docs: 记录前端降噪审计修复部署复检（frontend-audit-fixes-deploy-verify）

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/check.jsonl

@@ -0,0 +1,4 @@
+{"file": ".trellis/spec/hyb-oa/deployment-trialrun.md", "reason": "核对部署命令、远端 env 边界和公网验证要求。"}
+{"file": ".trellis/spec/hyb-oa/security-privacy.md", "reason": "核对部署证据和验证报告不得泄露敏感信息。"}
+{"file": ".trellis/spec/hyb-oa/docs-and-evidence.md", "reason": "核对证据记录、任务归档和文档边界。"}
+{"file": ".trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/deploy-context.md", "reason": "核对本任务部署上下文和输出计划。"}

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/implement.jsonl

@@ -0,0 +1,4 @@
+{"file": ".trellis/spec/hyb-oa/deployment-trialrun.md", "reason": "公网试运行部署、安全模式、env contract 和部署后检查规则。"}
+{"file": ".trellis/spec/hyb-oa/frontend-react-vite-design.md", "reason": "前端改动部署前验证和 A 类页面口径。"}
+{"file": ".trellis/spec/hyb-oa/project-governance.md", "reason": "Trellis task、审批、提交和单人开发治理规则。"}
+{"file": ".trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/deploy-context.md", "reason": "本任务部署边界和证据输出计划。"}

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/implement.md

@@ -0,0 +1,19 @@
+# 实施说明
+
+## Plan
+
+1. 补齐部署复检任务合同和上下文。
+2. 部署前复跑本地前端、部署契约和 Trellis 门禁。
+3. 在用户明确批准后，以 `SYNC_ENV=0 bash deploy/trialrun/deploy.sh` 部署公网试运行环境。
+4. 部署后执行 live readiness、权限矩阵、PC 只读视觉、移动入口和企业微信渲染只读验证。
+5. 将验证结论、报告相对路径和最终 Go/No-Go 写回当前任务。
+
+## Risk
+
+- 公网 OA 是准生产环境；部署必须得到用户明确批准。
+- 本任务不写真实业务数据，不执行真实付款，不覆盖远端 `.env`。
+- 如果部署后只读验证失败，结论写 `BLOCKED_POSTDEPLOY_VERIFICATION`，不告知用户可以测试。
+
+## Rollback
+
+- 若部署后出现阻断回归，按部署脚本和试运行手册回滚到上一个已验证 commit；回滚同样需要记录 commit、命令和公网检查结论。

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/prd.md

@@ -0,0 +1,123 @@
+# 前端降噪审计修复部署复检
+
+## Goal
+
+将已完成并提交的前端降噪审计修复部署到公网试运行环境，并完成必要的公网只读复检，确认工作台审计日志入口、报销支付日期默认值和报销详情状态文案修复已经进入试运行版本，且没有引入登录、权限、PC 只读视觉、移动入口或企业微信渲染回归。
+
+本任务只做已提交修复的部署和只读验证；不扩大页面重构范围，不写真实业务数据，不覆盖远端 `.env`。
+
+## Scope
+
+- 部署当前 `main` 中 `7b6e705` 前端审计修复到公网试运行环境。
+- 部署前复跑本地门禁，确认当前工作区和任务合同稳定。
+- 使用 `SYNC_ENV=0 bash deploy/trialrun/deploy.sh` 部署，禁止同步或覆盖远端 `.env`。
+- 部署后执行公网只读验证矩阵。
+- 在当前 Trellis task 中保存脱敏摘要和相对报告路径。
+
+## What I Already Know
+
+- 最新本地修复提交：`7b6e705 修复前端降噪审计问题（frontend-simplification-audit-fixes）`。
+- 任务归档提交：`13643e3 归档前端降噪审计修复任务（frontend-simplification-audit-fixes）`。
+- 当前 `main` 工作区干净，本地比远端 ahead 11。
+- 前端审计修复本地验证已通过：
+  - `cd client && npm run typecheck`
+  - `cd client && npm run build`
+  - 聚焦 Playwright：`login-portal-ux.spec.ts --grep "系统摘要审计日志"`
+  - UI 设计规则、Trellis governance、`git diff --check`
+- 上一轮降噪部署复检已验证公网环境可通过 live readiness、权限矩阵、PC 只读视觉、移动入口和企微渲染矩阵。
+
+## Requirements
+
+- 部署前必须记录执行边界、验证计划和脱敏证据路径。
+- 部署前必须复跑最小本地门禁：
+  - `cd client && npm run typecheck`
+  - `cd client && npm run build`
+  - `node scripts/qa/check-ui-design-rules.mjs`
+  - `node deploy/trialrun/validate-env-contract.js`
+  - `python3 ./.trellis/scripts/task.py validate 05-29-frontend-audit-fixes-deploy-verify`
+  - `node scripts/qa/check-trellis-governance.mjs`
+  - `git diff --check`
+- 公网部署必须使用安全模式：
+  - `SYNC_ENV=0 bash deploy/trialrun/deploy.sh`
+  - 不覆盖远端 `.env`
+  - 不做数据库重置、恢复或手工迁移
+- 部署后必须执行公网只读验证：
+  - `/ready` 和部署脚本自带 smoke 结论
+  - live smoke / OCR readiness
+  - OA 权限矩阵
+  - OAFRONT3 PC 只读视觉矩阵
+  - 移动入口矩阵和企业微信渲染矩阵
+- 验证报告只登记相对路径、状态和脱敏摘要；不得写入密码、token、完整账号、完整本地路径、真实票据或 raw payload。
+
+## Acceptance Criteria
+
+- [x] 用户明确批准执行公网部署。
+- [x] Trellis task 材料完整并通过 validate/governance。
+- [x] 部署前本地门禁通过。
+- [x] `SYNC_ENV=0 bash deploy/trialrun/deploy.sh` 完成远端服务重建，未覆盖远端 `.env`。
+- [x] 部署后公网 `/ready` 通过。
+- [x] live smoke / OCR readiness 通过或有可解释 SKIP/PASS_WITH_FINDINGS。
+- [x] 权限矩阵返回 `PASS_WITH_FINDINGS`：缺少本地角色凭据导致 7 个角色 SKIP，无权限断言失败。
+- [x] PC 只读视觉矩阵无 P1 blocker。
+- [x] 移动入口和企业微信渲染矩阵通过。
+- [x] 当前任务记录公网验证摘要和报告相对路径。
+
+## Test Plan
+
+部署前：
+
+```bash
+cd client && npm run typecheck
+cd client && npm run build
+node scripts/qa/check-ui-design-rules.mjs
+node deploy/trialrun/validate-env-contract.js
+python3 ./.trellis/scripts/task.py validate 05-29-frontend-audit-fixes-deploy-verify
+node scripts/qa/check-trellis-governance.mjs
+git diff --check
+```
+
+部署：
+
+```bash
+SYNC_ENV=0 bash deploy/trialrun/deploy.sh
+```
+
+部署后：
+
+```bash
+LIVE_SMOKE_BASE_URL=https://oa.hyinda.com LIVE_SMOKE_READINESS_DIR=.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness bash scripts/qa/run-live-smoke-readiness.sh
+LIVE_SMOKE_BASE_URL=https://oa.hyinda.com OA_PERMISSION_MATRIX_REPORT_DIR=.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-permission-matrix node scripts/qa/check-oa-permission-matrix.mjs
+bash scripts/qa/run-oafront3-pc-readonly-visual.sh
+cd client && E2E_BASE_URL=https://oa.hyinda.com npx playwright test tests/e2e/dg7-mobile-information-dedupe.spec.ts tests/e2e/r124-mobile-entry-matrix.spec.ts --workers=1 --reporter=list
+cd client && E2E_BASE_URL=https://oa.hyinda.com npx playwright test tests/e2e/r6-wecom-mobile-rendering-hardening.spec.ts --workers=1 --reporter=list
+node scripts/qa/check-trellis-governance.mjs
+git diff --check
+```
+
+## Definition Of Done
+
+- 公网试运行环境部署到包含 `7b6e705` 修复的 commit。
+- 公网只读验证结果记录到当前任务。
+- 结论明确为 `READY_WITH_FINDINGS`。
+- 只有在部署与公网只读检查通过或可解释后，才告知用户可以测试。
+- 提交中文 commit，commit message 引用本 Trellis task。
+
+## Out Of Scope
+
+- 不继续重构其他页面。
+- 不新增截图对比页。
+- 不启动或重置真实 7 天试运行计数。
+- 不创建、提交、审批、付款任何真实业务单据。
+- 不写企业微信消息、通讯录、审批或回调数据。
+- 不改远端 `.env`、生产配置、Caddy 配置或生产数据库。
+- 不执行真实付款、银行流水导入、ERP 写入或支付接口联调。
+
+## Technical Notes
+
+- Deployment spec: `.trellis/spec/hyb-oa/deployment-trialrun.md`
+- Frontend spec: `.trellis/spec/hyb-oa/frontend-react-vite-design.md`
+- Evidence spec: `.trellis/spec/hyb-oa/docs-and-evidence.md`
+- Privacy spec: `.trellis/spec/hyb-oa/security-privacy.md`
+- Governance spec: `.trellis/spec/hyb-oa/project-governance.md`
+- Trial run runbook: `docs/试运行与自动化验证手册.md`
+- Fix task: `.trellis/tasks/archive/2026-05/05-29-frontend-simplification-audit-fixes/`

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/deploy-context.md

@@ -0,0 +1,19 @@
+# 部署复检上下文
+
+## 已完成本地修复
+
+- `7b6e705 修复前端降噪审计问题（frontend-simplification-audit-fixes）`
+- `13643e3 归档前端降噪审计修复任务（frontend-simplification-audit-fixes）`
+
+## 部署边界
+
+- 使用 `SYNC_ENV=0 bash deploy/trialrun/deploy.sh`。
+- 不同步或覆盖远端 `.env`。
+- 不写真实业务数据、不写企业微信、不执行真实付款。
+- 验证报告只记录脱敏状态、摘要和相对路径。
+
+## 计划输出
+
+- `research/postdeploy-live-smoke-readiness/summary.json`
+- `research/postdeploy-permission-matrix/summary.json`
+- `research/postdeploy-summary.md`

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/env.json

@@ -0,0 +1,51 @@
+{
+  "checkedAt": "2026-05-29T06:59:42.434Z",
+  "baseUrl": "https://oa.hyinda.com",
+  "liveSmokeReady": false,
+  "liveSmoke": {
+    "adminCredentialReady": false,
+    "employeeCredentialReady": false
+  },
+  "liveSmokeOptional": {
+    "expectedWecomStatusReady": false,
+    "managerCredentialReady": false,
+    "financeCredentialReady": false
+  },
+  "liveOcrReady": false,
+  "liveOcr": {
+    "userReady": false,
+    "invoiceSampleReady": false,
+    "invoiceFileProvided": false,
+    "invoiceFileReady": false,
+    "invoiceBatchDirProvided": false,
+    "invoiceBatchDirReady": false,
+    "allowDuplicate": false
+  },
+  "missing": [
+    "adminCredentialReady",
+    "employeeCredentialReady",
+    "ocrOrEmployeeCredentialReady",
+    "PLAYWRIGHT_OCR_LIVE_FILE 或 PLAYWRIGHT_OCR_LIVE_DIR 中的 PDF 样票"
+  ],
+  "publicReady": {
+    "ok": true,
+    "status": 200
+  },
+  "wecomConfig": {
+    "ok": true,
+    "status": 200,
+    "statusText": "ready",
+    "entryEnabled": true,
+    "oauthEnabled": true,
+    "defaultReturnTo": "/mobile",
+    "loginUrl": "/api/auth/wecom/login?returnTo=%2Fmobile"
+  },
+  "authCapabilities": {
+    "ok": true,
+    "status": 200,
+    "emailDeliveryReady": true,
+    "emailDeliveryReasons": [],
+    "emailLoginCodeEnabled": true,
+    "passwordResetEnabled": true
+  }
+}

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/live-ocr.txt

@@ -0,0 +1 @@
+>>> [live-readiness] SKIP 真实 OCR：缺少 smoke 员工凭据或 PLAYWRIGHT_OCR_LIVE_FILE/PLAYWRIGHT_OCR_LIVE_DIR

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/live-smoke.txt

@@ -0,0 +1 @@
+>>> [live-readiness] SKIP live smoke：缺少完整 LIVE_SMOKE_* 凭据

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/pending-ocr.txt

@@ -0,0 +1 @@
+[pending-ocr][SKIP] missing DATABASE_URL

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/public-bundle-copy.txt

@@ -0,0 +1 @@
+[public-bundle-copy] base=https://oa.hyinda.com scanned=91 focused=2 findings=0

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/summary.json

@@ -0,0 +1,12 @@
+{
+  "issueId": null,
+  "baseURL": "https://oa.hyinda.com",
+  "commit": "13643e3",
+  "checkedAt": "2026-05-29T06:59:47.423Z",
+  "status": "PASS",
+  "mode": "live-smoke-readiness",
+  "reportDir": ".trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness",
+  "reportRef": ".trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness",
+  "groups": null,
+  "notes": "公网 /ready、public bundle、pending OCR、live smoke 和真实 OCR 可用性检查；缺少凭据或样票时按脚本规则记录 SKIP。"
+}

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-permission-matrix/summary.json

@@ -0,0 +1,127 @@
+{
+  "issueId": "OANEXT2-4",
+  "status": "PASS_WITH_FINDINGS",
+  "checkedAt": "2026-05-29T06:59:54.262Z",
+  "baseUrl": "https://oa.hyinda.com",
+  "privacy": "redacted role/status/count evidence only; no password, token, Secret, full account, invoice, contract, attachment, or raw payload",
+  "counts": {
+    "roles": 7,
+    "positiveProbes": 0,
+    "negativeProbes": 0
+  },
+  "issues": [],
+  "results": [
+    {
+      "key": "employee",
+      "expectedRoles": [
+        "employee"
+      ],
+      "maskedIdentifier": null,
+      "login": {
+        "status": "SKIP",
+        "reason": "missing_credentials",
+        "code": null
+      },
+      "roleMatch": "SKIP",
+      "actualRoles": [],
+      "probes": []
+    },
+    {
+      "key": "manager",
+      "expectedRoles": [
+        "manager",
+        "employee"
+      ],
+      "maskedIdentifier": null,
+      "login": {
+        "status": "SKIP",
+        "reason": "missing_credentials",
+        "code": null
+      },
+      "roleMatch": "SKIP",
+      "actualRoles": [],
+      "probes": []
+    },
+    {
+      "key": "finance",
+      "expectedRoles": [
+        "finance",
+        "employee"
+      ],
+      "maskedIdentifier": null,
+      "login": {
+        "status": "SKIP",
+        "reason": "missing_credentials",
+        "code": null
+      },
+      "roleMatch": "SKIP",
+      "actualRoles": [],
+      "probes": []
+    },
+    {
+      "key": "finance_mgr",
+      "expectedRoles": [
+        "finance",
+        "finance_mgr",
+        "employee"
+      ],
+      "maskedIdentifier": null,
+      "login": {
+        "status": "SKIP",
+        "reason": "missing_credentials",
+        "code": null
+      },
+      "roleMatch": "SKIP",
+      "actualRoles": [],
+      "probes": []
+    },
+    {
+      "key": "hr",
+      "expectedRoles": [
+        "hr",
+        "employee"
+      ],
+      "maskedIdentifier": null,
+      "login": {
+        "status": "SKIP",
+        "reason": "missing_credentials",
+        "code": null
+      },
+      "roleMatch": "SKIP",
+      "actualRoles": [],
+      "probes": []
+    },
+    {
+      "key": "ceo",
+      "expectedRoles": [
+        "ceo",
+        "employee"
+      ],
+      "maskedIdentifier": null,
+      "login": {
+        "status": "SKIP",
+        "reason": "missing_credentials",
+        "code": null
+      },
+      "roleMatch": "SKIP",
+      "actualRoles": [],
+      "probes": []
+    },
+    {
+      "key": "admin",
+      "expectedRoles": [
+        "admin",
+        "employee"
+      ],
+      "maskedIdentifier": null,
+      "login": {
+        "status": "SKIP",
+        "reason": "missing_credentials",
+        "code": null
+      },
+      "roleMatch": "SKIP",
+      "actualRoles": [],
+      "probes": []
+    }
+  ]
+}

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-permission-matrix/summary.md

@@ -0,0 +1,28 @@
+# OA 权限矩阵脱敏自动验证报告
+
+生成时间：2026-05-29T06:59:54.262Z
+结论：PASS_WITH_FINDINGS
+
+## 统计
+
+- 角色数：7
+- 正向探针：0
+- 负向探针：0
+- 问题数：0
+
+## 角色结果
+
+| 角色 | 登录 | 角色匹配 | 探针通过/总数 |
+| --- | --- | --- | ---: |
+| employee | SKIP | SKIP | 0/0 |
+| manager | SKIP | SKIP | 0/0 |
+| finance | SKIP | SKIP | 0/0 |
+| finance_mgr | SKIP | SKIP | 0/0 |
+| hr | SKIP | SKIP | 0/0 |
+| ceo | SKIP | SKIP | 0/0 |
+| admin | SKIP | SKIP | 0/0 |
+
+## 说明
+
+- 本报告只输出角色、HTTP 状态、脱敏账号和摘要计数，不输出密码、token、Secret、完整账号、合同正文、票据内容或原始 payload。
+- 409 表示功能门禁关闭且未泄露数据；对财务/AP/付款等冻结或受控功能可作为可解释拒绝。

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-summary.md

@@ -0,0 +1,53 @@
+# 前端降噪审计修复部署复检摘要
+
+## 结论
+
+`READY_WITH_FINDINGS`
+
+公网试运行环境已部署到本地 `main` 当前提交 `13643e3`，该提交包含前端审计修复提交 `7b6e705`。本次部署使用 `SYNC_ENV=0 bash deploy/trialrun/deploy.sh`，未同步或覆盖远端 `.env`。
+
+权限矩阵结论为 `PASS_WITH_FINDINGS`，finding 为本地缺少 7 个角色的 live 凭据，角色登录与探针均按脚本规则 SKIP；报告未记录权限断言失败。live smoke 和真实 OCR 也因缺少完整凭据或 PDF 样票按脚本规则 SKIP。其余本地门禁、部署脚本、公网 `/ready`、资源文案扫描、PC 只读视觉、移动入口矩阵、企业微信渲染矩阵和聚焦审计入口用例均通过。
+
+## 部署前门禁
+
+- `cd client && npm run typecheck`：PASS
+- `cd client && npm run build`：PASS
+- `node scripts/qa/check-ui-design-rules.mjs`：PASS
+- `node deploy/trialrun/validate-env-contract.js`：PASS
+- `python3 ./.trellis/scripts/task.py validate 05-29-frontend-audit-fixes-deploy-verify`：PASS
+- `node scripts/qa/check-trellis-governance.mjs`：PASS
+- `git diff --check`：PASS
+
+## 部署结果
+
+- 命令：`SYNC_ENV=0 bash deploy/trialrun/deploy.sh`
+- 结果：PASS
+- `.env`：安全模式跳过同步，未覆盖远端 `.env`
+- migration：无待执行 migration
+- 部署脚本自带检查：契约校验、`/ready`、external deps smoke、runtime smoke、公网前端资源文案扫描均完成
+- 非阻断提示：同步阶段提示一个历史 `artifacts/qa-flow` 目录未删除；脚本继续并最终部署成功
+
+## 部署后验证
+
+- live smoke / OCR readiness：PASS；live smoke 与真实 OCR 因缺少完整凭据或 PDF 样票 SKIP
+  - 报告：`.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-live-smoke-readiness/summary.json`
+- OA 权限矩阵：`PASS_WITH_FINDINGS`；7 个角色因缺少本地 live 凭据 SKIP，无权限断言失败
+  - 报告：`.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-permission-matrix/summary.json`
+  - 摘要：`.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/research/postdeploy-permission-matrix/summary.md`
+- OAFRONT3 PC 只读视觉矩阵：PASS
+  - 报告：`artifacts/qa-flow/oafront3-pc-readonly-visual-20260529-150000/summary.json`
+- 移动入口矩阵：PASS，6 个用例通过
+- 企业微信移动渲染矩阵：PASS，8 个用例通过
+- Portal 审计日志入口聚焦用例：PASS
+- 公网 bundle 补充核验：PASS
+  - Portal chunk 包含 `/audit-logs`
+  - 报销详情 chunk 不含旧硬编码日期 `2026-02-08`
+  - 报销详情 chunk 含今天日期表达式
+  - 报销详情 chunk 不含重复状态字样
+- 最终 `node scripts/qa/check-trellis-governance.mjs`：PASS
+- 最终 `git diff --check`：PASS
+
+## 后续建议
+
+- 若要把权限矩阵从 `PASS_WITH_FINDINGS` 提升为完全 PASS，需要在本地配置脱敏 live 角色凭据后重跑矩阵。
+- 若要覆盖真实 OCR，需要提供受控 PDF 样票或样票目录后重跑 readiness。

.trellis/tasks/05-29-frontend-audit-fixes-deploy-verify/task.json

@@ -0,0 +1,32 @@
+{
+  "id": "frontend-audit-fixes-deploy-verify",
+  "name": "frontend-audit-fixes-deploy-verify",
+  "title": "前端降噪审计修复部署复检",
+  "description": "将前端降噪审计修复部署到公网试运行环境，并完成部署后只读复检。",
+  "status": "in_progress",
+  "dev_type": null,
+  "scope": "deployment",
+  "package": null,
+  "priority": "P2",
+  "creator": "shunli",
+  "assignee": "shunli",
+  "createdAt": "2026-05-29",
+  "completedAt": null,
+  "branch": null,
+  "base_branch": "main",
+  "worktree_path": null,
+  "commit": null,
+  "pr_url": null,
+  "subtasks": [],
+  "children": [],
+  "parent": null,
+  "relatedFiles": [
+    ".trellis/tasks/archive/2026-05/05-29-frontend-simplification-audit-fixes/",
+    "deploy/trialrun/deploy.sh",
+    "scripts/qa/run-live-smoke-readiness.sh",
+    "scripts/qa/check-oa-permission-matrix.mjs",
+    "scripts/qa/run-oafront3-pc-readonly-visual.sh"
+  ],
+  "notes": "",
+  "meta": {}
+}