Current State

Phase 0 static assessment originally generated on 2026-07-29. Current delivery status updated on 2026-08-01 through V4450/EDU-033; the original investigation remains below as provenance.

Current implementation summary

The target branch now contains the student core loop, tenant/identity enforcement, bounded content/operations/appearance/activation-code capabilities, and module-owned PostgreSQL Flyway migrations V4010–V4450. Native RuoYi Pay, Product, Coupon, normal Trade order, Discount/Reward checkout, delivery, after-sale, brokerage, Seckill, and Combination administration are activated with tenant-composite persistence and their existing APIs, RBAC, services, and Vben pages; Education does not own shadow financial, catalog, order, delivery, refund, commission, or promotion ledgers. The full Flyway suite passes 52 PostgreSQL scenarios through V4450; EDU-031 proves tenant-isolated two-level commission/statistics, EDU-032 proves same-number cross-tenant seckill state plus atomic last-stock competition, and EDU-033 proves tenant-isolated group records plus atomic last-place competition and Trade Order/head consistency. The required non-clean Maven compile chain and complete Vben typecheck pass without interrupting the running server. This is isolated disposable-schema evidence, not proof that a shared Pilot or production database was migrated. Explicit legacy Product/coupon/order/refund mapping, source referral CRM and settlement proof/export import, Bargain/Point and other special-order Promotion families, production deployment/data, automatic purchase fulfillment/refund revocation, and selected deferred learning/platform families remain open.

This document retains the original Phase 0 findings below as provenance. Current ticket status is authoritative in issues/README.md, and rollout evidence is tracked by ../pilot-acceptance-runbook.md.

Original Phase 0 executive summary

Verified evidence showed the target on feature/education-core-loop with a heavily dirty worktree, while the source checkout had no local or remote branch with that name and remained at 033701a. The assessment identified a meaningful committed core-loop slice plus substantial provider/catalog/session work that still required classification. It selected provider-neutral fail-closed question handling, tenant/principal enforcement, atomic idempotency, PostgreSQL/Flyway takeover, and catalog graph integrity as the immediate blockers. Those bounded blockers have since been implemented and verified; this paragraph is retained only as historical context.

Original Phase 0 decisions and unknowns

The remaining sections are the immutable investigation record from 2026-07-29. Items phrased as pending may now be resolved by later tickets and migrations; use the current summary and ticket index above for delivery status.

Decisions recorded during Phase 0

Verified source provenance is limited: /Users/tiku1/code/tiku-backend has only main and origin/main at 033701a785c7012139e7f86995eea6041225592e; no local or remote feature/education-core-loop ref exists. Use main/033701a provisionally only, or obtain explicit approval for that baseline.
Verified target branch is feature/education-core-loop and its worktree is dirty. Current read-only inventory reports 65 modified tracked files and 97 untracked entries; preserve all, and do not rely on an older 21-untracked count.
Classify target behavior as committed-and-tested, committed-but-not-runtime-verified, dirty/uncommitted, or absent before scheduling work. ce02f8a is committed core-loop evidence; native provider/catalog and much of the schema are dirty.
Verified V4010 is SELECT 1 and V4020 is native catalog only. Practice/report/idempotency/wrong/favorite DDL in sql/postgresql/education is untracked/manual and not proven active Flyway. Convert required DDL to immutable module-owned PostgreSQL Flyway migrations before claiming schema delivery; never modify published migrations.
Keep PostgreSQL/Flyway as the only new schema delivery mechanism. Historical MySQL files and root SQL are not active delivery unless explicitly labeled archival/manual and removed from operational runbooks.
Treat public tenant resolution origin-binding absence as a P0 correction, not merely a richer-legacy gap. Separately acknowledge that TenantSecurityWebFilter already rejects authenticated tenant/header mismatch; the remaining principal issue is missing Member/UserType enforcement in /education/context.
Treat hostname port handling as a verified internal contradiction requiring alignment across implementation, properties, API documentation, System lookup normalization, and tests.
Treat native catalog isolation as an intentional TenantUtils.executeIgnore/manual-scope boundary, not evidence of a current leak. Make mapper audit and tenant/scope-consistent graph constraints concrete blockers before authoring.
Make the first slice provider-neutral or cover both providers because SCALAR_READ is the verified default and Java provider is conditional. The slice must include fresh browsing and persisted session restoration, with a common option-schema contract and fail-closed behavior.
Do not treat submit idempotency as complete: check-then-insert is not an atomic claim. Reserve keys atomically and define crash recovery before the submit slice.
Add first-class Auth/Profile/extended Learning, tenant appearance/integrations/secrets/codes, and granular platform-admin capability groups so every required legacy cluster has a disposition.
Do not expose paid/private practice until entitlement semantics and public target contracts are decided.
No tests, builds, PostgreSQL connections, Flyway execution, or runtime verification were performed; all conclusions are static repository evidence unless explicitly marked otherwise.

Unknowns recorded during Phase 0

EDU-003 decided the public resolver threat model and contract. Browser headers are forgeable context claims; a constrained Public Tenant Handle supports headless clients; success discloses tenant existence; unknown/disabled/expired failures are identical; exact errors, canonical websites, local activation, Member-only context, and abuse controls are assigned to EDU-004.
Whether a future System-owned immutable Tenant Code or authenticated/signed locator is required beyond the accepted public-handle contract.
The valid option schema for each question type, including whether absent options are legal; whether malformed published content is omitted or produces a controlled source failure.
Whether PUBLIC tenant_id=0 rows may reference only PUBLIC parents, whether tenant-owned rows may reference global rows, and the precise composite constraint/trigger strategy.
Whether untracked /Users/tiku1/code/ruoyi-vue-pro/sql/postgresql/education files are intended for promotion into Flyway or are design/manual artifacts.
Whether V4010/V4020 or any manual core-loop DDL has ever run successfully in PostgreSQL; no runtime migration evidence exists.
Whether target test H2 MODE=MYSQL is test-only and compatible with PostgreSQL-only delivery.
Which Auth/Profile/extended Learning semantics are replaced by Member/System/Infra versus Education-owned, including vocabulary, leaderboard, stats, trend, feedback, exam dates, notifications, points, and badges.
Whether tenant appearance, domains, payment accounts, auth providers, secrets, activation codes, coupons, integrations, marketing, public-bank grants, and sync are in scope or explicitly retired.
Whether legacy assets are migrated, re-uploaded, re-scanned, or retired, and who owns ClamAV/scanner integration.
Which legacy RLS, triggers, functions, grants, seeds, queue leases, retry behavior, and operational semantics are contractual and need Java/constraint/event/job reproduction.
Whether the ten required Phase 0 artifacts must be committed files or may remain in reviewed scratch form during discovery.

7.9 KiB Raw Blame History Unescape Escape