ID,Title,Description,Acceptance,Test_Method,Tools,Dev_Status,Review1_Status,Regression_Status,Files,Dependencies,Notes
E1,CSV快照收口（试运行上线版）,新建P4试运行上线版执行合同快照承接全部前后端与联动工作,新CSV通过校验且依赖关系正确旧快照不改动,python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-02-08_21-50-09-p4-trialrun-ready.csv,manual,DONE,DONE,DONE,issues/2026-02-08_21-50-09-p4-trialrun-ready.csv,[],none
E2,前端UI组件基线（成熟复用）,引入UI primitives与移动端44px触控规范并保持现有token策略,三大业务页可复用组件且typecheck与build通过,cd client && npm run typecheck && npm run build,manual,DONE,DONE,DONE,client/src/components/ui/* | client/src/lib/* | client/src/styles/mobile-touch.css | client/src/index.css | client/tailwind.config.js | client/package.json,"[""E1""]",本地拷贝shadcn风格组件子集并记录来源/许可证与回滚路径
E3,前端布局导航收敛,统一Sidebar与Topbar交互视觉响应式与权限菜单体验,四角色菜单正确窄屏可用路由守卫无闪烁,"manual: 按server与client README启动联调并验证employee manager finance finance_mgr菜单与守卫",manual,DONE,DONE,DONE,client/src/layouts/AppShellLayout.tsx | client/src/components/navigation/* | client/src/components/common/PageHeader.tsx | client/src/router/*,"[""E2""]",none
E4,待办页精修（列表详情动作）,用UI primitives收敛待办列表与详情动作区统一加载空态错误并补data-testid,approve reject return transfer动作可用且动作后列表详情刷新一致,cd client && npm run typecheck && npm run build,manual,DONE,DONE,DONE,client/src/pages/WorkflowTasksPage.tsx | client/src/pages/WorkflowTaskDetailPage.tsx | client/src/api/workflow.ts,"[""E3""]",为E2E补稳定选择器data-testid
E5,报销页精修（列表详情联动）,收敛报销列表详情展示并优化支付凭证与票据区块一致性并补data-testid,employee可create submit withdraw且finance可pay并填写凭证字段,cd client && npm run typecheck && npm run build,manual,DONE,DONE,DONE,client/src/pages/ReimbursementsPage.tsx | client/src/pages/ReimbursementDetailPage.tsx | client/src/api/reimbursements.ts,"[""E3""]",为E2E补稳定选择器data-testid
E6,票据中心精修（OCR与预览）,收敛上传列表详情并强化OCR状态展示绑定与签名预览交互并补data-testid,OCR_PROVIDER=mock联调可轮询pending_ocr且ocr_failed展示原因且预览可用,cd client && npm run typecheck && npm run build,manual,DONE,DONE,DONE,client/src/pages/InvoicePoolPage.tsx | client/src/api/invoicePool.ts | client/src/api/http.ts,"[""E3""]",为E2E补稳定选择器data-testid
E7,委派管理前端页（运营可用）,新增委派管理页与API封装支持创建列表撤销并加菜单入口与守卫,可创建委派撤销后delegate不可代办且无权限用户403提示正确,"manual: manager创建委派让delegate代办一次后撤销再验证PERM_002",manual,DONE,DONE,DONE,client/src/pages/DelegationsPage.tsx | client/src/api/delegations.ts | client/src/router/index.tsx | client/src/components/navigation/Sidebar.tsx,"[""E3""]",权限码沿用expense.proxy_manage
E8,默认账号与失败体验收敛,补dev seed默认账号文档并让前端对网络失败给出可操作提示（含“忘记密码请联系管理员重置”）,登录页后端不可达提示服务未启动且README列出默认账号且SYS_001提示可读,"manual: 停后端访问登录页看到提示并按README默认账号登录成功",manual,DONE,DONE,DONE,client/src/pages/LoginPage.tsx | client/src/api/errorMessages.ts | server/README.md | client/README.md,"[""E1""]",仅写dev seed账号不写生产密码与密钥
E9,DB索引补强（试运行性能）,为列表分页与筛选补组合索引以降低试运行慢查询风险,迁移可重复执行且回归全绿,cd server && npm run prisma:migrate:deploy && ./scripts/regression-all.sh,manual,DONE,DONE,DONE,server/prisma/schema.prisma | server/prisma/migrations/*,"[""E1""]",新增组合索引仅增不破回滚成本低
E10,后端安全基线（上线级）,增加安全头与关键接口限流并完善上传校验与日志脱敏约定,限流触发行为正确安全头存在上传非法类型被拒绝且不泄露token,"manual: curl压测login并验证429与headers并做一次上传非法类型校验",manual,DONE,DONE,DONE,server/src/app.js | server/src/config.js | server/src/routes/auth.js | server/src/routes/invoicePool.js | server/README.md | server/package.json,"[""E1""]",优先使用@fastify/helmet与@fastify/rate-limit并写回滚说明
E11,可观测性基线（ready与作业统计）,新增/ready进行DB探活并为OCR与委派回收作业输出结构化统计,ready可反映db状态且作业日志输出claimed updated audited等计数便于排障,"manual: 启动服务curl /ready并触发一次job观察日志字段",manual,DONE,DONE,DONE,server/src/app.js | server/src/jobs/delegationRevokeJob.js | server/src/jobs/ocrJob.js | server/README.md,"[""E10""]",不引入外部监控先提供最小可观测字段
E12,单域部署（server托管client静态）,支持server托管client dist实现同域cookie并提供开关与SPA回退,开启后通过server根路径访问前端且登录刷新正常,"manual: cd client && npm run build 然后SERVE_CLIENT_DIST=true启动server访问http://127.0.0.1:3000完成登录",manual,DONE,DONE,DONE,server/src/app.js | server/src/config.js | server/README.md | docker-compose.yml,"[""E10""]",优先复用@fastify/static并用正则fallback避开/api
E13,部署与运维包（试运行）,提供deploy/trialrun含env模板compose示例反向代理示例与启动停止runbook,按runbook可在新机器完成启动升级迁移与回滚演练一次,"manual: 按deploy/trialrun/runbook执行docker compose启动并验证ready与登录与回归入口",manual,DONE,DONE,DONE,deploy/trialrun/* | docker-compose.yml | server/.env.example | server/README.md | client/README.md,"[""E12""]",先覆盖试运行环境后续再细化生产
E14,备份与恢复演练（DB+文件）,提供DB(pg_dump)与文件存储(票据上传目录)备份恢复脚本并把演练步骤写入runbook,可生成DB+文件备份并在空库与空存储恢复后通过smoke与登录验证,"manual: 执行备份脚本后restore到新库与新存储目录并跑smoke-test",manual,DONE,DONE,DONE,scripts/backup-db.sh | scripts/restore-db.sh | scripts/backup-storage.sh | scripts/restore-storage.sh | deploy/trialrun/* | server/README.md,"[""E13""]",脚本读取DATABASE_URL与STORAGE_DIR不写死密码并输出可审计日志
E15,Playwright E2E（上线门禁）,引入Playwright覆盖主链路登录待办审批报销提交票据上传OCR轮询绑定预览支付登出,本地与CI均可稳定跑通且失败输出可定位trace与截图,cd client && npm run test:e2e,manual,DONE,DONE,DONE,client/playwright.config.ts | client/tests/e2e/* | client/package.json | client/README.md | client/src/pages/*,"[""E12"",""E4"",""E5"",""E6"",""E8""]",测试环境OCR_PROVIDER=mock且OCR_POLL_CRON改为秒级以保证E2E稳定
E16,CI集成E2E与全链门禁,新增ci-e2e工作流在PR与nightly跑E2E并保留现有最小门禁与后端回归,PR能跑min+e2e smoke nightly跑regression+e2e全量,"manual: GitHub Actions workflow_dispatch触发并通过",manual,DONE,DONE,DONE,.github/workflows/ci-e2e.yml | .github/workflows/ci-minimal.yml | .github/workflows/ci-regression.yml,"[""E15""]",CI中OCR默认mock避免外部凭据不稳定
E17,账号与角色管理API（后端运营）,新增system.users下的员工创建启用禁用重置密码角色分配接口并写审计,system.users可完成一轮创建与禁用与角色分配且审计完整,"manual: curl或postman完成创建禁用改角色与重置密码并验证权限阻断",manual,DONE,DONE,DONE,server/src/routes/users.js | server/src/app.js | server/src/constants/permissions.js | server/README.md | server/package.json,"[""E10""]",禁止自注册仅运营接口并记录回滚策略
E18,账号与角色管理页（前端最小可运营）,新增系统用户管理页与API封装并加菜单入口与守卫,具备system.users账号可管理普通账号且无权限用户403,"manual: admin登录进入用户管理页完成创建与禁用与重置密码",manual,DONE,DONE,DONE,client/src/pages/UserManagementPage.tsx | client/src/api/users.ts | client/src/router/index.tsx | client/src/components/navigation/Sidebar.tsx,"[""E17"",""E3""]",页面先满足运营闭环不做复杂组织管理
E19,上线发布清单与回滚策略收口,把试运行上线步骤门禁回归备份回滚监控要点写成可执行checklist,按清单可完成一次发布并可在10分钟内回滚到上个版本,"manual: 按runbook checklist执行一次演练并记录证据",manual,DONE,DONE,DONE,server/README.md | client/README.md | deploy/trialrun/*,"[""E9"",""E11"",""E13"",""E14"",""E16"",""E18""]",形成可审计可回滚的发布闭环
E20,试运行引导管理员账号（bootstrap）,新增试运行引导脚本创建首个管理员账号用于后续运营（管理员重置密码策略）,空库可通过脚本创建管理员且可登录并进入用户管理页,"manual: 空库migrate后运行seed:trialrun并用管理员账号调用/login与进入前端用户管理页",manual,DONE,DONE,DONE,server/src/scripts/seed-trialrun.js | server/package.json | server/README.md | deploy/trialrun/*,"[""E1""]",避免使用seed-dev默认弱口令；密码由env提供或首次启动输出一次性口令
E21,服务优雅停机（单机部署）,补齐SIGTERM/SIGINT优雅退出（停止job/关闭HTTP/断开DB）并写入runbook,容器stop或Ctrl+C退出时无Unhandled且能在超时前完成close,"manual: 本地启动server后发送SIGTERM观察日志并确认端口释放",manual,DONE,DONE,DONE,server/src/index.js | server/README.md | deploy/trialrun/*,"[""E1""]",单机同样需要保证升级/重启过程中连接与作业可控