chore: record verification report and state update

docs/superpowers/reports/2026-07-02-migrate-to-turborepo-verify.md

@@ -0,0 +1,81 @@
+# Verification Report: migrate-to-turborepo
+
+- Date: 2026-07-02
+- Verify Mode: full
+
+## Summary Scorecard
+
+| Dimension | Status |
+|-----------|--------|
+| Completeness | 27/27 tasks, 3 specs, 0 remaining |
+| Correctness | 11/11 requirements covered |
+| Coherence | Followed — design decisions reflected in implementation |
+
+## Fresh Verification Evidence
+
+| Check | Command | Result |
+|-------|---------|--------|
+| Build | `npm run build` | 2 successful, FULL TURBO |
+| Test | `npm run test --workspace=apps/server` | 1 passed, 1 total |
+| Typecheck | `npm run typecheck` | 2 successful |
+
+## Completeness
+
+### Tasks: 27/27 ✅
+
+All tasks checked off in tasks.md and plan. Every task has a corresponding commit.
+
+### Spec Coverage: 3/3 specs ✅
+
+**monorepo-structure** (4 requirements):
+- Monorepo directory structure ✅ — `apps/server/`, `apps/admin/`, `packages/typescript-config/` exist
+- npm workspaces configuration ✅ — root `package.json` has `workspaces: ["apps/*", "packages/*"]`
+- Shared TypeScript configuration ✅ — `packages/typescript-config/` with base/nestjs/react-vite presets
+- Docker Compose path compatibility ✅ — `docker-compose.yml` build contexts updated
+
+**turborepo-pipeline** (3 requirements):
+- Turbo pipeline configuration ✅ — `turbo.json` with build/dev/lint/test/format/typecheck
+- Unified root scripts ✅ — root `package.json` delegates to `turbo run`
+- Independent workspace scripts ✅ — workspace package.json files retain own scripts
+
+**oxlint-oxfmt-toolchain** (4 requirements):
+- oxfmt replaces Prettier ✅ — `.oxfmtrc.json` at root, Prettier configs removed
+- Admin oxlint replaces ESLint ✅ — `apps/admin/package.json` uses oxlint, ESLint removed
+- Server retains ESLint ✅ — ESLint config preserved, Prettier integration removed
+- Pre-existing Prettier/ESLint cleanup ✅ — no Prettier remnants in config files
+
+## Correctness
+
+All 11 spec requirements have verifiable implementation evidence in the repository. No requirement-to-implementation divergence detected. The implementation is a structural migration — all changes are in config files (package.json, tsconfig, eslint config, turbo.json, docker-compose.yml, oxlint config, oxfmt config), with zero business logic modifications.
+
+## Coherence
+
+### Design Adherence
+
+| Design Decision | Implementation Evidence |
+|----------------|------------------------|
+| git mv for history preservation | 137 file renames at 100% similarity |
+| npm workspaces (apps/*, packages/*) | Root package.json workspaces field |
+| Turborepo pipeline | turbo.json with 6 tasks |
+| oxfmt unified formatting | .oxfmtrc.json at root |
+| Admin oxlint + Server ESLint | Respective lint scripts and configs |
+| @gongxue/typescript-config shared | packages/typescript-config/ with exports |
+| TS ~6.0.2 unified | Both server and admin devDependencies |
+| Docker container names unchanged | docker-compose.yml confirms |
+
+### Delta Spec vs Design Doc
+
+No conflicts detected. Design doc decisions align with delta spec requirements. No implementation divergence to document.
+
+## Issues
+
+**CRITICAL**: None
+
+**WARNING**: None
+
+**SUGGESTION**: 
+- Docker daemon was unavailable during verification; build contexts are correct but runtime verification deferred
+
+## Final Assessment
+
+**All checks passed. Ready for archive.**

docs/superpowers/reports/2026-07-02-rbac-refactor-verify.md

@@ -0,0 +1,85 @@
+# RBAC 鉴权重构 — 验证报告
+
+- **Change**: rbac-refactor
+- **Date**: 2026-07-02
+- **Verify Mode**: full
+- **Commits**: 22 (78676a1 → d159615)
+- **Files Changed**: ~50+ (核心变更)
+
+## 1. 构建验证
+
+| 检查项 | 结果 | 证据 |
+|--------|------|------|
+| Backend TypeScript 编译 | PASS | `npx tsc --noEmit` exit 0, 零错误 |
+| Frontend TypeScript 编译 | PASS | `npx tsc -b --noEmit` exit 0, 零错误 |
+| Frontend Vite 生产构建 | PASS | `npx vite build` exit 0, 构建成功 |
+
+## 2. 任务完成度
+
+| 检查项 | 结果 |
+|--------|------|
+| tasks.md 全部勾选 | PASS (0 unchecked) |
+| Plan 全部勾选 | PASS (0 unchecked) |
+
+## 3. 设计决策对照
+
+| 决策 | 实现状态 |
+|------|---------|
+| RBAC 数据模型 (User↔Role↔Permission) | ✅ Permission, Role 实体 + ManyToMany 关联 |
+| 权限码 module:action 格式 | ✅ 51 个权限码按 13 个 group 组织 |
+| @RequirePermission OR 语义 | ✅ PermissionGuard.getAllAndMerge 扁平匹配 |
+| PermissionGuard 全局 + @Public 豁免 | ✅ APP_GUARD 注册，@Public 跳过检查 |
+| JWT payload {sub, username, permissions} | ✅ login() 调用 getUserPermissions 打入 |
+| 独立 RbacModule | ✅ forwardRef 解决 AuthModule 循环依赖 |
+| 种子数据幂等 | ✅ orIgnore() INSERT，onModuleInit 触发 |
+| PermissionButton 隐藏（非禁用） | ✅ return null 实现 |
+| TypeORM synchronize 保留 | ✅ 保留 synchronize: true（dev mode） |
+
+## 4. Proposal 目标达成
+
+| 目标 | 状态 |
+|------|------|
+| RBAC 实体层：Role/Permission 四表 | ✅ |
+| 权限守卫：@RequirePermission + PermissionGuard | ✅ |
+| User 实体迁移：移除 role/allowedMenus | ✅ |
+| 种子数据：4 预置角色 + 权限点 | ✅ |
+| 前端权限管理界面 | ✅ Roles + Permissions 页 |
+| 前端权限适配：路由/按钮/菜单 | ✅ |
+| 权限点定义：覆盖所有模块 | ✅ 13 groups, 51 codes |
+
+## 5. Capabilities 实现
+
+| Capability | 状态 |
+|------------|------|
+| db-migration | ⚠️ 跳过（保留 synchronize 模式） |
+| rbac-core | ✅ 实体 + 服务层 + 种子数据 |
+| permission-guard | ✅ PermissionGuard + @Public + @RequirePermission |
+| permission-admin-ui | ✅ Roles CRUD + Permissions 只读展示 |
+
+## 6. 安全性检查
+
+| 检查项 | 结果 |
+|--------|------|
+| 无硬编码密钥 | PASS |
+| 所有 API 受权限保护 | PASS（全局 PermissionGuard + @RequirePermission） |
+| @Public 不可绕过 | PASS（handler + class 层双重检查） |
+| 系统角色不可删除 | PASS（isSystem 检查） |
+| admin 用户不可删除 | PASS（username 检查） |
+
+## 7. 代码审查
+
+- 最终审查模式：standard
+- 审查模型：Fable
+- 发现问题：3 IMPORTANT
+- 修复状态：全部修复 + 复查 APPROVED
+
+## 8. 最终判定
+
+**VERDICT: PASS**
+
+所有检查通过。建议进入归档阶段。
+
+## 9. 已知偏差
+
+- TypeORM Migration 脚本未创建（保留 synchronize: true，种子数据通过 onModuleInit 幂等插入）
+- e2e 测试未实现（项目原无 e2e 测试基础设施）