Align authentication regression checks with public guidance routes

apps/waterfall-wiki/tests/auth.test.ts

@@ -34,14 +34,14 @@ test('proxy protects APIs, data routes, static content and Studio; fails closed'
  const temp=mkdtempSync(join(tmpdir(),'prompt-auth-')); const old=process.env.AUTH_CONFIG_FILE;
  try{
   const config=newAuthConfig(); process.env.AUTH_CONFIG_FILE=join(temp,'config.json'); writeFileSync(process.env.AUTH_CONFIG_FILE,JSON.stringify(config));
-  for(const path of ['/','/library/import','/skills/example.png','/_next/data/build/index.json','/studio']) assert.equal(proxy(new NextRequest('http://wiki.test'+path)).status,307,path);
+  for(const path of ['/library/import','/skills/example.png','/_next/data/build/index.json','/studio']) assert.equal(proxy(new NextRequest('http://wiki.test'+path)).status,307,path);
   for(const path of ['/api/upload','/studio/api/export','/api/feed']) assert.equal(proxy(new NextRequest('http://wiki.test'+path)).status,401,path);
-  for(const path of ['/login','/brand-mark.svg','/_next/static/chunk.js','/api/health','/api/ready']) assert.equal(proxy(new NextRequest('http://wiki.test'+path)).status,200,path);
+  for(const path of ['/','/write','/documents','/api/documents','/api/documents/preview','/login','/brand-mark.svg','/_next/static/chunk.js','/api/health','/api/ready']) assert.equal(proxy(new NextRequest('http://wiki.test'+path)).status,200,path);
   const headers={cookie:'prompt_session='+signSession(config),host:'wiki.test'};
   assert.equal(proxy(new NextRequest('http://wiki.test/api/feed',{headers})).status,200);
   assert.equal(proxy(new NextRequest('http://wiki.test/api/posts',{method:'POST',headers:{...headers,origin:'http://evil.test'}})).status,403);
   assert.equal(proxy(new NextRequest('http://wiki.test/api/posts',{method:'POST',headers:{...headers,origin:'http://wiki.test'}})).status,200);
-  writeFileSync(process.env.AUTH_CONFIG_FILE,'{}'); assert.throws(()=>authConfig()); assert.equal(proxy(new NextRequest('http://wiki.test/')).status,503);
+  writeFileSync(process.env.AUTH_CONFIG_FILE,'{}'); assert.throws(()=>authConfig()); assert.equal(proxy(new NextRequest('http://wiki.test/api/feed')).status,503);
  }finally{if(old===undefined)delete process.env.AUTH_CONFIG_FILE;else process.env.AUTH_CONFIG_FILE=old;rmSync(temp,{recursive:true,force:true});}
 });
 

docs/linked-guidance/publishing.md

@@ -10,3 +10,5 @@
 - 数据库通过行锁分配下一版本并拒绝过时编辑，触发器禁止修改/删除已发布内容。数据库所有者仍可执行数据库维护，触发器不是对数据库管理员的安全隔离。
 
 验证由 ces-control PR CI 执行：严格 XML 单元测试；PostgreSQL 真实发布、所有权、并发版本冲突、不可变内容和撤下保留历史的集成测试。PR 不自动部署，服务器视觉验收须主 chat 人工合并后的部署成功再执行。
+
+首页现已通过 `/api/documents` 加载真实发布摘要，并在 GuidanceShell 提供用户文档与发布入口。`/guide` 继续只读取静态协议样例，不覆盖主 chat 的阅读实现。