ID,Title,Description,Acceptance,Test_Method,Tools,Dev_Status,Review1_Status,Regression_Status,Files,Dependencies,Notes
"WOUA-0","合同建档与边界冻结","建立 OA 与企微用户一致性只读对账合同，锁定本轮只生成脱敏差异报告，不执行真实员工批量 apply，不打开 wecom_hr_master_sync_v1，不修改 OA 或企微用户数据。","1) CSV 校验通过；2) 范围限定为 QA-only 只读 runner、脱敏匹配单测、公网只读审计、事实源回写；3) 不新增公开 API、Prisma schema、前端 UI 或 feature flag；4) 不调用会持久化同步批次的 WHMS dry-run API。","受影响流程：OA active 员工 -> 企业微信通讯录/人事助手 -> 用户一致性审计 -> 后续修复合同决策；验证步骤：python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-05-18_20-45-58-wecom-oa-user-consistency-audit.csv。","python3|manual","DONE","DONE","DONE","issues/2026-05-18_20-45-58-wecom-oa-user-consistency-audit.csv","[]","回滚路径：删除本 CSV 和本轮 QA-only 代码/文档回写；本轮不涉及运行时数据变更。"
"WOUA-1","新增只读对账 runner","新增 QA-only CLI，读取 OA 员工和企业微信通讯录/人事助手资料，按 WHMS 匹配优先级生成脱敏一致性报告。","1) OA 侧使用 PostgreSQL BEGIN READ ONLY；2) 企微侧只读调用通讯录和人事助手；3) 报告包含 matchedActive、oaActiveMissingInWecom、wecomActiveMissingInOa、oaActiveMissingBinding、inactiveWithBinding、statusMismatch、missingRequiredFields、matchConflict；4) 不输出手机号、邮箱、完整 userid、token、secret 或原始 payload。","受影响流程：管理员/QA 执行只读审计 -> 生成脱敏差异报告；验证步骤：cd server && node --check src/scripts/audit-wecom-oa-user-consistency.js；cd server && node src/scripts/audit-wecom-oa-user-consistency.js --help。","node|pg|wecom","DONE","DONE","DONE","server/src/scripts/audit-wecom-oa-user-consistency.js|server/package.json","[""WOUA-0""]","本 runner 不作为应用运行时依赖；缺企微配置时必须输出 SKIP/BLOCKED_BY_EXTERNAL_CONFIG，不伪造成 PASS。"
"WOUA-2","脱敏与匹配单测","新增 focused 单测覆盖全匹配、OA active 缺企微、企微 active 缺 OA、企微缺必填字段、inactive 仍绑定和重复匹配冲突。","1) 测试覆盖匹配优先级 external_user_id -> employee_no/userid -> phone -> email；2) 输出不含手机号、邮箱或完整 userid；3) status 可判定 PASS_NO_DRIFT 或 PASS_WITH_FINDINGS；4) 单测可独立运行。","受影响流程：对账逻辑 -> 报告分类 -> 后续修复分流；验证步骤：cd server && npx vitest run tests/unit/scripts/audit-wecom-oa-user-consistency.test.js --reporter=verbose。","vitest","DONE","DONE","DONE","server/tests/unit/scripts/audit-wecom-oa-user-consistency.test.js","[""WOUA-1""]","只测纯逻辑和脱敏，不访问真实数据库或企业微信。"
"WOUA-3","公网只读对账执行","本地门禁通过后，以 SYNC_ENV=0 受控部署 QA 脚本，在远端 server 容器内执行只读对账并保存报告。","1) 部署不覆盖远端 env；2) 公网执行命令只读，不打开 feature flag，不写 OA/企微用户数据；3) 报告结论为 PASS_WITH_FINDINGS、PASS_NO_DRIFT 或 SKIP/BLOCKED_BY_EXTERNAL_CONFIG；4) 报告路径可审计。","受影响流程：公网 OA 员工和企微可见成员 -> 只读差异审计 -> 后续修复决策；验证步骤：SYNC_ENV=0 bash deploy/trialrun/deploy.sh；ssh deploy@118.89.77.218 在 /opt/hyb-oa-trialrun 容器内执行 npm run audit:wecom-oa-users -- --live --format=json。","bash|ssh|node","DONE","DONE","DONE","external|artifacts/qa-flow/wecom-oa-user-consistency-*","[""WOUA-2""]","公网审计实际结论为 SKIP/BLOCKED_BY_EXTERNAL_CONFIG，企微读取返回 wecom_errcode_60011；OA 侧只读计数 oaEmployees=13、oaActiveEmployees=12、oaActiveWithBinding=5；未打印 Secret/token/完整 userid/手机号/邮箱，未写 OA/企微数据。"
"WOUA-4","报告和事实源回写","更新人工试运行报告、文档索引和事实源矩阵，记录本轮只是只读对账，不代表真实员工已批量同步。","1) 文档记录 WOUA 当前结论、报告路径和下一步建议；2) 明确不执行真实员工 apply；3) 明确如差异较大先进入 WOUA-FIX 或 WHMS 批量同步窗口决策；4) 文档审计和关键词核对通过。","受影响流程：事实源读取 -> 判断 OA/企微用户一致性 -> 后续派工；验证步骤：node scripts/qa/audit-docs.mjs --check-registry；rg -n 'WOUA|用户一致性|PASS_WITH_FINDINGS|wecom-oa-user-consistency|批量同步' docs issues。","node|rg","DONE","DONE","DONE","docs/trialrun/人工试运行报告.md|docs/文档索引.md|docs/文档事实源状态矩阵.md","[""WOUA-3""]","事实源记录 WOUA 为只读审计且被外部配置阻断，不承诺自动修复；下一步需处理企微读权限或另建 WOUA-FIX/WHMS 批量同步窗口。"
"WOUA-5","状态回填与中文提交","完成 WOUA 状态回填、本地门禁、公网报告核对和中文提交。","1) WOUA-0..4 均按实际结果回填；2) validate_issues_csv、node --check、focused vitest、prisma validate、git diff --check 通过；3) 中文 commit 引用 WOUA；4) 最终说明是否部署和用户是否可查看报告。","受影响流程：Issue CSV -> 验证证据 -> 中文提交 -> 后续实施入口；验证步骤：git status --short；git log -1 --oneline。","git|manual","DONE","DONE","DONE","issues/2026-05-18_20-45-58-wecom-oa-user-consistency-audit.csv|docs|server/src/scripts/audit-wecom-oa-user-consistency.js|server/tests/unit/scripts/audit-wecom-oa-user-consistency.test.js|server/package.json","[""WOUA-4""]","提交前确认不包含 Secret、token、手机号、邮箱、完整 userid 或企微原始 payload；本地门禁和公网只读审计证据已核对，中文提交引用 WOUA。"