{
  "id": "production-authenticated-readiness",
  "name": "production-authenticated-readiness",
  "title": "生产登录态只读验收",
  "description": "诊断生产管理员与员工验收凭据 401 的原因，在不修改账号、权限或业务数据的前提下恢复最小登录态只读验收；登录前先查锁定/失败计数和 identifier 登录语义，合同终止只验证到初始禁用按钮，并在验收前后复核回滚窗口。",
  "status": "in_progress",
  "dev_type": null,
  "scope": "production-auth-diagnosis-and-authenticated-readonly-acceptance",
  "package": null,
  "priority": "P1",
  "creator": "shunli",
  "assignee": "shunli",
  "createdAt": "2026-08-08",
  "completedAt": null,
  "branch": null,
  "base_branch": "main",
  "worktree_path": null,
  "commit": null,
  "pr_url": null,
  "subtasks": [],
  "children": [],
  "parent": null,
  "relatedFiles": [
    "server/src/routes/auth.js",
    "server/src/scripts/repair-oa-only-smoke-accounts.js",
    "server/prisma/schema.prisma",
    "server/src/routes/contractsRegistry.js",
    "client/src/pages/ContractRegistryWorkspacePage.tsx",
    "client/tests/e2e/live-smoke.spec.ts",
    "scripts/qa/run-live-smoke-readiness.sh",
    "deploy/trialrun/production-preflight-remote.sh",
    ".trellis/spec/hyb-oa/deployment-trialrun.md"
  ],
  "notes": "生产只读基线通过：公网产品 SHA 匹配已部署候选，65 条 migration applied、pending=none，四次窗口均 rollbackWindow=OPEN、terminatedRows=0。唯一活跃管理员 email 可解析、未锁定、failureCount=0，但现有密码不匹配；员工目标账号未唯一确定。生产 EMAIL_ENABLED=false，公网 email delivery 原因为 email_disabled；管理员 password reset 未锁定且请求计数 0，未发送验证码。登录 attempts=0、terminate POST=0、生产写入=0。登录态 UI 验收保持 PAUSED；建议另行批准既有 break-glass 脚本，其 must_change_password、token/session/code/lock/audit 副作用须完整接受。旧 hash 仅可作为短期高敏有限恢复材料，不构成完整回滚。",
  "meta": {}
}