固化七月迭代审计治理进展以隔离线上热修

Constraint: 切换 main 前必须保存当前七月分支全部项目进展，套餐生效提案仅属于 Iteration/7-11。

Rejected: 将七月套餐修复直接移植到 main | 两个分支的可靠投递架构不同。

Confidence: medium

Scope-risk: broad

Directive: 不得将本提交整体 cherry-pick 到 main；main 套餐热修必须基于其纯 Asynq 代码独立实施。

Tested: git diff --check；openspec validate fix-package-activation-starvation --strict。

Not-tested: 按用户要求未运行自动化测试；go build ./... 因当前审计改造中的 Enterprise 模型字面量和 role.recordFailure 参数类型错误未通过。

internal/routes/admin.go

@@ -144,6 +144,9 @@ func RegisterAdminRoutes(router fiber.Router, handlers *bootstrap.Handlers, midd
 	if handlers.SystemConfig != nil {
 		registerSystemConfigRoutes(authGroup, handlers.SystemConfig, doc, basePath)
 	}
+	if handlers.Audit != nil {
+		registerAuditRoutes(authGroup, handlers.Audit, doc, basePath)
+	}
 	if handlers.WeCom != nil {
 		registerWeComRoutes(authGroup, handlers.WeCom, doc, basePath)
 	}

internal/routes/asset.go

@@ -129,8 +129,8 @@ func registerAssetRoutes(router fiber.Router, handler *admin.AssetHandler, walle
 	})
 
 	Register(assets, doc, groupPath, "GET", "/:identifier/operation-logs", handler.OperationLogs, RouteSpec{
-		Summary:     "资产操作审计日志",
-		Description: "通过资产标识符查询审计日志，支持分页和操作类型/结果状态筛选。",
+		Summary:     "查询平台旧资产操作日志",
+		Description: "仅超级管理员和平台账号可查询切换前旧资产日志；代理和企业必须使用独立资源活动接口。旧记录不接入统一审计时间线。",
 		Tags:        []string{"资产管理"},
 		Input:       new(dto.AssetOperationLogListRequest),
 		Output:      new(dto.AssetOperationLogListResponse),

internal/routes/audit.go

@@ -0,0 +1,73 @@
+package routes
+
+import (
+	"github.com/gofiber/fiber/v2"
+
+	"github.com/break/junhong_cmp_fiber/internal/handler/admin"
+	"github.com/break/junhong_cmp_fiber/internal/model/dto"
+	auditquery "github.com/break/junhong_cmp_fiber/internal/query/audit"
+	integrationquery "github.com/break/junhong_cmp_fiber/internal/query/integration"
+	"github.com/break/junhong_cmp_fiber/pkg/openapi"
+)
+
+// registerAuditRoutes 注册平台基础审计调查只读路由。
+func registerAuditRoutes(router fiber.Router, handler *admin.AuditHandler, doc *openapi.Generator, basePath string) {
+	agent := router.Group("/agent/resource-activities")
+	Register(agent, doc, basePath+"/agent/resource-activities", "GET", "/:resource_type/:identifier", handler.AgentResourceActivities, RouteSpec{
+		Summary:     "查询代理资源活动",
+		Description: "resource_type/identifier 来自代理当前业务页面稳定字段；店铺范围只读取认证上下文。仅返回写入时生成的安全业务结论和白名单详情，越权与不存在同错。",
+		Tags:        []string{"资源活动"}, Input: new(dto.SubjectResourceActivityRequest), Output: new(auditquery.SubjectActivityPage), Auth: true,
+	})
+	enterprise := router.Group("/enterprise/resource-activities")
+	Register(enterprise, doc, basePath+"/enterprise/resource-activities", "GET", "/:resource_type/:identifier", handler.EnterpriseResourceActivities, RouteSpec{
+		Summary:     "查询企业资源活动",
+		Description: "仅支持企业当前有效授权的卡和设备；企业身份只读取认证上下文，授权撤销后立即不可读取。响应不包含平台操作者、风险、内部前后值或外部交互内容。",
+		Tags:        []string{"资源活动"}, Input: new(dto.SubjectResourceActivityRequest), Output: new(auditquery.SubjectActivityPage), Auth: true,
+	})
+
+	audit := router.Group("/audit")
+	groupPath := basePath + "/audit"
+
+	Register(audit, doc, groupPath, "GET", "/events", handler.ListEvents, RouteSpec{
+		Summary:     "查询全局审计事件",
+		Description: "筛选值来自调查人员输入或其他调查节点的稳定引用；身份范围只读取认证上下文。固定按发生时间和事件ID倒序，不提供导出、修改或删除。",
+		Tags:        []string{"审计调查"}, Input: new(dto.AuditEventListRequest), Output: new(auditquery.EventPage), Auth: true,
+	})
+	Register(audit, doc, groupPath, "GET", "/events/:event_id", handler.GetEvent, RouteSpec{
+		Summary:     "查询审计事件详情",
+		Description: "event_id 来自事件、资源、操作者或链路节点的 investigation_refs；返回全部资源快照和各资源 before/after。",
+		Tags:        []string{"审计调查"}, Input: new(dto.AuditEventIDParams), Output: new(auditquery.EventView), Auth: true,
+	})
+	Register(audit, doc, groupPath, "GET", "/actors/:kind/:id/events", handler.ListActorEvents, RouteSpec{
+		Summary:     "查询操作者行为时间线",
+		Description: "kind/id 来自事件 actor_ref 或平台账号选择器；历史名称直接使用事件快照，不查询当前账号名称覆盖历史。",
+		Tags:        []string{"审计调查"}, Input: new(dto.AuditActorEventsRequest), Output: new(auditquery.EventPage), Auth: true,
+	})
+	// 资源搜索静态路径必须先于资源动态时间线路径，避免被动态参数吞掉。
+	Register(audit, doc, groupPath, "GET", "/resources/search", handler.SearchResources, RouteSpec{
+		Summary:     "精确搜索注册资源",
+		Description: "卡支持 ICCID/VirtualNo，设备支持 VirtualNo/IMEI/SN，店铺、订单、退款使用各自稳定编号。当前资源不存在时仅按 Registry 白名单快照字段精确查找历史，不做任意 JSON 模糊搜索。",
+		Tags:        []string{"审计调查"}, Input: new(dto.AuditResourceSearchRequest), Output: new(auditquery.ResourceSearchPage), Auth: true,
+	})
+	Register(audit, doc, groupPath, "GET", "/resources/:resource_type/:resource_id/timeline", handler.ResourceTimeline, RouteSpec{
+		Summary:     "查询通用资源时间线",
+		Description: "resource_type/resource_id 必须来自业务页面稳定字段、资源搜索结果或 investigation_refs。事件在资源作为 primary、affected 或 reference 时均会返回。",
+		Tags:        []string{"审计调查"}, Input: new(dto.AuditResourceTimelineRequest), Output: new(auditquery.EventPage), Auth: true,
+	})
+	// Integration 总览静态路径必须先于动态详情路径，避免 overview 被当作 integration_id。
+	Register(audit, doc, groupPath, "GET", "/integrations/overview", handler.IntegrationOverview, RouteSpec{
+		Summary:     "查询外部集成交互总览",
+		Description: "筛选和时间范围来自调查输入或关联视角跳转，身份只来自认证上下文。总览区分成功、处理中、结果不确定、失败和未发送终态。",
+		Tags:        []string{"审计调查"}, Input: new(dto.IntegrationOverviewRequest), Output: new(integrationquery.Overview), Auth: true,
+	})
+	Register(audit, doc, groupPath, "GET", "/integrations", handler.ListIntegrations, RouteSpec{
+		Summary:     "查询外部集成交互列表",
+		Description: "组合筛选来自调查输入或关联视角稳定引用，固定按创建时间和记录ID倒序分页，不提供任意摘要搜索。",
+		Tags:        []string{"审计调查"}, Input: new(dto.IntegrationListRequest), Output: new(integrationquery.ListPage), Auth: true,
+	})
+	Register(audit, doc, groupPath, "GET", "/integrations/:integration_id", handler.GetIntegration, RouteSpec{
+		Summary:     "查询外部集成交互详情",
+		Description: "integration_id 来自列表、通知目标 target_key 或调查节点稳定引用；只展示结构化详情和显式尝试序列，不提供重试、补偿、确认、绑定、恢复、修改、删除或导出。",
+		Tags:        []string{"审计调查"}, Input: new(dto.IntegrationIDParams), Output: new(integrationquery.Detail), Auth: true,
+	})
+}