WREMOTE1 完成远端收口验证

scripts/qa/run-three-day-full-goal-smoke.sh

@@ -305,8 +305,8 @@ write_manual_checklist() {
 
 ## Day 2
 - SMOKE002：继续按企微规则打卡。
-- HYD000006：检查请假、补卡、外出、加班四类模板审批规则。
-- WAPPR1 选项：A 审批人自动带出且申请人不能任意选择；B 默认带出但申请人仍可改人；C 必须申请人手选；D 当前看不到或模板未配置。只有 A 放行。
+- HYD000006：已在 2026-05-21 真机确认请假、补卡、外出、加班四类模板均为 A。
+- WAPPR1 当前结论：A 审批人自动带出且申请人不能任意选择；申请人不能删除、改人或新增审批人。若后续模板配置变化，B/C/D 均重新阻断 WEXT1-FORMAL 和 WREAL1。
 - 小团队规则：公司不到 10 人，默认一层直属主管或指定审批角色自动带出审批人；主管链缺失、审批人不可见/停用/未绑定或命中自审时，由管理员兜底或阻断。
 
 ## Day 3
@@ -437,9 +437,9 @@ const manualGates = [
   },
   {
     id: "WAPPR1",
-    status: "PENDING_MANUAL_CONFIRMATION",
+    status: "PASS_APPROVER_RULES_READY",
     owner: "HYD000006",
-    requiredEvidence: "四类模板均为 A：一层主管/指定审批角色自动带出，申请人不能任意选择；缺主管/不可用/自审时管理员兜底或阻断",
+    requiredEvidence: "2026-05-21 用户真机确认请假、补卡、外出、加班均为 A：审批人自动带出，申请人不能删除、改人或新增审批人",
   },
   {
     id: "WEXT1-FORMAL",
@@ -466,6 +466,7 @@ if (Number(statusInput || 0) !== 0 || findings.some((item) => item.severity ===
 
 const summary = {
   issueId: "WFULLSMOKE1",
+  routeIssueId: "WFULLSMOKE2",
   mode: "three-day-full-goal-smoke",
   status,
   conclusion: status,

scripts/qa/run-wecom-test-account-final-closeout.sh

@@ -213,8 +213,9 @@ run_wrule1() {
 run_privacy_smoke() {
   local sensitive_pattern='(["'\'']?(WECOM_[A-Z0-9_]*(SECRET|TOKEN)|[A-Z0-9_]*(TOKEN|SECRET|PASSWORD|ENCODING_AES_KEY|ENCODINGAESKEY|CORP_SECRET|ACCESS_TOKEN)[A-Z0-9_]*)["'\'']?[[:space:]]*[:=][[:space:]]*["'\'']?[A-Za-z0-9._:/+=-]{8,}["'\'']?)|Authorization:[[:space:]]*Bearer[[:space:]]+[A-Za-z0-9._-]{8,}|access_token=[A-Za-z0-9._-]{8,}|1[3-9][0-9]{9}|[[:alnum:]._%+-]+@[[:alnum:].-]+\.[[:alpha:]]{2,}|-----BEGIN|BEGIN [A-Z ]*KEY|"[^"]*(token|secret|password|encodingAESKey|encoding_aes_key|sp_no|spNo|template_id|templateId|userid|userId|external_userid|externalUserId|external_user_id)[^"]*"[[:space:]]*:[[:space:]]*"[^"]{8,}"|\b20[0-9]{12,}\b|"(raw|rawPayload|raw_payload|payload|xml|ciphertext|Encrypt|formValue|formValues|attachments|comments)"[[:space:]]*:'
   local safe_metadata_pattern='"[^"]*(secret|token)[^"]*"[[:space:]]*:[[:space:]]*"WECOM_[A-Z0-9_]*(SECRET|TOKEN)([[:space:]]|["]|$)|"[^"]*(secret|token)[^"]*"[[:space:]]*:[[:space:]]*"WECOM_[A-Z0-9_]*(SECRET|TOKEN)[^"]*(source|path|read paths|fallback)'
+  local safe_redacted_prefix_pattern='"[^"]*(sp_no|spNo|template_id|templateId|userid|userId|external_userid|externalUserId|external_user_id)[^"]*Prefixes?"[[:space:]]*:[[:space:]]*"[^"]{1,16}\*\*\*[^"]{0,8}"'
   local matches
-  matches="$(grep -RInEi "$sensitive_pattern" "$REPORT_DIR" | grep -vE 'HRWDTEST-[0-9]{14}' | grep -vEi "$safe_metadata_pattern" || true)"
+  matches="$(grep -RInEi "$sensitive_pattern" "$REPORT_DIR" | grep -vE 'HRWDTEST-[0-9]{14}' | grep -vEi "$safe_metadata_pattern" | grep -vEi "$safe_redacted_prefix_pattern" || true)"
   if [[ -n "$matches" ]]; then
     printf '%s\n' "$matches"
     log "[wtclose2][FAIL] report-privacy-smoke matched sensitive pattern"