"ID","Title","Description","Acceptance","Test_Method","Tools","Dev_Status","Review1_Status","Regression_Status","Files","Dependencies","Notes"
"WTCLOSE2-0","测试号最终收口合同建档","建立 WTCLOSE2 测试号最终收口与证据复核合同，承接 WAPPR1 四类模板 A 结论。目标是在不写企业微信、不启用真实员工的前提下，复跑并汇总 WROAD2/WARCH3/WAUTO1/WFULLSMOKE1/WEXT1LD/WRULE1 证据。","1) 新合同使用 WTCLOSE2-0..WTCLOSE2-8；2) 明确 WAPPR1=A 只代表规则门禁通过，不授权 live 或真实试用；3) 不创建外出/加班模板或审批单；4) 不启用真实员工；5) 输出 PASS_TEST_ACCOUNT_CLOSEOUT_READY、PASS_WITH_FINDINGS、PAUSED_MANUAL_CONFIRMATION 或 SKIP/BLOCKED_BY_EXTERNAL_CONFIG。","受影响流程：测试号三天巡检/业务冒烟 -> 自动证据汇总 -> WRULE1 审批链校验 -> WEXT1-LIVE/WREAL1 问答准入；验证步骤：python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-05-22_10-21-12-wecom-test-account-final-closeout-v1.csv；node scripts/qa/check-process-contract.mjs --issue issues/2026-05-22_10-21-12-wecom-test-account-final-closeout-v1.csv --profile wecom --json。","python3|node","DONE","DONE","DONE","issues/2026-05-22_10-21-12-wecom-test-account-final-closeout-v1.csv","[]","回滚/清理：删除本 CSV 或恢复事实源；本合同不授权企微写入、不部署真实员工、不修改 Prisma schema。"
"WTCLOSE2-1","QA-only 最终收口编排脚本","新增测试号最终收口脚本，自动复跑 /ready、WAUTO1、WFULLSMOKE1、外出/加班 dry-run、WRULE1，并汇总 WROAD2/WARCH3 既有报告。","1) 脚本路径 scripts/qa/run-wecom-test-account-final-closeout.sh；2) 输出 artifacts/qa-flow/wecom-test-account-final-closeout-*/summary.json；3) WFULLSMOKE1 以 WFULLSMOKE_ALLOW_PUBLIC_WRITES=0 运行，不创建新的 OA 测试业务数据；4) WEXT1LD 只 dry-run，不设置 WECOM_APPROVAL_FIXTURE_WRITE=1；5) WRULE1 使用 --manual-gate=all:A；6) 报告不泄露完整外部键或敏感字段。","受影响流程：自动证据复跑 -> 脱敏汇总 -> WEXT1-LIVE 问答；验证步骤：bash -n scripts/qa/run-wecom-test-account-final-closeout.sh；bash scripts/qa/run-wecom-test-account-final-closeout.sh。","bash|node|npm","DONE","DONE","DONE","scripts/qa/run-wecom-test-account-final-closeout.sh","[""WTCLOSE2-0""]","回滚/清理：删除新增脚本和本地 artifacts 报告；脚本默认不写企微。"
"WTCLOSE2-2","WAUTO1/WFULLSMOKE1 只读复核","由 WTCLOSE2 编排脚本复跑 WAUTO1 与 WFULLSMOKE1，收集受控试用、全域主路径、归档和移动入口证据。","1) WAUTO1 report 纳入 WTCLOSE2 summary；2) WFULLSMOKE1 report 纳入 WTCLOSE2 summary；3) 不触发企微写入；4) 不启用真实员工；5) WFULLSMOKE1 公网写流程关闭，避免新增 OA 测试业务数据。","受影响流程：公网 ready -> 企微受控试用汇总 -> OA 主办域 smoke 汇总；验证步骤：bash scripts/qa/run-wecom-test-account-final-closeout.sh 后检查 summary.json childReports。","bash|node","DONE","DONE","DONE","scripts/qa/run-wecom-test-account-final-closeout.sh|scripts/qa/collect-wecom-controlled-trial-evidence.sh|scripts/qa/run-three-day-full-goal-smoke.sh","[""WTCLOSE2-1""]","回滚/清理：报告保留审计；如公网凭据缺失记录 finding，不伪造成通过。"
"WTCLOSE2-3","WRULE1 实际审批链复核","在 WAPPR1 四类 A 的人工门禁基础上，复跑 WRULE1 审批链校验器，检查 OA 理论审批人与已归档企微实际审批链是否一致。","1) WRULE1 使用 --template=leave/missed_punch/outing/overtime 与 --manual-gate=all:A；2) 无归档样本或本地 DB 不可读时真实记录 SKIP/BLOCKED_BY_EXTERNAL_CONFIG；3) 自审、审批人不匹配或申请人可手选均阻断；4) 不调用企微 API、不写 OA/企微。","受影响流程：OA 组织规则 -> OA 已归档企微审批详情 -> 理论/实际审批链对账；验证步骤：cd server && npm run check:wecom-approval-rule-validator -- --format=json --template=leave --template=missed_punch --template=outing --template=overtime --manual-gate=all:A。","npm|node","DONE","DONE","DONE","server/src/scripts/check-wecom-approval-rule-validator.js|scripts/qa/run-wecom-test-account-final-closeout.sh","[""WTCLOSE2-1""]","回滚/清理：无运行态写入；若本地无归档数据，记录阻断并等待远端或后续真实样例。"
"WTCLOSE2-4","外出加班 live 前 dry-run 复核","复跑外出/加班 live 前 dry-run，确认 payload、测试链、非自审、固定 WECOM_AGENT_SECRET、不尝试其他 Secret 和脱敏报告仍可用。","1) 只执行 --target=outing --target=overtime dry-run；2) 不带 --live、--create-templates、--submit-test-approvals；3) 不设置 WECOM_APPROVAL_FIXTURE_WRITE=1；4) 失败不自动换人、不自动重试 live；5) 结果进入 WTCLOSE2 summary。","受影响流程：外出/加班 dry-run -> WEXT1-LIVE 问答准入；验证步骤：cd server && npm run check:wecom-approval-fixtures -- --format=json --target=outing --target=overtime。","npm|node","DONE","DONE","DONE","server/src/scripts/check-wecom-approval-fixtures.js|scripts/qa/run-wecom-test-account-final-closeout.sh","[""WTCLOSE2-1""]","回滚/清理：dry-run 报告保留审计；不创建企微模板或审批单；不允许运行时猜 Secret。"
"WTCLOSE2-5","事实源和问答门禁回写","更新路线图、管理员手册、试运行报告、文档索引、事实源矩阵和项目 skill，固化 WTCLOSE2 -> WEXT1-LIVE -> WREAL1 -> 最小镜像顺序。","1) 事实源包含 WTCLOSE2；2) 明确 WAPPR1=A 后仍需 WRULE1 和问答；3) 明确 WEXT1-LIVE 先问再写；4) 明确 WREAL1 默认 1 名真实员工 + 1 名审批人/管理员观察；5) 文档审计和 skill 校验通过。","受影响流程：后续任务读取事实源 -> WEXT1-LIVE 问答 -> WREAL1 问答 -> 最小镜像规划；验证步骤：node scripts/qa/audit-docs.mjs --check-registry；quick_validate.py .agents/skills/hyb-oa-delivery；rg -n ""WTCLOSE2|PASS_TEST_ACCOUNT_CLOSEOUT_READY|先问再写|1 名真实员工"" docs .agents/skills/hyb-oa-delivery/SKILL.md。","node|python3|rg","DONE","DONE","DONE","docs/企微优先开发路线图.md|docs/管理员手册.md|docs/trialrun/人工试运行报告.md|docs/文档索引.md|docs/文档事实源状态矩阵.md|.agents/skills/hyb-oa-delivery/SKILL.md","[""WTCLOSE2-4""]","回滚/清理：恢复本轮文档和 skill 改动；不修改历史 Issue 快照。"
"WTCLOSE2-6","隐私和写入边界核对","核对 WTCLOSE2 及子报告不泄露完整 sp_no、template_id、userid、手机号、邮箱、token、Secret、EncodingAESKey、表单值、附件、评论或原始 payload；确认未写企微。","1) WTCLOSE2 privacy smoke 通过；2) 报告仅含状态、计数和路径；3) 未设置企微写入变量；4) 未执行 live 创建；5) 真实员工未启用。","受影响流程：报告生成 -> 隐私扫描 -> 后续人工问答；验证步骤：bash scripts/qa/run-wecom-test-account-final-closeout.sh；git diff --check。","bash|git","DONE","DONE","DONE","scripts/qa/run-wecom-test-account-final-closeout.sh|artifacts/qa-flow","[""WTCLOSE2-2"",""WTCLOSE2-3"",""WTCLOSE2-4""]","回滚/清理：如发现泄露，暂停并清理本地报告；不进入提交。"
"WTCLOSE2-7","只读 reviewer 审查","审批规则和 live/真实试用准入属于高风险治理项，实施后另开只读 reviewer subagent 审查，不允许修改代码。","1) reviewer 只读；2) 审查 WAPPR1=A 是否被误读为 live/真实试用批准；3) 审查 WTCLOSE2 summary 是否保留 WRULE1/WEXT1-LIVE/WREAL1 门禁；4) 审查隐私和写入边界；5) blocker 必须修复或记录。","受影响流程：实现完成 -> 独立评审 -> 状态回填；验证步骤：reviewer subagent 输出无 blocker 或 blocker 已处理。","subagent|manual","DONE","DONE","DONE","N/A","[""WTCLOSE2-6""]","回滚/清理：reviewer 不修改文件；如发现高风险，暂停 WEXT1-LIVE/WREAL1。"
"WTCLOSE2-8","门禁状态回填和中文提交","完成合同校验、process gate、脚本语法、自动验证、文档审计、skill 校验、diff 检查、状态回填和中文提交。","1) validate_issues_csv 通过；2) process gate baseline 和 issue-specific 通过；3) bash -n 通过；4) WTCLOSE2 runner 已执行并生成 summary；5) audit-docs、quick_validate、git diff --check 通过；6) 中文提交包含 WTCLOSE2。","受影响流程：合同 -> 实施 -> 验证 -> review -> 提交 -> 后续问答；验证步骤：git status --short；git log -1 --oneline。","python3|node|bash|git","DONE","DONE","DONE","issues/2026-05-22_10-21-12-wecom-test-account-final-closeout-v1.csv|scripts/qa/run-wecom-test-account-final-closeout.sh|docs/*|.agents/skills/hyb-oa-delivery/SKILL.md","[""WTCLOSE2-7""]","提交建议：WTCLOSE2 收口测试号最终证据；最终报告 artifacts/qa-flow/wecom-test-account-final-closeout-20260522-105852/summary.json，结论 SKIP/BLOCKED_BY_EXTERNAL_CONFIG，公网 /ready 与隐私扫描通过，未写企微，未创建样件，未启用真实员工；回滚/清理：恢复本轮 CSV、脚本和文档改动，保留或按审计要求清理本地 artifacts。"