matevip 2e3dd071a5 fix(kb-open): assert session belongs to path kbId + cleanup ... - requireSessionOwnership now also checks session.kbId() == path kbId (404 on mismatch), so a research session started under one KB cannot be addressed via another KB path even when the caller's key is bound to both — defense-in-depth on top of the keyId ownership check. - Drop internal "R7" / "review #446" markers from the controller Javadoc in favour of functional wording. - Import Set/Map/concurrent types and static any() instead of inline FQNs in the new kb-open research/auth tests, per code style.		2026-07-02 17:52:25 +08:00
..
auth	feat(kb-open): Deep Research 开放 API（start/SSE/status/cancel） (#446)	2026-07-02 17:47:24 +08:00
controller	fix(kb-open): assert session belongs to path kbId + cleanup	2026-07-02 17:52:25 +08:00
dto	feat(kb-open): P0-B 9 个开放 API 端点 (#445)	2026-06-30 09:36:55 +08:00
research	feat(kb-open): Deep Research 开放 API（start/SSE/status/cancel） (#446)	2026-07-02 17:47:24 +08:00
service	feat(kb-open): P0-B 9 个开放 API 端点 (#445)	2026-06-30 09:36:55 +08:00