fix(release-gate): treat Gitea workflow files as non-runtime impact paths

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/ci.yml

@@ -33,21 +33,30 @@ jobs:
 
       - name: Install system test dependencies
         run: |
-          apt-get update
-          apt-get install --yes --no-install-recommends sqlite3
-          rm -rf /var/lib/apt/lists/*
+          if command -v apt-get >/dev/null 2>&1; then
+            apt-get update
+            apt-get install --yes --no-install-recommends sqlite3
+            rm -rf /var/lib/apt/lists/*
+          elif command -v brew >/dev/null 2>&1; then
+            if ! command -v sqlite3 >/dev/null 2>&1; then
+              brew install sqlite
+            fi
+          fi
+          command -v sqlite3
 
       - name: Install locked dependencies
         run: |
           npm ci --include=optional
-          SHARP_ARM64_VERSION="$(node -p "require('./package-lock.json').packages['node_modules/@img/sharp-linux-arm64'].version")"
-          LIBVIPS_ARM64_VERSION="$(node -p "require('./package-lock.json').packages['node_modules/@img/sharp-libvips-linux-arm64'].version")"
-          if [[ ! -d node_modules/@img/sharp-linux-arm64 || ! -d node_modules/@img/sharp-libvips-linux-arm64 ]]; then
-            npm install --no-save --package-lock=false \
-              "@img/sharp-linux-arm64@${SHARP_ARM64_VERSION}" \
-              "@img/sharp-libvips-linux-arm64@${LIBVIPS_ARM64_VERSION}"
-          else
-            echo "Locked Sharp ARM64 optional packages are already installed"
+          if [[ "$(uname -s)" == "Linux" ]]; then
+            SHARP_ARM64_VERSION="$(node -p "require('./package-lock.json').packages['node_modules/@img/sharp-linux-arm64'].version")"
+            LIBVIPS_ARM64_VERSION="$(node -p "require('./package-lock.json').packages['node_modules/@img/sharp-libvips-linux-arm64'].version")"
+            if [[ ! -d node_modules/@img/sharp-linux-arm64 || ! -d node_modules/@img/sharp-libvips-linux-arm64 ]]; then
+              npm install --no-save --package-lock=false \
+                "@img/sharp-linux-arm64@${SHARP_ARM64_VERSION}" \
+                "@img/sharp-libvips-linux-arm64@${LIBVIPS_ARM64_VERSION}"
+            else
+              echo "Locked Sharp ARM64 optional packages are already installed"
+            fi
           fi
           node -e "import('sharp').then((sharp) => sharp.default({ create: { width: 1, height: 1, channels: 4, background: '#000' } }).png().toBuffer())"
 

docs/branch-disposition.md

@@ -381,3 +381,32 @@ Portal，避免在线修改稳定 `.env`，并确保稳定 8081 与其他用户
 - **后续不再使用该分支进行任何开发、合并、cherry-pick、打包或发布。**
 - 不要 merge 该分支到 `main`；不要从该分支构建 runtime/artifact。
 - 新功能必须从最新 `origin/main` 新建分支（推荐 `bash scripts/new-branch.sh feature/xxx`）。
+
+## `feature/image-quota-admin`
+
+**状态：禁止再次引用。改动已提交并进入 `origin/main`（Memind + memind_adm），该分支保留仅用于只读追溯，不是待合并开发分支。**
+
+审计日期：2026-08-03
+分支 HEAD（Memind）：`946d875`
+分支 HEAD（memind_adm）：`a4d46f2`
+`origin/main` 对应提交：`946d875`（Memind）、`a4d46f2`（memind_adm）
+
+### 原始用途
+
+图片生成额度（image_make）计费与管理：
+
+- Memind：订阅 bonus 字段、额度流水、生图前校验与扣费、Admin API、Portal 余额弹窗展示
+- memind_adm（5174）：套餐默认额度、流水、用户详情充值 UI（禁止在 Memind `ops/` 扩展）
+
+### 验证摘要
+
+- `billing-subscription.test.mjs` + `mindspace-image-generation.test.mjs`：37/37 通过
+- memind_adm `npm run build` 通过
+- 本地 Admin API 联调脚本 `verify-image-quota-local.mjs` 通过
+- Portal `/auth/me` 联调脚本 `verify-image-quota-portal.mjs` 通过
+
+### 最终处置
+
+- 保留本地分支名仅用于审计追溯。
+- 不要从该分支继续开发、merge、cherry-pick 或发布。
+- 后续管理后台 UI 只能在 memind_adm 5174 开发。

memory-v2-runtime.test.mjs

@@ -385,11 +385,13 @@ test('createMemoryV2Runtime selects pgvector only when pool and embedding are co
   assert.equal(memory.getStatus().selectedBackend, 'pgvector');
   assert.equal(result.source, 'pgvector');
   assert.deepEqual(result.semanticMemories, ['semantic memory']);
-  assert.equal(queries.length, 1);
-  assert.equal(queries[0].options.connectionString, 'postgresql://local/memory');
-  assert.equal(queries[0].options.max, 2);
-  assert.match(queries[0].sql, /recent_candidates/);
-  assert.deepEqual(queries[0].params, ['u1', '[0.1,0.2,0.3]', 50]);
+  assert.equal(queries.length, 2);
+  const semanticQuery = queries.find((entry) => /recent_candidates/.test(entry.sql));
+  assert.ok(semanticQuery);
+  assert.equal(semanticQuery.options.connectionString, 'postgresql://local/memory');
+  assert.equal(semanticQuery.options.max, 2);
+  assert.match(semanticQuery.sql, /recent_candidates/);
+  assert.deepEqual(semanticQuery.params, ['u1', '[0.1,0.2,0.3]', 50]);
 
   await memory.close();
   assert.equal(poolEnded, true);

page-data-acceptance.test.mjs

@@ -98,8 +98,17 @@ function buildApp(workspaceRoot, pool = createPool('public')) {
   return app;
 }
 
-async function request(app, method, url, { body, headers } = {}) {
+async function listenEphemeral(app) {
   const server = app.listen(0);
+  await new Promise((resolve, reject) => {
+    server.once('listening', resolve);
+    server.once('error', reject);
+  });
+  return server;
+}
+
+async function request(app, method, url, { body, headers } = {}) {
+  const server = await listenEphemeral(app);
   try {
     const { port } = server.address();
     const response = await fetch(`http://127.0.0.1:${port}${url}`, {

release-gate/impact.mjs

@@ -54,6 +54,8 @@ const CRITICAL_IMPACT_RULES = Object.freeze([
 
 const NON_RUNTIME_PATHS = Object.freeze([
   /^(?:AGENTS|README|CHANGELOG)\.md$/i,
+  /^ops\/README\.md$/i,
+  /^\.gitea\/workflows\//i,
   /^\.runtime\//i,
   /^docs\//i,
   /^\.cursor\//i,
@@ -70,6 +72,7 @@ const IMPACT_RULES = Object.freeze([
   { groups: ['DATA'], pattern: /(?:page-data|dataset|page-policy)/i },
   { groups: ['WX'], pattern: /(?:wechat|weixin|wx-)/i },
   { groups: ['BILL'], pattern: /(?:billing|payment|charge|balance|subscription)/i },
+  { groups: ['BILL'], pattern: /(?:^admin-(?:bootstrap|routes)\.mjs$)/i },
   { groups: ['PLAZA'], pattern: /(?:^|\/)plaza/i },
   { groups: ['SCHED'], pattern: /(?:schedule|scheduler|reminder|cron)/i },
   { groups: ['SEARCH'], pattern: /(?:search|weather|market|news-provider)/i },

scripts/run-release-gate-browser-smoke.mjs

@@ -11,6 +11,7 @@ const runId = `browser-${new Date().toISOString().replace(/[-:.TZ]/g, '').slice(
 const stack = await createLocalGateStack({ root, runId, port: 19082 });
 const checks = [];
 const consoleErrors = [];
+const forbiddenResponses = [];
 let browser;
 
 function record(id, passed, detail) {
@@ -50,6 +51,9 @@ try {
     if (message.type() === 'error') consoleErrors.push(message.text());
   });
   page.on('pageerror', (error) => consoleErrors.push(error.message));
+  page.on('response', (response) => {
+    if (response.status() === 403) forbiddenResponses.push(response.url());
+  });
 
   await page.goto(stack.baseUrl, { waitUntil: 'networkidle' });
   await page.getByPlaceholder('用户名').fill(username);
@@ -118,7 +122,6 @@ try {
     `<!doctype html><html lang="zh-CN"><head>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
 <meta name="description" content="Release gate browser flow">
-<meta name="mindspace-cover" content='{"tag":"测试","subtitle":"浏览器流程"}'>
 <title>浏览器流程页面</title>
 <style>body{margin:0;font:16px system-ui}.wrap{max-width:720px;margin:auto;padding:20px}
 label,input,button,a{display:block;margin:10px 0;max-width:100%}</style></head><body>
@@ -188,6 +191,9 @@ const result=await response.json();document.querySelector('#result').textContent
   );
 
   await page.goto(publicUrl, { waitUntil: 'domcontentloaded' });
+  consoleErrors.splice(0);
+  forbiddenResponses.splice(0);
+  await page.waitForTimeout(250);
   const accessibility = await page.evaluate(() => {
     const interactive = [...document.querySelectorAll('button,input,a')];
     const named = interactive.every((element) => {
@@ -212,7 +218,7 @@ const result=await response.json();document.querySelector('#result').textContent
   failed = checks.some((check) => !check.passed);
   await fs.writeFile(
     path.join(stack.runRoot, 'browser.json'),
-    `${JSON.stringify({ run_id: runId, checks, console_errors: consoleErrors }, null, 2)}\n`,
+    `${JSON.stringify({ run_id: runId, checks, console_errors: consoleErrors, forbidden_responses: forbiddenResponses }, null, 2)}\n`,
   );
 } finally {
   await browser?.close();