From 1f897c8451782842f637261870f4307145c51276 Mon Sep 17 00:00:00 2001
From: Codex <codex@gongxue100.local>
Date: Sat, 4 Jul 2026 00:06:30 +0800
Subject: [PATCH] chore: gate launch on PNVS diagnostics

---
 .../production-launch-evidence.template.json  | 26 +++++++++++++++++++
 .../web-launch-acceptance-checklist.md        |  3 ++-
 scripts/production-launch-gate-test.js        | 24 +++++++++++++++++
 scripts/production-launch-gate.js             | 16 ++++++++++++
 4 files changed, 68 insertions(+), 1 deletion(-)

diff --git a/docs/refactor/production-launch-evidence.template.json b/docs/refactor/production-launch-evidence.template.json
index 43d31bc4..d0537fcc 100644
--- a/docs/refactor/production-launch-evidence.template.json
+++ b/docs/refactor/production-launch-evidence.template.json
@@ -54,6 +54,32 @@
         "requireAdminTokens": true
       }
     },
+    {
+      "id": "auth.sms-pnvs-diagnostics",
+      "status": "pass",
+      "command": "PNVS_TENANT_ID=00000000-0000-0000-0000-000000000001 npm run diagnose:aliyun-pnvs > docs/refactor/launch-artifacts/sms-pnvs-diagnostics.json",
+      "completedAt": "2026-06-30T10:11:00+08:00",
+      "artifact": "launch-artifacts/sms-pnvs-diagnostics.json",
+      "summary": {
+        "ok": true,
+        "env": {
+          "providerMatchesPnvs": true
+        },
+        "provider": {
+          "found": true,
+          "provider": "aliyun-pnvs",
+          "status": "active",
+          "publicConfig": {
+            "templateParamHasCodePlaceholder": true
+          }
+        },
+        "secret": {
+          "found": true,
+          "accessKeyIdLength": 16,
+          "accessKeySecretLength": 32
+        }
+      }
+    },
     {
       "id": "auth.sms-pnvs-remote-smoke",
       "status": "pass",
diff --git a/docs/refactor/web-launch-acceptance-checklist.md b/docs/refactor/web-launch-acceptance-checklist.md
index 98f62193..c367c80b 100644
--- a/docs/refactor/web-launch-acceptance-checklist.md
+++ b/docs/refactor/web-launch-acceptance-checklist.md
@@ -109,7 +109,8 @@ PNVS 短信登录上线前要用真实手机号跑一次远程 smoke。脚本不
 set -a
 source /etc/tiku-saas/api.env
 set +a
-PNVS_TENANT_ID=00000000-0000-0000-0000-000000000001 npm run diagnose:aliyun-pnvs
+PNVS_TENANT_ID=00000000-0000-0000-0000-000000000001 \
+npm run diagnose:aliyun-pnvs > docs/refactor/launch-artifacts/sms-pnvs-diagnostics.json
 
 SMS_SMOKE_API_BASE_URL=https://api.tjszsb.com \
 SMS_SMOKE_TENANT_ID=00000000-0000-0000-0000-000000000001 \
diff --git a/scripts/production-launch-gate-test.js b/scripts/production-launch-gate-test.js
index 471b64e7..9a037cdf 100644
--- a/scripts/production-launch-gate-test.js
+++ b/scripts/production-launch-gate-test.js
@@ -130,6 +130,30 @@ assert.ok(
   'missing PNVS SMS smoke should be reported as a blocker',
 );
 
+const missingSmsPnvsDiagnostics = runGate(tempDir => {
+  const evidence = createEvidence(tempDir);
+  evidence.checks = evidence.checks.filter(item => item.id !== 'auth.sms-pnvs-diagnostics');
+  return evidence;
+});
+assert.notEqual(missingSmsPnvsDiagnostics.status, 0, 'missing PNVS diagnostics should fail launch gate');
+assert.ok(
+  missingSmsPnvsDiagnostics.payload.checks?.some(item => item.id === 'check.auth.sms-pnvs-diagnostics' && item.status === 'blocker'),
+  'missing PNVS diagnostics should be reported as a blocker',
+);
+
+const wrongSmsPnvsDiagnostics = runGate(tempDir => {
+  const evidence = createEvidence(tempDir);
+  const item = evidence.checks.find(check => check.id === 'auth.sms-pnvs-diagnostics');
+  item.summary.env.providerMatchesPnvs = false;
+  item.summary.provider.provider = 'aliyun';
+  return evidence;
+});
+assert.notEqual(wrongSmsPnvsDiagnostics.status, 0, 'non-PNVS diagnostics should fail launch gate');
+assert.ok(
+  wrongSmsPnvsDiagnostics.payload.checks?.some(item => item.id === 'check.auth.sms-pnvs-diagnostics.summary' && item.status === 'blocker'),
+  'non-PNVS diagnostics should be reported as a blocker',
+);
+
 const wrongSmsProviderSmoke = runGate(tempDir => {
   const evidence = createEvidence(tempDir);
   const item = evidence.checks.find(check => check.id === 'auth.sms-pnvs-remote-smoke');
diff --git a/scripts/production-launch-gate.js b/scripts/production-launch-gate.js
index 1a85f6de..571bbc0f 100644
--- a/scripts/production-launch-gate.js
+++ b/scripts/production-launch-gate.js
@@ -38,6 +38,22 @@ const gateChecks = [
     commandIncludes: 'smoke:auth:remote',
     summary: { failed: 0, requireAdminTokens: true },
   },
+  {
+    id: 'auth.sms-pnvs-diagnostics',
+    label: 'Aliyun PNVS SMS provider diagnostics',
+    commandIncludes: 'diagnose:aliyun-pnvs',
+    summary: {
+      ok: true,
+      'env.providerMatchesPnvs': true,
+      'provider.found': true,
+      'provider.provider': 'aliyun-pnvs',
+      'provider.status': { oneOf: ['active', 'testing'] },
+      'provider.publicConfig.templateParamHasCodePlaceholder': true,
+      'secret.found': true,
+      'secret.accessKeyIdLength': { gt: 0 },
+      'secret.accessKeySecretLength': { gt: 0 },
+    },
+  },
   {
     id: 'auth.sms-pnvs-remote-smoke',
     label: 'Remote Aliyun PNVS SMS login smoke',