"ID","Title","Description","Acceptance","Test_Method","Tools","Dev_Status","Review1_Status","Regression_Status","Files","Dependencies","Notes"
"WCHECK1-0","打卡摘要留存合同与边界","建立 WCHECK1 打卡摘要留存合同；承接 WROAD2/WARCH3，目标是 OA 自建留存规范化打卡明细、日/月摘要和规则快照，企微不可用时仍能查看已保存历史摘要。","1) 保存范围为规范化打卡记录、日摘要、月摘要、异常摘要、规则快照摘要和原始记录 hash；2) 禁止保存完整位置、人脸、设备明文、原始 payload、token、Secret；3) Secret 来源固定 WECOM_AGENT_SECRET 或显式 WECOM_CHECKIN_SECRET，不尝试其他 Secret、无 fallback、不允许运行时猜 Secret；4) 缺 Secret、权限、可信 IP、可见范围或企微 API 错误记录 NEEDS_CONFIG 或 SKIP/BLOCKED_BY_EXTERNAL_CONFIG；5) 不写企业微信、不创建审批模板或审批单、不扩大真实员工。","受影响流程：企微打卡只读拉取 -> OA 规范化留存 -> 离线摘要读取；验证步骤：python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-05-20_12-48-04-wecom-checkin-summary-archive-v1.csv；node scripts/qa/check-process-contract.mjs --issue issues/2026-05-20_12-48-04-wecom-checkin-summary-archive-v1.csv --profile wecom --json。","python3|node","DONE","DONE","DONE","issues/2026-05-20_12-48-04-wecom-checkin-summary-archive-v1.csv","[]","回滚/清理：本行仅合同；如不通过，删除本合同和后续 WCHECK1 改动即可，不影响既有 WecomCheckinRecord。"
"WCHECK1-1","打卡摘要 Schema 与迁移","新增打卡日/月摘要和规则快照表，复用 WecomCheckinRecord 作为规范化明细。","1) 新增 WecomCheckinDailySummary、WecomCheckinMonthlySummary、WecomCheckinRuleSnapshot；2) 表内只保存摘要、计数、首末时间、异常计数、规则摘要、hash 和外部 userid 前缀/必要映射，不保存位置、人脸、设备明文或原始 payload；3) 有唯一键保证按员工/日期、员工/月、外部 userid/规则日幂等；4) 迁移可回滚说明明确。","受影响流程：已同步打卡明细 -> 摘要表 -> 离线读取；验证步骤：cd server && npm run prisma:validate；检查 server/prisma/migrations/*_wecom_checkin_summary_archive_v1/migration.sql；必要时受控部署执行 prisma migrate deploy。","prisma|sql","DONE","DONE","DONE","server/prisma/schema.prisma|server/prisma/migrations/*_wecom_checkin_summary_archive_v1/migration.sql","[""WCHECK1-0""]","回滚/清理：如未部署，恢复 schema 和删除迁移目录；如已部署，需单独审批后 DROP wecom_checkin_daily_summaries、wecom_checkin_monthly_summaries、wecom_checkin_rule_snapshots。"
"WCHECK1-2","打卡摘要归档服务","新增服务函数，从 WecomCheckinRecord 生成日/月摘要，并可在 live 只读模式拉取打卡规则形成规则快照。","1) 摘要生成幂等 upsert；2) 日摘要包含打卡次数、首末打卡时间、异常计数、结果摘要、source 摘要、raw_hash 聚合；3) 月摘要包含天数、异常天数、缺卡候选天数、首末覆盖日期；4) 规则快照只存规则摘要、hash、员工映射和时间窗口，不存原始 payload；5) 企微 API 阻断按 SKIP/BLOCKED_BY_EXTERNAL_CONFIG 归类。","受影响流程：打卡记录 -> 摘要生成 -> 规则快照 -> 后续离线查询；验证步骤：cd server && node --check src/services/integrations/wecomCheckinArchive.js；cd server && npx vitest run tests/unit/services/wecomCheckinArchive.test.js --reporter=verbose。","node|vitest","DONE","DONE","DONE","server/src/services/integrations/wecomCheckinArchive.js|server/tests/unit/services/wecomCheckinArchive.test.js","[""WCHECK1-1""]","回滚/清理：删除新增服务和测试即可；服务不写企业微信，写 OA 留存表用于审计。"
"WCHECK1-3","打卡摘要 QA runner","新增 QA-only runner check-wecom-checkin-summary-archive，支持 live 只读拉取、persist 写 OA 摘要和 offline 离线读取证明。","1) 默认 offline/read-only，不调用企微；2) live 模式仅调用打卡读取和规则读取，不写企业微信；3) 写 OA 摘要必须同时带 --persist-to-db 和 WECOM_CHECKIN_ARCHIVE_WRITE=1；4) 输出 artifacts/qa-flow/wecom-checkin-summary-archive-<timestamp>/summary.json；5) 报告只输出计数、日期、状态、异常摘要和脱敏 userid 前缀，不泄露完整 userid、位置、人脸、设备、token、Secret 或原始 payload。","受影响流程：企微打卡只读 -> OA 摘要留存 -> 企微 API 不可用时离线读取；验证步骤：cd server && node --check src/scripts/check-wecom-checkin-summary-archive.js；cd server && npx vitest run tests/unit/scripts/check-wecom-checkin-summary-archive.test.js tests/unit/services/wecomCheckinArchive.test.js --reporter=verbose。","node|vitest","DONE","DONE","DONE","server/src/scripts/check-wecom-checkin-summary-archive.js|server/tests/unit/scripts/check-wecom-checkin-summary-archive.test.js|server/package.json","[""WCHECK1-2""]","回滚/清理：删除 runner 和 package 脚本即可；若已写 OA 摘要，保留审计或按后续人工批准清理。"
"WCHECK1-4","本地门禁与隐私测试","执行 WCHECK1 本地合同、Prisma、语法、focused 单测、文档和最小门禁。","1) CSV 与 process gate 通过；2) Prisma validate 通过；3) node --check 通过；4) 单测覆盖空记录、幂等、规则快照脱敏、外部配置阻断、隐私不泄露；5) git diff --check 和 scripts/check-minimal.sh 通过。","受影响流程：WCHECK1 实施候选 -> 本地 QA -> 可部署候选；验证步骤：python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-05-20_12-48-04-wecom-checkin-summary-archive-v1.csv；node scripts/qa/check-process-contract.mjs --baseline --json；node scripts/qa/check-process-contract.mjs --issue issues/2026-05-20_12-48-04-wecom-checkin-summary-archive-v1.csv --profile wecom --json；cd server && npm run prisma:validate；cd server && node --check src/services/integrations/wecomCheckinArchive.js；cd server && node --check src/scripts/check-wecom-checkin-summary-archive.js；cd server && npx vitest run tests/unit/services/wecomCheckinArchive.test.js tests/unit/scripts/check-wecom-checkin-summary-archive.test.js --reporter=verbose；node scripts/qa/audit-docs.mjs --check-registry；python3 /home/shunli/.codex/skills/.system/skill-creator/scripts/quick_validate.py .agents/skills/hyb-oa-delivery；git diff --check；bash scripts/check-minimal.sh。","python3|node|prisma|vitest|bash|git","DONE","DONE","DONE","issues/2026-05-20_12-48-04-wecom-checkin-summary-archive-v1.csv|server/prisma/*|server/src/services/integrations/wecomCheckinArchive.js|server/src/scripts/check-wecom-checkin-summary-archive.js|server/tests/unit/*|docs/*|.agents/skills/hyb-oa-delivery/SKILL.md","[""WCHECK1-3""]","回滚/清理：本地门禁失败不部署；修复后重跑。"
"WCHECK1-5","公网只读与归档验证","本地门禁通过后，以 SYNC_ENV=0 部署并远端执行 WCHECK1 runner，证明可写 OA 摘要并离线读取。","1) 使用 SYNC_ENV=0，不同步本地 env；2) /ready 正常；3) 远端 live 只读拉取打卡短窗口并在双开关下写 OA 摘要；4) 离线读取不调用企微 API、不读取企微 Secret；5) 若权限、可信 IP、可见范围或 Secret 阻断，记录真实 SKIP/BLOCKED_BY_EXTERNAL_CONFIG；6) 报告隐私扫描通过。","受影响流程：部署 -> 企微打卡只读 -> OA 摘要归档 -> 离线读取；验证步骤：SYNC_ENV=0 bash deploy/trialrun/deploy.sh；curl -fsS https://oa.hyinda.com/ready；远端执行 WECOM_CHECKIN_ARCHIVE_WRITE=1 npm run check:wecom-checkin-summary-archive -- --live --persist-to-db --format=json；远端执行 npm run check:wecom-checkin-summary-archive -- --offline --format=json。","bash|ssh|curl|npm","DONE","DONE","DONE","deploy/trialrun/deploy.sh|server/src/scripts/check-wecom-checkin-summary-archive.js","[""WCHECK1-4""]","回滚/清理：部署异常按既有 trialrun 回滚；已写 OA 摘要保留审计，不写企业微信数据。；实际结果：SYNC_ENV=0 部署通过，/ready 正常；live 报告 /app/artifacts/qa-flow/wecom-checkin-summary-archive-20260520T054907Z/summary.json 为 PASS_CHECKIN_ARCHIVE_READY，本窗口 0 条打卡明细、2 条规则快照写入 OA 留存；offline 报告 /app/artifacts/qa-flow/wecom-checkin-summary-archive-20260520T054926Z/summary.json 为 PASS_CHECKIN_ARCHIVE_OFFLINE_READY。"
"WCHECK1-6","事实源回写","更新路线图、API 目录、请假考勤规约、企业微信基础设施规约、管理员手册、试运行报告、文档索引、事实源矩阵和项目 skill。","1) 文档明确 WCHECK1 保存规范化明细、日/月摘要和规则快照；2) 明确不保存位置、人脸、设备明文或原始 payload；3) 明确企微不可用时 OA 只能查看已保存历史摘要，不代表继续办理；4) 后续仍需 WEXT1 dry-run 和 WREAL1 小范围真实试用。","受影响流程：事实源 -> 后续 WEXT1/WREAL1/镜像规划；验证步骤：node scripts/qa/audit-docs.mjs --check-registry；python3 /home/shunli/.codex/skills/.system/skill-creator/scripts/quick_validate.py .agents/skills/hyb-oa-delivery；rg -n ""WCHECK1|打卡摘要|规则快照|不保存完整位置|WEXT1|WREAL1|wecom_attendance_approval_mirror_v1"" docs .agents/skills/hyb-oa-delivery/SKILL.md。","node|python3|rg","DONE","DONE","DONE","docs/企微优先开发路线图.md|docs/企微API能力目录.md|docs/需求-请假考勤修正规约.md|docs/需求-企业微信基础设施规约.md|docs/管理员手册.md|docs/trialrun/人工试运行报告.md|docs/文档索引.md|docs/文档事实源状态矩阵.md|.agents/skills/hyb-oa-delivery/SKILL.md","[""WCHECK1-5""]","回滚/清理：恢复本阶段文档改动即可。"
"WCHECK1-7","状态回填与中文提交","完成 WCHECK1 状态回填、本地与公网证据登记和中文提交。","1) Test_Method 全部真实通过或真实 SKIP；2) Issue 状态回填；3) 公网报告路径写入 Notes；4) git diff --check 通过；5) 中文提交完成。","受影响流程：WCHECK1 实施 -> 证据回写 -> 可进入 WEXT1/WREAL1；验证步骤：git status --short；git diff --check；git log -1 --oneline；确认提交信息包含 WCHECK1。","git|manual","DONE","DONE","DONE","issues/2026-05-20_12-48-04-wecom-checkin-summary-archive-v1.csv|server/*|docs/*|.agents/skills/hyb-oa-delivery/SKILL.md","[""WCHECK1-6""]","提交建议：WCHECK1 增加企微打卡摘要留存。若公网因外部配置 SKIP，仍提交真实阻断事实，不伪造成 PASS。；实际结果：WCHECK1 本地门禁、公网 live 写 OA 留存、离线读取和事实源回写已完成；未写企业微信，未保存位置、人脸、设备明文或原始 payload。"