hyb-oa/.trellis/tasks/05-26-oaops1-patrol-feature-review/info.md

OAOPS1 Patrol Review Findings

Review Scope

Reviewed:

• scripts/qa/run-oa-real-use-daily.sh
• scripts/qa/run-oa-final-launch-readiness.sh
• scripts/qa/check-oa-only-smoke-readiness.mjs
• docs/管理员手册.md
• docs/文档事实源状态矩阵.md

Commands run:

• bash -n scripts/qa/run-oa-real-use-daily.sh
• bash -n scripts/qa/run-oa-final-launch-readiness.sh

No deployment, public OA writes, Enterprise WeChat writes, payment actions or database restore were performed.

Findings

High: Daily patrol can hide child PASS_WITH_FINDINGS results

run-oa-real-use-daily.sh wraps child checks with run_finding_step, which marks a step as PASS whenever the command exits 0. check-oa-only-smoke-readiness.mjs returns exit 0 when role credentials are missing but emits summary status PASS_WITH_FINDINGS. The parent summary only inspects parent step status plus the local authenticated probe, so child PASS_WITH_FINDINGS can be lost and the daily patrol can conclude PASS_OA_REAL_USE_DAILY_READY.

Why it matters:

• docs/管理员手册.md requires missing live smoke credentials to be recorded as finding or SKIP, not disguised as pass.
• OALAUNCH1 reads latestOaops.findingCount; if the daily report loses child findings, final readiness can understate risk.

Evidence:

• scripts/qa/run-oa-real-use-daily.sh lines 63-66 mark a child command as PASS only by exit code.
• scripts/qa/check-oa-only-smoke-readiness.mjs lines 253-259 emits PASS_WITH_FINDINGS when credentials are skipped.
• scripts/qa/check-oa-only-smoke-readiness.mjs line 288 exits non-zero only for blocking failures.
• scripts/qa/run-oa-real-use-daily.sh lines 412-426 build findings without reading the child summary statuses.

Recommended fix:

• Add a report-aware step wrapper for child reports. After each child command, read its summary.json; promote PASS_WITH_FINDINGS, SKIP, PARTIAL, PAUSED and child findingCount > 0 into parent findings.
• Include oa-only-smoke-readiness in childReports, not just live-readiness.

High: Privacy smoke failure can leave summary.json saying PASS

run-oa-real-use-daily.sh writes summary.json before running report-privacy-smoke. If privacy smoke fails, it sets STATUS=1 and exits non-zero, but the already-written summary is not regenerated. The report can therefore contain a PASS conclusion while the script fails.

Why it matters:

• Day 7 review is driven by summary.json.
• A privacy violation must be visible in the machine-readable report, not only in process exit code or console output.

Evidence:

• scripts/qa/run-oa-real-use-daily.sh lines 505-510 write summary, then run privacy smoke, then exit.
• scripts/qa/run-oa-final-launch-readiness.sh lines 483-486 already has the better pattern: rewrite summary when privacy status changes.

Recommended fix:

• Mirror the OALAUNCH1 pattern in OAOPS1: run privacy smoke after summary, then rewrite summary if status changed.
• Add an explicit report-privacy-smoke step/finding to the daily summary.

Medium: Privacy smoke prints raw matches to stdout

OAOPS1 privacy smoke prints the full grep matches when it detects sensitive patterns. If the match is a token, phone number, email or raw key line, the scanner itself leaks it into terminal/CI logs.

Why it matters:

• Privacy tooling should not echo the sensitive value it detected.
• This violates the current report discipline: status/count/path summaries only.

Evidence:

• scripts/qa/run-oa-real-use-daily.sh lines 347-351 capture and print raw grep matches.

Recommended fix:

• Store only redacted match metadata: file path, line number and rule name.
• Do not print full matched lines.

Medium: Daily summary writes full local paths

OAOPS1 step JSON and summary use absolute local paths for logPath and reportDir. Current project privacy rules prohibit complete local paths in task/docs/reports.

Why it matters:

• The final launch script already uses repo-relative reportRef for this reason.
• These daily reports may be copied into Trellis task evidence or user-facing summaries.

Evidence:

• scripts/qa/run-oa-real-use-daily.sh line 35 writes absolute logPath.
• scripts/qa/run-oa-real-use-daily.sh line 380 writes absolute missing-step logPath.
• scripts/qa/run-oa-real-use-daily.sh line 443 writes absolute reportDir.
• scripts/qa/run-oa-final-launch-readiness.sh lines 160-167 use safer relative reportRef.

Recommended fix:

• Add a reportRef(file) helper to OAOPS1 and use repo-relative paths when possible.
• Replace reportDir with reportRef or keep reportDirName only.

Medium: Read-only probe can record business totals, not only counts/status

The authenticated read-only probe records any short string field that is not excluded by a narrow key regex. In observed evidence, reimbursement aggregate amount appears in the patrol report. The report policy says generated evidence should keep status/count/report-path summaries, not business amounts.

Why it matters:

• Aggregate amounts can still be sensitive business information in a small team.
• OALAUNCH evidence should remain safe to copy into task notes.

Evidence:

• scripts/qa/run-oa-real-use-daily.sh lines 197-207 allow numeric/boolean values and short strings.
• Observed latest daily report includes a reimbursement totalAmount aggregate in the authenticated probe summary.

Recommended fix:

• Change summarizePayload to an allowlist: item counts, totals as record counts only, status/mode/conclusion and booleans that are operational states.
• Drop amount, money, balance, price, cost, bank and invoice-value-like fields.

Overall Assessment

The patrol function is directionally useful and already covers the right operational domains: public readiness, live smoke, feature flags, OA-only roles, read-only business probes, mobile/WeCom entry and privacy checks.

Before starting the formal 7-day OAOPS1 window, it should be improved in a small technical task. The most important fix is report-status correctness: parent reports must faithfully include child findings and privacy failures.

Suggested Improvement Order

1. Fix child summary propagation and parent findingCount.
2. Fix privacy-smoke summary rewrite and redacted match output.
3. Replace absolute paths with report refs.
4. Reduce authenticated probe payload summaries to operational counts/status only.
5. Re-run bash -n, default OAOPS1 daily, and default OALAUNCH1 readiness.

Implementation Result

Implemented in scripts/qa/run-oa-real-use-daily.sh:

• Step JSON now writes repo-relative logRef instead of absolute logPath.
• Daily summary now writes reportRef instead of absolute reportDir.
• Parent daily summary reads child summary.json for live-smoke-readiness and oa-only-smoke-readiness.
• Child PASS_WITH_FINDINGS, SKIP, MISSING, PAUSED, PARTIAL, blocker statuses and child finding counts now contribute to parent findings.
• Privacy smoke now writes redacted privacy-findings.txt metadata instead of printing raw grep matches.
• Privacy smoke now records a report-privacy-smoke step and summary is rewritten after privacy checks.
• Authenticated probe payload summary now uses an allowlist and excludes amount, money, price, cost, balance, bank, receipt, account, invoice, tax, fee, paid and payment fields.

Final validation report:

• .trellis/tasks/05-26-oaops1-patrol-feature-review/research/oaops1-after-patrol-fix-final/summary.json
• Status: PASS_WITH_FINDINGS
• Parent finding count: 4
• childReports.oaOnlySmokeReadiness.status: PASS_WITH_FINDINGS
• childReports.oaOnlySmokeReadiness.findingCount: 7
• report-privacy-smoke: PASS
• No full local path matches in summary.json.
• No business amount key matches in summary.json or authenticated-readonly-probe.json.