收口(07-28-travel-reimbursement-guide): 完成腾讯OCR费用告警闭环
这个提交包含在：
@@ -267,6 +267,84 @@ toNumberString(info?.Total ?? info?.Fare);
|
||||
toNumberString(info?.Total) ?? toNumberString(info?.Fare);
|
||||
```
|
||||
|
||||
## Scenario: Tencent OCR Cost Safety Gate
|
||||
|
||||
### 1. Scope / Trigger
|
||||
|
||||
- Trigger: enabling or re-enabling production Tencent OCR, rotating its cloud
|
||||
identity, or changing the product/region used by `RecognizeGeneralInvoice`.
|
||||
- Purpose: prove that a working API cannot silently become an unbounded paid
|
||||
integration after its free resource package is exhausted.
|
||||
|
||||
### 2. Signatures
|
||||
|
||||
- Runtime provider remains `OCR_PROVIDER=tencent` and calls only
|
||||
`ocr:RecognizeGeneralInvoice` in the approved mainland-China region.
|
||||
- Tencent Cloud console evidence is limited to three booleans: the matching
|
||||
monthly free package is active, postpaid usage is disabled, and a cost or
|
||||
balance alert is enabled.
|
||||
- Provider exhaustion continues to surface as the existing bounded terminal
|
||||
resource-package error; it must not switch provider or billing mode.
|
||||
|
||||
### 3. Contracts
|
||||
|
||||
- Confirm the free package against the actual cloud account, product edition
|
||||
and region before production enablement. Documentation or an earlier account
|
||||
snapshot is not current evidence.
|
||||
- Disable postpaid usage so package exhaustion fails closed. Never enable
|
||||
postpaid merely to make a live probe pass.
|
||||
- Enable at least one cost or balance alert as a secondary control. Threshold,
|
||||
recipients, account balance and console screenshots are restricted account
|
||||
data and do not belong in Trellis, repository docs or chat.
|
||||
- Console authentication and changes are performed by an authorized account
|
||||
owner. Automation may record only the user's explicit redacted confirmation;
|
||||
it must not retain login QR codes, cookies, tokens or account pages.
|
||||
|
||||
### 4. Validation & Error Matrix
|
||||
|
||||
- Free package missing, wrong edition or wrong region -> do not enable Tencent
|
||||
OCR; keep real invoice upload gated until the account state is corrected.
|
||||
- Postpaid enabled or unknown -> cost gate fails; do not treat API success as
|
||||
production readiness.
|
||||
- Alert absent -> OCR may remain technically functional, but task closeout and
|
||||
cost-safety acceptance remain incomplete.
|
||||
- Package exhausted -> terminal OCR failure with no automatic paid fallback,
|
||||
provider switch or repeated blind retry.
|
||||
|
||||
### 5. Good/Base/Bad Cases
|
||||
|
||||
- Good: current account shows the matching free package, postpaid disabled and
|
||||
an enabled alert; the task stores only those redacted state conclusions.
|
||||
- Base: provider is temporarily disabled while an account owner fixes one
|
||||
missing cost control.
|
||||
- Bad: infer billing safety from a successful sample call, save a console
|
||||
screenshot with account data, or turn on postpaid to avoid an exhaustion
|
||||
error.
|
||||
|
||||
### 6. Tests Required
|
||||
|
||||
- Before first enablement or a product/region change, obtain authorized manual
|
||||
console confirmation of all three booleans.
|
||||
- Adapter tests keep resource-package exhaustion and arrears/charge-state
|
||||
errors terminal and assert no retry or provider fallback.
|
||||
- Run sensitive-content scanning after recording the confirmation; no account,
|
||||
threshold, recipient, balance, QR code, cookie or token may appear.
|
||||
|
||||
### 7. Wrong vs Correct
|
||||
|
||||
#### Wrong
|
||||
|
||||
```text
|
||||
sample OCR succeeded -> billing is safe -> close the task
|
||||
```
|
||||
|
||||
#### Correct
|
||||
|
||||
```text
|
||||
matching free package active + postpaid disabled + alert enabled
|
||||
-> record redacted booleans -> allow/continue production Tencent OCR
|
||||
```
|
||||
|
||||
## Scenario: Live OCR Sample Stdin Probe
|
||||
|
||||
### 1. Scope / Trigger
|
||||
|
||||
@@ -6,9 +6,9 @@
|
||||
- [x] 用户在腾讯云侧创建该专用子用户和密钥。
|
||||
- [x] 在实际账号确认通用票据识别（高级版）每月 1,000 次专用免费包已到账，生产配置使用中国大陆地域。
|
||||
- [x] 在 OCR 控制台设置页确认后付费关闭；额度耗尽时接受 OCR 失败关闭。
|
||||
- [ ] 配置费用或余额告警作为二次兜底。
|
||||
- [ ] 确认腾讯 OCR 服务和 `ocr:RecognizeGeneralInvoice` 最小权限可用，不接独立火车票接口。
|
||||
- [ ] 确认住宿电子普通发票和铁路电子客票各一份 PDF 样票的测试授权及仓库外受控位置；不得向 Codex 或聊天提供票据。
|
||||
- [x] 用户在腾讯云控制台配置并启用费用或余额告警作为二次兜底；任务只记录启用状态，不记录阈值、接收人或账户信息。
|
||||
- [x] 腾讯 OCR 服务和 `ocr:RecognizeGeneralInvoice` 最小权限已通过生产 smoke 与两类真实样票验证，不接独立火车票接口。
|
||||
- [x] 住宿电子普通发票和铁路电子客票各一份 PDF 的测试授权、仓库外受控位置和脱敏调用均已完成；票据未进入 Codex、聊天或仓库。
|
||||
|
||||
## 2. 腾讯 adapter 修正
|
||||
|
||||
@@ -170,3 +170,9 @@
|
||||
- server 重建：短暂影响 OA；仅操作当前实际 server，保留回退配置。
|
||||
- 真实样票：包含发票和个人/企业信息；只留在仓库外受控位置。
|
||||
- 文档：员工指南必须短且与生产费用类型、PDF-only 和附件入口一致，避免把财务付款回单误写成员工材料。
|
||||
|
||||
## 2026-08-23 腾讯云费用告警收口
|
||||
|
||||
- 用户确认腾讯云费用或余额告警已经启用；未向 Codex 提供控制台登录态、二维码、阈值、接收人、账户余额或截图。
|
||||
- 结合此前已确认的高级版免费包、中国大陆地域和后付费关闭，腾讯 OCR 费用控制闭环完成；额度耗尽继续按既有合同失败关闭，不自动产生后付费。
|
||||
- 本步骤未进入腾讯云登录态，未修改 OA 生产配置、代码、数据库或真实业务数据。
|
||||
|
||||
@@ -67,7 +67,7 @@
|
||||
- [x] 指南内容与当前页面、服务端格式限制及生产费用类型一致。
|
||||
- [x] 业务事实源明确火车票和住宿费支付截图为必交补充材料，并包含遮挡、差异、退款和无截图例外规则。
|
||||
- [x] 腾讯 adapter 使用 `RecognizeGeneralInvoice`，聚焦测试覆盖住宿电子普通发票、铁路电子客票、无代码票据、多票/不支持票据、大小门禁和敏感原始字段不持久化。
|
||||
- [ ] 腾讯云控制台确认通用票据识别（高级版）每月 1,000 次免费包已到账、中国大陆地域、后付费关闭和费用/余额告警可用；额度耗尽不产生后付费。
|
||||
- [x] 腾讯云控制台确认通用票据识别（高级版）每月 1,000 次免费包已到账、中国大陆地域、后付费关闭和费用/余额告警可用；额度耗尽不产生后付费。
|
||||
- [x] 生产实际 provider 为 `tencent`，只授予 `ocr:RecognizeGeneralInvoice`，两个凭证字段已配置但不泄露，external deps smoke、`/ready` 和运行 job 拓扑通过。
|
||||
- [x] 住宿电子普通发票和铁路电子客票各一份已授权 PDF 经真实腾讯 OCR 进入可解释终态，并证明没有调用 mock；样票和原始识别 payload 不进入仓库或聊天。
|
||||
- [x] 明确 OCR 只辅助字段识别/查重，财务仍执行明细—PDF 原件—支付证明复核。
|
||||
@@ -80,6 +80,11 @@
|
||||
- [x] 中文文件名的报销附件和发票 PDF 均返回合法 `Content-Disposition`，保留 `inline` 与 UTF-8 文件名语义且无响应头注入。
|
||||
- [x] 聚焦测试使用与生产一致的全局 `files=1` 基线，证明路由级覆盖有效，并覆盖 5 个成功、6 个失败、中文名和恶意文件名。
|
||||
|
||||
## Lifecycle Closeout
|
||||
|
||||
- 2026-08-23，用户在腾讯云控制台完成费用或余额告警配置并确认已启用；任务仅记录“已启用”这一脱敏结论，不记录告警阈值、接收人、账户余额、账号或控制台截图。
|
||||
- 免费包、中国大陆地域、后付费关闭、最小权限、生产腾讯 OCR、两类授权样票、差旅指南、费用类型及附件修复均已完成，任务验收项全部关闭。
|
||||
|
||||
## Out of Scope
|
||||
|
||||
- 新增第二个 OCR provider、开放图片发票、自动验真或增加人工发票字段。
|
||||
|
||||
@@ -27,6 +27,6 @@
|
||||
"server/src/routes/invoicePool.js",
|
||||
"client/src/pages/ReimbursementDetailPage.tsx"
|
||||
],
|
||||
"notes": "指南、差旅补助费用类型、附件修复和腾讯 OCR 生产启用均已完成；当前唯一未关闭项是由负责人在腾讯云控制台确认高级版免费包到账、后付费关闭以及费用或余额告警已启用。",
|
||||
"notes": "指南、差旅补助费用类型、附件修复、腾讯 OCR 生产启用和费用控制均已完成；用户于 2026-08-23 确认腾讯云费用或余额告警已启用，任务只保留脱敏状态结论。",
|
||||
"meta": {}
|
||||
}
|
||||
|
||||
在新工单中引用
屏蔽一个用户