sileya-ai
/
vr-shopxo-plugin
1
0
Fork 0
Code Issues 3 Pull Requests Packages Projects Releases Wiki Activity
vr-shopxo-plugin/plan.md

63 lines
2.1 KiB
Markdown
Raw Normal View History

council(draft): PerformanceBenchmarker - round1 evaluation report + plan Key findings: - P1: GoodsSpecBase full scan, no pagination (1-5MB response) - P2: No FOR UPDATE SKIP LOCKED (oversell race condition) - P3: Polling without diff, cache stampede risk - P4: SoldSeats API stub (empty array) - Vote: C (parallel), with P0 fixes (row lock + index) non-blocking to frontend Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 09:17:55 +00:00
# Plan — Round 1 Performance Evaluation (2026-05-26)
council(draft): SecurityEngineer - create plan.md with Phase 2 security research directions Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-15 05:53:39 +00:00
council(draft): PerformanceBenchmarker - round1 evaluation report + plan Key findings: - P1: GoodsSpecBase full scan, no pagination (1-5MB response) - P2: No FOR UPDATE SKIP LOCKED (oversell race condition) - P3: Polling without diff, cache stampede risk - P4: SoldSeats API stub (empty array) - Vote: C (parallel), with P0 fixes (row lock + index) non-blocking to frontend Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 09:17:55 +00:00
> Agent: council/PerformanceBenchmarker
council(draft): SecurityEngineer - add Round 1 plan for AdminGoodsSaveHandle security audit Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 01:45:33 +00:00
council(draft): PerformanceBenchmarker - round1 evaluation report + plan Key findings: - P1: GoodsSpecBase full scan, no pagination (1-5MB response) - P2: No FOR UPDATE SKIP LOCKED (oversell race condition) - P3: Polling without diff, cache stampede risk - P4: SoldSeats API stub (empty array) - Vote: C (parallel), with P0 fixes (row lock + index) non-blocking to frontend Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 09:17:55 +00:00
## Phase: Draft → Review → Finalize
council(draft): SecurityEngineer - add Round 1 plan for AdminGoodsSaveHandle security audit Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 01:45:33 +00:00
council(draft): DebugAgent - plan.md: debug "Undefined array key id" error Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 01:46:20 +00:00
---
council(draft): SecurityEngineer - add Round 1 plan for AdminGoodsSaveHandle security audit Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 01:45:33 +00:00
council(draft): PerformanceBenchmarker - round1 evaluation report + plan Key findings: - P1: GoodsSpecBase full scan, no pagination (1-5MB response) - P2: No FOR UPDATE SKIP LOCKED (oversell race condition) - P3: Polling without diff, cache stampede risk - P4: SoldSeats API stub (empty array) - Vote: C (parallel), with P0 fixes (row lock + index) non-blocking to frontend Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 09:17:55 +00:00
## 评估任务清单
council(draft): SecurityEngineer - add Round 1 plan for AdminGoodsSaveHandle security audit Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 01:45:33 +00:00
council(draft): PerformanceBenchmarker - round1 evaluation report + plan Key findings: - P1: GoodsSpecBase full scan, no pagination (1-5MB response) - P2: No FOR UPDATE SKIP LOCKED (oversell race condition) - P3: Polling without diff, cache stampede risk - P4: SoldSeats API stub (empty array) - Vote: C (parallel), with P0 fixes (row lock + index) non-blocking to frontend Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 09:17:55 +00:00
- [x] **Task 1**: [Done: PerformanceBenchmarker] 检查 git log 和文件结构
- [x] **Task 2**: [Done: PerformanceBenchmarker] 探索 SeatMapService + seatmap API + SKIP LOCKED 实现
- [x] **Task 3**: [Done: PerformanceBenchmarker] 输出性能评估报告 → `docs/council-eval-performancebenchmark.md`
- [ ] **Task 4**: [Pending] 等待其他成员完成后，汇总至最终报告（西莉雅负责）
fix(P0): vr_ticket Base - inherit ShopXO Common for full auth chain - Change plugin Base from standalone to extend Common - Call IsLogin() + IsPower() + FormTableInit() explicitly (avoids full ViewInit which is unnecessary for API/admin controllers) - Documents permission node format: plugins_vr_ticket-{controller}-{action} - Fixes R1 P0: bypassed auth chain (only LoginInfo, missing IsPower) - Also fixes all child controllers since they call parent::__construct() Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-15 06:00:20 +00:00
council(plan): FrontendDev - Phase 2 bugfix plan: routing + encoding issues Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-16 00:11:57 +00:00
---
council(draft): SecurityEngineer - add Round 1 plan for AdminGoodsSaveHandle security audit Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 01:45:33 +00:00
council(draft): PerformanceBenchmarker - round1 evaluation report + plan Key findings: - P1: GoodsSpecBase full scan, no pagination (1-5MB response) - P2: No FOR UPDATE SKIP LOCKED (oversell race condition) - P3: Polling without diff, cache stampede risk - P4: SoldSeats API stub (empty array) - Vote: C (parallel), with P0 fixes (row lock + index) non-blocking to frontend Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 09:17:55 +00:00
## 阶段划分
council(draft): SecurityEngineer - add Round 1 plan for AdminGoodsSaveHandle security audit Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 01:45:33 +00:00
council(draft): PerformanceBenchmarker - round1 evaluation report + plan Key findings: - P1: GoodsSpecBase full scan, no pagination (1-5MB response) - P2: No FOR UPDATE SKIP LOCKED (oversell race condition) - P3: Polling without diff, cache stampede risk - P4: SoldSeats API stub (empty array) - Vote: C (parallel), with P0 fixes (row lock + index) non-blocking to frontend Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 09:17:55 +00:00
| 阶段 | 内容 | 状态 |
|------|------|------|
| **Draft** | Task 1-3（独立评估 + 输出报告） | ✅ 完成 |
| **Review** | 等待 BackendArchitect、FrontendDeveloper、SecurityEngineer 完成评估 | ⏳ 等待 |
| **Finalize** | 西莉雅汇总所有成员报告，输出综合决策报告 | ⏳ 等待 |
Merge branch 'main' into council/SecurityEngineer # Conflicts: # plan.md
2026-04-20 01:59:21 +00:00
---
council(draft): SecurityEngineer - add Round 1 plan for AdminGoodsSaveHandle security audit Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 01:45:33 +00:00
council(draft): PerformanceBenchmarker - round1 evaluation report + plan Key findings: - P1: GoodsSpecBase full scan, no pagination (1-5MB response) - P2: No FOR UPDATE SKIP LOCKED (oversell race condition) - P3: Polling without diff, cache stampede risk - P4: SoldSeats API stub (empty array) - Vote: C (parallel), with P0 fixes (row lock + index) non-blocking to frontend Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 09:17:55 +00:00
## 依赖关系
Merge branch 'council/FrontendDev' # Conflicts: # plan.md
2026-04-20 10:49:13 +00:00
council(draft): PerformanceBenchmarker - round1 evaluation report + plan Key findings: - P1: GoodsSpecBase full scan, no pagination (1-5MB response) - P2: No FOR UPDATE SKIP LOCKED (oversell race condition) - P3: Polling without diff, cache stampede risk - P4: SoldSeats API stub (empty array) - Vote: C (parallel), with P0 fixes (row lock + index) non-blocking to frontend Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 09:17:55 +00:00
- 本轮评估无对其他成员的依赖，可独立完成
- 最终综合报告由西莉雅（协调者）负责
council(review): SecurityEngineer - merge Task 13 audit report into main plan Task 13 complete: reviews/SecurityEngineer-AUDIT.md - Confirms BackendArchitect root cause findings (P0: Line 77, P1: Line 71) - Adds PHP 8 compatibility note on null[key] TypeError - Provides complete fix code Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 01:57:43 +00:00
council(draft): DebugAgent - plan.md: debug "Undefined array key id" error Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 01:46:20 +00:00
---
council(draft): PerformanceBenchmarker - round1 evaluation report + plan Key findings: - P1: GoodsSpecBase full scan, no pagination (1-5MB response) - P2: No FOR UPDATE SKIP LOCKED (oversell race condition) - P3: Polling without diff, cache stampede risk - P4: SoldSeats API stub (empty array) - Vote: C (parallel), with P0 fixes (row lock + index) non-blocking to frontend Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 09:17:55 +00:00
## 投票结果
council(draft): DebugAgent - plan.md: debug "Undefined array key id" error Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 01:46:20 +00:00
council(draft): PerformanceBenchmarker - round1 evaluation report + plan Key findings: - P1: GoodsSpecBase full scan, no pagination (1-5MB response) - P2: No FOR UPDATE SKIP LOCKED (oversell race condition) - P3: Polling without diff, cache stampede risk - P4: SoldSeats API stub (empty array) - Vote: C (parallel), with P0 fixes (row lock + index) non-blocking to frontend Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 09:17:55 +00:00
**议题：下一步主攻方向**
- 投票：**C（双线并行）**
- 备选：A（后端优先，补充 seatSpecMap + 性能 P0 同步修复）
council(draft): DebugAgent - plan.md: debug "Undefined array key id" error Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 01:46:20 +00:00
council(draft): PerformanceBenchmarker - round1 evaluation report + plan Key findings: - P1: GoodsSpecBase full scan, no pagination (1-5MB response) - P2: No FOR UPDATE SKIP LOCKED (oversell race condition) - P3: Polling without diff, cache stampede risk - P4: SoldSeats API stub (empty array) - Vote: C (parallel), with P0 fixes (row lock + index) non-blocking to frontend Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 09:17:55 +00:00
详见 `docs/council-eval-performancebenchmark.md`
fix(P0): vr_ticket Base - inherit ShopXO Common for full auth chain - Change plugin Base from standalone to extend Common - Call IsLogin() + IsPower() + FormTableInit() explicitly (avoids full ViewInit which is unnecessary for API/admin controllers) - Documents permission node format: plugins_vr_ticket-{controller}-{action} - Fixes R1 P0: bypassed auth chain (only LoginInfo, missing IsPower) - Also fixes all child controllers since they call parent::__construct() Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-15 06:00:20 +00:00
council(plan): FrontendDev - Phase 2 bugfix plan: routing + encoding issues Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-16 00:11:57 +00:00
---
council(execute): FrontendDev - Round 4: export button fix + mark Phase 2 complete - Fix P1 bug: ticket/list.html export button (GET→POST form) matching IS_AJAX_POST - Mark all plan.md tasks complete (seat templates, tickets, verifiers, verifications views) - BackendArchitect: AuditService.php (S4 design), Verifier.php CONCAT fix, Verification.php column() fix - BackendArchitect: SeatTemplate.php countSeats fix, TicketService.php transaction fix - BackendArchitect: EventListener.php audit_log table added - SecurityEngineer: S1-S5 security audit complete - [CONSENSUS: YES] all three agents vote YES Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-15 06:20:03 +00:00
council(draft): PerformanceBenchmarker - round1 evaluation report + plan Key findings: - P1: GoodsSpecBase full scan, no pagination (1-5MB response) - P2: No FOR UPDATE SKIP LOCKED (oversell race condition) - P3: Polling without diff, cache stampede risk - P4: SoldSeats API stub (empty array) - Vote: C (parallel), with P0 fixes (row lock + index) non-blocking to frontend Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 09:17:55 +00:00
## 关键发现摘要
council(draft): DebugAgent - plan.md: debug "Undefined array key id" error Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 01:46:20 +00:00
council(draft): PerformanceBenchmarker - round1 evaluation report + plan Key findings: - P1: GoodsSpecBase full scan, no pagination (1-5MB response) - P2: No FOR UPDATE SKIP LOCKED (oversell race condition) - P3: Polling without diff, cache stampede risk - P4: SoldSeats API stub (empty array) - Vote: C (parallel), with P0 fixes (row lock + index) non-blocking to frontend Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 09:17:55 +00:00
| # | 严重程度 | 问题 | 量化 |
|---|----------|------|------|
| P1 | 🔴 严重 | `GoodsSpecBase` 全量扫描无分页 | 响应体 1-5 MB，TTFB > 2s |
| P2 | 🔴 严重 | 无 `FOR UPDATE SKIP LOCKED`，超卖竞态 | 超卖率 = f(并发 × 事务时长) |
| P3 | 🟡 高 | 轮询无差异化，缓存击穿 | 500 并发 DB QPS = 2500+ |
| P4 | 🟡 高 | SoldSeats API stub | 支付后状态短暂不一致 |
| P5 | 🟢 中 | 模板缓存 TTL=60s 与轮询周期耦合 | 感知延迟 0-60s |
council(draft): BackendArchitect - add documentation review plan - Add BackendArchitect Round 1 section to plan.md - Claim 4 review tasks: 3 docs + 1 summary - Dimensions: accuracy, completeness, actionability, consistency, misleading risk Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-19 21:25:48 +00:00
council(security): SecurityEngineer - add missing VenueList methods + security audit Security findings: - SQL injection: LOW (query builder + parameter binding) - XSS: LOW (ThinkPHP auto-escape, no |raw detected) - Path traversal: LOW (all view paths hardcoded) - CSRF: MEDIUM (ShopXO framework-level gap, out of scope for plugin) Critical fix: admin/Admin.php was missing VenueList(), VenueSave(), VenueDelete() — sidebar URL "/plugins/vr_ticket/admin/venueList" would return 500 error. Added all three methods with v3.0 seat_map support. P1 garbled name: documented DB fix SQL for shx_plugins + vrt_power tables. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-16 00:53:41 +00:00
---
council(draft): PerformanceBenchmarker - round1 evaluation report + plan Key findings: - P1: GoodsSpecBase full scan, no pagination (1-5MB response) - P2: No FOR UPDATE SKIP LOCKED (oversell race condition) - P3: Polling without diff, cache stampede risk - P4: SoldSeats API stub (empty array) - Vote: C (parallel), with P0 fixes (row lock + index) non-blocking to frontend Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 09:17:55 +00:00
## 优先级建议
council(draft): SecurityEngineer - Round 1 plan for ghost spec security audit
2026-04-20 10:47:31 +00:00
council(draft): PerformanceBenchmarker - round1 evaluation report + plan Key findings: - P1: GoodsSpecBase full scan, no pagination (1-5MB response) - P2: No FOR UPDATE SKIP LOCKED (oversell race condition) - P3: Polling without diff, cache stampede risk - P4: SoldSeats API stub (empty array) - Vote: C (parallel), with P0 fixes (row lock + index) non-blocking to frontend Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 09:17:55 +00:00
1. **P0**：实现库存行锁（FOR UPDATE SKIP LOCKED）— 消除超卖
2. **P0**：添加 `(goods_id, inventory)` 复合索引 — 消除全表扫描
3. **P1**：实现细粒度库存轮询 API（差量更新）— 降低 80% DB 负载
4. **P2**：Tree API 实现（Phase 4）