feat: move report artifacts to OSS storage

tests/test_company_reports_acceptance.py

@@ -6,7 +6,7 @@ from pathlib import Path
 
 from company_reports.contracts import COMPANY_NAMES, REPORT_HEADERS, WarningCode
 from company_reports.core import build_all_company_reports
-from company_reports.publishing import ArtifactToolBuilder
+from company_reports.publishing import OpenpyxlWorkbookBuilder
 from tests.company_reports_acceptance_fixture import (
     AS_OF_DATE,
     REPORT_MONTH,
@@ -15,10 +15,6 @@ from tests.company_reports_acceptance_fixture import (
 )
 
 
-PROJECT_ROOT = Path(__file__).resolve().parents[1]
-BUILDER_SCRIPT = PROJECT_ROOT / "company_reports" / "xlsx" / "build_workbook.mjs"
-
-
 def acceptance_reports():
     return build_all_company_reports(
         REPORT_YEAR,
@@ -88,10 +84,7 @@ class CompanyReportAcceptanceCoreTests(unittest.TestCase):
 
 class CompanyReportAcceptanceWorkbookTests(unittest.TestCase):
     def test_real_builder_exports_and_reopens_all_five_workbooks(self):
-        builder = ArtifactToolBuilder(
-            BUILDER_SCRIPT,
-            timeout_seconds=180,
-        )
+        builder = OpenpyxlWorkbookBuilder()
         with tempfile.TemporaryDirectory(prefix="company-report-acceptance-") as temp_dir:
             root = Path(temp_dir)
             for report in acceptance_reports():

tests/test_company_reports_integration.py

@@ -9,7 +9,7 @@ from datetime import date
 from pathlib import Path
 
 from company_reports.publishing import (
-    ArtifactToolBuilder,
+    OpenpyxlWorkbookBuilder,
     AtomicReportPublisher,
     BuiltWorkbook,
     sha256_file,
@@ -19,10 +19,6 @@ from company_reports.service import CompanyReportService, RunRequest
 from tests.test_company_reports_service import FakeRepository, synthetic_snapshot
 
 
-PROJECT_ROOT = Path(__file__).resolve().parents[1]
-BUILDER_SCRIPT = PROJECT_ROOT / "company_reports" / "xlsx" / "build_workbook.mjs"
-
-
 class CompanyReportIntegrationTests(unittest.TestCase):
     def test_missing_and_unmatched_group_codes_export_blank_booking_room(self):
         class CapturingBuilder:
@@ -46,7 +42,7 @@ class CompanyReportIntegrationTests(unittest.TestCase):
                 )
             )
             builder = CapturingBuilder(
-                ArtifactToolBuilder(BUILDER_SCRIPT, timeout_seconds=90)
+                OpenpyxlWorkbookBuilder()
             )
             publisher = AtomicReportPublisher(project_root, output_root)
             service = CompanyReportService(
@@ -114,7 +110,7 @@ class CompanyReportIntegrationTests(unittest.TestCase):
             project_root.mkdir(parents=True)
             repository = StableVersionRepository(synthetic_snapshot())
             builder = RebuildingBuilder(
-                ArtifactToolBuilder(BUILDER_SCRIPT, timeout_seconds=90)
+                OpenpyxlWorkbookBuilder()
             )
             publisher = AtomicReportPublisher(project_root, output_root)
             service = CompanyReportService(

tests/test_company_reports_publishing.py

@@ -19,7 +19,7 @@ from company_reports.contracts import (
 )
 from company_reports.core import build_company_report
 from company_reports.publishing import (
-    ArtifactToolBuilder,
+    OpenpyxlWorkbookBuilder,
     AtomicReportPublisher,
     BuiltWorkbook,
     PublicationError,
@@ -112,14 +112,11 @@ def synthetic_built_workbook(
 
 
 class CompanyReportPublishingTests(unittest.TestCase):
-    def test_builder_creates_xlsx_without_private_artifact_tool_runtime(self):
+    def test_builder_creates_xlsx_with_openpyxl_only(self):
         with tempfile.TemporaryDirectory(prefix="company-report-builder-test-") as temp_dir:
             root = Path(temp_dir)
             report = workbook_report()
-            builder = ArtifactToolBuilder(
-                Path("/private/artifact-tool/build_workbook.mjs"),
-                node_binary="/definitely/not/node",
-            )
+            builder = OpenpyxlWorkbookBuilder()
 
             built = builder.build(report, root)
 

tests/test_company_reports_xlsx.py

@@ -1,119 +0,0 @@
-from __future__ import annotations
-
-import json
-import os
-import shutil
-import subprocess
-import tempfile
-import unittest
-from pathlib import Path
-
-
-PROJECT_ROOT = Path(__file__).resolve().parents[1]
-BUILDER = PROJECT_ROOT / "company_reports" / "xlsx" / "build_workbook.mjs"
-FIXTURE = (
-    PROJECT_ROOT
-    / "tests"
-    / "fixtures"
-    / "company_reports"
-    / "synthetic_qbd_payload.json"
-)
-ARTIFACT_PACKAGE = (
-    PROJECT_ROOT
-    / "company_reports"
-    / "xlsx"
-    / "node_modules"
-    / "@oai"
-    / "artifact-tool"
-)
-
-
-def artifact_tool_available() -> bool:
-    configured = os.environ.get("COMPANY_REPORT_ARTIFACT_TOOL_MODULE", "").strip()
-    return ARTIFACT_PACKAGE.exists() or bool(configured and Path(configured).is_file())
-
-
-def node_binary() -> str:
-    configured = os.environ.get("COMPANY_REPORT_NODE_BINARY", "").strip()
-    return configured or shutil.which("node") or ""
-
-
-@unittest.skipUnless(artifact_tool_available(), "artifact-tool dependency is not installed")
-class CompanyReportXlsxTests(unittest.TestCase):
-    def test_builder_exports_reopens_checks_and_renders_all_sheets(self):
-        node = node_binary()
-        if not node:
-            self.skipTest("Node.js is unavailable")
-        with tempfile.TemporaryDirectory(prefix="company-report-xlsx-test-") as temp_dir:
-            root = Path(temp_dir)
-            output = root / "QBD-July-2026.xlsx"
-            previews = root / "previews"
-            summary_path = root / "summary.json"
-            completed = subprocess.run(
-                [
-                    node,
-                    str(BUILDER),
-                    str(FIXTURE),
-                    str(output),
-                    str(previews),
-                    str(summary_path),
-                ],
-                cwd=PROJECT_ROOT,
-                capture_output=True,
-                text=True,
-                timeout=90,
-                check=False,
-            )
-
-            self.assertEqual(completed.returncode, 0, completed.stderr)
-            self.assertTrue(output.is_file())
-            self.assertFalse(Path(f"{output}.inspect.ndjson").exists())
-            self.assertEqual(output.stat().st_mode & 0o777, 0o600)
-            summary = json.loads(summary_path.read_text(encoding="utf-8"))
-            self.assertEqual(summary["status"], "success")
-            self.assertEqual(summary["row_counts"], [2, 1, 0])
-            self.assertEqual(summary["formula_count"], 0)
-            self.assertEqual(summary["preview_count"], 3)
-            self.assertEqual(len(list(previews.glob("sheet-*.png"))), 3)
-
-    def test_invalid_payload_fails_with_only_a_stable_error_code(self):
-        node = node_binary()
-        if not node:
-            self.skipTest("Node.js is unavailable")
-        with tempfile.TemporaryDirectory(prefix="company-report-xlsx-test-") as temp_dir:
-            root = Path(temp_dir)
-            invalid = root / "invalid.json"
-            invalid.write_text(
-                json.dumps({"schema_version": "invalid", "synthetic_marker": "SYN-ONLY"}),
-                encoding="utf-8",
-            )
-            completed = subprocess.run(
-                [
-                    node,
-                    str(BUILDER),
-                    str(invalid),
-                    str(root / "invalid.xlsx"),
-                    str(root / "previews"),
-                    str(root / "summary.json"),
-                ],
-                cwd=PROJECT_ROOT,
-                capture_output=True,
-                text=True,
-                timeout=30,
-                check=False,
-            )
-
-            self.assertEqual(completed.returncode, 4)
-            self.assertEqual(
-                json.loads(completed.stderr),
-                {
-                    "status": "failed",
-                    "code": "COMPANY_REPORT_OUTPUT_VALIDATION_FAILED",
-                },
-            )
-            self.assertNotIn("SYN-ONLY", completed.stderr)
-            self.assertFalse((root / "invalid.xlsx").exists())
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/test_deployment_entrypoints.py

@@ -33,6 +33,9 @@ class DeploymentEntrypointTests(unittest.TestCase):
         root_requirements = (PROJECT_ROOT / "requirements.txt").read_text(
             encoding="utf-8"
         )
+        monthly_requirements = (
+            PROJECT_ROOT / "requirements-monthly-reports.txt"
+        ).read_text(encoding="utf-8")
         company_requirements = (
             PROJECT_ROOT / "requirements-company-reports.txt"
         ).read_text(encoding="utf-8")
@@ -51,13 +54,11 @@ class DeploymentEntrypointTests(unittest.TestCase):
         self.assertNotIn("basic_auth", caddy)
         self.assertNotIn("requirements-agent-integration", root_requirements)
         self.assertNotIn("requirements-arr-mcp", root_requirements)
+        self.assertIn("openpyxl", monthly_requirements)
         self.assertIn("openpyxl", company_requirements)
-        company_package = json.loads(
-            (PROJECT_ROOT / "company_reports" / "xlsx" / "package.json").read_text(
-                encoding="utf-8"
-            )
-        )
-        self.assertNotIn("@oai/artifact-tool", json.dumps(company_package))
+        self.assertFalse((PROJECT_ROOT / "company_reports" / "xlsx" / "package.json").exists())
+        self.assertFalse((PROJECT_ROOT / "monthly_reports" / "xlsx" / "package.json").exists())
+        self.assertNotIn("artifact-tool", compose)
 
 
 if __name__ == "__main__":

tests/test_monthly_oss_artifact_migration.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+import unittest
+from pathlib import Path
+
+
+PROJECT_ROOT = Path(__file__).resolve().parents[1]
+
+
+class MonthlyOssArtifactMigrationTests(unittest.TestCase):
+    def test_forward_migration_allows_oss_and_keeps_local_compatibility(self):
+        sql = (PROJECT_ROOT / "database" / "016_monthly_report_oss_artifacts.sql").read_text(
+            encoding="utf-8"
+        )
+        self.assertIn("current_database() <> 'booking_test'", sql)
+        self.assertIn("COALESCE(workbook_provider, '') NOT IN ('oss', 's3', 'local')", sql)
+        self.assertIn("COALESCE(result_provider, '') NOT IN ('oss', 's3', 'local')", sql)
+        self.assertIn("CREATE OR REPLACE FUNCTION reporting.validate_monthly_run_publication()", sql)
+        self.assertIn("existing private OSS", sql)
+
+    def test_down_migration_refuses_published_nonlocal_artifacts(self):
+        sql = (
+            PROJECT_ROOT / "database" / "016_monthly_report_oss_artifacts.down.sql"
+        ).read_text(encoding="utf-8")
+        self.assertIn("artifact.storage_provider <> 'local'", sql)
+        self.assertIn("rollback refused", sql)
+        self.assertIn("workbook_provider IS DISTINCT FROM 'local'", sql)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_monthly_reports_xlsx.py

@@ -1,9 +1,5 @@
 from __future__ import annotations
 
-import json
-import os
-import shutil
-import subprocess
 import tempfile
 import unittest
 from datetime import date
@@ -19,21 +15,10 @@ from monthly_reports.contracts import (
     MonthlySnapshot,
 )
 from monthly_reports.core import build_monthly_report
+from monthly_reports.publishing import OpenpyxlWorkbookBuilder
 
 
-PROJECT_ROOT = Path(__file__).resolve().parents[1]
-BUILDER = PROJECT_ROOT / "monthly_reports" / "xlsx" / "build_workbook.mjs"
-
-
-def artifact_tool_module() -> str:
-    return os.environ.get("MONTHLY_REPORT_ARTIFACT_TOOL_MODULE", "").strip()
-
-
-def node_binary() -> str:
-    return os.environ.get("MONTHLY_REPORT_NODE_BINARY", "").strip() or shutil.which("node") or ""
-
-
-def report_payload() -> dict:
+def report_fixture():
     source = MonthlyFact(
         daily_record_id=1,
         daily_version_id=100,
@@ -60,7 +45,7 @@ def report_payload() -> dict:
         total_price=Decimal("901.00"),
         kb_amount=None,
     )
-    report = build_monthly_report(
+    return build_monthly_report(
         2026,
         7,
         date(2026, 7, 8),
@@ -70,59 +55,28 @@ def report_payload() -> dict:
             (ChannelObservation(date(2026, 7, 8), 100, "QBD", 1, 1),),
         ),
     )
-    return report.to_workbook_payload()
 
 
-@unittest.skipUnless(
-    bool(artifact_tool_module() and Path(artifact_tool_module()).is_file()),
-    "artifact-tool module is not configured",
-)
 class MonthlyReportsXlsxTests(unittest.TestCase):
-    def test_builder_exports_reopens_scans_and_renders_every_channel(self):
-        node = node_binary()
-        if not node:
-            self.skipTest("Node.js is unavailable")
+    def test_openpyxl_builder_reopens_checks_formulas_and_semantic_identity(self):
+        report = report_fixture()
         with tempfile.TemporaryDirectory(prefix="monthly-report-xlsx-") as temp_dir:
-            root = Path(temp_dir)
-            payload_path = root / "payload.json"
-            payload_path.write_text(
-                json.dumps(report_payload(), ensure_ascii=False),
-                encoding="utf-8",
-            )
-            output = root / "monthly.xlsx"
-            previews = root / "previews"
-            summary_path = root / "summary.json"
-            completed = subprocess.run(
-                [
-                    node,
-                    str(BUILDER),
-                    str(payload_path),
-                    str(output),
-                    str(previews),
-                    str(summary_path),
-                ],
-                cwd=PROJECT_ROOT,
-                capture_output=True,
-                text=True,
-                timeout=120,
-                check=False,
-                env=os.environ.copy(),
-            )
+            built = OpenpyxlWorkbookBuilder().build(report, Path(temp_dir))
 
-            self.assertEqual(completed.returncode, 0, completed.stderr)
-            summary = json.loads(summary_path.read_text(encoding="utf-8"))
-            self.assertEqual(summary["sheet_names"][:5], [
+            self.assertTrue(built.path.is_file())
+            self.assertEqual(built.path.stat().st_mode & 0o777, 0o600)
+            self.assertEqual(built.summary["sheet_names"][:5], [
                 "LIANTAI-GROUP", "LIANTAI-FIT", "QBD", "DY-AI-Easy-KB", "FENGRUN"
             ])
-            self.assertEqual(summary["row_counts"], [0, 0, 1, 0, 0])
-            self.assertEqual(summary["formula_count"], 1)
-            self.assertEqual(summary["preview_count"], 5)
-            self.assertEqual(len(list(previews.glob("sheet-*.png"))), 5)
-            self.assertEqual(output.stat().st_mode & 0o777, 0o600)
-            self.assertFalse(Path(f"{output}.inspect.ndjson").exists())
-            workbook = load_workbook(output, data_only=False, read_only=True)
+            self.assertEqual(built.summary["row_counts"], [0, 0, 1, 0, 0])
+            self.assertEqual(built.summary["formula_count"], 1)
+            self.assertEqual(built.summary["preview_count"], 5)
+            self.assertEqual(len(built.summary["semantic_sha256"]), 64)
+
+            workbook = load_workbook(built.path, data_only=False, read_only=True)
             try:
                 self.assertEqual(workbook["QBD"]["S2"].value, "=R2*C2*G2")
+                self.assertEqual(workbook["QBD"]["F2"].value, "'=SYN-FORMULA-LIKE")
                 formulas = [
                     cell.value
                     for sheet in workbook.worksheets
@@ -134,43 +88,6 @@ class MonthlyReportsXlsxTests(unittest.TestCase):
             finally:
                 workbook.close()
 
-    def test_invalid_payload_returns_only_stable_error_code(self):
-        node = node_binary()
-        if not node:
-            self.skipTest("Node.js is unavailable")
-        with tempfile.TemporaryDirectory(prefix="monthly-report-xlsx-") as temp_dir:
-            root = Path(temp_dir)
-            invalid = root / "invalid.json"
-            invalid.write_text(
-                json.dumps({"schema_version": "bad", "sensitive": "SYN-SECRET"}),
-                encoding="utf-8",
-            )
-            completed = subprocess.run(
-                [
-                    node,
-                    str(BUILDER),
-                    str(invalid),
-                    str(root / "invalid.xlsx"),
-                    str(root / "previews"),
-                    str(root / "summary.json"),
-                ],
-                cwd=PROJECT_ROOT,
-                capture_output=True,
-                text=True,
-                timeout=30,
-                check=False,
-                env=os.environ.copy(),
-            )
-            self.assertEqual(completed.returncode, 4)
-            self.assertEqual(
-                json.loads(completed.stderr),
-                {
-                    "status": "failed",
-                    "code": "MONTHLY_REPORT_OUTPUT_VALIDATION_FAILED",
-                },
-            )
-            self.assertNotIn("SYN-SECRET", completed.stderr)
-
 
 if __name__ == "__main__":
     unittest.main()

tests/test_report_artifacts.py

@@ -0,0 +1,182 @@
+from __future__ import annotations
+
+import hashlib
+import tempfile
+import unittest
+from pathlib import Path
+
+from arr_storage.filesystem import FilesystemObjectBackend
+from arr_storage.store import ManagedObjectStore
+from arr_web.downloads import (
+    ArtifactDescriptor,
+    ControlledProjectArtifactReader,
+    ManagedObjectArtifactReader,
+    RoutedArtifactReader,
+)
+from company_reports.publishing import AtomicReportPublisher as CompanyPublisher
+from company_reports.repository import ReservedReport as CompanyReservation
+from monthly_reports.publishing import (
+    AtomicReportPublisher as MonthlyPublisher,
+    OpenpyxlWorkbookBuilder,
+    private_staging_directory,
+)
+from monthly_reports.repository import ReservedReport as MonthlyReservation
+from tests.test_company_reports_publishing import (
+    FakeRepository as CompanyFakeRepository,
+    empty_report,
+    synthetic_built_workbook,
+)
+from tests.test_monthly_reports_publishing import FakeRepository as MonthlyFakeRepository
+from tests.test_monthly_reports_xlsx import report_fixture
+
+
+XLSX_MIME = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
+
+
+class ReportArtifactStorageTests(unittest.TestCase):
+    def test_monthly_and_company_publications_upload_workbook_and_result_to_oss(self):
+        with tempfile.TemporaryDirectory(prefix="report-artifact-oss-") as temporary:
+            root = Path(temporary) / "project"
+            root.mkdir()
+            store = ManagedObjectStore(
+                FilesystemObjectBackend(root / "objects", create=True)
+            )
+
+            monthly_report = report_fixture()
+            monthly_work = root / "monthly-work"
+            monthly_work.mkdir()
+            monthly_built = OpenpyxlWorkbookBuilder().build(monthly_report, monthly_work)
+            monthly_outcome = MonthlyPublisher(
+                root,
+                root / "outputs" / "monthly_reports",
+                object_store=store,
+            ).publish(
+                monthly_report,
+                MonthlyReservation(44, 2),
+                monthly_built,
+                MonthlyFakeRepository(),
+                monthly_work,
+            )
+
+            self.assertEqual(monthly_outcome.artifact.storage_provider, "oss")
+            self.assertEqual(monthly_outcome.result_json.storage_provider, "oss")
+            self.assertEqual(
+                store.inspect_committed(
+                    monthly_outcome.artifact.storage_key,
+                    monthly_report.filename,
+                ).role,
+                "monthly_report",
+            )
+            self.assertEqual(
+                store.inspect_committed(
+                    monthly_outcome.result_json.storage_key,
+                    monthly_outcome.result_json.original_filename,
+                ).role,
+                "result_json",
+            )
+
+            company_report = empty_report()
+            company_work = root / "company-work"
+            company_work.mkdir()
+            company_built = synthetic_built_workbook(
+                company_work,
+                company_report.filename,
+                b"synthetic-company-xlsx",
+                "a" * 64,
+            )
+            company_outcome = CompanyPublisher(
+                root,
+                root / "outputs" / "company_reports",
+                object_store=store,
+            ).publish(
+                company_report,
+                CompanyReservation(45, 3, company_report.company),
+                company_built,
+                CompanyFakeRepository(),
+                company_work,
+            )
+
+            self.assertEqual(company_outcome.artifact.storage_provider, "oss")
+            self.assertEqual(company_outcome.result_json.storage_provider, "oss")
+            self.assertEqual(
+                store.inspect_committed(
+                    company_outcome.artifact.storage_key,
+                    company_report.filename,
+                ).role,
+                "company_report",
+            )
+
+            retry_work = root / "company-retry-work"
+            retry_work.mkdir()
+            retry_built = synthetic_built_workbook(
+                retry_work,
+                company_report.filename,
+                b"synthetic-company-xlsx-rebuilt",
+                "a" * 64,
+            )
+            retry_outcome = CompanyPublisher(
+                root,
+                root / "outputs" / "company_reports",
+                object_store=store,
+            ).publish(
+                company_report,
+                CompanyReservation(45, 3, company_report.company),
+                retry_built,
+                CompanyFakeRepository(),
+                retry_work,
+            )
+            self.assertEqual(retry_outcome.artifact.storage_provider, "oss")
+            self.assertEqual(
+                retry_outcome.artifact.sha256,
+                company_outcome.artifact.sha256,
+            )
+            self.assertEqual(retry_outcome.result_json.storage_provider, "oss")
+
+    def test_download_router_supports_oss_and_legacy_local_records(self):
+        with tempfile.TemporaryDirectory(prefix="report-download-") as temporary:
+            root = Path(temporary)
+            source = root / "monthly.xlsx"
+            source.write_bytes(b"monthly-oss-bytes")
+            store = ManagedObjectStore(
+                FilesystemObjectBackend(root / "objects", create=True)
+            )
+            stored = store.upload_committed(
+                job_id="monthly-download-001",
+                attempt_no=1,
+                role="monthly_report",
+                source=source,
+                original_filename="月报.xlsx",
+            )
+            oss_descriptor = ArtifactDescriptor(
+                "monthly_xlsx",
+                "月报.xlsx",
+                stored.object_key,
+                stored.sha256,
+                stored.byte_size,
+                stored.mime_type,
+                "oss",
+                "arr-private",
+            )
+            local_path = root / "outputs" / "legacy.xlsx"
+            local_path.parent.mkdir()
+            local_path.write_bytes(b"legacy-local-bytes")
+            local_descriptor = ArtifactDescriptor(
+                "monthly_xlsx",
+                "legacy.xlsx",
+                "outputs/legacy.xlsx",
+                hashlib.sha256(local_path.read_bytes()).hexdigest(),
+                local_path.stat().st_size,
+                XLSX_MIME,
+            )
+            reader = RoutedArtifactReader(
+                daily_reader=None,
+                local_reader=ControlledProjectArtifactReader(root),
+                oss_reader=ManagedObjectArtifactReader(store),
+            )
+
+            self.assertEqual(reader.read(oss_descriptor), source.read_bytes())
+            self.assertEqual(reader.read(local_descriptor), local_path.read_bytes())
+
+
+if __name__ == "__main__":
+    unittest.main()