chore: gate launch on PNVS diagnostics

docs/refactor/production-launch-evidence.template.json

@@ -54,6 +54,32 @@
         "requireAdminTokens": true
       }
     },
+    {
+      "id": "auth.sms-pnvs-diagnostics",
+      "status": "pass",
+      "command": "PNVS_TENANT_ID=00000000-0000-0000-0000-000000000001 npm run diagnose:aliyun-pnvs > docs/refactor/launch-artifacts/sms-pnvs-diagnostics.json",
+      "completedAt": "2026-06-30T10:11:00+08:00",
+      "artifact": "launch-artifacts/sms-pnvs-diagnostics.json",
+      "summary": {
+        "ok": true,
+        "env": {
+          "providerMatchesPnvs": true
+        },
+        "provider": {
+          "found": true,
+          "provider": "aliyun-pnvs",
+          "status": "active",
+          "publicConfig": {
+            "templateParamHasCodePlaceholder": true
+          }
+        },
+        "secret": {
+          "found": true,
+          "accessKeyIdLength": 16,
+          "accessKeySecretLength": 32
+        }
+      }
+    },
     {
       "id": "auth.sms-pnvs-remote-smoke",
       "status": "pass",

docs/refactor/web-launch-acceptance-checklist.md

@@ -109,7 +109,8 @@ PNVS 短信登录上线前要用真实手机号跑一次远程 smoke。脚本不
 set -a
 source /etc/tiku-saas/api.env
 set +a
-PNVS_TENANT_ID=00000000-0000-0000-0000-000000000001 npm run diagnose:aliyun-pnvs
+PNVS_TENANT_ID=00000000-0000-0000-0000-000000000001 \
+npm run diagnose:aliyun-pnvs > docs/refactor/launch-artifacts/sms-pnvs-diagnostics.json
 
 SMS_SMOKE_API_BASE_URL=https://api.tjszsb.com \
 SMS_SMOKE_TENANT_ID=00000000-0000-0000-0000-000000000001 \

scripts/production-launch-gate-test.js

@@ -130,6 +130,30 @@ assert.ok(
   'missing PNVS SMS smoke should be reported as a blocker',
 );
 
+const missingSmsPnvsDiagnostics = runGate(tempDir => {
+  const evidence = createEvidence(tempDir);
+  evidence.checks = evidence.checks.filter(item => item.id !== 'auth.sms-pnvs-diagnostics');
+  return evidence;
+});
+assert.notEqual(missingSmsPnvsDiagnostics.status, 0, 'missing PNVS diagnostics should fail launch gate');
+assert.ok(
+  missingSmsPnvsDiagnostics.payload.checks?.some(item => item.id === 'check.auth.sms-pnvs-diagnostics' && item.status === 'blocker'),
+  'missing PNVS diagnostics should be reported as a blocker',
+);
+
+const wrongSmsPnvsDiagnostics = runGate(tempDir => {
+  const evidence = createEvidence(tempDir);
+  const item = evidence.checks.find(check => check.id === 'auth.sms-pnvs-diagnostics');
+  item.summary.env.providerMatchesPnvs = false;
+  item.summary.provider.provider = 'aliyun';
+  return evidence;
+});
+assert.notEqual(wrongSmsPnvsDiagnostics.status, 0, 'non-PNVS diagnostics should fail launch gate');
+assert.ok(
+  wrongSmsPnvsDiagnostics.payload.checks?.some(item => item.id === 'check.auth.sms-pnvs-diagnostics.summary' && item.status === 'blocker'),
+  'non-PNVS diagnostics should be reported as a blocker',
+);
+
 const wrongSmsProviderSmoke = runGate(tempDir => {
   const evidence = createEvidence(tempDir);
   const item = evidence.checks.find(check => check.id === 'auth.sms-pnvs-remote-smoke');

scripts/production-launch-gate.js

@@ -38,6 +38,22 @@ const gateChecks = [
     commandIncludes: 'smoke:auth:remote',
     summary: { failed: 0, requireAdminTokens: true },
   },
+  {
+    id: 'auth.sms-pnvs-diagnostics',
+    label: 'Aliyun PNVS SMS provider diagnostics',
+    commandIncludes: 'diagnose:aliyun-pnvs',
+    summary: {
+      ok: true,
+      'env.providerMatchesPnvs': true,
+      'provider.found': true,
+      'provider.provider': 'aliyun-pnvs',
+      'provider.status': { oneOf: ['active', 'testing'] },
+      'provider.publicConfig.templateParamHasCodePlaceholder': true,
+      'secret.found': true,
+      'secret.accessKeyIdLength': { gt: 0 },
+      'secret.accessKeySecretLength': { gt: 0 },
+    },
+  },
   {
     id: 'auth.sms-pnvs-remote-smoke',
     label: 'Remote Aliyun PNVS SMS login smoke',