diff --git a/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/check.jsonl b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/check.jsonl new file mode 100644 index 00000000..e516df6e --- /dev/null +++ b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/check.jsonl @@ -0,0 +1,4 @@ +{"file": ".trellis/spec/hyb-oa/deployment-trialrun.md", "reason": "核对部署命令、远端 env 边界和公网验证要求。"} +{"file": ".trellis/spec/hyb-oa/security-privacy.md", "reason": "核对部署证据和验证报告不得泄露敏感信息。"} +{"file": ".trellis/spec/hyb-oa/docs-and-evidence.md", "reason": "核对证据记录、任务归档和文档边界。"} +{"file": ".trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/deploy-context.md", "reason": "核对本任务部署上下文和输出计划。"} diff --git a/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/implement.jsonl b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/implement.jsonl new file mode 100644 index 00000000..573ea3b0 --- /dev/null +++ b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/implement.jsonl @@ -0,0 +1,4 @@ +{"file": ".trellis/spec/hyb-oa/deployment-trialrun.md", "reason": "公网试运行部署、安全模式、env contract 和部署后检查规则。"} +{"file": ".trellis/spec/hyb-oa/frontend-react-vite-design.md", "reason": "前端改动部署前验证和 A 类页面口径。"} +{"file": ".trellis/spec/hyb-oa/project-governance.md", "reason": "Trellis task、审批、提交和单人开发治理规则。"} +{"file": ".trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/deploy-context.md", "reason": "本任务部署边界和证据输出计划。"} diff --git a/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/implement.md b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/implement.md new file mode 100644 index 00000000..ee08ece9 --- /dev/null +++ b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/implement.md @@ -0,0 +1,19 @@ +# 实施说明 + +## Plan + +1. 补齐部署复检任务合同和上下文。 +2. 部署前复跑本地前端、部署契约和 Trellis 门禁。 +3. 在用户明确批准后，以 `SYNC_ENV=0 bash deploy/trialrun/deploy.sh` 部署公网试运行环境。 +4. 部署后执行 live readiness、权限矩阵、PC 只读视觉、移动入口和企业微信渲染只读验证。 +5. 将验证结论、报告相对路径和最终 Go/No-Go 写回当前任务。 + +## Risk + +- 公网 OA 是准生产环境；部署必须得到用户明确批准。 +- 本任务不写真实业务数据，不执行真实付款，不覆盖远端 `.env`。 +- 如果部署后只读验证失败，结论写 `BLOCKED_POSTDEPLOY_VERIFICATION`，不告知用户可以测试。 + +## Rollback + +- 若部署后出现阻断回归，按部署脚本和试运行手册回滚到上一个已验证 commit；回滚同样需要记录 commit、命令和公网检查结论。 diff --git a/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/prd.md b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/prd.md new file mode 100644 index 00000000..aee06c28 --- /dev/null +++ b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/prd.md @@ -0,0 +1,123 @@ +# 前端降噪审计修复部署复检 + +## Goal + +将已完成并提交的前端降噪审计修复部署到公网试运行环境，并完成必要的公网只读复检，确认工作台审计日志入口、报销支付日期默认值和报销详情状态文案修复已经进入试运行版本，且没有引入登录、权限、PC 只读视觉、移动入口或企业微信渲染回归。 + +本任务只做已提交修复的部署和只读验证；不扩大页面重构范围，不写真实业务数据，不覆盖远端 `.env`。 + +## Scope + +- 部署当前 `main` 中 `7b6e705` 前端审计修复到公网试运行环境。 +- 部署前复跑本地门禁，确认当前工作区和任务合同稳定。 +- 使用 `SYNC_ENV=0 bash deploy/trialrun/deploy.sh` 部署，禁止同步或覆盖远端 `.env`。 +- 部署后执行公网只读验证矩阵。 +- 在当前 Trellis task 中保存脱敏摘要和相对报告路径。 + +## What I Already Know + +- 最新本地修复提交：`7b6e705 修复前端降噪审计问题（frontend-simplification-audit-fixes）`。 +- 任务归档提交：`13643e3 归档前端降噪审计修复任务（frontend-simplification-audit-fixes）`。 +- 当前 `main` 工作区干净，本地比远端 ahead 11。 +- 前端审计修复本地验证已通过： + - `cd client && npm run typecheck` + - `cd client && npm run build` + - 聚焦 Playwright：`login-portal-ux.spec.ts --grep "系统摘要审计日志"` + - UI 设计规则、Trellis governance、`git diff --check` +- 上一轮降噪部署复检已验证公网环境可通过 live readiness、权限矩阵、PC 只读视觉、移动入口和企微渲染矩阵。 + +## Requirements + +- 部署前必须记录执行边界、验证计划和脱敏证据路径。 +- 部署前必须复跑最小本地门禁： + - `cd client && npm run typecheck` + - `cd client && npm run build` + - `node scripts/qa/check-ui-design-rules.mjs` + - `node deploy/trialrun/validate-env-contract.js` + - `python3 ./.trellis/scripts/task.py validate 05-29-frontend-audit-fixes-deploy-verify` + - `node scripts/qa/check-trellis-governance.mjs` + - `git diff --check` +- 公网部署必须使用安全模式： + - `SYNC_ENV=0 bash deploy/trialrun/deploy.sh` + - 不覆盖远端 `.env` + - 不做数据库重置、恢复或手工迁移 +- 部署后必须执行公网只读验证： + - `/ready` 和部署脚本自带 smoke 结论 + - live smoke / OCR readiness + - OA 权限矩阵 + - OAFRONT3 PC 只读视觉矩阵 + - 移动入口矩阵和企业微信渲染矩阵 +- 验证报告只登记相对路径、状态和脱敏摘要；不得写入密码、token、完整账号、完整本地路径、真实票据或 raw payload。 + +## Acceptance Criteria + +- [x] 用户明确批准执行公网部署。 +- [x] Trellis task 材料完整并通过 validate/governance。 +- [x] 部署前本地门禁通过。 +- [x] `SYNC_ENV=0 bash deploy/trialrun/deploy.sh` 完成远端服务重建，未覆盖远端 `.env`。 +- [x] 部署后公网 `/ready` 通过。 +- [x] live smoke / OCR readiness 通过或有可解释 SKIP/PASS_WITH_FINDINGS。 +- [x] 权限矩阵返回 `PASS_WITH_FINDINGS`：缺少本地角色凭据导致 7 个角色 SKIP，无权限断言失败。 +- [x] PC 只读视觉矩阵无 P1 blocker。 +- [x] 移动入口和企业微信渲染矩阵通过。 +- [x] 当前任务记录公网验证摘要和报告相对路径。 + +## Test Plan + +部署前： + +```bash +cd client && npm run typecheck +cd client && npm run build +node scripts/qa/check-ui-design-rules.mjs +node deploy/trialrun/validate-env-contract.js +python3 ./.trellis/scripts/task.py validate 05-29-frontend-audit-fixes-deploy-verify +node scripts/qa/check-trellis-governance.mjs +git diff --check +``` + +部署： + +```bash +SYNC_ENV=0 bash deploy/trialrun/deploy.sh +``` + +部署后： + +```bash +LIVE_SMOKE_BASE_URL=https://oa.hyinda.com LIVE_SMOKE_READINESS_DIR=.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness bash scripts/qa/run-live-smoke-readiness.sh +LIVE_SMOKE_BASE_URL=https://oa.hyinda.com OA_PERMISSION_MATRIX_REPORT_DIR=.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-permission-matrix node scripts/qa/check-oa-permission-matrix.mjs +bash scripts/qa/run-oafront3-pc-readonly-visual.sh +cd client && E2E_BASE_URL=https://oa.hyinda.com npx playwright test tests/e2e/dg7-mobile-information-dedupe.spec.ts tests/e2e/r124-mobile-entry-matrix.spec.ts --workers=1 --reporter=list +cd client && E2E_BASE_URL=https://oa.hyinda.com npx playwright test tests/e2e/r6-wecom-mobile-rendering-hardening.spec.ts --workers=1 --reporter=list +node scripts/qa/check-trellis-governance.mjs +git diff --check +``` + +## Definition Of Done + +- 公网试运行环境部署到包含 `7b6e705` 修复的 commit。 +- 公网只读验证结果记录到当前任务。 +- 结论明确为 `READY_WITH_FINDINGS`。 +- 只有在部署与公网只读检查通过或可解释后，才告知用户可以测试。 +- 提交中文 commit，commit message 引用本 Trellis task。 + +## Out Of Scope + +- 不继续重构其他页面。 +- 不新增截图对比页。 +- 不启动或重置真实 7 天试运行计数。 +- 不创建、提交、审批、付款任何真实业务单据。 +- 不写企业微信消息、通讯录、审批或回调数据。 +- 不改远端 `.env`、生产配置、Caddy 配置或生产数据库。 +- 不执行真实付款、银行流水导入、ERP 写入或支付接口联调。 + +## Technical Notes + +- Deployment spec: `.trellis/spec/hyb-oa/deployment-trialrun.md` +- Frontend spec: `.trellis/spec/hyb-oa/frontend-react-vite-design.md` +- Evidence spec: `.trellis/spec/hyb-oa/docs-and-evidence.md` +- Privacy spec: `.trellis/spec/hyb-oa/security-privacy.md` +- Governance spec: `.trellis/spec/hyb-oa/project-governance.md` +- Trial run runbook: `docs/试运行与自动化验证手册.md` +- Fix task: `.trellis/tasks/archive/2026-05/05-29-frontend-simplification-audit-fixes/` diff --git a/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/deploy-context.md b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/deploy-context.md new file mode 100644 index 00000000..b9910bcf --- /dev/null +++ b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/deploy-context.md @@ -0,0 +1,19 @@ +# 部署复检上下文 + +## 已完成本地修复 + +- `7b6e705 修复前端降噪审计问题（frontend-simplification-audit-fixes）` +- `13643e3 归档前端降噪审计修复任务（frontend-simplification-audit-fixes）` + +## 部署边界 + +- 使用 `SYNC_ENV=0 bash deploy/trialrun/deploy.sh`。 +- 不同步或覆盖远端 `.env`。 +- 不写真实业务数据、不写企业微信、不执行真实付款。 +- 验证报告只记录脱敏状态、摘要和相对路径。 + +## 计划输出 + +- `research/postdeploy-live-smoke-readiness/summary.json` +- `research/postdeploy-permission-matrix/summary.json` +- `research/postdeploy-summary.md` diff --git a/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/env.json b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/env.json new file mode 100644 index 00000000..351dc82d --- /dev/null +++ b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/env.json @@ -0,0 +1,51 @@ +{ + "checkedAt": "2026-05-29T06:59:42.434Z", + "baseUrl": "https://oa.hyinda.com", + "liveSmokeReady": false, + "liveSmoke": { + "adminCredentialReady": false, + "employeeCredentialReady": false + }, + "liveSmokeOptional": { + "expectedWecomStatusReady": false, + "managerCredentialReady": false, + "financeCredentialReady": false + }, + "liveOcrReady": false, + "liveOcr": { + "userReady": false, + "invoiceSampleReady": false, + "invoiceFileProvided": false, + "invoiceFileReady": false, + "invoiceBatchDirProvided": false, + "invoiceBatchDirReady": false, + "allowDuplicate": false + }, + "missing": [ + "adminCredentialReady", + "employeeCredentialReady", + "ocrOrEmployeeCredentialReady", + "PLAYWRIGHT_OCR_LIVE_FILE 或 PLAYWRIGHT_OCR_LIVE_DIR 中的 PDF 样票" + ], + "publicReady": { + "ok": true, + "status": 200 + }, + "wecomConfig": { + "ok": true, + "status": 200, + "statusText": "ready", + "entryEnabled": true, + "oauthEnabled": true, + "defaultReturnTo": "/mobile", + "loginUrl": "/api/auth/wecom/login?returnTo=%2Fmobile" + }, + "authCapabilities": { + "ok": true, + "status": 200, + "emailDeliveryReady": true, + "emailDeliveryReasons": [], + "emailLoginCodeEnabled": true, + "passwordResetEnabled": true + } +} diff --git a/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/live-ocr.txt b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/live-ocr.txt new file mode 100644 index 00000000..ab174d1d --- /dev/null +++ b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/live-ocr.txt @@ -0,0 +1 @@ +>>> [live-readiness] SKIP 真实 OCR：缺少 smoke 员工凭据或 PLAYWRIGHT_OCR_LIVE_FILE/PLAYWRIGHT_OCR_LIVE_DIR diff --git a/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/live-smoke.txt b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/live-smoke.txt new file mode 100644 index 00000000..f89e1cc3 --- /dev/null +++ b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/live-smoke.txt @@ -0,0 +1 @@ +>>> [live-readiness] SKIP live smoke：缺少完整 LIVE_SMOKE_* 凭据 diff --git a/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/pending-ocr.txt b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/pending-ocr.txt new file mode 100644 index 00000000..a8739766 --- /dev/null +++ b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/pending-ocr.txt @@ -0,0 +1 @@ +[pending-ocr][SKIP] missing DATABASE_URL diff --git a/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/public-bundle-copy.txt b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/public-bundle-copy.txt new file mode 100644 index 00000000..6d2bd196 --- /dev/null +++ b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/public-bundle-copy.txt @@ -0,0 +1 @@ +[public-bundle-copy] base=https://oa.hyinda.com scanned=91 focused=2 findings=0 diff --git a/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/summary.json b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/summary.json new file mode 100644 index 00000000..a48e6a77 --- /dev/null +++ b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/summary.json @@ -0,0 +1,12 @@ +{ + "issueId": null, + "baseURL": "https://oa.hyinda.com", + "commit": "13643e3", + "checkedAt": "2026-05-29T06:59:47.423Z", + "status": "PASS", + "mode": "live-smoke-readiness", + "reportDir": ".trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness", + "reportRef": ".trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness", + "groups": null, + "notes": "公网 /ready、public bundle、pending OCR、live smoke 和真实 OCR 可用性检查；缺少凭据或样票时按脚本规则记录 SKIP。" +} \ No newline at end of file diff --git a/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-permission-matrix/summary.json b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-permission-matrix/summary.json new file mode 100644 index 00000000..239ee101 --- /dev/null +++ b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-permission-matrix/summary.json @@ -0,0 +1,127 @@ +{ + "issueId": "OANEXT2-4", + "status": "PASS_WITH_FINDINGS", + "checkedAt": "2026-05-29T06:59:54.262Z", + "baseUrl": "https://oa.hyinda.com", + "privacy": "redacted role/status/count evidence only; no password, token, Secret, full account, invoice, contract, attachment, or raw payload", + "counts": { + "roles": 7, + "positiveProbes": 0, + "negativeProbes": 0 + }, + "issues": [], + "results": [ + { + "key": "employee", + "expectedRoles": [ + "employee" + ], + "maskedIdentifier": null, + "login": { + "status": "SKIP", + "reason": "missing_credentials", + "code": null + }, + "roleMatch": "SKIP", + "actualRoles": [], + "probes": [] + }, + { + "key": "manager", + "expectedRoles": [ + "manager", + "employee" + ], + "maskedIdentifier": null, + "login": { + "status": "SKIP", + "reason": "missing_credentials", + "code": null + }, + "roleMatch": "SKIP", + "actualRoles": [], + "probes": [] + }, + { + "key": "finance", + "expectedRoles": [ + "finance", + "employee" + ], + "maskedIdentifier": null, + "login": { + "status": "SKIP", + "reason": "missing_credentials", + "code": null + }, + "roleMatch": "SKIP", + "actualRoles": [], + "probes": [] + }, + { + "key": "finance_mgr", + "expectedRoles": [ + "finance", + "finance_mgr", + "employee" + ], + "maskedIdentifier": null, + "login": { + "status": "SKIP", + "reason": "missing_credentials", + "code": null + }, + "roleMatch": "SKIP", + "actualRoles": [], + "probes": [] + }, + { + "key": "hr", + "expectedRoles": [ + "hr", + "employee" + ], + "maskedIdentifier": null, + "login": { + "status": "SKIP", + "reason": "missing_credentials", + "code": null + }, + "roleMatch": "SKIP", + "actualRoles": [], + "probes": [] + }, + { + "key": "ceo", + "expectedRoles": [ + "ceo", + "employee" + ], + "maskedIdentifier": null, + "login": { + "status": "SKIP", + "reason": "missing_credentials", + "code": null + }, + "roleMatch": "SKIP", + "actualRoles": [], + "probes": [] + }, + { + "key": "admin", + "expectedRoles": [ + "admin", + "employee" + ], + "maskedIdentifier": null, + "login": { + "status": "SKIP", + "reason": "missing_credentials", + "code": null + }, + "roleMatch": "SKIP", + "actualRoles": [], + "probes": [] + } + ] +} diff --git a/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-permission-matrix/summary.md b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-permission-matrix/summary.md new file mode 100644 index 00000000..bba26cf4 --- /dev/null +++ b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-permission-matrix/summary.md @@ -0,0 +1,28 @@ +# OA 权限矩阵脱敏自动验证报告 + +生成时间：2026-05-29T06:59:54.262Z +结论：PASS_WITH_FINDINGS + +## 统计 + +- 角色数：7 +- 正向探针：0 +- 负向探针：0 +- 问题数：0 + +## 角色结果 + +| 角色 | 登录 | 角色匹配 | 探针通过/总数 | +| --- | --- | --- | ---: | +| employee | SKIP | SKIP | 0/0 | +| manager | SKIP | SKIP | 0/0 | +| finance | SKIP | SKIP | 0/0 | +| finance_mgr | SKIP | SKIP | 0/0 | +| hr | SKIP | SKIP | 0/0 | +| ceo | SKIP | SKIP | 0/0 | +| admin | SKIP | SKIP | 0/0 | + +## 说明 + +- 本报告只输出角色、HTTP 状态、脱敏账号和摘要计数，不输出密码、token、Secret、完整账号、合同正文、票据内容或原始 payload。 +- 409 表示功能门禁关闭且未泄露数据；对财务/AP/付款等冻结或受控功能可作为可解释拒绝。 diff --git a/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-summary.md b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-summary.md new file mode 100644 index 00000000..7d25a8db --- /dev/null +++ b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-summary.md @@ -0,0 +1,53 @@ +# 前端降噪审计修复部署复检摘要 + +## 结论 + +`READY_WITH_FINDINGS` + +公网试运行环境已部署到本地 `main` 当前提交 `13643e3`，该提交包含前端审计修复提交 `7b6e705`。本次部署使用 `SYNC_ENV=0 bash deploy/trialrun/deploy.sh`，未同步或覆盖远端 `.env`。 + +权限矩阵结论为 `PASS_WITH_FINDINGS`，finding 为本地缺少 7 个角色的 live 凭据，角色登录与探针均按脚本规则 SKIP；报告未记录权限断言失败。live smoke 和真实 OCR 也因缺少完整凭据或 PDF 样票按脚本规则 SKIP。其余本地门禁、部署脚本、公网 `/ready`、资源文案扫描、PC 只读视觉、移动入口矩阵、企业微信渲染矩阵和聚焦审计入口用例均通过。 + +## 部署前门禁 + +- `cd client && npm run typecheck`：PASS +- `cd client && npm run build`：PASS +- `node scripts/qa/check-ui-design-rules.mjs`：PASS +- `node deploy/trialrun/validate-env-contract.js`：PASS +- `python3 ./.trellis/scripts/task.py validate 05-29-frontend-audit-fixes-deploy-verify`：PASS +- `node scripts/qa/check-trellis-governance.mjs`：PASS +- `git diff --check`：PASS + +## 部署结果 + +- 命令：`SYNC_ENV=0 bash deploy/trialrun/deploy.sh` +- 结果：PASS +- `.env`：安全模式跳过同步，未覆盖远端 `.env` +- migration：无待执行 migration +- 部署脚本自带检查：契约校验、`/ready`、external deps smoke、runtime smoke、公网前端资源文案扫描均完成 +- 非阻断提示：同步阶段提示一个历史 `artifacts/qa-flow` 目录未删除；脚本继续并最终部署成功 + +## 部署后验证 + +- live smoke / OCR readiness：PASS；live smoke 与真实 OCR 因缺少完整凭据或 PDF 样票 SKIP + - 报告：`.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/summary.json` +- OA 权限矩阵：`PASS_WITH_FINDINGS`；7 个角色因缺少本地 live 凭据 SKIP，无权限断言失败 + - 报告：`.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-permission-matrix/summary.json` + - 摘要：`.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-permission-matrix/summary.md` +- OAFRONT3 PC 只读视觉矩阵：PASS + - 报告：`artifacts/qa-flow/oafront3-pc-readonly-visual-20260529-150000/summary.json` +- 移动入口矩阵：PASS，6 个用例通过 +- 企业微信移动渲染矩阵：PASS，8 个用例通过 +- Portal 审计日志入口聚焦用例：PASS +- 公网 bundle 补充核验：PASS + - Portal chunk 包含 `/audit-logs` + - 报销详情 chunk 不含旧硬编码日期 `2026-02-08` + - 报销详情 chunk 含今天日期表达式 + - 报销详情 chunk 不含重复状态字样 +- 最终 `node scripts/qa/check-trellis-governance.mjs`：PASS +- 最终 `git diff --check`：PASS + +## 后续建议 + +- 若要把权限矩阵从 `PASS_WITH_FINDINGS` 提升为完全 PASS，需要在本地配置脱敏 live 角色凭据后重跑矩阵。 +- 若要覆盖真实 OCR，需要提供受控 PDF 样票或样票目录后重跑 readiness。 diff --git a/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/task.json b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/task.json new file mode 100644 index 00000000..1d536dcc --- /dev/null +++ b/.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/task.json @@ -0,0 +1,32 @@ +{ + "id": "frontend-audit-fixes-deploy-verify", + "name": "frontend-audit-fixes-deploy-verify", + "title": "前端降噪审计修复部署复检", + "description": "将前端降噪审计修复部署到公网试运行环境，并完成部署后只读复检。", + "status": "in_progress", + "dev_type": null, + "scope": "deployment", + "package": null, + "priority": "P2", + "creator": "shunli", + "assignee": "shunli", + "createdAt": "2026-05-29", + "completedAt": null, + "branch": null, + "base_branch": "main", + "worktree_path": null, + "commit": null, + "pr_url": null, + "subtasks": [], + "children": [], + "parent": null, + "relatedFiles": [ + ".trellis/tasks/archive/2026-05/05-29-frontend-simplification-audit-fixes/", + "deploy/trialrun/deploy.sh", + "scripts/qa/run-live-smoke-readiness.sh", + "scripts/qa/check-oa-permission-matrix.mjs", + "scripts/qa/run-oafront3-pc-readonly-visual.sh" + ], + "notes": "", + "meta": {} +} \ No newline at end of file