docs: 记录前端降噪审计修复部署复检（frontend-audit-fixes-deploy-verify）

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/deploy-context.md

@@ -0,0 +1,19 @@
+# 部署复检上下文
+
+## 已完成本地修复
+
+- `7b6e705 修复前端降噪审计问题（frontend-simplification-audit-fixes）`
+- `13643e3 归档前端降噪审计修复任务（frontend-simplification-audit-fixes）`
+
+## 部署边界
+
+- 使用 `SYNC_ENV=0 bash deploy/trialrun/deploy.sh`。
+- 不同步或覆盖远端 `.env`。
+- 不写真实业务数据、不写企业微信、不执行真实付款。
+- 验证报告只记录脱敏状态、摘要和相对路径。
+
+## 计划输出
+
+- `research/postdeploy-live-smoke-readiness/summary.json`
+- `research/postdeploy-permission-matrix/summary.json`
+- `research/postdeploy-summary.md`

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/env.json

@@ -0,0 +1,51 @@
+{
+  "checkedAt": "2026-05-29T06:59:42.434Z",
+  "baseUrl": "https://oa.hyinda.com",
+  "liveSmokeReady": false,
+  "liveSmoke": {
+    "adminCredentialReady": false,
+    "employeeCredentialReady": false
+  },
+  "liveSmokeOptional": {
+    "expectedWecomStatusReady": false,
+    "managerCredentialReady": false,
+    "financeCredentialReady": false
+  },
+  "liveOcrReady": false,
+  "liveOcr": {
+    "userReady": false,
+    "invoiceSampleReady": false,
+    "invoiceFileProvided": false,
+    "invoiceFileReady": false,
+    "invoiceBatchDirProvided": false,
+    "invoiceBatchDirReady": false,
+    "allowDuplicate": false
+  },
+  "missing": [
+    "adminCredentialReady",
+    "employeeCredentialReady",
+    "ocrOrEmployeeCredentialReady",
+    "PLAYWRIGHT_OCR_LIVE_FILE 或 PLAYWRIGHT_OCR_LIVE_DIR 中的 PDF 样票"
+  ],
+  "publicReady": {
+    "ok": true,
+    "status": 200
+  },
+  "wecomConfig": {
+    "ok": true,
+    "status": 200,
+    "statusText": "ready",
+    "entryEnabled": true,
+    "oauthEnabled": true,
+    "defaultReturnTo": "/mobile",
+    "loginUrl": "/api/auth/wecom/login?returnTo=%2Fmobile"
+  },
+  "authCapabilities": {
+    "ok": true,
+    "status": 200,
+    "emailDeliveryReady": true,
+    "emailDeliveryReasons": [],
+    "emailLoginCodeEnabled": true,
+    "passwordResetEnabled": true
+  }
+}

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/live-ocr.txt

@@ -0,0 +1 @@
+>>> [live-readiness] SKIP 真实 OCR：缺少 smoke 员工凭据或 PLAYWRIGHT_OCR_LIVE_FILE/PLAYWRIGHT_OCR_LIVE_DIR

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/live-smoke.txt

@@ -0,0 +1 @@
+>>> [live-readiness] SKIP live smoke：缺少完整 LIVE_SMOKE_* 凭据

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/pending-ocr.txt

@@ -0,0 +1 @@
+[pending-ocr][SKIP] missing DATABASE_URL

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/public-bundle-copy.txt

@@ -0,0 +1 @@
+[public-bundle-copy] base=https://oa.hyinda.com scanned=91 focused=2 findings=0

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/summary.json

@@ -0,0 +1,12 @@
+{
+  "issueId": null,
+  "baseURL": "https://oa.hyinda.com",
+  "commit": "13643e3",
+  "checkedAt": "2026-05-29T06:59:47.423Z",
+  "status": "PASS",
+  "mode": "live-smoke-readiness",
+  "reportDir": ".trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness",
+  "reportRef": ".trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness",
+  "groups": null,
+  "notes": "公网 /ready、public bundle、pending OCR、live smoke 和真实 OCR 可用性检查；缺少凭据或样票时按脚本规则记录 SKIP。"
+}

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-permission-matrix/summary.json

@@ -0,0 +1,127 @@
+{
+  "issueId": "OANEXT2-4",
+  "status": "PASS_WITH_FINDINGS",
+  "checkedAt": "2026-05-29T06:59:54.262Z",
+  "baseUrl": "https://oa.hyinda.com",
+  "privacy": "redacted role/status/count evidence only; no password, token, Secret, full account, invoice, contract, attachment, or raw payload",
+  "counts": {
+    "roles": 7,
+    "positiveProbes": 0,
+    "negativeProbes": 0
+  },
+  "issues": [],
+  "results": [
+    {
+      "key": "employee",
+      "expectedRoles": [
+        "employee"
+      ],
+      "maskedIdentifier": null,
+      "login": {
+        "status": "SKIP",
+        "reason": "missing_credentials",
+        "code": null
+      },
+      "roleMatch": "SKIP",
+      "actualRoles": [],
+      "probes": []
+    },
+    {
+      "key": "manager",
+      "expectedRoles": [
+        "manager",
+        "employee"
+      ],
+      "maskedIdentifier": null,
+      "login": {
+        "status": "SKIP",
+        "reason": "missing_credentials",
+        "code": null
+      },
+      "roleMatch": "SKIP",
+      "actualRoles": [],
+      "probes": []
+    },
+    {
+      "key": "finance",
+      "expectedRoles": [
+        "finance",
+        "employee"
+      ],
+      "maskedIdentifier": null,
+      "login": {
+        "status": "SKIP",
+        "reason": "missing_credentials",
+        "code": null
+      },
+      "roleMatch": "SKIP",
+      "actualRoles": [],
+      "probes": []
+    },
+    {
+      "key": "finance_mgr",
+      "expectedRoles": [
+        "finance",
+        "finance_mgr",
+        "employee"
+      ],
+      "maskedIdentifier": null,
+      "login": {
+        "status": "SKIP",
+        "reason": "missing_credentials",
+        "code": null
+      },
+      "roleMatch": "SKIP",
+      "actualRoles": [],
+      "probes": []
+    },
+    {
+      "key": "hr",
+      "expectedRoles": [
+        "hr",
+        "employee"
+      ],
+      "maskedIdentifier": null,
+      "login": {
+        "status": "SKIP",
+        "reason": "missing_credentials",
+        "code": null
+      },
+      "roleMatch": "SKIP",
+      "actualRoles": [],
+      "probes": []
+    },
+    {
+      "key": "ceo",
+      "expectedRoles": [
+        "ceo",
+        "employee"
+      ],
+      "maskedIdentifier": null,
+      "login": {
+        "status": "SKIP",
+        "reason": "missing_credentials",
+        "code": null
+      },
+      "roleMatch": "SKIP",
+      "actualRoles": [],
+      "probes": []
+    },
+    {
+      "key": "admin",
+      "expectedRoles": [
+        "admin",
+        "employee"
+      ],
+      "maskedIdentifier": null,
+      "login": {
+        "status": "SKIP",
+        "reason": "missing_credentials",
+        "code": null
+      },
+      "roleMatch": "SKIP",
+      "actualRoles": [],
+      "probes": []
+    }
+  ]
+}

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-permission-matrix/summary.md

@@ -0,0 +1,28 @@
+# OA 权限矩阵脱敏自动验证报告
+
+生成时间：2026-05-29T06:59:54.262Z
+结论：PASS_WITH_FINDINGS
+
+## 统计
+
+- 角色数：7
+- 正向探针：0
+- 负向探针：0
+- 问题数：0
+
+## 角色结果
+
+| 角色 | 登录 | 角色匹配 | 探针通过/总数 |
+| --- | --- | --- | ---: |
+| employee | SKIP | SKIP | 0/0 |
+| manager | SKIP | SKIP | 0/0 |
+| finance | SKIP | SKIP | 0/0 |
+| finance_mgr | SKIP | SKIP | 0/0 |
+| hr | SKIP | SKIP | 0/0 |
+| ceo | SKIP | SKIP | 0/0 |
+| admin | SKIP | SKIP | 0/0 |
+
+## 说明
+
+- 本报告只输出角色、HTTP 状态、脱敏账号和摘要计数，不输出密码、token、Secret、完整账号、合同正文、票据内容或原始 payload。
+- 409 表示功能门禁关闭且未泄露数据；对财务/AP/付款等冻结或受控功能可作为可解释拒绝。

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-summary.md

@@ -0,0 +1,53 @@
+# 前端降噪审计修复部署复检摘要
+
+## 结论
+
+`READY_WITH_FINDINGS`
+
+公网试运行环境已部署到本地 `main` 当前提交 `13643e3`，该提交包含前端审计修复提交 `7b6e705`。本次部署使用 `SYNC_ENV=0 bash deploy/trialrun/deploy.sh`，未同步或覆盖远端 `.env`。
+
+权限矩阵结论为 `PASS_WITH_FINDINGS`，finding 为本地缺少 7 个角色的 live 凭据，角色登录与探针均按脚本规则 SKIP；报告未记录权限断言失败。live smoke 和真实 OCR 也因缺少完整凭据或 PDF 样票按脚本规则 SKIP。其余本地门禁、部署脚本、公网 `/ready`、资源文案扫描、PC 只读视觉、移动入口矩阵、企业微信渲染矩阵和聚焦审计入口用例均通过。
+
+## 部署前门禁
+
+- `cd client && npm run typecheck`：PASS
+- `cd client && npm run build`：PASS
+- `node scripts/qa/check-ui-design-rules.mjs`：PASS
+- `node deploy/trialrun/validate-env-contract.js`：PASS
+- `python3 ./.trellis/scripts/task.py validate 05-29-frontend-audit-fixes-deploy-verify`：PASS
+- `node scripts/qa/check-trellis-governance.mjs`：PASS
+- `git diff --check`：PASS
+
+## 部署结果
+
+- 命令：`SYNC_ENV=0 bash deploy/trialrun/deploy.sh`
+- 结果：PASS
+- `.env`：安全模式跳过同步，未覆盖远端 `.env`
+- migration：无待执行 migration
+- 部署脚本自带检查：契约校验、`/ready`、external deps smoke、runtime smoke、公网前端资源文案扫描均完成
+- 非阻断提示：同步阶段提示一个历史 `artifacts/qa-flow` 目录未删除；脚本继续并最终部署成功
+
+## 部署后验证
+
+- live smoke / OCR readiness：PASS；live smoke 与真实 OCR 因缺少完整凭据或 PDF 样票 SKIP
+  - 报告：`.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/summary.json`
+- OA 权限矩阵：`PASS_WITH_FINDINGS`；7 个角色因缺少本地 live 凭据 SKIP，无权限断言失败
+  - 报告：`.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-permission-matrix/summary.json`
+  - 摘要：`.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-permission-matrix/summary.md`
+- OAFRONT3 PC 只读视觉矩阵：PASS
+  - 报告：`artifacts/qa-flow/oafront3-pc-readonly-visual-20260529-150000/summary.json`
+- 移动入口矩阵：PASS，6 个用例通过
+- 企业微信移动渲染矩阵：PASS，8 个用例通过
+- Portal 审计日志入口聚焦用例：PASS
+- 公网 bundle 补充核验：PASS
+  - Portal chunk 包含 `/audit-logs`
+  - 报销详情 chunk 不含旧硬编码日期 `2026-02-08`
+  - 报销详情 chunk 含今天日期表达式
+  - 报销详情 chunk 不含重复状态字样
+- 最终 `node scripts/qa/check-trellis-governance.mjs`：PASS
+- 最终 `git diff --check`：PASS
+
+## 后续建议
+
+- 若要把权限矩阵从 `PASS_WITH_FINDINGS` 提升为完全 PASS，需要在本地配置脱敏 live 角色凭据后重跑矩阵。
+- 若要覆盖真实 OCR，需要提供受控 PDF 样票或样票目录后重跑 readiness。