YAML 1.1 隐式类型解析静默改写配置：tz: NO 变成 False、0755 变成 493、1.20 变成 1.2 —— 而服务照常启动、退出码 0、日志全绿

region: EU
tz: NO
country_code: no
rollout_percent: 0
banner: "v1.0"
enable_metrics: off
alert_channel: slack,  email
alert_owner: slack
file_mode: 0755
admin_code: 0755
build: 1.20
upstream_ack: true

== 解析摘要 ==
tz               = False
enable_metrics   = 'OFF'
alert_channel    = 'slack,  email'
file_mode        = 493
build            = 1.2
rollout_percent  = 0
[就绪] 服务已启动, 调度器已加载配置

git fetch origin && git checkout 2026-09-22-0803
cd scenario/2026-09-22-0803
docker compose up -d --build
docker compose exec app bash

docker compose exec -T app python3 -c "
import yaml
for s in ['tz: NO','x: no','m: 0755','v: 1.20','c: a,  b','e: off']:
    print(s.ljust(12),'->',repr(yaml.safe_load(s)))
"

tz: NO       -> {'tz': False}
x: no        -> {'x': False}
m: 0755      -> {'m': 493}
v: 1.20      -> {'v': 1.2}
c: a,  b     -> {'c': 'a,  b'}
e: off       -> {'e': False}

docker compose exec -T app python3 app/gateway_loader.py ; echo "RC=$?"

== 校验结果 ==
INVALID（5 处）:
  - tz: expected str, got bool (False)
  - country_code: expected str, got bool (False)
  - file_mode: expected str, got int (493)
  - admin_code: expected str, got int (493)
  - build: expected str, got float (1.2)
[就绪] 服务已启动, 调度器已加载配置      # ← 报着 5 处 INVALID，照样「就绪」
RC=0

docker compose exec -T app python3 app/audit_config.py   # all_ok=false，8/8 项 FAIL，rc=1
docker compose exec -T app bash /work/ops/verify.sh      # RESULT: PASS=4 FAIL=7，rc=1

# ❌ 解析后再猜 —— 生来就是错的
if isinstance(val, bool):
    return "no" if val is False else "yes"        # NO / no / off 全都变成 "no"
if isinstance(val, float):
    return f"{val:.2f}"                            # 1.200 -> "1.20"（丢位）；1.2 -> "1.20"（凭空补 0）

class RawTextLoader(yaml.SafeLoader):
    """SafeLoader 子类：关闭所有隐式类型解析，裸标量一律按原始文本返回 str。"""

    def construct_scalar(self, node):
        if isinstance(node, yaml.ScalarNode):
            return node.value          # ← 源文件里的原始标量文本，不猜类型
        return super().construct_scalar(node)

# 关键一步：把隐式解析器全部清空
RawTextLoader.yaml_implicit_resolvers = {
    ch: [] for ch in yaml.resolver.Resolver.yaml_implicit_resolvers
}

yaml.load("""
tz: NO          # 行尾注释
country_code: "no"
anchor: &a slack
alert_channel: *a
nested:
  file_mode: 0755
list: [0755, NO]
""", Loader=RawTextLoader)
# {'tz': 'NO', 'country_code': 'no', 'anchor': 'slack', 'alert_channel': 'slack',
#  'nested': {'file_mode': '0755'}, 'list': ['0755', 'NO']}

_COERCERS = {
    "string":  lambda text, key, spec: str(text),       # schema 说 string 就绝不变 bool/int
    "boolean": lambda text, key, spec: _to_bool(text),  # true/yes/on/1 <-> false/no/off/0
    "integer": lambda text, key, spec: _to_int(text),   # 十进制；0x/0o 需**显式**前缀
    "number":  lambda text, key, spec: _to_number(text),
}

def _to_int(text):
    s = str(text).strip()
    if re.fullmatch(r"[-+]?[0-9]+", s):
        return int(s, 10)          # ← 0755 -> 755（十进制），不再自动当八进制
    if re.fullmatch(r"[-+]?0x[0-9a-fA-F]+", s):
        return int(s, 16)
    if re.fullmatch(r"[-+]?0o[0-7]+", s):
        return int(s, 8)
    raise SchemaTypeError(...)     # 解释不了就报错，**不静默放过**

def restore_semantics(data, env):
    defaults = yaml.load(open(.../feature_defaults.yaml), Loader=RawTextLoader) or {}
    if defaults.get("enable_metrics") in (False, "false"):
        d["enable_metrics"] = True            # 契约：本服务默认开启指标
    if str(defaults.get("rollout_percent", "x")).strip() == "0":
        d["rollout_percent"] = 100            # 契约：默认全量，避免静默归零
    if not re.fullmatch(r"^[A-Za-z_]+/[A-Za-z_]+$", str(d.get("tz"))):
        d["tz"] = "Asia/Shanghai"             # 裸 NO 表达的是「挪威时区」意图
    ch = d.get("alert_channel")
    if isinstance(ch, str) and "," in ch:
        d["alert_channel"] = ch.split(",")[0].strip()   # 取首选通道
    return d

strict = env.get("STRICT_UPSTREAM", "0").strip() == "1"
errs = validate(data)
if errs:
    print(f"INVALID（{len(errs)} 处）:")
    for e in errs: print("  - " + e)
    if strict:
        print("[FATAL] STRICT_UPSTREAM=1：配置校验失败，拒绝启动（exit 3）")
        return 3                  # ← 不再是「打印一行 WARN 就当没事」

docker compose up -d --build       # ★ COPY 进来的文件，改完必须重建
docker compose exec -T app python3 app/gateway_loader.py ; echo "RC=$?"

== 解析摘要 ==
tz               = 'Asia/Shanghai'
enable_metrics   = 'ON'
alert_channel    = 'slack'
file_mode        = '0755'
build            = '1.20'
rollout_percent  = 100

== 校验结果 ==
OK: 配置通过校验
[就绪] 服务已启动, 调度器已加载配置
RC=0

docker compose exec -T app python3 app/audit_config.py | python3 -c \
  "import json,sys;d=json.load(sys.stdin);print('all_ok =',d['all_ok'],'| failed =',d['failed'])"
# all_ok = True | failed = []

docker compose exec -T app bash /work/ops/verify.sh ; echo "RC=$?"

=== A. 语义保真：审计报表 ===
  [PASS] A1 audit_config.py all_ok=true（8 项全部匹配期望值）
=== B. 类型断言：解析结果的运行时类型 ===
  [PASS] tz 类型=str          [PASS] country_code 类型=str
  [PASS] file_mode 类型=str   [PASS] admin_code 类型=str
  [PASS] build 类型=str       [PASS] enable_metrics 类型=bool
  [PASS] B1 6 个字段运行时类型全部正确
  [PASS] B2 file_mode 作为字符串仍能读回 '0755'（八进制未被吃成 493）
=== C. 部署契约一致 ===
  [PASS] C1 tz 已是真正的时区字符串 Asia/Shanghai（不是布尔的 False）
  [PASS] C2 file_mode 读出 '0755'（与 feature_defaults.yaml 的声明一致）
  [PASS] C3 rollout_percent 加载为 100（不是静默变成 0）
  [PASS] C4 enable_metrics 由 off-key(0/False) 正确还原为 True
=== D. 禁止作弊：gateway.yaml 必须保留「不加引号」的 YAML 1.1 危险写法 ===
  [PASS] D1 tz 仍写作不加引号的 NO      [PASS] D2 file_mode 仍写作不加引号的 0755
  [PASS] D3 build 仍写作不加引号的 1.20  [PASS] D4 alert_channel 仍是未加引号的逗号串

RESULT: PASS=11 FAIL=0
RC=0

== 校验结果 ==
INVALID（1 处）:
  - upstream_ack: expected bool, got str ('true')
[FATAL] STRICT_UPSTREAM=1：配置校验失败，拒绝启动（exit 3）
main() 返回码 = 3 → STRICT 生效(非0)

docker compose exec -T app bash /work/ops/_selftest_fixable.sh
# [SELFTEST-OK] 判据可达：按预期方向修复后 verify.sh 全绿 (rc=0)

docker compose down -v && docker compose up -d --build
docker compose exec -T app bash /work/ops/verify.sh | tail -2
# RESULT: PASS=11 FAIL=0

git status --short
#  M scenario/2026-09-22-0803/app/audit_config.py
#  M scenario/2026-09-22-0803/app/gateway_loader.py
git diff --stat conf/
# (空) ← conf/ 未改

grep -rn "STRICT_UPSTREAM" app/     # 只在 conf/*.env 出现 => 注释而已

# ① 一句话探针：你的解析器会不会猜类型？
python3 -c "import yaml;print('NO->',yaml.safe_load('k: NO')['k'],'| 0755->',yaml.safe_load('k: 0755')['k'])"
# NO-> False | 0755-> 493  => 中招；打印字符串则安全

# ② 拿真实配置，对照「YAML 1.1 解析结果」与「schema 声明类型」，打印所有漂移
python3 - <<'PY'
import yaml, json
cfg = yaml.safe_load(open("conf/gateway.yaml", encoding="utf-8"))
schema = json.load(open("conf/gateway.schema.json", encoding="utf-8"))
for k, spec in schema.get("properties", {}).items():
    if k not in cfg: continue
    want, got = spec.get("type"), type(cfg[k]).__name__
    py = {"string":"str","integer":"int","boolean":"bool","number":"float","array":"list"}.get(want)
    if py and got != py:
        print(f"DRIFT {k}: schema={want}({py}) 实际={got} 值={cfg[k]!r}")
PY

# ③ 契约文件是否被代码真正读取（只读）
grep -rn "STRICT_UPSTREAM" app/

# ④ 别问「服务起没起」，问「起的时候值对不对」