docs(architecture): add VS-01/VS-02 slice specs, register VS-02 tech debt

- VS-01-SLICE_SPEC.md: Identity/MFA/RBAC/maker-checker contract (draft, ready for security review)
  * Roles: GUEST/USER/OPERATOR/ADMIN/SUPER_ADMIN
  * MFA tiers: NO_MFA → TOTP_REQUIRED → HARDWARE_KEY
  * Maker-checker approval workflow for role elevation
  * Schema: users/roles/user_roles/role_approval_requests/mfa_devices/permissions (PIT-tracked)
  * Prerequisite AEG-X-001/AEG-VS-00-02 already COMPLETED → can proceed immediately

- VS-02-SLICE_SPEC.md: Financial security master (listing/delisting/product structure) [DRAFT]
  * Correct domain: Financial PIT data, NOT access-control rules
  * Existing VS-02 code (RBAC rule sync) is mislabeled → registered as tech debt
  * Schema stub: securities/trading_restrictions (PIT-tracked)
  * CRITICAL: Source Unknown — awaiting data governance approval of:
    (1) KRX data source endpoint (not in source-catalog.md)
    (2) Import SLA (daily? intraday?)
    (3) Audit/corrections policy
  * Status: DRAFT (cannot proceed without unknowns resolved)

- TECH_DEBT_REGISTER.md: Added DEBT-016 (VS-02 mislabeled)
  * Impact: Medium (design confusion), Effort: Low (doc) → Medium (code removal)
  * Endpoints disabled (DISABLED comment), schema never migrated, never deployed
  * Dead code marked for removal decision (separate PR recommended)

- WBS_PROGRESS_TRACKER.csv: Updated status
  * AEG-VS-01-01: PLANNED → IN_PROGRESS (SLICE_SPEC ready)
  * AEG-VS-02-01: PLANNED → DRAFT (unknowns documented, data gov approval needed)

AGENTS.md: Maturity (contract before code), Necessity (fix only real issues — domain confusion + unknowns)

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
This commit is contained in:
2026-08-07 14:05:17 +09:00
parent 67274cbdb6
commit 5db772f404
4 changed files with 438 additions and 2 deletions
+1
View File
@@ -48,6 +48,7 @@
|----|----------|--------|--------|--------|-------|-------|-----|
| DEBT-007 | Newtonsoft.Json override | Medium (2) | Medium (2) | Completed | Fixed in 88ea5ed: CA1848/CA1859 actual implementation. LoggerMessage + HashSet/Dictionary. | @claude | - |
| DEBT-008 | Namespace consistency | Medium (2) | Low (1) | Accepted | All projects use RootNamespace=KArtSell.Aegis; AssemblyName retained per-project for DLL clarity. Trade-off accepted: DLL clarity > namespace alignment. No action. | @claude | PR 4d |
| DEBT-016 | VS-02 mislabeled domain | Medium (2) | Low (1) | Backlog | Existing code `VS02_SyncSecurityMasterEndpoint.cs`, `VS02_SecurityMasterJobs.cs`, `VS02_SecurityMasterPolicy.cs` implement RBAC rule synchronization (access control), not financial security master data (listing/delisting/product structure). Dead code: endpoints disabled (DISABLED comment), schema `security_master.rules` table never migrated, never deployed. Correct domain documented in `docs/CURRENT/SLICE_SPECS/VS-02-SLICE_SPEC.md` (financial PIT). Removal decision deferred pending architect review (PR recommended). | @claude | docs/CURRENT/SLICE_SPECS/VS-02-SLICE_SPEC.md |
---