From ddc4e8380f47180805ad44ff5508f9fd18d0ff90 Mon Sep 17 00:00:00 2001
From: randypanding <randypanding@users.noreply.github.com>
Date: Sat, 29 Aug 2026 10:04:56 +0000
Subject: [PATCH 1/2] =?UTF-8?q?fix:=20elevation=20role=20=E5=88=A4?=
 =?UTF-8?q?=E5=AE=9A=E5=85=BC=E5=AE=B9=20org=20=E4=BB=93=20MEMBER=20?=
 =?UTF-8?q?=E8=AF=AD=E4=B9=89=20+=20=E5=BD=B1=E5=AD=90=20actor.role=20?=
 =?UTF-8?q?=E6=9E=9A=E4=B8=BE=E6=98=A0=E5=B0=84=EF=BC=88W2-C4=20=E5=AE=9E?=
 =?UTF-8?q?=E6=B5=8B=E7=BC=BA=E9=99=B7=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

实测（run 33246847376/33246848965）两缺陷：
- org 仓 owner 的 author_association 呈 MEMBER 而非 OWNER（一人公司语境
  MEMBER 即 owner 本人）→ 正向请求被误判 role=none 而拒；
- 裁决 role=none 直写影子账本 actor.role → 枚举校验 exit 3（合法集
  owner/agent/bot/human），deny 记录落账失败。

修复：OWNER/MEMBER→owner；none→human（事实身份）入账。

Card: Cloudbird-Software/.github#415
---
 .github/workflows/elevation.yml | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/elevation.yml b/.github/workflows/elevation.yml
index eeba438..a6d5dce 100644
--- a/.github/workflows/elevation.yml
+++ b/.github/workflows/elevation.yml
@@ -8,8 +8,9 @@ name: elevation
 # 铁律对齐：
 # - 默认拒绝：reason/spec_ref 缺失（HO 场景 3）、能力未声明、角色不匹配、
 #   TTL 越界 → deny（裁决逻辑唯一真源=governance/elevation.py，纯函数可测）。
-# - 判定锚点机械（INV-01/02）：role 取 GitHub author_association（OWNER→owner）
-#   与 actor 身份（cloudbrid-agent[bot]→agent），workflow 不自判。
+# - 判定锚点机械（INV-01/02）：role 取 GitHub author_association（org 仓
+#   OWNER/MEMBER→owner——一人公司语境 MEMBER 即 owner 本人）与 actor 身份
+#   （cloudbrid-agent[bot]→agent），workflow 不自判。
 # - append-only（ADR-0062）：账本经 evidence_shadow.py 链式追加，验链后推送；
 #   幂等=delivery_id（评论 id）已入账即 no-op（重复投递不双写）。
 # - v0 边界：裁决+记账+TTL 收回闭环；不铸造真实平台凭证（提权档
@@ -62,10 +63,15 @@ jobs:
           CARD="Cloudbird-Software/.github#${ISSUE_N}"
           printf '%s\n' "$COMMENT_BODY" >"$TMP/comment.txt"
 
-          # role 判定锚点机械（INV-01）：OWNER→owner；cloudbrid-agent App→agent；其余→none
-          if [[ "$AUTHOR_ASSOC" == "OWNER" ]]; then ROLE=owner
+          # role 判定锚点机械（INV-01）：OWNER/MEMBER→owner（org 仓 owner 的
+          # author_association 呈 MEMBER——一人公司语境 MEMBER 即 owner 本人，
+          # 2026-08-29 实测）；cloudbrid-agent App→agent；其余→none
+          if [[ "$AUTHOR_ASSOC" == "OWNER" || "$AUTHOR_ASSOC" == "MEMBER" ]]; then ROLE=owner
           elif [[ "$ACTOR" == "cloudbrid-agent[bot]" ]]; then ROLE=agent
           else ROLE=none; fi
+          # 影子账本 actor.role 枚举（owner/agent/bot/human）：裁决 role=none 的
+          # 请求方按事实身份记 human（none 非法枚举——实测 exit 3）
+          if [[ "$ROLE" == "none" ]]; then AROLE=human; else AROLE=$ROLE; fi
           echo "role=$ROLE (assoc=$AUTHOR_ASSOC actor=$ACTOR)"
 
           # ---- 台账基线（clone elevation-ledger；不存在=创世） ----
@@ -103,7 +109,7 @@ jobs:
           # ---- 台账追加（schema v1 链式 hash；kind=approval，AC-9c subject 可查询） ----
           V=$(cat "$TMP/verdict.json")
           jq -n --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" --arg card "$CARD" \
-              --arg requester "$REQUESTER" --arg role "$ROLE" --argjson v "$V" \
+              --arg requester "$REQUESTER" --arg role "$AROLE" --argjson v "$V" \
               '{ts:$ts, kind:"approval", action:("elevation."+$v.verdict), verdict:$v.verdict,
                 subject:{card:$card, tenant:"cloudbird-internal"},
                 actor:{identity:$requester, role:$role},

From a5623e2539bb2eb5f2bfc215641bcf495131c592 Mon Sep 17 00:00:00 2001
From: randypanding <randypanding@users.noreply.github.com>
Date: Sat, 29 Aug 2026 10:14:12 +0000
Subject: [PATCH 2/2] =?UTF-8?q?fix:=20elevation=20sweep=20revoke=20?=
 =?UTF-8?q?=E4=BA=8B=E4=BB=B6=20payload=20=E9=A1=BB=E4=B8=BA=E5=AD=97?=
 =?UTF-8?q?=E7=AC=A6=E4=B8=B2=EF=BC=88schema=20v1=EF=BC=8CW2-C4=20?=
 =?UTF-8?q?=E5=AE=9E=E6=B5=8B=E7=BC=BA=E9=99=B7=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

实测（run 33247268672）：sweep 到期 grant 补 revoke 时 payload 以对象形态
构造 → evidence_shadow 枚举校验 exit 3（schema v1 要求 payload=字符串或
null）。改 |tojson（与 adjudicate job 同款）。

Card: Cloudbird-Software/.github#415
---
 .github/workflows/elevation.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/elevation.yml b/.github/workflows/elevation.yml
index a6d5dce..b982350 100644
--- a/.github/workflows/elevation.yml
+++ b/.github/workflows/elevation.yml
@@ -172,7 +172,7 @@ jobs:
               '{ts:$ts, kind:"approval", action:"elevation.revoke", verdict:"revoked",
                 subject:{card:$g.card, tenant:"cloudbird-internal"},
                 actor:{identity:"elevation-bot", role:"bot"},
-                payload:{elevation_id:$g.elevation_id, capability:$g.capability, cause:"ttl-expired"}}' >event.json
+                payload:({elevation_id:$g.elevation_id, capability:$g.capability, cause:"ttl-expired"}|tojson)}' >event.json
             python3 governance/evidence_shadow.py append --file "$LED" --event-file event.json
             i=$((i + 1))
           done