wangsli/hyb-oa
1
0
派生 0
代码 工单 合并请求 工作流 8 软件包 项目 发布 百科 活动

OMAT1 补充成熟度对标基线

浏览代码
这个提交包含在：
wangsli
2026-05-23 17:42:35 +08:00
父节点 c954ce1932
当前提交 4fac218db6
共修改 4 个文件，包含 5 行新增和 3 行删除
下载 Patch 文件 下载 Diff 文件 展开所有文件 折叠所有文件
.agents/skills/hyb-oa-delivery/SKILL.md
+1 -1
查看文件
@@ -29,7 +29,7 @@ Read only what is relevant:
- ASSET1 is the current unified asset registry lane after OAOPS1: reuse the existing asset module for fixed assets plus electronic document/system/repository/backup asset metadata. Number families are `FA-YYYY-NNNNNN`, `EA-DOC-YYYY-NNNNNN`, `EA-SYS-YYYY-NNNNNN`, `EA-REPO-YYYY-NNNNNN`, and `EA-BKP-YYYY-NNNNNN`; `VER-NNNNN` is historical lookup only. `EA-ACC` is deferred: never store passwords, token, Secret, private keys, source bundles, full config, confidential document bodies, complete local paths, sensitive quotes, bank statement originals, or raw invoice images in OA, repo docs, chat, or reports. Git remains the source of truth for code; OA only stores repository metadata and responsibility. Historical company directory imports may only use redacted metadata from `00_保密索引`, default dry-run, with sensitive text/path guards.
- OSMOKE1 is the current OA-only smoke account governance lane after ASSET1D/OAOPS1 blockers: do not request more Enterprise WeChat accounts just to test OA-primary reimbursement/assets/finance/AP/contracts/permissions. Enterprise WeChat smoke accounts remain for HR/attendance evidence; admin/finance/hr/ceo OA regression accounts are OA-only smoke accounts and may be active in OA without WeCom binding. Use `npm run repair:oa-only-smoke` from `server/` for dry-run first; apply requires `--apply` plus `OA_ONLY_SMOKE_REPAIR_APPLY=1`, must not reset passwords, print secrets, affect real employees, or write WeCom. `audit-wecom-oa-user-consistency` classifies env-listed, explicit allowlisted, or `SMOKE*`/`smoke-*`/test-named OA-only smoke accounts as `oaOnlySmokeExempted` so they are not archived as missing in WeCom; `run-oa-real-use-daily.sh` includes OA-only smoke readiness before asset/finance UI automation.
- OALAUNCH1 is the current final-enable gate after OAOPS1/ASSET1D/OSMOKE1: do not treat ASSET1D completion or `PASS_OA_REAL_USE_DAILY_READY` as final launch approval. Use `scripts/qa/run-oa-final-launch-readiness.sh` to aggregate evidence only; it must not create business data, execute payments, write WeCom, reset/restore the production DB, print secrets, or mark final launch ready without real business closeout, 7-day stabilization, permission matrix acceptance, backup/restore drill evidence, data-governance/training acceptance, and Day 7 Go/No-Go. Valid conclusions are `PASS_OA_LAUNCH_READY`, `PASS_WITH_FINDINGS`, `PAUSED_MANUAL_CONFIRMATION`, and `SKIP/BLOCKED_BY_EXTERNAL_CONFIG`. Permission or backup/restore fixes require read-only reviewer review before launch acceptance.
- OMAT1 is the current maturity-gap review goal after OALAUNCH1: use `issues/2026-05-23_17-20-00-oa-maturity-gap-review-v1.csv` as the reviewable ledger for every problem or suggestion. Follow the MAGI cycle wording as audit structure only: review/evaluate first, record or solve bounded evidence gaps second, then prioritize direction. Do not implement OMAT1 suggestions until the user chooses adopt/defer/reject and a proper Issue CSV exists for the adopted work.
- OMAT1 is the current maturity-gap review goal after OALAUNCH1: use `issues/2026-05-23_17-20-00-oa-maturity-gap-review-v1.csv` as the reviewable ledger for every problem or suggestion. It includes domestic benchmark sources and the small-team rule that maturity means controlled operation before feature breadth. Follow the MAGI cycle wording as audit structure only: review/evaluate first, record or solve bounded evidence gaps second, then prioritize direction. Do not implement OMAT1 suggestions until the user chooses adopt/defer/reject and a proper Issue CSV exists for the adopted work.
- WEGOV1 changes the current WeCom route to "Enterprise WeChat owns mature HR/attendance flows; OA stores self-owned history, audit, entry, messages, and emergency fallback." Treat four domains explicitly: WeCom-owned domain is check-in, leave, missed punch, outing, overtime, leave balance, and HR assistant; OA-owned domain remains reimbursement, procurement, contracts, projects, payments, invoices, bank receipts, sensitive attachments, and operating audit; OA archive domain stores WeCom business history, full external keys, and necessary snapshots; OA emergency domain is manually enabled only when WeCom is unavailable. Do not assume a full isolated WeCom sandbox; use the controlled test domain `SMOKE002 -> SMOKE101`, `OA-POC` templates, low-risk approvals, synthetic tests, public live runners, and limited real-device confirmation. WARCH1 now supplies the minimum leave/missed-punch archive implementation, WARCH2 supplies the formal read-only history query surface, and WROAD2 supplies controlled ops daily checks. Do not start deep mirror until WROAD2-CLOSEOUT, WROAD2-BIZ1, WAPPR1, WRULE1, WAUTO1/WEXT1LD, WFULLSMOKE1, WTCLOSE2, WEXT1-FORMAL, WREAL1 question gates or explicit approval, and the mirror stage's own contract are complete.
- For reimbursement, invoice, OCR, duplicate invoice, or attachment work, read `docs/报销发票附件规则.md` and `references/reimbursement.md`.
- For local/WeCom/public trial-run, OCR runtime, Caddy, or DB drift work, read `docs/试运行与自动化验证手册.md` and `references/trialrun.md`.
docs/文档事实源状态矩阵.md
+1 -1
查看文件
@@ -112,7 +112,7 @@
| `ASSET1` | `issues/2026-05-22_21-18-33-oa-asset-governance-v1.csv` | `CURRENT` | 当前统一资产台账 V1 合同：复用现有资产模块统一管理固定资产和电子资产索引；编号族为 `FA/EA-DOC/EA-SYS/EA-REPO/EA-BKP`，`EA-ACC` 暂缓；代码仓库由 Git 管源码，OA 只登记元数据；历史公司目录只允许脱敏索引 dry-run 或受控写入 |
| `OSMOKE1` | `issues/2026-05-23_13-59-52-oa-only-smoke-account-governance-v1.csv` | `CURRENT` | 当前 OA-only smoke 账号治理合同：企微账号有限时不再为 OA 全域自动化额外申请企微账号；admin/finance/hr/ceo 等回归账号作为 OA-only smoke，可不绑定企微；新增修复脚本、`oaOnlySmokeExempted` 审计豁免和公网角色 readiness 检查，豁免命中限于私有 env、显式员工号 allowlist 或 `SMOKE*`/`smoke-*`/测试命名；默认 dry-run，真实修复需 `OA_ONLY_SMOKE_REPAIR_APPLY=1` |
| `OALAUNCH1` | `issues/2026-05-23_16-49-39-oa-final-launch-readiness-v1.csv` | `CURRENT` | 当前最终启用前收口与 Go/No-Go 门禁合同：在 OAOPS1/ASSET1D/OSMOKE1 之上增加真实业务闭环、7 天稳定化、权限矩阵、备份恢复演练、数据治理培训、运营支持和 Day 7 人工决策；新增 `scripts/qa/run-oa-final-launch-readiness.sh` 默认只读汇总证据；未达到 `PASS_OA_LAUNCH_READY` 前不得宣布最终正式启用完成 |
| `OMAT1` | `issues/2026-05-23_17-20-00-oa-maturity-gap-review-v1.csv` | `CURRENT` | 当前成熟度缺口审查台账：按 MAGI 审视/执行/提升轮次调查 hyb-oa 是否成熟，并对标国内主流 OA/协同/低代码/财务/资产系统；所有问题和建议先记录为待用户采纳、暂缓或否决，不直接改业务代码 |
| `OMAT1` | `issues/2026-05-23_17-20-00-oa-maturity-gap-review-v1.csv` | `CURRENT` | 当前成熟度缺口审查台账：按 MAGI 审视/执行/提升轮次调查 hyb-oa 是否成熟，并对标国内主流 OA/协同/低代码/财务/资产系统；已补充国内对标来源和小团队取舍原则；所有问题和建议先记录为待用户采纳、暂缓或否决，不直接改业务代码 |
| `WREAL1-PREP` | `issues/2026-05-20_14-35-42-wecom-real-trial-prep-v1.csv` | `CURRENT` | 真实小范围试用准备合同：只固化候选员工、非自审审批人、回滚联系人、允许流程、暂停条件和验收标准；当前不启用真实员工，真实试用必须等请假/补卡/外出/加班四类测试号证据、WAPPR1 审批规则门禁和 WFULLSMOKE1 全域主路径可解释通过后再问 |
旧 Issue CSV 保留为历史审计证据：不删除、不批量回写、不移动到 `docs/archive/` 或其他归档目录。新连续合同如替代旧合同，只在新合同 `Notes` 或文档索引中说明 supersedes。
docs/文档索引.md
+1 -1
查看文件
@@ -173,7 +173,7 @@ R6 -> PC6 -> PA6 -> FL6 -> AP6 -> RI6 -> LP6 -> ME6/QG6 -> DG7/MRF7 -> MIA7 -> M
| `ASSET1` | `issues/2026-05-22_21-18-33-oa-asset-governance-v1.csv` | 当前统一资产台账 V1：电子资产 + 固定资产共用现有资产模块 | 扩展 `AssetCard` 为 `FA/EA-DOC/EA-SYS/EA-REPO/EA-BKP`，新增资产大类、敏感级别、负责人/保管人、归档位置、外部引用、hash、历史验证编号、最近验证时间和脱敏索引 dry-run；前端资产页支持类型/敏感级别/编号搜索 | 代码仓库仍由 Git 管理；`EA-ACC` 暂缓；不保存密码、token、Secret、源码包、完整配置、涉密正文、真实完整路径、敏感报价、银行流水原件或未脱敏票面 |
| `OSMOKE1` | `issues/2026-05-23_13-59-52-oa-only-smoke-account-governance-v1.csv` | 当前 OA-only smoke 账号治理：恢复公网 OA 自动化高权限测试账号，不再额外申请企微账号 | 新增 OA-only smoke 修复脚本、企微/OA 一致性审计豁免 `oaOnlySmokeExempted`、公网角色 readiness 检查，并接入 OAOPS1 每日巡检 | 只处理私有 env、显式员工号 allowlist 或 `SMOKE*`/`smoke-*`/测试命名命中的 smoke 标识；默认 dry-run，apply 必须 `OA_ONLY_SMOKE_REPAIR_APPLY=1`；不写企业微信、不重置密码、不影响真实员工、不执行 EA-DOC live 导入 |
| `OALAUNCH1` | `issues/2026-05-23_16-49-39-oa-final-launch-readiness-v1.csv` | 当前最终启用前收口与 Go/No-Go 门禁：在 OAOPS1/ASSET1D 之上增加业务闭环、权限、备份恢复、数据治理、培训和 Day 7 决策 | 新增 `scripts/qa/run-oa-final-launch-readiness.sh`，默认只读聚合 OAOPS1、ASSET1D、权限矩阵、备份恢复演练和人工 Go/No-Go 证据，输出 `PASS_OA_LAUNCH_READY` / `PASS_WITH_FINDINGS` / `PAUSED_MANUAL_CONFIRMATION` / `SKIP/BLOCKED_BY_EXTERNAL_CONFIG` | 不创建业务数据、不执行付款、不写企业微信、不恢复数据库；未达到 `PASS_OA_LAUNCH_READY` 前不得宣布最终正式启用完成 |
| `OMAT1` | `issues/2026-05-23_17-20-00-oa-maturity-gap-review-v1.csv` | 当前成熟度缺口审查台账：按 MAGI 审视/执行/提升轮次，对标国内主流 OA、协同、低代码、财务和资产系统，记录每个问题或建议供用户逐项采纳、暂缓或否决 | 已登记最终启用、真实业务闭环、权限、备份恢复、运营支持、流程配置、报表、财务月结、合同、采购、资产、HR 镜像、移动体验、数据治理、SLO、集成、知识档案、主数据、UX 和 AI 边界等候选项 | 本台账只做审查和决策，不直接触发业务代码实现；采纳项必须另建或延续对应 Issue CSV，并满足 OALAUNCH1 门禁 |
| `OMAT1` | `issues/2026-05-23_17-20-00-oa-maturity-gap-review-v1.csv` | 当前成熟度缺口审查台账：按 MAGI 审视/执行/提升轮次，对标国内主流 OA、协同、低代码、财务和资产系统，记录每个问题或建议供用户逐项采纳、暂缓或否决 | 已登记最终启用、真实业务闭环、权限、备份恢复、运营支持、流程配置、报表、财务月结、合同、采购、资产、HR 镜像、移动体验、数据治理、SLO、集成、知识档案、主数据、UX、AI 边界、国内对标来源和小团队取舍原则等候选项 | 本台账只做审查和决策，不直接触发业务代码实现；采纳项必须另建或延续对应 Issue CSV，并满足 OALAUNCH1 门禁 |
| `WREAL1-PREP` | `issues/2026-05-20_14-35-42-wecom-real-trial-prep-v1.csv` | 当前真实试用准备：不启用真实员工 | 固化候选员工、非自审审批人、回滚联系人、允许流程、暂停条件和验收标准；真实试用必须等请假、补卡、外出、加班四类测试号证据、WAPPR1 和 WFULLSMOKE1 通过后再问 | 当前不创建外出/加班 live 样件；真实员工名单不写入 Issue 或文档，后续通过问答确认 |
旧 Issue CSV 不删除、不批量回写、不移动到归档目录。若新治理流替代旧合同，只在新 CSV 的 `Notes` 或本索引说明 supersedes，旧文件保留历史审计语义。
issues/2026-05-23_17-20-00-oa-maturity-gap-review-v1.csv
+2
查看文件
@@ -21,3 +21,5 @@
"OMAT1-19","角色工作台和菜单降噪还可继续打磨","当前导航和移动入口已多轮整改，但成熟 OA 对员工、审批人、财务、管理员、CEO 的首页任务密度、入口优先级和异常提示仍可继续按真实频次优化。","用户决定是否进入 UX 优化合同；只根据 7 天真实使用频次和反馈调整，不凭主观重排。","受影响流程：登录工作台 -> 查看待办/摘要 -> 进入高频动作；验证步骤：收集 7 天访问和人工反馈后再拆 UX Issue。","manual|playwright","TODO","TODO","TODO","client/src/features/navigation/schema.ts;client/src/pages/PortalHomePage.tsx;client/src/pages/MobilePortalPage.tsx","[""OMAT1-13""]","优先级 P2；建议暂缓到真实反馈后。对标飞书/钉钉只学信息层级，不复制视觉。"
"OMAT1-20","AI/自动化建议只能作为辅助，不宜进入核心写操作","国内产品已普遍宣传 AI 助理、智能审批、智能报表，但 hyb-oa 当前真实启用阶段更需要稳定、审计和恢复；AI 可用于草拟、解释和报告，不应直接改规则或业务数据。","用户决定 AI 范围：A 仅用于报告解释/草拟制度，B 扩到 dry-run 规则建议，C 暂不启用；任何写入必须另建合同和人工批准。","受影响流程：报告生成 -> AI 摘要/建议 -> 人工确认 -> 后续合同；验证步骤：审查输出不含隐私、Secret、原始票据、合同正文或银行流水。","manual","TODO","TODO","TODO","server/src/routes/ai.js;docs/产品口径.md","[""OMAT1-14""]","优先级 P2；建议当前只允许只读解释和草拟，不允许自动写业务规则。"
"OMAT1-21","成熟度审查需要轮次化复盘","本次只完成第一轮审视和初始台账；后续应按 MAGI 大轮次持续审视、执行、提升，把用户采纳项转成独立 Issue CSV，把否决项保留原因。","每轮复盘更新 OMAT1 Notes 或新建下一版成熟度合同；用户审查后每个条目有 A/B/C 决策。","受影响流程：审视问题 -> 用户评审 -> 采纳项进入合同 -> 执行验证 -> 下一轮提升；验证步骤：用户逐行审查后回填决策。","manual","TODO","TODO","TODO","issues/2026-05-23_17-20-00-oa-maturity-gap-review-v1.csv","[""OMAT1-0""]","优先级 P0；建议采纳。不要把建议直接变成开发，先用决策门禁控范围。"
"OMAT1-22","国内对标来源需要固化为后续评审基线","本轮调研对标泛微 e-cology/e-office、致远 A8、钉钉宜搭、飞书审批/假勤/多维表格、金蝶精斗云/云星辰、用友 BIP/畅捷通等方向；成熟系统共同点是门户、流程、表单、报表、财务、合同、项目、资产、权限、移动端、集成和审计形成闭环。","后续每次提出成熟度建议时必须标明是 P0 启用门禁、P1 近期增强还是 P2 后置能力；不得只因竞品存在某功能就直接进入开发。","受影响流程：外部对标 -> 内部差距识别 -> 用户采纳/暂缓/否决 -> Issue CSV；验证步骤：用户审查本行 Notes 中的来源和分类后，采纳项另建合同。","web|manual","TODO","TODO","TODO","issues/2026-05-23_17-20-00-oa-maturity-gap-review-v1.csv","[""OMAT1-0""]","优先级 P0；建议采纳为评审方法。官方来源示例：https://www.weaver.com.cn/e9/；https://www.weaver.com.cn/subpage/e-cology/form.asp；https://www.seeyon.com/home/Tiyan/index.html；https://docs.aliwork.com/docs/yida_support/wtwabe；https://dingtalk-yida.github.io/developer-site/docs/guide/about/；https://www.feishu.cn/hc/zh-CN/articles/360033971554-飞书审批管理员手册；https://www.feishu.cn/hc/zh-CN/articles/337377280090-管理员设置考勤组；https://www.kingdee.com/product/jdy；https://www.kingdee.com/product/stellar_finance.html；https://www.yonyou.com/。"
"OMAT1-23","小团队成熟度不应照搬大型 OA 套件","公司不到 10 人，成熟度目标应优先保证真实业务闭环、权限、审计、备份恢复、问题响应和资料边界；泛微/致远/用友/金蝶等大型套件的复杂 BPM、深度集成、预算、ERP、银行流水、AI 自动写规则不应成为启用前阻断。","用户确认小团队 V1 成熟度定义：P0 必须完成 OALAUNCH1；P1 只做真实使用证明高价值的增强；P2 保持冻结或另行调研。","受影响流程：成熟度定义 -> 优先级排序 -> 开发节奏 -> Go/No-Go；验证步骤：Day 7 Go/No-Go 时按 P0/P1/P2 分类复核，不以大型套件功能完整度否定小团队上线。","manual","TODO","TODO","TODO","docs/产品口径.md;docs/集成边界.md;issues/2026-05-23_16-49-39-oa-final-launch-readiness-v1.csv","[""OMAT1-22""]","优先级 P0；建议采纳。原则：先像成熟系统一样可控运行，再逐步补齐高频真实缺口；不要为了看起来完整而引入维护成本。"
1 ID Title Description Acceptance Test_Method Tools Dev_Status Review1_Status Regression_Status Files Dependencies Notes
21 OMAT1-19 角色工作台和菜单降噪还可继续打磨 当前导航和移动入口已多轮整改，但成熟 OA 对员工、审批人、财务、管理员、CEO 的首页任务密度、入口优先级和异常提示仍可继续按真实频次优化。 用户决定是否进入 UX 优化合同；只根据 7 天真实使用频次和反馈调整，不凭主观重排。 受影响流程：登录工作台 -> 查看待办/摘要 -> 进入高频动作；验证步骤：收集 7 天访问和人工反馈后再拆 UX Issue。 manual|playwright TODO TODO TODO client/src/features/navigation/schema.ts;client/src/pages/PortalHomePage.tsx;client/src/pages/MobilePortalPage.tsx ["OMAT1-13"] 优先级 P2；建议暂缓到真实反馈后。对标飞书/钉钉只学信息层级，不复制视觉。
22 OMAT1-20 AI/自动化建议只能作为辅助，不宜进入核心写操作 国内产品已普遍宣传 AI 助理、智能审批、智能报表，但 hyb-oa 当前真实启用阶段更需要稳定、审计和恢复；AI 可用于草拟、解释和报告，不应直接改规则或业务数据。 用户决定 AI 范围：A 仅用于报告解释/草拟制度，B 扩到 dry-run 规则建议，C 暂不启用；任何写入必须另建合同和人工批准。 受影响流程：报告生成 -> AI 摘要/建议 -> 人工确认 -> 后续合同；验证步骤：审查输出不含隐私、Secret、原始票据、合同正文或银行流水。 manual TODO TODO TODO server/src/routes/ai.js;docs/产品口径.md ["OMAT1-14"] 优先级 P2；建议当前只允许只读解释和草拟，不允许自动写业务规则。
23 OMAT1-21 成熟度审查需要轮次化复盘 本次只完成第一轮审视和初始台账；后续应按 MAGI 大轮次持续审视、执行、提升，把用户采纳项转成独立 Issue CSV，把否决项保留原因。 每轮复盘更新 OMAT1 Notes 或新建下一版成熟度合同；用户审查后每个条目有 A/B/C 决策。 受影响流程：审视问题 -> 用户评审 -> 采纳项进入合同 -> 执行验证 -> 下一轮提升；验证步骤：用户逐行审查后回填决策。 manual TODO TODO TODO issues/2026-05-23_17-20-00-oa-maturity-gap-review-v1.csv ["OMAT1-0"] 优先级 P0；建议采纳。不要把建议直接变成开发，先用决策门禁控范围。
24 OMAT1-22 国内对标来源需要固化为后续评审基线 本轮调研对标泛微 e-cology/e-office、致远 A8、钉钉宜搭、飞书审批/假勤/多维表格、金蝶精斗云/云星辰、用友 BIP/畅捷通等方向；成熟系统共同点是门户、流程、表单、报表、财务、合同、项目、资产、权限、移动端、集成和审计形成闭环。 后续每次提出成熟度建议时必须标明是 P0 启用门禁、P1 近期增强还是 P2 后置能力；不得只因竞品存在某功能就直接进入开发。 受影响流程：外部对标 -> 内部差距识别 -> 用户采纳/暂缓/否决 -> Issue CSV；验证步骤：用户审查本行 Notes 中的来源和分类后，采纳项另建合同。 web|manual TODO TODO TODO issues/2026-05-23_17-20-00-oa-maturity-gap-review-v1.csv ["OMAT1-0"] 优先级 P0；建议采纳为评审方法。官方来源示例：https://www.weaver.com.cn/e9/；https://www.weaver.com.cn/subpage/e-cology/form.asp；https://www.seeyon.com/home/Tiyan/index.html；https://docs.aliwork.com/docs/yida_support/wtwabe；https://dingtalk-yida.github.io/developer-site/docs/guide/about/；https://www.feishu.cn/hc/zh-CN/articles/360033971554-飞书审批管理员手册；https://www.feishu.cn/hc/zh-CN/articles/337377280090-管理员设置考勤组；https://www.kingdee.com/product/jdy；https://www.kingdee.com/product/stellar_finance.html；https://www.yonyou.com/。
25 OMAT1-23 小团队成熟度不应照搬大型 OA 套件 公司不到 10 人，成熟度目标应优先保证真实业务闭环、权限、审计、备份恢复、问题响应和资料边界；泛微/致远/用友/金蝶等大型套件的复杂 BPM、深度集成、预算、ERP、银行流水、AI 自动写规则不应成为启用前阻断。 用户确认小团队 V1 成熟度定义：P0 必须完成 OALAUNCH1；P1 只做真实使用证明高价值的增强；P2 保持冻结或另行调研。 受影响流程：成熟度定义 -> 优先级排序 -> 开发节奏 -> Go/No-Go；验证步骤：Day 7 Go/No-Go 时按 P0/P1/P2 分类复核，不以大型套件功能完整度否定小团队上线。 manual TODO TODO TODO docs/产品口径.md;docs/集成边界.md;issues/2026-05-23_16-49-39-oa-final-launch-readiness-v1.csv ["OMAT1-22"] 优先级 P0；建议采纳。原则：先像成熟系统一样可控运行，再逐步补齐高频真实缺口；不要为了看起来完整而引入维护成本。