ID,Title,Description,Acceptance,Test_Method,Tools,Dev_Status,Review1_Status,Regression_Status,Files,Dependencies,Notes
B1,国内最佳实践与全业务流程矩阵,"调研国内 OA、费控、报销、审批系统的流程最佳实践，并与当前 hyb-oa 业务域做流程-角色-页面-接口-测试映射。","形成矩阵，覆盖认证、审批、报销、票据、HR、项目、采购、资产、系统治理；每个域标明主流程、异常流程、权限流程、最佳实践差距和优化建议。","业务流程：全业务流程审计；步骤：读取 docs/feature-matrix.md、docs/trialrun/coverage-matrix.csv、client 路由、server 路由、E2E 文件，并结合公开调研来源，生成 docs/trialrun/project-wide-flow-matrix.csv 和 docs/trialrun/domestic-oa-best-practices.md 后人工审阅。","manual|node|web",DONE,DONE,DONE,"docs/trialrun/project-wide-flow-matrix.csv|docs/trialrun/domestic-oa-best-practices.md","[]","仅新增治理文档，不改变业务逻辑。"
B2,测试覆盖索引与缺口扫描,"自动扫描前端路由、页面、后端路由和 E2E 文件，输出覆盖索引和缺口清单。","脚本能列出页面是否有 PC/mobile/WeCom/flow/visual 覆盖，输出 JSON 与 Markdown 摘要；缺口可按风险排序。","业务流程：测试治理；步骤：node scripts/qa/check-flow-coverage.mjs --json；node scripts/qa/check-flow-coverage.mjs --markdown artifacts/qa-flow/flow-coverage.md；确认包含所有 router 页面和关键后端路由。","node",DONE,DONE,DONE,"scripts/qa/check-flow-coverage.mjs|artifacts/qa-flow","[""B1""]","新增只读扫描脚本；artifacts 不纳入提交。"
B3,全页面视觉巡检,"构建 Playwright 全页面视觉检查，覆盖 PC、mobile、WeCom UA。","无横向溢出；移动无桌面表格；无 5xx/console error；无原始码值/内部术语；截图归档；无法自动登录的页面必须明确 skipped。","业务流程：PC 与企业微信移动端全页面巡检；步骤：E2E_BASE_URL=<local> npx playwright test tests/e2e/project-wide-visual.spec.ts --workers=1 --reporter=list。","playwright",DONE,DONE,DONE,"client/tests/e2e/project-wide-visual.spec.ts|output/playwright|artifacts/qa-flow","[""B1"",""B2""]","先覆盖可 mock 或无需后端状态的页面；公网真实登录由 B5 处理。"
B4,核心业务流门禁脚本,"聚合现有核心业务 E2E，形成可复用业务流门禁。","认证、请假、审批、报销、票据、周报、项目、采购、资产、系统治理等已存在用例能通过一个脚本按域执行；失败产物自动收集。","业务流程：全业务核心 E2E；步骤：bash scripts/qa/run-business-flow-gates.sh local；必要时传入 E2E_BASE_URL；确认脚本输出每个业务域结果。","bash|playwright",DONE,DONE,DONE,"scripts/qa/run-business-flow-gates.sh|client/tests/e2e","[""B2""]","优先聚合现有 E2E，不在本 Issue 大规模补业务代码。"
B5,真实OCR与公网live smoke前置门禁,"把 LIVE_SMOKE_*、真实企业微信入口、真实 OCR 样本和真机测试要求做成可检查的环境门禁。","缺账号或样本时明确 skipped 并说明缺项；配置完整时能执行公网 ready、企业微信配置、真实登录 smoke 和 OCR 样本上传耗时记录。","业务流程：公网登录、企业微信入口、真实发票上传与 OCR；步骤：node scripts/qa/check-live-smoke-env.mjs；LIVE_SMOKE_BASE_URL=https://oa.hyinda.com bash scripts/qa/run-live-smoke-readiness.sh。","node|bash|playwright|curl|manual",DONE,DONE,DONE,"scripts/qa/check-live-smoke-env.mjs|scripts/qa/run-live-smoke-readiness.sh|docs/trialrun/live-smoke-readiness.md","[]","需要测试账号、腾讯 OCR 环境和测试发票样本；不得打印密码或 secret。"
B6,本地迁移漂移诊断专项,"在不重置数据库的前提下诊断本地开发库 Prisma migration drift，并给出安全修复路径。","脚本能输出当前迁移状态、漂移风险、推荐动作；不会执行 migrate reset；如需破坏性重建必须提示人工确认。","业务流程：本地真实 HTTP 回归准备；步骤：bash scripts/qa/check-local-migration-drift.sh；bash scripts/qa/run-isolated-regression-dedup.sh；确认本地漂移不会阻塞隔离回归。","bash|prisma|manual",DONE,DONE,DONE,"scripts/qa/check-local-migration-drift.sh|docs/trialrun-runbook.md","[]","短期继续使用隔离 QA 库；本项只做诊断和非破坏建议。"
B7,发布门禁project-wide模式,"把静态扫描、覆盖扫描、业务流门禁、视觉巡检、live smoke readiness 聚合到 release gate。","bash scripts/qa/run-release-gate.sh project-wide 可运行完整项目级门禁；缺 live 凭据时只标记 live readiness skipped，不影响本地门禁结论。","业务流程：发布前验证；步骤：bash scripts/qa/run-release-gate.sh project-wide；失败时输出阶段、命令、截图或报告路径。","bash|npm|playwright",DONE,DONE,DONE,"scripts/qa/run-release-gate.sh|scripts/qa/run-web-gates.sh|scripts/qa","[""B2"",""B3"",""B4"",""B5"",""B6""]","不改变既有 all/r66 等模式默认行为。"
B8,第二轮回归部署与公网复核,"完成 B1-B7 后执行本地回归、提交、部署和公网复核。","Issue CSV 状态回填；git status 干净；公网 /ready、企业微信 config、public bundle scan、项目级门禁结果明确；用户可测试项已部署。","业务流程：交付闭环；步骤：validate issue csv、client typecheck/build、server prisma validate、project-wide gate、deploy/trialrun/deploy.sh、公网 ready 和 bundle scan。","bash|npm|curl|git",DONE,DONE,DONE,"issues|client|server|scripts|docs","[""B1"",""B2"",""B3"",""B4"",""B5"",""B6"",""B7""]","若 live smoke 缺凭据，最终报告必须列明阻塞项和最小补齐清单。"