hyb-oa/.trellis/spec/hyb-oa/wecom-boundary.md

Enterprise WeChat Boundary

Ownership

Enterprise WeChat owns mature HR/attendance actions: check-in, leave, missed punch, outing, overtime and related mobile entry. OA owns reimbursement, procurement, contracts, projects, payments, invoices, sensitive attachments and operating audit.

Rules

• Enterprise WeChat API checks that need trusted IP must run from the deployment server, not local.
• Do not write Enterprise WeChat, create templates, create approvals, expand real users, or enable live trials without explicit approval and a Trellis task.
• Approval-rule configuration cannot be fully read through official APIs; keep manual backend/real-device gates where specified.
• Messages to Enterprise WeChat must be dehydrated and link back to OA; do not send sensitive attachments or business documents into native WeCom approvals.

HR / Attendance UI Contracts

• 请假记录 is the PC leave entry label and page title. Ordinary employees must see records, balances and a WeCom-owned explanation, not an OA leave creation form.
• OA leave creation, edit, submit and withdraw controls are emergency-only UI. They require leave.manage and must be labeled with OA 应急 / 应急草稿 / 提交应急审批; do not expose them based only on leave.create.
• Mobile leave defaults to records for ordinary employees. Hide the form tab and row actions unless the user has leave.manage; keep the first card explicit: 企业微信主办 and 只读.
• Attendance correction forms are emergency-only UI. They require attendance.manage and use OA 应急修正 / 提交应急修正. Ordinary employees see a WeCom handling explanation for missed punch, outing and overtime.
• WeCom approval archive pages are read-only history and reconciliation. They may show status/action history labels from WeCom data, but must not offer OA approve/reject/return/transfer actions.

Tests Required

• Mocked frontend Playwright coverage should assert that ordinary employees do not see OA leave/correction create actions, while admin/HR roles retain explicitly labeled emergency entry points.
• Full-stack Playwright coverage that writes local data still requires a running local backend/API environment; a Vite-only run is not a valid failure signal for those real-chain tests.