wangsli/hyb-oa
1
0
派生 0
代码 工单 合并请求 工作流 8 软件包 项目 发布 百科 活动
文件
main
hyb-oa/issues/2026-05-20_12-48-04-wecom-archive-stabilization-ops-v1.csv
T
wangsli 56b720b8ab WARCH3/WCHECK1/WEXT1 完成受控上线后续自动化 
Issue: WARCH3, WCHECK1, WEXT1
2026-05-20 13:58:40 +08:00

10 行
11 KiB
CSV
原始文件 永久链接 Blame 文件历史

"ID","Title","Description","Acceptance","Test_Method","Tools","Dev_Status","Review1_Status","Regression_Status","Files","Dependencies","Notes"
"WARCH3-0","归档稳定化合同与边界","建立 WARCH3 归档稳定化与自动巡检合同；承接 WROAD2 Day 0 PASS_WITH_FINDINGS，继续测试账号受控上线，不扩大真实员工，不进入 wecom_attendance_approval_mirror_v1。","1) 明确 WARCH3 只稳定每日补偿归档、趋势、finding 去重和脱敏告警；2) 巡检只允许补偿归档写 OA DB，不写企业微信、不创建模板、不提交审批单；3) Secret 来源固定 WECOM_AGENT_SECRET，不尝试其他 Secret、无 fallback、不允许运行时猜 Secret；4) 缺 Secret、权限、可信 IP、可见范围或外部配置时记录 NEEDS_CONFIG 或 SKIP/BLOCKED_BY_EXTERNAL_CONFIG；5) live smoke 凭据/pending OCR 子检查和历史 callback gap 为观察项，不阻断企微归档主链路。","受影响流程：WROAD2 Day 0 巡检 -> WARCH3 自动巡检治理 -> 后续 WCHECK1/WEXT1；验证步骤：python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-05-20_12-48-04-wecom-archive-stabilization-ops-v1.csv；node scripts/qa/check-process-contract.mjs --issue issues/2026-05-20_12-48-04-wecom-archive-stabilization-ops-v1.csv --profile wecom --json。","python3|node","DONE","DONE","DONE","issues/2026-05-20_12-48-04-wecom-archive-stabilization-ops-v1.csv","[]","回滚/清理：本行仅合同；如不通过，删除本合同和后续 WARCH3 改动即可，不影响 WROAD2 既有脚本和报告。"
"WARCH3-1","每日巡检汇总与 finding 去重","新增 WARCH3 QA/ops 汇总脚本，读取 WROAD2 子报告并生成趋势、主链路状态、观察项、callback gap 解释和去重 finding。","1) 输出 artifacts/qa-flow/warch3-ops-<timestamp>/summary.json；2) 主链路关注企微 runtime、审批补偿归档写 OA、OA 离线归档读取和隐私扫描；3) live smoke 凭据/pending OCR 子检查只作为 observation；4) 重复/漏回调/状态不一致 finding 以脱敏 evidenceDigest 去重；5) 报告不泄露手机号、邮箱、token、secret、完整 userid、完整 template_id、完整 sp_no、原始 XML、密文、表单值、附件、评论或原始 payload。","受影响流程：每日巡检 -> 子报告聚合 -> 管理员看趋势和下一步建议；验证步骤：bash -n scripts/qa/run-warch3-ops-daily.sh；本地执行 WARCH3_SKIP_WROAD2=1 bash scripts/qa/run-warch3-ops-daily.sh 生成脱敏 summary.json；检查报告隐私扫描通过。","bash|node","DONE","DONE","DONE","scripts/qa/run-warch3-ops-daily.sh","[""WARCH3-0""]","回滚/清理：删除新增脚本即可；脚本默认只读，只有复用 WROAD2 时允许进程级 WECOM_ARCHIVE_WRITE=1 写 OA 留存库，不写企业微信。"
"WARCH3-2","企微脱敏巡检告警","新增 QA-only 企微巡检告警脚本，巡检失败或 finding 时向管理员 wangshunli/HYD000006 发送脱敏状态和报告路径。","1) 告警固定使用 WECOM_AGENT_SECRET 和企业微信应用消息；2) 仅发送阶段、状态、finding 数、报告路径和下一步建议；3) 默认 dry-run，不发真实消息；4) 真实发送必须带 --send 且 WARCH3_OPS_ALERT_SEND=1；5) 缺收件人绑定、Secret、权限、可见范围或 API 错误记录 NEEDS_CONFIG 或 SKIP/BLOCKED_BY_EXTERNAL_CONFIG；6) 不输出手机号、邮箱、token、Secret、完整 userid、完整 template_id、完整 sp_no、表单值或原始 payload。","受影响流程：WARCH3 巡检 -> finding/失败 -> 管理员脱敏企微提醒；验证步骤：cd server && node --check src/scripts/send-wecom-ops-alert.js；cd server && npx vitest run tests/unit/scripts/send-wecom-ops-alert.test.js --reporter=verbose；公网只发送一条脱敏测试告警。","node|vitest","DONE","DONE","DONE","server/src/scripts/send-wecom-ops-alert.js|server/tests/unit/scripts/send-wecom-ops-alert.test.js","[""WARCH3-1""]","回滚/清理：删除告警脚本或不设置 WARCH3_OPS_ALERT_SEND 即可；真实告警为低风险应用消息，保留审计，不写企微业务数据。"
"WARCH3-3","systemd 定时器安装脚本","新增服务器 systemd service/timer 安装脚本，每天北京时间 07:30 自动触发 WARCH3/WROAD2 巡检。","1) 新增 deploy/trialrun/install-warch3-ops-timer.sh；2) service 只执行仓库脚本，不写企业微信；3) timer 使用 Asia/Shanghai 语义的 07:30；4) 安装、启用、手动触发和卸载路径明确；5) 不修改公开业务 API、Prisma schema、前端页面或 feature flag。","受影响流程：受控上线巡检 -> 服务器定时触发 -> 每日脱敏报告；验证步骤：bash -n deploy/trialrun/install-warch3-ops-timer.sh；远端 SYNC_ENV=0 部署后执行安装脚本；systemctl list-timers hyb-oa-warch3-ops.timer；systemctl start hyb-oa-warch3-ops.service。","bash|systemctl|ssh","DONE","DONE","DONE","deploy/trialrun/install-warch3-ops-timer.sh","[""WARCH3-1""]","回滚/清理：运行安装脚本 --uninstall 或 systemctl disable --now hyb-oa-warch3-ops.timer 并删除 service/timer 文件；不影响应用容器和数据库。；实际结果：安装脚本已兼容 docker compose v2 与 docker-compose v1；远端 timer 已启用，下次触发 2026-05-21 07:30 CST。"
"WARCH3-4","本地门禁与单测","执行 WARCH3 本地合同、脚本、单测、文档和最小门禁。","1) CSV 校验通过；2) process gate baseline 和 WARCH3 issue profile 通过；3) bash/node 语法通过；4) focused vitest 通过；5) 文档审计、skill 校验、git diff --check、scripts/check-minimal.sh 通过。","受影响流程：WARCH3 实施候选 -> 本地 QA -> 可部署候选；验证步骤：python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-05-20_12-48-04-wecom-archive-stabilization-ops-v1.csv；node scripts/qa/check-process-contract.mjs --baseline --json；node scripts/qa/check-process-contract.mjs --issue issues/2026-05-20_12-48-04-wecom-archive-stabilization-ops-v1.csv --profile wecom --json；bash -n scripts/qa/run-warch3-ops-daily.sh；bash -n deploy/trialrun/install-warch3-ops-timer.sh；cd server && node --check src/scripts/send-wecom-ops-alert.js；cd server && npx vitest run tests/unit/scripts/send-wecom-ops-alert.test.js --reporter=verbose；node scripts/qa/audit-docs.mjs --check-registry；python3 /home/shunli/.codex/skills/.system/skill-creator/scripts/quick_validate.py .agents/skills/hyb-oa-delivery；git diff --check；bash scripts/check-minimal.sh。","python3|node|bash|vitest|git","DONE","DONE","DONE","issues/2026-05-20_12-48-04-wecom-archive-stabilization-ops-v1.csv|scripts/qa/run-warch3-ops-daily.sh|deploy/trialrun/install-warch3-ops-timer.sh|server/src/scripts/send-wecom-ops-alert.js|server/tests/unit/scripts/send-wecom-ops-alert.test.js|docs/*|.agents/skills/hyb-oa-delivery/SKILL.md","[""WARCH3-2"",""WARCH3-3""]","回滚/清理：门禁失败不部署、不安装 timer；修复后重跑。"
"WARCH3-5","公网部署与定时器验证","本地门禁通过后，以 SYNC_ENV=0 受控部署，安装 systemd timer，手动触发一次 service，并发送一条脱敏告警测试消息。","1) 使用 SYNC_ENV=0，不同步本地 env；2) /ready 正常；3) 远端手动触发 WARCH3 service 生成 summary.json；4) systemd timer 已启用且下次运行时间为北京时间 07:30；5) 告警仅发送脱敏状态和报告路径；6) 远端报告和告警不泄露完整外部键或敏感值。","受影响流程：部署 -> /ready -> systemd timer -> 手动 service -> 脱敏企微告警；验证步骤：SYNC_ENV=0 bash deploy/trialrun/deploy.sh；curl -fsS https://oa.hyinda.com/ready；ssh 远端执行 deploy/trialrun/install-warch3-ops-timer.sh；systemctl start hyb-oa-warch3-ops.service；WARCH3_OPS_ALERT_SEND=1 npm run send:wecom-ops-alert 或等效命令。","bash|ssh|curl|systemctl|npm","DONE","DONE","DONE","deploy/trialrun/deploy.sh|deploy/trialrun/install-warch3-ops-timer.sh|scripts/qa/run-warch3-ops-daily.sh","[""WARCH3-4""]","回滚/清理：如 systemd 或告警异常，先 disable timer 并保留报告；不扩大真实用户，不写企业微信业务数据。；实际结果：SYNC_ENV=0 部署通过，/ready 正常；远端 service 手动触发成功，报告 /app/artifacts/qa-flow/warch3-ops-20260520-054841/summary.json 为 PASS_WITH_FINDINGS；告警报告 /app/artifacts/qa-flow/wecom-ops-alert-20260520T054851Z/summary.json 为 PASS_ALERT_SENT_WITH_CONFIG_GAPS，已向有效管理员 HYD000006 发送脱敏企微消息，wangshunli 仅记录为非员工号别名 gap。"
"WARCH3-6","事实源回写","更新路线图、API 目录、管理员手册、试运行报告、文档索引、事实源矩阵和项目 skill，固化 WARCH3 结果。","1) 文档明确 WARCH3 已将每日巡检升级为 systemd timer；2) 告警为脱敏企微应用消息；3) live smoke/OCR finding 属观察项；4) WARCH3 后仍需 WCHECK1 和 WEXT1 dry-run，再规划真实小范围试用；5) 不暗示完整镜像、应急或回写已完成。","受影响流程：事实源 -> 后续 WCHECK1/WEXT1/WREAL1 规划；验证步骤：node scripts/qa/audit-docs.mjs --check-registry；python3 /home/shunli/.codex/skills/.system/skill-creator/scripts/quick_validate.py .agents/skills/hyb-oa-delivery；rg -n ""WARCH3|systemd|07:30|脱敏告警|WCHECK1|WEXT1|WREAL1|BLOCKED_BY_EXTERNAL_CONFIG"" docs .agents/skills/hyb-oa-delivery/SKILL.md。","node|python3|rg","DONE","DONE","DONE","docs/企微优先开发路线图.md|docs/企微API能力目录.md|docs/需求-企业微信基础设施规约.md|docs/管理员手册.md|docs/trialrun/人工试运行报告.md|docs/文档索引.md|docs/文档事实源状态矩阵.md|.agents/skills/hyb-oa-delivery/SKILL.md","[""WARCH3-5""]","回滚/清理：恢复本阶段文档改动即可；不修改历史 Issue 快照。"
"WARCH3-7","状态回填与中文提交","完成 WARCH3 状态回填、本地与公网证据登记和中文提交。","1) Test_Method 全部真实通过或真实 SKIP；2) Issue 状态回填；3) 远端报告路径、timer 状态和告警结果写入 Notes；4) git diff --check 通过；5) 中文提交完成。","受影响流程：WARCH3 实施 -> 证据回写 -> 可进入 WCHECK1/WEXT1；验证步骤：git status --short；git diff --check；git log -1 --oneline；确认提交信息包含 WARCH3。","git|manual","DONE","DONE","DONE","issues/2026-05-20_12-48-04-wecom-archive-stabilization-ops-v1.csv|docs/*|scripts/qa/*|deploy/trialrun/*|server/src/scripts/send-wecom-ops-alert.js|server/tests/unit/scripts/send-wecom-ops-alert.test.js","[""WARCH3-6""]","提交建议：WARCH3 增加归档稳定化自动巡检。若公网因外部配置 SKIP，仍提交真实阻断事实，不伪造成 PASS。；实际结果：WARCH3 本地门禁、公网部署、timer、service、脱敏告警和事实源回写已完成；live smoke 凭据/pending OCR 与历史 callback gap 继续作为观察项。；回滚/清理：如后续公网定时巡检异常，可运行 deploy/trialrun/install-warch3-ops-timer.sh uninstall 停用 timer；报告和测试告警保留审计，不清理业务数据。"
在新工单中引用 查看 Git Blame 复制永久链接