:
     value: green
-    run_id: 40197782006
+    run_id: 40283282916
     workflow: Security Scan
-    sha: 27978a4fcac9f638eeadc9870f3c7dff3bbfa396
-    verified_at: '2026-10-25T13:28:42Z'
+    sha: 820f17d10c42df1952287ff8c101fb6cca1fe0a5
+    verified_at: '2026-10-26T07:03:36Z'
   dependency_audit:
-    value: failed
-    run_id: 40204363568
+    value: green
+    run_id: 40283282879
     workflow_id: 390339508
     workflow: Dependency Audit
-    sha: 27978a4fcac9f638eeadc9870f3c7dff3bbfa396
-    verified_at: '2026-10-25T15:02:17Z'
-    detail: 'workflow_dispatch run 40204363568 于 main@27978a4 failure：main 仍为旧版 workflow（audit runner 环境 setuptools 79.0.1，3 条漏洞）；本地新版锁文件隔离流程 dry-run 0 findings，修复未提交'
+    sha: 820f17d10c42df1952287ff8c101fb6cca1fe0a5
+    verified_at: '2026-10-26T07:02:27Z'
+    detail: 'PR #457 合并后 main@820f17d1 首次运行新版 workflow 即 success；此前的 main@27978a4f failure 由旧版 workflow 引起，已随合并消除'
   internal_repo_ci:
     repo: private_internal_repo  # 内部仓名按公共仓泄漏门禁隐去
     status: blocked_external_billing
@@ -87,12 +87,12 @@ governance:
   audit_score_previous: '8.8/10 (2026-08-04)'
   audit_note: 'v0.54.3 CI stabilization on top of P0 remediation; see docs/plans/2026-10-19-audit-remediation-v0.54.1.md'
   coverage:
-    value: 76.28
-    overall: 76.28
-    source_run_id: 40205853879
-    sha: 602a211eb78989bf0ea890ec6544a969de3d11b5
-    verified_at: '2026-10-25T15:36:00Z'
-    evidence: 'CI run 40205853879（MAREF CI / test，PR #457 head 602a211e，conclusion success）产物 coverage-dc2d7162c464c1e41315a422ce23de984017e05c（github.sha = PR merge commit）：71862/90815 行，76.28%；本地 coverage_claim_check exit 0。此前本机全量复跑 76.41% 为脏工作区口径，已被本指针取代'
+    value: 76.31
+    overall: 76.31
+    source_run_id: 40283282776
+    sha: 820f17d10c42df1952287ff8c101fb6cca1fe0a5
+    verified_at: '2026-10-26T07:25:56Z'
+    evidence: 'CI run 40283282776（MAREF CI / test，main@820f17d1，conclusion success）产物 coverage-820f17d10c42df1952287ff8c101fb6cca1fe0a5：71881/90815 行，coverage.py 综合 76.31%（含分支），分支覆盖 65.07%；产物已下载本地解析核对。此前 PR 口径 76.28% 已被本指针取代'
     domains:
       governance: 87.70
       federation: 67.76
@@ -101,7 +101,7 @@ governance:
       execution: 71.62
       data_value: 95.95
     domains_note: '旧口径，未随 2026-10-24 全仓重算'
-  coverage_note: '2026-10-24 本机按 CI 标准域重跑：pytest tests/ -q --timeout=120 -m "not integration and not chaos and not benchmark and not slow and not real" --ignore=tests/maref/compliance --ignore=tests/desktop --ignore=tests/test_crypto.py（addopts --cov=src）。结果 15051 passed / 14 skipped / 495 deselected / 0 failed，76.36%（71797/90641 行），耗时 6m14s，HEAD feb31444。此前 10.68%（2026-10-23，全仓 89425 行）与 52.49%（2026-08-05，8158 tests）为不同口径历史值，均已被本次替代。CI 远程复跑仍需在下次 push 后确认。下方分域覆盖率数字仍为旧口径，未随本次重算。2026-10-25 审计：无对应 SHA 的覆盖率产物留存，76.36% 标注为待复现。2026-10-25 22:56 本机再次全量复跑：15104 passed / 0 failed / 13 skipped，76.41%（71941/90749 行），430.60s，工作区含未提交改动；仍无 CI SHA 绑定。2026-10-25 23:36 起以 CI 产物为准：PR #457 run 40205853879 test job 产物 76.28%（71862/90815），coverage 节点改为数值指针；合并后 main 的 CI 复跑仍需复核。'
+  coverage_note: '2026-10-24 本机按 CI 标准域重跑：pytest tests/ -q --timeout=120 -m "not integration and not chaos and not benchmark and not slow and not real" --ignore=tests/maref/compliance --ignore=tests/desktop --ignore=tests/test_crypto.py（addopts --cov=src）。结果 15051 passed / 14 skipped / 495 deselected / 0 failed，76.36%（71797/90641 行），耗时 6m14s，HEAD feb31444。此前 10.68%（2026-10-23，全仓 89425 行）与 52.49%（2026-08-05，8158 tests）为不同口径历史值，均已被本次替代。CI 远程复跑仍需在下次 push 后确认。下方分域覆盖率数字仍为旧口径，未随本次重算。2026-10-25 审计：无对应 SHA 的覆盖率产物留存，76.36% 标注为待复现。2026-10-25 22:56 本机再次全量复跑：15104 passed / 0 failed / 13 skipped，76.41%（71941/90749 行），430.60s，工作区含未提交改动；仍无 CI SHA 绑定。2026-10-25 23:36 起以 CI 产物为准：PR #457 run 40205853879 test job 产物 76.28%（71862/90815），coverage 节点改为数值指针；2026-10-26 合并后 main@820f17d1 CI run 40283282776 复跑 76.31%（71881/90815，含分支口径），见 coverage.evidence。'
   v051_features: 13/13 (W1-W6 enterprise value closure)
   coverage_target_v0350: 50%+
   mypy_errors: 0  # 2026-08-05 修复 report_generator.py:151 arg-type 后实测清零，见 audit-reinforcement-20260805-v0.52.md H-5
@@ -158,18 +158,19 @@ submission_pipeline:
     expires: '2026-06-13'
     status: expired_or_expiring
 d1_gate:
-  value: failed
-  sha: 27978a4fcac9f638eeadc9870f3c7dff3bbfa396
-  verified_at: '2026-10-25T15:02:17Z'
+  value: passed
+  sha: 820f17d10c42df1952287ff8c101fb6cca1fe0a5
+  verified_at: '2026-10-26T07:26:07Z'
   source: 'scripts/d1_preflight_check.py --sha <sha>'
-  exit_code: 1
+  exit_code: 0
   checks:
-    G1_branch_protection: true  # 2026-10-25 --apply 后 10 contexts 生效
-    G2_ci_green: false  # sca check-run 为 failure（run 40204363568，旧版 workflow）
-    G3_security_clean: true
+    G1_branch_protection: true  # 10 contexts，10 必需
+    G2_ci_green: true  # main@820f17d1：6 个必需 check-runs 成功
+    G3_security_clean: true  # Security Scan run 40283282916
     G4_no_runtime_artifacts: true
-  detail: 'G1 已修复（branch protection --apply，--check exit 0）；G2 仍缺成功的 sca check-run；G3/G4 通过'
-  last_preflight_run: '2026-10-25'
+  detail: 'PR #457 合并为 main@820f17d1 后重跑 D1 Pre-Flight，G1–G4 全过（exit 0）'
+  evidence: docs/audit-reports/d1-preflight-820f17d1.md
+  last_preflight_run: '2026-10-26'
   last_push_blocked_by: null  # 本次审计未 push；A5 计费阻塞仅影响内部仓
   external_gate_override:  # arXiv/期刊等外部闸门已由人类决策取消，回归内功补强，不受外部影响
     arxiv_id: cancelled_by_human

docs/audit-reports/d1-preflight-820f17d1.md

@@ -0,0 +1,35 @@
+# D1 Pre-Flight 记录 — main@820f17d1
+
+- 执行时间: 2026-10-26T07:26:07Z
+- 目标: maref-org/maref@main `820f17d10c42df1952287ff8c101fb6cca1fe0a5`
+- 命令: `python3 scripts/d1_preflight_check.py --sha 820f17d10c42df1952287ff8c101fb6cca1fe0a5`
+- 执行环境: 维护者本机（与 `.githooks/pre-push` 同一脚本）
+
+## 结果
+
+| 闸门 | 结果 | 证据 |
+|------|------|------|
+| G1 Branch Protection | 通过 | 10 contexts，10 required |
+| G2 CI Status | 通过 | 6 个必需 check-runs 成功 |
+| G3 Security Scan | 通过 | Security Scan run 40283282916 (success) |
+| G4 No Runtime Artifacts | 通过 | 索引中无运行时产物 |
+
+退出码: `0`（全部通过）
+
+## 关联运行
+
+| 工作流 | run ID | 完成时间 | 结论 |
+|--------|--------|----------|------|
+| MAREF CI | 40283282776 | 2026-10-26T07:25:56Z | success |
+| Security Scan | 40283282916 | 2026-10-26T07:03:36Z | success |
+| Dependency Audit | 40283282879 | 2026-10-26T07:02:27Z | success |
+
+## 运行时证言
+
+- 证言 ref: `attestations/latest` @ `b9f2e220162112b91ec70cdd3d19fcd82dd26769`
+- 验证: `verify_runtime_attest.py --public-key configs/runtime-attest-public.pub --require-healthy`
+- 结果: `verified=true`，`key_id=1c650ce065489fd165f20cc14c948a29`，age 10077.6s（<24h），m0–m4 全为 true
+
+## 说明
+
+本记录为 D1 闸门的可追溯证据，对应 `STATE.yaml` 中 `d1_gate.value: passed`。main 分支保护要求所有变更经 PR，因此该证据随合并后的 STATE.yaml 指针更新一并提交。