docs: add product experience officer best practice and demo

[yefengzi7]

Cookbook contribution

Summary

• Content type: Best Practice
• Locale: zh-CN
• Demo source included: yes
• Target audience: 需要在发版前做重复性产品体验巡检的产品与工程团队，以及想用 Cloud Agent 做自动化评测的开发者。
• User problem and expected outcome: 人工反复巡检文档、控制台与 API 成本高，且因过于熟悉而容易跳步漏检。本文给出用只读 Agent 加浏览器能力做自动化巡检的做法：默认零写入不影响被测系统，产出可回溯到具体工具调用的证据边界，并说明如何验证「它真的做了它声称做的事」。

Sources and assets

• Public sources used: 无外部引用文本。正文基于作者团队的自有实践与 Cloud Agents 平台的公开行为。
• Asset owner and license: 无图片与第三方素材。Demo 源码取自作者团队自有产品实现（Product Experience Officer 应用）的核心模块，为原创代码、非第三方来源，按本仓库条款以 Apache-2.0 贡献。
• If fully original, state: All submitted text and assets are original.

Specialist review

• 暂无指定复核人。如需产品或安全侧专项复核，请在评论中指出。

Author checklist

• I used exactly one author and no more than five approved tags.
• The article has at least three ## sections and no hand-written table of contents.
• I did not use GitHub Alerts, video, raw HTML, JavaScript, MDX, iframe, remote images, SVG, or interactive content.
• Images are local PNG, JPEG, or WebP files with meaningful alternative text and documented rights.
• The contribution contains no credentials, customer data, personal information, internal links, or unreleased capabilities.
• If a Demo is included, demos/<slug>/ matches the owner article, and the article contains the exact GitHub Demo link.
• If a Demo is included, its README documents prerequisites, setup, run, verification, cleanup, and cost/safety considerations.
• Demo configuration uses placeholders; no dependency cache, build output, binary, archive, nested Git metadata, or symbolic link is included.
• I disclosed the origin and license of Demo source, dependencies, fixtures, and third-party assets.
• I reviewed the generated preview locally or from the required GitHub Actions checks.
• Every commit contains a Signed-off-by trailer.
• I understand that maintainer Merge to main is the publication event.

Maintainer Demo review

• Not applicable, or a Maintainer reviewed the Demo README and source manually.
• Not applicable, or the claimed result, cleanup, billable operations, permissions, and destructive side effects were reviewed.

[Copilot]

Pull request overview

Adds a new zh-CN best-practice article and an accompanying “Product Experience Officer” demo code drop that illustrates a read-only evaluation workflow (prompting, session orchestration, evidence summarization, safe report rendering, and owner-scoped persistence).

Changes:

• Add zh-CN best-practice content for running “read-only + browser” product experience evaluations with verifiable evidence boundaries.
• Add a demo source bundle (API routes, access-policy parsing/redaction, report finality/continuation logic, safe markdown rendering, and D1/Supabase-backed evaluation persistence).
• Add a minimal demo package.json documenting runtime expectations.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
demos/product-experience-officer/README.md	Documents what the demo includes/excludes and how to verify key guarantees.
demos/product-experience-officer/package.json	Declares demo package metadata and Node engine requirement.
demos/product-experience-officer/lib/test-access.ts	Implements access policy validation, secret limits, summaries, and redaction helpers.
demos/product-experience-officer/lib/run-owner.ts	Adds owner isolation via cookie-based random owner id.
demos/product-experience-officer/lib/qca-report-finality.ts	Implements report completeness detection and continuation policy/messages.
demos/product-experience-officer/lib/product.ts	Adds product packs, evaluation stages, and baseline report/findings content.
demos/product-experience-officer/lib/evaluation-prompt.ts	Builds the evaluation prompt with access rules and report format contract.
demos/product-experience-officer/db/supabase-admin.ts	Provides server-only Supabase admin client creation.
demos/product-experience-officer/db/schema.ts	Defines Drizzle schema for evaluations table and indexes.
demos/product-experience-officer/db/index.ts	Provides D1 DB binding access via Cloudflare Workers env.
demos/product-experience-officer/db/evaluations.ts	Implements evaluation CRUD/update plans + D1 schema init + Supabase/D1 backends.
demos/product-experience-officer/app/report-markdown.tsx	Safely renders untrusted Markdown (no HTML, safe links, image placeholders, constrained Mermaid).
demos/product-experience-officer/app/api/runs/route.ts	Adds owner-scoped run history APIs (list/get/delete) with cookie binding.
demos/product-experience-officer/app/api/qca/route.ts	Implements QCA orchestration: provision resources, start sessions, poll evidence, continue reports, cleanup ephemeral resources.
content/zh-CN/best-practices/product-experience-officer/index.md	Adds the zh-CN best-practice article tying the approach and demo together.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.