diff --git a/issues/2026-05-23_22-40-51-oa-small-team-maturity-next-work-v1.csv b/issues/2026-05-23_22-40-51-oa-small-team-maturity-next-work-v1.csv
new file mode 100644
index 00000000..0777e75b
--- /dev/null
+++ b/issues/2026-05-23_22-40-51-oa-small-team-maturity-next-work-v1.csv
@@ -0,0 +1,18 @@
+"ID","Title","Description","Acceptance","Test_Method","Tools","Dev_Status","Review1_Status","Regression_Status","Files","Dependencies","Notes"
+"OASMALL1-0","建立 10 人小科技公司 OA 成熟化下一步规划合同","按 MAGI 审视/执行/提升轮次，结合国内主流 OA/协同/低代码/财务产品调研和 hyb-oa 当前证据，建立下一步工作台账；本合同只用于审查和后续采纳，不直接改代码、部署或写公网业务数据。","Issue CSV 校验通过；明确本合同不替代 OALAUNCH1、OAOPS1、OANEXT2 或 OMAT1；所有建议默认 TODO，待用户逐项选择 A 采纳、B 暂缓、C 不采纳。","受影响流程：外部调研 -> 当前证据审视 -> 下一步工作拆分 -> 用户采纳；验证步骤：python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-05-23_22-40-51-oa-small-team-maturity-next-work-v1.csv。","python3|manual","DONE","DONE","DONE","issues/2026-05-23_22-40-51-oa-small-team-maturity-next-work-v1.csv","[]","MAGI 审视：10 人小科技公司应优先可控运行，不照搬大型 OA 套件；执行：建立规划台账；提升：把后续工作分成 P0 启用门禁、P1 轻量增强、P2 冻结后置。回滚/清理：本规划只新增 Issue CSV，若不采纳可删除本文件或在后续合同标记 superseded，不影响公网、数据库或业务数据。"
+"OASMALL1-1","国内同类系统能力域对标","调研钉钉/宜搭、飞书、企业微信、泛微、致远、金蝶、用友等国内常见方案，抽象出小团队真正需要对标的能力域：门户、流程、财务费控、合同项目、资产、权限审计、移动通知、数据档案、备份恢复和运维支持。","形成域级结论：竞品能力只能作为能力域参考，不因为大型产品存在某功能就直接进入 hyb-oa 开发；每个建议必须归类 P0/P1/P2。","受影响流程：外部能力调研 -> 内部优先级判断 -> 后续采纳；验证步骤：检查本 CSV Notes 的来源链接和 P0/P1/P2 分类是否完整。","web|manual","DONE","DONE","DONE","issues/2026-05-23_22-40-51-oa-small-team-maturity-next-work-v1.csv","[""OASMALL1-0""]","参考来源：钉钉宜搭/低代码、飞书审批/多维表格、企业微信审批/打卡、泛微/致远 OA、金蝶/用友财务与小微企业产品官方资料。结论：能力域要学，复杂度要克制。"
+"OASMALL1-2","P0：最终启用门禁仍是最高优先级","当前自动巡检、权限矩阵、OCR 小样本和 TEST/SMOKE 业务闭环已增强，但最终启用仍必须以 OALAUNCH1 为准，不能把自动通过等同于正式上线。","OALAUNCH1 输出 PASS_OA_LAUNCH_READY，或用户明确接受 PASS_WITH_FINDINGS 并指定 owner/日期；否则继续 PAUSED_MANUAL_CONFIRMATION。","受影响流程：最终启用 -> Go/No-Go；验证步骤：OALAUNCH_PERMISSION_EVIDENCE=<summary> bash scripts/qa/run-oa-final-launch-readiness.sh，检查 open gates。","bash|manual","TODO","TODO","TODO","issues/2026-05-23_16-49-39-oa-final-launch-readiness-v1.csv;scripts/qa/run-oa-final-launch-readiness.sh","[""OASMALL1-1""]","P0。小团队成熟系统的第一标准是可控启用：真实业务、权限、备份、SOP、7 天稳定化、Day 7 决策缺一不可。"
+"OASMALL1-3","P0：真实业务样本闭环","正式启用前补齐 1 条真实报销、1 条采购/费用、1 条合同台账和每日问题登记；自动 TEST/SMOKE 闭环只能证明技术链路，不替代真实业务证据。","真实报销完成 PDF OCR、提交、审批、付款批次、回单、已付款、AP 导出；采购/费用完成审批并关联项目或合同；合同台账含编号、负责人、归档位置和权限检查。","受影响流程：真实业务 -> 审批 -> 财务/合同/项目 -> 审计；验证步骤：人工在公网 OA 完成样本后，提供脱敏 evidence 路径给 run-oa-final-launch-readiness.sh 汇总。","manual|bash","TODO","TODO","TODO","issues/2026-05-22_20-09-22-oa-real-use-stabilization-v1.csv;issues/2026-05-23_20-47-20-oa-next-adoption-detailed-roadmap-v2.csv","[""OASMALL1-2""]","P0。真实票据、回单、合同正文、敏感报价、银行流水原件和未脱敏票面不得进入仓库、聊天或自动报告。"
+"OASMALL1-4","P0：备份恢复演练和恢复责任","成熟启用不能只看备份文件存在，必须做一次影子库或隔离环境恢复验证，并记录 RTO/RPO、负责人和证据路径。","备份集合可定位；影子恢复不影响公网生产库；关键表、附件、登录、报销详情、付款/AP 抽样通过；失败则暂停正式启用。","受影响流程：备份检查 -> 影子恢复 -> 数据抽样 -> Go/No-Go；验证步骤：按 OPS runbook 执行，OALAUNCH_BACKUP_EVIDENCE=<path> bash scripts/qa/run-oa-final-launch-readiness.sh。","manual|ops","TODO","TODO","TODO","docs/trialrun/OPS7运维交接Runbook.md;docs/ops/非功能基线.md","[""OASMALL1-2""]","P0。不得重置公网数据库，不得 destructive restore；回滚/清理只删除影子库、临时恢复目录和临时凭据。涉及恢复和权限修复后需只读 reviewer。"
+"OASMALL1-5","P0：权限矩阵补充冻结项、搜索和高敏模块负例","权限矩阵已通过基础角色和 API 负例，但最终启用前应把冻结功能、全局搜索、薪酬绩效差旅等高敏/后置模块纳入负例确认。","普通员工不能通过导航、直连 URL、API 或全局搜索看到财务敏感、合同敏感、他人审批、管理入口、冻结模块、薪酬绩效或未启用差旅；授权角色必要入口可用。","受影响流程：登录 -> 导航/搜索/API 直连 -> 权限拒绝或脱敏展示；验证步骤：扩展或复用 check-oa-permission-matrix.mjs，报告纳入 OALAUNCH_PERMISSION_EVIDENCE。","node|playwright|manual","TODO","TODO","TODO","scripts/qa/check-oa-permission-matrix.mjs;server/src/routes/search.js;client/src/features/navigation/schema.ts;server/src/routes/featureFlags.js","[""OASMALL1-2""]","P0。若只需启用前证据，可先用现有 smoke 账号做只读负例；涉及权限模型改动必须 reviewer 评审。"
+"OASMALL1-6","P0：数据治理、电子档案和会计资料留存清单","把可上传、只登记摘要、线下归档、导出审计、保管期限、离职交接和敏感资料禁止流转规则清单化，覆盖报销、发票、回单、付款批次、AP 导出、合同摘要、资产凭证和 EA-DOC。","管理员手册或员工快速上手中形成可执行清单；员工、审批人、财务、管理员知道边界；抽样资料能说明保管人、保管位置、授权和审计方式。","受影响流程：资料上传/登记 -> 查阅/导出 -> 归档/移交 -> 审计；验证步骤：抽样 1 条报销、1 条回单、1 条合同台账、1 条 EA-DOC，人工确认留存规则可执行。","manual|node","TODO","TODO","TODO","docs/管理员手册.md;docs/员工快速上手.md;docs/需求-资产管理规约.md;docs/需求-合同附件归档规约.md","[""OASMALL1-3""]","P0。第一阶段做清单和培训，不做复杂电子档案门户；敏感合同正文、银行流水原件、Secret、完整路径不得进入仓库/聊天/报告。"
+"OASMALL1-7","P0：审批异常处理和上线变更规则","小团队也需要明确误提交、退回重提、作废、审批人离岗、临时绕行、发布窗口、功能开关变更和回滚责任，避免启用后靠口头处理。","形成 P0 SOP：报销、采购/费用、合同台账各有异常处理责任人和审计要求；上线后变更有 owner、发布时间、回滚联系人、/ready 和业务 smoke。","受影响流程：提交 -> 审批异常 -> 退回/作废/绕行 -> 审计补录；变更 -> 部署/配置 -> smoke -> 回滚；验证步骤：人工桌面演练 1 次异常处理和 1 次非破坏性变更记录。","manual|bash","TODO","TODO","TODO","docs/需求-统一审批中心规约.md;docs/管理员手册.md;docs/试运行与自动化验证手册.md;deploy/trialrun/deploy.sh","[""OASMALL1-3""]","P0。先做 SOP，不急着上复杂 BPM、自由加签或自动代理。"
+"OASMALL1-8","P0：7 天稳定化和 Day 7 Go/No-Go","启动连续 7 天稳定化：每天自动只读巡检 + 人工日收口；第 7 天按 OALAUNCH1 做 Go/No-Go。","连续 7 天无不可解释 blocker；非阻断 finding 有 owner、日期或接受理由；Day 7 用户明确选择正式启用、带 finding 启用或暂停整改。","受影响流程：每日巡检 -> 问题登记 -> 修复/绕行/暂停 -> Day 7 决策；验证步骤：LIVE_SMOKE_BASE_URL=https://oa.hyinda.com bash scripts/qa/run-oa-real-use-daily.sh；Day 7 运行 run-oa-final-launch-readiness.sh。","bash|manual","TODO","TODO","TODO","scripts/qa/run-oa-real-use-daily.sh;scripts/qa/run-oa-final-launch-readiness.sh;docs/trialrun/人工试运行报告.md","[""OASMALL1-3"",""OASMALL1-4"",""OASMALL1-6""]","P0。不能用历史报告凑 7 天，需要用户确认起始日期。"
+"OASMALL1-9","P1：财务月结和代账交接轻量化","正式启用后优先把 AP、报销、票据、付款批次、回单、银行侧人工核对和代账资料交接固化为月结清单，而不是先接 ERP 或银行流水。","完成 1 次月度模拟或真实月结演练；导出文件、回单、银行侧人工核对、差异处理和代账交接确认有脱敏证据。","受影响流程：AP/报销/票据/付款批次导出 -> 银行侧资料 -> 代账交接 -> 差异处理；验证步骤：按 SOP 执行并在人工试运行报告中记录脱敏证据。","manual","TODO","TODO","TODO","server/src/routes/apOperations.js;server/src/routes/exports.js;docs/管理员手册.md","[""OASMALL1-8""]","P1。对 10 人公司，月结交接比复杂财务系统集成更有实际价值。"
+"OASMALL1-10","P1：合同项目提醒和责任人机制","合同台账已有基础，后续优先补轻量到期、履约义务、项目关联和责任人提醒；涉密正文仍线下归档，公网 OA 只放摘要和归档位置。","至少 1 条真实合同台账能关联项目/采购/付款；合同到期或履约责任能形成提醒或人工清单；权限负例通过。","受影响流程：合同登记 -> 项目/采购/付款关联 -> 责任提醒 -> 归档；验证步骤：真实合同样本抽查 + 权限负例 + 后续是否需要功能化提醒的人工决策。","manual|playwright","TODO","TODO","TODO","server/src/routes/contractsRegistry.js;client/src/pages/ContractsRegistryPage.tsx;docs/需求-合同附件归档规约.md","[""OASMALL1-8""]","P1。先做轻量提醒和责任人，不上大型合同全生命周期或电子签章。"
+"OASMALL1-11","P1：资产运营和真实盘点","ASSET1 已完成统一台账底座，但成熟资产管理还需要真实 FA 领用/归还/盘点、EA-SYS 负责人/备份策略、EA-BKP 恢复验证日期和离职交接检查。","至少 1 条真实 FA 完成领用/归还/盘点；1 条 EA-SYS 核验负责人和备份策略；1 条 EA-BKP 记录最近恢复验证；离职交接清单覆盖资产和权限。","受影响流程：资产登记 -> 领用/保管 -> 盘点/验证 -> 离职交接；验证步骤：公网 OA 真实资产抽样和 ASSET1D 报告回看。","manual|playwright","TODO","TODO","TODO","issues/2026-05-23_10-42-03-oa-asset-deploy-and-trial-v1.csv;server/src/routes/assets.js;docs/需求-资产管理规约.md","[""OASMALL1-4"",""OASMALL1-8""]","P1。EA-ACC 继续暂缓，OA 不保存密码、token、Secret 或私钥。"
+"OASMALL1-12","P1：移动端、通知和角色工作台真实反馈池","自动移动矩阵和通知链路只能证明基础可用；正式启用后应根据员工、审批人、财务、管理员真实频次优化首页入口、通知回跳、待办密度和异常提示。","7 天内收集角色反馈；关键通知抽样可读、可回跳、失败可追踪；阻断当天修复，体验项进入 UX 反馈池。","受影响流程：企业微信/浏览器入口 -> 移动页面 -> 通知 -> 业务详情 -> 返回；验证步骤：OAOPS1 每日巡检 + 人工真机反馈记录。","playwright|manual|node","TODO","TODO","TODO","client/src/features/navigation/schema.ts;client/src/pages/PortalHomePage.tsx;client/src/pages/MobilePortalPage.tsx;server/src/routes/notifications.js","[""OASMALL1-8""]","P1。只根据真实使用频次调整，不凭主观重排。"
+"OASMALL1-13","P1：轻量配置台只做必要范围","国内成熟 OA/低代码平台强调表单、流程和报表配置，但 10 人公司不宜过早引入复杂 BPM；若真实使用发现规则频繁变动，再做轻量配置台。","用户决定是否采纳：只覆盖 OA 主办报销、采购/费用、合同、资产的少量规则和字段；复杂 BPM、自由流程、预算占用继续冻结。","受影响流程：管理员配置 -> 用户提交 -> 审批链/字段生效 -> 审计；验证步骤：先评审配置边界和回滚策略，采纳后另建实现合同。","manual","TODO","TODO","TODO","server/src/routes/workflowDefinitions.js;server/src/routes/approvalRules.js;client/src/pages/WorkflowDefinitionsPage.tsx","[""OASMALL1-8""]","P1。建议谨慎采纳：先用真实反馈证明配置需求，再实现。"
+"OASMALL1-14","P2：深集成和大型套件能力继续冻结","ERP、银行流水导入、真实支付直连、电子签章、税务验真、复杂预算、AI 自动写规则、企微 HR 深镜像、应急接管、恢复写回、RuleOps 等均不应成为 10 人小团队启用前阻断。","冻结项不得通过导航、搜索、API 或 feature flag 误开放；后续重启必须另建专项 Issue CSV、风险评审和人工批准。","受影响流程：范围控制 -> 功能开关 -> 权限负例 -> 后续专项评估；验证步骤：结合权限矩阵、功能开关矩阵和 OALAUNCH1 权限证据检查冻结项不可见不可写。","manual|node|playwright","TODO","TODO","TODO","docs/集成边界.md;docs/产品口径.md;docs/企微优先开发路线图.md;server/src/routes/featureFlags.js","[""OASMALL1-5""]","P2。成熟路线是先 P0 可控运行，再用真实反馈选择少量 P1；不要为了对标大型系统而增加维护负担。"
+"OASMALL1-15","用户采纳问答门禁","本规划完成后，用户需要按组选择是否采纳，采纳项再进入 OALAUNCH1/OAOPS1/OANEXT2 或新的实现合同；未采纳项不得进入开发。","用户至少对 P0 组、P1 组、P2 冻结组给出 A/B/C 决策；决策回填后才允许进入实施。","受影响流程：规划审查 -> 用户决策 -> 后续执行合同；验证步骤：人工核对用户回复并 validate CSV。","manual|python3","TODO","TODO","TODO","issues/2026-05-23_22-40-51-oa-small-team-maturity-next-work-v1.csv","[""OASMALL1-0""]","选项：P0 A=全部采纳并优先执行，B=只采纳真实业务/备份/7天，C=暂停；P1 A=启用后逐项规划，B=观察真实反馈，C=暂不做；P2 A=继续冻结，B=只做可行性调研，C=提前专项启动。"
+"OASMALL1-16","合同校验与本轮停止点","完成本 CSV 校验和状态核对；本轮只交付调研结论与后续工作台账，不改代码、不部署、不写公网。","validate_issues_csv.py 通过；git diff 可审查；最终回复说明当前建议顺序、需要人工决策项和下一步可自动执行项。","受影响流程：规划 -> 校验 -> 汇报 -> 用户验收；验证步骤：python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-05-23_22-40-51-oa-small-team-maturity-next-work-v1.csv；git diff --check。","python3|git","DONE","DONE","DONE","issues/2026-05-23_22-40-51-oa-small-team-maturity-next-work-v1.csv","[""OASMALL1-1""]","本轮目标是把问题和建议记录下来，等用户审查决定是否采纳；已通过 validate_issues_csv.py、check-process-contract general、git diff --check。"