feat(expenses): secure timeline and draft events

server/tests/test_steward_action_executor.py

@@ -14,6 +14,7 @@ from app.db.base import Base
 from app.main import create_app
 from app.models.agent_conversation import AgentConversation
 from app.models.employee import Employee
+from app.models.expense_case import BusinessEvent, ExpenseCaseLink
 from app.models.financial_record import ExpenseClaim
 from app.services import attachment_association_jobs as attachment_jobs_module
 
@@ -284,6 +285,9 @@ def test_steward_action_executor_reuses_checkpoint_for_duplicate_trace_without_d
     assert second_payload["result_payload"]["idempotent_replay"] is True
     with session_factory() as db:
         assert claim_count(db) == 1
+        events = list(db.scalars(select(BusinessEvent)).all())
+        assert len(events) == 1
+        assert events[0].event_type == "claim_draft_created"
 
 
 def test_steward_action_executor_requires_confirmation_before_submit_side_effect() -> None:
@@ -342,6 +346,16 @@ def test_steward_action_executor_saves_application_draft_from_action_step() -> N
         claim = db.scalars(select(ExpenseClaim)).one()
         assert claim.status == "draft"
         assert claim.reason == "辅助国网仿生产服务器部署"
+        event = db.scalars(
+            select(BusinessEvent).where(BusinessEvent.aggregate_id == claim.id)
+        ).one()
+        assert event.event_type == "claim_draft_created"
+        assert event.actor_id == "zhangsan@example.com"
+        assert event.correlation_id == "steward-action:save_application_draft:task_app_001"
+        link = db.scalars(
+            select(ExpenseCaseLink).where(ExpenseCaseLink.resource_id == claim.id)
+        ).one()
+        assert link.relation_type == "application"
 
 
 def test_steward_action_executor_creates_reimbursement_draft_from_action_step() -> None: