hyb-oa/issues/2026-05-24_00-50-23-oa-backup-restore-drill-v1.csv

"ID","Title","Description","Acceptance","Test_Method","Tools","Dev_Status","Review1_Status","Regression_Status","Files","Dependencies","Notes"
"OABK1-0","建立影子库恢复演练合同","为 OA 正式启用前补齐备份恢复门禁，建立只针对影子库/临时库的恢复演练执行合同；本合同不覆盖生产库、不重置公网、不改变真实业务数据。","Issue CSV 校验通过；明确演练目标、禁止项、人工批准点、证据格式和清理路径；未批准前不执行任何恢复命令。","受影响流程：备份恢复准备 -> 人工批准 -> 影子库恢复 -> 验证 -> 清理；验证步骤：python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-05-24_00-50-23-oa-backup-restore-drill-v1.csv；node scripts/qa/check-process-contract.mjs --issue issues/2026-05-24_00-50-23-oa-backup-restore-drill-v1.csv --profile general --json。","python3|node|manual","DONE","DONE","DONE","issues/2026-05-24_00-50-23-oa-backup-restore-drill-v1.csv","[]","MAGI 审视：正式启用不能只看备份存在，必须证明可恢复；执行：先做合同和清单；提升：以后把 RTO/RPO 和恢复证据纳入 OALAUNCH1。回滚/清理：本行只新增合同，不执行远端命令；若不采纳可标记 superseded，不影响公网或数据库。"
"OABK1-1","备份源与恢复目标确认","确认公网 OA 当前备份来源、最近备份时间、备份文件或快照位置、附件存储备份位置、恢复目标机器/目录/影子库名和临时凭据。","形成脱敏恢复参数清单；不在仓库、聊天或报告写入密码、Secret、完整连接串、完整本地路径或真实敏感业务内容。","受影响流程：运维备份 -> 参数核对 -> 恢复窗口；验证步骤：人工填写 OAAUTO1 证据模板或临时 /tmp env；只记录脱敏别名、时间、大小、hash/校验状态。","manual|ssh","TODO","TODO","TODO","external|/tmp|artifacts/qa-flow","[""OABK1-0""]","人工确认点：A 使用最近自动备份；B 指定某个备份点；C 暂停演练。回滚/清理：本步骤只读核对，清理临时 env 和脱敏清单即可。"
"OABK1-2","影子库恢复命令草案","准备不会触碰生产库的恢复命令草案：创建临时数据库或临时 schema，导入备份，指向只读验证连接，禁止把恢复目标设为生产 DSN。","命令草案包含 dry-run/echo 预览、目标库二次确认、禁止生产库保护、失败退出和清理命令；未经批准不执行。","受影响流程：命令准备 -> 人工确认 -> 受控执行；验证步骤：bash -n 或 shellcheck 可用时检查脚本片段；人工核查目标 DSN 不是生产库。","bash|manual","TODO","TODO","TODO","artifacts/qa-flow/oa-launch-manual-evidence-*;docs/trialrun/OPS7运维交接Runbook.md","[""OABK1-1""]","建议命名：hyb_oa_restore_shadow_<timestamp>。回滚/清理：DROP 临时库/临时 schema、删除临时连接文件、撤销临时凭据；禁止 DROP/restore 生产库。"
"OABK1-3","恢复后只读抽样验证","在影子库中只读验证关键表和附件引用：员工/角色、报销/发票、付款批次/AP、采购、合同台账、资产台账、审计日志、文件引用一致性。","输出脱敏 summary：表存在、行数区间、最近更新时间、关键外键抽样、附件引用可定位；不输出真实票号、合同正文、银行流水、完整账号、完整路径或原始 payload。","受影响流程：影子库恢复 -> 只读 SQL/脚本抽样 -> 脱敏证据；验证步骤：只读查询或 QA-only 脚本输出 artifacts/qa-flow/oa-backup-restore-drill-<timestamp>/summary.json。","node|psql|manual","TODO","TODO","TODO","scripts/qa;artifacts/qa-flow/oa-backup-restore-drill-*","[""OABK1-2""]","允许新增 QA-only 脚本，但不得写业务库。回滚/清理：删除影子库连接文件和报告中的敏感原文；保留脱敏 summary 作为证据。"
"OABK1-4","RTO/RPO 和负责人记录","记录恢复耗时、备份点时间、RTO/RPO 初始值、演练负责人、问题 owner、下一次演练建议。","RTO/RPO 有明确数值或区间；如果恢复超时或备份过旧，记录 blocker/finding 并进入整改合同，不得直接 Go。","受影响流程：恢复结果 -> 运维指标 -> 启用门禁；验证步骤：summary.json 或人工证据模板包含 rtoMinutes、rpoMinutes、owner、decision。","manual","TODO","TODO","TODO","artifacts/qa-flow/oa-backup-restore-drill-*;issues/2026-05-23_16-49-39-oa-final-launch-readiness-v1.csv","[""OABK1-3""]","回滚/清理：指标记录只保留脱敏信息；如结果不合格，不更新 OALAUNCH 为通过。"
"OABK1-5","人工接受或重跑决策","恢复演练完成后由你选择接受、修复后重跑或暂停正式启用；自动化不能替代该决策。","用户明确选择 A/B/C；A 接受恢复演练结果并进入 Go/No-Go 准备；B 修复后重跑；C 暂停正式启用。","受影响流程：恢复证据 -> 用户决策 -> OALAUNCH1 门禁；验证步骤：在最终回复或 OALAUNCH evidence 中记录脱敏决策，不写入敏感运维凭据。","manual","TODO","TODO","TODO","external|issues/2026-05-23_16-49-39-oa-final-launch-readiness-v1.csv","[""OABK1-4""]","人工选项：A 接受；B 修复后重跑；C 暂停。回滚/清理：未接受前 OALAUNCH1 继续 PAUSED_MANUAL_CONFIRMATION。"
"OABK1-6","OALAUNCH1 恢复证据接入","在恢复演练被接受后，把脱敏 summary 接入 run-oa-final-launch-readiness，作为 BACKUP_RESTORE_DRILL 门禁证据。","OALAUNCH1 不再因备份恢复缺证据阻断；但真实业务闭环、7 天稳定化和 Day 7 Go/No-Go 未完成前仍不得 PASS_OA_LAUNCH_READY。","受影响流程：恢复证据 -> 最终启用汇总；验证步骤：OALAUNCH_BACKUP_EVIDENCE=<summary.json> bash scripts/qa/run-oa-final-launch-readiness.sh。","bash|manual","TODO","TODO","TODO","scripts/qa/run-oa-final-launch-readiness.sh;artifacts/qa-flow/oa-final-launch-readiness-*","[""OABK1-5""]","回滚/清理：若证据不被接受，不设置 OALAUNCH_BACKUP_EVIDENCE；不伪造通过。"
"OABK1-7","真实业务样本最小人工步骤确认","并行明确真实业务最小样本：1 条真实报销闭环、1 条采购/费用申请、1 条合同台账；这些不能由自动化伪造为真实业务。","步骤和脱敏证据字段明确；不要求大量样本；不上传涉密合同正文、银行流水原件、密码、Secret、完整票号或完整本地路径到仓库/聊天/报告。","受影响流程：真实报销 -> 审批 -> 付款/AP；采购/费用 -> 审批 -> 关联；合同台账 -> 归档位置 -> 权限抽查；验证步骤：人工完成后用 OAAUTO1 evidence 模板记录业务别名、状态、日期、角色和证据路径。","manual","DONE","DONE","DONE","issues/2026-05-23_23-01-55-oa-automation-manual-cutover-v1.csv;artifacts/qa-flow/oa-launch-manual-evidence-*","[""OABK1-0""]","已细化步骤来源 OAAUTO1-8/9/10；本合同只重申最小真实样本边界。回滚/清理：真实业务数据按审计保留；误录按业务状态归档/冲正，不从仓库清理。"