fix(GOV-009): 完成仅源码部署最终复审

docs/features/GOV-009-application-scaffold-baseline/source-only-deployment-implementation-plan.md

@@ -54,7 +54,7 @@
 - Consumes: repository paths and the existing `deploy/systemd/`, `deploy/nginx/`, `web/dist/`, and `server/dist/` conventions.
 - Produces: root scripts `test:deployment` and `verify:source`; failing tests that define the source-only repository contract before implementation.
 
-- [ ] **Step 1: Add failing fixture tests for the source verifier**
+- [x] **Step 1: Add failing fixture tests for the source verifier**
 
 Create tests that import the not-yet-existing module and define these exact behaviors:
 
@@ -96,7 +96,7 @@ test('Nginx 未代理 API 或未指向 Web dist 时会阻断源码发布', async
 
 The local `createSourceReleaseFixture` helper must create only the minimum paths needed by the verifier: four build outputs, three unit files with distinct `EnvironmentFile`, and one Nginx file. It must accept `omit`, `apiUser`, and `invalidNginx` options so each negative test changes one condition.
 
-- [ ] **Step 2: Replace Docker assertions in the environment baseline with source-only assertions**
+- [x] **Step 2: Replace Docker assertions in the environment baseline with source-only assertions**
 
 Keep env-template and RocketMQ tests unchanged. Replace Compose/Docker tests with explicit active-path assertions:
 
@@ -123,7 +123,7 @@ test('活动仓库不再包含 Docker 运行构建或部署入口', async () =>
 
 Add focused checks that current docs describe external local Redis, Ubuntu 22.04/24.04, Node 22.x, pnpm 10.25.0, immutable releases, health checks, and rollback. Do not scan historical feature archives for the word Docker because those files are intentional evidence.
 
-- [ ] **Step 3: Point root deployment scripts at the not-yet-existing source verifier**
+- [x] **Step 3: Point root deployment scripts at the not-yet-existing source verifier**
 
 Change root scripts to the following contract:
 
@@ -135,7 +135,7 @@ Change root scripts to the following contract:
 
 Remove `check:images` and `verify:docker`.
 
-- [ ] **Step 4: Run RED tests and record expected failures**
+- [x] **Step 4: Run RED tests and record expected failures**
 
 Run:
 
@@ -167,11 +167,11 @@ Expected: the deployment test fails because `verify-source-deployment.mjs` does
 - Consumes: `verifySourceDeployment(repositoryRoot?: string | URL): Promise<void>` inputs and the existing build/deployment paths.
 - Produces: an importable verifier plus the CLI command `pnpm verify:source`, which exits non-zero on incomplete or unsafe source releases.
 
-- [ ] **Step 1: Run GitNexus impact before modifying or deleting deployment symbols**
+- [x] **Step 1: Run GitNexus impact before modifying or deleting deployment symbols**
 
 Run upstream impact for `assertImmutableImageReferences`, `docker`, and `verifyLongRunningProcess`, including tests. Report direct callers, affected processes, and risk to the user. If risk is HIGH or CRITICAL, stop before editing and ask for confirmation as required by `AGENTS.md`.
 
-- [ ] **Step 2: Implement the minimal source verifier**
+- [x] **Step 2: Implement the minimal source verifier**
 
 Implement these exports in one readable file:
 
@@ -206,11 +206,11 @@ The implementation must:
 - produce errors that identify the missing or invalid file without printing env values;
 - print `源码发布产物与 systemd/Nginx 配置验证通过` only in direct CLI mode.
 
-- [ ] **Step 3: Delete the obsolete Docker artifacts**
+- [x] **Step 3: Delete the obsolete Docker artifacts**
 
 Delete only the paths listed in this task. Do not delete env templates, systemd units, the production Nginx template, or historical GOV-006/GOV-009 evidence.
 
-- [ ] **Step 4: Run GREEN deployment tests after creating build outputs**
+- [x] **Step 4: Run GREEN deployment tests after creating build outputs**
 
 Run:
 
@@ -223,7 +223,7 @@ pnpm verify:source
 
 Expected: all commands pass; `verify:source` confirms all four build outputs and the deployment templates.
 
-- [ ] **Step 5: Detect scope, commit, and push the executable deployment change**
+- [x] **Step 5: Detect scope, commit, and push the executable deployment change**
 
 Run GitNexus `detect_changes(scope: "all")`. Review that only deployment validation and environment-policy flows are affected, then run:
 
@@ -246,11 +246,11 @@ git push origin "$(git branch --show-current)"
 - Consumes: TCP endpoint `127.0.0.1:6379` and the existing public production API fixture.
 - Produces: `checkLocalRedis({ host, port, timeoutMs }): Promise<void>` and `runTestApi(): Promise<void>`; direct execution launches only the API process after Redis succeeds.
 
-- [ ] **Step 1: Run GitNexus upstream impact for launcher symbols**
+- [x] **Step 1: Run GitNexus upstream impact for launcher symbols**
 
 Run impact for `forwardSignal` and the `run-test-api.mjs` file, including tests. Report the Playwright web-server dependency and any API health flows before editing. Stop for confirmation only if the graph reports HIGH or CRITICAL risk.
 
-- [ ] **Step 2: Write failing launcher tests**
+- [x] **Step 2: Write failing launcher tests**
 
 Refactor-safe tests must verify behavior rather than depend on Docker availability:
 
@@ -275,7 +275,7 @@ test('API 测试启动器不包含 Docker 子进程路径', async () => {
 
 Use an OS-assigned loopback port for deterministic tests. The user-facing failure message may state the fixed required Redis endpoint even when the injected test port differs.
 
-- [ ] **Step 3: Run the launcher RED test**
+- [x] **Step 3: Run the launcher RED test**
 
 Run:
 
@@ -285,7 +285,7 @@ node --test server/tools/run-test-api.test.mjs
 
 Expected: FAIL because `checkLocalRedis` and guarded direct-execution behavior do not yet exist.
 
-- [ ] **Step 4: Refactor the launcher without infrastructure fallback**
+- [x] **Step 4: Refactor the launcher without infrastructure fallback**
 
 Remove `execFileSync`, container naming, dynamic Redis port publication, ownership flags, and cleanup. Export and use:
 
@@ -305,7 +305,7 @@ export async function runTestApi() {
 
 Guard execution with the existing `process.argv[1]` and `fileURLToPath(import.meta.url)` pattern so tests can import the functions without starting API. Keep `REDIS_PORT: '6379'`; never derive or override it from a container.
 
-- [ ] **Step 5: Include the new test in the Server test command**
+- [x] **Step 5: Include the new test in the Server test command**
 
 Change the Server test script to run both Vitest and the Node launcher test:
 
@@ -313,7 +313,7 @@ Change the Server test script to run both Vitest and the Node launcher test:
 "test": "vitest run && node --test tools/run-test-api.test.mjs"
 ```
 
-- [ ] **Step 6: Run GREEN and real local Redis checks**
+- [x] **Step 6: Run GREEN and real local Redis checks**
 
 Run:
 
@@ -326,7 +326,7 @@ pnpm verify:e2e
 
 Expected: unit tests pass, Redis prints `PONG`, and both Playwright viewports pass using the already-running local Redis. If Redis is unavailable, stop with the new explicit error; do not start or install it.
 
-- [ ] **Step 7: Detect scope, commit, and push the launcher change**
+- [x] **Step 7: Detect scope, commit, and push the launcher change**
 
 Run GitNexus `detect_changes(scope: "all")`, confirm the impact is limited to Playwright/API startup, then run:
 
@@ -364,7 +364,7 @@ git push origin "$(git branch --show-current)"
 - Consumes: the confirmed `source-only-deployment-design.md` decision and actual Task 2/3 behavior.
 - Produces: one unambiguous current deployment policy with intact historical evidence and a traceable GOV-009 record.
 
-- [ ] **Step 1: Update current public docs and architecture**
+- [x] **Step 1: Update current public docs and architecture**
 
 Make these statements exact and consistent:
 
@@ -377,7 +377,7 @@ Make these statements exact and consistent:
 
 Remove the active Docker deployment link from `README.md` and `docs/index.md`.
 
-- [ ] **Step 2: Update mandatory engineering and workflow rules**
+- [x] **Step 2: Update mandatory engineering and workflow rules**
 
 In code standards, replace the dual-deployment variable rule with:
 
@@ -387,7 +387,7 @@ In code standards, replace the dual-deployment variable rule with:
 
 Replace `开发、测试、Docker 和生产环境` with `开发、测试和生产环境`. In workflow rules, require env/systemd/Nginx synchronization and immutable release-directory rollback; remove Compose/image language. State that `verify:release` is the source-release gate and that unavailable external infrastructure is a failed prerequisite, never a container fallback.
 
-- [ ] **Step 3: Update GOV-009 current records without falsifying history**
+- [x] **Step 3: Update GOV-009 current records without falsifying history**
 
 Revise PRD scope, R7, design configuration/deployment sections, automated test plan, current release notes, rollback, and architecture review to match actual source-only implementation. Add `source_only_deployment_implementation_plan` to `manifest.yaml`. Keep `status: reviewing`, `release: unreleased`, and the architecture confirmation completion gate.
 
@@ -395,11 +395,11 @@ In `qa/test-results.md`, preserve dated Docker validation as historical fact and
 
 If GOV-006's manifest presents its Docker approach as current, add only a dated `superseded_by` pointer to the GOV-009 source-only decision; do not rewrite its original PRD/design/test evidence.
 
-- [ ] **Step 4: Add the unreleased changelog decision**
+- [x] **Step 4: Add the unreleased changelog decision**
 
 At the top current section, record that the project removed Docker/Compose/image validation and now supports only Ubuntu source deployment with external infrastructure. Leave older entries about when Docker was added unchanged below it.
 
-- [ ] **Step 5: Run active-document policy tests and scan for contradictions**
+- [x] **Step 5: Run active-document policy tests and scan for contradictions**
 
 Run:
 
@@ -410,7 +410,7 @@ rg -n '双部署|同时支持 Docker|Compose 只|Docker Compose 生产|verify:do
 
 Expected: tests pass. Search results may remain only in explicitly dated historical results or supersession explanations; no current instruction may expose a Docker command or claim Docker support.
 
-- [ ] **Step 6: Detect scope, commit, and push documentation alignment**
+- [x] **Step 6: Detect scope, commit, and push documentation alignment**
 
 Run GitNexus `detect_changes(scope: "all")`, then:
 
@@ -437,7 +437,7 @@ git push origin "$(git branch --show-current)"
 - Consumes: the completed implementation, root verification scripts, GitNexus graph, and Review standards.
 - Produces: final evidence for the deployment-policy adjustment while GOV-009 remains `reviewing/unreleased` pending user architecture confirmation.
 
-- [ ] **Step 1: Run focused tests and full source release verification**
+- [x] **Step 1: Run focused tests and full source release verification**
 
 Run without Docker:
 
@@ -450,11 +450,11 @@ pnpm verify:release
 
 Expected: all pass. `verify:release` must execute the full root verification, desktop/mobile Playwright checks, builds, and `verify:source`; it must not invoke Docker.
 
-- [ ] **Step 2: Perform visual verification at both configured viewports**
+- [x] **Step 2: Perform visual verification at both configured viewports**
 
 Use Playwright/browser screenshots at 1440x900 and 390x844. Confirm the page is nonblank, API health data renders, no content overlaps, and browser console/network contains no blocking error. Save screenshots under the existing ignored/output convention and record results, not binary artifacts, in `qa/test-results.md`.
 
-- [ ] **Step 3: Refresh GitNexus and record before/after evidence**
+- [x] **Step 3: Refresh GitNexus and record before/after evidence**
 
 Run:
 
@@ -466,7 +466,7 @@ npm run governance:finish -- GOV-009 application-scaffold-baseline
 
 Then use GitNexus `detect_changes(scope: "compare", base_ref: "cfcd7f13d9a6a35173d01bd8ca1458911190e70f")`. Record node/edge/flow counts, removed Docker verifier symbols, added source verifier symbols, and affected processes in the three GitNexus records. Do not commit `.gitnexus/`.
 
-- [ ] **Step 4: Conduct code Review**
+- [x] **Step 4: Conduct code Review**
 
 Review for functional regressions, release-gate bypasses, unsafe process spawning, Redis failure semantics, missing build artifacts, and test gaps. Resolve every blocking finding, rerun affected checks, and finish `review/code-review.md` with the exact line:
 
@@ -474,7 +474,7 @@ Review for functional regressions, release-gate bypasses, unsafe process spawnin
 最终结论：passed
 ```
 
-- [ ] **Step 5: Conduct development-standards Review**
+- [x] **Step 5: Conduct development-standards Review**
 
 Review source-only policy consistency, Chinese comments for non-obvious logic, file responsibility, no secrets, MySQL 5.7 constraints, no production access, historical traceability, Chinese commits, Gitea push state, and the absence of a `v0.0.8` tag. Finish `review/standards-review.md` with the exact line:
 
@@ -482,7 +482,7 @@ Review source-only policy consistency, Chinese comments for non-obvious logic, f
 最终结论：passed
 ```
 
-- [ ] **Step 6: Re-run final verification after Review edits**
+- [x] **Step 6: Re-run final verification after Review edits**
 
 Run:
 
@@ -494,7 +494,7 @@ git status --short
 
 Expected: formatting and release verification pass. Only intended Review/evidence files remain uncommitted.
 
-- [ ] **Step 7: Detect final scope, commit, and push evidence**
+- [x] **Step 7: Detect final scope, commit, and push evidence**
 
 Run GitNexus `detect_changes(scope: "all")`, verify no unexpected application flow changed, then:
 
@@ -504,7 +504,7 @@ git commit -m "docs(GOV-009): 封存仅源码部署复核证据"
 git push origin "$(git branch --show-current)"
 ```
 
-- [ ] **Step 8: Confirm remote consistency without releasing**
+- [x] **Step 8: Confirm remote consistency without releasing**
 
 Run: