ID,Title,Description,Acceptance,Test_Method,Tools,Dev_Status,Review1_Status,Regression_Status,Files,Dependencies,Notes
"WAPC2-0","合同建档与边界冻结","建立 WAPC2 企微审批模板与低风险 sp_no 只读 POC 合同；承接 WMSG1/WAPC1 事实，本轮只验证请假和补卡模板详情/审批详情只读链路。","1) CSV 校验通过；2) 范围锁定请假和补卡；3) 固定使用 WECOM_AGENT_SECRET；4) 不接真实回调、不调用写接口、不写 OA/企微数据；5) 不进入 wecom_attendance_approval_mirror_v1。","受影响流程：WAPC1 配置准备 -> 审批模板/审批详情只读 POC -> 后续镜像准入判断；验证步骤：python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-05-19_09-34-16-wecom-approval-template-spno-poc-v1.csv。","python3|manual","DONE","DONE","DONE","issues/2026-05-19_09-34-16-wecom-approval-template-spno-poc-v1.csv","[]","CSV 校验通过；回滚路径：撤回本 CSV 和本轮代码/文档变更；无运行时状态需要回滚。"
"WAPC2-1","审批只读集成服务","新增企微审批只读集成服务，固定使用自建应用 WECOM_AGENT_SECRET 获取 access token，并调用 gettemplatedetail/getapprovaldetail。","1) 不使用 WECOM_CONTACT_SECRET/WECOM_CHECKIN_SECRET/WECOM_HR_ASSISTANT_SECRET；2) 缺 WECOM_AGENT_SECRET 返回配置阻断；3) API 错误按权限/可信 IP/可见范围/模板或审批单不可见归类；4) 只返回脱敏摘要。","受影响流程：企微审批模板/审批单读取；验证步骤：cd server && node --check src/services/integrations/wecomApproval.js；focused vitest 覆盖 Secret 固定选择、无 fallback 和错误分类。","node|vitest","DONE","DONE","DONE","server/src/services/integrations/wecomApproval.js","[""WAPC2-0""]","node --check 和 focused vitest 通过；只读集成；不调用企业微信写接口。"
"WAPC2-2","QA-only runner","新增 check-wecom-approval-poc runner 和 package script，支持 live/dry-run、JSON/text 输出、CLI/env 输入请假/补卡模板 ID 与低风险 sp_no，并输出脱敏 summary.json。","1) 支持 --template=leave:<id>、--template=missed_punch:<id>、--sp-no=leave:<sp_no>、--sp-no=missed_punch:<sp_no>；2) 支持 WECOM_APPROVAL_LEAVE_TEMPLATE_ID、WECOM_APPROVAL_MISSED_PUNCH_TEMPLATE_ID、WECOM_APPROVAL_LEAVE_TEST_SP_NO、WECOM_APPROVAL_MISSED_PUNCH_TEST_SP_NO；3) 缺配置返回 PARTIAL_APPROVAL_POC_NEEDS_CONFIG；4) live API 阻断返回 SKIP/BLOCKED_BY_EXTERNAL_CONFIG。","受影响流程：审批配置准备 -> QA-only 只读 POC 报告；验证步骤：cd server && node --check src/scripts/check-wecom-approval-poc.js；cd server && npx vitest run tests/unit/scripts/check-wecom-approval-poc.test.js --reporter=verbose。","node|vitest","DONE","DONE","DONE","server/src/scripts/check-wecom-approval-poc.js|server/package.json","[""WAPC2-1""]","node --check 和 focused vitest 通过；报告不输出手机号、邮箱、token、secret、完整 userid、完整 sp_no、表单值、附件内容、评论内容或原始 payload。"
"WAPC2-3","只读 POC 单测","新增 focused vitest 覆盖 WAPC2 runner 和集成摘要行为。","1) 覆盖固定 WECOM_AGENT_SECRET；2) 覆盖模板详情读取和审批详情读取；3) 覆盖缺模板 ID、缺 sp_no；4) 覆盖企微 API 错误分类；5) 覆盖脱敏输出不泄露敏感字段。","受影响流程：WAPC2 本地质量门禁；验证步骤：cd server && npx vitest run tests/unit/scripts/check-wecom-approval-poc.test.js --reporter=verbose。","vitest","DONE","DONE","DONE","server/tests/unit/scripts/check-wecom-approval-poc.test.js","[""WAPC2-2""]","focused vitest 10 passed；单测使用 mock fetch，不访问公网，覆盖非 JSON 响应不得误判 PASS。"
"WAPC2-4","事实源文档回写","更新路线图、企微 API 能力目录、统一审批规约、企业微信基础设施规约、管理员手册、试运行报告、索引和事实源矩阵，说明 WAPC2 是请假/补卡只读 POC，不代表审批镜像或回调实现。","1) 文档明确 gettemplatedetail/getapprovaldetail 使用 WECOM_AGENT_SECRET；2) 明确 WAPC2 仅请假+补卡；3) 明确低风险 sp_no 各一条；4) 明确真实回调仍未实现；5) 不保存 Secret、Token、完整 sp_no 或原始 payload。","受影响流程：后续企微审批开发事实源；验证步骤：node scripts/qa/audit-docs.mjs --check-registry；rg -n 'WAPC2|gettemplatedetail|getapprovaldetail|WECOM_AGENT_SECRET|sp_no|真实回调|wecom_attendance_approval_mirror_v1' docs .agents/skills/hyb-oa-delivery/SKILL.md。","node|rg","DONE","DONE","DONE","docs|.agents/skills/hyb-oa-delivery/SKILL.md","[""WAPC2-3""]","audit-docs errors=0 warnings=1（既有未登记文档 warning）；关键词检查命中；文档只保存摘要、链接和项目决策。"
"WAPC2-5","本地静态门禁","执行 CSV 校验、node --check、prisma validate、focused vitest、文档审计、skill 校验、关键词检查和 diff 检查。","1) 所有本地门禁通过；2) 若 audit-docs 仅保留既有非阻断 warning，Notes 记录；3) git diff --check 通过。","受影响流程：WAPC2 本地验收；验证步骤：python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-05-19_09-34-16-wecom-approval-template-spno-poc-v1.csv；cd server && node --check src/scripts/check-wecom-approval-poc.js；cd server && npm run prisma:validate；cd server && npx vitest run tests/unit/scripts/check-wecom-approval-poc.test.js --reporter=verbose；node scripts/qa/audit-docs.mjs --check-registry；python3 /home/shunli/.codex/skills/.system/skill-creator/scripts/quick_validate.py .agents/skills/hyb-oa-delivery；git diff --check。","python3|node|npm|vitest|git","DONE","DONE","DONE","N/A","[""WAPC2-4""]","validate_issues_csv、node --check、prisma validate、focused vitest、audit-docs、quick_validate、关键词检查和 git diff --check 通过；audit-docs 仅既有 warnings=1。"
"WAPC2-6","公网只读复跑准备","在本地门禁通过后，以 SYNC_ENV=0 受控部署 QA-only 变更，并远端执行 check:wecom-approval-poc live；缺模板或 sp_no 时必须返回 PARTIAL_APPROVAL_POC_NEEDS_CONFIG。","1) 不同步本地 env；2) 不持久修改远端 env；3) 不写 OA/企微数据；4) 报告结果不伪造成 PASS；5) 复检 /ready 和公网 runtime smoke。","受影响流程：公网只读 POC 证据；验证步骤：SYNC_ENV=0 bash deploy/trialrun/deploy.sh；远端容器 npm run check:wecom-approval-poc -- --live --format=json；/ready 与 public runtime smoke。","bash|ssh|node","DONE","DONE","DONE","deploy/trialrun/deploy.sh|server/src/scripts/check-wecom-approval-poc.js","[""WAPC2-5""]","SYNC_ENV=0 部署完成，部署脚本通过 /ready、external deps smoke、runtime smoke 和 public bundle scan；远端报告 /app/artifacts/qa-flow/wecom-approval-poc-20260519T020429Z/summary.json 为 PARTIAL_APPROVAL_POC_NEEDS_CONFIG，Secret OK，缺请假/补卡模板 ID 和两条低风险 sp_no；公网 /ready ok。回滚路径：按部署脚本回滚到上一提交。"
"WAPC2-7","状态回填与中文提交","根据本地门禁和公网复跑结果回填状态，中文提交引用 WAPC2，并在最终说明中列出人工仍需提供的模板 ID 与 sp_no。","1) 已完成项状态回填；2) 中文提交引用 WAPC2；3) 最终说明包含验证命令、部署状态、报告路径、剩余人工门禁。","受影响流程：WAPC2 交付闭环；验证步骤：git status --short；git log --oneline -1。","git","DONE","DONE","DONE","issues/2026-05-19_09-34-16-wecom-approval-template-spno-poc-v1.csv|N/A","[""WAPC2-6""]","准备中文提交引用 WAPC2；公网配置未齐，后续由人工准备请假/补卡模板 ID 和两条低风险 sp_no 后复跑。"