docs(P19AI1-4,P19AI1-5): 收口AI-1文档矩阵与执行合同

issues/2026-03-10_12-54-30-p19-ai-1-l5-suggestion-workbench-refresh.csv

@@ -0,0 +1,7 @@
+ID,Title,Description,Acceptance,Test_Method,Tools,Dev_Status,Review1_Status,Regression_Status,Files,Dependencies,Notes
+P19AI1-0,P19AI1执行合同刷新建档,创建并校验AI只读建议工作台刷新执行合同CSV,刷新CSV通过校验且字段完整并冻结AI-1只读建议边界,python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-03-10_12-54-30-p19-ai-1-l5-suggestion-workbench-refresh.csv,manual,DONE,DONE,DONE,issues/2026-03-10_12-54-30-p19-ai-1-l5-suggestion-workbench-refresh.csv,[],AI一期只做详情页建议摘要异常提示与下一步建议 不做写库动作且不依赖MCP运行时
+P19AI1-1,AI provider与治理开关,新增AI配置 环境变量 feature flag与ai.assist权限并固化provider契约,AI调用具备mock和http openai-compatible两类provider且默认关闭并受权限与flag双重控制,cd server && npm run test,manual,DONE,DONE,DONE,server/src/config.js | server/src/constants/permissions.js | server/src/services/featureFlags/index.js | server/src/scripts/seed-config.js | server/src/services/ai | server/tests | issues/2026-03-10_12-54-30-p19-ai-1-l5-suggestion-workbench-refresh.csv,"[""P19AI1-0""]",首期不落AI持久化表 仅请求时生成与审计摘要
+P19AI1-2,AI建议服务与接口,实现报销 采购 资产三类只读suggestion接口并补敏感信息脱敏与审计,三个suggestion接口可返回summary riskHints nextActions sourceSnapshot providerMeta generatedAt且失败不影响原业务,cd server && npm run test,manual,DONE,DONE,DONE,server/src/routes/ai.js | server/src/services/ai/provider.js | server/src/services/ai/prompts.js | server/src/services/ai/sanitizer.js | server/src/services/ai/suggestions.js | server/tests | issues/2026-03-10_12-54-30-p19-ai-1-l5-suggestion-workbench-refresh.csv,"[""P19AI1-1""]",审计只记录target provider model promptHash tokenUsage 不记录原始敏感prompt
+P19AI1-3,详情页AI建议卡片,在报销 采购 资产详情页增加只读AI建议卡片并处理权限与失败展示,有权限用户可在详情页查看AI建议卡片 无权限或AI关闭时不暴露入口且页面主流程零回归,cd client && npm run typecheck && npm run build,manual,DONE,DONE,DONE,client/src/pages/ReimbursementDetailPage.tsx | client/src/pages/PurchaseRequestsPage.tsx | client/src/pages/AssetRegistryPage.tsx | client/src/api/ai.ts | client/src/components/ai | issues/2026-03-10_12-54-30-p19-ai-1-l5-suggestion-workbench-refresh.csv,"[""P19AI1-2""]",不新增独立AI后台 页面仅作详情侧建议挂件
+P19AI1-4,AI文档事件与矩阵同步,同步AI边界 API事实源 Feature Matrix与使用说明,AI文档与矩阵完成收口并明确AI只做建议不提升为自动执行能力,python3 scripts/validate-feature-matrix.py,manual,DONE,DONE,DONE,docs/integration-boundaries.md | docs/domain-events.md | docs/feature-matrix.md | scripts/validate-feature-matrix.py | issues/2026-03-10_12-54-30-p19-ai-1-l5-suggestion-workbench-refresh.csv,"[""P19AI1-3""]",新增GET /api/ai/status且不引入新的公共领域事件名
+P19AI1-5,P19AI1回归与验收收口,完成AI provider 权限门禁 详情卡片与降级容错验证后收口,AI mock和http失败语义均可回归且不影响报销采购资产详情与既有集成流程,cd server && npm run prisma:validate && npm run test && cd ../client && npm run typecheck && npm run build && python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-03-10_12-54-30-p19-ai-1-l5-suggestion-workbench-refresh.csv && python3 scripts/validate-feature-matrix.py && git diff --check,manual,DONE,DONE,DONE,issues/2026-03-10_12-54-30-p19-ai-1-l5-suggestion-workbench-refresh.csv | server/tests | client/src/pages/ReimbursementDetailPage.tsx | client/src/pages/PurchaseRequestsPage.tsx | client/src/pages/AssetRegistryPage.tsx,"[""P19AI1-4""]",重点核对AI关闭 无权限 4xx 5xx timeout 脱敏日志与矩阵236收口