"ID","Title","Description","Acceptance","Test_Method","Tools","Dev_Status","Review1_Status","Regression_Status","Files","Dependencies","Notes"
"A1","R80 执行合同建档与范围冻结","为公网企微入口启用建立独立合同，范围仅覆盖远端 WECOM 环境变量、feature flag、容器重启、只读 smoke 与首次绑定说明；不做业务代码改造，不把真实密钥写入仓库。","CSV 列完整且通过校验；A2-A4 依赖顺序清晰；Notes 明确本轮只做公网接入启用与验收。","命令：`python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-05-04_16-47-46-r80-live-wecom-enablement.csv`。业务：确认本轮只承接“企微后台已完成后的服务器侧启用”，不混入 OCR、通知、其他功能改动。","manual","DONE","DONE","DONE","issues/2026-05-04_16-47-46-r80-live-wecom-enablement.csv","[]","回滚路径：删除本 CSV，不影响运行时。真实 corpId/agentSecret 仅写远端 env，不入仓。2026-05-04：R80 合同已写入并通过 validate_issues_csv.py 校验。"
"A2","公网 WECOM 环境变量启用","在远端 `/opt/hyb-oa-trialrun/deploy/trialrun/.env` 写入 `WECOM_ENABLED/WECOM_ENTRY_ENABLED/WECOM_OAUTH_ENABLED=true` 及 `WECOM_CORP_ID/WECOM_AGENT_ID/WECOM_AGENT_SECRET/WECOM_REDIRECT_URI/WECOM_ALLOWED_RETURN_HOSTS`，并保留备份。","远端 `.env` 已存在完整 WECOM 配置；`APP_ORIGIN=https://oa.hyinda.com`、`COOKIE_SECURE=true` 保持不变；密钥不写入仓库，不打印到报告。","命令：`ssh root@118.89.77.218 'grep -E ^(APP_ORIGIN|COOKIE_SECURE|WECOM_)= /opt/hyb-oa-trialrun/deploy/trialrun/.env'`。业务：`GET /api/auth/wecom/config` 不再返回 disabled 类原因。","ssh|manual","DONE","DONE","DONE","deploy/trialrun/.env.example|external","[""A1""]","回滚路径：恢复 `.env` 备份并重启容器。使用对话中提供的 corpId/agentId/secret，仅写远端。2026-05-04：已备份远端 `.env`，WECOM 变量已写入并重新核对。"
"A3","wecom_entry_v1 放开与公网入口重载","把数据库 `feature_flags.flag_key=wecom_entry_v1` 的 `override_mode` 从 `force_off` 调整为 `inherit`，随后重建或重启 server 容器，使环境闸门与数据库开关一致生效。","`wecom_entry_v1` 不再是 `force_off`；server 容器重启后 `/api/auth/wecom/login?returnTo=%2Fportal` 返回 302，`Location` 指向 `open.weixin.qq.com` 且包含正确 `appid/agentid/redirect_uri`。","命令：`ssh root@118.89.77.218 'docker exec hyb-oa-trialrun-db psql -U hyboa_user -d hyb_oa -c select_flag_status'`、`curl -k -I https://oa.hyinda.com/api/auth/wecom/login?returnTo=%2Fportal`。业务：企微入口从 404 变为 OAuth 跳转。","ssh|manual","DONE","DONE","DONE","external","[""A2""]","回滚路径：把 `override_mode` 改回 `force_off` 或恢复 `.env` 备份后重启。选择 `inherit` 是为了保持 env 作为硬闸门。2026-05-04：`wecom_entry_v1` 已改为 `inherit`，server 容器已用 docker-compose 重建，公网 login 已返回 302 到企业微信 OAuth。"
"A4","公网 smoke 与首次绑定闭环说明","用 curl/Playwright 做只读公网验收，并补齐首次绑定的人工作业说明：未绑定员工首次从企微进入时回退到 `/login?wecom=unbound`，需先普通登录后在个人设置完成绑定，再重新从企微进入。","`/api/auth/wecom/config` 显示 ready；`/api/auth/wecom/login` 跳转正确；手册中写清首次绑定步骤；若真实手机端试用失败，报告中能区分是 IP/secret/callback/未绑定 哪一层失败。","命令：`curl -k https://oa.hyinda.com/api/auth/wecom/config`、`curl -k -I 'https://oa.hyinda.com/api/auth/wecom/login?returnTo=%2Fportal'`，必要时补一条 Playwright 只读检查。业务：选 1 个已有员工账号执行一次“普通登录 -> 个人设置绑定企微 -> 从企微重新进入 OA”手工闭环。","manual|ssh|playwright","DONE","DONE","DONE","artifacts/r70/manual-trialrun-checklist.md|artifacts/r70/manual-trialrun-report.md|external","[""A3""]","自动化已覆盖 config、302 跳转、登录页按钮与浏览器到 `open.weixin.qq.com` 的落点；R80 文档已写明首次绑定步骤。2026-05-05：用户手机企业微信验证已可进入工作台，首次绑定闭环通过。"