# Bitan Pharmacy Dev Baseline Owner Decision

- generated_at: `2026-06-24T14:05:45+08:00`
- product_id: `bitan-pharmacy`
- local_path: `/Users/ogt/bitan-pharmacy`
- status: `high risk, internal repo owner export required`

## Readback

| Gate | Result |
|------|--------|
| local branch | `main` |
| local head | `e122c8cbd9522999fd9844c2b63790fadcc89c20` |
| Gitea main | internal inventory required |
| Gitea dev | internal inventory required |
| tracked modified | `64` |
| tracked deleted | `0` |
| untracked | `252` |
| diff shortstat | `64 files changed, 4069 insertions(+), 665 deletions(-)` |
| diff check | failed: trailing whitespace in two files |

## Untracked 分桶

| Bucket | Count | 判定 |
|--------|------:|------|
| `src/app` | `75` | source candidates |
| `src/components` | `19` | source candidates |
| `src/lib` | `17` | source candidates |
| `scripts` | `104` | source candidates, but production / cron / verification split required |
| `supabase/migrations` | `27` | migration candidates, requires DB owner review |
| `docs` | `5` | source docs candidates |
| `public` | `2` | asset candidates |
| `logs` | `1` | evidence/log, default quarantine |
| root | `2` | `.npmrc` requires quarantine / sanitization review |

## Tracked Modified Groups

- Docs：12-agent audit progress、tech stack、user flow、data recovery guide、deploy checklist。
- i18n / runtime config：messages、middleware、Next config、package lock、manifest。
- Ops scripts：production readiness、full fix、health check、production stack recovery、recovery drill、production verification。
- Public / admin / API routes：login、products、prescription、admin, announcements, articles, pages, products, services, settings, translate, users, cron cleanup, customer support chat, product inquiry, settings, tracking。
- Components / libraries / types：admin settings/users、customer support widget、product inquiry button、layout, auth, notifications, rate limiter, Supabase server, auth/product types。
- Supabase：`002_storage_buckets.sql`。

## Untracked Source Candidates

- AI / ops docs：MCP RAG integration、AI support governance / health check、AI operations automation、external MCP onboarding。
- Scripts：blue-green deploy, safe deploy, release sync, install / run / verify cron and production health scripts, external MCP provider tooling, public content cleanliness checks。
- Admin / public pages：AI information suggestions、knowledge sources、operations reports/tasks/workbench、support conversations, support FAQ, blue-green events, privacy, product inquiries, production health, public FAQ / information / news / policies / privacy。
- API / cron routes：admin action approval, AI information suggestions, knowledge sources, operations, support, blue-green, privacy, product inquiries, production health, AI operations cron, customer support Telegram webhook, health, internal MCP, privacy request。
- Libraries / migrations：AI provider / MCP / RAG / operations, API response, admin action approval, public content safety, privacy compliance / governance / rights request, Supabase migrations。

Quarantined by default:

- `.npmrc`
- `logs/public-content-cleanliness.latest.json`

Env-like paths observed but not read:

- `.env.example`
- `.env.local`

## 判定

Bitan 不能直接建立遠端 `dev`。這不是單純缺 branch，而是 internal repo inventory、public content cleanliness evidence、production deploy scripts、blue-green, Supabase migrations, AI support, privacy, MCP, cron 與 admin workflow 全部混在同一個 dirty tree。

`logs/public-content-cleanliness.latest.json` 可作為「告警 / evidence metadata」候選，但預設不可直接進 source baseline；`.npmrc` 也必須先 quarantine，確認沒有 credential material 或改以 sanitized replacement 進入。

## Owner Decision

需要 owner 回覆：

1. 提供 authenticated Gitea inventory 或 owner export，確認 Bitan 正確遠端 repo 與 refs。
2. 64 個 tracked modified files 哪些要納入。
3. 252 個 untracked candidates 哪些要納入。
4. `.npmrc` 是否含 credential material；未確認前不可納入。
5. `logs/public-content-cleanliness.latest.json` 是否只保留 evidence ref，或作為 sanitized evidence artifact。
6. `.env.example` / `.env.local` 一律不讀內容、不收 secret value。
7. public content cleanliness alert 要先 closeout 或明確標為 blocking production evidence。
8. 是否先修 `scripts/verify-production-stack.sh` 與 `src/app/api/customer-support/chat/route.ts` trailing whitespace。
9. owner 接受 include / exclude、evidence policy 與 internal inventory 後，才可建立 review branch 或遠端 `dev`。

## 安全邊界

- 未讀 `.env`。
- 未讀 `.npmrc` 內容。
- 未讀 secret value。
- 未修改 Bitan repo。
- 未建立 branch、commit 或 push。
- 未同步 logs、runtime volumes、raw `.git` 或 raw Codex conversations。
- 未執行 public content check、deploy、cron、DB migration、production smoke 或 runtime write。
