hyb-oa/issues/2026-03-07_18-16-00-g2-l5-cross-domain-bridge.csv

ID,Title,Description,Acceptance,Test_Method,Tools,Dev_Status,Review1_Status,Regression_Status,Files,Dependencies,Notes
G2-0,G2执行合同建档,创建并校验G2跨域兼容桥接执行合同CSV,CSV通过校验且字段完整,python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-03-07_18-16-00-g2-l5-cross-domain-bridge.csv,manual,DONE,DONE,DONE,issues/2026-03-07_18-16-00-g2-l5-cross-domain-bridge.csv,[],G2只处理预算 编号 工作流跨域桥接不进入采购业务表
G2-1,扩展预算与工作流跨域兼容模型,为BudgetPool BudgetLedgerEntry WorkflowInstance补齐采购与主数据桥接字段并生成迁移,Prisma schema与迁移可通过校验且保持报销兼容,cd server && npm run prisma:validate && npx prisma migrate dev --name g2_cross_domain_bridge && npm run prisma:generate,manual,DONE,DONE,DONE,server/prisma/schema.prisma | server/prisma/migrations,"[""G2-0""]",保留department_id与reimbursement_id兼容字段
G2-2,补齐预算接口与通用单据编号读取,扩展预算API支持法体与成本中心维度并新增通用document sequence读取与运行时helper,预算接口和document sequence接口可兼容报销并支撑后续采购,cd server && npm run test,manual,DONE,DONE,DONE,server/src/routes/budgets.js | server/src/routes/configRead.js | server/src/routes/reimbursements.js | server/src/utils | server/src/app.js,"[""G2-1""]",禁止引入新的全局mapper框架
G2-3,扩展权限解析与工作流实体元数据,为resolveEntityPermission补齐procurement实体并在workflow内新增实体展示元数据,采购任务可按procurement.approve出动作且报销请假不回归,cd server && npm run test && ./scripts/regression-workflow-actions.sh,manual,DONE,DONE,DONE,server/src/constants/permissions.js | server/src/routes/workflow.js | server/src/plugins/auth.js,"[""G2-1""]",仅新增本地helper getWorkflowEntityMeta 不新增permission-mapper.js
G2-4,升级预算前端为多作用域模式,将BudgetsPage从部门预算升级为全局 部门 法体加成本中心三模式并补法体成本中心筛选,预算前端支持新维度创建与筛选且兼容旧部门预算,cd client && npm run typecheck && npm run build,manual,DONE,DONE,DONE,client/src/api/budgets.ts | client/src/pages/BudgetsPage.tsx | client/src/api/masterData.ts,"[""G2-2"",""G2-3""]",不新增独立预算重构页面继续使用BudgetsPage
G2-5,同步R9与G2事实源,新增R9路线合同并在feature-matrix中补G2阶段事实源与说明,矩阵校验通过且G2与R9可追溯,python3 scripts/validate-feature-matrix.py,manual,DONE,DONE,DONE,docs/feature-matrix.md | issues/2026-03-07_18-15-03-r9-g2-p19-roadmap-refresh.csv | issues/2026-03-07_18-16-00-g2-l5-cross-domain-bridge.csv,"[""G2-4""]",旧P16到P18蓝图保留为历史快照不回写
G2-6,G2回归与安全收口,执行后端前端总回归并完成预算 编号 工作流的越权负测,跨域桥接通过回归且无报销请假回归,cd server && npm run test && ./scripts/regression-all.sh && cd ../client && npm run typecheck && npm run build,manual,DONE,DONE,DONE,issues/2026-03-07_18-16-00-g2-l5-cross-domain-bridge.csv | server/src/routes/budgets.js | server/src/routes/configRead.js | server/src/routes/workflow.js | client/src/pages/BudgetsPage.tsx,"[""G2-5""]",合并前使用security-best-practices复核预算与对象越权