From c119183da67f870ac3a441bdfa35637629ff59cc Mon Sep 17 00:00:00 2001 From: shunli Date: Thu, 21 May 2026 00:35:10 +0800 Subject: [PATCH] =?UTF-8?q?WRULE1=20=E5=AE=9E=E7=8E=B0=E4=BC=81=E5=BE=AE?= =?UTF-8?q?=E5=AE=A1=E6=89=B9=E9=93=BE=E6=A0=A1=E9=AA=8C=E5=99=A8=20POC?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .agents/skills/hyb-oa-delivery/SKILL.md | 8 +- docs/trialrun/人工试运行报告.md | 19 +- docs/企微API能力目录.md | 10 +- docs/企微优先开发路线图.md | 27 +- docs/文档事实源状态矩阵.md | 7 +- docs/文档索引.md | 3 +- docs/管理员手册.md | 3 +- docs/需求-统一审批中心规约.md | 16 +- ...15-wecom-hr-approval-rule-validator-v1.csv | 9 + server/package.json | 1 + .../check-wecom-approval-rule-validator.js | 454 ++++++++++++++++++ .../wecomApprovalRuleValidator.js | 331 +++++++++++++ ...heck-wecom-approval-rule-validator.test.js | 188 ++++++++ .../wecomApprovalRuleValidator.test.js | 178 +++++++ 14 files changed, 1225 insertions(+), 29 deletions(-) create mode 100644 issues/2026-05-20_23-56-15-wecom-hr-approval-rule-validator-v1.csv create mode 100644 server/src/scripts/check-wecom-approval-rule-validator.js create mode 100644 server/src/services/integrations/wecomApprovalRuleValidator.js create mode 100644 server/tests/unit/scripts/check-wecom-approval-rule-validator.test.js create mode 100644 server/tests/unit/services/wecomApprovalRuleValidator.test.js diff --git a/.agents/skills/hyb-oa-delivery/SKILL.md b/.agents/skills/hyb-oa-delivery/SKILL.md index 93bc0b5e..d5d3d136 100644 --- a/.agents/skills/hyb-oa-delivery/SKILL.md +++ b/.agents/skills/hyb-oa-delivery/SKILL.md @@ -19,8 +19,8 @@ Read only what is relevant: - For any Enterprise WeChat capability, Secret, callback, approval, check-in, HR assistant, or contact-directory task, read `docs/企微API能力目录.md` before planning or coding. WAPI fixes the current Secret matrix: contacts use `WECOM_CONTACT_SECRET`; workbench/OAuth/messages/HR assistant/roster/check-in/approval use `WECOM_AGENT_SECRET`; `WECOM_CHECKIN_SECRET` is only an explicit check-in override; `WECOM_HR_ASSISTANT_SECRET` is historical compatibility and not a default. Do not write runtime code that tries multiple Secrets to guess the correct one. - For Enterprise WeChat-first HR/attendance runtime migration, read `docs/企微优先开发路线图.md` before planning or coding. WDRG makes the roadmap authoritative for stage order; WAPI adds the runtime-first stage before deep mirror work; WRRA states that WOUA `PASS_WITH_FINDINGS` does not clear deep mirror work; WOUA-FIX has now soft-archived the 7 OA active test accounts missing in WeCom, fixed the `T0000` seed reactivation behavior, transferred the `SMOKE201` test-manager side effects, and rerun WOUA with `oaActiveMissingInWecom=0`. WCPC has rerun the capability POC with an existing active test account and reached `GO_TO_HR_MASTER_SYNC`; WHMS/WHMSLIVE has implemented, deployed, and publicly verified `wecom_hr_master_sync_v1`, with the production flag restored to `force_off` and production real-employee batch apply not approved. WMSG1 proves real app-message delivery and Deeplink return only; WAPC1 fixes the approval configuration preparation checklist before mirror work; WAPC2 adds the leave/missed-punch approval template and low-risk `sp_no` read-only POC runner. WPROC1/WPROC2 fixed the engineering process gate; WEGOV1 is the route gate, and WACP3R has now rerun the compensation-pull POC by automatically discovering OA-POC leave/missed-punch template IDs from `SMOKE002` creator. Public report `/app/artifacts/qa-flow/wecom-approval-compensation-poc-20260519T115944Z/summary.json` is `PASS_WITH_FINDINGS`: compensation pull and detail read work, with finding that callback evidence files are not persisted across deploys. WREAD1/WREAD1F have now completed real-device readability confirmation for leave and missed-punch: public report `/app/artifacts/qa-flow/wecom-approval-readability-gate-20260519T133628Z/summary.json` is `PASS_READABLE`; the user confirmed cards/lists/details are readable, reject has second confirmation, and approve is single-tap. WADM1 has completed the self-owned archive/mirror data-model design. WARCH1 has implemented and publicly verified the minimum leave/missed-punch archive slice: Prisma archive/callback/compensation/finding tables, callback DB persistence with non-200 retry on DB failure, compensation persistence behind `--persist-to-db` + `WECOM_ARCHIVE_WRITE=1`, and offline `npm run check:wecom-approval-archive`; public reports `/app/artifacts/qa-flow/wecom-approval-compensation-poc-20260519T160306Z/summary.json` and `/app/artifacts/qa-flow/wecom-approval-archive-20260519T160330Z/summary.json` are `PASS_WITH_FINDINGS`, with 2 archived histories readable and only a historical pre-WARCH1 callback gap finding. WARCH2 has now added the formal OA read-only archive API/page: `/api/wecom/approval-archive`, `/wecom-approval-archive`, and `/mobile/wecom-approval-archive` read OA DB only, do not call WeCom API or read WeCom Secrets, and enforce self/direct-report/HR-admin visibility with unmapped applicant records HR/admin-only. WROAD2+OPS is the controlled launch gate: use test accounts `SMOKE002 -> SMOKE101`, observe/admin-alert via employee_no `HYD000006` (the employee id for `wangshunli`), run daily checks for 3 days, allow only compensation archive writes to OA DB via `WECOM_ARCHIVE_WRITE=1`, and do not create WeCom templates/approvals, write WeCom, or expand real users. Day 0 public report `/app/artifacts/qa-flow/wroad2-ops-20260520-041941/summary.json` is `PASS_WITH_FINDINGS`: WeCom runtime, compensation archive persistence, offline archive read, and privacy smoke pass; findings are missing live-smoke login credentials/pending OCR subcheck and historical callback gap. It still does not implement full mirror, outing/overtime live, emergency mode, writeback, or RuleOps. WAUTO1 adds `scripts/qa/collect-wecom-controlled-trial-evidence.sh` for read-only controlled-trial evidence aggregation; it must not set `WECOM_ARCHIVE_WRITE=1`, `WECOM_CHECKIN_ARCHIVE_WRITE=1`, or `WECOM_APPROVAL_FIXTURE_WRITE=1`. WEXT1LD is the outing/overtime live-before dry-run gate and does not authorize live fixture creation. WFULLSMOKE1 adds `scripts/qa/run-three-day-full-goal-smoke.sh` as the three-day full-goal smoke controller; it may create only OA test business data marked `TEST/SMOKE/WFULL`, and must not write WeCom, create outing/overtime fixtures, enable real employees, make real payments, connect real payment providers, write ERP, or import bank statements. WPROC2 adds the executable `process gate`: before WAPC2F or other high-risk WeCom work, run `node scripts/qa/check-process-contract.mjs --baseline` and the issue-specific profile check to enforce DoR/DoD, fixed Secret source, non-self approval, live write switches, missing-config classification, and redaction boundaries. Do not start `wecom_attendance_approval_mirror_v1`, `oa_hr_emergency_mode_v1`, `wecom_recovery_writeback_v1`, or `wecom_ruleops_v1` without WROAD2-CLOSEOUT, WROAD2-BIZ1, WAPPR1, WAUTO1/WEXT1LD, WFULLSMOKE1 evidence, WEXT1-LIVE, WREAL1 question gates or explicit approval, and the next stage's own Issue CSV and acceptance gates. - WARCH3/WCHECK1/WEXT1 update the route after WROAD2 Day 0: WARCH3 adds `scripts/qa/run-warch3-ops-daily.sh`, `deploy/trialrun/install-warch3-ops-timer.sh`, and `npm run send:wecom-ops-alert` for 07:30 systemd巡检和脱敏企微告警；public report `/app/artifacts/qa-flow/warch3-ops-20260520-054841/summary.json` is `PASS_WITH_FINDINGS`, and WOPS1 now fixes alert noise: default recipient is `HYD000006` (the employee_no for `wangshunli`), repeated known findings are skipped via `artifacts/qa-flow/warch3-ops-alert-state.json`, and only blocked/failure/new-finding/status-worsening/force sends a message. WOPS1 public rerun `/app/artifacts/qa-flow/warch3-ops-20260520-070731/summary.json` is `PASS_WITH_FINDINGS`, and alert report `/app/artifacts/qa-flow/wecom-ops-alert-20260520T070740Z/summary.json` is `PASS_ALERT_SKIPPED_NO_FINDINGS` with `no_new_findings_or_status_worsening`. WCHECK1 adds `npm run check:wecom-checkin-summary-archive`, daily/monthly check-in summaries, and rule snapshots with `--persist-to-db` + `WECOM_CHECKIN_ARCHIVE_WRITE=1` as the only OA DB write gate; public reports `/app/artifacts/qa-flow/wecom-checkin-summary-archive-20260520T054907Z/summary.json` and `/app/artifacts/qa-flow/wecom-checkin-summary-archive-20260520T054926Z/summary.json` are `PASS_CHECKIN_ARCHIVE_READY` and `PASS_CHECKIN_ARCHIVE_OFFLINE_READY`. WEXT1 only extends approval fixtures for `--target=outing --target=overtime` dry-run; public report `/app/artifacts/qa-flow/wecom-approval-fixtures-20260520T054940Z/summary.json` is `PASS_FIXTURE_DRY_RUN_READY`. WAUTO1/WEXT1LD now add a read-only evidence aggregation script and a live-before dry-run contract; WFULLSMOKE1 adds full-domain main-path smoke orchestration across WeCom HR/attendance, OA-primary reimbursement/procurement/contract-project/payment-batch flows, mobile/WeCom entry, and ops checks. These do not create outing/overtime WeCom templates/approvals, expand real users, or implement full mirror/emergency/writeback/RuleOps. WEXT1-LIVE needs WROAD2-CLOSEOUT/WROAD2-BIZ1/WAPPR1/WAUTO1/WEXT1LD/WFULLSMOKE1, a new Issue CSV, and explicit approval; WREAL1 real users are asked only after leave, missed punch, outing, and overtime test-account evidence plus approver-rule gate and WFULLSMOKE1 are passable/explainable. -- WROAD2-BIZ1/WAPPR1 adjust the post-WOPS1 route: during the 3-day window, add manual business smoke on test accounts without replacing WARCH3 automation. `SMOKE002` should try WeCom check-in and submit low-risk leave/missed-punch, `SMOKE101` must open details before approving, and `HYD000006` checks OA archived approval/check-in summaries. WAPPR1 treats "applicant must manually choose approver" as a blocking rule finding: test templates remain `SMOKE002 -> SMOKE101`, formal leave/missed-punch/outing/overtime templates must auto-resolve approvers from direct manager, department owner, or configured approval role, and applicant-chosen arbitrary approvers/self-approval must block WREAL1. Official WeCom APIs do not expose a read-only native-template approval-rule configuration surface: `gettemplatedetail` returns controls, `getapprovaldetail` returns actual submitted flow, and `applyevent use_template_approver=1` is a write-style check, so do not design WAPPR1 as pure API automation. WAUTO1 can automate evidence collection, and WFULLSMOKE1 can aggregate full-domain smoke evidence, but WAPPR1 choices A/B/C/D and real-device business actions remain manual gates. Do not start WEXT1-LIVE, WREAL1, deep mirror, emergency, writeback, or RuleOps until WROAD2-CLOSEOUT, WROAD2-BIZ1, WAPPR1, WAUTO1/WEXT1LD, WFULLSMOKE1, WEXT1-LIVE, and the relevant question gates or explicit approval are complete. -- WROUTE2 locks the post-WFULLSMOKE1 route: first close out test-account evidence, then ask for WEXT1-LIVE outing+overtime test-account live POC, then ask WREAL1 with exactly 1 real employee + 1 approver/admin observer, then prioritize `wecom_attendance_approval_mirror_v1` minimum complete mirror. WTCLOSE1 adds the small-team execution rule: because the company has fewer than 10 people, WAPPR1 targets option A for leave/missed-punch/outing/overtime; formal HR/attendance approvals use one direct manager or configured approval role with admin fallback/blocking when the approver chain is missing, unavailable, invisible, unbound, or self-approval. WTCLOSE1 only authorizes WAUTO1/WFULLSMOKE1 aggregation and WEXT1-LIVE pre-dry-run; it does not authorize WeCom writes, real employees, outing/overtime fixture creation, emergency mode, writeback, or RuleOps. +- WROAD2-BIZ1/WAPPR1/WRULE1 adjust the post-WOPS1 route: during the 3-day window, add manual business smoke on test accounts without replacing WARCH3 automation. `SMOKE002` should try WeCom check-in and submit low-risk leave/missed-punch, `SMOKE101` must open details before approving, and `HYD000006` checks OA archived approval/check-in summaries. WAPPR1 treats "applicant must manually choose approver" as a blocking rule finding: test templates remain `SMOKE002 -> SMOKE101`, formal leave/missed-punch/outing/overtime templates must auto-resolve approvers from direct manager, department owner, or configured approval role, and applicant-chosen arbitrary approvers/self-approval must block WREAL1. Official WeCom APIs do not expose a read-only native-template approval-rule configuration surface: `gettemplatedetail` returns controls, `getapprovaldetail` returns actual submitted flow, and `applyevent use_template_approver=1` is a write-style check, so do not design WAPPR1 as pure API automation. WRULE1 adds `npm run check:wecom-approval-rule-validator` to compare OA theoretical approvers with archived WeCom actual approval chains; it is read-only, does not read WeCom backend rules, and does not replace WAPPR1 A/B/C/D manual gates. WAUTO1 can automate evidence collection, and WFULLSMOKE1 can aggregate full-domain smoke evidence, but WAPPR1 choices A/B/C/D and real-device business actions remain manual gates. Do not start WEXT1-LIVE, WREAL1, deep mirror, emergency, writeback, or RuleOps until WROAD2-CLOSEOUT, WROAD2-BIZ1, WAPPR1, WRULE1, WAUTO1/WEXT1LD, WFULLSMOKE1, WEXT1-LIVE, and the relevant question gates or explicit approval are complete. +- WROUTE2 locks the post-WFULLSMOKE1 route: first close out test-account evidence, then ask for WEXT1-LIVE outing+overtime test-account live POC, then ask WREAL1 with exactly 1 real employee + 1 approver/admin observer, then prioritize `wecom_attendance_approval_mirror_v1` minimum complete mirror. WTCLOSE1 adds the small-team execution rule: because the company has fewer than 10 people, WAPPR1 targets option A for leave/missed-punch/outing/overtime; formal HR/attendance approvals use one direct manager or configured approval role with admin fallback/blocking when the approver chain is missing, unavailable, invisible, unbound, or self-approval. WRULE1 enforces this as an OA-side validator over archived WeCom approval details; `PASS_RULE_MATCH` or explainable `PASS_WITH_ADMIN_FALLBACK` can support test-account closeout, while `FAIL_APPLICANT_CAN_CHOOSE`, `FAIL_SELF_APPROVAL`, `FAIL_APPROVER_MISMATCH`, missing manual gates, or external config blockers stop WEXT1-LIVE/WREAL1. WTCLOSE1 only authorizes WAUTO1/WFULLSMOKE1 aggregation and WEXT1-LIVE pre-dry-run; it does not authorize WeCom writes, real employees, outing/overtime fixture creation, emergency mode, writeback, or RuleOps. - WAPC2FLIVE supersedes the WAPC2F dry-run gap for OA-POC samples: after user approval, the runner was corrected to the official `template_name` + `property` controls create-template payload, deployed with `SYNC_ENV=0`, and the public live report `/app/artifacts/qa-flow/wecom-approval-fixtures-20260519T053400Z/summary.json` reached `PASS_FIXTURE_CREATED`; leave/missed-punch OA-POC templates and low-risk test approvals were created and retained for audit, with WAPC2 auto-rerun `PASS_APPROVAL_POC`. WCBK1 has added and deployed read-only `GET/POST /api/wecom/approval/callback`, `wecomCallbackCrypto`, `npm run check:wecom-approval-callback-poc`, and the `wecom-callback` process gate. After remote callback config was set, public report `/app/artifacts/qa-flow/wecom-approval-callback-poc-20260519T083422Z/summary.json` reached `PASS_CALLBACK_URL_VERIFIED`; after `SMOKE101` approved an existing OA-POC missed-punch test approval, `/app/artifacts/qa-flow/wecom-approval-callback-poc-20260519T092648Z/summary.json` reached `PASS_CALLBACK_EVENT_CONFIRMED` with one redacted event. WACP3/WACP3R has added and deployed `npm run check:wecom-approval-compensation-poc`, `POST /cgi-bin/oa/getapprovalinfo` read support, and automatic template discovery by `SMOKE002` creator; WREAD1 deploy reran WACP3R at `/app/artifacts/qa-flow/wecom-approval-compensation-poc-20260519T125515Z/summary.json` and then generated `/app/artifacts/qa-flow/wecom-approval-readability-gate-20260519T125532Z/summary.json` as `PAUSED_MANUAL_CONFIRMATION`. WREAD1F then fixed duplicate OA-POC template names by adding timestamp uniqueness and created fresh leave/missed-punch approvals at `/app/artifacts/qa-flow/wecom-approval-fixtures-20260519T131958Z/summary.json`; final WREAD1 manual report `/app/artifacts/qa-flow/wecom-approval-readability-gate-20260519T133628Z/summary.json` is `PASS_READABLE`. This clears leave/missed-punch readability only; mirror data model, minimum archive, emergency mode, writeback, RuleOps, and outing/overtime sample decisions remain later gates. - WEGOV1 changes the current WeCom route to "Enterprise WeChat owns mature HR/attendance flows; OA stores self-owned history, audit, entry, messages, and emergency fallback." Treat four domains explicitly: WeCom-owned domain is check-in, leave, missed punch, outing, overtime, leave balance, and HR assistant; OA-owned domain remains reimbursement, procurement, contracts, projects, payments, invoices, bank receipts, sensitive attachments, and operating audit; OA archive domain stores WeCom business history, full external keys, and necessary snapshots; OA emergency domain is manually enabled only when WeCom is unavailable. Do not assume a full isolated WeCom sandbox; use the controlled test domain `SMOKE002 -> SMOKE101`, `OA-POC` templates, low-risk approvals, synthetic tests, public live runners, and limited real-device confirmation. WARCH1 now supplies the minimum leave/missed-punch archive implementation, WARCH2 supplies the formal read-only history query surface, and WROAD2 supplies controlled ops daily checks. Do not start deep mirror until WROAD2-CLOSEOUT, WROAD2-BIZ1, WAPPR1, WAUTO1/WEXT1LD, WFULLSMOKE1, WEXT1-LIVE, WREAL1 question gates or explicit approval, and the mirror stage's own contract are complete. - For reimbursement, invoice, OCR, duplicate invoice, or attachment work, read `docs/报销发票附件规则.md` and `references/reimbursement.md`. @@ -111,8 +111,8 @@ Final responses should include: - R6 scope defaults to reimbursement, leave, procurement, approval, Enterprise WeChat entry/notification, finance payment/export. - Do not expand to budget, ERP, AI, full travel, or complex BPM during R6; record those as follow-up Issues. - Enterprise WeChat personal app message is the formal approval notification channel after R5; mock and group bots are not acceptance evidence for R6 business notification. -- After WAPI, ERP is not a future OA integration target. HR/attendance employee daily approvals (leave, missed punch, outing, overtime) should reuse mature Enterprise WeChat capabilities first, while OA provides self-owned archive, domain-based mirror, manual takeover, recovery writeback, finance closeout, and audit. Reimbursement, payment batches, AP, accounting handoff, procurement, expenses, contracts, projects, sensitive attachments, invoices, bank receipts, and accounting handoff materials remain OA-primary unless a later Issue changes that domain explicitly. OA-primary approvals may send Enterprise WeChat personal-app notifications, but messages must contain only dehydrated title/type/no/status/deeplink; do not upload procurement forms, contract bodies, quotes, supplier files, invoices, bank receipts, or accounting materials to WeCom native approvals or WeCom attachments. Current WAPI rule: contacts read with `WECOM_CONTACT_SECRET`; HR assistant/roster/check-in/approval default to `WECOM_AGENT_SECRET`, with `WECOM_CHECKIN_SECRET` only as explicit check-in override; no runtime Secret guessing. Current stage order is `WOPS1 巡检告警降噪 -> WROAD2-CLOSEOUT 三天验收 -> WROAD2-BIZ1 三天业务冒烟 -> WAPPR1 审批规则规范化 -> WAUTO1 自动证据汇总 -> WEXT1LD 外出/加班 live 前 dry-run -> WFULLSMOKE1 三天全域最终目标测试 -> WROUTE2 测试号收口到最小镜像路线锁定 -> WEXT1-LIVE 外出/加班测试号 live POC -> 四类测试号证据和审批规则门禁通过后问答 WREAL1 小范围真实试用（首批 1 名真实员工 + 1 名审批人/管理员观察） -> wecom_attendance_approval_mirror_v1 最小完整镜像 -> oa_hr_emergency_mode_v1 -> wecom_recovery_writeback_v1 -> wecom_ruleops_v1`. UI and API work must distinguish `OA 主办`, `企微主办`, `OA 自建留存`, and `OA 应急接管`. Do not treat WEXT1 dry-run, WEXT1LD, WFULLSMOKE1, or WROUTE2 as permission to live-create outing/overtime templates or approvals; live needs explicit user approval. -- Current post-WROAD2 route wording is: `WOPS1 巡检告警降噪 -> WROAD2-CLOSEOUT 三天验收 -> WROAD2-BIZ1 三天业务冒烟 -> WAPPR1 审批规则规范化 -> WAUTO1 自动证据汇总 -> WEXT1LD 外出/加班 live 前 dry-run -> WFULLSMOKE1 三天全域最终目标测试 -> WROUTE2 测试号收口到最小镜像路线锁定 -> WEXT1-LIVE 外出/加班测试号 live POC -> 四类测试号证据和审批规则门禁通过后问答 WREAL1 小范围真实试用（首批 1 名真实员工 + 1 名审批人/管理员观察） -> wecom_attendance_approval_mirror_v1 最小完整镜像`. WREAL1-PREP only prepared the checklist and does not enable real employees. Do not treat WEXT1 dry-run, WEXT1LD, WFULLSMOKE1, or WROUTE2 as permission to live-create outing/overtime templates or approvals; live needs explicit user approval. +- After WAPI, ERP is not a future OA integration target. HR/attendance employee daily approvals (leave, missed punch, outing, overtime) should reuse mature Enterprise WeChat capabilities first, while OA provides self-owned archive, domain-based mirror, manual takeover, recovery writeback, finance closeout, and audit. Reimbursement, payment batches, AP, accounting handoff, procurement, expenses, contracts, projects, sensitive attachments, invoices, bank receipts, and accounting handoff materials remain OA-primary unless a later Issue changes that domain explicitly. OA-primary approvals may send Enterprise WeChat personal-app notifications, but messages must contain only dehydrated title/type/no/status/deeplink; do not upload procurement forms, contract bodies, quotes, supplier files, invoices, bank receipts, or accounting materials to WeCom native approvals or WeCom attachments. Current WAPI rule: contacts read with `WECOM_CONTACT_SECRET`; HR assistant/roster/check-in/approval default to `WECOM_AGENT_SECRET`, with `WECOM_CHECKIN_SECRET` only as explicit check-in override; no runtime Secret guessing. Current stage order is `WOPS1 巡检告警降噪 -> WROAD2-CLOSEOUT 三天验收 -> WROAD2-BIZ1 三天业务冒烟 -> WAPPR1 审批规则规范化 -> WRULE1 审批链校验器 POC -> WAUTO1 自动证据汇总 -> WEXT1LD 外出/加班 live 前 dry-run -> WFULLSMOKE1 三天全域最终目标测试 -> WROUTE2 测试号收口到最小镜像路线锁定 -> WEXT1-LIVE 外出/加班测试号 live POC -> 四类测试号证据和审批规则门禁通过后问答 WREAL1 小范围真实试用（首批 1 名真实员工 + 1 名审批人/管理员观察） -> wecom_attendance_approval_mirror_v1 最小完整镜像 -> oa_hr_emergency_mode_v1 -> wecom_recovery_writeback_v1 -> wecom_ruleops_v1`. UI and API work must distinguish `OA 主办`, `企微主办`, `OA 自建留存`, and `OA 应急接管`. Do not treat WEXT1 dry-run, WEXT1LD, WFULLSMOKE1, or WROUTE2 as permission to live-create outing/overtime templates or approvals; live needs explicit user approval. +- Current post-WROAD2 route wording is: `WOPS1 巡检告警降噪 -> WROAD2-CLOSEOUT 三天验收 -> WROAD2-BIZ1 三天业务冒烟 -> WAPPR1 审批规则规范化 -> WRULE1 审批链校验器 POC -> WAUTO1 自动证据汇总 -> WEXT1LD 外出/加班 live 前 dry-run -> WFULLSMOKE1 三天全域最终目标测试 -> WROUTE2 测试号收口到最小镜像路线锁定 -> WEXT1-LIVE 外出/加班测试号 live POC -> 四类测试号证据和审批规则门禁通过后问答 WREAL1 小范围真实试用（首批 1 名真实员工 + 1 名审批人/管理员观察） -> wecom_attendance_approval_mirror_v1 最小完整镜像`. WREAL1-PREP only prepared the checklist and does not enable real employees. Do not treat WEXT1 dry-run, WEXT1LD, WFULLSMOKE1, or WROUTE2 as permission to live-create outing/overtime templates or approvals; live needs explicit user approval. - WMSG1 has verified real Enterprise WeChat personal-app delivery and Deeplink return: report `/app/artifacts/qa-flow/wecom-runtime-ready-20260518T234431Z/summary.json` has `checks.message.status=OK`, `errcode=0`, and `recipientCount=1`; the user confirmed receiving "OA 运行就绪检查" and opening the OA notifications page from the message. This only clears message/deeplink runtime evidence; template/detail, callback evidence, compensation pull, readability, self-owned archive model design, and minimum archive implementation are covered by WAPC2FLIVE/WCBK1/WACP3R/WREAD1/WADM1/WARCH1 in the OA-POC leave/missed-punch scope, while deep mirror work remains a separate later gate. - WAPC1 has fixed the WeCom approval configuration preparation gate: first templates are leave, missed punch, outing, and overtime; each needs template ID, scope, fields, approver rules, visible scope, and self-built app permission; low-risk test `sp_no` must not contain procurement, contract, reimbursement, invoice, bank receipt, sensitive attachment, or real sensitive business material; callback URL/Token/EncodingAESKey are deployment-only values and must not be written to repo docs or Issue CSV. Do not implement real approval callback handling, deep mirror, emergency mode, recovery writeback, or RuleOps until a later approved Issue covers the POC or implementation. - WAPC2 has added the WeCom approval template/detail read-only POC runner for leave and missed punch. Use `npm run check:wecom-approval-poc`; pass template IDs with `--template=leave:` / `--template=missed_punch:` and low-risk test approval numbers with `--sp-no=leave:` / `--sp-no=missed_punch:`. The runner must use only `WECOM_AGENT_SECRET`, redact full template IDs and `sp_no`, and never output form values, attachments, comments, full userid, token, Secret, or raw payload. diff --git a/docs/trialrun/人工试运行报告.md b/docs/trialrun/人工试运行报告.md index 22fc313c..9f4a6363 100644 --- a/docs/trialrun/人工试运行报告.md +++ b/docs/trialrun/人工试运行报告.md @@ -477,10 +477,11 @@ Go 结论边界： | WROAD2-CLOSEOUT 三天验收 | 待 Day 1/2/3 自动采集 | Day 0 报告 `/app/artifacts/qa-flow/wroad2-ops-20260520-041941/summary.json` 为 `PASS_WITH_FINDINGS`。已知 observation 为 live smoke 凭据、pending OCR 子检查和历史 callback gap，不阻断受控试用；企微 runtime、审批补偿归档、OA 离线读取、打卡摘要 offline 可读和隐私扫描仍是主链路。三天内正常或已知 finding 不打扰，仅新增异常、状态恶化、阻断或脚本失败时通知。 | | WROAD2-BIZ1 三天业务冒烟 | 已建档，待人工执行 | 三天内补充真实业务动作：`SMOKE002` 每天按企微规则尝试上/下班打卡，提交低风险请假和补卡；`SMOKE101` 每条审批必须先打开详情再审批；`HYD000006` 每天查看 OA 企微审批归档历史和打卡摘要。人工业务冒烟不替代 WARCH3 自动巡检；无法打卡、无法审批或仍需手选审批人时，真实记录为 finding。 | | WAPPR1 审批规则规范化 | 已建档，作为真实试用前门禁 | 用户发现补卡申请需要申请人手动选择审批人，该现象作为 blocking finding 治理。测试模板固定 `SMOKE002 -> SMOKE101`；正式请假、补卡、外出、加班模板必须按直属主管、部门负责人或指定审批角色自动带出审批人；申请人不得任意选择审批人，审批人缺失、停用、未绑定、不可见或自审时阻断。 | -| WREAL1-PREP 真实试用准备 | 仅规划，不启用真实员工 | 固化候选员工 active/已绑定/可见、审批人非本人、回滚联系人、允许流程、暂停条件和验收标准。当前继续测试账号；真实试用必须等请假、补卡、外出、加班四类测试号证据和 WAPPR1 审批规则门禁通过后再问答确认，默认仍从 1 名真实员工 + 1 名审批人/管理员观察开始。 | +| WRULE1 审批链校验器 | 已建档并进入本地 POC | 固定“单一组织规则，两个执行域”：OA 维护主管链、业务审批角色和管理员兜底，企微执行 HR/考勤审批，OA 只读已归档审批详情并校验理论审批人是否匹配实际审批链。WRULE1 不读取企微后台规则、不写企微、不替代 WAPPR1 人工门禁。 | +| WREAL1-PREP 真实试用准备 | 仅规划，不启用真实员工 | 固化候选员工 active/已绑定/可见、审批人非本人、回滚联系人、允许流程、暂停条件和验收标准。当前继续测试账号；真实试用必须等请假、补卡、外出、加班四类测试号证据和 WAPPR1/WRULE1 审批规则门禁通过后再问答确认，默认仍从 1 名真实员工 + 1 名审批人/管理员观察开始。 | | 外出/加班 | live POC 待三天验收后另建合同 | WEXT1 dry-run 证据保留；当前不创建企微外出/加班模板或审批单。已锁定 WEXT1-LIVE 方向：外出+加班两类一起创建 OA-POC 测试模板和低风险审批单，固定 `SMOKE002 -> SMOKE101`、`WECOM_AGENT_SECRET` 和双开关，样件保留审计，由 `SMOKE101` 真机确认。 | -三天验收结束后的人工问答选项固定为：进入 WEXT1-LIVE、先处理指定 finding、或暂停。外出/加班 live 写入前必须再次说明当前状态、改了什么、测了什么、结果是什么和会留下什么企微记录；四类测试号证据和 WAPPR1 审批规则门禁通过后，再问是否进入真实小范围试用。 +三天验收结束后的人工问答选项固定为：进入 WEXT1-LIVE、先处理指定 finding、或暂停。外出/加班 live 写入前必须再次说明当前状态、改了什么、测了什么、结果是什么和会留下什么企微记录；四类测试号证据和 WAPPR1/WRULE1 审批规则门禁通过后，再问是否进入真实小范围试用。 ## WAUTO1 / WEXT1LD 自动证据汇总与 live 前 dry-run @@ -512,7 +513,7 @@ Go 结论边界： | 项 | 当前结果 | 证据和边界 | | --- | --- | --- | | 路线合同 | 已建档 | 新增 `issues/2026-05-20_20-15-29-wecom-test-account-closeout-to-minimal-mirror-route-v1.csv`，作为 WFULLSMOKE1 后的路线锁定合同。 | -| 测试号收口 | 已锁定 | 当前优先完成 WROAD2-CLOSEOUT、WROAD2-BIZ1、WAPPR1、WAUTO1、WEXT1LD 和 WFULLSMOKE1；WAPPR1 四类模板必须为 A，否则不进入 WEXT1-LIVE 或 WREAL1。 | +| 测试号收口 | 已锁定 | 当前优先完成 WROAD2-CLOSEOUT、WROAD2-BIZ1、WAPPR1、WRULE1、WAUTO1、WEXT1LD 和 WFULLSMOKE1；WAPPR1 四类模板必须为 A，WRULE1 必须为 `PASS_RULE_MATCH` 或可解释 `PASS_WITH_ADMIN_FALLBACK`，否则不进入 WEXT1-LIVE 或 WREAL1。 | | 外出/加班 live | 待后续问答 | 只有三天验收、全域主路径、业务冒烟、规则门禁和 dry-run 均可解释通过后，才另建 WEXT1-LIVE 合同并再次问答是否一次性 live 创建外出+加班测试号样件。 | | 真实试用与镜像 | 后置 | WREAL1 首批固定为 1 名真实员工 + 1 名审批人/管理员观察；WREAL1 通过后优先规划 `wecom_attendance_approval_mirror_v1` 最小完整镜像，应急接管、恢复回写和 RuleOps 均后置。 | @@ -531,6 +532,18 @@ Go 结论边界： | 外出/加班 live 前 dry-run | `PASS_FIXTURE_DRY_RUN_READY` | 公网报告 `/app/artifacts/qa-flow/wecom-approval-fixtures-20260520T125941Z/summary.json`；`secretMatrix=OK`、`actors=OK`、`liveWrite=DRY_RUN_READY`、`autoRerun=DRY_RUN_SKIPPED`。本轮没有设置 `WECOM_APPROVAL_FIXTURE_WRITE=1`，没有带 `--live --create-templates --submit-test-approvals`，没有创建企微模板或审批单。 | | 后续问答 | 待人工门禁 | dry-run 已具备进入问答的自动证据，但必须先由 `HYD000006` 确认请假、补卡、外出、加班四类模板均为 A；若出现 B/C/D，先修审批规则。WAPPR1 四类为 A 且三天业务动作可解释通过后，才问是否进入 WEXT1-LIVE；真实员工试用仍固定后置为 1 名真实员工 + 1 名审批人/管理员观察。 | +## WRULE1 企微 HR/考勤审批链校验器 POC + +执行时间：2026-05-20。本轮只做本地只读 POC，不部署、不写 OA 业务数据、不写企业微信、不启用真实员工。 + +| 项目 | 状态 | 证据与边界 | +| --- | --- | --- | +| 执行合同 | 已建档 | 新增 `issues/2026-05-20_23-56-15-wecom-hr-approval-rule-validator-v1.csv`，ID 为 `WRULE1-0..WRULE1-7`。 | +| 校验器 | 已实现 | 新增 `server/src/services/integrations/wecomApprovalRuleValidator.js` 和 `server/src/scripts/check-wecom-approval-rule-validator.js`；按 OA 直属主管、业务审批角色和管理员兜底计算理论审批人，再与 OA 已归档企微审批参与人/动作对比。 | +| 结论分类 | 已固定 | `PASS_RULE_MATCH`、`PASS_WITH_ADMIN_FALLBACK`、`FAIL_APPLICANT_CAN_CHOOSE`、`FAIL_SELF_APPROVAL`、`FAIL_APPROVER_MISMATCH`、`PAUSED_MANUAL_CONFIRMATION`、`SKIP/BLOCKED_BY_EXTERNAL_CONFIG`。 | +| 人工门禁关系 | 不替代 WAPPR1 | `--manual-gate=