hyb-oa/issues/2026-03-13_21-04-30-p23-im2-wecom-productionization-refresh.csv

1	ID	Title	Description	Acceptance	Test_Method	Tools	Dev_Status	Review1_Status	Regression_Status	Files	Dependencies	Notes
2	IM2-0	P23执行合同建档与范围冻结	新建 P23 refresh 合同并冻结本轮只处理企微真实出站 密钥安全 回归文档与矩阵收口的边界，不混入飞书 钉钉 IM-3 IM-4 与业务代码之外的新域扩展。	P23 CSV 通过校验且 Notes 明确 I4 只做 refresh 不新增并行矩阵项，同时记录 4 个前端脏文件已独立 stash 不并入本轮。	python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-03-13_21-04-30-p23-im2-wecom-productionization-refresh.csv	manual	DONE	DONE	DONE	issues/2026-03-13_21-04-30-p23-im2-wecom-productionization-refresh.csv|docs/feature-matrix.md	[]	I4 refresh only and pre-existing frontend WIP is stashed as pre-p23-im2-frontend-wip
3	IM2-1	通知渠道密钥安全收口	新增通知渠道配置辅助层并将企微 webhook secret 从明文存储明文回显改为加密存储与遮罩回显，兼容历史 config_json.secret 读取但新写入只生成 secretEncrypted。	通知渠道列表与详情不再回显明文 secret；POST PATCH 在携带真实 secret 且缺少 FIELD_ENCRYPTION_KEY 时显式失败；历史明文渠道在迁移前后都能继续发送；迁移脚本同时支持 encrypt 与 decrypt。	cd server && npm test -- server/tests/unit/routes/notifications.test.js server/tests/unit/services/imRouting.test.js server/tests/unit/services/imEnqueue.test.js server/tests/unit/services/integrations/dispatcher.test.js server/tests/unit/integrations.dispatcher.test.js	manual	DONE	DONE	DONE	server/src/routes/notifications.js|server/src/services/notifications/channelConfig.js|server/src/services/crypto/index.js|server/src/services/notifications/channels.js|server/src/services/integrations/im/wecom.js|server/src/scripts/migrate-notification-channel-secrets.js|server/tests/unit/routes/notifications.test.js|server/tests/unit/services/imRouting.test.js|server/tests/unit/services/imEnqueue.test.js|server/tests/unit/services/integrations/dispatcher.test.js|server/tests/unit/integrations.dispatcher.test.js	["IM2-0"]	persist only secretEncrypted and expose secretConfigured plus secretMasked on read APIs
4	IM2-2	企微发送链路与错误语义加固	在现有 wecom_webhook 出站链路上复用 channelConfig 解析 secret 并稳定化 mock webhook 4xx 5xx timeout decrypt-failed 等错误语义，同时增强 test channel 响应信息而不改 event type 与 outbox 模型。	test channel 接口能区分 mock 成功 webhook 成功 webhook 4xx 5xx timeout 与 secret 不可用；dispatcher 对 4xx 5xx timeout decrypt-failed 的 retryable 判定均有覆盖；IM_NOTIFIER_ENABLED=false 的 skip 语义不回归。	cd server && npm test -- server/tests/unit/routes/notifications.test.js server/tests/unit/services/imRouting.test.js server/tests/unit/services/imEnqueue.test.js server/tests/unit/services/integrations/dispatcher.test.js server/tests/unit/integrations.dispatcher.test.js	manual	DONE	DONE	DONE	server/src/services/integrations/im/wecom.js|server/src/services/notifications/channels.js|server/src/services/integrations/dispatcher.js|server/src/routes/notifications.js|server/tests/unit/routes/notifications.test.js|server/tests/unit/services/integrations/dispatcher.test.js|server/tests/unit/integrations.dispatcher.test.js	["IM2-1"]	keep notification.im event type and wechat_work compatibility alias while tightening operator-facing diagnostics
5	IM2-3	通知渠道页生产化改造	将通知渠道页改为遮罩显示 secret 并支持保留 替换 清空三种编辑语义，同时展示 test channel 的 code message retryable 与 preview 信息，不提前放出飞书或钉钉选项。	前端不再拿到明文 secret；编辑已有渠道时可不改 secret 直接更新其他字段，也可显式替换或清空；通知渠道页 typecheck 与 build 通过。	cd client && npm run typecheck && npm run build	manual	DONE	DONE	DONE	client/src/api/notificationChannels.ts|client/src/pages/NotificationChannelsPage.tsx|client/src/api/errorMessages.ts	["IM2-1","IM2-2"]	read model and write model are split so secret becomes write-only plus clearSecret control
6	IM2-4	回归与文档矩阵收口	补齐通知渠道路由单测 扩展 IM 回归脚本并刷新 requirements integration-boundaries 与 feature-matrix 的 I4 事实源口径，明确本轮仅完成企微真实出站而飞书钉钉与 IM-3 IM-4 继续 backlog。	新 CSV 校验通过；IM 专项回归 相关单测 矩阵校验与 git diff --check 均通过；文档不再将企微真实 webhook 出站描述为纯 backlog。	cd server && npm test -- server/tests/unit/routes/notifications.test.js server/tests/unit/services/imRouting.test.js server/tests/unit/services/imEnqueue.test.js server/tests/unit/services/integrations/dispatcher.test.js server/tests/unit/integrations.dispatcher.test.js && ./scripts/regression-im-notifier.sh && cd .. && python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-03-13_21-04-30-p23-im2-wecom-productionization-refresh.csv && python3 scripts/validate-feature-matrix.py && git diff --check	manual	DONE	DONE	DONE	server/scripts/regression-im-notifier.sh|docs/requirements-specification.md|docs/integration-boundaries.md|docs/feature-matrix.md|issues/2026-03-13_21-04-30-p23-im2-wecom-productionization-refresh.csv	["IM2-2","IM2-3"]	refresh I4 evidence only and keep matrix cardinality unchanged unless validator requires a fact-source adjustment