--- title: FR-119 盤點——主專案（BE repo）還剩哪些程式沒被資安掃描讀過、怎麼切 --- # FR-119 盤點：主專案未掃清單重數與切棒 > 盤點日期 2026-09-24｜盤點卡 CM-2140（母卡 CM-2139）｜這份文件只盤點、不掃描——切好棒等首腦決定要不要開卡派工。 > 行數全部是 `wc -l` 逐檔實算。基準：BE `feature/review` commit `3ef11c640`（工作區有平行 session 未 commit 的改動，都在 `docs/`，不影響程式檔行數）。 名詞先講清楚（讀者是 PM 與新手工程師）： - **主專案**：BE repo 本身的程式（不含 21 支 jedi-* 套件）。正式程式的算法是 `git ls-files -- '*.py' | grep -v -E '^(test|tests|scripts|docs|migrations)/'`，共 **826 支、87,324 行**。 - **掃過**：掃描工具實際把這支檔讀進去、而且三人檢查面板有跑完（驗證章 `verified`）。 - **部分掃過**：工具讀過，但面板沒跑完（沒驗證章）。這種檔「讀過」但**不能當作掃乾淨**。 - **沒碰**：125 輪裡沒有任何一輪把它排進範圍。 - **一棒**：派給一個 session 跑一次掃描工具的份量，上限 2,000 行、30 檔。 --- ## 這批最該先看的五件事 1. **數字**：826 支裡 **380 支（56,131 行）掃過**、**21 支（3,237 行）部分掃過**、**425 支（27,956 行）沒碰**。沒碰的 425 支裡，**真正有判斷邏輯、該掃的是 119 支、17,511 行**；其餘是純宣告（258 支）、DI 組裝（38 支）、離線小工具（10 支）。 2. **切成 12 棒**（U1～U12），每棒 709～1,908 行、6～20 檔，全部在 2,000 行／30 檔以內。**加上「DI 組裝專掃」一棒（U13，17 檔 2,840 行，要再切成兩半）＝13～14 棒**。 3. 🔴 **權限檢查的共用那一層（`common/authz/`）有 9 支從來沒被掃過**。先前 FR-115 盤點寫「`common/authz/` 全專案共用守門本體，FR-085 C1 已掃」——**這句不成立**：FR-085 C1 掃的是 `jedi-common` 套件的 `session／identity／handler`，不是主專案的 `common/authz/`。stamp 顯示主專案這層只有 `project.py`／`ssp.py`／`workflow.py` 三支被別棒順帶讀過；`license.py`（367 行，授權檔功能開關）、`sharing.py`、`__init__.py`（180 行，決策表）等 9 支沒人讀過。**建議排第一棒（U1）**。 4. 🔴 **「每個請求都經過」的中介層還有兩支沒碰**：`common/middleware/jwt_mw.py`、`common/middleware/license_readonly_mw.py`（217 行，授權到期時的唯讀閘門），加上 `core/app_factory.py`（469 行，把中介層與路由組起來的地方）。總表第 154 項（唯一不必登入就能讓全產品停擺）就是在同一個目錄抓到的。**建議排第二棒（U2）**。 5. **最大一塊是「Google 雲端硬碟整合」（`cloud_integration`），51 支 6,000 多行完全沒碰**，其中背景同步那半（U5／U6）**守門字眼是 0**——它不接網址，是 Google 通知回呼＋背景工作在跑，工具要看的是「回呼憑什麼信任」與「背景工作用誰的身分動誰的資料」。 --- ## 1. 範圍界定 ### 1.1 已掃範圍怎麼算的（三個來源） | 來源 | 內容 | 怎麼用 | |---|---|---| | ① BE repo 根下 55 個 `CLAUDE-SECURITY-<時間>/` | 53 個有 stamp（`CLAUDE-SECURITY-REVISION-*.json`，內有 `scope` 陣列＝工具實際讀的路徑），2 個空目錄（`20260905-141910`、`20260908-070222`，沒 stamp、沒報告） | **主來源**。`scope` 裡的目錄前綴展開到檔 → 命中 **379 支**主專案檔 | | ② 各棒報告與 `scan-inventory.md` | FR-113／115／116／118 四份盤點＋FR-113 module_frame 盤點＋各棒 `scan-*.md` | 補 stamp 不在的棒：FR-113 **O6、O9a、O9b、B1-item** 四棒的 stamp 目錄已不在 BE repo 根下，照盤點檔列的檔案清單補進來（+22 支） | | ③ 總表 §1（125 列） | 每輪的範圍描述 | 交叉核對用：早期 FR-075～FR-088、FR-095～FR-098 的主專案模組都能在 ① 找到對應 stamp（通知 N2、公告 B2、意見回饋 I2、AI 儀表板 D2、上傳 B2、流程引擎 H1～H4、任務平台 H1、系統設定 H1）。**套件側的 stamp 在 jedi monorepo 與各套件目錄下（共 78 個），scope 全是套件路徑，對主專案檔數零貢獻**（唯一例外 FR-095 P2 的 `participant/…` 是套件內路徑） | **兩個容易看錯的地方**： - **FR-085 C1～C3 是套件棒**：掃的是 `jedi-common` 的 `session/`、`logger/`、`utils/`，報告裡提到的主專案檔（`request_context_mw.py`、`app_mw.py`、`redis_client_util.py`）是 runner「越界核對」讀的，**不算掃過**。前兩支後來由 FR-115 W5／W7 正式掃了；`redis_client_util.py` 仍是沒碰。 - **2026-07 那批（`security-scan-2607/`）是 Semgrep 規則掃描**，不是同一種工具，不算入本表。 - 另外 `FR-087 T1` 是人工查資料庫，沒有讀程式的範圍，不算入。 ### 1.2 「部分掃過」是哪 21 支 全部來自 FR-113 的三棒面板沒跑完： | 棒 | 檔數／行數 | 為什麼只算部分 | |---|---|---| | O6 文件池與匯入比對引擎 | 6／1,917 | 面板 `unverified`，決策者手動停；首腦開檔核對三處屬實 | | O9b 接線總裝、稽核階段掛鉤、人員對帳 | 17 支範圍裡 **12 支只有這棒讀過**（含 1 支 0 行 `__init__`；另 5 支被別棒掃過）／905 行 | 投票 0 票回收；報告自承「人員對帳的跨公司比對、三支資料表的公司欄位」未及查證 | | B1-item 範本子項 | 4 支裡 **3 支只有這棒讀過**／415 行 | 面板 3／6 票；報告自承「這四支檔不能視為掃過了」 | **建議**：這 21 支不另開棒——O9b 那 12 支裡 `reconciliation/` 五支＋`party_reconciliation_service.py` 是「把 Word 裡的人名對到系統使用者」，是 FR-113 O9b 報告點名沒查完的「跨公司比對」；若決策者要補，可以併進 U12（零散殘段，709 行）帶入，約 +400 行、合計約 1,110 行，不破上限（併進 U9 會超過 2,000 行）。 ### 1.3 沒碰的 425 支怎麼分三堆 判準照 FR-118 盤點：**函式裡有 if／for／while／try／推導式，或有資料庫查詢組裝，才算「判斷邏輯」**（用 Python AST 逐檔算，不是看檔名）。 | 堆 | 檔數 | 行數 | 處置 | |---|---:|---:|---| | **判斷邏輯** | **119** | **17,511** | 切 12 棒（第 2 節） | | **DI 組裝**（`di_containers/`、`core/plugins/`、`config/di_modules.py`） | 38（其中 21 支是 0 行 `__init__.py`） | 2,840 | 另列一表、另一種掃法（第 5 節） | | **純宣告**（`__init__`、序列化器、entity、model、mapper、dto、repo 介面、錯誤碼、常數、設定值） | 258 | 4,792 | 不掃，附錄 A 列清單與理由 | | **離線小工具**（`content/detection-profiles/tools/` 7 支、`examples/` 3 支） | 10 | 2,813 | 不掃：命令列轉換工具與範例，產品執行時不 import、不接網址（`grep` 全 repo 零引用） | ### 1.4 已裁不掃 - jedi-task-platform 剩 108 檔（套件側，不在 BE repo）——與本盤點無關。 - **主專案側沒有任何「裁不掃」的區塊**。但以下兩支在 FR-115 盤點被寫成「屬任務平台（FR-095）地盤、FR-095 裁停在三棒所以沒掃」：`job_import_service.py`、`job_batch_complete_service.py`、`job_route.py`。FR-095 H2（CM-1783）**從來沒派**。本盤點把它們排進 U7，**是否要掃要決策者確認**（見第 7 節）。 --- ## 2. 切棒（12 棒，按業務模組垂直切） 每棒 ≤2,000 行、≤30 檔。沒有任何一支檔超過 1,000 行（最大 `core/scheduler.py` 550 行），所以沒有「單檔一棒」。中文註解密度最高的是 U3（每字元約 18% 是中文），但也只有 930 行，不用再壓。 | 棒 | 範圍 | 檔／行 | 守門字眼 vs 函式 | 零守門檔 | 為什麼排這個順位 | |---|---|---|---|---|---| | **U1** | 權限檢查共用層＋共用小工具 | 15／1,132 | 66／41 | 7 | 全產品守門的地基，前面每棒都假設它沒問題 | | **U2** | 啟動與中介層 | 6／1,233 | 2／16 | 4 | 每個請求都經過；第 154 項同目錄 | | **U3** | 首次安裝精靈＋版本資訊 | 9／930 | 8／16 | 7 | **登入前就打得到**（安裝精靈用一次性碼、版本與前端設定完全免認證） | | **U4** | 雲端硬碟：設定、授權、金鑰 | 13／1,786 | 26／55 | 7 | 管客戶 Google 授權與加密金鑰；總表 CM-1631 金鑰外洩同一條線 | | **U5** | 雲端硬碟：Google 回呼＋同步排程主幹 | 9／1,838 | **0**／46 | **9** | 🔴 回呼端點**不登入**（靠 header 帶的 token）；排程主幹零守門 | | **U6** | 雲端硬碟：八支檔案搬移處理器 | 10／1,758 | **0**／38 | **10** | 🔴 會寫 `job_evidences`（沒 RLS 的表）；零守門 | | **U7** | 任務入口與批次 | 7／1,908 | 14／25 | 4 | FR-095 H2 沒派的那張；總表第 59 項「批次完成預設當管理員」未核對點 | | **U8** | 流程背景作業 | 8／1,716 | 19／27 | 5 | 用原生 SQL 寫五張沒 RLS 的表 | | **U9** | 專案摘要報告＋關聯表＋使用者／角色殘段 | 20／1,658 | 21／67 | **15** | 摘要報告兩支 route 零守門字眼 | | **U10** | 系統診斷包：入口與組裝 | 8／1,295 | 7／18 | 5 | 平台管理員限定，會把日誌與資料庫摘要打包下載 | | **U11** | 系統診斷包：資料收集器 | 7／1,548 | **0**／25 | 7 | 讀主機檔案、容器、日誌——路徑與遮罩 | | **U12** | 零散殘段 | 7／709 | **0**／32 | 7 | 防竄改接線、解析工作單、即時通知 | | | **合計** | **119／17,511** | | | | （「守門字眼」＝`grep -c 'require_\|assert_\|_check_'`，「函式」＝`grep -c 'def [a-z]'`，照卡片口徑。**0 不等於沒守門**——有些守門在上一層或用 `@jwt_required`，但 0 的棒要特別看「這些方法被誰呼叫、呼叫前有沒有人檢查」。） ### 接縫（刻意重疊或越界讀、不報） - U1 ↔ 全部：每棒研究員都會追進 `common/authz/`，**只有 U1 報它本身的問題**。 - U4 ↔ U5 ↔ U6：三棒共用 `tenant_drive_integration`（授權紀錄），U4 報「存與取」，U5／U6 讀它只為了知道背景工作用哪把授權。`drive_project_verify_service.py`（FR-095 H1 已掃）三棒都可讀不報。 - U7 ↔ U8：`task_existence_query.py` 放 U8；U7 會讀。`job_service.py`（FR-115 W2 已掃）U7 可讀不報。 - U2 ↔ U3：`core/app_factory.py` 放 U2；U3 要追「安裝精靈的路由是怎麼繞過中介層的」會讀它。 - U10 ↔ U11：`diag_bundle_app_service.py` 放 U10，是 U11 七支收集器的唯一呼叫者。 ### 2.1 各棒檔案清單與驗證指令 行數旁邊的「守門字眼」是該檔 `require_|assert_|_check_|jwt_required|ForbiddenError|_require` 的出現次數，0 的要特別看。 #### U1 — 權限檢查共用層（common/authz）＋共用小工具（15 檔／1,132 行） ``` common/authz/__init__.py 180 守門字眼 45 common/authz/admin.py 12 守門字眼 3 common/authz/capability.py 22 守門字眼 3 common/authz/decorators.py 11 守門字眼 6 common/authz/license.py 367 守門字眼 17 common/authz/menu_license_filter.py 76 守門字眼 0 common/authz/platform.py 11 守門字眼 3 common/authz/sharing.py 35 守門字眼 4 common/authz/signed_token.py 22 守門字眼 3 common/iam_ports.py 100 守門字眼 0 common/util/round_guard.py 46 守門字眼 3 common/util/ssp_resource_name_dup.py 56 守門字眼 0 common/util/common_util.py 65 守門字眼 0 common/util/redis_client_util.py 79 守門字眼 0 common/util/resource_path.py 50 守門字眼 0 ``` 驗證（預期 15 檔／1,132 行）： ```bash git ls-files -- common/authz/__init__.py \ common/authz/admin.py \ common/authz/capability.py \ common/authz/decorators.py \ common/authz/license.py \ common/authz/menu_license_filter.py \ common/authz/platform.py \ common/authz/sharing.py \ common/authz/signed_token.py \ common/iam_ports.py \ common/util/round_guard.py \ common/util/ssp_resource_name_dup.py \ common/util/common_util.py \ common/util/redis_client_util.py \ common/util/resource_path.py | xargs wc -l | tail -1 ``` #### U2 — 啟動與中介層（每個請求都經過的那層）（6 檔／1,233 行） ``` common/middleware/jwt_mw.py 46 守門字眼 0 common/middleware/license_readonly_mw.py 217 守門字眼 10 core/app_factory.py 469 守門字眼 0 core/host_capabilities.py 76 守門字眼 1 main.py 302 守門字眼 3 config/config_loader.py 123 守門字眼 4 ``` 驗證（預期 6 檔／1,233 行）： ```bash git ls-files -- common/middleware/jwt_mw.py \ common/middleware/license_readonly_mw.py \ core/app_factory.py \ core/host_capabilities.py \ main.py \ config/config_loader.py | xargs wc -l | tail -1 ``` #### U3 — 首次安裝精靈＋版本資訊（登入前就打得到）（9 檔／930 行） ``` api/setup/__init__.py 22 守門字眼 0 api/setup/routes/setup_route.py 128 守門字眼 8 app/setup/service/setup_wizard_service.py 395 守門字眼 6 common/setup/setup_token.py 113 守門字眼 0 infra/setup/setup_state_reader.py 89 守門字眼 0 api/version/__init__.py 19 守門字眼 0 api/version/routes/client_config_route.py 47 守門字眼 0 api/version/routes/version_route.py 29 守門字眼 0 common/util/app_version.py 88 守門字眼 0 ``` 驗證（預期 9 檔／930 行）： ```bash git ls-files -- api/setup/__init__.py \ api/setup/routes/setup_route.py \ app/setup/service/setup_wizard_service.py \ common/setup/setup_token.py \ infra/setup/setup_state_reader.py \ api/version/__init__.py \ api/version/routes/client_config_route.py \ api/version/routes/version_route.py \ common/util/app_version.py | xargs wc -l | tail -1 ``` #### U4 — 雲端硬碟整合：設定、授權與金鑰（13 檔／1,786 行） ``` api/cloud_integration/__init__.py 84 守門字眼 0 api/cloud_integration/routes/drive_app_credential_verify_route.py 44 守門字眼 3 api/cloud_integration/routes/google_drive_integration_route.py 140 守門字眼 11 api/cloud_integration/routes/google_drive_sync_route.py 260 守門字眼 23 app/cloud_integration/service/drive_app_credential_verify_service.py 94 守門字眼 2 app/cloud_integration/service/drive_sync_admin_service.py 164 守門字眼 2 app/cloud_integration/service/google_drive_integration_service.py 288 守門字眼 2 app/system_config/service/google_drive_app_config_resolver.py 224 守門字眼 0 domain/cloud_integration/service/google_drive_token_manager.py 131 守門字眼 3 domain/cloud_integration/service/tenant_drive_integration_domain_service.py 65 守門字眼 1 infra/cloud_integration/crypto/fernet_crypto.py 18 守門字眼 0 infra/cloud_integration/google_drive/google_oauth_client.py 180 守門字眼 0 infra/cloud_integration/repository/tenant_drive_integration_repo_impl.py 94 守門字眼 0 ``` 驗證（預期 13 檔／1,786 行）： ```bash git ls-files -- api/cloud_integration/__init__.py \ api/cloud_integration/routes/drive_app_credential_verify_route.py \ api/cloud_integration/routes/google_drive_integration_route.py \ api/cloud_integration/routes/google_drive_sync_route.py \ app/cloud_integration/service/drive_app_credential_verify_service.py \ app/cloud_integration/service/drive_sync_admin_service.py \ app/cloud_integration/service/google_drive_integration_service.py \ app/system_config/service/google_drive_app_config_resolver.py \ domain/cloud_integration/service/google_drive_token_manager.py \ domain/cloud_integration/service/tenant_drive_integration_domain_service.py \ infra/cloud_integration/crypto/fernet_crypto.py \ infra/cloud_integration/google_drive/google_oauth_client.py \ infra/cloud_integration/repository/tenant_drive_integration_repo_impl.py | xargs wc -l | tail -1 ``` #### U5 — 雲端硬碟整合：Google 回呼通知＋同步排程主幹（9 檔／1,838 行） ``` api/cloud_integration/routes/google_drive_webhook_route.py 64 守門字眼 0 app/cloud_integration/service/google_drive_webhook_service.py 127 守門字眼 0 app/cloud_integration/service/webhook_channel_manager.py 202 守門字眼 1 app/cloud_integration/service/drive_sync_orchestration_service.py 529 守門字眼 0 app/cloud_integration/service/drive_sync_worker.py 149 守門字眼 0 app/cloud_integration/service/project_tree_loader.py 171 守門字眼 0 domain/cloud_integration/service/drive_sync_job_domain_service.py 104 守門字眼 0 infra/cloud_integration/repository/drive_sync_job_repo_impl.py 191 守門字眼 0 infra/cloud_integration/google_drive/google_drive_api_client.py 301 守門字眼 0 ``` 驗證（預期 9 檔／1,838 行）： ```bash git ls-files -- api/cloud_integration/routes/google_drive_webhook_route.py \ app/cloud_integration/service/google_drive_webhook_service.py \ app/cloud_integration/service/webhook_channel_manager.py \ app/cloud_integration/service/drive_sync_orchestration_service.py \ app/cloud_integration/service/drive_sync_worker.py \ app/cloud_integration/service/project_tree_loader.py \ domain/cloud_integration/service/drive_sync_job_domain_service.py \ infra/cloud_integration/repository/drive_sync_job_repo_impl.py \ infra/cloud_integration/google_drive/google_drive_api_client.py | xargs wc -l | tail -1 ``` #### U6 — 雲端硬碟整合：八支檔案搬移處理器（10 檔／1,758 行） ``` app/cloud_integration/service/handlers/archive_drive_file_handler.py 165 守門字眼 0 app/cloud_integration/service/handlers/create_folder_handler.py 71 守門字眼 0 app/cloud_integration/service/handlers/import_drive_file_handler.py 264 守門字眼 0 app/cloud_integration/service/handlers/init_project_folders_handler.py 449 守門字眼 3 app/cloud_integration/service/handlers/process_drive_changes_handler.py 275 守門字眼 2 app/cloud_integration/service/handlers/reconcile_task_folder_handler.py 129 守門字眼 0 app/cloud_integration/service/handlers/rename_folder_handler.py 59 守門字眼 0 app/cloud_integration/service/handlers/soft_delete_evidence_handler.py 42 守門字眼 0 domain/cloud_integration/service/drive_folder_mapping_domain_service.py 133 守門字眼 0 infra/cloud_integration/repository/drive_folder_mapping_repo_impl.py 171 守門字眼 0 ``` 驗證（預期 10 檔／1,758 行）： ```bash git ls-files -- app/cloud_integration/service/handlers/archive_drive_file_handler.py \ app/cloud_integration/service/handlers/create_folder_handler.py \ app/cloud_integration/service/handlers/import_drive_file_handler.py \ app/cloud_integration/service/handlers/init_project_folders_handler.py \ app/cloud_integration/service/handlers/process_drive_changes_handler.py \ app/cloud_integration/service/handlers/reconcile_task_folder_handler.py \ app/cloud_integration/service/handlers/rename_folder_handler.py \ app/cloud_integration/service/handlers/soft_delete_evidence_handler.py \ domain/cloud_integration/service/drive_folder_mapping_domain_service.py \ infra/cloud_integration/repository/drive_folder_mapping_repo_impl.py | xargs wc -l | tail -1 ``` #### U7 — 任務入口與批次（任務增刪改查、Excel 批次匯入、批次完成、我的任務）（7 檔／1,908 行） ``` api/flow_control/routes/job_route.py 259 守門字眼 14 api/flow_control/serializers/job.py 417 守門字眼 6 app/flow_control/service/job_import_service.py 470 守門字眼 6 app/flow_control/service/job_batch_complete_service.py 193 守門字眼 2 app/readmodel/service/my_jobs_app_service.py 117 守門字眼 0 infra/readmodel/tasks/my_grc_jobs_query.py 198 守門字眼 0 infra/readmodel/audit/flow_control_dashboard_repo_impl.py 254 守門字眼 0 ``` 驗證（預期 7 檔／1,908 行）： ```bash git ls-files -- api/flow_control/routes/job_route.py \ api/flow_control/serializers/job.py \ app/flow_control/service/job_import_service.py \ app/flow_control/service/job_batch_complete_service.py \ app/readmodel/service/my_jobs_app_service.py \ infra/readmodel/tasks/my_grc_jobs_query.py \ infra/readmodel/audit/flow_control_dashboard_repo_impl.py | xargs wc -l | tail -1 ``` #### U8 — 流程背景作業（排程器、流程圖同步、孤兒清理、重新驗證繼承）（8 檔／1,716 行） ``` core/scheduler.py 550 守門字眼 4 app/flow_control/service/workflow_xml_sync_service.py 246 守門字眼 10 app/flow_control/service/job_binding_orphan_cleanup_service.py 174 守門字眼 0 infra/flow_control/repository/job_binding_orphan_query.py 129 守門字眼 5 app/flow_control/service/reverify_inheritance_service.py 73 守門字眼 0 infra/flow_control/repository/reverify_clone_query.py 176 守門字眼 3 infra/flow_control/repository/task_execution_query.py 292 守門字眼 0 infra/flow_control/task_existence_query.py 76 守門字眼 0 ``` 驗證（預期 8 檔／1,716 行）： ```bash git ls-files -- core/scheduler.py \ app/flow_control/service/workflow_xml_sync_service.py \ app/flow_control/service/job_binding_orphan_cleanup_service.py \ infra/flow_control/repository/job_binding_orphan_query.py \ app/flow_control/service/reverify_inheritance_service.py \ infra/flow_control/repository/reverify_clone_query.py \ infra/flow_control/repository/task_execution_query.py \ infra/flow_control/task_existence_query.py | xargs wc -l | tail -1 ``` #### U9 — 專案摘要報告＋專案關聯表＋使用者／角色殘段（20 檔／1,658 行） ``` api/project_summary_report/__init__.py 43 守門字眼 0 api/project_summary_report/routes/project_summary_report_route.py 170 守門字眼 7 api/project_summary_report/routes/project_summary_report_history_route.py 71 守門字眼 4 app/project_summary_report/service/project_summary_report_service.py 178 守門字眼 9 app/project_summary_report/service/project_summary_report_history_service.py 77 守門字眼 2 infra/project_summary_report/repository/project_summary_report_hitrosy_repo_impl.py 36 守門字眼 0 api/project/__init__.py 88 守門字眼 0 api/project/routes/project_route.py 69 守門字眼 6 api/project/serializers/assessment_plan.py 148 守門字眼 0 app/associations/service/project_assessment_plan_mapping_service.py 67 守門字眼 0 app/associations/service/project_org_unit_mapping_service.py 44 守門字眼 0 domain/associations/service/project_system_characteristic_mapping_domain_service.py 50 守門字眼 0 infra/associations/repository/project_assessment_plan_mapping_repo_impl.py 71 守門字眼 0 infra/associations/repository/project_org_unit_mapping_repo_impl.py 38 守門字眼 0 infra/associations/repository/project_system_characteristic_mapping_repo_impl.py 59 守門字眼 0 app/auth/service/role_app_service.py 94 守門字眼 6 app/auth/service/user_app_service.py 122 守門字眼 9 app/auth/service/user_import_template_app_service.py 106 守門字眼 0 infra/auth/root_admin_reader.py 40 守門字眼 0 common/util/audit_nickname.py 87 守門字眼 0 ``` 驗證（預期 20 檔／1,658 行）： ```bash git ls-files -- api/project_summary_report/__init__.py \ api/project_summary_report/routes/project_summary_report_route.py \ api/project_summary_report/routes/project_summary_report_history_route.py \ app/project_summary_report/service/project_summary_report_service.py \ app/project_summary_report/service/project_summary_report_history_service.py \ infra/project_summary_report/repository/project_summary_report_hitrosy_repo_impl.py \ api/project/__init__.py \ api/project/routes/project_route.py \ api/project/serializers/assessment_plan.py \ app/associations/service/project_assessment_plan_mapping_service.py \ app/associations/service/project_org_unit_mapping_service.py \ domain/associations/service/project_system_characteristic_mapping_domain_service.py \ infra/associations/repository/project_assessment_plan_mapping_repo_impl.py \ infra/associations/repository/project_org_unit_mapping_repo_impl.py \ infra/associations/repository/project_system_characteristic_mapping_repo_impl.py \ app/auth/service/role_app_service.py \ app/auth/service/user_app_service.py \ app/auth/service/user_import_template_app_service.py \ infra/auth/root_admin_reader.py \ common/util/audit_nickname.py | xargs wc -l | tail -1 ``` #### U10 — 系統診斷包：下載入口與組裝（8 檔／1,295 行） ``` api/support/__init__.py 30 守門字眼 0 api/support/routes/diagnostic_bundle_route.py 67 守門字眼 2 api/support/routes/recent_error_route.py 43 守門字眼 3 app/support/diag_cli.py 366 守門字眼 0 app/support/service/diag_bundle_app_service.py 334 守門字眼 0 app/support/service/diag_bundle_export_service.py 133 守門字眼 3 app/support/service/recent_error_app_service.py 52 守門字眼 4 domain/support/service/diag_slice_domain_service.py 270 守門字眼 0 ``` 驗證（預期 8 檔／1,295 行）： ```bash git ls-files -- api/support/__init__.py \ api/support/routes/diagnostic_bundle_route.py \ api/support/routes/recent_error_route.py \ app/support/diag_cli.py \ app/support/service/diag_bundle_app_service.py \ app/support/service/diag_bundle_export_service.py \ app/support/service/recent_error_app_service.py \ domain/support/service/diag_slice_domain_service.py | xargs wc -l | tail -1 ``` #### U11 — 系統診斷包：資料收集器（讀主機／容器／日誌／資料庫）（7 檔／1,548 行） ``` infra/support/collector/container_collector.py 105 守門字眼 0 infra/support/collector/host_collector.py 201 守門字眼 0 infra/support/collector/staged_collector.py 178 守門字眼 0 infra/support/diag_db_reader.py 242 守門字眼 0 infra/support/diag_event_fetcher.py 303 守門字眼 0 infra/support/diag_log_reader.py 176 守門字眼 0 infra/support/diag_packer.py 343 守門字眼 0 ``` 驗證（預期 7 檔／1,548 行）： ```bash git ls-files -- infra/support/collector/container_collector.py \ infra/support/collector/host_collector.py \ infra/support/collector/staged_collector.py \ infra/support/diag_db_reader.py \ infra/support/diag_event_fetcher.py \ infra/support/diag_log_reader.py \ infra/support/diag_packer.py | xargs wc -l | tail -1 ``` #### U12 — 零散殘段（防竄改接線、解析工作單、即時通知、人員欄位格式）（7 檔／709 行） ``` common/integrity/adapters.py 357 守門字眼 0 domain/oscal/service/ssp_docx_parse_job_domain_service.py 71 守門字眼 0 domain/oscal/service/ssp_excel_parse_job_domain_service.py 71 守門字眼 0 infra/oscal/repository/ssp_docx_parse_job_repo_impl.py 54 守門字眼 0 infra/oscal/repository/ssp_excel_parse_job_repo_impl.py 56 守門字眼 0 api/oscal/serializers/ssp/ssp_party.py 47 守門字眼 0 app/notification/handler/notification_socketio_handler.py 53 守門字眼 0 ``` 驗證（預期 7 檔／709 行）： ```bash git ls-files -- common/integrity/adapters.py \ domain/oscal/service/ssp_docx_parse_job_domain_service.py \ domain/oscal/service/ssp_excel_parse_job_domain_service.py \ infra/oscal/repository/ssp_docx_parse_job_repo_impl.py \ infra/oscal/repository/ssp_excel_parse_job_repo_impl.py \ api/oscal/serializers/ssp/ssp_party.py \ app/notification/handler/notification_socketio_handler.py | xargs wc -l | tail -1 ``` --- ## 3. 每棒重點看什麼 ### 每一棒開工前都先做的一件事 ```bash # 守門字眼 vs 函式數，0 命中的檔標紅 git ls-files -- <本棒檔案> | xargs grep -c 'require_\|assert_\|_check_' git ls-files -- <本棒檔案> | xargs grep -c 'def [a-z]' ``` ### U1 — 權限檢查共用層＋共用小工具 - 🔴 **`common/authz/license.py`（367 行）**：授權檔決定「這家客戶買了哪些模組」，掛在每支 route 的 `@require_license` 就是它。問：授權檔讀不到、過期、被竄改時是**擋下**還是**放行**（fail-open）？快取多久、換客戶會不會拿到上一家的結果？ - **`common/authz/__init__.py`（180 行）是決策表**：它 re-export 哪一軸給誰用。問：五支 shim（`admin`／`capability`／`decorators`／`platform`／`signed_token`）轉到 `jedi_iam.authz` 時，有沒有哪一支名字對了、實作指到舊路徑。 - **`sharing.py`**：母租戶分享資源給子樹的判斷（FR-094.4b 新增）。問：「分享給子樹」會不會被反過來用——子租戶改到母租戶的資源。 - **`round_guard.py`**：稽核輪次的狀態守門。問：只看狀態、還是也看「這一輪屬於你的專案」。 - `redis_client_util.py`：FR-085 C1 報告提到這支（Redis 金鑰前綴），當時是越界讀、沒正式掃。問：鍵名有沒有帶租戶，跨客戶會不會讀到彼此的快取。 ### U2 — 啟動與中介層 - 🔴 **`license_readonly_mw.py`（217 行）**：授權到期後全站唯讀的閘門。問：它用什麼判斷「這是寫入請求」（HTTP 方法？網址白名單？）——有沒有 POST 其實是讀、或 GET 其實是寫的漏網；白名單網址是前綴比對還是完整比對。 - **`jwt_mw.py`**：登入權杖的解析。問：權杖過期、簽章錯誤、缺欄位時的處理；有沒有哪條路會把「解不開」當成「匿名但放行」。 - **`core/app_factory.py`（469 行）**：中介層的掛載順序＋哪些路由被豁免。問：豁免清單（免登入、免授權）列了誰，是不是每一個都有理由。 - `main.py` 的 `diag` 子命令分支：命令列入口，確認只在本機命令列觸發、網址打不到。 ### U3 — 首次安裝精靈＋版本資訊（登入前就打得到） - 🔴 **`setup_route.py`＋`setup_token.py`**：精靈用 install.sh 印出的一次性設定碼代替登入。問：設定碼怎麼比對（常數時間比對？）、用過一次後真的失效嗎、「已開通」之後再打 `POST /setup/provision` 會不會再建一個管理員。 - **`setup_state_reader.py`**：判斷「是否已開通」的唯一依據是「root 以外的租戶底下有沒有使用者」。問：這個判據能不能被繞——例如把那個使用者刪掉，精靈是不是就重新打開了。 - **`version_route.py`、`client_config_route.py`（完全免認證）**：確認只回版本號與錯誤收集站連線字串，**不夾帶環境變數、主機路徑、內部 IP**。 ### U4 — 雲端硬碟：設定、授權、金鑰 - 🔴 **`google_drive_token_manager.py`＋`fernet_crypto.py`**：客戶的 Google 授權權杖怎麼加密存、用哪把金鑰。總表 CM-1631 已知「加密金鑰寫在版控裡」，這棒問的是**程式邏輯**：解密失敗時怎麼處理、權杖過期換新時會不會寫錯租戶。 - **`google_drive_integration_route.py`／`google_drive_sync_route.py`（22 次守門字眼、7 支方法）**：守門很多，照手冊問「守的問題對不對」——是檢查「你是這家公司的管理員」，還是只檢查「你有 drive 能力點」。 - `google_drive_app_config_resolver.py`（224 行、10 支公開方法、0 守門）：Google 應用程式設定從哪讀（租戶→原廠→環境變數）。問：租戶層設定能不能被一般使用者寫入、進而把整家公司的同步導到攻擊者的 Google 應用程式。 - `drive_sync_admin_service.py`：手動觸發同步。問：能不能觸發別家公司的同步。 ### U5 — 雲端硬碟：Google 回呼＋同步排程主幹 - 🔴 **`google_drive_webhook_route.py`（不登入）**：Google 送變更通知進來，靠 header 裡的 channel id＋token 認身分。問：token 比對是不是常數時間；找不到 channel 時回的錯誤訊息會不會洩露「這個 channel 存在與否」；**攻擊者能不能狂打這支讓系統無限排同步工作**（總表 🅹 資源耗盡同型）。 - **`drive_sync_orchestration_service.py`（529 行、0 守門）**：背景同步的總指揮。問：背景工作用「哪個租戶的機器身分」跑，身分是從工作紀錄讀的還是從呼叫者帶的；工作紀錄能不能被使用者塞一筆指定別家租戶。 - `webhook_channel_manager.py`：向 Google 註冊通知頻道。問：token 怎麼產生（夠不夠隨機）。 ### U6 — 雲端硬碟：八支檔案搬移處理器 - 🔴 **會寫 `compliance.job_evidences`（沒 RLS、沒租戶欄位的表）**：五支處理器（`import`／`archive`／`soft_delete`／`reconcile`／`process_drive_changes`）直接新增或軟刪證據紀錄。問：寫入前有沒有確認「這個任務屬於這家公司」——資料庫不會幫忙擋。 - **`import_drive_file_handler.py`**：把雲端硬碟的檔案抓回系統存成證據。問：檔名、大小、類型有沒有限制（與總表 🅹 資源耗盡、檔案上傳那批比對）。 - **`process_drive_changes_handler.py`**：處理 Google 送來的變更清單。問：變更清單裡的檔案編號如果指到別家公司的資料夾，會不會被照單全收。 ### U7 — 任務入口與批次 - 🔴 **`job_batch_complete_service.py:50-56`**：總表第 59 項「預設把呼叫者當管理員」的未核對點，FR-095 盤點明寫「待 H2 核對」。 - **`job_import_service.py`（470 行、控制流程 101 處）**：Excel 批次建任務。FR-095 盤點寫「匯入三步只有最後一步有守門」。問：前兩步（上傳、預覽）能不能讀到別的專案的資料。 - **`my_grc_jobs_query.py`、`flow_control_dashboard_repo_impl.py`**：「我的任務」與儀表板查詢，原生 SQL。問：`WHERE` 條件有沒有限定「是我的」／「是我能看的專案」，還是只靠 RLS。 - `job_route.py`：只掛登入＋授權模組，權限在 `job_service._require_manager`（FR-115 W2 已掃）。問 route 這層有沒有哪支方法沒走到那道。 ### U8 — 流程背景作業 - 🔴 **用原生 SQL 寫五張沒 RLS 的表**：`reverify_clone_query.py` 對 `job_evidences`、`job_execution_devices`、`job_execution_org_units`、`task_assignees` 做 `INSERT … SELECT`；`workflow_xml_sync_service.py` 更新 `workflow_templates_trans`（沒 RLS）。問：來源與目的的專案編號是不是從同一個已驗證的物件來，還是參數各自傳進來。 - **`core/scheduler.py`（550 行、控制流程 91 處、46 處查詢）**：所有背景排程的總表。問：每個排程工作用誰的身分跑、有沒有「逐租戶切換身分」，還是一個系統身分掃全庫。 - `job_binding_orphan_cleanup_service.py`：孤兒清理會**刪資料**。問：「孤兒」的判定條件有沒有可能誤判活資料。 ### U9 — 專案摘要報告＋關聯表＋使用者／角色殘段 - 🔴 **摘要報告兩支 route、三支關聯表 service 零守門字眼**：摘要報告表沒有租戶欄位，RLS 是「專案看得到就看得到」（`EXISTS projects`）。問：同一家公司內，**非專案成員**能不能讀／改別的專案的摘要報告——RLS 只擋跨公司、不擋公司內跨專案。 - **`user_import_template_app_service.py`**：產生使用者匯入範本 Excel。FR-113 B6 的公式注入（第 150 項）這支是外部消費者，當時沒掃。問：範本裡帶的現有資料有沒有中和 `= + - @`。 - `role_app_service.py`／`user_app_service.py`：主專案側對 jedi-iam 的包裝。問：有沒有繞過套件守門直接改角色。 - `root_admin_reader.py`：讀原廠管理員帳號。問：誰能呼叫、回傳什麼欄位。 ### U10 — 系統診斷包：入口與組裝 - 守門在服務層（`diag_bundle_export_service.py:74` `require_platform_admin()`，已開檔確認）。 - 🔴 **打包的內容**：`diag_bundle_app_service.py` 收環境變數、授權檔、應用日誌、資料庫摘要、事件。問：**環境變數與日誌有沒有遮罩密碼／金鑰**（總表 🅳「敏感內容寫進日誌」同型）；平台管理員是原廠人員，但包會被寄出去給支援，外流風險在包本身。 - `since`／`until` 參數：問時間範圍有沒有上限（一次打包半年日誌＝資源耗盡）。 - `recent_error_route.py`：回最近的錯誤訊息。問：錯誤訊息會不會帶 stack trace 與內部路徑。 ### U11 — 系統診斷包：資料收集器 - 🔴 **`host_collector.py`／`container_collector.py`／`diag_log_reader.py`**：讀主機檔案與容器。問：讀哪些路徑是寫死的還是可被參數影響（路徑穿越）；有沒有呼叫外部指令、參數怎麼組（指令注入）。 - **`diag_db_reader.py`（242 行、16 處查詢）**：讀 `system_logs`、`schema_migrations`。問：用哪個資料庫帳號、會不會把其他客戶的日誌一起打包。 - `diag_packer.py`：打 tar.gz。問：檔名與壓縮大小的上限。 ### U12 — 零散殘段 - **`common/integrity/adapters.py`（357 行、24 處查詢）**：主專案給 jedi-integrity（防竄改）套件的接線，FR-084 只掃了套件本體。問：雜湊鏈寫入 `api_logs`（沒 RLS）時的租戶歸屬。 - **兩支解析工作單 repo（`ssp_docx_parse_job_repo_impl.py`／`ssp_excel_parse_job_repo_impl.py`）**：FR-116 C4a 驗收時登記「兩張解析工作單表 RLS 壞規則」，這兩支就是讀寫那兩張表的程式，當時沒在範圍內。 - `notification_socketio_handler.py`：即時通知的 WebSocket 連線。問：連線時怎麼認身分、能不能訂閱別人的通知頻道。 --- ## 4. 掃過但之後有新增（41 支有改動，8 支加了新函式） 做法：每支「已掃」檔，拿它最後一次被掃時的 commit（stamp 裡的 `revision.commit`）對 HEAD 做 `git diff`，數新增行與新增 `def`。**41 支掃後有改動，其中 8 支新增了函式、0 支新增了網址入口**。只改註解、import 路徑、欄位的列在後面。 ### 4.1 🔴 有新增函式的 8 支（建議決策者裁要不要補掃） | 檔 | 最後掃描 | 掃後新增行 | 新增函式 | 主要改動 | 建議 | |---|---|---:|---:|---|---| | `app/system_config/service/guarded_system_config_service.py`（665 行） | 09-15 FR-096 H1 | **391** | **12** | 09-17～18 八個 commit：AI 金鑰遮罩／寫入合併、Google Drive 應用程式設定群組、平台管理員守門（`_platform_admin_only`、`_assert_restricted_group_access`） | 🔴 **要補**。掃後新增量比掃時還大，而且新增的就是守門本身。總表第 74 項（09-20 複查）已點「這道守門的涵蓋名單只有 AI 金鑰與雲端硬碟兩組」——那是人工看的，沒經工具。**可併進 U4**（U4 1,786＋665＝2,451 行會爆），建議**單獨一棒**或併進 U12（709＋665＝1,374 行） | | `app/system_config/service/tenant_storage_config_seeder.py` | 09-15 FR-096 H1 | 47 | 1 | 09-17 AI 分類設定金鑰寫入 | 跟上一支一起帶 | | `app/cloud_integration/service/drive_project_verify_service.py` | 09-14 FR-095 H1 | 36 | 2 | 09-18 「專案總覽一鍵開啟 Drive 資料夾」新方法 `get_project_folders`，由 `google_drive_sync_route.py:187` 呼叫 | **已排進 U4 的接縫**（U4 會讀那支 route）；在 U4 卡上點名看新方法即可，不另開 | | `infra/flow_engine/repository/job_evidence_repo_impl.py` | 09-12 FR-088 H2 | 29 | 2 | 09-17 證據 AI 分類新增 `get_active_by_job_and_file`、`find_active_by_content_hash` | 🟡 呼叫者是 `core/plugins/evidence_classification.py`（FR-115 W7 09-23 已掃）。新方法是 repo 查詢，`job_evidences` 沒 RLS——問「查詢有沒有限定任務範圍」。**可在 U6 帶入**（U6 本來就寫這張表） | | `domain/flow_engine/repository/job_evidence.py` | 09-12 | 16 | 2 | 同上（介面） | 同上 | | `domain/flow_engine/service/job_evidence_domain_service.py` | 09-12 | 10 | 2 | 同上（轉呼叫） | 同上 | | `di_containers/dashboard_apis/__init__.py` | 09-10 FR-083 D2 | 34 | 2 | 09-16 意見回饋上移 jedi-issue，新增 `package_service()` 取用口 | 🟢 DI 取用口，併入 U13 DI 專掃 | | `di_containers/ai_dashboard/ai_dashboard_containers.py` | 09-10 FR-083 D2 | 39 | 1 | 09-17 AI 金鑰統一來源 `_ai_api_keys()` | 🟢 併入 U13 | ### 4.2 有改動但沒新增函式的 33 支（不建議補） 大宗是三種：①09-12～16 的「wiring 併進 `core/plugins/`」「import 路徑改指套件」「施工日誌註解收斂」；②09-14 FR-094.4b 的 `flow_template` 系列加 `scope`／`tenant_id` 欄位（8 支，最多 15 行）；③09-13 FR-092 刪死碼（只減不增）。唯一值得一提的是： - `di_containers/bulletin/bulletin_containers.py`（+70 行，09-12 wiring 搬家）、`di_containers/flow_control/flow_control_containers.py`（+31 行，09-20 FR-112「強制開始」端點的接線）——兩支都是 DI，併入 U13 專掃時一起看。FR-112 強制開始的 route／service 本身 FR-115 W8 已在 09-23 掃過。 - `app/upload_file/service/managed_file_upload_service.py`（+33 行，09-16 批次 API 儲存轉接頭）——沒新增函式，改的是既有方法的參數，影響小。 完整 41 支清單的驗證方式： ```bash # 對某支檔： 取該檔最後一次掃描 stamp 的 revision.commit git diff -U0 HEAD -- <檔> | grep -E '^\+\s*(async\s+)?def ' ``` --- ## 5. DI 組裝檔清單（另一種掃法） **為什麼另列**：FR-113 O9b 與 FR-116 C1／C5 證實「組裝時漏接一個零件，守門程式寫得再完整也不會執行，而且不會報錯」。這種問題**不在任何一支業務程式裡**，只看得出「宣告需要四個零件、組裝時只給了三個」。所以 DI 檔要用「對照表」的方式掃：每個需要守門零件的 service，它在容器裡的建構參數是不是全部接上。 ### 5.1 全貌 主專案 DI 相關檔（`di_containers/`＋`core/plugins/`＋`config/di_modules.py`，排除 0 行 `__init__`）共 **75 支、11,062 行**： | 狀態 | 檔數 | 行數 | |---|---:|---:| | 已被某棒掃過（多半是順帶，不是專門對照零件） | 58 | 8,222 | | **從沒碰過** | **17** | **2,840** | ⚠️ **「掃過」不等於「對照過零件」**：前面各棒把容器檔放進範圍，是為了讓研究員追得到 service 從哪來，不是專門核對「每個參數都接了」。真正專門做這件事的只有 FR-113 O9b（面板沒跑完）與 FR-116 C1／C5。 ### 5.2 從沒碰過的 17 支 | 檔 | 行數 | 接的是什麼 | |---|---:|---| | `core/plugins/identity.py` | 679 | 🔴 身分與權限套件（jedi-iam）的主專案接線——守門零件從這裡交出去 | | `di_containers/containers.py` | 397 | 總組裝表，每個容器登記一行 | | `di_containers/cloud_integration/cloud_integration_containers.py` | 310 | 雲端硬碟整合（U4～U6 的零件全在這） | | `config/di_modules.py` | 225 | 自動掃描要 wire 哪些模組（漏列＝該模組的 `@inject` 全部拿不到東西） | | `core/plugins/bulletin.py` | 220 | 公告套件接線（FR-079 B2 掃的是 09-12 搬家前的舊位置） | | `core/plugins/file_upload.py` | 145 | 檔案上傳套件接線（同上，FR-086 B2 掃舊位置） | | `core/plugins/ai_bot.py` | 135 | AI 聊天機器人接線 | | `core/plugins/ai_dashboard.py` | 98 | AI 儀表板接線 | | `core/plugins/integrity.py` | 93 | 防竄改接線 | | `di_containers/license/license_containers.py` | 84 | 🔴 授權檢查的零件（U1 `license.py` 從這拿） | | `core/plugins/__init__.py` | 83 | 插件清單 | | `core/plugins/flow_engine.py` | 83 | 流程引擎接線 | | `core/plugins/notification.py` | 83 | 通知接線 | | `di_containers/support/support_containers.py` | 82 | 診斷包（U10／U11） | | `di_containers/project/project_summary_report_containers.py` | 48 | 摘要報告（U9） | | `di_containers/setup/setup_containers.py` | 41 | 安裝精靈（U3） | | `di_containers/identity/identity_containers.py` | 34 | 身分 | ### 5.3 建議：U13 DI 專掃（兩種做法擇一） - **做法 A（只掃沒碰過的）**：17 支 2,840 行，超過 2,000 行上限，切兩半——**U13a**：`core/plugins/` 九支＋`config/di_modules.py`（1,666 行）；**U13b**：`di_containers/` 七支（996 行）。 - **做法 B（全部對照一遍）**：75 支 11,062 行，要切 6～7 棒。**不建議用掃描工具做**——這件事用工具效益低（工具擅長找「程式寫錯」，不擅長找「少接一條線」），**用一支腳本比較快**：列出每個 service 建構子的參數、再列出容器給的參數，比對缺漏。這是實作卡，不是掃描卡，建議首腦裁要不要開。 --- ## 6. 資料庫隔離對照表（沒碰的模組會寫到哪些表） 查 `scripts/init/02-schema.sql`（出貨基線）。「有客戶欄位」＝表上有 `tenant_id`；「RLS」＝有 `ENABLE ROW LEVEL SECURITY`。**全檔只有 1 張表開了 `FORCE`，下表全部沒開 FORCE**（表的擁有者帳號會繞過 RLS）。 | 表 | 客戶欄位 | RLS | 寫它的沒碰程式（棒） | 白話 | |---|---|---|---|---| | `public.tenant_drive_integrations` | 有 | 開 | U4 repo | ✅ 有隔離 | | `public.drive_sync_jobs` | 有 | 開 | U5 repo | ✅ 有隔離；但背景工作用機器身分跑，要看身分怎麼切 | | `public.drive_folder_mappings` | 有 | 開 | U6 repo | ✅ 有隔離（同上） | | `compliance.job_evidences` | **無** | **無** | U6 五支處理器、U8 `reverify_clone_query` | 🔴 **沒有任何隔離**，全靠程式自己檢查（總表第 49 項同一張表） | | `compliance.task_assignees` | 無 | 無 | U8 `reverify_clone_query` | 🔴 同上（總表第 22 項：觸發器函式讀不存在的欄位） | | `compliance.job_execution_devices` | 無 | 無 | U8 | 🔴 同上 | | `compliance.job_execution_org_units` | 無 | 無 | U8 | 🔴 同上 | | `compliance.workflow_templates_trans` | 無 | 無 | U8 `workflow_xml_sync_service` | 🟡 翻譯表，本體 `workflow_templates` 有 RLS；子表沒有 | | `survey.task_surveys`／`survey.question_answers` | 無 | 開 | U8 `reverify_clone_query` | 🟡 RLS 是靠關聯推的 | | `compliance.project_summary_reports`／`…_histories` | 無 | 開（`EXISTS projects`） | U9 | 🟡 擋得住跨公司，**擋不住同公司跨專案** | | `compliance.project_assessment_plan_mapping`／`project_org_unit_mapping`／`project_system_characteristic_mapping` | 無 | 開（`EXISTS projects`） | U9 | 🟡 同上 | | `oscal.ssp_docx_parse_jobs`／`ssp_excel_parse_jobs` | 有 | 開 | U12 | 🟡 FR-116 C4a 驗收時登記「RLS 規則寫壞」 | | `public.api_logs` | 無 | 無 | U12 `integrity/adapters.py`（讀寫雜湊鏈） | 🟡 日誌表，設計上跨租戶；看的是「誰讀得到」 | | `public.system_logs`／`schema_migrations` | 無 | 無 | U11 `diag_db_reader`（只讀） | 🟢 平台管理員限定，唯讀 | | `public.users` | 有 | 開 | U3 `setup_state_reader`（只讀、繞 RLS 數使用者） | 🟢 只讀一個數字 | --- ## 7. 盤點時發現、需要首腦裁決的事 1. **要不要掃 U7（任務入口與批次）**：這三支在 FR-115 盤點被寫成「屬任務平台地盤、FR-095 裁停」，但 FR-095 H2（CM-1783）是「待派」不是「裁不掃」，而且這三支在主專案、不在套件。本盤點建議掃（總表第 59 項的核對點在這）。 2. **總表／FR-115 盤點有一句要更正**：「`common/authz/` 全專案共用守門本體，FR-085 C1 已掃」不成立（見開頭第 3 點）。建議首腦在總表 §0.5 補一句。 3. **`guarded_system_config_service.py` 要不要補掃**（第 4.1 節）：掃後新增 391 行、12 支函式，新增的就是守門。建議補，放 U12 一起（合計 1,374 行）。 4. **DI 專掃用工具還是用腳本**（第 5.3 節）。 5. **O9b 沒查完的「人員對帳跨公司比對」要不要補**（第 1.2 節）：可併 U12。**若 3 與 5 都併 U12，U12 會到約 1,770 行，仍在上限內**。 6. **打折處照實講**：①「部分掃過」21 支依報告與盤點檔判定，四棒 stamp 目錄已不在 BE repo 根下，無法用 stamp 複核；② 判斷邏輯／純宣告的分法是 AST 自動算的，純宣告裡有 14 支不屬於標準宣告目錄（例如 `config/config.py`、兩支只有轉呼叫的 domain service），已逐支看過列在附錄 A；③ 守門字眼只是 grep，**0 次不等於沒守**（例如診斷包守門在 export service，路由檔是 0）。 --- ## 8. 建議派工順序與總量 | 優先 | 棒 | 理由 | |---|---|---| | 1 | U1 權限共用層 | 地基；後面每棒都會追進來 | | 2 | U2 中介層 | 每個請求都經過 | | 3 | U3 安裝精靈 | 登入前打得到 | | 4 | U5 雲端硬碟回呼＋排程 | 不登入的外部入口＋零守門 | | 5 | U6 雲端硬碟處理器 | 寫沒隔離的表 | | 6 | U7 任務入口 | 第 59 項核對點 | | 7 | U4 雲端硬碟設定 | 守門多，看「問得對不對」 | | 8 | U8 流程背景作業 | 寫四張沒隔離的表 | | 9 | U9 摘要報告＋關聯表 | 同公司跨專案 | | 10 | U12（＋`guarded_system_config`＋O9b 殘段） | 零散 | | 11 | U10／U11 診斷包 | 平台管理員限定，門檻高 | | 12 | U13a／U13b DI 專掃 | 另一種掃法，看首腦裁 | **總量**：判斷邏輯 12 棒 17,511 行；加上補掃與 DI 最多 14 棒約 21,300 行。時間參考（報告實記，不是估算）：FR-113 O9a 916 行 1 小時 37 分、B1c 925 行 1 小時 27 分、O9b 1,903 行研究階段 1 小時 52 分（面板另計）。本批每棒 700～1,900 行，照這個量級每棒約 1.5～3 小時；幾線並行由首腦依額度定。 --- ## 附錄 A：不掃的宣告檔（258 支／4,792 行） 理由：沒有 if／for／try、沒有查詢組裝，只是資料形狀、名稱、常數的宣告。其中 **160 支是 `__init__.py`（共 372 行，多半 0 行）不逐列**；其餘 98 支如下。 | 類別 | 檔數 | 行數 | 為什麼不掃 | |---|---:|---:|---| | 序列化器（serializers） | 27 | 797 | 欄位型別宣告，驗證規則由 marshmallow 套件執行 | | 錯誤碼／常數／列舉 | 15 | 1,279 | 純字串與數字 | | entity | 13 | 457 | 資料類別，0 個方法 | | repo 介面（domain） | 12 | 349 | 抽象方法宣告，沒實作 | | mapper | 8 | 294 | 欄位對拷 | | dto | 5 | 159 | 資料類別 | | model | 4 | 184 | 資料表欄位宣告 | | 其他 | 14 | 901 | 逐支看過：`config/config.py`（設定值宣告，憑證問題已由 CM-1631 等卡處理）、`config/app_modules.py`（模組名單）、`core/extensions.py`（空物件）、兩支關聯表 domain service 與兩支摘要報告 domain service（只轉呼叫 repo、0 分支）、兩支介面檔（`drive_api_client_interface`、`collector/protocol`）、`base_job_handler`、`token_crypto_service`、`common_schema`、`config_util`、`vw_user_job_queue`（唯讀檢視表宣告） | 清單（`__init__.py` 除外）： | 路徑 | 行數 | |---|---:| | `api/cloud_integration/serializers/drive_sync_job.py` | 22 | | `api/cloud_integration/serializers/google_drive_integration.py` | 55 | | `api/oscal/serializers/oscal_common/base/oscal_document.py` | 15 | | `api/oscal/serializers/oscal_common/base/oscal_link.py` | 15 | | `api/oscal/serializers/oscal_common/base/oscal_location.py` | 14 | | `api/oscal/serializers/oscal_common/base/oscal_metadata.py` | 34 | | `api/oscal/serializers/oscal_common/base/oscal_party.py` | 17 | | `api/oscal/serializers/oscal_common/base/oscal_prop.py` | 16 | | `api/oscal/serializers/oscal_common/base/oscal_remarks.py` | 12 | | `api/oscal/serializers/oscal_common/base/oscal_responsible_party.py` | 13 | | `api/oscal/serializers/oscal_common/base/oscal_role.py` | 14 | | `api/oscal/serializers/oscal_common/catalog/catalog.py` | 27 | | `api/oscal/serializers/oscal_common/catalog/catalog_control.py` | 38 | | `api/oscal/serializers/oscal_common/catalog/catalog_control_assessment.py` | 20 | | `api/oscal/serializers/oscal_common/catalog/catalog_control_parameter.py` | 16 | | `api/oscal/serializers/oscal_common/catalog/catalog_control_part.py` | 16 | | `api/oscal/serializers/oscal_common/catalog/catalog_group.py` | 23 | | `api/oscal/serializers/oscal_common/profile/profile.py` | 31 | | `api/oscal/serializers/oscal_common/profile/profile_control.py` | 16 | | `api/oscal/serializers/ssp/ssp_system_characteristic_inproject.py` | 32 | | `api/project/serializers/ap_docx_import.py` | 51 | | `api/project/serializers/ar_import.py` | 44 | | `api/project/serializers/project.py` | 143 | | `api/project_summary_report/serializers/project_summary_report.py` | 39 | | `api/project_summary_report/serializers/project_summary_report_history.py` | 21 | | `api/support/serializers/diagnostic_bundle.py` | 20 | | `api/support/serializers/recent_error.py` | 33 | | `app/cloud_integration/dto/google_drive_integration_dto.py` | 54 | | `app/cloud_integration/service/handlers/base_job_handler.py` | 36 | | `app/cloud_integration/service/handlers/exceptions.py` | 25 | | `app/common/dto/base_dto.py` | 5 | | `app/common/schema/common_schema.py` | 4 | | `app/project_summary_report/dto/project_summary_report_dto.py` | 44 | | `app/project_summary_report/dto/project_summary_report_history_dto.py` | 41 | | `app/setup/code/setup_error_code.py` | 27 | | `common/code/detection_tools_error_code.py` | 209 | | `common/code/error_code.py` | 185 | | `common/code/file_storage_type.py` | 9 | | `common/code/flow_control_error_code.py` | 513 | | `common/constant/ai_service_config.py` | 29 | | `common/constant/drive_app_config.py` | 45 | | `common/constant/tenant.py` | 11 | | `common/dto/file_info_dto.py` | 15 | | `common/enum/event_code.py` | 133 | | `common/enum/participant_enum.py` | 18 | | `common/exception_error/common_exception.py` | 24 | | `config/app_modules.py` | 146 | | `config/config.py` | 310 | | `config/config_util.py` | 16 | | `core/extensions.py` | 32 | | `domain/associations/entity/project_assessment_plan_mapping_query_entity.py` | 13 | | `domain/associations/entity/project_org_unit_mapping_query_entity.py` | 13 | | `domain/associations/entity/project_system_characteristic_mapping_query_entity.py` | 13 | | `domain/associations/repository/project_assessment_plan_mapping.py` | 22 | | `domain/associations/repository/project_org_unit_mapping.py` | 10 | | `domain/associations/repository/project_system_characteristic_mapping.py` | 13 | | `domain/associations/service/project_assessment_plan_mapping_domain_service.py` | 36 | | `domain/associations/service/project_org_unit_mapping_domain_service.py` | 23 | | `domain/cloud_integration/entities/drive_folder_mapping_entity.py` | 19 | | `domain/cloud_integration/entities/drive_sync_job_entity.py` | 22 | | `domain/cloud_integration/entities/tenant_drive_integration_entity.py` | 31 | | `domain/cloud_integration/enums/scope_type.py` | 13 | | `domain/cloud_integration/enums/sync_job_type.py` | 12 | | `domain/cloud_integration/repository/drive_folder_mapping_repository.py` | 66 | | `domain/cloud_integration/repository/drive_sync_job_repository.py` | 70 | | `domain/cloud_integration/repository/tenant_drive_integration_repository.py` | 29 | | `domain/cloud_integration/service/drive_api_client_interface.py` | 67 | | `domain/cloud_integration/service/token_crypto_service.py` | 9 | | `domain/oscal/entity/ssp_docx_parse_job_entity.py` | 70 | | `domain/oscal/entity/ssp_excel_parse_job_entity.py` | 70 | | `domain/oscal/repository/i_framework_parse_job_repo.py` | 39 | | `domain/oscal/repository/i_ssp_catalog_title_query.py` | 24 | | `domain/oscal/repository/i_ssp_docx_parse_job_repo.py` | 25 | | `domain/oscal/repository/i_ssp_excel_parse_job_repo.py` | 25 | | `domain/project_summary_report/entity/project_summary_report_entity.py` | 28 | | `domain/project_summary_report/entity/project_summary_report_history_entity.py` | 26 | | `domain/project_summary_report/entity/project_summary_report_history_query_filter.py` | 17 | | `domain/project_summary_report/entity/project_summary_report_query_filter.py` | 19 | | `domain/project_summary_report/repository/project_summary_reoprt.py` | 18 | | `domain/project_summary_report/repository/project_summary_reoprt_history.py` | 8 | | `domain/project_summary_report/service/project_summary_report_domain_service.py` | 52 | | `domain/project_summary_report/service/project_summary_report_history_domain_service.py` | 21 | | `domain/support/entity/diag_bundle.py` | 116 | | `infra/cloud_integration/google_drive/exceptions.py` | 26 | | `infra/cloud_integration/mapper/drive_folder_mapping_mapper.py` | 35 | | `infra/cloud_integration/mapper/drive_sync_job_mapper.py` | 39 | | `infra/cloud_integration/mapper/tenant_drive_integration_mapper.py` | 56 | | `infra/cloud_integration/models/drive_folder_mapping.py` | 34 | | `infra/cloud_integration/models/drive_sync_job.py` | 38 | | `infra/cloud_integration/models/tenant_drive_integration.py` | 45 | | `infra/oscal/mapper/framework_parse_job_mapper.py` | 39 | | `infra/oscal/mapper/ssp_docx_parse_job_mapper.py` | 35 | | `infra/oscal/mapper/ssp_excel_parse_job_mapper.py` | 35 | | `infra/project_summary_report/mapper/project_summary_report_history_mapper.py` | 27 | | `infra/project_summary_report/mapper/project_summary_report_mapper.py` | 28 | | `infra/project_summary_report/models/project_summary_report_history.py` | 67 | | `infra/readmodel/tasks/vw_user_job_queue.py` | 94 | | `infra/support/collector/protocol.py` | 55 | --- ## 附錄 B：826 支逐檔狀態總表 「哪一棒」欄：掃過／部分掃過的列掃描目錄或棒名；沒碰的列所屬的堆，判斷邏輯堆標出排進哪一棒。 | 路徑 | 行數 | 狀態 | 哪一棒 | |---|---:|---|---| | `api/__init__.py` | 3 | ❌ 沒碰 | 純宣告 | | `api/cloud_integration/__init__.py` | 84 | ❌ 沒碰 | 判斷邏輯（→ U4） | | `api/cloud_integration/routes/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `api/cloud_integration/routes/drive_app_credential_verify_route.py` | 44 | ❌ 沒碰 | 判斷邏輯（→ U4） | | `api/cloud_integration/routes/google_drive_integration_route.py` | 140 | ❌ 沒碰 | 判斷邏輯（→ U4） | | `api/cloud_integration/routes/google_drive_sync_route.py` | 260 | ❌ 沒碰 | 判斷邏輯（→ U4） | | `api/cloud_integration/routes/google_drive_webhook_route.py` | 64 | ❌ 沒碰 | 判斷邏輯（→ U5） | | `api/cloud_integration/serializers/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `api/cloud_integration/serializers/drive_sync_job.py` | 22 | ❌ 沒碰 | 純宣告 | | `api/cloud_integration/serializers/google_drive_integration.py` | 55 | ❌ 沒碰 | 純宣告 | | `api/flow_control/__init__.py` | 135 | ✅ 掃過 | CLAUDE-SECURITY-20260924-072304 | | `api/flow_control/routes/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `api/flow_control/routes/assessment_plan_route.py` | 117 | ✅ 掃過 | CLAUDE-SECURITY-20260924-082233 | | `api/flow_control/routes/job_force_start_route.py` | 84 | ✅ 掃過 | CLAUDE-SECURITY-20260923-143410 | | `api/flow_control/routes/job_route.py` | 259 | ❌ 沒碰 | 判斷邏輯（→ U7） | | `api/flow_control/routes/project_route.py` | 273 | ✅ 掃過 | CLAUDE-SECURITY-20260924-082233 | | `api/flow_control/serializers/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `api/flow_control/serializers/job.py` | 417 | ❌ 沒碰 | 判斷邏輯（→ U7） | | `api/flow_engine/__init__.py` | 102 | ✅ 掃過 | CLAUDE-SECURITY-20260912-034350 | | `api/flow_engine/routes/flow_engine_route.py` | 192 | ✅ 掃過 | CLAUDE-SECURITY-20260912-034350 | | `api/flow_engine/routes/flow_template_route.py` | 144 | ✅ 掃過 | CLAUDE-SECURITY-20260913-021915 | | `api/flow_engine/routes/job_evidence_route.py` | 148 | ✅ 掃過 | CLAUDE-SECURITY-20260912-034350 | | `api/flow_engine/routes/stage_advance_route.py` | 71 | ✅ 掃過 | CLAUDE-SECURITY-20260912-073625 | | `api/flow_engine/routes/stage_object_route.py` | 22 | ✅ 掃過 | CLAUDE-SECURITY-20260912-073625 | | `api/flow_engine/routes/stage_rollback_route.py` | 67 | ✅ 掃過 | CLAUDE-SECURITY-20260912-073625 | | `api/flow_engine/serializers/flow_engine/element_variable.py` | 14 | ✅ 掃過 | CLAUDE-SECURITY-20260912-034350 | | `api/flow_engine/serializers/flow_engine/job_evidence.py` | 54 | ✅ 掃過 | CLAUDE-SECURITY-20260912-034350 | | `api/flow_engine/serializers/flow_engine/job_execution.py` | 231 | ✅ 掃過 | CLAUDE-SECURITY-20260912-034350 | | `api/flow_engine/serializers/flow_engine/job_template.py` | 10 | ✅ 掃過 | CLAUDE-SECURITY-20260912-034350 | | `api/flow_engine/serializers/flow_engine/ref_control_proof_doc.py` | 11 | ✅ 掃過 | CLAUDE-SECURITY-20260912-034350 | | `api/flow_engine/serializers/flow_engine/workflow_execution.py` | 59 | ✅ 掃過 | CLAUDE-SECURITY-20260912-034350 | | `api/flow_engine/serializers/flow_template.py` | 68 | ✅ 掃過 | CLAUDE-SECURITY-20260913-021915 | | `api/flow_engine/serializers/stage_advance.py` | 74 | ✅ 掃過 | CLAUDE-SECURITY-20260912-073625 | | `api/flow_engine/serializers/stage_object.py` | 19 | ✅ 掃過 | CLAUDE-SECURITY-20260912-073625 | | `api/flow_engine/serializers/stage_rollback.py` | 39 | ✅ 掃過 | CLAUDE-SECURITY-20260912-073625 | | `api/module_frame/__init__.py` | 252 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104426 | | `api/module_frame/routes/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `api/module_frame/routes/mf_ssp_export_route.py` | 71 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104527 | | `api/module_frame/routes/module_frame_components_route.py` | 78 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104527 | | `api/module_frame/routes/module_frame_control_default_route.py` | 139 | ✅ 掃過 | CLAUDE-SECURITY-20260922-090431 | | `api/module_frame/routes/module_frame_control_objective_default_route.py` | 147 | ✅ 掃過 | CLAUDE-SECURITY-20260922-090431 | | `api/module_frame/routes/module_frame_import_route.py` | 95 | ✅ 掃過 | CLAUDE-SECURITY-20260923-095422 | | `api/module_frame/routes/module_frame_inventory_route.py` | 78 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104527 | | `api/module_frame/routes/module_frame_item_route.py` | 128 | ⚠️ 部分 | FR-113 B1-item | | `api/module_frame/routes/module_frame_leveraged_route.py` | 91 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104527 | | `api/module_frame/routes/module_frame_party_route.py` | 95 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104527 | | `api/module_frame/routes/module_frame_reference_document_route.py` | 281 | ✅ 掃過 | CLAUDE-SECURITY-20260922-090431 | | `api/module_frame/routes/module_frame_route.py` | 102 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104426 | | `api/module_frame/routes/module_frame_ssp_resources_route.py` | 99 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104527 | | `api/module_frame/routes/module_frame_system_characteristic_route.py` | 56 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104527 | | `api/module_frame/routes/module_frame_template_import_route.py` | 260 | ✅ 掃過 | CLAUDE-SECURITY-20260922-090410 | | `api/module_frame/routes/ssp_import_template_route.py` | 169 | ✅ 掃過 | CLAUDE-SECURITY-20260922-090440 | | `api/module_frame/serializers/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `api/module_frame/serializers/module_frame.py` | 153 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104426 | | `api/module_frame/serializers/module_frame_control_default.py` | 46 | ✅ 掃過 | CLAUDE-SECURITY-20260922-090431 | | `api/module_frame/serializers/module_frame_control_objective_default.py` | 49 | ✅ 掃過 | CLAUDE-SECURITY-20260922-090431 | | `api/module_frame/serializers/module_frame_item.py` | 38 | ⚠️ 部分 | FR-113 B1-item | | `api/module_frame/serializers/module_frame_party.py` | 43 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104527 | | `api/module_frame/serializers/module_frame_reference_document.py` | 61 | ✅ 掃過 | CLAUDE-SECURITY-20260922-090431 | | `api/module_frame/serializers/module_frame_template_import.py` | 105 | ✅ 掃過 | CLAUDE-SECURITY-20260922-090410 | | `api/notify_config/__init__.py` | 20 | ✅ 掃過 | CLAUDE-SECURITY-20260908-073510 | | `api/notify_config/routes/__init__.py` | 0 | ✅ 掃過 | CLAUDE-SECURITY-20260908-073510 | | `api/notify_config/routes/notify_config_route.py` | 36 | ✅ 掃過 | CLAUDE-SECURITY-20260908-073510 | | `api/notify_config/serializers/__init__.py` | 0 | ✅ 掃過 | CLAUDE-SECURITY-20260908-073510 | | `api/notify_config/serializers/notify_config.py` | 11 | ✅ 掃過 | CLAUDE-SECURITY-20260908-073510 | | `api/oscal/__init__.py` | 201 | ⚠️ 部分 | FR-113 O9b | | `api/oscal/routes/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `api/oscal/routes/framework/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `api/oscal/routes/framework/framework_parse_job_route.py` | 178 | ✅ 掃過 | CLAUDE-SECURITY-20260921-154612 | | `api/oscal/routes/framework/framework_version_edit_route.py` | 132 | ✅ 掃過 | CLAUDE-SECURITY-20260921-154528 | | `api/oscal/routes/framework/oscal_framework_route.py` | 104 | ✅ 掃過 | CLAUDE-SECURITY-20260921-154528 | | `api/oscal/routes/framework/oscal_framework_version_route.py` | 157 | ✅ 掃過 | CLAUDE-SECURITY-20260921-154528 | | `api/oscal/routes/module_frame_template_ssp_route.py` | 38 | ✅ 掃過 | CLAUDE-SECURITY-20260921-060255；CLAUDE-SECURITY-20260922-104527 | | `api/oscal/routes/resource_library_route.py` | 62 | ✅ 掃過 | CLAUDE-SECURITY-20260921-060255 | | `api/oscal/routes/ssp/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `api/oscal/routes/ssp/ssp_components_route.py` | 85 | ✅ 掃過 | CLAUDE-SECURITY-20260921-113212 | | `api/oscal/routes/ssp/ssp_control_impl_import_route.py` | 114 | ✅ 掃過 | CLAUDE-SECURITY-20260921-113255 | | `api/oscal/routes/ssp/ssp_control_implementation_route.py` | 309 | ✅ 掃過 | CLAUDE-SECURITY-20260921-061133 | | `api/oscal/routes/ssp/ssp_document_pool_route.py` | 183 | ⚠️ 部分 | FR-113 O6 | | `api/oscal/routes/ssp/ssp_docx_import_route.py` | 105 | ✅ 掃過 | CLAUDE-SECURITY-20260921-113255 | | `api/oscal/routes/ssp/ssp_excel_import_route.py` | 112 | ✅ 掃過 | CLAUDE-SECURITY-20260921-081023 | | `api/oscal/routes/ssp/ssp_export_route.py` | 72 | ✅ 掃過 | CLAUDE-SECURITY-20260921-060255 | | `api/oscal/routes/ssp/ssp_inventory_items_route.py` | 84 | ✅ 掃過 | CLAUDE-SECURITY-20260921-113212 | | `api/oscal/routes/ssp/ssp_leveraged_route.py` | 78 | ✅ 掃過 | CLAUDE-SECURITY-20260921-113212 | | `api/oscal/routes/ssp/ssp_party_route.py` | 84 | ✅ 掃過 | CLAUDE-SECURITY-20260921-113212 | | `api/oscal/routes/ssp/ssp_resources_route.py` | 88 | ✅ 掃過 | CLAUDE-SECURITY-20260921-113212 | | `api/oscal/routes/ssp/ssp_scoped_excel_import_route.py` | 130 | ✅ 掃過 | CLAUDE-SECURITY-20260921-081023 | | `api/oscal/routes/ssp/ssp_system_characteristic_route.py` | 51 | ✅ 掃過 | CLAUDE-SECURITY-20260921-113212 | | `api/oscal/serializers/__init__.py` | 17 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/framework/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/framework/oscal_framework.py` | 165 | ✅ 掃過 | CLAUDE-SECURITY-20260921-154528 | | `api/oscal/serializers/framework/oscal_framework_version.py` | 34 | ✅ 掃過 | CLAUDE-SECURITY-20260921-154528 | | `api/oscal/serializers/framework_parse_job/__init__.py` | 19 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/framework_parse_job/framework_parse_job_schemas.py` | 201 | ✅ 掃過 | CLAUDE-SECURITY-20260921-154612 | | `api/oscal/serializers/framework_version_edit/__init__.py` | 13 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/framework_version_edit/schemas.py` | 60 | ✅ 掃過 | CLAUDE-SECURITY-20260921-154528 | | `api/oscal/serializers/oscal_common/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/oscal_common/base/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/oscal_common/base/oscal_document.py` | 15 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/oscal_common/base/oscal_link.py` | 15 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/oscal_common/base/oscal_location.py` | 14 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/oscal_common/base/oscal_metadata.py` | 34 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/oscal_common/base/oscal_party.py` | 17 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/oscal_common/base/oscal_prop.py` | 16 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/oscal_common/base/oscal_remarks.py` | 12 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/oscal_common/base/oscal_responsible_party.py` | 13 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/oscal_common/base/oscal_role.py` | 14 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/oscal_common/catalog/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/oscal_common/catalog/catalog.py` | 27 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/oscal_common/catalog/catalog_control.py` | 38 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/oscal_common/catalog/catalog_control_assessment.py` | 20 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/oscal_common/catalog/catalog_control_parameter.py` | 16 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/oscal_common/catalog/catalog_control_part.py` | 16 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/oscal_common/catalog/catalog_group.py` | 23 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/oscal_common/profile/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/oscal_common/profile/profile.py` | 31 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/oscal_common/profile/profile_control.py` | 16 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/ssp/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `api/oscal/serializers/ssp/ssp_control_impl_import.py` | 59 | ✅ 掃過 | CLAUDE-SECURITY-20260921-113255 | | `api/oscal/serializers/ssp/ssp_control_impl_objective.py` | 27 | ✅ 掃過 | CLAUDE-SECURITY-20260921-061133 | | `api/oscal/serializers/ssp/ssp_control_implementation.py` | 88 | ✅ 掃過 | CLAUDE-SECURITY-20260921-061133 | | `api/oscal/serializers/ssp/ssp_document_pool.py` | 37 | ⚠️ 部分 | FR-113 O6 | | `api/oscal/serializers/ssp/ssp_docx_import.py` | 185 | ✅ 掃過 | CLAUDE-SECURITY-20260921-113255 | | `api/oscal/serializers/ssp/ssp_excel_import.py` | 137 | ✅ 掃過 | CLAUDE-SECURITY-20260921-081023 | | `api/oscal/serializers/ssp/ssp_party.py` | 47 | ❌ 沒碰 | 判斷邏輯（→ U12） | | `api/oscal/serializers/ssp/ssp_system_characteristic_inproject.py` | 32 | ❌ 沒碰 | 純宣告 | | `api/project/__init__.py` | 88 | ❌ 沒碰 | 判斷邏輯（→ U9） | | `api/project/routes/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `api/project/routes/ap_docx_import_route.py` | 116 | ✅ 掃過 | CLAUDE-SECURITY-20260924-090417 | | `api/project/routes/ar_import_route.py` | 116 | ✅ 掃過 | CLAUDE-SECURITY-20260924-102701 | | `api/project/routes/audit_round_route.py` | 508 | ✅ 掃過 | CLAUDE-SECURITY-20260924-050412；CLAUDE-SECURITY-20260924-050420 | | `api/project/routes/project_route.py` | 69 | ❌ 沒碰 | 判斷邏輯（→ U9） | | `api/project/serializers/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `api/project/serializers/ap_docx_import.py` | 51 | ❌ 沒碰 | 純宣告 | | `api/project/serializers/ar_import.py` | 44 | ❌ 沒碰 | 純宣告 | | `api/project/serializers/assessment_plan.py` | 148 | ❌ 沒碰 | 判斷邏輯（→ U9） | | `api/project/serializers/audit_round.py` | 239 | ✅ 掃過 | CLAUDE-SECURITY-20260924-050420 | | `api/project/serializers/project.py` | 143 | ❌ 沒碰 | 純宣告 | | `api/project_summary_report/__init__.py` | 43 | ❌ 沒碰 | 判斷邏輯（→ U9） | | `api/project_summary_report/routes/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `api/project_summary_report/routes/project_summary_report_history_route.py` | 71 | ❌ 沒碰 | 判斷邏輯（→ U9） | | `api/project_summary_report/routes/project_summary_report_route.py` | 170 | ❌ 沒碰 | 判斷邏輯（→ U9） | | `api/project_summary_report/serializers/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `api/project_summary_report/serializers/project_summary_report.py` | 39 | ❌ 沒碰 | 純宣告 | | `api/project_summary_report/serializers/project_summary_report_history.py` | 21 | ❌ 沒碰 | 純宣告 | | `api/remote_agent/__init__.py` | 2 | ✅ 掃過 | CLAUDE-SECURITY-20260917-015011 | | `api/remote_agent/routes/__init__.py` | 0 | ✅ 掃過 | CLAUDE-SECURITY-20260917-015011 | | `api/remote_agent/routes/agent_file_route.py` | 61 | ✅ 掃過 | CLAUDE-SECURITY-20260917-015011 | | `api/setup/__init__.py` | 22 | ❌ 沒碰 | 判斷邏輯（→ U3） | | `api/setup/routes/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `api/setup/routes/setup_route.py` | 128 | ❌ 沒碰 | 判斷邏輯（→ U3） | | `api/support/__init__.py` | 30 | ❌ 沒碰 | 判斷邏輯（→ U10） | | `api/support/routes/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `api/support/routes/diagnostic_bundle_route.py` | 67 | ❌ 沒碰 | 判斷邏輯（→ U10） | | `api/support/routes/recent_error_route.py` | 43 | ❌ 沒碰 | 判斷邏輯（→ U10） | | `api/support/serializers/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `api/support/serializers/diagnostic_bundle.py` | 20 | ❌ 沒碰 | 純宣告 | | `api/support/serializers/recent_error.py` | 33 | ❌ 沒碰 | 純宣告 | | `api/system_config/__init__.py` | 49 | ✅ 掃過 | CLAUDE-SECURITY-20260915-090332 | | `api/system_config/routes/security_policy_route.py` | 71 | ✅ 掃過 | CLAUDE-SECURITY-20260915-090332 | | `api/system_config/routes/system_config_route.py` | 160 | ✅ 掃過 | CLAUDE-SECURITY-20260915-090332 | | `api/system_config/serializers/security_policy.py` | 48 | ✅ 掃過 | CLAUDE-SECURITY-20260915-090332 | | `api/system_config/serializers/system_config.py` | 16 | ✅ 掃過 | CLAUDE-SECURITY-20260915-090332 | | `api/version/__init__.py` | 19 | ❌ 沒碰 | 判斷邏輯（→ U3） | | `api/version/routes/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `api/version/routes/client_config_route.py` | 47 | ❌ 沒碰 | 判斷邏輯（→ U3） | | `api/version/routes/version_route.py` | 29 | ❌ 沒碰 | 判斷邏輯（→ U3） | | `app/__init__.py` | 4 | ❌ 沒碰 | 純宣告 | | `app/associations/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/associations/dto/__init__.py` | 7 | ❌ 沒碰 | 純宣告 | | `app/associations/dto/project_assessment_plan_mapping_dto.py` | 30 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `app/associations/dto/project_org_unit_mapping_dto.py` | 37 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `app/associations/dto/project_system_characteristic_mapping_dto.py` | 39 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `app/associations/service/__init__.py` | 9 | ❌ 沒碰 | 純宣告 | | `app/associations/service/project_assessment_plan_mapping_service.py` | 67 | ❌ 沒碰 | 判斷邏輯（→ U9） | | `app/associations/service/project_org_unit_mapping_service.py` | 44 | ❌ 沒碰 | 判斷邏輯（→ U9） | | `app/associations/service/project_system_characteristic_mapping_service.py` | 60 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `app/auth/__init__.py` | 10 | ❌ 沒碰 | 純宣告 | | `app/auth/service/__init__.py` | 1 | ❌ 沒碰 | 純宣告 | | `app/auth/service/role_app_service.py` | 94 | ❌ 沒碰 | 判斷邏輯（→ U9） | | `app/auth/service/user_app_service.py` | 122 | ❌ 沒碰 | 判斷邏輯（→ U9） | | `app/auth/service/user_import_template_app_service.py` | 106 | ❌ 沒碰 | 判斷邏輯（→ U9） | | `app/cloud_integration/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/cloud_integration/dto/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/cloud_integration/dto/google_drive_integration_dto.py` | 54 | ❌ 沒碰 | 純宣告 | | `app/cloud_integration/service/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/cloud_integration/service/drive_app_credential_verify_service.py` | 94 | ❌ 沒碰 | 判斷邏輯（→ U4） | | `app/cloud_integration/service/drive_project_verify_service.py` | 273 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `app/cloud_integration/service/drive_sync_admin_service.py` | 164 | ❌ 沒碰 | 判斷邏輯（→ U4） | | `app/cloud_integration/service/drive_sync_orchestration_service.py` | 529 | ❌ 沒碰 | 判斷邏輯（→ U5） | | `app/cloud_integration/service/drive_sync_worker.py` | 149 | ❌ 沒碰 | 判斷邏輯（→ U5） | | `app/cloud_integration/service/google_drive_integration_service.py` | 288 | ❌ 沒碰 | 判斷邏輯（→ U4） | | `app/cloud_integration/service/google_drive_webhook_service.py` | 127 | ❌ 沒碰 | 判斷邏輯（→ U5） | | `app/cloud_integration/service/handlers/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/cloud_integration/service/handlers/archive_drive_file_handler.py` | 165 | ❌ 沒碰 | 判斷邏輯（→ U6） | | `app/cloud_integration/service/handlers/base_job_handler.py` | 36 | ❌ 沒碰 | 純宣告 | | `app/cloud_integration/service/handlers/create_folder_handler.py` | 71 | ❌ 沒碰 | 判斷邏輯（→ U6） | | `app/cloud_integration/service/handlers/exceptions.py` | 25 | ❌ 沒碰 | 純宣告 | | `app/cloud_integration/service/handlers/import_drive_file_handler.py` | 264 | ❌ 沒碰 | 判斷邏輯（→ U6） | | `app/cloud_integration/service/handlers/init_project_folders_handler.py` | 449 | ❌ 沒碰 | 判斷邏輯（→ U6） | | `app/cloud_integration/service/handlers/process_drive_changes_handler.py` | 275 | ❌ 沒碰 | 判斷邏輯（→ U6） | | `app/cloud_integration/service/handlers/reconcile_task_folder_handler.py` | 129 | ❌ 沒碰 | 判斷邏輯（→ U6） | | `app/cloud_integration/service/handlers/rename_folder_handler.py` | 59 | ❌ 沒碰 | 判斷邏輯（→ U6） | | `app/cloud_integration/service/handlers/soft_delete_evidence_handler.py` | 42 | ❌ 沒碰 | 判斷邏輯（→ U6） | | `app/cloud_integration/service/project_tree_loader.py` | 171 | ❌ 沒碰 | 判斷邏輯（→ U5） | | `app/cloud_integration/service/webhook_channel_manager.py` | 202 | ❌ 沒碰 | 判斷邏輯（→ U5） | | `app/common/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/common/dto/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/common/dto/base_dto.py` | 5 | ❌ 沒碰 | 純宣告 | | `app/common/schema/common_schema.py` | 4 | ❌ 沒碰 | 純宣告 | | `app/detection_tools/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/detection_tools/dto/__init__.py` | 26 | ✅ 掃過 | CLAUDE-SECURITY-20260923-130633 | | `app/detection_tools/service/__init__.py` | 26 | ✅ 掃過 | CLAUDE-SECURITY-20260923-130633 | | `app/detection_tools/task_type_declaration.py` | 109 | ✅ 掃過 | CLAUDE-SECURITY-20260923-130633 | | `app/evidence_classification/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/evidence_classification/resources/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/flow_control/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/flow_control/dto/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/flow_control/dto/job_dto.py` | 360 | ✅ 掃過 | CLAUDE-SECURITY-20260923-142057 | | `app/flow_control/service/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/flow_control/service/assessment_plan_app_service.py` | 742 | ✅ 掃過 | CLAUDE-SECURITY-20260924-071232 | | `app/flow_control/service/job_batch_complete_service.py` | 193 | ❌ 沒碰 | 判斷邏輯（→ U7） | | `app/flow_control/service/job_binding_orphan_cleanup_service.py` | 174 | ❌ 沒碰 | 判斷邏輯（→ U8） | | `app/flow_control/service/job_handlers/__init__.py` | 36 | ✅ 掃過 | CLAUDE-SECURITY-20260923-142057 | | `app/flow_control/service/job_handlers/survey_handler.py` | 196 | ✅ 掃過 | CLAUDE-SECURITY-20260923-142057 | | `app/flow_control/service/job_import_service.py` | 470 | ❌ 沒碰 | 判斷邏輯（→ U7） | | `app/flow_control/service/job_service.py` | 455 | ✅ 掃過 | CLAUDE-SECURITY-20260923-142057 | | `app/flow_control/service/oscal_stage_handlers.py` | 142 | ✅ 掃過 | CLAUDE-SECURITY-20260912-073625；FR-113 O9b | | `app/flow_control/service/oscal_stage_preconditions.py` | 129 | ✅ 掃過 | CLAUDE-SECURITY-20260912-073625；FR-113 O9b | | `app/flow_control/service/oscal_stage_rollback_handlers.py` | 71 | ✅ 掃過 | CLAUDE-SECURITY-20260912-073625；FR-113 O9b | | `app/flow_control/service/prep_job_generation_service.py` | 226 | ✅ 掃過 | CLAUDE-SECURITY-20260924-054633 | | `app/flow_control/service/project_service.py` | 789 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `app/flow_control/service/reverify_inheritance_service.py` | 73 | ❌ 沒碰 | 判斷邏輯（→ U8） | | `app/flow_control/service/workflow_xml_sync_service.py` | 246 | ❌ 沒碰 | 判斷邏輯（→ U8） | | `app/flow_engine/__init__.py` | 7 | ❌ 沒碰 | 純宣告 | | `app/flow_engine/dto/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/flow_engine/dto/ext_workflow_execution_dto.py` | 95 | ✅ 掃過 | CLAUDE-SECURITY-20260913-064104 | | `app/flow_engine/dto/flow_template_dto.py` | 49 | ✅ 掃過 | CLAUDE-SECURITY-20260913-021915 | | `app/flow_engine/dto/job_evidence_dto.py` | 81 | ✅ 掃過 | CLAUDE-SECURITY-20260912-034350 | | `app/flow_engine/dto/stage_object_dto.py` | 39 | ✅ 掃過 | CLAUDE-SECURITY-20260912-073625 | | `app/flow_engine/enums/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/flow_engine/enums/code.py` | 5 | ✅ 掃過 | CLAUDE-SECURITY-20260913-064104 | | `app/flow_engine/service/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/flow_engine/service/flow_template_app_service.py` | 265 | ✅ 掃過 | CLAUDE-SECURITY-20260913-021915 | | `app/flow_engine/service/job_evidence_service.py` | 191 | ✅ 掃過 | CLAUDE-SECURITY-20260912-034350；CLAUDE-SECURITY-20260923-142057 | | `app/flow_engine/service/job_force_start_service.py` | 154 | ✅ 掃過 | CLAUDE-SECURITY-20260923-143410 | | `app/flow_engine/service/join_wait_inspector.py` | 135 | ✅ 掃過 | CLAUDE-SECURITY-20260923-143410 | | `app/flow_engine/service/stage_advance_service.py` | 702 | ✅ 掃過 | CLAUDE-SECURITY-20260912-073625 | | `app/flow_engine/service/stage_object_app_service.py` | 16 | ✅ 掃過 | CLAUDE-SECURITY-20260912-073625 | | `app/flow_engine/service/stage_rollback_service.py` | 189 | ✅ 掃過 | CLAUDE-SECURITY-20260912-073625 | | `app/flow_engine/service/workflow_execution_service.py` | 1374 | ✅ 掃過 | CLAUDE-SECURITY-20260913-064104；CLAUDE-SECURITY-20260923-143410 | | `app/flow_engine/service/workflow_template_snapshot_service.py` | 94 | ✅ 掃過 | CLAUDE-SECURITY-20260913-021915 | | `app/module_frame/__init__.py` | 7 | ❌ 沒碰 | 純宣告 | | `app/module_frame/code/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/module_frame/code/module_frame_error_code.py` | 32 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104426 | | `app/module_frame/dto/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/module_frame/dto/module_frame_control_default_dto.py` | 49 | ✅ 掃過 | CLAUDE-SECURITY-20260922-090431 | | `app/module_frame/dto/module_frame_control_objective_default_dto.py` | 47 | ✅ 掃過 | CLAUDE-SECURITY-20260922-090431 | | `app/module_frame/dto/module_frame_dto.py` | 70 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104426 | | `app/module_frame/dto/module_frame_menu_dto.py` | 34 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104426 | | `app/module_frame/dto/module_frame_reference_document_dto.py` | 57 | ✅ 掃過 | CLAUDE-SECURITY-20260922-090431 | | `app/module_frame/excel_template/__init__.py` | 11 | ✅ 掃過 | CLAUDE-SECURITY-20260923-095130 | | `app/module_frame/excel_template/data_validation_builder.py` | 54 | ✅ 掃過 | CLAUDE-SECURITY-20260923-095130 | | `app/module_frame/excel_template/generator.py` | 652 | ✅ 掃過 | CLAUDE-SECURITY-20260923-095130 | | `app/module_frame/excel_template/header_i18n.py` | 176 | ✅ 掃過 | CLAUDE-SECURITY-20260923-095130 | | `app/module_frame/excel_template/lookup_builder.py` | 108 | ✅ 掃過 | CLAUDE-SECURITY-20260923-095130 | | `app/module_frame/excel_template/sheet_definitions.py` | 617 | ✅ 掃過 | CLAUDE-SECURITY-20260923-095130 | | `app/module_frame/excel_template/styles.py` | 38 | ✅ 掃過 | CLAUDE-SECURITY-20260923-095130 | | `app/module_frame/service/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/module_frame/service/module_frame_components_service.py` | 211 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104527 | | `app/module_frame/service/module_frame_control_default_service.py` | 240 | ✅ 掃過 | CLAUDE-SECURITY-20260922-090431 | | `app/module_frame/service/module_frame_control_objective_default_service.py` | 269 | ✅ 掃過 | CLAUDE-SECURITY-20260922-090431 | | `app/module_frame/service/module_frame_import_service.py` | 415 | ✅ 掃過 | CLAUDE-SECURITY-20260923-095422 | | `app/module_frame/service/module_frame_inventory_service.py` | 220 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104527 | | `app/module_frame/service/module_frame_item_service.py` | 249 | ⚠️ 部分 | FR-113 B1-item | | `app/module_frame/service/module_frame_leveraged_service.py` | 214 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104527 | | `app/module_frame/service/module_frame_party_service.py` | 323 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104527 | | `app/module_frame/service/module_frame_reference_document_service.py` | 257 | ✅ 掃過 | CLAUDE-SECURITY-20260922-090431 | | `app/module_frame/service/module_frame_service.py` | 260 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510；CLAUDE-SECURITY-20260922-104426；CLAUDE-SECURITY-20260923-095422；FR-113 B1-item | | `app/module_frame/service/module_frame_ssp_resources_service.py` | 101 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104527 | | `app/module_frame/service/module_frame_system_characteristic_service.py` | 186 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104527 | | `app/module_frame/service/module_frame_template_import_service.py` | 1011 | ✅ 掃過 | CLAUDE-SECURITY-20260922-090410 | | `app/module_frame/service/ssp_import_template_app_service.py` | 1500 | ✅ 掃過 | CLAUDE-SECURITY-20260922-090440 | | `app/notification/__init__.py` | 7 | ❌ 沒碰 | 純宣告 | | `app/notification/handler/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/notification/handler/notification_socketio_handler.py` | 53 | ❌ 沒碰 | 判斷邏輯（→ U12） | | `app/notification/service/__init__.py` | 0 | ✅ 掃過 | CLAUDE-SECURITY-20260908-073510 | | `app/notification/service/notification_service.py` | 110 | ✅ 掃過 | CLAUDE-SECURITY-20260908-073510 | | `app/notification/service/test_mail_service.py` | 121 | ✅ 掃過 | CLAUDE-SECURITY-20260908-073510 | | `app/notify_config/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/notify_config/service/__init__.py` | 0 | ✅ 掃過 | CLAUDE-SECURITY-20260908-073510 | | `app/notify_config/service/notify_config_test_service.py` | 97 | ✅ 掃過 | CLAUDE-SECURITY-20260908-073510 | | `app/oscal/__init__.py` | 7 | ❌ 沒碰 | 純宣告 | | `app/oscal/dto/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/oscal/dto/ssp/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/oscal/dto/ssp/ssp_reference_document_dto.py` | 29 | ✅ 掃過 | CLAUDE-SECURITY-20260924-073342 | | `app/oscal/service/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/oscal/service/excel_parser/__init__.py` | 9 | ✅ 掃過 | CLAUDE-SECURITY-20260921-154709 | | `app/oscal/service/excel_parser/parser.py` | 153 | ✅ 掃過 | CLAUDE-SECURITY-20260921-154709 | | `app/oscal/service/excel_parser/sheet_handlers.py` | 428 | ✅ 掃過 | CLAUDE-SECURITY-20260921-154709 | | `app/oscal/service/excel_parser/types.py` | 111 | ✅ 掃過 | CLAUDE-SECURITY-20260921-154709 | | `app/oscal/service/excel_parser/v2_bundle.py` | 217 | ✅ 掃過 | CLAUDE-SECURITY-20260921-154709 | | `app/oscal/service/excel_parser/validators.py` | 66 | ✅ 掃過 | CLAUDE-SECURITY-20260921-154709 | | `app/oscal/service/excel_parser/version_check.py` | 63 | ✅ 掃過 | CLAUDE-SECURITY-20260921-154709 | | `app/oscal/service/export/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/oscal/service/export/ssp_docx_generator.py` | 258 | ✅ 掃過 | CLAUDE-SECURITY-20260921-060255 | | `app/oscal/service/export/ssp_export_app_service.py` | 114 | ✅ 掃過 | CLAUDE-SECURITY-20260921-060255 | | `app/oscal/service/export/ssp_export_model.py` | 169 | ✅ 掃過 | CLAUDE-SECURITY-20260921-060255 | | `app/oscal/service/export/ssp_libreoffice_converter.py` | 124 | ✅ 掃過 | CLAUDE-SECURITY-20260921-060255 | | `app/oscal/service/export/ssp_v2_content_loader.py` | 217 | ✅ 掃過 | CLAUDE-SECURITY-20260921-060255 | | `app/oscal/service/framework_app_service.py` | 247 | ✅ 掃過 | CLAUDE-SECURITY-20260921-154528 | | `app/oscal/service/framework_parse_job_service.py` | 674 | ✅ 掃過 | CLAUDE-SECURITY-20260921-154612 | | `app/oscal/service/framework_version_app_service.py` | 229 | ✅ 掃過 | CLAUDE-SECURITY-20260921-154528 | | `app/oscal/service/framework_version_edit_service.py` | 351 | ✅ 掃過 | CLAUDE-SECURITY-20260921-154528 | | `app/oscal/service/import_adapter/__init__.py` | 9 | ❌ 沒碰 | 純宣告 | | `app/oscal/service/import_adapter/_common.py` | 620 | ✅ 掃過 | FR-113 O9a | | `app/oscal/service/import_adapter/docx_to_oscal_ssp.py` | 152 | ✅ 掃過 | CLAUDE-SECURITY-20260921-113255；FR-113 O9a | | `app/oscal/service/import_adapter/excel_to_oscal_ssp.py` | 144 | ✅ 掃過 | CLAUDE-SECURITY-20260921-081023；FR-113 O9a | | `app/oscal/service/import_adapter/party_match_enrich.py` | 78 | ✅ 掃過 | CLAUDE-SECURITY-20260921-113255 | | `app/oscal/service/import_adapter/v2_candidate_loader.py` | 54 | ✅ 掃過 | CLAUDE-SECURITY-20260921-113255 | | `app/oscal/service/import_diff/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/oscal/service/import_diff/decision_merge.py` | 318 | ⚠️ 部分 | FR-113 O6 | | `app/oscal/service/import_diff/snapshot_views.py` | 315 | ⚠️ 部分 | FR-113 O6 | | `app/oscal/service/import_diff/ssp_diff_service.py` | 751 | ⚠️ 部分 | FR-113 O6 | | `app/oscal/service/oscal_export_app_service.py` | 47 | ✅ 掃過 | CLAUDE-SECURITY-20260921-060255 | | `app/oscal/service/resource_library_app_service.py` | 530 | ✅ 掃過 | CLAUDE-SECURITY-20260921-060255 | | `app/oscal/service/ssp_components_app_service.py` | 142 | ✅ 掃過 | CLAUDE-SECURITY-20260921-113212 | | `app/oscal/service/ssp_control_impl_import_service.py` | 416 | ✅ 掃過 | CLAUDE-SECURITY-20260921-113255 | | `app/oscal/service/ssp_control_implementation_service.py` | 1037 | ✅ 掃過 | CLAUDE-SECURITY-20260921-061133 | | `app/oscal/service/ssp_document_pool_service.py` | 313 | ⚠️ 部分 | FR-113 O6 | | `app/oscal/service/ssp_docx_import_app_service.py` | 787 | ✅ 掃過 | CLAUDE-SECURITY-20260921-113255 | | `app/oscal/service/ssp_excel_import_app_service.py` | 937 | ✅ 掃過 | CLAUDE-SECURITY-20260921-081023 | | `app/oscal/service/ssp_inventory_items_app_service.py` | 194 | ✅ 掃過 | CLAUDE-SECURITY-20260921-113212 | | `app/oscal/service/ssp_leveraged_app_service.py` | 141 | ✅ 掃過 | CLAUDE-SECURITY-20260921-113212 | | `app/oscal/service/ssp_party_app_service.py` | 169 | ✅ 掃過 | CLAUDE-SECURITY-20260921-113212 | | `app/oscal/service/ssp_resources_app_service.py` | 52 | ✅ 掃過 | CLAUDE-SECURITY-20260921-113212 | | `app/oscal/service/ssp_resources_context_service.py` | 230 | ✅ 掃過 | CLAUDE-SECURITY-20260921-113212 | | `app/oscal/service/ssp_system_characteristic_app_service.py` | 68 | ✅ 掃過 | CLAUDE-SECURITY-20260921-113212 | | `app/project/__init__.py` | 7 | ❌ 沒碰 | 純宣告 | | `app/project/service/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/project/service/project_start_app_service.py` | 481 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `app/project_summary_report/__init__.py` | 7 | ❌ 沒碰 | 純宣告 | | `app/project_summary_report/dto/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/project_summary_report/dto/project_summary_report_dto.py` | 44 | ❌ 沒碰 | 純宣告 | | `app/project_summary_report/dto/project_summary_report_history_dto.py` | 41 | ❌ 沒碰 | 純宣告 | | `app/project_summary_report/service/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/project_summary_report/service/project_summary_report_history_service.py` | 77 | ❌ 沒碰 | 判斷邏輯（→ U9） | | `app/project_summary_report/service/project_summary_report_service.py` | 178 | ❌ 沒碰 | 判斷邏輯（→ U9） | | `app/readmodel/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/readmodel/service/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/readmodel/service/auditor_dashboard_service.py` | 14 | ✅ 掃過 | CLAUDE-SECURITY-20260924-050436 | | `app/readmodel/service/my_jobs_app_service.py` | 117 | ❌ 沒碰 | 判斷邏輯（→ U7） | | `app/setup/__init__.py` | 1 | ❌ 沒碰 | 純宣告 | | `app/setup/code/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/setup/code/setup_error_code.py` | 27 | ❌ 沒碰 | 純宣告 | | `app/setup/service/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/setup/service/setup_wizard_service.py` | 395 | ❌ 沒碰 | 判斷邏輯（→ U3） | | `app/support/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/support/diag_cli.py` | 366 | ❌ 沒碰 | 判斷邏輯（→ U10） | | `app/support/service/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `app/support/service/diag_bundle_app_service.py` | 334 | ❌ 沒碰 | 判斷邏輯（→ U10） | | `app/support/service/diag_bundle_export_service.py` | 133 | ❌ 沒碰 | 判斷邏輯（→ U10） | | `app/support/service/recent_error_app_service.py` | 52 | ❌ 沒碰 | 判斷邏輯（→ U10） | | `app/system_config/__init__.py` | 7 | ✅ 掃過 | CLAUDE-SECURITY-20260915-090332 | | `app/system_config/service/__init__.py` | 0 | ✅ 掃過 | CLAUDE-SECURITY-20260915-090332 | | `app/system_config/service/ai_provider_key_resolver.py` | 199 | ✅ 掃過 | CLAUDE-SECURITY-20260923-143342 | | `app/system_config/service/google_drive_app_config_resolver.py` | 224 | ❌ 沒碰 | 判斷邏輯（→ U4） | | `app/system_config/service/guarded_system_config_service.py` | 665 | ✅ 掃過 | CLAUDE-SECURITY-20260915-090332 | | `app/system_config/service/security_policy_app_service.py` | 207 | ✅ 掃過 | CLAUDE-SECURITY-20260915-090332 | | `app/system_config/service/shared_config_app_service.py` | 88 | ✅ 掃過 | CLAUDE-SECURITY-20260915-090332 | | `app/system_config/service/storage_config_restore_app_service.py` | 81 | ✅ 掃過 | CLAUDE-SECURITY-20260915-090332 | | `app/system_config/service/tenant_storage_config_seeder.py` | 129 | ✅ 掃過 | CLAUDE-SECURITY-20260915-090332 | | `app/upload_file/__init__.py` | 0 | ✅ 掃過 | CLAUDE-SECURITY-20260911-065519 | | `app/upload_file/service/__init__.py` | 0 | ✅ 掃過 | CLAUDE-SECURITY-20260911-065519 | | `app/upload_file/service/managed_file_upload_service.py` | 386 | ✅ 掃過 | CLAUDE-SECURITY-20260911-065519 | | `common/__init__.py` | 2 | ❌ 沒碰 | 純宣告 | | `common/authz/__init__.py` | 180 | ❌ 沒碰 | 判斷邏輯（→ U1） | | `common/authz/admin.py` | 12 | ❌ 沒碰 | 判斷邏輯（→ U1） | | `common/authz/capability.py` | 22 | ❌ 沒碰 | 判斷邏輯（→ U1） | | `common/authz/decorators.py` | 11 | ❌ 沒碰 | 判斷邏輯（→ U1） | | `common/authz/license.py` | 367 | ❌ 沒碰 | 判斷邏輯（→ U1） | | `common/authz/menu_license_filter.py` | 76 | ❌ 沒碰 | 判斷邏輯（→ U1） | | `common/authz/platform.py` | 11 | ❌ 沒碰 | 判斷邏輯（→ U1） | | `common/authz/project.py` | 120 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `common/authz/sharing.py` | 35 | ❌ 沒碰 | 判斷邏輯（→ U1） | | `common/authz/signed_token.py` | 22 | ❌ 沒碰 | 判斷邏輯（→ U1） | | `common/authz/ssp.py` | 225 | ✅ 掃過 | CLAUDE-SECURITY-20260921-061133 | | `common/authz/workflow.py` | 49 | ✅ 掃過 | CLAUDE-SECURITY-20260912-034350 | | `common/code/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `common/code/detection_tools_error_code.py` | 209 | ❌ 沒碰 | 純宣告 | | `common/code/error_code.py` | 185 | ❌ 沒碰 | 純宣告 | | `common/code/feedback_code.py` | 5 | ✅ 掃過 | CLAUDE-SECURITY-20260909-061148；CLAUDE-SECURITY-20260923-130819 | | `common/code/file_storage_type.py` | 9 | ❌ 沒碰 | 純宣告 | | `common/code/flow_control_error_code.py` | 513 | ❌ 沒碰 | 純宣告 | | `common/constant/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `common/constant/ai_service_config.py` | 29 | ❌ 沒碰 | 純宣告 | | `common/constant/drive_app_config.py` | 45 | ❌ 沒碰 | 純宣告 | | `common/constant/tenant.py` | 11 | ❌ 沒碰 | 純宣告 | | `common/dto/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `common/dto/file_info_dto.py` | 15 | ❌ 沒碰 | 純宣告 | | `common/enum/event_code.py` | 133 | ❌ 沒碰 | 純宣告 | | `common/enum/participant_enum.py` | 18 | ❌ 沒碰 | 純宣告 | | `common/exception_error/common_exception.py` | 24 | ❌ 沒碰 | 純宣告 | | `common/iam_ports.py` | 100 | ❌ 沒碰 | 判斷邏輯（→ U1） | | `common/integrity/__init__.py` | 33 | ❌ 沒碰 | 純宣告 | | `common/integrity/adapters.py` | 357 | ❌ 沒碰 | 判斷邏輯（→ U12） | | `common/middleware/__init__.py` | 1 | ❌ 沒碰 | 純宣告 | | `common/middleware/app_mw.py` | 297 | ✅ 掃過 | CLAUDE-SECURITY-20260923-130653 | | `common/middleware/jwt_mw.py` | 46 | ❌ 沒碰 | 判斷邏輯（→ U2） | | `common/middleware/license_readonly_mw.py` | 217 | ❌ 沒碰 | 判斷邏輯（→ U2） | | `common/middleware/request_context_mw.py` | 69 | ✅ 掃過 | CLAUDE-SECURITY-20260923-143342 | | `common/setup/__init__.py` | 5 | ❌ 沒碰 | 純宣告 | | `common/setup/setup_token.py` | 113 | ❌ 沒碰 | 判斷邏輯（→ U3） | | `common/util/agent_auth_settings.py` | 40 | ✅ 掃過 | CLAUDE-SECURITY-20260917-015011 | | `common/util/app_version.py` | 88 | ❌ 沒碰 | 判斷邏輯（→ U3） | | `common/util/audit_nickname.py` | 87 | ❌ 沒碰 | 判斷邏輯（→ U9） | | `common/util/common_util.py` | 65 | ❌ 沒碰 | 判斷邏輯（→ U1） | | `common/util/profile_extractor/__init__.py` | 12 | ✅ 掃過 | CLAUDE-SECURITY-20260923-130633 | | `common/util/redis_client_util.py` | 79 | ❌ 沒碰 | 判斷邏輯（→ U1） | | `common/util/resource_path.py` | 50 | ❌ 沒碰 | 判斷邏輯（→ U1） | | `common/util/round_guard.py` | 46 | ❌ 沒碰 | 判斷邏輯（→ U1） | | `common/util/ssp_resource_name_dup.py` | 56 | ❌ 沒碰 | 判斷邏輯（→ U1） | | `common/util/system_asset_snapshot.py` | 129 | ✅ 掃過 | CLAUDE-SECURITY-20260923-130819 | | `config/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `config/app_modules.py` | 146 | ❌ 沒碰 | 純宣告 | | `config/config.py` | 310 | ❌ 沒碰 | 純宣告 | | `config/config_loader.py` | 123 | ❌ 沒碰 | 判斷邏輯（→ U2） | | `config/config_util.py` | 16 | ❌ 沒碰 | 純宣告 | | `config/di_modules.py` | 225 | ❌ 沒碰 | DI 組裝 | | `config/socketio_namespaces.py` | 52 | ✅ 掃過 | CLAUDE-SECURITY-20260923-130757 | | `content/detection-profiles/tools/gpo_extract.py` | 169 | ❌ 沒碰 | 離線工具 | | `content/detection-profiles/tools/gpo_match.py` | 164 | ❌ 沒碰 | 離線工具 | | `content/detection-profiles/tools/linux_rules.py` | 160 | ❌ 沒碰 | 離線工具 | | `content/detection-profiles/tools/maps.py` | 163 | ❌ 沒碰 | 離線工具 | | `content/detection-profiles/tools/service_names.py` | 161 | ❌ 沒碰 | 離線工具 | | `content/detection-profiles/tools/twgcb2inspec.py` | 715 | ❌ 沒碰 | 離線工具 | | `content/detection-profiles/tools/verify_service_map.py` | 111 | ❌ 沒碰 | 離線工具 | | `core/__init__.py` | 3 | ❌ 沒碰 | 純宣告 | | `core/app_factory.py` | 469 | ❌ 沒碰 | 判斷邏輯（→ U2） | | `core/extensions.py` | 32 | ❌ 沒碰 | 純宣告 | | `core/host_capabilities.py` | 76 | ❌ 沒碰 | 判斷邏輯（→ U2） | | `core/plugins/__init__.py` | 83 | ❌ 沒碰 | DI 組裝 | | `core/plugins/_host.py` | 212 | ✅ 掃過 | CLAUDE-SECURITY-20260915-090332；CLAUDE-SECURITY-20260923-130633；CLAUDE-SECURITY-20260923-130757；CLAUDE-SECURITY-20260923-130819 | | `core/plugins/ai_bot.py` | 135 | ❌ 沒碰 | DI 組裝 | | `core/plugins/ai_dashboard.py` | 98 | ❌ 沒碰 | DI 組裝 | | `core/plugins/api_log.py` | 352 | ✅ 掃過 | CLAUDE-SECURITY-20260923-130653 | | `core/plugins/asset.py` | 174 | ✅ 掃過 | CLAUDE-SECURITY-20260923-130819 | | `core/plugins/bulletin.py` | 220 | ❌ 沒碰 | DI 組裝 | | `core/plugins/compliance_audit.py` | 185 | ✅ 掃過 | CLAUDE-SECURITY-20260924-072304 | | `core/plugins/detection.py` | 362 | ✅ 掃過 | CLAUDE-SECURITY-20260923-130633 | | `core/plugins/evidence_classification.py` | 718 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510；CLAUDE-SECURITY-20260923-143342 | | `core/plugins/file_upload.py` | 145 | ❌ 沒碰 | DI 組裝 | | `core/plugins/flow_engine.py` | 83 | ❌ 沒碰 | DI 組裝 | | `core/plugins/identity.py` | 679 | ❌ 沒碰 | DI 組裝 | | `core/plugins/integrity.py` | 93 | ❌ 沒碰 | DI 組裝 | | `core/plugins/issue.py` | 195 | ✅ 掃過 | CLAUDE-SECURITY-20260923-130819 | | `core/plugins/license.py` | 391 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `core/plugins/notification.py` | 83 | ❌ 沒碰 | DI 組裝 | | `core/plugins/participant.py` | 181 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `core/plugins/remote_agent.py` | 140 | ✅ 掃過 | CLAUDE-SECURITY-20260917-015011 | | `core/plugins/survey.py` | 186 | ✅ 掃過 | CLAUDE-SECURITY-20260923-130757 | | `core/plugins/system_core.py` | 180 | ✅ 掃過 | CLAUDE-SECURITY-20260915-090332 | | `core/plugins/task.py` | 138 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `core/scheduler.py` | 550 | ❌ 沒碰 | 判斷邏輯（→ U8） | | `di_containers/__init__.py` | 0 | ❌ 沒碰 | DI 組裝 | | `di_containers/agent_task/__init__.py` | 0 | ✅ 掃過 | CLAUDE-SECURITY-20260917-015011 | | `di_containers/agent_task/agent_task_containers.py` | 40 | ✅ 掃過 | CLAUDE-SECURITY-20260917-015011 | | `di_containers/ai_dashboard/__init__.py` | 0 | ✅ 掃過 | CLAUDE-SECURITY-20260910-044812 | | `di_containers/ai_dashboard/ai_dashboard_containers.py` | 109 | ✅ 掃過 | CLAUDE-SECURITY-20260910-044812 | | `di_containers/ai_dashboard/dashboard_registry_wiring.py` | 84 | ✅ 掃過 | CLAUDE-SECURITY-20260910-044812 | | `di_containers/asset/__init__.py` | 0 | ❌ 沒碰 | DI 組裝 | | `di_containers/asset/asset_containers.py` | 89 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510；CLAUDE-SECURITY-20260923-130819 | | `di_containers/associations/__init__.py` | 0 | ❌ 沒碰 | DI 組裝 | | `di_containers/associations/associations_containers.py` | 133 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `di_containers/auth/__init__.py` | 0 | ❌ 沒碰 | DI 組裝 | | `di_containers/auth/auth_containers.py` | 349 | ✅ 掃過 | CLAUDE-SECURITY-20260915-090332 | | `di_containers/bulletin/__init__.py` | 0 | ✅ 掃過 | CLAUDE-SECURITY-20260908-134256 | | `di_containers/bulletin/bulletin_containers.py` | 97 | ✅ 掃過 | CLAUDE-SECURITY-20260908-134256 | | `di_containers/cloud_integration/__init__.py` | 0 | ❌ 沒碰 | DI 組裝 | | `di_containers/cloud_integration/cloud_integration_containers.py` | 310 | ❌ 沒碰 | DI 組裝 | | `di_containers/containers.py` | 397 | ❌ 沒碰 | DI 組裝 | | `di_containers/dashboard_apis/__init__.py` | 87 | ✅ 掃過 | CLAUDE-SECURITY-20260910-044812 | | `di_containers/dashboard_apis/auth.py` | 57 | ✅ 掃過 | CLAUDE-SECURITY-20260910-044812 | | `di_containers/dashboard_apis/bulletin.py` | 29 | ✅ 掃過 | CLAUDE-SECURITY-20260908-134256；CLAUDE-SECURITY-20260910-044812 | | `di_containers/dashboard_apis/device.py` | 21 | ✅ 掃過 | CLAUDE-SECURITY-20260910-044812；CLAUDE-SECURITY-20260923-130819 | | `di_containers/dashboard_apis/feedback.py` | 25 | ✅ 掃過 | CLAUDE-SECURITY-20260909-061148；CLAUDE-SECURITY-20260910-044812；CLAUDE-SECURITY-20260923-130819 | | `di_containers/dashboard_apis/flow_engine.py` | 52 | ✅ 掃過 | CLAUDE-SECURITY-20260910-044812；CLAUDE-SECURITY-20260913-064104 | | `di_containers/dashboard_apis/module_frame.py` | 22 | ✅ 掃過 | CLAUDE-SECURITY-20260910-044812；CLAUDE-SECURITY-20260922-104426 | | `di_containers/dashboard_apis/oscal.py` | 36 | ✅ 掃過 | CLAUDE-SECURITY-20260910-044812；FR-113 O9b | | `di_containers/dashboard_apis/participant.py` | 109 | ✅ 掃過 | CLAUDE-SECURITY-20260910-044812；CLAUDE-SECURITY-20260914-070510 | | `di_containers/dashboard_apis/project.py` | 50 | ✅ 掃過 | CLAUDE-SECURITY-20260910-044812 | | `di_containers/dashboard_apis/survey.py` | 44 | ✅ 掃過 | CLAUDE-SECURITY-20260910-044812；CLAUDE-SECURITY-20260923-130757 | | `di_containers/dashboard_apis/system_config.py` | 23 | ✅ 掃過 | CLAUDE-SECURITY-20260910-044812 | | `di_containers/dashboard_apis/system_menu.py` | 21 | ✅ 掃過 | CLAUDE-SECURITY-20260910-044812 | | `di_containers/dashboard_apis/user_auth_provider.py` | 32 | ✅ 掃過 | CLAUDE-SECURITY-20260910-044812 | | `di_containers/detection_execution/__init__.py` | 0 | ❌ 沒碰 | DI 組裝 | | `di_containers/detection_execution/detection_execution_containers.py` | 33 | ✅ 掃過 | CLAUDE-SECURITY-20260923-130633 | | `di_containers/detection_tools/__init__.py` | 0 | ❌ 沒碰 | DI 組裝 | | `di_containers/detection_tools/detection_orchestration_containers.py` | 125 | ✅ 掃過 | CLAUDE-SECURITY-20260923-130633 | | `di_containers/detection_tools/detection_tools_containers.py` | 204 | ✅ 掃過 | CLAUDE-SECURITY-20260923-130633 | | `di_containers/evidence_classification/__init__.py` | 0 | ❌ 沒碰 | DI 組裝 | | `di_containers/evidence_classification/evidence_classification_containers.py` | 198 | ✅ 掃過 | CLAUDE-SECURITY-20260923-143342 | | `di_containers/flow_control/__init__.py` | 0 | ❌ 沒碰 | DI 組裝 | | `di_containers/flow_control/flow_control_containers.py` | 753 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `di_containers/flow_engine/__init__.py` | 0 | ❌ 沒碰 | DI 組裝 | | `di_containers/flow_engine/flow_template_containers.py` | 46 | ✅ 掃過 | CLAUDE-SECURITY-20260913-021915 | | `di_containers/flow_engine/job_evidence_containers.py` | 38 | ✅ 掃過 | CLAUDE-SECURITY-20260912-034350 | | `di_containers/flow_engine/project_participant_containers.py` | 118 | ✅ 掃過 | CLAUDE-SECURITY-20260913-064104；CLAUDE-SECURITY-20260914-070510 | | `di_containers/flow_engine/task_assignee_containers.py` | 78 | ✅ 掃過 | CLAUDE-SECURITY-20260912-034350；CLAUDE-SECURITY-20260914-070510 | | `di_containers/flow_engine/workflow_excution_containers.py` | 155 | ✅ 掃過 | CLAUDE-SECURITY-20260913-064104；CLAUDE-SECURITY-20260914-070510 | | `di_containers/identity/__init__.py` | 0 | ❌ 沒碰 | DI 組裝 | | `di_containers/identity/identity_containers.py` | 34 | ❌ 沒碰 | DI 組裝 | | `di_containers/license/__init__.py` | 0 | ❌ 沒碰 | DI 組裝 | | `di_containers/license/license_containers.py` | 84 | ❌ 沒碰 | DI 組裝 | | `di_containers/log/__init__.py` | 0 | ❌ 沒碰 | DI 組裝 | | `di_containers/log/apilog_containers.py` | 21 | ✅ 掃過 | CLAUDE-SECURITY-20260923-130653 | | `di_containers/login/__init__.py` | 0 | ❌ 沒碰 | DI 組裝 | | `di_containers/login/login_containers.py` | 76 | ✅ 掃過 | CLAUDE-SECURITY-20260915-090332 | | `di_containers/module_frame/__init__.py` | 0 | ❌ 沒碰 | DI 組裝 | | `di_containers/module_frame/module_frame_containers.py` | 260 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104426 | | `di_containers/notification/__init__.py` | 0 | ✅ 掃過 | CLAUDE-SECURITY-20260908-073510 | | `di_containers/notification/notification_containers.py` | 33 | ✅ 掃過 | CLAUDE-SECURITY-20260908-073510；CLAUDE-SECURITY-20260915-090332 | | `di_containers/notify_config/__init__.py` | 0 | ✅ 掃過 | CLAUDE-SECURITY-20260908-073510 | | `di_containers/notify_config/containers.py` | 13 | ✅ 掃過 | CLAUDE-SECURITY-20260908-073510 | | `di_containers/oscal/__init__.py` | 0 | ⚠️ 部分 | FR-113 O9b | | `di_containers/oscal/oscal_containers.py` | 509 | ✅ 掃過 | CLAUDE-SECURITY-20260924-073342；FR-113 O9b | | `di_containers/project/__init__.py` | 0 | ❌ 沒碰 | DI 組裝 | | `di_containers/project/project_containers.py` | 70 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `di_containers/project/project_summary_report_containers.py` | 48 | ❌ 沒碰 | DI 組裝 | | `di_containers/remote_agent/__init__.py` | 0 | ✅ 掃過 | CLAUDE-SECURITY-20260917-015011 | | `di_containers/remote_agent/remote_agent_containers.py` | 100 | ✅ 掃過 | CLAUDE-SECURITY-20260917-015011 | | `di_containers/setup/__init__.py` | 0 | ❌ 沒碰 | DI 組裝 | | `di_containers/setup/setup_containers.py` | 41 | ❌ 沒碰 | DI 組裝 | | `di_containers/support/__init__.py` | 0 | ❌ 沒碰 | DI 組裝 | | `di_containers/support/support_containers.py` | 82 | ❌ 沒碰 | DI 組裝 | | `di_containers/survey/__init__.py` | 0 | ❌ 沒碰 | DI 組裝 | | `di_containers/survey/survey_containers.py` | 124 | ✅ 掃過 | CLAUDE-SECURITY-20260923-130757 | | `di_containers/system_core/__init__.py` | 0 | ✅ 掃過 | CLAUDE-SECURITY-20260915-090332 | | `di_containers/system_core/system_core_containers.py` | 96 | ✅ 掃過 | CLAUDE-SECURITY-20260915-090332 | | `di_containers/task_survey/__init__.py` | 0 | ❌ 沒碰 | DI 組裝 | | `di_containers/task_survey/question_answer_containers.py` | 97 | ✅ 掃過 | CLAUDE-SECURITY-20260923-130757 | | `di_containers/task_survey/task_survey_containers.py` | 56 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510；CLAUDE-SECURITY-20260923-130757 | | `di_containers/upload_file/__init__.py` | 0 | ✅ 掃過 | CLAUDE-SECURITY-20260911-065519 | | `di_containers/upload_file/upload_file_containers.py` | 34 | ✅ 掃過 | CLAUDE-SECURITY-20260911-065519 | | `di_containers/user_change_password/__init__.py` | 0 | ❌ 沒碰 | DI 組裝 | | `di_containers/user_change_password/user_change_password_containers.py` | 62 | ✅ 掃過 | CLAUDE-SECURITY-20260915-090332 | | `domain/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/associations/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/associations/entity/__init__.py` | 10 | ❌ 沒碰 | 純宣告 | | `domain/associations/entity/project_assessment_plan_mapping_entity.py` | 23 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `domain/associations/entity/project_assessment_plan_mapping_query_entity.py` | 13 | ❌ 沒碰 | 純宣告 | | `domain/associations/entity/project_org_unit_mapping_entity.py` | 21 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `domain/associations/entity/project_org_unit_mapping_query_entity.py` | 13 | ❌ 沒碰 | 純宣告 | | `domain/associations/entity/project_system_characteristic_mapping_entity.py` | 21 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `domain/associations/entity/project_system_characteristic_mapping_query_entity.py` | 13 | ❌ 沒碰 | 純宣告 | | `domain/associations/repository/__init__.py` | 9 | ❌ 沒碰 | 純宣告 | | `domain/associations/repository/project_assessment_plan_mapping.py` | 22 | ❌ 沒碰 | 純宣告 | | `domain/associations/repository/project_org_unit_mapping.py` | 10 | ❌ 沒碰 | 純宣告 | | `domain/associations/repository/project_system_characteristic_mapping.py` | 13 | ❌ 沒碰 | 純宣告 | | `domain/associations/service/__init__.py` | 9 | ❌ 沒碰 | 純宣告 | | `domain/associations/service/project_assessment_plan_mapping_domain_service.py` | 36 | ❌ 沒碰 | 純宣告 | | `domain/associations/service/project_org_unit_mapping_domain_service.py` | 23 | ❌ 沒碰 | 純宣告 | | `domain/associations/service/project_system_characteristic_mapping_domain_service.py` | 50 | ❌ 沒碰 | 判斷邏輯（→ U9） | | `domain/cloud_integration/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/cloud_integration/entities/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/cloud_integration/entities/drive_folder_mapping_entity.py` | 19 | ❌ 沒碰 | 純宣告 | | `domain/cloud_integration/entities/drive_sync_job_entity.py` | 22 | ❌ 沒碰 | 純宣告 | | `domain/cloud_integration/entities/tenant_drive_integration_entity.py` | 31 | ❌ 沒碰 | 純宣告 | | `domain/cloud_integration/enums/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/cloud_integration/enums/scope_type.py` | 13 | ❌ 沒碰 | 純宣告 | | `domain/cloud_integration/enums/sync_job_type.py` | 12 | ❌ 沒碰 | 純宣告 | | `domain/cloud_integration/repository/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/cloud_integration/repository/drive_folder_mapping_repository.py` | 66 | ❌ 沒碰 | 純宣告 | | `domain/cloud_integration/repository/drive_sync_job_repository.py` | 70 | ❌ 沒碰 | 純宣告 | | `domain/cloud_integration/repository/tenant_drive_integration_repository.py` | 29 | ❌ 沒碰 | 純宣告 | | `domain/cloud_integration/service/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/cloud_integration/service/drive_api_client_interface.py` | 67 | ❌ 沒碰 | 純宣告 | | `domain/cloud_integration/service/drive_folder_mapping_domain_service.py` | 133 | ❌ 沒碰 | 判斷邏輯（→ U6） | | `domain/cloud_integration/service/drive_sync_job_domain_service.py` | 104 | ❌ 沒碰 | 判斷邏輯（→ U5） | | `domain/cloud_integration/service/google_drive_token_manager.py` | 131 | ❌ 沒碰 | 判斷邏輯（→ U4） | | `domain/cloud_integration/service/tenant_drive_integration_domain_service.py` | 65 | ❌ 沒碰 | 判斷邏輯（→ U4） | | `domain/cloud_integration/service/token_crypto_service.py` | 9 | ❌ 沒碰 | 純宣告 | | `domain/flow_engine/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/flow_engine/entity/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/flow_engine/entity/ext_workflow_execution_entity.py` | 81 | ✅ 掃過 | CLAUDE-SECURITY-20260913-064104 | | `domain/flow_engine/entity/ext_workflow_execution_query_entity.py` | 52 | ✅ 掃過 | CLAUDE-SECURITY-20260913-064104 | | `domain/flow_engine/entity/flow_template_entity.py` | 21 | ✅ 掃過 | CLAUDE-SECURITY-20260913-021915 | | `domain/flow_engine/entity/flow_template_query_entity.py` | 12 | ✅ 掃過 | CLAUDE-SECURITY-20260913-021915 | | `domain/flow_engine/entity/job_evidence_entity.py` | 67 | ✅ 掃過 | CLAUDE-SECURITY-20260912-034350 | | `domain/flow_engine/entity/job_evidence_query_entity.py` | 34 | ✅ 掃過 | CLAUDE-SECURITY-20260912-034350 | | `domain/flow_engine/entity/stage_object_entity.py` | 29 | ✅ 掃過 | CLAUDE-SECURITY-20260912-073625 | | `domain/flow_engine/entity/stage_object_query_entity.py` | 9 | ✅ 掃過 | CLAUDE-SECURITY-20260912-073625 | | `domain/flow_engine/entity/workflow_execution_control_mapping_entity.py` | 26 | ✅ 掃過 | CLAUDE-SECURITY-20260913-064104 | | `domain/flow_engine/entity/workflow_execution_control_mapping_query_entity.py` | 18 | ✅ 掃過 | CLAUDE-SECURITY-20260913-064104 | | `domain/flow_engine/repository/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/flow_engine/repository/ext_workflow_execution.py` | 8 | ✅ 掃過 | CLAUDE-SECURITY-20260913-064104 | | `domain/flow_engine/repository/flow_template_repo.py` | 28 | ✅ 掃過 | CLAUDE-SECURITY-20260913-021915 | | `domain/flow_engine/repository/job_evidence.py` | 79 | ✅ 掃過 | CLAUDE-SECURITY-20260912-034350 | | `domain/flow_engine/repository/stage_object_repo.py` | 16 | ✅ 掃過 | CLAUDE-SECURITY-20260912-073625 | | `domain/flow_engine/repository/workflow_execution_control_mapping.py` | 26 | ✅ 掃過 | CLAUDE-SECURITY-20260913-064104 | | `domain/flow_engine/service/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/flow_engine/service/ext_workflow_execution_domain_service.py` | 29 | ✅ 掃過 | CLAUDE-SECURITY-20260913-064104 | | `domain/flow_engine/service/flow_template_domain_service.py` | 33 | ✅ 掃過 | CLAUDE-SECURITY-20260913-021915 | | `domain/flow_engine/service/job_evidence_domain_service.py` | 78 | ✅ 掃過 | CLAUDE-SECURITY-20260912-034350 | | `domain/flow_engine/service/stage_completion_registry.py` | 177 | ✅ 掃過 | CLAUDE-SECURITY-20260912-073625 | | `domain/flow_engine/service/stage_object_domain_service.py` | 20 | ✅ 掃過 | CLAUDE-SECURITY-20260912-073625 | | `domain/flow_engine/service/workflow_execution_control_mapping_domain_service.py` | 32 | ✅ 掃過 | CLAUDE-SECURITY-20260913-064104 | | `domain/flow_engine/vo/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/flow_engine/vo/control_vo.py` | 6 | ✅ 掃過 | CLAUDE-SECURITY-20260913-064104 | | `domain/module_frame/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/module_frame/code/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/module_frame/code/module_frame_action_type_enum.py` | 15 | ✅ 掃過 | CLAUDE-SECURITY-20260923-095422 | | `domain/module_frame/dto/module_frame_dto.py` | 49 | ✅ 掃過 | CLAUDE-SECURITY-20260923-095422 | | `domain/module_frame/entity/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/module_frame/entity/module_frame_entity.py` | 113 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104426 | | `domain/module_frame/entity/module_frame_menu_entity.py` | 23 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104426 | | `domain/module_frame/entity/module_frame_query_filter.py` | 37 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104426 | | `domain/module_frame/repository/__init__.py` | 1 | ❌ 沒碰 | 純宣告 | | `domain/module_frame/repository/module_frame.py` | 33 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104426 | | `domain/module_frame/service/__init__.py` | 1 | ❌ 沒碰 | 純宣告 | | `domain/module_frame/service/module_frame_domain_service.py` | 76 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104426 | | `domain/oscal/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/oscal/adapter/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/oscal/adapter/adapter_registry.py` | 21 | ✅ 掃過 | CLAUDE-SECURITY-20260924-085329 | | `domain/oscal/adapter/cmmc_ssp_adapter.py` | 860 | ✅ 掃過 | CLAUDE-SECURITY-20260924-085329 | | `domain/oscal/adapter/i_ssp_docx_adapter.py` | 78 | ✅ 掃過 | CLAUDE-SECURITY-20260924-085329 | | `domain/oscal/entity/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/oscal/entity/framework_parse_job_entity.py` | 76 | ✅ 掃過 | CLAUDE-SECURITY-20260921-154612 | | `domain/oscal/entity/ssp_docx_parse_job_entity.py` | 70 | ❌ 沒碰 | 純宣告 | | `domain/oscal/entity/ssp_excel_parse_job_entity.py` | 70 | ❌ 沒碰 | 純宣告 | | `domain/oscal/import_pipeline/__init__.py` | 1 | ❌ 沒碰 | 純宣告 | | `domain/oscal/import_pipeline/bundle_restore.py` | 208 | ⚠️ 部分 | FR-113 O9b | | `domain/oscal/parser/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/oscal/parser/control_id_matcher.py` | 120 | ✅ 掃過 | CLAUDE-SECURITY-20260924-080234 | | `domain/oscal/parser/docx_intermediate.py` | 72 | ✅ 掃過 | CLAUDE-SECURITY-20260924-080234 | | `domain/oscal/parser/docx_parser_core.py` | 555 | ✅ 掃過 | CLAUDE-SECURITY-20260924-080234 | | `domain/oscal/parser/docx_section_extractors.py` | 892 | ✅ 掃過 | CLAUDE-SECURITY-20260924-080234 | | `domain/oscal/parser/framework_patterns.py` | 19 | ✅ 掃過 | CLAUDE-SECURITY-20260924-080234 | | `domain/oscal/parser/ssp_intermediate.py` | 369 | ✅ 掃過 | CLAUDE-SECURITY-20260924-085329 | | `domain/oscal/repository/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/oscal/repository/i_framework_parse_job_repo.py` | 39 | ❌ 沒碰 | 純宣告 | | `domain/oscal/repository/i_ssp_catalog_title_query.py` | 24 | ❌ 沒碰 | 純宣告 | | `domain/oscal/repository/i_ssp_docx_parse_job_repo.py` | 25 | ❌ 沒碰 | 純宣告 | | `domain/oscal/repository/i_ssp_excel_parse_job_repo.py` | 25 | ❌ 沒碰 | 純宣告 | | `domain/oscal/service/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/oscal/service/framework_parse_job_domain_service.py` | 123 | ✅ 掃過 | CLAUDE-SECURITY-20260921-154612 | | `domain/oscal/service/party_reconciliation_service.py` | 30 | ⚠️ 部分 | FR-113 O9b | | `domain/oscal/service/reconciliation/__init__.py` | 18 | ❌ 沒碰 | 純宣告 | | `domain/oscal/service/reconciliation/_normalizers.py` | 51 | ⚠️ 部分 | FR-113 O9b | | `domain/oscal/service/reconciliation/base.py` | 107 | ⚠️ 部分 | FR-113 O9b | | `domain/oscal/service/reconciliation/match_method.py` | 10 | ⚠️ 部分 | FR-113 O9b | | `domain/oscal/service/reconciliation/organization_reconciler.py` | 101 | ⚠️ 部分 | FR-113 O9b | | `domain/oscal/service/reconciliation/person_reconciler.py` | 101 | ⚠️ 部分 | FR-113 O9b | | `domain/oscal/service/ssp_context_resolver.py` | 158 | ✅ 掃過 | CLAUDE-SECURITY-20260921-113212 | | `domain/oscal/service/ssp_docx_parse_job_domain_service.py` | 71 | ❌ 沒碰 | 判斷邏輯（→ U12） | | `domain/oscal/service/ssp_excel_parse_job_domain_service.py` | 71 | ❌ 沒碰 | 判斷邏輯（→ U12） | | `domain/oscal/service/ssp_project_resolver.py` | 184 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510；CLAUDE-SECURITY-20260921-113212 | | `domain/project_summary_report/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/project_summary_report/entity/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/project_summary_report/entity/project_summary_report_entity.py` | 28 | ❌ 沒碰 | 純宣告 | | `domain/project_summary_report/entity/project_summary_report_history_entity.py` | 26 | ❌ 沒碰 | 純宣告 | | `domain/project_summary_report/entity/project_summary_report_history_query_filter.py` | 17 | ❌ 沒碰 | 純宣告 | | `domain/project_summary_report/entity/project_summary_report_query_filter.py` | 19 | ❌ 沒碰 | 純宣告 | | `domain/project_summary_report/repository/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/project_summary_report/repository/project_summary_reoprt.py` | 18 | ❌ 沒碰 | 純宣告 | | `domain/project_summary_report/repository/project_summary_reoprt_history.py` | 8 | ❌ 沒碰 | 純宣告 | | `domain/project_summary_report/service/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/project_summary_report/service/project_summary_report_domain_service.py` | 52 | ❌ 沒碰 | 純宣告 | | `domain/project_summary_report/service/project_summary_report_history_domain_service.py` | 21 | ❌ 沒碰 | 純宣告 | | `domain/support/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/support/entity/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/support/entity/diag_bundle.py` | 116 | ❌ 沒碰 | 純宣告 | | `domain/support/service/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `domain/support/service/diag_slice_domain_service.py` | 270 | ❌ 沒碰 | 判斷邏輯（→ U10） | | `examples/compute_engine_example.py` | 469 | ❌ 沒碰 | 離線工具 | | `examples/metadata_builder_example.py` | 263 | ❌ 沒碰 | 離線工具 | | `examples/prompts_metadata_example.py` | 438 | ❌ 沒碰 | 離線工具 | | `infra/__init__.py` | 2 | ❌ 沒碰 | 純宣告 | | `infra/associations/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/associations/mapper/__init__.py` | 7 | ❌ 沒碰 | 純宣告 | | `infra/associations/mapper/project_assessment_plan_mapping_mapper.py` | 27 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `infra/associations/mapper/project_org_unit_mapping_mapper.py` | 29 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `infra/associations/mapper/project_system_characteristic_mapping_mapper.py` | 28 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `infra/associations/model/__init__.py` | 5 | ❌ 沒碰 | 純宣告 | | `infra/associations/model/project_assessment_plan_mapping.py` | 66 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `infra/associations/model/project_org_unit.py` | 50 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `infra/associations/model/project_system_characteristic.py` | 54 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `infra/associations/repository/__init__.py` | 7 | ❌ 沒碰 | 純宣告 | | `infra/associations/repository/project_assessment_plan_mapping_repo_impl.py` | 71 | ❌ 沒碰 | 判斷邏輯（→ U9） | | `infra/associations/repository/project_org_unit_mapping_repo_impl.py` | 38 | ❌ 沒碰 | 判斷邏輯（→ U9） | | `infra/associations/repository/project_system_characteristic_mapping_repo_impl.py` | 59 | ❌ 沒碰 | 判斷邏輯（→ U9） | | `infra/auth/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/auth/root_admin_reader.py` | 40 | ❌ 沒碰 | 判斷邏輯（→ U9） | | `infra/cloud_integration/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/cloud_integration/crypto/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/cloud_integration/crypto/fernet_crypto.py` | 18 | ❌ 沒碰 | 判斷邏輯（→ U4） | | `infra/cloud_integration/google_drive/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/cloud_integration/google_drive/exceptions.py` | 26 | ❌ 沒碰 | 純宣告 | | `infra/cloud_integration/google_drive/google_drive_api_client.py` | 301 | ❌ 沒碰 | 判斷邏輯（→ U5） | | `infra/cloud_integration/google_drive/google_oauth_client.py` | 180 | ❌ 沒碰 | 判斷邏輯（→ U4） | | `infra/cloud_integration/mapper/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/cloud_integration/mapper/drive_folder_mapping_mapper.py` | 35 | ❌ 沒碰 | 純宣告 | | `infra/cloud_integration/mapper/drive_sync_job_mapper.py` | 39 | ❌ 沒碰 | 純宣告 | | `infra/cloud_integration/mapper/tenant_drive_integration_mapper.py` | 56 | ❌ 沒碰 | 純宣告 | | `infra/cloud_integration/models/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/cloud_integration/models/drive_folder_mapping.py` | 34 | ❌ 沒碰 | 純宣告 | | `infra/cloud_integration/models/drive_sync_job.py` | 38 | ❌ 沒碰 | 純宣告 | | `infra/cloud_integration/models/tenant_drive_integration.py` | 45 | ❌ 沒碰 | 純宣告 | | `infra/cloud_integration/repository/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/cloud_integration/repository/drive_folder_mapping_repo_impl.py` | 171 | ❌ 沒碰 | 判斷邏輯（→ U6） | | `infra/cloud_integration/repository/drive_sync_job_repo_impl.py` | 191 | ❌ 沒碰 | 判斷邏輯（→ U5） | | `infra/cloud_integration/repository/tenant_drive_integration_repo_impl.py` | 94 | ❌ 沒碰 | 判斷邏輯（→ U4） | | `infra/flow_control/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/flow_control/repository/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/flow_control/repository/flow_control_job_repo_impl.py` | 1216 | ✅ 掃過 | CLAUDE-SECURITY-20260923-143314 | | `infra/flow_control/repository/flow_control_project_repo_impl.py` | 716 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `infra/flow_control/repository/job_binding_orphan_query.py` | 129 | ❌ 沒碰 | 判斷邏輯（→ U8） | | `infra/flow_control/repository/job_import_lookup_query.py` | 149 | ✅ 掃過 | CLAUDE-SECURITY-20260923-143314 | | `infra/flow_control/repository/reverify_clone_query.py` | 176 | ❌ 沒碰 | 判斷邏輯（→ U8） | | `infra/flow_control/repository/task_execution_query.py` | 292 | ❌ 沒碰 | 判斷邏輯（→ U8） | | `infra/flow_control/task_existence_query.py` | 76 | ❌ 沒碰 | 判斷邏輯（→ U8） | | `infra/flow_engine/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/flow_engine/mapper/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/flow_engine/mapper/ext_workflow_execution_mapper.py` | 61 | ✅ 掃過 | CLAUDE-SECURITY-20260913-064104 | | `infra/flow_engine/mapper/flow_template_mapper.py` | 44 | ✅ 掃過 | CLAUDE-SECURITY-20260913-021915 | | `infra/flow_engine/mapper/job_evidence_mapper.py` | 46 | ✅ 掃過 | CLAUDE-SECURITY-20260912-034350 | | `infra/flow_engine/mapper/stage_object_mapper.py` | 59 | ✅ 掃過 | CLAUDE-SECURITY-20260912-073625 | | `infra/flow_engine/mapper/workflow_execution_control_mapping_mapper.py` | 20 | ✅ 掃過 | CLAUDE-SECURITY-20260913-064104 | | `infra/flow_engine/models/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/flow_engine/models/ext_workflow_execution.py` | 164 | ✅ 掃過 | CLAUDE-SECURITY-20260913-064104 | | `infra/flow_engine/models/flow_template.py` | 29 | ✅ 掃過 | CLAUDE-SECURITY-20260913-021915 | | `infra/flow_engine/models/job_evidence.py` | 117 | ✅ 掃過 | CLAUDE-SECURITY-20260912-034350；CLAUDE-SECURITY-20260923-143342 | | `infra/flow_engine/models/stage_object.py` | 34 | ✅ 掃過 | CLAUDE-SECURITY-20260912-073625 | | `infra/flow_engine/models/workflow_execution_control_mapping.py` | 57 | ✅ 掃過 | CLAUDE-SECURITY-20260913-064104 | | `infra/flow_engine/repository/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/flow_engine/repository/ext_workflow_execution_impl.py` | 52 | ✅ 掃過 | CLAUDE-SECURITY-20260913-064104 | | `infra/flow_engine/repository/flow_template_repo_impl.py` | 108 | ✅ 掃過 | CLAUDE-SECURITY-20260913-021915 | | `infra/flow_engine/repository/job_evidence_repo_impl.py` | 206 | ✅ 掃過 | CLAUDE-SECURITY-20260912-034350 | | `infra/flow_engine/repository/job_execution_repo_impl.py` | 26 | ✅ 掃過 | CLAUDE-SECURITY-20260912-034350 | | `infra/flow_engine/repository/stage_object_repo_impl.py` | 38 | ✅ 掃過 | CLAUDE-SECURITY-20260912-073625 | | `infra/flow_engine/repository/workflow_execution_control_mapping_repo_impl.py` | 93 | ✅ 掃過 | CLAUDE-SECURITY-20260913-064104 | | `infra/identity/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/identity/user_name_resolver.py` | 85 | ✅ 掃過 | CLAUDE-SECURITY-20260923-130653 | | `infra/module_frame/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/module_frame/adapter/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/module_frame/adapter/parser_adapter_factory.py` | 17 | ✅ 掃過 | CLAUDE-SECURITY-20260923-095422 | | `infra/module_frame/adapter/yaml_to_module_frame_parser_adapter.py` | 65 | ✅ 掃過 | CLAUDE-SECURITY-20260923-095422 | | `infra/module_frame/mapper/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/module_frame/mapper/module_frame_mapper.py` | 41 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104426 | | `infra/module_frame/mapper/module_frame_menu_mapper.py` | 23 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104426 | | `infra/module_frame/models/__init__.py` | 4 | ❌ 沒碰 | 純宣告 | | `infra/module_frame/models/module_frame.py` | 91 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104426 | | `infra/module_frame/models/module_frame_trans.py` | 29 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104426 | | `infra/module_frame/ports/parser_port.py` | 9 | ✅ 掃過 | CLAUDE-SECURITY-20260923-095422 | | `infra/module_frame/repository/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/module_frame/repository/module_frame_repo_impl.py` | 136 | ✅ 掃過 | CLAUDE-SECURITY-20260922-104426 | | `infra/notification/__init__.py` | 0 | ✅ 掃過 | CLAUDE-SECURITY-20260908-073510 | | `infra/notification/tenant_notify_config_reader.py` | 37 | ✅ 掃過 | CLAUDE-SECURITY-20260908-073510；CLAUDE-SECURITY-20260915-090332 | | `infra/oscal/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/oscal/mapper/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/oscal/mapper/framework_parse_job_mapper.py` | 39 | ❌ 沒碰 | 純宣告 | | `infra/oscal/mapper/ssp_docx_parse_job_mapper.py` | 35 | ❌ 沒碰 | 純宣告 | | `infra/oscal/mapper/ssp_excel_parse_job_mapper.py` | 35 | ❌ 沒碰 | 純宣告 | | `infra/oscal/model/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/oscal/model/framework_parse_job.py` | 36 | ⚠️ 部分 | FR-113 O9b | | `infra/oscal/model/ssp_docx_parse_job.py` | 30 | ⚠️ 部分 | FR-113 O9b | | `infra/oscal/model/ssp_excel_parse_job.py` | 30 | ⚠️ 部分 | FR-113 O9b | | `infra/oscal/repository/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/oscal/repository/framework_parse_job_repo_impl.py` | 91 | ✅ 掃過 | CLAUDE-SECURITY-20260921-154612 | | `infra/oscal/repository/ssp_catalog_title_query.py` | 93 | ✅ 掃過 | CLAUDE-SECURITY-20260924-073342；FR-113 O9b | | `infra/oscal/repository/ssp_docx_parse_job_repo_impl.py` | 54 | ❌ 沒碰 | 判斷邏輯（→ U12） | | `infra/oscal/repository/ssp_excel_parse_job_repo_impl.py` | 56 | ❌ 沒碰 | 判斷邏輯（→ U12） | | `infra/project_summary_report/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/project_summary_report/mapper/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/project_summary_report/mapper/project_summary_report_history_mapper.py` | 27 | ❌ 沒碰 | 純宣告 | | `infra/project_summary_report/mapper/project_summary_report_mapper.py` | 28 | ❌ 沒碰 | 純宣告 | | `infra/project_summary_report/models/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/project_summary_report/models/project_summary_report.py` | 56 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `infra/project_summary_report/models/project_summary_report_history.py` | 67 | ❌ 沒碰 | 純宣告 | | `infra/project_summary_report/repository/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/project_summary_report/repository/project_summary_report_hitrosy_repo_impl.py` | 36 | ❌ 沒碰 | 判斷邏輯（→ U9） | | `infra/project_summary_report/repository/project_summary_report_repo_impl.py` | 137 | ✅ 掃過 | CLAUDE-SECURITY-20260914-070510 | | `infra/readmodel/__init__.py` | 68 | ❌ 沒碰 | 純宣告 | | `infra/readmodel/audit/__init__.py` | 11 | ❌ 沒碰 | 純宣告 | | `infra/readmodel/audit/auditor_dashboard_query.py` | 118 | ✅ 掃過 | CLAUDE-SECURITY-20260924-050436 | | `infra/readmodel/audit/flow_control_dashboard_repo_impl.py` | 254 | ❌ 沒碰 | 判斷邏輯（→ U7） | | `infra/readmodel/detection/__init__.py` | 14 | ❌ 沒碰 | 純宣告 | | `infra/readmodel/detection/detection_job_notify_query.py` | 161 | ✅ 掃過 | CLAUDE-SECURITY-20260923-130633 | | `infra/readmodel/detection/detection_profile_usage_query.py` | 150 | ✅ 掃過 | CLAUDE-SECURITY-20260923-130633 | | `infra/readmodel/oscal/__init__.py` | 11 | ❌ 沒碰 | 純宣告 | | `infra/readmodel/oscal/resource_library_query.py` | 141 | ✅ 掃過 | CLAUDE-SECURITY-20260921-060255 | | `infra/readmodel/oscal/ssp_control_implementation_query.py` | 257 | ✅ 掃過 | CLAUDE-SECURITY-20260921-061133 | | `infra/readmodel/tasks/__init__.py` | 14 | ❌ 沒碰 | 純宣告 | | `infra/readmodel/tasks/job_batch_complete_query.py` | 284 | ✅ 掃過 | CLAUDE-SECURITY-20260923-142057 | | `infra/readmodel/tasks/job_export_query.py` | 264 | ✅ 掃過 | CLAUDE-SECURITY-20260923-143314 | | `infra/readmodel/tasks/my_grc_jobs_query.py` | 198 | ❌ 沒碰 | 判斷邏輯（→ U7） | | `infra/readmodel/tasks/vw_user_job_queue.py` | 94 | ❌ 沒碰 | 純宣告 | | `infra/remote_agent/__init__.py` | 0 | ✅ 掃過 | CLAUDE-SECURITY-20260917-015011 | | `infra/remote_agent/adapter/__init__.py` | 0 | ✅ 掃過 | CLAUDE-SECURITY-20260917-015011 | | `infra/remote_agent/adapter/detection_lifecycle_listener.py` | 37 | ✅ 掃過 | CLAUDE-SECURITY-20260917-015011；CLAUDE-SECURITY-20260923-130633 | | `infra/remote_agent/adapter/detection_task_payload_provider.py` | 125 | ✅ 掃過 | CLAUDE-SECURITY-20260917-015011 | | `infra/remote_agent/recon_query_adapter.py` | 34 | ✅ 掃過 | CLAUDE-SECURITY-20260917-015011 | | `infra/setup/__init__.py` | 1 | ❌ 沒碰 | 純宣告 | | `infra/setup/setup_state_reader.py` | 89 | ❌ 沒碰 | 判斷邏輯（→ U3） | | `infra/support/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/support/collector/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/support/collector/container_collector.py` | 105 | ❌ 沒碰 | 判斷邏輯（→ U11） | | `infra/support/collector/host_collector.py` | 201 | ❌ 沒碰 | 判斷邏輯（→ U11） | | `infra/support/collector/protocol.py` | 55 | ❌ 沒碰 | 純宣告 | | `infra/support/collector/staged_collector.py` | 178 | ❌ 沒碰 | 判斷邏輯（→ U11） | | `infra/support/diag_db_reader.py` | 242 | ❌ 沒碰 | 判斷邏輯（→ U11） | | `infra/support/diag_event_fetcher.py` | 303 | ❌ 沒碰 | 判斷邏輯（→ U11） | | `infra/support/diag_log_reader.py` | 176 | ❌ 沒碰 | 判斷邏輯（→ U11） | | `infra/support/diag_masking.py` | 198 | ✅ 掃過 | CLAUDE-SECURITY-20260923-130653 | | `infra/support/diag_packer.py` | 343 | ❌ 沒碰 | 判斷邏輯（→ U11） | | `infra/survey/__init__.py` | 0 | ❌ 沒碰 | 純宣告 | | `infra/survey/adapters.py` | 163 | ✅ 掃過 | CLAUDE-SECURITY-20260923-130757 | | `infra/system_config/__init__.py` | 0 | ✅ 掃過 | CLAUDE-SECURITY-20260915-090332 | | `infra/system_config/runtime_config.py` | 74 | ✅ 掃過 | CLAUDE-SECURITY-20260915-090332 | | `infra/system_config/system_config_root_reader.py` | 321 | ✅ 掃過 | CLAUDE-SECURITY-20260908-073510；CLAUDE-SECURITY-20260915-090332；CLAUDE-SECURITY-20260923-143342 | | `infra/system_config/tenant_config_seed_writer.py` | 86 | ✅ 掃過 | CLAUDE-SECURITY-20260915-090332 | | `infra/upload_file/__init__.py` | 0 | ✅ 掃過 | CLAUDE-SECURITY-20260911-065519 | | `infra/upload_file/remote_agent_adapter.py` | 275 | ✅ 掃過 | CLAUDE-SECURITY-20260911-065519；CLAUDE-SECURITY-20260917-015011 | | `infra/upload_file/remote_agent_config_dto.py` | 22 | ✅ 掃過 | CLAUDE-SECURITY-20260911-065519；CLAUDE-SECURITY-20260917-015011 | | `infra/upload_file/system_storage_config_reader.py` | 58 | ✅ 掃過 | CLAUDE-SECURITY-20260911-065519 | | `main.py` | 302 | ❌ 沒碰 | 判斷邏輯（→ U2） | --- 沿革見 FR-119 母卡 CM-2139 與 git log。