部署优化

.project-docs/30-worklog/current-state.md

@@ -13,8 +13,19 @@ blocked. A not-yet-ended period keeps its fixed C/O cutoff and must be rerun aft
 workbook needs those facts. Duplicate publication of the same semantic snapshot is idempotent: the first validated
 archive/result pair remains authoritative even if a retry rebuilds different XLSX bytes.
 
+Company-channel XLSX generation is now Web-container deployable without the private `@oai/artifact-tool` npm package:
+`company_reports.publishing.ArtifactToolBuilder` builds and reopens workbooks with Python/openpyxl, validates sheet
+names/headers/row counts/no-formulas, and treats blank Excel cells as business-empty strings. Node/artifact-tool remains
+only a monthly-worker packaging concern.
+
 ## Completed On 2026-08-03
 
+- Removed the private npm dependency from the company-channel report deployment path after CentOS Docker build failed
+  with `@oai/artifact-tool` 404. The company workbook builder now uses Python/openpyxl inside Web, keeps formula-injection
+  text escaping, produces no preview PNGs, and validates regenerated workbooks after saving. `compose.yaml` starts Web
+  with `--enable-company-reports`; HTTP/IP test overrides must keep that flag while omitting `--secure-cookies`.
+  Focused company-report and deployment-entrypoint tests pass 19/19. No database migration or live server deployment was
+  performed from this workstation.
 - Made the mobile H5 dashboard publicly readable without weakening the desktop/operator boundary. Anonymous users can
   load `/h5`, its H5 assets and purpose-built `/api/public/h5/months` plus `/api/public/h5/analytics` aggregate routes;
   the public projection omits source hashes and operational metadata. Generic analytics, legacy H5 APIs, desktop pages,
@@ -439,9 +450,10 @@ archive/result pair remains authoritative even if a retry rebuilds different XLS
   detached and are not reboot-persistent.
 - The latest operator-selected Web credentials were rotated on 2026-07-31, but the password still matches the username.
   Rotate it again to a distinct high-entropy value in Keychain, followed by one controlled Web restart.
-- The workstation runs Web and worker as separate processes. The checked-in Compose image intentionally does not claim
-  to run the worker because it does not package the workstation-only artifact-tool module; a production image/process
-  manager must supply Node/artifact-tool and the shared output volume before enabling that service.
+- The workstation runs Web and worker as separate processes. The checked-in Compose image now supports company-channel
+  XLSX generation through Python/openpyxl in Web, but intentionally does not claim to run the monthly worker because it
+  does not package the workstation-only monthly artifact-tool module; a production image/process manager must supply
+  Node/artifact-tool and the shared output volume before enabling that monthly service.
 - A formally controlled no-PII server acceptance run remains appropriate after that deployment packaging is complete.
 - ARR2.0 now has Git metadata; `main` tracks `origin/main`. Runtime credential values remain outside Git and project
   files.

.project-docs/30-worklog/task-history.md

@@ -4,6 +4,7 @@
 
 | Date | Task | Outcome | Docs Updated |
 |---|---|---|---|
+| 2026-08-03 | Make company-report XLSX generation deploy without private npm | Replaced the company-report builder's Node/private `@oai/artifact-tool` runtime dependency with Python/openpyxl workbook generation and self-validation, removed the private package dependency, enabled `--enable-company-reports` in Compose Web, and documented that only the monthly worker still needs Node/artifact-tool packaging. Focused company-report and deployment-entrypoint tests pass 19/19; no migration or live deployment was performed | Current state/history, architecture, deployment evidence/index, stale item, runbooks |
 | 2026-08-03 | Execute controlled fix and live-accept 2026-08 `01-10` company report | With explicit confirmation, stopped only the stale PID 11176 and started new listener PID 54127 through the existing Keychain-backed launcher. One authorized job `05cc547d…` succeeded 5/5 with row counts `54/18/7/1/15`, captured active Booking batch-7 source metadata, reused the existing version/artifact identities, and passed five HTTP download/hash checks. Logout and temporary-file cleanup completed; no Booking/Finance source or fact mutation occurred | Current state, runtime evidence/index, stale item, commitments, scoped planning record |
 | 2026-08-03 | Diagnose the latest 2026-08 `01-10` official-Excel save failure | Read-only evidence confirms newest job `087dceca...` built all five companies (`54/18/7/1/15`) and failed only at publish. Port 8766 is still PID 11176 from 2026-08-02, older than the semantic-reuse publisher fix; the earlier successful five-file archive/result/current set remains hash-consistent and intact. The launcher preflight is ready and six publisher tests pass. Repair is an exact controlled listener replacement followed by one authorized rerun; no restart, report write or business-data mutation was performed | Current state, runtime evidence/index, stale item, scoped planning record |
 | 2026-08-03 | Check whether company-report retries show reused-file identity | Confirmed the publisher can reuse an existing archive/result pair, but the outcome, job API and frontend expose only success/version/download; users cannot see that the file was reused or which prior artifact supplied it. No code or business-data change was made | Current state, retry-semantics evidence/index |