WTCLOSE1 收口测试号全域证据 dry-run

scripts/qa/collect-wecom-controlled-trial-evidence.sh

@@ -107,6 +107,8 @@ write_manual_checklist() {
 - C：必须申请人手选审批人。
 - D：当前看不到或模板未配置。
 
+小团队默认规则：公司不到 10 人，按一层直属主管或指定审批角色自动带出审批人；主管链缺失、审批人不可见/停用/未绑定或命中自审时，由管理员兜底或阻断。当前目标按 A 执行，B/C/D 均视为阻断 WEXT1-LIVE 和 WREAL1 的 finding。
+
 需要记录的字段：模板入口、适用范围、审批人规则、是否允许申请人手选、是否可能自审、主管链缺失时表现、审批人不可见或停用时表现。
 
 边界：不要记录 Secret、token、EncodingAESKey、完整 userid、完整审批单号、完整 template_id、表单值、附件、评论或原始 payload。
@@ -115,7 +117,10 @@ EOF
 
 run_privacy_smoke() {
   local sensitive_pattern='access_token=[A-Za-z0-9._-]{8,}|1[3-9][0-9]{9}|[[:alnum:]._%+-]+@[[:alnum:].-]+\.[[:alpha:]]{2,}|-----BEGIN|BEGIN [A-Z ]*KEY|"((token|secret|password|EncodingAESKey|encodingAESKey|sp_no|spNo|template_id|templateId|userid|userId|external_userid|externalUserId|external_user_id))"[[:space:]]*:[[:space:]]*"[^"*]{8,}"|\b20[0-9]{12,}\b|"(raw|rawPayload|raw_payload|payload|xml|ciphertext|Encrypt|formValue|formValues|attachments|comments)"[[:space:]]*:'
-  if grep -RInE "$sensitive_pattern" "$REPORT_DIR"; then
+  local matches
+  matches="$(grep -RInE "$sensitive_pattern" "$REPORT_DIR" | grep -vE 'HRWDTEST-[0-9]{14}' || true)"
+  if [[ -n "$matches" ]]; then
+    printf '%s\n' "$matches"
     log "[wauto1][FAIL] privacy smoke matched sensitive pattern"
     STATUS=1
   else
@@ -227,7 +232,7 @@ const manualGates = [
     id: "WAPPR1",
     status: "PENDING_MANUAL_CONFIRMATION",
     owner: "HYD000006",
-    requiredEvidence: "请假、补卡、外出、加班逐模板审批人自动化选项 A/B/C/D",
+    requiredEvidence: "请假、补卡、外出、加班逐模板均达到 A；小团队采用一层主管/指定审批角色 + 管理员兜底",
   },
   {
     id: "WEXT1-LIVE",

scripts/qa/run-three-day-full-goal-smoke.sh

@@ -91,6 +91,21 @@ run_client_finding_step() {
   fi
 }
 
+run_client_spec_if_present() {
+  local name="$1"
+  local spec="$2"
+  shift 2
+
+  if [[ ! -f "$CLIENT_DIR/$spec" ]]; then
+    log "[wfullsmoke1][FINDING] $name missing client spec in current runtime image: $spec"
+    FINDING_COUNT=$((FINDING_COUNT + 1))
+    write_step_json "$name" "FINDING" "finding_allowed" 0 "client spec missing in current runtime image: $spec"
+    return 0
+  fi
+
+  run_client_finding_step "$name" "$@" npx playwright test "$spec" --workers=1 --reporter=list
+}
+
 load_default_env() {
   local env_file="${WFULLSMOKE_ENV_FILE:-$HOME/.hyb-oa/live-smoke.env}"
   if [[ "${WFULLSMOKE_SKIP_ENV_FILE:-0}" == "1" || ! -f "$env_file" ]]; then
@@ -212,15 +227,12 @@ run_oa_business_chain() {
 }
 
 run_mobile_and_wecom_entry() {
-  run_client_finding_step "mobile-entry-matrix" \
-    E2E_BASE_URL="$PUBLIC_BASE_URL" \
-    npx playwright test tests/e2e/r124-mobile-entry-matrix.spec.ts --workers=1 --reporter=list
-  run_client_finding_step "wecom-rendering-matrix" \
-    E2E_BASE_URL="$PUBLIC_BASE_URL" \
-    npx playwright test tests/e2e/r6-wecom-mobile-rendering-hardening.spec.ts --workers=1 --reporter=list
-  run_client_finding_step "wecom-entry" \
-    E2E_BASE_URL="$PUBLIC_BASE_URL" \
-    npx playwright test tests/e2e/wecom-entry.spec.ts --workers=1 --reporter=list
+  run_client_spec_if_present "mobile-entry-matrix" "tests/e2e/r124-mobile-entry-matrix.spec.ts" \
+    E2E_BASE_URL="$PUBLIC_BASE_URL"
+  run_client_spec_if_present "wecom-rendering-matrix" "tests/e2e/r6-wecom-mobile-rendering-hardening.spec.ts" \
+    E2E_BASE_URL="$PUBLIC_BASE_URL"
+  run_client_spec_if_present "wecom-entry" "tests/e2e/wecom-entry.spec.ts" \
+    E2E_BASE_URL="$PUBLIC_BASE_URL"
 }
 
 write_manual_checklist() {
@@ -236,6 +248,7 @@ write_manual_checklist() {
 - SMOKE002：继续按企微规则打卡。
 - HYD000006：检查请假、补卡、外出、加班四类模板审批规则。
 - WAPPR1 选项：A 审批人自动带出且申请人不能任意选择；B 默认带出但申请人仍可改人；C 必须申请人手选；D 当前看不到或模板未配置。只有 A 放行。
+- 小团队规则：公司不到 10 人，默认一层直属主管或指定审批角色自动带出审批人；主管链缺失、审批人不可见/停用/未绑定或命中自审时，由管理员兜底或阻断。
 
 ## Day 3
 - HYD000006：确认三天业务结果和 OA 历史可读性。
@@ -247,7 +260,10 @@ EOF
 
 run_privacy_smoke() {
   local sensitive_pattern='access_token=[A-Za-z0-9._-]{8,}|1[3-9][0-9]{9}|[[:alnum:]._%+-]+@[[:alnum:].-]+\.[[:alpha:]]{2,}|-----BEGIN|BEGIN [A-Z ]*KEY|"((token|secret|password|EncodingAESKey|encodingAESKey|sp_no|spNo|template_id|templateId|userid|userId|external_userid|externalUserId|external_user_id))"[[:space:]]*:[[:space:]]*"[^"*]{8,}"|\b20[0-9]{12,}\b|"(raw|rawPayload|raw_payload|payload|xml|ciphertext|Encrypt|formValue|formValues|attachments|comments)"[[:space:]]*:'
-  if grep -RInE "$sensitive_pattern" "$REPORT_DIR"; then
+  local matches
+  matches="$(grep -RInE "$sensitive_pattern" "$REPORT_DIR" | grep -vE 'HRWDTEST-[0-9]{14}' || true)"
+  if [[ -n "$matches" ]]; then
+    printf '%s\n' "$matches"
     log "[wfullsmoke1][FAIL] report-privacy-smoke matched sensitive pattern"
     STATUS=1
   else
@@ -364,7 +380,7 @@ const manualGates = [
     id: "WAPPR1",
     status: "PENDING_MANUAL_CONFIRMATION",
     owner: "HYD000006",
-    requiredEvidence: "四类模板均为 A：审批人自动带出且申请人不能任意选择",
+    requiredEvidence: "四类模板均为 A：一层主管/指定审批角色自动带出，申请人不能任意选择；缺主管/不可用/自审时管理员兜底或阻断",
   },
   {
     id: "WEXT1-LIVE",