feat(compliance): add compliance version mapping and audit snapshots

server/skillhub-app/src/main/java/com/iflytek/skillhub/bootstrap/BuiltinSkillInitializer.java

@@ -2,6 +2,7 @@
 
 import com.iflytek.skillhub.bootstrap.BuiltinSkillManifestLoader.ManifestItem;
 import com.iflytek.skillhub.controller.support.SkillPackageArchiveExtractor;
+import com.iflytek.skillhub.domain.audit.AuditLogService;
 import com.iflytek.skillhub.domain.namespace.Namespace;
 import com.iflytek.skillhub.domain.namespace.NamespaceMember;
 import com.iflytek.skillhub.domain.namespace.NamespaceMemberRepository;
@@ -16,6 +17,7 @@
 import com.iflytek.skillhub.domain.skill.SkillVersionRepository;
 import com.iflytek.skillhub.domain.skill.SkillVersionStatus;
 import com.iflytek.skillhub.domain.skill.SkillVisibility;
+import com.iflytek.skillhub.domain.skill.metadata.SkillComplianceAuditDetailFactory;
 import com.iflytek.skillhub.domain.skill.metadata.SkillMetadata;
 import com.iflytek.skillhub.domain.skill.metadata.SkillMetadataParser;
 import com.iflytek.skillhub.domain.skill.service.SkillPublishService;
@@ -35,6 +37,7 @@
 import java.security.MessageDigest;
 import java.util.Comparator;
 import java.util.HexFormat;
+import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Optional;
 import java.util.Set;
@@ -64,6 +67,9 @@ public class BuiltinSkillInitializer {
     private final SkillVersionRepository skillVersionRepository;
     private final SkillFileRepository skillFileRepository;
     private final SkillPublishService skillPublishService;
+    private final AuditLogService auditLogService;
+    private final SkillComplianceAuditDetailFactory complianceAuditDetailFactory =
+            new SkillComplianceAuditDetailFactory();
 
     public BuiltinSkillInitializer(
             BuiltinSkillProperties properties,
@@ -77,7 +83,8 @@ public BuiltinSkillInitializer(
             SkillRepository skillRepository,
             SkillVersionRepository skillVersionRepository,
             SkillFileRepository skillFileRepository,
-            SkillPublishService skillPublishService) {
+            SkillPublishService skillPublishService,
+            AuditLogService auditLogService) {
         this.properties = properties;
         this.manifestLoader = manifestLoader;
         this.downloader = downloader;
@@ -90,6 +97,7 @@ public BuiltinSkillInitializer(
         this.skillVersionRepository = skillVersionRepository;
         this.skillFileRepository = skillFileRepository;
         this.skillPublishService = skillPublishService;
+        this.auditLogService = auditLogService;
     }
 
     @EventListener(ApplicationReadyEvent.class)
@@ -238,14 +246,15 @@ private SyncOutcome syncItem(Namespace namespace, ManifestItem item) throws Exce
         }
 
         try {
-            skillPublishService.publishFromEntries(
+            SkillPublishService.PublishResult publishResult = skillPublishService.publishFromEntries(
                     GLOBAL_NAMESPACE,
                     entries,
                     SYSTEM_PUBLISHER_ID,
                     SkillVisibility.PUBLIC,
                     SYSTEM_PUBLISHER_ROLES,
                     CONFIRM_BUILTIN_PUBLISH_WARNINGS
             );
+            recordBuiltInPublishAuditIfLatestPublished(publishResult);
             log.info("Published built-in skill slug={} version={} to @{}",
                     item.slug(), item.version(), GLOBAL_NAMESPACE);
             return SyncOutcome.PUBLISHED;
@@ -271,6 +280,26 @@ private Optional<URI> parsePackageUri(ManifestItem item) {
         }
     }
 
+    private void recordBuiltInPublishAuditIfLatestPublished(SkillPublishService.PublishResult publishResult) {
+        if (publishResult.version().getStatus() != SkillVersionStatus.PUBLISHED) {
+            return;
+        }
+
+        LinkedHashMap<String, Object> extras = new LinkedHashMap<>();
+        extras.put("namespace", GLOBAL_NAMESPACE);
+        extras.put("slug", publishResult.slug());
+        auditLogService.record(
+                SYSTEM_PUBLISHER_ID,
+                "BUILTIN_PUBLISH",
+                "SKILL_VERSION",
+                publishResult.version().getId(),
+                null,
+                null,
+                null,
+                complianceAuditDetailFactory.latestPublishedEntered(publishResult.version(), extras)
+        );
+    }
+
     private SkillMetadata parseSkillMetadata(List<PackageEntry> entries) {
         PackageEntry skillMd = entries.stream()
                 .filter(entry -> SkillPackagePolicy.SKILL_MD_PATH.equals(entry.path()))

server/skillhub-app/src/main/java/com/iflytek/skillhub/compat/ClawHubCompatAppService.java

@@ -16,14 +16,17 @@
 import com.iflytek.skillhub.domain.namespace.NamespaceRole;
 import com.iflytek.skillhub.domain.shared.exception.DomainNotFoundException;
 import com.iflytek.skillhub.domain.skill.SkillVersion;
+import com.iflytek.skillhub.domain.skill.SkillVersionStatus;
 import com.iflytek.skillhub.domain.skill.SkillVisibility;
+import com.iflytek.skillhub.domain.skill.metadata.SkillComplianceAuditDetailFactory;
 import com.iflytek.skillhub.domain.skill.service.SkillPublishService;
 import com.iflytek.skillhub.domain.skill.service.SkillQueryService;
 import com.iflytek.skillhub.domain.social.SkillStarService;
 import com.iflytek.skillhub.dto.SkillSummaryResponse;
 import com.iflytek.skillhub.service.SkillSearchAppService;
 import java.io.IOException;
 import java.util.HashMap;
+import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import org.slf4j.MDC;
@@ -49,6 +52,8 @@ public class ClawHubCompatAppService {
     private final AuditLogService auditLogService;
     private final CompatSkillLookupService compatSkillLookupService;
     private final SkillStarService skillStarService;
+    private final SkillComplianceAuditDetailFactory complianceAuditDetailFactory =
+            new SkillComplianceAuditDetailFactory();
 
     public ClawHubCompatAppService(CanonicalSlugMapper mapper,
                                    SkillSearchAppService skillSearchAppService,
@@ -302,8 +307,14 @@ public ClawHubPublishResponse publishSkill(String payloadJson,
                 principal.platformRoles(),
                 confirmWarnings
         );
-        recordCompatPublishAudit(principal.userId(), result.version().getId(), clientIp, userAgent,
-                "{\"namespace\":\"" + namespace + "\",\"slug\":\"" + extracted.payload().slug() + "\"}");
+        recordCompatPublishAudit(
+                principal.userId(),
+                result.version(),
+                namespace,
+                result.slug(),
+                clientIp,
+                userAgent
+        );
         return new ClawHubPublishResponse(result.skillId().toString(), result.version().getId().toString());
     }
 
@@ -321,8 +332,14 @@ public ClawHubPublishResponse publish(MultipartFile file,
                 principal.platformRoles(),
                 confirmWarnings
         );
-        recordCompatPublishAudit(principal.userId(), result.version().getId(), clientIp, userAgent,
-                "{\"namespace\":\"" + namespace + "\"}");
+        recordCompatPublishAudit(
+                principal.userId(),
+                result.version(),
+                namespace,
+                result.slug(),
+                clientIp,
+                userAgent
+        );
         return new ClawHubPublishResponse(result.skillId().toString(), result.version().getId().toString());
     }
 
@@ -421,20 +438,31 @@ private String normalizeNamespace(String namespace) {
     }
 
     private void recordCompatPublishAudit(String userId,
-                                          Long versionId,
+                                          SkillVersion version,
+                                          String namespace,
+                                          String slug,
                                           String clientIp,
-                                          String userAgent,
-                                          String detailJson) {
+                                          String userAgent) {
         auditLogService.record(
                 userId,
                 "COMPAT_PUBLISH",
                 "SKILL_VERSION",
-                versionId,
+                version.getId(),
                 MDC.get("requestId"),
                 clientIp,
                 userAgent,
-                detailJson
+                compatPublishAuditDetail(version, namespace, slug)
         );
     }
 
+    private String compatPublishAuditDetail(SkillVersion version, String namespace, String slug) {
+        if (version.getStatus() == SkillVersionStatus.PUBLISHED) {
+            LinkedHashMap<String, Object> extras = new LinkedHashMap<>();
+            extras.put("namespace", namespace);
+            extras.put("slug", slug);
+            return complianceAuditDetailFactory.latestPublishedEntered(version, extras);
+        }
+        return "{\"namespace\":\"" + namespace + "\",\"slug\":\"" + slug + "\"}";
+    }
+
 }

server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/cli/CliSkillController.java

@@ -125,7 +125,8 @@ public ApiResponse<CliPublishResponse> publish(
             @PathVariable String namespace,
             @RequestPart("file") MultipartFile file,
             @RequestPart(value = "visibility", required = false) String visibility,
-            @AuthenticationPrincipal PlatformPrincipal principal) throws IOException {
+            @AuthenticationPrincipal PlatformPrincipal principal,
+            HttpServletRequest request) throws IOException {
         List<PackageEntry> entries;
         try {
             entries = archiveExtractor.extract(file);
@@ -135,7 +136,8 @@ public ApiResponse<CliPublishResponse> publish(
         var result = cliSkillAppService.publish(
                 namespace, entries, principal.userId(),
                 SkillVisibility.valueOf((visibility != null ? visibility : "PUBLIC").toUpperCase()),
-                principal.platformRoles());
+                principal.platformRoles(),
+                AuditRequestContext.from(request));
         return ok("response.success.published", result);
     }
 }

server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/portal/SkillController.java

@@ -11,6 +11,7 @@
 import com.iflytek.skillhub.dto.ApiResponseFactory;
 import com.iflytek.skillhub.dto.PageResponse;
 import com.iflytek.skillhub.dto.ResolveVersionResponse;
+import com.iflytek.skillhub.dto.SkillComplianceMappingResponse;
 import com.iflytek.skillhub.dto.SkillDetailResponse;
 import com.iflytek.skillhub.dto.SkillFileResponse;
 import com.iflytek.skillhub.dto.SkillLifecycleVersionResponse;
@@ -173,7 +174,16 @@ public ApiResponse<SkillVersionDetailResponse> getVersionDetail(
                 detail.totalSize(),
                 detail.publishedAt(),
                 detail.parsedMetadataJson(),
-                detail.manifestJson()
+                detail.manifestJson(),
+                detail.complianceMappings().stream()
+                        .map(mapping -> new SkillComplianceMappingResponse(
+                                mapping.standard(),
+                                mapping.standardVersion(),
+                                mapping.controlId(),
+                                mapping.controlTitle(),
+                                mapping.evidenceUrl()
+                        ))
+                        .toList()
         );
         return ok("response.success.read", response);
     }

server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/portal/SkillPublishController.java

@@ -1,22 +1,27 @@
 package com.iflytek.skillhub.controller.portal;
 
+import com.iflytek.skillhub.domain.audit.AuditLogService;
 import com.iflytek.skillhub.auth.rbac.PlatformPrincipal;
 import com.iflytek.skillhub.controller.BaseApiController;
 import com.iflytek.skillhub.controller.support.SkillPackageArchiveExtractor;
 import com.iflytek.skillhub.domain.shared.exception.DomainBadRequestException;
 import com.iflytek.skillhub.domain.skill.SkillVisibility;
+import com.iflytek.skillhub.domain.skill.SkillVersionStatus;
+import com.iflytek.skillhub.domain.skill.metadata.SkillComplianceAuditDetailFactory;
 import com.iflytek.skillhub.domain.skill.service.SkillPublishService;
 import com.iflytek.skillhub.domain.skill.validation.PackageEntry;
 import com.iflytek.skillhub.dto.ApiResponse;
 import com.iflytek.skillhub.dto.ApiResponseFactory;
 import com.iflytek.skillhub.dto.PublishResponse;
+import jakarta.servlet.http.HttpServletRequest;
 import com.iflytek.skillhub.metrics.SkillHubMetrics;
 import com.iflytek.skillhub.ratelimit.RateLimit;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.multipart.MultipartFile;
 
 import java.io.IOException;
+import java.util.LinkedHashMap;
 import java.util.List;
 
 /**
@@ -32,15 +37,20 @@ public class SkillPublishController extends BaseApiController {
     private final SkillPublishService skillPublishService;
     private final SkillPackageArchiveExtractor skillPackageArchiveExtractor;
     private final SkillHubMetrics skillHubMetrics;
+    private final AuditLogService auditLogService;
+    private final SkillComplianceAuditDetailFactory complianceAuditDetailFactory =
+            new SkillComplianceAuditDetailFactory();
 
     public SkillPublishController(SkillPublishService skillPublishService,
                                   SkillPackageArchiveExtractor skillPackageArchiveExtractor,
                                   ApiResponseFactory responseFactory,
-                                  SkillHubMetrics skillHubMetrics) {
+                                  SkillHubMetrics skillHubMetrics,
+                                  AuditLogService auditLogService) {
         super(responseFactory);
         this.skillPublishService = skillPublishService;
         this.skillPackageArchiveExtractor = skillPackageArchiveExtractor;
         this.skillHubMetrics = skillHubMetrics;
+        this.auditLogService = auditLogService;
     }
 
     /**
@@ -54,7 +64,8 @@ public ApiResponse<PublishResponse> publish(
             @RequestParam("file") MultipartFile file,
             @RequestParam("visibility") String visibility,
             @RequestParam(value = "confirmWarnings", defaultValue = "false") boolean confirmWarnings,
-            @AuthenticationPrincipal PlatformPrincipal principal) throws IOException {
+            @AuthenticationPrincipal PlatformPrincipal principal,
+            HttpServletRequest request) throws IOException {
 
         SkillVisibility skillVisibility = SkillVisibility.valueOf(visibility.toUpperCase());
 
@@ -93,8 +104,32 @@ public ApiResponse<PublishResponse> publish(
                 publishResult.version().getFileCount(),
                 publishResult.version().getTotalSize()
         );
+        recordPublishAuditIfLatestPublished(principal.userId(), namespace, publishResult, request);
         skillHubMetrics.incrementSkillPublish(namespace, publishResult.version().getStatus().name());
 
         return ok("response.success.published", response);
     }
+
+    private void recordPublishAuditIfLatestPublished(String userId,
+                                                     String namespace,
+                                                     SkillPublishService.PublishResult publishResult,
+                                                     HttpServletRequest request) {
+        if (publishResult.version().getStatus() != SkillVersionStatus.PUBLISHED) {
+            return;
+        }
+
+        LinkedHashMap<String, Object> extras = new LinkedHashMap<>();
+        extras.put("namespace", namespace);
+        extras.put("slug", publishResult.slug());
+        auditLogService.record(
+                userId,
+                "PUBLISH",
+                "SKILL_VERSION",
+                publishResult.version().getId(),
+                null,
+                request != null ? request.getRemoteAddr() : null,
+                request != null ? request.getHeader("User-Agent") : null,
+                complianceAuditDetailFactory.latestPublishedEntered(publishResult.version(), extras)
+        );
+    }
 }

server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/portal/SkillSearchController.java

@@ -2,6 +2,8 @@
 
 import com.iflytek.skillhub.controller.BaseApiController;
 import com.iflytek.skillhub.domain.namespace.NamespaceRole;
+import com.iflytek.skillhub.domain.shared.exception.DomainBadRequestException;
+import com.iflytek.skillhub.domain.skill.metadata.ComplianceStandard;
 import com.iflytek.skillhub.dto.ApiResponse;
 import com.iflytek.skillhub.dto.ApiResponseFactory;
 import com.iflytek.skillhub.ratelimit.RateLimit;
@@ -40,6 +42,11 @@ public ApiResponse<SkillSearchAppService.SearchResponse> search(
             @RequestParam(required = false) String q,
             @RequestParam(required = false) String namespace,
             @RequestParam(name = "label", required = false) java.util.List<String> labels,
+            @Parameter(
+                    name = "complianceStandard",
+                    schema = @Schema(implementation = ComplianceStandard.class)
+            )
+            @RequestParam(required = false) String complianceStandard,
             @Parameter(schema = @Schema(defaultValue = DEFAULT_SORT))
             @RequestParam(required = false) String sort,
             @Parameter(schema = @Schema(type = "integer", defaultValue = "0", minimum = "0"))
@@ -56,6 +63,7 @@ public ApiResponse<SkillSearchAppService.SearchResponse> search(
                 parseNonNegativeInt(page, DEFAULT_PAGE),
                 parsePositiveInt(size, DEFAULT_SIZE),
                 labels,
+                parseComplianceStandard(complianceStandard),
                 userId,
                 userNsRoles
         );
@@ -89,4 +97,12 @@ private int parsePositiveInt(String rawValue, int defaultValue) {
         int parsed = parseNonNegativeInt(rawValue, defaultValue);
         return parsed > 0 ? parsed : defaultValue;
     }
+
+    private ComplianceStandard parseComplianceStandard(String rawValue) {
+        if (rawValue == null || rawValue.isBlank()) {
+            return null;
+        }
+        return ComplianceStandard.findByValue(rawValue)
+                .orElseThrow(() -> new DomainBadRequestException("error.search.complianceStandard.invalid", rawValue.trim()));
+    }
 }

server/skillhub-app/src/main/java/com/iflytek/skillhub/dto/SkillComplianceMappingResponse.java

@@ -0,0 +1,11 @@
+package com.iflytek.skillhub.dto;
+
+import com.iflytek.skillhub.domain.skill.metadata.ComplianceStandard;
+
+public record SkillComplianceMappingResponse(
+        ComplianceStandard standard,
+        String standardVersion,
+        String controlId,
+        String controlTitle,
+        String evidenceUrl
+) {}