{
  "ticket": "U31 #68",
  "date": "2026-10-26",
  "cycles": [
    {
      "observation": "匿名真实HTTP先200，保护链实现后401",
      "logs": {
        "http-red": {
          "privateLog": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u31-preparation/http-red.log",
          "sha256": "9c98f6ef0d91b80b067900cd628c8d8deef1054fb876cb247a25a70f482e9ab4"
        },
        "http-green": {
          "privateLog": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u31-preparation/http-green.log",
          "sha256": "f9387510076a88e45b694665118ccfeb78b1d43a78022a5b95ec36c772bc8951"
        }
      }
    },
    {
      "observation": "有效密码先仅返回unprotected，补Context跨scheduler读取后返回可信alice且ThreadLocal空",
      "logs": {
        "context-red": {
          "privateLog": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u31-preparation/context-red.log",
          "sha256": "fbc7f39cbcd6b2af9767b6bca99b90accc93e0e92dcb350618dfb39fb7fc82c7"
        },
        "context-green": {
          "privateLog": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u31-preparation/context-green.log",
          "sha256": "9785f7b4f6a5608b56d2ec7c7cbe1496d70724413cd254bc45588acf370f409d"
        }
      }
    },
    {
      "observation": "缺管理端点先404，补请求规则和独立方法代理后缺角色403/admin200",
      "logs": {
        "authorization-red": {
          "privateLog": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u31-preparation/authorization-red.log",
          "sha256": "37619a53e10265b94a02b9213d8cea2ad267ba342a914eb159e925412563b954"
        },
        "authorization-green": {
          "privateLog": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u31-preparation/authorization-green.log",
          "sha256": "ec1adcd5d929ae4983e9e764bb869a62c59732a751a3c9520aeb8afc6fa672db"
        }
      }
    },
    {
      "observation": "对象端点先404，补基于可信主体的对象方法授权后本人200/他人403/合法恢复",
      "logs": {
        "owner-red": {
          "privateLog": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u31-preparation/owner-red.log",
          "sha256": "f57abdd5b7dbfa1dd69d510acc39f4c957a8abf5052f5826c03e4794183f323e"
        },
        "owner-green": {
          "privateLog": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u31-preparation/owner-green.log",
          "sha256": "6072badedf189f05423242a036b8f33fc50a367271db9a5773f424be2af51f66"
        }
      }
    },
    {
      "observation": "默认SETUP拒绝真实连接；改为允许SETUP、业务逐请求认证并安装具体路由后合法read成功",
      "logs": {
        "rsocket-red": {
          "privateLog": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u31-preparation/rsocket-red.log",
          "sha256": "746224a4250ef1765d4f8abd44c845c062f2f6957744ed613fef37e555ee5ee4"
        },
        "rsocket-green": {
          "privateLog": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u31-preparation/rsocket-green.log",
          "sha256": "6aef32f8e3bc52c9dd84f486cf6949f6d20093aca2b2173f67e145b75f23c2c3"
        }
      }
    },
    {
      "observation": "真实签名Bearer先被Basic链401，接入Reactive decoder/独立链后200",
      "logs": {
        "jwt-red": {
          "privateLog": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u31-preparation/jwt-red.log",
          "sha256": "324afde227d4f88791f08a993d79507d6bbcad9aeed7c49f35c2824570446e27"
        },
        "jwt-green": {
          "privateLog": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u31-preparation/jwt-green.log",
          "sha256": "b9654394371a997c5ab4309efc2db5f68cc1fa6d76439807ef758006172f4ff6"
        }
      }
    },
    {
      "observation": "CSRF入口先被API链401，接入WebSession链与延迟token端点后200",
      "logs": {
        "session-red": {
          "privateLog": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u31-preparation/session-red.log",
          "sha256": "e066a08754b08d659a7b8d111d47a6940261cc4fc2594f5a665afd298fc8ef0e"
        },
        "session-green": {
          "privateLog": "/Users/gaochao/.cache/software-engineering-study/java-depth-impl/u31-preparation/session-green.log",
          "sha256": "c67632aa78b113a46863ed8359c7c916faa4108366d4bfaaf9da87bf00067a1f"
        }
      }
    }
  ],
  "notes": [
    "首轮工程启动失败因RSocket默认认证无manager，补真实用户/manager后才形成HTTP行为RED；RSocketMessageHandler import编译修正不计协议负例。",
    "不是每个分支都各自完成一轮RED/GREEN：先逐片公开接口贯通，再对同一接口补密码/claim/CSRF/角色负例、并发隔离及恢复；不把编译/启动失败冒称安全攻击验证。",
    "最终公开入口一次完整成功的9测试/四类证据与上述开发历史分开。JWT JWKS是网络fixture，不是完整AS或企业IdP。"
  ]
}