docs(ops): add VibeWork dev baseline decision package [skip ci]

2026-06-24 14:01:33 +08:00
parent d12a925954
commit 21fbebc2eb
3 changed files with 386 additions and 0 deletions
--- a/docs/LOGBOOK.md
+++ b/docs/LOGBOOK.md
@@ -1,3 +1,29 @@
+## 2026-06-24｜VibeWork dev baseline owner decision package
+
+**背景**：Blocked products pick list 將 VibeWork 排在第五候選，但它不是 clean dev bootstrap；本輪只讀 `/Users/ogt/Documents/VibeWork`，確認此產品已進入大面積 commercial / MCP / payment / runtime drift。沒有 commit、branch、push、讀 `.env` 或讀 secret value。
+
+**只讀 readback**：
+- local branch：`main`。
+- local HEAD：`48275cc52be79107e887147d3fe10310a887afe9`。
+- Gitea main：`76a4ee15026af278a3660ad4b4547e9308b107be`。
+- Gitea `dev`：missing。
+- tracked modified：`105`。
+- tracked deleted：`0`。
+- untracked：`97`。
+- diff shortstat：超過 30s，中止。
+- targeted `git diff --check -- docs/PHASE_0_IMPLEMENTATION_PLAN.md`：failed，原因為多處 trailing whitespace。
+- env-like paths observed but not read：`.env`、`.env.example`、`.env.production.example`。
+
+**文件**：
+- `docs/operations/vibework-dev-baseline-owner-decision.snapshot.json`
+- `docs/operations/VIBEWORK-DEV-BASELINE-OWNER-DECISION-2026-06-24.md`
+
+**判定**：VibeWork 不能直接建立遠端 `dev`。變更橫跨 Nginx、Docker、Prisma、package lock、ops scripts、AI routes、growth / lead APIs、Stripe webhook、MCP route、workspace packages、public pages、i18n、marketing assets 與大型商業文件；必須先由 owner 做 include / exclude 分桶。
+
+**下一步**：建立 VibeWork path-bucketed owner response；owner 明確接受 tracked / untracked groups、release scope、env example policy 與 whitespace cleanup 後，才可進入 review branch 或 remote `dev` creation gate。
+
+**邊界**：沒有產品 repo 寫入、沒有 remote write、沒有 runtime write、沒有 secret collection；Mac Mini / MacBook Pro 仍不得把 VibeWork 視為雙機可開發 ready。
+
 ## 2026-06-24｜2026FIFA dev baseline owner decision package

 **背景**：Blocked products pick list 將 2026FIFA 排在第四候選，但它不是一般 dirty review：本輪只讀 `/Users/ogt/Documents/2026FIFAWorldCup` 時，normal status / diff 與窄 `git ls-files` retry 均超過可接受時間，證明需要專用窄掃描工具。不 commit、不 branch、不 push、不讀 `.env` 或 secret value。
--- a/docs/operations/VIBEWORK-DEV-BASELINE-OWNER-DECISION-2026-06-24.md
+++ b/docs/operations/VIBEWORK-DEV-BASELINE-OWNER-DECISION-2026-06-24.md
@@ -0,0 +1,80 @@
+# VibeWork Dev Baseline Owner Decision
+
+- generated_at: `2026-06-24T13:58:34+08:00`
+- product_id: `vibework`
+- local_path: `/Users/ogt/Documents/VibeWork`
+- status: `high risk, owner pick required`
+
+## Readback
+
+| Gate | Result |
+|------|--------|
+| local branch | `main` |
+| local head | `48275cc52be79107e887147d3fe10310a887afe9` |
+| Gitea main | `76a4ee15026af278a3660ad4b4547e9308b107be` |
+| Gitea dev | missing |
+| tracked modified | `105` |
+| tracked deleted | `0` |
+| untracked | `97` |
+| diff shortstat | timeout / interrupted after 30s |
+| diff check | failed on `docs/PHASE_0_IMPLEMENTATION_PLAN.md` trailing whitespace |
+
+## 分類
+
+Tracked modified groups:
+
+- Runtime / deploy：`.env.production.example`、`.gitignore`、`Dockerfile`、Nginx conf、production compose、`package.json`、`pnpm-lock.yaml`、Prisma schema、Tailwind / TS config。
+- Docs：API contract、deployment strategy、design notes、Phase 0 / Phase 2 planning、release process。
+- Ops scripts：image build、remote compose deploy、smoke check。
+- Public asset：`public/images/vibework-hero.png`。
+- Admin / AI routes：growth launch、growth leads、intake assistant、milestone assistant、support。
+- Product APIs：admin review、marketing content、auth、growth events / leads、project intake、PRD freeze、workspace milestones。
+- Public pages：case studies、clients、coders、compare、early access、FAQ、industries、pricing、resources、services、scope score、sitemap / robots。
+- Features / libraries：admin、auth、coder、growth、intake、marketing、match、workspace、i18n、domain / server libraries、middleware。
+
+Untracked groups:
+
+- Docs：audit / admin readiness / handoff / commercial plan / master plan / validation status。
+- Workspace packages：`packages/contracts`、`packages/mcp-server`、`pnpm-workspace.yaml`。
+- Brand / public assets：brand SVG、avatar PNG、empty-state PNG、marketing feature PNG、new hero asset。
+- Ops / verification：route policy checks、public header policy check、expected hero hash、release guard、production image verifier、seed / replay / prisma / MCP / E2E verification scripts。
+- New API routes：cron reaper、matching run、MCP route、acquire lead lifecycle、growth launch admin, growth leads, scout events, Stripe webhook。
+- New pages / features / libraries：English catch-all, error / loading pages, services page, GrowthLeadsPage, BrandLogo, growth pages, SEO helpers, demand acquisition, payment / prisma / rate-limit / sandbox / Stripe checkout libraries。
+
+Env-like paths observed but not read:
+
+- `.env`
+- `.env.example`
+- `.env.production.example`
+
+## 判定
+
+不能直接把 VibeWork 推成 Gitea `dev` baseline。這批變更面積太大，且同時碰到 public website、growth / lead API、MCP、Stripe webhook、Nginx、Docker、Prisma、workspace packages、ops verification scripts 與大量商業文件；local HEAD 也與 Gitea main 不同。
+
+直接建立遠端 `dev` 會有三個風險：
+
+1. 把未經 owner 選擇的 97 個 untracked candidates 一次性納入。
+2. 把 runtime / deploy / payment / MCP / Nginx 變更混成同一個 baseline，後續 Mac Mini / MacBook Pro 會一起繼承不明 release scope。
+3. 目前 `docs/PHASE_0_IMPLEMENTATION_PLAN.md` diff check 已因 trailing whitespace 失敗，代表最少仍需 hygiene pass 或 owner 接受例外。
+
+## Owner Decision
+
+需要 owner 回覆：
+
+1. 是否以 local head `48275cc52be79107e887147d3fe10310a887afe9` 作為最新產品基準候選。
+2. tracked modified groups 哪些要保留、哪些要拆成後續分支。
+3. untracked groups 哪些要納入、哪些要排除。
+4. `packages/contracts` / `packages/mcp-server` / `pnpm-workspace.yaml` 是否正式成為 VibeWork baseline。
+5. Stripe webhook、MCP route、Nginx route、Docker、Prisma、growth lead API 是否同屬一個 release scope，或必須拆分。
+6. `.env` 一律不納入；`.env.example` / `.env.production.example` 只允許 metadata-only review，不收 secret value。
+7. `docs/PHASE_0_IMPLEMENTATION_PLAN.md` trailing whitespace cleanup 要先清，還是 owner 接受暫時保留為歷史文件 debt。
+8. owner 接受 include / exclude list 後，才可建立 product repo review branch 或遠端 `dev`。
+
+## 安全邊界
+
+- 未讀 `.env`。
+- 未讀 secret value。
+- 未修改 VibeWork repo。
+- 未建立 branch、commit 或 push。
+- 未同步 raw `.git`、runtime volume 或 Codex raw conversation。
+- 未把 Gitea `main`、local `main` 或 dirty worktree 誤標成可雙機開發的 `dev` baseline。
--- a/docs/operations/vibework-dev-baseline-owner-decision.snapshot.json
+++ b/docs/operations/vibework-dev-baseline-owner-decision.snapshot.json
@@ -0,0 +1,280 @@
+{
+  "schema_version": "vibework_dev_baseline_owner_decision_v1",
+  "generated_at": "2026-06-24T13:58:34+08:00",
+  "product_id": "vibework",
+  "local_path": "/Users/ogt/Documents/VibeWork",
+  "gitea_repo": "wooo/vibework",
+  "remote_refs": {
+    "main": "76a4ee15026af278a3660ad4b4547e9308b107be",
+    "dev": ""
+  },
+  "local_readback": {
+    "branch": "main",
+    "head": "48275cc52be79107e887147d3fe10310a887afe9",
+    "tracked_modified_count": 105,
+    "tracked_deleted_count": 0,
+    "untracked_count": 97,
+    "diff_shortstat": "timeout_interrupted_after_30s",
+    "diff_check": "failed_targeted_docs_phase_0_trailing_whitespace",
+    "status": "high_risk_owner_pick_required"
+  },
+  "tracked_modified_groups": {
+    "runtime_and_deploy": [
+      ".env.production.example",
+      ".gitignore",
+      "Dockerfile",
+      "deploy/nginx/vibework.wooo.work.conf",
+      "docker-compose.production.yml",
+      "package.json",
+      "pnpm-lock.yaml",
+      "prisma/schema.prisma",
+      "tailwind.config.ts",
+      "tsconfig.json"
+    ],
+    "docs": [
+      "docs/API_CONTRACT_DRAFT.md",
+      "docs/DEPLOYMENT_STRATEGY.md",
+      "docs/DESIGN_REFERENCE_NOTES.md",
+      "docs/PHASE_0_IMPLEMENTATION_PLAN.md",
+      "docs/PHASE_2_API_CONTRACT.md",
+      "docs/PHASE_2_PLANNING.md",
+      "docs/RELEASE_PROCESS.md"
+    ],
+    "ops_scripts": [
+      "scripts/ops/build-image.sh",
+      "scripts/ops/deploy-compose-remote.sh",
+      "scripts/ops/smoke-check.sh"
+    ],
+    "public_assets": [
+      "public/images/vibework-hero.png"
+    ],
+    "admin_and_ai_routes": [
+      "src/app/admin/growth-launch/page.tsx",
+      "src/app/admin/growth-leads/page.tsx",
+      "src/app/api/ai/intake-assistant/apply/route.ts",
+      "src/app/api/ai/intake-assistant/route.ts",
+      "src/app/api/ai/milestone-assistant/apply/route.ts",
+      "src/app/api/ai/milestone-assistant/route.ts",
+      "src/app/api/ai/support/route.ts"
+    ],
+    "product_api_routes": [
+      "src/app/api/v1/admin/change-requests/[changeRequestId]/intervene/route.ts",
+      "src/app/api/v1/admin/coder-applications/[applicationId]/review/route.ts",
+      "src/app/api/v1/admin/marketing-content/[itemId]/route.ts",
+      "src/app/api/v1/admin/marketing-content/route.ts",
+      "src/app/api/v1/admin/users/[userId]/status/route.ts",
+      "src/app/api/v1/auth/demo-login/route.ts",
+      "src/app/api/v1/auth/password-login/route.ts",
+      "src/app/api/v1/auth/register/route.ts",
+      "src/app/api/v1/growth/events/route.ts",
+      "src/app/api/v1/growth/leads/[leadId]/route.ts",
+      "src/app/api/v1/growth/leads/export/route.ts",
+      "src/app/api/v1/growth/leads/route.ts",
+      "src/app/api/v1/projects/[projectId]/change-requests/route.ts",
+      "src/app/api/v1/projects/[projectId]/intake-sessions/[sessionId]/route.ts",
+      "src/app/api/v1/projects/[projectId]/prd/current/freeze/route.ts",
+      "src/app/api/v1/projects/[projectId]/prd/current/route.ts",
+      "src/app/api/v1/projects/[projectId]/workspace/milestones/[milestoneId]/evidence/route.ts",
+      "src/app/api/v1/projects/[projectId]/workspace/milestones/[milestoneId]/review/route.ts",
+      "src/app/api/v1/projects/[projectId]/workspace/milestones/route.ts",
+      "src/app/api/v1/projects/intake-sessions/route.ts"
+    ],
+    "public_pages": [
+      "src/app/case-studies/[slug]/page.tsx",
+      "src/app/case-studies/page.tsx",
+      "src/app/clients/page.tsx",
+      "src/app/coders/page.tsx",
+      "src/app/compare/[slug]/page.tsx",
+      "src/app/compare/page.tsx",
+      "src/app/early-access/page.tsx",
+      "src/app/faq/page.tsx",
+      "src/app/globals.css",
+      "src/app/how-it-works/page.tsx",
+      "src/app/industries/[slug]/page.tsx",
+      "src/app/industries/page.tsx",
+      "src/app/layout.tsx",
+      "src/app/partners/page.tsx",
+      "src/app/pricing/page.tsx",
+      "src/app/resources/[slug]/page.tsx",
+      "src/app/resources/page.tsx",
+      "src/app/robots.ts",
+      "src/app/services/[slug]/page.tsx",
+      "src/app/sitemap.ts",
+      "src/app/tools/scope-score/page.tsx"
+    ],
+    "features_and_libraries": [
+      "src/features/admin/AdminDashboardPage.tsx",
+      "src/features/admin/GrowthAnalyticsAdminPage.tsx",
+      "src/features/admin/GrowthLaunchAdminPage.tsx",
+      "src/features/admin/admin-api.ts",
+      "src/features/auth/LoginPage.tsx",
+      "src/features/coder/CoderMatchesPage.tsx",
+      "src/features/growth/GrowthLeadCaptureForm.tsx",
+      "src/features/growth/PublicGrowthPages.tsx",
+      "src/features/growth/ScopeScoreTool.tsx",
+      "src/features/intake/IntakeWizard.tsx",
+      "src/features/marketing/MarketingHomePage.tsx",
+      "src/features/match/MatchResultsPage.tsx",
+      "src/features/workspace/ProjectWorkspacePages.tsx",
+      "src/i18n/dictionaries/en.json",
+      "src/i18n/dictionaries/zh-TW.json",
+      "src/lib/domain/admin.ts",
+      "src/lib/domain/growth-analytics.ts",
+      "src/lib/domain/growth-launch.ts",
+      "src/lib/domain/growth-leads.ts",
+      "src/lib/domain/growth.ts",
+      "src/lib/domain/marketing.ts",
+      "src/lib/domain/notification.ts",
+      "src/lib/server/admin.ts",
+      "src/lib/server/ai-assistant.ts",
+      "src/lib/server/auth.ts",
+      "src/lib/server/growth-analytics.ts",
+      "src/lib/server/growth-launch.ts",
+      "src/lib/server/growth-leads.ts",
+      "src/lib/server/marketing-db.ts",
+      "src/lib/server/marketing-metadata.ts",
+      "src/lib/server/marketing.ts",
+      "src/lib/server/matchmaking.ts",
+      "src/lib/server/notifications.ts",
+      "src/lib/server/project-workspace.ts",
+      "src/lib/server/store.ts",
+      "src/middleware.ts"
+    ]
+  },
+  "untracked_groups": {
+    "docs": [
+      "cross_audit_report.md",
+      "docs/ADMIN_BACKOFFICE_READINESS_AUDIT.md",
+      "docs/ADMIN_BACKOFFICE_WAVE8_JSON_PARSE_400.md",
+      "docs/FULL_PRODUCT_UX_BACKLOG_2026-06-11.md",
+      "docs/HANDOFF_PHASE0.md",
+      "docs/NGINX_ROUTING_GOVERNANCE.md",
+      "docs/PHASE_1_COMMERCIAL_BATTLE_PLAN.md",
+      "docs/PHASE_5_PLANNING.md",
+      "docs/PHASE_MASTER_FINAL_PLAN.md",
+      "docs/VALIDATION_STATUS_2026-06-04.md"
+    ],
+    "workspace_packages": [
+      "packages/contracts/package.json",
+      "packages/contracts/src/enums/index.ts",
+      "packages/contracts/src/errors/index.ts",
+      "packages/contracts/src/index.ts",
+      "packages/contracts/src/schemas/index.ts",
+      "packages/contracts/src/types/index.ts",
+      "packages/contracts/tsconfig.json",
+      "packages/mcp-server/package.json",
+      "packages/mcp-server/src/index.ts",
+      "packages/mcp-server/tsconfig.json",
+      "pnpm-workspace.yaml"
+    ],
+    "brand_and_public_assets": [
+      "public/brand/vibework-logo-full-dark.svg",
+      "public/brand/vibework-logo-full.svg",
+      "public/brand/vibework-logo-icon-dark.svg",
+      "public/brand/vibework-logo-icon.svg",
+      "public/images/avatar-client-pm.png",
+      "public/images/avatar-coder-assistant.png",
+      "public/images/avatar-support.png",
+      "public/images/client-empty-candidates.png",
+      "public/images/client-empty-state.png",
+      "public/images/coder-empty-evidence.png",
+      "public/images/coder-empty-state.png",
+      "public/images/marketing-feature-match.png",
+      "public/images/marketing-feature-milestone.png",
+      "public/images/marketing-feature-prd.png",
+      "public/images/vibework-hero-162baf5a13a2.png"
+    ],
+    "ops_and_verification": [
+      "scripts/ops/check-middleware-route-policy.mjs",
+      "scripts/ops/check-public-header-policy.mjs",
+      "scripts/ops/expected-hero-sha256",
+      "scripts/ops/pre-push-release-guard.sh",
+      "scripts/ops/verify-production-image.sh",
+      "scripts/replaybook.js",
+      "scripts/seed_tasks.js",
+      "scripts/seed_tasks.ts",
+      "scripts/simulate_drift.js",
+      "scripts/verify-prisma.js",
+      "scripts/verify-prisma.ts",
+      "scripts/verify_day6.js",
+      "scripts/verify_e2e.js",
+      "scripts/verify_e2e.ts",
+      "scripts/verify_mcp.js",
+      "scripts/verify_vibework.js",
+      "scripts/verify_vibework.ts"
+    ],
+    "new_api_routes": [
+      "src/app/api/cron/reaper/route.ts",
+      "src/app/api/matching/run/route.ts",
+      "src/app/api/mcp/[tool]/route.ts",
+      "src/app/api/v1/acquire/lead/[leadId]/cancel/route.ts",
+      "src/app/api/v1/acquire/lead/[leadId]/confirm/route.ts",
+      "src/app/api/v1/acquire/lead/[leadId]/status/route.ts",
+      "src/app/api/v1/acquire/lead/route.ts",
+      "src/app/api/v1/admin/growth-launch/action-items/[itemId]/route.ts",
+      "src/app/api/v1/admin/growth-launch/action-items/route.ts",
+      "src/app/api/v1/admin/growth-launch/content-items/[itemId]/route.ts",
+      "src/app/api/v1/admin/growth-launch/content-items/route.ts",
+      "src/app/api/v1/admin/growth-launch/site-signals/[signalId]/route.ts",
+      "src/app/api/v1/admin/growth-leads/[leadId]/route.ts",
+      "src/app/api/v1/admin/growth-leads/route.ts",
+      "src/app/api/v1/admin/projects/[projectId]/workspace/status/route.ts",
+      "src/app/api/v1/growth/signals/route.ts",
+      "src/app/api/v1/scout/events/route.ts",
+      "src/app/api/v1/stripe/webhook/route.ts"
+    ],
+    "new_pages_features_and_libraries": [
+      "src/app/en/[...slug]/page.tsx",
+      "src/app/error.tsx",
+      "src/app/global-error.tsx",
+      "src/app/loading.tsx",
+      "src/app/services/page.tsx",
+      "src/features/admin/GrowthLeadsPage.tsx",
+      "src/features/brand/BrandLogo.tsx",
+      "src/features/growth/EnglishGrowthPages.tsx",
+      "src/features/growth/GrowthPages.tsx",
+      "src/features/growth/GrowthTrackedLink.tsx",
+      "src/features/growth/PublicGrowthFooter.tsx",
+      "src/features/marketing/MarketingHeroSearch.tsx",
+      "src/features/marketing/MarketingLeadForm.tsx",
+      "src/features/marketing/OfficialSiteHeader.tsx",
+      "src/lib/domain/growth-signals.ts",
+      "src/lib/seo/growth.tsx",
+      "src/lib/seo/private.ts",
+      "src/lib/seo/site.ts",
+      "src/lib/server/demand-acquisition.ts",
+      "src/lib/server/growth-metadata.ts",
+      "src/lib/server/growth-signals.ts",
+      "src/lib/server/payment.js",
+      "src/lib/server/prisma.js",
+      "src/lib/server/rate-limit.ts",
+      "src/lib/server/sandbox.ts",
+      "src/lib/server/stripe-checkout.ts"
+    ]
+  },
+  "secret_or_env_paths_seen_but_not_read": [
+    ".env",
+    ".env.example",
+    ".env.production.example"
+  ],
+  "risk_assessment": {
+    "secret_value_collected": false,
+    "env_file_read": false,
+    "runtime_write_performed": false,
+    "product_repo_write_performed": false,
+    "remote_write_performed": false,
+    "risk_level": "high_owner_pick_required",
+    "reason": "VibeWork local tree spans runtime config, Nginx, Docker, Prisma, growth APIs, MCP, Stripe webhook, public pages, marketing assets, docs, and verification tooling. Local HEAD differs from Gitea main, remote dev is missing, and diff check currently fails on docs trailing whitespace."
+  },
+  "owner_decision_required": [
+    "Decide whether local head 48275cc52be79107e887147d3fe10310a887afe9 is the intended latest product baseline candidate.",
+    "Approve or reject each tracked modified group before any branch creation.",
+    "Approve or reject each untracked group before any branch creation.",
+    "Confirm env-like files remain excluded unless a separate metadata-only owner review explicitly approves example-file handling.",
+    "Confirm docs/PHASE_0_IMPLEMENTATION_PLAN.md trailing whitespace cleanup strategy before using this tree as a dev baseline.",
+    "Confirm whether pnpm workspace and packages/contracts plus packages/mcp-server should become part of the product baseline.",
+    "Confirm Stripe webhook, MCP route, Nginx route, Docker, Prisma, and growth lead APIs are in the same release scope or must be split.",
+    "Approve remote dev branch only after the include / exclude list is accepted."
+  ],
+  "recommended_next_step": "Create a path-bucketed owner response for VibeWork before any product repo commit, remote dev branch creation, or MacBook workspace bootstrap."
+}