全局审计完成

internal/governance/auditcoverage/scanner.go

@@ -134,12 +134,14 @@ func scanFile(root, path string) ([]Entry, error) {
 			if strings.HasPrefix(relative, "cmd/worker/") {
 				if taskType, schedule, ok := scheduledTask(call); ok {
 					entries = append(entries, classifySchedule(relative, position.Line, taskType, schedule))
+				} else if strings.Contains(expression(selector.X), "outboxConsumers") && len(call.Args) >= 2 {
+					entries = append(entries, classifyOutboxConsumer(relative, position.Line, expression(call.Args[0]), expression(call.Args[1])))
 				}
 			}
 		case "LogOperation":
 			entries = append(entries, classifyLegacyWriter(relative, position.Line, expression(call.Fun)))
-		case "Start", "Complete", "RecordInbound":
-			if isIntegrationLogCall(relative, expression(selector.X)) {
+		case "Start", "Complete", "RecordInbound", "ClaimExpiredInboundPending":
+			if selector.Sel.Name == "ClaimExpiredInboundPending" || isIntegrationLogCall(relative, expression(selector.X)) {
 				entries = append(entries, classifyIntegrationLog(relative, position.Line, expression(call.Fun)))
 			}
 		}
@@ -210,7 +212,7 @@ func classifyWorker(file string, line int, taskType, handler string) Entry {
 		FailureStrategy:   "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
 		SensitivePolicy:   "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
 		BeforeAfterPolicy: "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-		TestSeam:          "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口",
+		TestSeam:          "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口",
 	}
 	return entry
 }
@@ -230,6 +232,22 @@ func classifySchedule(file string, line int, taskType, schedule string) Entry {
 	}
 }
 
+func classifyOutboxConsumer(file string, line int, eventType, consumer string) Entry {
+	return Entry{
+		Key: fmt.Sprintf("outbox_consumer:%s:%d:%s", file, line, eventType), Kind: "outbox_consumer",
+		CodeEntry: fmt.Sprintf("%s:%d %s", file, line, consumer), Owner: workerOwner(eventType),
+		Summary:    "注册 Outbox 消费者 " + eventType,
+		AuditEvent: "N/A", DomainLedger: "N/A", IntegrationLog: "N/A", Outbox: "必须：消费已提交的可靠事件",
+		ActorSource: "system_task/outbox_consumer", Transaction: "N/A",
+		Visibility:        "内部系统装配入口，不直接对用户展示",
+		FailureStrategy:   "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
+		SensitivePolicy:   "注册入口不读取或记录事件载荷与安全凭据",
+		BeforeAfterPolicy: "N/A：注册入口不修改业务事实",
+		TestSeam:          "静态扫描注册点、消费者实现和对应业务动作",
+		NAReason:          "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责",
+	}
+}
+
 func classifyBusinessMethod(file string, line int, method string) Entry {
 	parts := strings.Split(file, "/")
 	layer := parts[1]
@@ -249,7 +267,7 @@ func classifyBusinessMethod(file string, line int, method string) Entry {
 		Visibility:        "由完整用例决定平台完整视图、主体安全投影或 internal_only",
 		SensitivePolicy:   "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
 		BeforeAfterPolicy: "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-		TestSeam:          "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口",
+		TestSeam:          "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口",
 	}
 	if layer == "domain" {
 		entry.AuditEvent = "N/A"