ID,Title,Description,Acceptance,Test_Method,Tools,Dev_Status,Review1_Status,Regression_Status,Files,Dependencies,Notes
J1,历史凭据临时注入与 strict 准入,"从本机 .bash_history 只解析 LIVE_SMOKE_* 到当前进程环境，结合现有 OCR 样票执行 R5 strict 准入；不落盘、不打印、不提交密码。","1) 能提取完整 LIVE_SMOKE_ADMIN/EMPLOYEE 四项；2) OCR 样票存在；3) check-live-smoke-env --strict 通过；4) 未写入 ~/.hyb-oa/live-smoke.env 或仓库文件。","流程级验证：使用只读脚本解析 .bash_history 并执行 node scripts/qa/check-live-smoke-env.mjs 和 --strict；输出只允许显示 present/missing、publicReady、wecom、liveSmokeReady、liveOcrReady，不显示任何 secret。","python3|node",DONE,DONE,DONE,"scripts/qa/check-live-smoke-env.mjs|artifacts/北京悦海堂餐饮管理有限公司_发票金额1683.00元.pdf","[]","J1 完成：历史 LIVE_SMOKE_* 四项均可提取且未打印；OCR 样票存在；check-live-smoke-env 与 --strict 均通过，liveSmokeReady=true，liveOcrReady=true；未写入凭据文件。"
J2,公网自动化 live smoke 与真实 OCR,"在 J1 strict 通过后，使用同一临时环境执行公网 readiness、资源扫描、网页登录 smoke 和真实 OCR 样票复核。","1) run-live-smoke-readiness.sh 完成；2) live smoke 不再 SKIP；3) 真实 OCR 不再 SKIP，并进入可解释终态；4) 公网 bundle 扫描 findings=0。","流程级验证：LIVE_SMOKE_BASE_URL=https://oa.hyinda.com bash scripts/qa/run-live-smoke-readiness.sh；检查最新 artifacts/qa-flow/live-smoke-readiness-* 的 live-smoke.txt、live-ocr.txt、public-bundle-copy.txt。","bash|node|playwright",DOING,TODO,TODO,"scripts/qa/run-live-smoke-readiness.sh|artifacts/qa-flow","[""J1""]","J2 已执行但未通过：/ready 和 WeCom config 正常，公网 bundle 扫描 findings=0，pending OCR 因缺 DATABASE_URL 辅助 SKIP；live smoke 管理员登录停留 /login 且 401，员工 smoke 和真实 OCR 未执行。证据目录 artifacts/qa-flow/live-smoke-readiness-20260510-165833；需重置或重新提供 SMOKE001/SMOKE002 密码后重跑。"
J3,smoke 自动化副作用只读审计,"公网自动化后只读审计 SMOKE001/SMOKE002 产生的数据足迹，记录会话、票据、OCR、审计日志数量；不做清理。","1) 远端审计脚本只读运行成功；2) 记录 smoke 账号 active 状态和数据计数；3) 不执行删除、归档或数据库写操作。","流程级验证：ssh deploy@118.89.77.218 进入 /opt/hyb-oa-trialrun 后执行 docker-compose server node src/scripts/audit-smoke-data.js --format=text；只记录计数摘要。","ssh|node|manual",DONE,DONE,DONE,"server/src/scripts/audit-smoke-data.js|external","[""J2""]","J3 完成：SMOKE001/SMOKE002 均 active；authSessions=555，reimbursements=1，invoices=5，ocrResultsLinkedFromInvoices=1，auditLogs=258；未执行清理或写操作。"
J4,企业微信真机人工验收,"按现有真机清单人工验证企业微信工作台、移动浏览器、移动审批、报销上传、通知、deeplink 和布局。","1) 真实企业微信客户端可进入海音达工作台；2) 移动页面无 PC 壳、横向溢出或内部码值主展示；3) 审批 deeplink 回 OA；4) 失败项有证据位置。","流程级验证：按 docs/trialrun/real-device-public-checklist.md 执行；记录测试日期、设备、企业微信版本、账号角色、失败步骤和证据位置；不得提交敏感截图或隐私。","manual",TODO,TODO,TODO,"docs/trialrun/real-device-public-checklist.md|docs/trialrun/release-readiness-checklist.md","[""J2""]","自动化 UA 不能替代真机；若无人工记录，主 R5 不得标 DONE。"
J5,R5 状态回填与 R6 Gate,"根据 J1-J4 结果回填主 R5 和发布清单；只有自动化和真机均通过才允许启动 R6。","1) J1-J4 全部通过时，主 R5 置为 DONE/DONE/DONE；2) 自动化通过但真机未验收时，主 R5 保持 DOING/TODO/TODO；3) R6 保持 TODO。","流程级验证：python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-05-10_16-56-44-r5-history-credential-live-smoke.csv；python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-05-10_12-39-37-release-readiness-live-smoke.csv；git diff --check。","python3|git|manual",DONE,DONE,DONE,"issues/2026-05-10_16-56-44-r5-history-credential-live-smoke.csv|issues/2026-05-10_12-39-37-release-readiness-live-smoke.csv|docs/trialrun/release-readiness-checklist.md","[""J1"",""J2"",""J3""]","J5 完成：因 J2 管理员登录 401 且 J4 未执行，主 R5 保持 DOING/TODO/TODO，R6 保持 TODO；下一步应重置或重新提供 smoke 密码。"