归档采购附件安全任务（07-17-purchase-attachment-xss-hardening）

.trellis/tasks/archive/2026-07/07-17-purchase-attachment-xss-hardening/check.jsonl

@@ -2,4 +2,4 @@
 {"file":".trellis/spec/hyb-oa/backend-fastify-prisma.md","reason":"检查后端实现、Prisma 验证和回归覆盖。"}
 {"file":".trellis/spec/hyb-oa/frontend-react-vite-design.md","reason":"检查 Blob 下载、前端构建和聚焦 UI 回归。"}
 {"file":".trellis/spec/hyb-oa/security-privacy.md","reason":"检查文件上传、下载权限、响应头、审计与敏感信息边界。"}
-{"file":".trellis/tasks/07-17-purchase-attachment-xss-hardening/research/attachment-security-design-research.md","reason":"按原始证据复核 P0 链路是否被完整切断。"}
+{"file":".trellis/tasks/archive/2026-07/07-17-purchase-attachment-xss-hardening/research/attachment-security-design-research.md","reason":"按原始证据复核 P0 链路是否被完整切断。"}

.trellis/tasks/archive/2026-07/07-17-purchase-attachment-xss-hardening/implement.jsonl

@@ -2,4 +2,4 @@
 {"file":".trellis/spec/hyb-oa/backend-fastify-prisma.md","reason":"约束 Fastify 路由、Prisma 无漂移验证和后端测试。"}
 {"file":".trellis/spec/hyb-oa/frontend-react-vite-design.md","reason":"保持现有 React/Vite 下载交互与前端验证合同。"}
 {"file":".trellis/spec/hyb-oa/security-privacy.md","reason":"执行业务附件权限、下载审计、私有存储和脱敏边界。"}
-{"file":".trellis/tasks/07-17-purchase-attachment-xss-hardening/research/attachment-security-design-research.md","reason":"提供已确认 XSS 链路、方案比较、历史兼容和复用证据。"}
+{"file":".trellis/tasks/archive/2026-07/07-17-purchase-attachment-xss-hardening/research/attachment-security-design-research.md","reason":"提供已确认 XSS 链路、方案比较、历史兼容和复用证据。"}

.trellis/tasks/archive/2026-07/07-17-purchase-attachment-xss-hardening/task.json

@@ -3,7 +3,7 @@
   "name": "purchase-attachment-xss-hardening",
   "title": "采购附件同源 XSS 安全收口",
   "description": "关闭采购附件任意格式上传、同源 signed URL 与 inline 响应形成的存储型 XSS，改为真实内容校验、私有随机存储和已认证强制下载。",
-  "status": "in_progress",
+  "status": "completed",
   "dev_type": null,
   "scope": "security/purchase-attachment-xss",
   "package": null,
@@ -11,11 +11,11 @@
   "creator": "shunli",
   "assignee": "shunli",
   "createdAt": "2026-07-17",
-  "completedAt": null,
+  "completedAt": "2026-07-17",
   "branch": null,
   "base_branch": "main",
   "worktree_path": null,
-  "commit": null,
+  "commit": "f424492",
   "pr_url": null,
   "subtasks": [],
   "children": [],
@@ -32,6 +32,6 @@
     "client/src/api/purchaseRequests.ts",
     "client/src/pages/PurchaseRequestsPage.tsx"
   ],
-  "notes": "P0 本地实施与质量门禁已完成：采购附件改为严格实际字节校验、随机私有存储、认证强制下载和历史复验；独立只读 reviewer 无剩余 P0/P1，统一门禁 PASS。待按 Phase 3.4 提交计划确认后提交；未连接业务数据库、读取真实附件、部署、push 或修改公网配置。",
+  "notes": "P0 本地实施与质量门禁已完成，工作提交 f424492：采购附件改为严格实际字节校验、随机私有存储、认证强制下载和历史复验；独立只读 reviewer 无剩余 P0/P1，统一门禁 PASS。未连接业务数据库、读取真实附件、部署、push 或修改公网配置。",
   "meta": {}
 }