落实公司资料与 OA 运营映射规则（05-28-company-docs-oa-ops-mapping）

.trellis/spec/hyb-oa/security-privacy.md

@@ -107,3 +107,51 @@ if (requiresDownloadReason(attachment) && !reason) {
 await prisma.auditLog.create({ data: buildDownloadAudit({ attachment, reason }) });
 return reply.send(stream);
 ```
+
+## Scenario: Company Documents And OA Collaboration
+
+### 1. Scope / Trigger
+
+- Trigger: mapping company electronic documents, policy files, operations
+  guidance, employee collaboration tasks or external-review materials into OA.
+- Applies to docs, specs, evidence, tasks, OA attachments, Enterprise WeChat
+  messages, AI/Codex-assisted processing and storage decisions.
+
+### 2. Contracts
+
+- OA is the operations control layer, not the full original-document library.
+- The controlled company document master keeps full originals, historical
+  packages and high-sensitivity materials.
+- OA may store indexes, business object links, status, responsibility, hash or
+  checksum summaries, archive-location summaries, review results and audit
+  evidence.
+- Necessary business originals may enter OA only through scoped business
+  attachment flows such as contract, reimbursement, purchase, payment, project
+  or policy workflows.
+- Employee collaboration, external review, generated reports, Enterprise
+  WeChat messages and AI/Codex work use redacted copies, aliases or summaries.
+- Do not build or describe a generic file center unless a Trellis task
+  explicitly reopens that architecture and defines permissions, audit, storage,
+  backup and retention rules.
+
+### 3. Storage Decision Defaults
+
+- Current V0 may keep authorized business attachments on the deployment
+  server, but it must not become a shared drive or full document mirror.
+- If storage is insufficient, prefer index-only records plus controlled offline
+  retrieval before moving high-sensitivity originals online.
+- Cloud object storage or controlled NAS/MinIO must be private, accessed by the
+  OA service account, and governed by OA permissions and download audit.
+- A home NAS can be cold archive, secondary backup or low-risk S3-compatible
+  trial storage; it is not the default production attachment store unless VPN,
+  private bucket, UPS, alerts and restore drills are in place.
+
+### 4. Forbidden Content
+
+- Full local paths to confidential directories.
+- Passwords, token, Secret, private keys, source packages and complete
+  configuration files.
+- ID-card, bank-card, payroll, social-security, tax and full bank-statement
+  originals in normal OA attachment areas.
+- Customer original material, sensitive quotes, contract bodies or signed
+  packages outside authorized business flows.