归档第二轮降噪部署复检任务（frontend-simplification-wave2-deploy-verify）

2026-05-29 13:46:28 +08:00
@@ -0,0 +1,6 @@
+{"file": ".trellis/spec/hyb-oa/deployment-trialrun.md", "reason": "Check public deployment safety mode and required postdeploy evidence."}
+{"file": ".trellis/spec/hyb-oa/frontend-react-vite-design.md", "reason": "Check comparison output and frontend validation against task-first simplification rules."}
+{"file": ".trellis/spec/hyb-oa/docs-and-evidence.md", "reason": "Check generated evidence summaries avoid absolute paths and sensitive fields."}
+{"file": ".trellis/spec/hyb-oa/security-privacy.md", "reason": "Check task artifacts and report summaries do not leak secrets or confidential data."}
+{"file": ".trellis/spec/hyb-oa/project-governance.md", "reason": "Check Trellis validate/governance/commit flow."}
+{"file": ".trellis/tasks/05-29-frontend-simplification-wave2-deploy-verify/research/deploy-verify-context.md", "reason": "Check task-specific expected evidence outputs."}
@@ -0,0 +1,6 @@
+{"file": ".trellis/spec/hyb-oa/deployment-trialrun.md", "reason": "Public trial-run deployment command, env sync boundary, postdeploy reporting requirements."}
+{"file": ".trellis/spec/hyb-oa/frontend-react-vite-design.md", "reason": "Frontend design verification and PC task-first simplification rules."}
+{"file": ".trellis/spec/hyb-oa/docs-and-evidence.md", "reason": "Evidence/report path and summary hygiene for generated QA artifacts."}
+{"file": ".trellis/spec/hyb-oa/security-privacy.md", "reason": "Sensitive data and report redaction boundaries."}
+{"file": ".trellis/spec/hyb-oa/project-governance.md", "reason": "Trellis task, validation and commit governance for this deployment task."}
+{"file": ".trellis/tasks/05-29-frontend-simplification-wave2-deploy-verify/research/deploy-verify-context.md", "reason": "Task-specific deployment and comparison evidence plan."}
@@ -0,0 +1,52 @@
+# Implementation Plan
+
+## Sequence
+
+1. Finish task planning artifacts and validate the Trellis task.
+2. Build the second wave before/after comparison:
+   - Capture "before" screenshots from the commit before `5f10b83`.
+   - Capture "after" screenshots from current `main`.
+   - Use the existing Playwright mock visual suites so business data is synthetic.
+   - Write `output/playwright/frontend-simplification-wave2-compare/index.html`.
+3. Run deployment preflight checks:
+   - frontend typecheck/build
+   - UI design rule checker
+   - deployment env contract checker
+   - `git diff --check`
+4. Deploy with the approved safe command:
+   - `SYNC_ENV=0 bash deploy/trialrun/deploy.sh`
+5. Run post-deploy readonly verification:
+   - live smoke readiness
+   - permission matrix
+   - PC readonly visual matrix
+   - mobile entry matrix
+   - WeCom rendering matrix
+6. Record a concise postdeploy summary under `research/`, using only relative report references and redacted conclusions.
+7. Run Trellis governance and final whitespace check.
+
+## Screenshot Strategy
+
+- Prefer a temporary git worktree for the "before" commit so the current working tree remains intact.
+- Do not use destructive checkout/reset commands in the main worktree.
+- Reuse test-generated screenshots where available:
+  - `output/playwright/pc-core-workflow-visual-wave2/`
+  - `output/playwright/pc-detail-mobile-visual-wave3/`
+- If the old and new screenshot filenames differ, normalize them by copying the selected images into the comparison output directory with stable names.
+
+## Stop Conditions
+
+- Unexpected dirty files outside the current task or generated comparison output.
+- Deployment script fails.
+- Public `/ready` fails.
+- Permission matrix reports a blocker.
+- PC readonly visual matrix reports a P1 blocker.
+- Any generated report contains secrets, raw payloads, full accounts or full local paths.
+
+## Safety Boundaries
+
+- No remote `.env` overwrite.
+- No real business write automation.
+- No Enterprise WeChat writes.
+- No real payment, bank import or ERP write.
+- No database reset, restore or manual migration.
+- No production config edits.
@@ -0,0 +1,140 @@
+# 部署并复检前端降噪第二轮
+
+## Goal
+
+将已完成并提交的第二轮前端降噪改动部署到公网试运行环境，并完成本地、截图对比和公网只读验证，确认审批中心与报销详情的新信息架构已经在试运行版本生效，且没有引入登录、审批、报销、移动入口或企业微信渲染回归。
+
+本任务只做已提交前端改动的部署、对比和只读验证；不继续扩大页面重构范围，不写真实业务数据，不覆盖远端 `.env`。
+
+## Scope
+
+- 部署当前 `main` 中第二轮前端降噪改动到公网试运行环境。
+- 生成审批中心、报销详情和审批任务详情的第二轮前后截图对比。
+- 修正部署门禁中暴露的非业务阻断，例如正式文案和测试断言漂移。
+- 执行部署前本地门禁和部署后公网只读验证矩阵。
+- 在当前 Trellis task 中保存脱敏摘要和相对报告路径。
+
+## What I Already Know
+
+- 用户已经确认第一轮对比效果，并要求“保持这样，作为统一设计规则”。
+- 用户批准按建议继续执行下一步：部署第二轮降噪并生成第二轮前后对比。
+- 第二轮前端降噪已完成并提交：
+  - `5f10b83 重构审批中心与报销详情降噪（approval-detail-simplification-refactor）`
+  - `79f50b0 归档审批详情降噪任务（approval-detail-simplification-refactor）`
+- 第二轮改动范围包括审批中心、报销详情、详情操作区和相关 Playwright 视觉/主流程测试。
+- 已存在第一轮对比页：`output/playwright/frontend-simplification-compare/index.html`。
+- 公网部署必须使用 `SYNC_ENV=0 bash deploy/trialrun/deploy.sh`，不得同步或覆盖远端 `.env`。
+
+## Requirements
+
+- 部署前补齐当前 Trellis 任务材料，记录执行边界、验证计划和脱敏证据位置。
+- 生成第二轮前后对比页：
+  - 输出目录：`output/playwright/frontend-simplification-wave2-compare/`
+  - 覆盖审批中心和报销详情 PC 页面。
+  - 对比基准使用第二轮重构前后 commit，视口和 mock 数据保持一致。
+  - 页面样式保持清爽、可扫读，不引入营销化说明。
+- 部署前必须复跑本地门禁：
+  - `cd client && npm run typecheck`
+  - `cd client && npm run build`
+  - `node scripts/qa/check-ui-design-rules.mjs --strict`
+  - `node deploy/trialrun/validate-env-contract.js`
+  - `git diff --check`
+- 公网部署必须使用安全模式：
+  - `SYNC_ENV=0 bash deploy/trialrun/deploy.sh`
+  - 不覆盖远端 `.env`
+  - 不做数据库重置、恢复或手工迁移
+- 部署后必须执行公网只读验证：
+  - `/ready` 和部署脚本自带 runtime smoke 结论
+  - live smoke / OCR readiness
+  - OA 权限矩阵
+  - OAFRONT3 PC 只读视觉矩阵
+  - 移动入口矩阵和企业微信渲染矩阵
+- 验证报告只登记相对路径、状态和脱敏摘要；不得写入密码、token、完整账号、完整本地路径、真实票据或 raw payload。
+
+## Acceptance Criteria
+
+- [x] 用户明确批准继续执行部署与第二轮对比。
+- [x] `prd.md`、`implement.md` 和上下文登记完成，并通过 Trellis task validate。
+- [x] 第二轮前后对比页生成完成，可从 `output/playwright/frontend-simplification-wave2-compare/index.html` 查看。
+- [x] 部署前本地门禁通过。
+- [x] `SYNC_ENV=0 bash deploy/trialrun/deploy.sh` 完成远端服务重建，未覆盖远端 `.env`；脚本内置 live smoke 因测试断言漂移退出，修正后标准 live readiness 已复跑通过。
+- [x] 部署后公网 `/ready` 通过。
+- [x] live smoke / OCR readiness 通过或有可解释 SKIP/PASS_WITH_FINDINGS。
+- [x] 权限矩阵通过。
+- [x] PC 只读视觉矩阵无 P1 blocker。
+- [x] 移动入口和企业微信渲染矩阵通过。
+- [x] 当前任务记录公网验证摘要和报告相对路径。
+- [x] Trellis governance 和 `git diff --check` 通过。
+
+## Result
+
+`READY_FOR_USER_TEST`
+
+## Definition Of Done
+
+- 公网试运行环境部署到包含第二轮降噪改动的 commit。
+- 第二轮视觉对比页与公网验证报告可用于说明“审批中心/报销详情已按统一降噪规则生效”。
+- 结论明确为 `READY_FOR_USER_TEST`、`READY_WITH_FINDINGS` 或 `BLOCKED_POSTDEPLOY_VERIFICATION`。
+- 只有在部署与公网只读检查通过或可解释后，才告知用户可以测试。
+
+## Out Of Scope
+
+- 不继续重构其他页面。
+- 不启动或重置真实 7 天试运行计数。
+- 不创建、提交、审批、付款任何真实业务单据。
+- 不写企业微信消息、通讯录、审批或回调数据。
+- 不改远端 `.env`、生产配置、Caddy 配置或生产数据库。
+- 不执行真实付款、银行流水导入、ERP 写入或支付接口联调。
+
+## Test Plan
+
+规划与上下文：
+
+```bash
+python3 ./.trellis/scripts/task.py validate 05-29-frontend-simplification-wave2-deploy-verify
+```
+
+截图对比：
+
+```bash
+cd client && npx playwright test tests/e2e/pc-core-workflow-visual-wave2.spec.ts --workers=1 --reporter=list
+cd client && npx playwright test tests/e2e/pc-detail-mobile-visual-wave3.spec.ts --grep "PC" --workers=1 --reporter=list
+```
+
+部署前：
+
+```bash
+cd client && npm run typecheck
+cd client && npm run build
+node scripts/qa/check-ui-design-rules.mjs --strict
+node deploy/trialrun/validate-env-contract.js
+git diff --check
+```
+
+部署：
+
+```bash
+SYNC_ENV=0 bash deploy/trialrun/deploy.sh
+```
+
+部署后：
+
+```bash
+LIVE_SMOKE_BASE_URL=https://oa.hyinda.com LIVE_SMOKE_READINESS_DIR=.trellis/tasks/05-29-frontend-simplification-wave2-deploy-verify/research/postdeploy-live-smoke-readiness bash scripts/qa/run-live-smoke-readiness.sh
+LIVE_SMOKE_BASE_URL=https://oa.hyinda.com OA_PERMISSION_MATRIX_REPORT_DIR=.trellis/tasks/05-29-frontend-simplification-wave2-deploy-verify/research/postdeploy-permission-matrix node scripts/qa/check-oa-permission-matrix.mjs
+bash scripts/qa/run-oafront3-pc-readonly-visual.sh
+cd client && E2E_BASE_URL=https://oa.hyinda.com npx playwright test tests/e2e/dg7-mobile-information-dedupe.spec.ts tests/e2e/r124-mobile-entry-matrix.spec.ts --workers=1 --reporter=list
+cd client && E2E_BASE_URL=https://oa.hyinda.com npx playwright test tests/e2e/r6-wecom-mobile-rendering-hardening.spec.ts --workers=1 --reporter=list
+node scripts/qa/check-trellis-governance.mjs
+git diff --check
+```
+
+## Technical Notes
+
+- Deployment spec: `.trellis/spec/hyb-oa/deployment-trialrun.md`
+- Frontend spec: `.trellis/spec/hyb-oa/frontend-react-vite-design.md`
+- Evidence spec: `.trellis/spec/hyb-oa/docs-and-evidence.md`
+- Privacy spec: `.trellis/spec/hyb-oa/security-privacy.md`
+- Governance spec: `.trellis/spec/hyb-oa/project-governance.md`
+- Trial run runbook: `docs/试运行与自动化验证手册.md`
+- First wave comparison reference: `output/playwright/frontend-simplification-compare/index.html`
@@ -0,0 +1,22 @@
+# Deploy Verify Context
+
+## Relevant Existing Evidence
+
+- Second wave implementation commit: `5f10b83`.
+- Second wave archive commit: `79f50b0`.
+- First wave comparison page: `output/playwright/frontend-simplification-compare/index.html`.
+- Prior public deploy verification task: `.trellis/tasks/archive/2026-05/05-26-oa-frontend-postdeploy-public-verification/`.
+
+## Derived Constraints
+
+- Deployment uses `SYNC_ENV=0 bash deploy/trialrun/deploy.sh`; remote `.env` must not be overwritten.
+- Reports should use task `research/` paths or existing QA artifact directories and only store relative references.
+- Screenshot comparison uses mocked Playwright data, not real business data.
+- User-facing "can test" conclusion is only allowed after deployment and public checks pass or have a clearly documented non-blocking finding.
+
+## Planned Evidence Outputs
+
+- `output/playwright/frontend-simplification-wave2-compare/index.html`
+- `.trellis/tasks/05-29-frontend-simplification-wave2-deploy-verify/research/postdeploy-summary.md`
+- `.trellis/tasks/05-29-frontend-simplification-wave2-deploy-verify/research/postdeploy-live-smoke-readiness/summary.json`
+- `.trellis/tasks/05-29-frontend-simplification-wave2-deploy-verify/research/postdeploy-permission-matrix/summary.json`
@@ -0,0 +1,46 @@
+{
+  "checkedAt": "2026-05-29T05:37:24.101Z",
+  "baseUrl": "https://oa.hyinda.com",
+  "liveSmokeReady": true,
+  "liveSmoke": {
+    "adminCredentialReady": true,
+    "employeeCredentialReady": true
+  },
+  "liveSmokeOptional": {
+    "expectedWecomStatusReady": true,
+    "managerCredentialReady": true,
+    "financeCredentialReady": true
+  },
+  "liveOcrReady": true,
+  "liveOcr": {
+    "userReady": true,
+    "invoiceSampleReady": true,
+    "invoiceFileProvided": true,
+    "invoiceFileReady": true,
+    "invoiceBatchDirProvided": false,
+    "invoiceBatchDirReady": false,
+    "allowDuplicate": true
+  },
+  "missing": [],
+  "publicReady": {
+    "ok": true,
+    "status": 200
+  },
+  "wecomConfig": {
+    "ok": true,
+    "status": 200,
+    "statusText": "ready",
+    "entryEnabled": true,
+    "oauthEnabled": true,
+    "defaultReturnTo": "/mobile",
+    "loginUrl": "/api/auth/wecom/login?returnTo=%2Fmobile"
+  },
+  "authCapabilities": {
+    "ok": true,
+    "status": 200,
+    "emailDeliveryReady": true,
+    "emailDeliveryReasons": [],
+    "emailLoginCodeEnabled": true,
+    "passwordResetEnabled": true
+  }
+}
@@ -0,0 +1,7 @@
+
+Running 1 test using 1 worker
+
+[live-ocr] {"alias":"SAMPLE-PDF-001","status":"ocr_failed","durationMs":1173,"transport":"ui","timings":{"uploadMs":1173,"terminalWaitMs":0},"reasonCategory":"duplicate_or_same_invoice","fieldHits":{"invoiceId":false,"invoiceCodeOrNumber":false,"sellerName":false,"totalAmount":false,"invoiceDate":false}}
+  ✓  1 tests/e2e/manual/live-invoice-ocr.spec.ts:8:1 › 手工 live 腾讯 OCR 辅助复核：真实 VAT 发票上传后进入可处理状态 (6.8s)
+
+  1 passed (10.5s)
@@ -0,0 +1,14 @@
+>>> 探活 live /ready: https://oa.hyinda.com/ready
+>>> 执行 live smoke Playwright
+
+> [email protected] test:e2e:live
+> playwright test tests/e2e/live-smoke.spec.ts
+
+
+Running 3 tests using 1 worker
+
+  ✓  1 tests/e2e/live-smoke.spec.ts:43:3 › live smoke › 公网基础探活与企微配置状态 (2.5s)
+  ✓  2 tests/e2e/live-smoke.spec.ts:64:3 › live smoke › 管理员只读网页 smoke (11.4s)
+  ✓  3 tests/e2e/live-smoke.spec.ts:106:3 › live smoke › 员工只读网页 smoke (10.7s)
+
+  3 passed (28.4s)
@@ -0,0 +1 @@
+[pending-ocr][SKIP] missing DATABASE_URL
@@ -0,0 +1 @@
+[public-bundle-copy] base=https://oa.hyinda.com scanned=91 focused=2 findings=0
@@ -0,0 +1,12 @@
+{
+  "issueId": "frontend-simplification-wave2-deploy-verify",
+  "baseURL": "https://oa.hyinda.com",
+  "commit": "c08ba72",
+  "checkedAt": "2026-05-29T05:38:17.239Z",
+  "status": "PASS",
+  "mode": "live-smoke-readiness",
+  "reportDir": ".trellis/tasks/05-29-frontend-simplification-wave2-deploy-verify/research/postdeploy-live-smoke-readiness",
+  "reportRef": ".trellis/tasks/05-29-frontend-simplification-wave2-deploy-verify/research/postdeploy-live-smoke-readiness",
+  "groups": null,
+  "notes": "公网 /ready、public bundle、pending OCR、live smoke 和真实 OCR 可用性检查；缺少凭据或样票时按脚本规则记录 SKIP。"
+}
@@ -0,0 +1,28 @@
+# OA 权限矩阵脱敏自动验证报告
+
+生成时间：2026-05-29T05:37:41.962Z
+结论：PASS_PERMISSION_MATRIX_READY
+
+## 统计
+
+- 角色数：7
+- 正向探针：43
+- 负向探针：42
+- 问题数：0
+
+## 角色结果
+
+| 角色 | 登录 | 角色匹配 | 探针通过/总数 |
+| --- | --- | --- | ---: |
+| employee | PASS | PASS | 17/17 |
+| manager | PASS | PASS | 13/13 |
+| finance | PASS | PASS | 14/14 |
+| finance_mgr | PASS | PASS | 10/10 |
+| hr | PASS | PASS | 11/11 |
+| ceo | PASS | PASS | 9/9 |
+| admin | PASS | PASS | 11/11 |
+
+## 说明
+
+- 本报告只输出角色、HTTP 状态、脱敏账号和摘要计数，不输出密码、token、Secret、完整账号、合同正文、票据内容或原始 payload。
+- 409 表示功能门禁关闭且未泄露数据；对财务/AP/付款等冻结或受控功能可作为可解释拒绝。
@@ -0,0 +1,42 @@
+# Postdeploy Summary
+
+## Conclusion
+
+`READY_FOR_USER_TEST`
+
+## Deployment
+
+- Deployed commit: `c08ba72`
+- Command: `SYNC_ENV=0 bash deploy/trialrun/deploy.sh`
+- Remote `.env`: not synced or overwritten.
+- Remote service rebuild, init, migration status and runtime deployment stages completed.
+- Note: the deploy script's integrated live smoke initially exited on a stale test assertion that looked for the old `Portal` nav label. The current UI exposes `工作台`; the shared smoke assertion was updated to accept both labels, then live smoke and the standard readiness suite passed.
+
+## Comparison Evidence
+
+- Second wave comparison page: `output/playwright/frontend-simplification-wave2-compare/index.html`
+- Pages compared: approval center, reimbursement detail, workflow task detail.
+- Data source: Playwright mock business data.
+- Baseline: before `29cfea2`, after `79f50b0` plus deployment gate copy fix in `c08ba72`.
+
+## Verification Results
+
+| Check | Result | Evidence |
+| --- | --- | --- |
+| Task validate | PASS | command output |
+| Frontend typecheck | PASS | command output |
+| Frontend build | PASS | command output |
+| UI design rules | PASS | command output |
+| Env contract | PASS | command output |
+| Public bundle copy scan | PASS | command output and live readiness report |
+| Live smoke readiness | PASS | `research/postdeploy-live-smoke-readiness/summary.json` |
+| Permission matrix | PASS_PERMISSION_MATRIX_READY | `research/postdeploy-permission-matrix/summary.json` |
+| PC readonly visual matrix | PASS_PC_READONLY_VISUAL_READY | `artifacts/qa-flow/oafront3-pc-readonly-visual-20260529-133832/summary.json` |
+| Mobile entry matrix | PASS | command output |
+| WeCom rendering matrix | PASS | command output |
+
+## Non-Blocking Notes
+
+- `pending OCR` scan reported `SKIP` because the local command did not receive `DATABASE_URL`; live OCR sample still ran through the standard readiness path.
+- Live OCR sample returned an explainable duplicate/same-invoice category and the readiness suite concluded PASS.
+- `rsync` printed a non-fatal warning for an old remote QA artifact directory that could not be deleted; deployment continued and postdeploy checks passed.
@@ -0,0 +1,33 @@
+{
+  "id": "frontend-simplification-wave2-deploy-verify",
+  "name": "frontend-simplification-wave2-deploy-verify",
+  "title": "部署并复检前端降噪第二轮",
+  "description": "部署第二轮前端降噪改动，生成审批中心和报销详情对比页，并完成公网只读验证。",
+  "status": "completed",
+  "dev_type": null,
+  "scope": "frontend-deploy-verify",
+  "package": null,
+  "priority": "P2",
+  "creator": "shunli",
+  "assignee": "shunli",
+  "createdAt": "2026-05-29",
+  "completedAt": "2026-05-29",
+  "branch": null,
+  "base_branch": "main",
+  "worktree_path": null,
+  "commit": null,
+  "pr_url": null,
+  "subtasks": [],
+  "children": [],
+  "parent": null,
+  "relatedFiles": [
+    "client/src/pages/PortalHomePage.tsx",
+    "client/tests/e2e/helpers/smokeAssertions.ts",
+    "deploy/trialrun/deploy.sh",
+    "scripts/qa/run-live-smoke-readiness.sh",
+    "scripts/qa/check-oa-permission-matrix.mjs",
+    "scripts/qa/run-oafront3-pc-readonly-visual.sh"
+  ],
+  "notes": "",
+  "meta": {}
+}
				`@@ -0,0 +1 @@`
				`[public-bundle-copy] base=https://oa.hyinda.com scanned=91 focused=2 findings=0`