hyb-oa/issues/2026-05-19_01-10-32-wecom-runtime-ready-v1.csv

ID,Title,Description,Acceptance,Test_Method,Tools,Dev_Status,Review1_Status,Regression_Status,Files,Dependencies,Notes
"WRV1-0","合同建档与边界冻结","建立 WECOM-RUNTIME-READY-V1 执行合同，承接用户确认：主线为运行优先 V1，审批模板、测试 sp_no、真实回调先列阻断，允许 SYNC_ENV=0 受控部署和公网低风险验证。","1) CSV 校验通过；2) 范围限定为企微入口、OAuth/绑定、脱敏消息、OA deeplink、通讯录 userid 清单、人事助手读取、打卡读取和审批/回调配置缺口分类；3) 不补企微资料；4) 不配置审批模板/sp_no/真实回调；5) 不进入 wecom_attendance_approval_mirror_v1。","受影响流程：企微运行优先能力 -> QA-only 运行就绪检查 -> 公网低风险验证 -> 后续阶段门禁；验证步骤：python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-05-19_01-10-32-wecom-runtime-ready-v1.csv。","python3|manual","DONE","DONE","DONE","issues/2026-05-19_01-10-32-wecom-runtime-ready-v1.csv","[]","CSV 校验通过；回滚路径：本轮只新增 QA-only runner、npm script、单测和文档；不改 schema、不改公开业务 API、不写企微资料；如公网配置阻断，只记录 SKIP/BLOCKED_BY_EXTERNAL_CONFIG。"
"WRV1-1","核实现有企微运行能力","读取 wecomAuth、通知、HR 主数据、打卡同步和 API 目录，确认 runner 复用既有能力且不引入 runtime Secret fallback。","1) 入口/OAuth 使用 WECOM_AGENT_SECRET；2) 通讯录 userid 清单固定 WECOM_CONTACT_SECRET + user/list_id；3) 人事助手固定 WECOM_AGENT_SECRET + get_staff_info；4) 打卡默认 WECOM_AGENT_SECRET，显式 WECOM_CHECKIN_SECRET 可 override；5) 消息默认 dry-run。","受影响流程：企微入口/绑定/消息/通讯录/人事助手/打卡 -> 运行就绪门禁；验证步骤：rg -n 'wecomAuth|sendWecomMessage|fetchWecomHrProfiles|fetchWecomCheckinData|WECOM_CONTACT_SECRET|WECOM_AGENT_SECRET' server/src docs/企微API能力目录.md。","rg|manual","DONE","DONE","DONE","server/src/routes/wecomAuth.js|server/src/services/integrations|docs/企微API能力目录.md","[""WRV1-0""]","已核实现有服务：通讯录 list_id 固定 WECOM_CONTACT_SECRET，人事助手固定 WECOM_AGENT_SECRET，打卡 WECOM_CHECKIN_SECRET 显式优先否则 WECOM_AGENT_SECRET，消息默认 dry-run；runner 未实现 Secret 试错。"
"WRV1-2","新增运行就绪 QA runner","新增 server/src/scripts/check-wecom-runtime-ready.js 和 npm script check:wecom-runtime-ready，输出脱敏 summary.json；默认只 dry-run，live 只读检查可访问企微 API，真实消息发送需双确认。","1) 输出 PASS_RUNTIME_READY、PASS_WITH_CONFIG_GAPS 或 SKIP/BLOCKED_BY_EXTERNAL_CONFIG；2) 报告只含计数、员工号、脱敏 userid 前缀、token source 和配置缺口；3) 不输出手机号、邮箱、完整 userid、secret、token 或原始 payload；4) 默认不发消息；5) --send-test-message 必须配合 WECOM_RUNTIME_TEST_SEND=1。","受影响流程：管理员/QA 执行运行就绪检查 -> 生成脱敏门禁报告 -> 判断是否能进入后续阶段；验证步骤：cd server && node --check src/scripts/check-wecom-runtime-ready.js；cd server && node src/scripts/check-wecom-runtime-ready.js --help。","node|pg","DONE","DONE","DONE","server/src/scripts/check-wecom-runtime-ready.js|server/package.json","[""WRV1-1""]","已新增 runner 和 npm script；node --check 通过，--help 输出正常；默认不发消息，--send-test-message 需 WECOM_RUNTIME_TEST_SEND=1。"
"WRV1-3","单测覆盖运行门禁边界","新增 focused vitest，覆盖 Secret 固定选择、无 fallback、通讯录 list_id、人事助手 WECOM_AGENT_SECRET、打卡 secret override、审批缺配置分类、消息发送双确认和脱敏输出。","1) 缺运行优先主链路配置时返回 BLOCKED；2) 审批模板/sp_no/回调缺失只返回 PASS_WITH_CONFIG_GAPS；3) dry-run 不发真实消息；4) 未设置 WECOM_RUNTIME_TEST_SEND=1 时 --send-test-message 抛错；5) 报告不含隐私字段。","受影响流程：运行就绪 runner -> 结论分类 -> 隐私边界；验证步骤：cd server && npx vitest run tests/unit/scripts/check-wecom-runtime-ready.test.js --reporter=verbose。","vitest","DONE","DONE","DONE","server/tests/unit/scripts/check-wecom-runtime-ready.test.js","[""WRV1-2""]","focused 单测通过：8 tests passed；只 mock fetch/DB，不访问真实企微；覆盖双确认、固定 Secret、NEEDS_CONFIG 和脱敏。"
"WRV1-4","本地静态和回归门禁","执行本地语法、Prisma、focused 单测和既有企微相关单测，确认 runner 不破坏入口、通知、打卡和 HR 主数据能力。","1) node --check runner、wecomAuth、attendance 通过；2) prisma validate 通过；3) focused vitest 通过；4) git diff --check 通过。","受影响流程：本地实现 -> 可部署 QA-only 验证；验证步骤：cd server && node --check src/scripts/check-wecom-runtime-ready.js；cd server && node --check src/routes/wecomAuth.js；cd server && node --check src/routes/attendance.js；cd server && npm run prisma:validate；cd server && npx vitest run tests/unit/scripts/check-wecom-runtime-ready.test.js tests/unit/routes/wecomAuth.test.js tests/unit/routes/notifications.test.js tests/unit/routes/attendance.test.js tests/unit/wecomHrMaster.service.test.js --reporter=verbose；git diff --check。","node|npm|git","DONE","DONE","DONE","server/src/scripts/check-wecom-runtime-ready.js|server/tests/unit/scripts/check-wecom-runtime-ready.test.js|server/package.json","[""WRV1-3""]","本地静态、Prisma、focused + 既有企微相关单测通过：5 files / 43 tests passed；git diff --check 通过。"
"WRV1-5","事实源回写","更新路线图、企微基础设施规约、统一审批规约、管理员手册、人工试运行报告、文档索引、事实源矩阵和 skill，固化 WRV1 结论与下一阶段边界。","1) 文档记录运行优先能力检查结果；2) 明确审批模板/sp_no/真实回调仍为 NEEDS_CONFIG；3) 明确不代表深度镜像、应急接管、恢复回写或 RuleOps 已完成；4) 文档审计通过。","受影响流程：事实源读取 -> 后续派工和阶段判断；验证步骤：node scripts/qa/audit-docs.mjs --check-registry；python3 /home/shunli/.codex/skills/.system/skill-creator/scripts/quick_validate.py .agents/skills/hyb-oa-delivery；rg -n 'WECOM-RUNTIME-READY-V1|PASS_RUNTIME_READY|PASS_WITH_CONFIG_GAPS|BLOCKED_BY_EXTERNAL_CONFIG|sp_no|真实回调' docs .agents/skills/hyb-oa-delivery/SKILL.md。","node|python3|rg","DONE","DONE","DONE","docs|.agents/skills/hyb-oa-delivery/SKILL.md","[""WRV1-4""]","已更新路线图、企微基础设施、审批、管理员手册、试运行报告、文档索引、事实源矩阵、产品口径、开发交付规约、请假考勤规约和 skill；audit-docs errors=0 warnings=1（既有未登记文档告警），skill quick_validate 通过，rg 门禁通过。"
"WRV1-6","公网受控部署与 live 只读验证","以 SYNC_ENV=0 受控部署 QA-only 变更，远端执行 npm run check:wecom-runtime-ready -- --live --format=json；默认不发真实消息。","1) 部署不覆盖远端 env；2) /ready、runtime smoke、public bundle scan 通过；3) 远端报告结论为 PASS_RUNTIME_READY、PASS_WITH_CONFIG_GAPS 或真实 SKIP/BLOCKED_BY_EXTERNAL_CONFIG；4) 不写企微资料，不发送真实消息，除非单独带双确认。","受影响流程：公网运行就绪检查 -> 后续阶段门禁；验证步骤：SYNC_ENV=0 bash deploy/trialrun/deploy.sh；ssh 远端容器执行 npm run check:wecom-runtime-ready -- --live --format=json。","bash|ssh|node","DONE","DONE","DONE","external|artifacts/qa-flow/wecom-runtime-ready-*","[""WRV1-5""]","SYNC_ENV=0 受控部署完成，未同步本地 env；/ready、runtime smoke 和 public bundle scan 通过。远端容器 live runner 报告 /app/artifacts/qa-flow/wecom-runtime-ready-20260518T173402Z/summary.json，结论 SKIP/BLOCKED_BY_EXTERNAL_CONFIG，阻断项为 WECOM_CHECKIN_SYNC_ENABLED 未启用；入口/OAuth、Secret 矩阵、OA active 绑定、通讯录、人事助手和消息 dry-run 通过；未写企微资料，未发送真实消息。"
"WRV1-7","状态回填与中文提交","完成 Issue 状态回填、本地和公网证据核对、隐私检查和中文提交。","1) WRV1-0..6 按实际结果回填；2) 所有 Test_Method 有结果；3) git diff 不含 secret、token、手机号、邮箱、完整 userid 或原始 payload；4) 中文 commit 引用 WRV1。","受影响流程：Issue CSV -> 验证证据 -> 提交审计 -> 下一阶段入口；验证步骤：git status --short；git log -1 --oneline。","git|manual","DONE","DONE","DONE","issues/2026-05-19_01-10-32-wecom-runtime-ready-v1.csv|server|docs|.agents/skills/hyb-oa-delivery/SKILL.md","[""WRV1-6""]","已按实际公网结果回填状态；最终门禁和隐私检查通过后提交中文 commit，commit hash 在最终答复中记录。"