Spring AI Business Copilot v2.3.0

Spring AI Business Copilot 2.3.0

2.3.0 is the formal enterprise-workflow release. It closes the existing Data,
Knowledge, Support, Report, and HR business loops with governed state, human review,
audit evidence, recoverable failure paths, and reproducible delivery gates.

2.3.0 是正式企业闭环版本。本版本不增加第六个模块，而是把 Data、Knowledge、
Support、Report、HR 五个现有模块收口为具备治理状态、人工复核、审计证据、失败恢复和
可复现交付门禁的业务样板。

Highlights / 主要能力

• Replaced the legacy workbench with a bilingual Vue 3 + TypeScript SPA for all five
  business domains, login, and administration, with role-aware callable actions.
• Data adds immutable governance versions, four-eyes approval, bounded read-only
  execution, retained result snapshots, and atomic handoff to Report.
• Knowledge adds fail-closed ACL/source access and structured evidence, answer,
  remediation, and disposition quality review.
• Support adds idempotent external import, token-bound human review, expired-session
  renewal, separately confirmed external writeback, and evidence-based recovery from
  unknown external outcomes. Internal confirmation never sends a customer message.
• Report adds repeatable-source validation, Data handoff consumption, schedule leases,
  stale-run recovery, run history, and reviewable drafts that are never auto-published.
• HR adds purpose-bound consent, assessment review queues, interview membership and
  feedback, onboarding instances/tasks, and a read-only ATS boundary without scoring,
  ranking, or automated hiring decisions.
• Flyway V29-V31, fail-closed external HTTP policy, structured errors, auto-configuration
  contracts, CycloneDX SBOM, and a non-root runtime image complete the delivery surface.

Release gates / 发布门禁

• Pull request: #12
• Verified main commit: fe60bd4c
• Main CI: run 31715748768
• Vue TypeScript, ESLint, 5 files / 9 unit tests, and production build passed.
• Desktop 21/21 and mobile 21/21 Playwright workflows passed (42/42 total).
• Maven verify -Psbom passed across 13 Reactor modules; PostgreSQL migrations and
  integration tests, MySQL 5.7/8.4 query targets, and all 67 fixed evaluation samples passed.
• Dependency review, repository Trivy, release-container Trivy, non-root 10001:10001,
  Compose runtime, authentication/CSRF smoke, and CycloneDX SBOM gates passed.

Upgrade / 升级

Read docs/upgrade-2.2.1-to-2.3.0.md
before upgrading. Back up the database before Flyway V29-V31; rollback uses the previous
application together with a database backup rather than deleting applied migrations.

Deployment boundary / 部署责任边界

Real model providers, Jira/Notion/ServiceNow/ATS tenants, enterprise identity sources,
secret custody, production networking, backup/restore drills, capacity testing, and legal
retention policy remain deployment-owned acceptance items. The project provides closed,
auditable, human-confirmed paths but does not claim simulated vendor tests as production proof.

Full changes: v2.2.1...v2.3.0