diff --git a/.trellis/tasks/05-27-invoice-verification-api-poc/check.jsonl b/.trellis/tasks/05-27-invoice-verification-api-poc/check.jsonl
new file mode 100644
index 00000000..1470ecc6
--- /dev/null
+++ b/.trellis/tasks/05-27-invoice-verification-api-poc/check.jsonl
@@ -0,0 +1,3 @@
+{"file": ".trellis/spec/hyb-oa/reimbursement-invoice-ocr.md", "reason": "Validate invoice verification remains compatible with current OCR and duplicate rules"}
+{"file": ".trellis/spec/hyb-oa/docs-and-evidence.md", "reason": "Validate vendor research and POC evidence handling"}
+{"file": ".trellis/spec/hyb-oa/security-privacy.md", "reason": "Validate no invoice originals, credentials or sensitive fields are persisted"}
diff --git a/.trellis/tasks/05-27-invoice-verification-api-poc/implement.jsonl b/.trellis/tasks/05-27-invoice-verification-api-poc/implement.jsonl
new file mode 100644
index 00000000..b2335512
--- /dev/null
+++ b/.trellis/tasks/05-27-invoice-verification-api-poc/implement.jsonl
@@ -0,0 +1,5 @@
+{"file": ".trellis/spec/hyb-oa/project-governance.md", "reason": "Approval boundaries for paid API POC and vendor selection"}
+{"file": ".trellis/spec/hyb-oa/reimbursement-invoice-ocr.md", "reason": "Invoice OCR, duplicate check and verification flow boundaries"}
+{"file": ".trellis/spec/hyb-oa/backend-fastify-prisma.md", "reason": "Backend integration boundaries if a POC is later implemented"}
+{"file": ".trellis/spec/hyb-oa/docs-and-evidence.md", "reason": "Vendor research and sample evidence handling"}
+{"file": ".trellis/spec/hyb-oa/security-privacy.md", "reason": "Invoice sample and credential privacy requirements"}
diff --git a/.trellis/tasks/05-27-invoice-verification-api-poc/implement.md b/.trellis/tasks/05-27-invoice-verification-api-poc/implement.md
new file mode 100644
index 00000000..4324de8f
--- /dev/null
+++ b/.trellis/tasks/05-27-invoice-verification-api-poc/implement.md
@@ -0,0 +1,18 @@
+# 实施策略
+
+## Planning 口径
+
+本子任务先保持 planning。总任务完成后，再启动发票验真 API POC。
+
+## 后续执行方式
+
+1. 研究官方查验边界和主流 API 供应商能力。
+2. 对比腾讯云、华为云、百度、百望/诺诺类平台的价格、能力、集成成本和采购风险。
+3. 设计最小 POC，优先使用授权样票和脱敏证据。
+4. 输出接入建议、降级策略、费用控制和审计记录方案。
+
+## 边界
+
+- 不采购、充值或开通生产付费能力。
+- 不上传未经授权的真实发票。
+- 不保存真实票面、税号、银行账号、二维码或完整敏感字段。
diff --git a/.trellis/tasks/05-27-invoice-verification-api-poc/prd.md b/.trellis/tasks/05-27-invoice-verification-api-poc/prd.md
new file mode 100644
index 00000000..e481eb27
--- /dev/null
+++ b/.trellis/tasks/05-27-invoice-verification-api-poc/prd.md
@@ -0,0 +1,46 @@
+# 发票验真 API POC 与采购决策
+
+## Goal
+
+评估并验证适合 hyb-oa 的发票验真 API，形成成本、能力、集成复杂度、合规边界和采购建议。先做 POC 与决策，不直接接入生产主链路。
+
+## Scope
+
+- 候选：腾讯云、华为云、百度智能云、百望/诺诺类财税平台。
+- 对比维度：单次价格、免费额度、发票类型、验真字段、失败原因、限流、签名鉴权、SDK/HTTP 接入、账期和采购便利性。
+- 与当前 PDF OCR、发票查重、财务人工复核流程衔接。
+
+## Requirements
+
+- 研究国家税务总局官方查验边界，确认不得依赖爬官方查验平台作为生产能力。
+- 建立候选 API 对比表。
+- 选 1-2 个候选做最小 POC 方案设计，优先考虑现有 OCR provider 复用和采购成本。
+- 给出是否接入、何时接入、如何降级、如何记录审计和如何收费控制的建议。
+
+## Acceptance Criteria
+
+- [ ] 输出发票验真 API 对比矩阵。
+- [ ] 输出推荐供应商和备选供应商。
+- [ ] 输出 POC 流程、样票授权边界、测试命令和验收标准。
+- [ ] 明确发票验真失败、超限、欠费、API 不可用时的业务降级策略。
+
+## Out of Scope
+
+- 不直接采购、充值或开通付费生产能力。
+- 不上传未经授权的真实发票样票。
+- 不保存真实票面、税号、银行账号、二维码或完整发票敏感字段。
+- 不替代财务人工复核；首批仍以 OCR、查重和人工复核为主。
+
+## Test Plan
+
+```bash
+python3 ./.trellis/scripts/task.py validate 05-27-invoice-verification-api-poc
+node scripts/qa/check-trellis-governance.mjs
+git diff --check
+```
+
+## Technical Notes
+
+- Reimbursement rules: `docs/报销发票附件规则.md`
+- Invoice/OCR spec: `.trellis/spec/hyb-oa/reimbursement-invoice-ocr.md`
+- Security/privacy spec: `.trellis/spec/hyb-oa/security-privacy.md`
diff --git a/.trellis/tasks/05-27-invoice-verification-api-poc/task.json b/.trellis/tasks/05-27-invoice-verification-api-poc/task.json
new file mode 100644
index 00000000..6cd7f17a
--- /dev/null
+++ b/.trellis/tasks/05-27-invoice-verification-api-poc/task.json
@@ -0,0 +1,26 @@
+{
+  "id": "invoice-verification-api-poc",
+  "name": "invoice-verification-api-poc",
+  "title": "发票验真API POC与采购决策",
+  "description": "评估腾讯云、华为云、百度、百望或诺诺等发票验真API，完成POC、成本测算和接入决策。",
+  "status": "planning",
+  "dev_type": null,
+  "scope": "invoice-verification-research",
+  "package": null,
+  "priority": "P2",
+  "creator": "shunli",
+  "assignee": "shunli",
+  "createdAt": "2026-05-27",
+  "completedAt": null,
+  "branch": null,
+  "base_branch": "main",
+  "worktree_path": null,
+  "commit": null,
+  "pr_url": null,
+  "subtasks": [],
+  "children": [],
+  "parent": "05-27-oa-product-flow-test-policy-audit",
+  "relatedFiles": [],
+  "notes": "",
+  "meta": {}
+}
\ No newline at end of file
diff --git a/.trellis/tasks/05-27-oa-business-flow-policy-alignment/check.jsonl b/.trellis/tasks/05-27-oa-business-flow-policy-alignment/check.jsonl
new file mode 100644
index 00000000..7a95a66d
--- /dev/null
+++ b/.trellis/tasks/05-27-oa-business-flow-policy-alignment/check.jsonl
@@ -0,0 +1,3 @@
+{"file": ".trellis/spec/hyb-oa/approval-workflow.md", "reason": "Validate proposed flow mapping does not violate approval boundaries"}
+{"file": ".trellis/spec/hyb-oa/docs-and-evidence.md", "reason": "Validate policy mapping evidence is abstract and registered"}
+{"file": ".trellis/spec/hyb-oa/security-privacy.md", "reason": "Validate no policy source secrets, full paths or sensitive originals are stored"}
diff --git a/.trellis/tasks/05-27-oa-business-flow-policy-alignment/implement.jsonl b/.trellis/tasks/05-27-oa-business-flow-policy-alignment/implement.jsonl
new file mode 100644
index 00000000..a715ddbb
--- /dev/null
+++ b/.trellis/tasks/05-27-oa-business-flow-policy-alignment/implement.jsonl
@@ -0,0 +1,5 @@
+{"file": ".trellis/spec/hyb-oa/project-governance.md", "reason": "Governance and approval boundaries for policy mapping"}
+{"file": ".trellis/spec/hyb-oa/approval-workflow.md", "reason": "Approval rules, self-approval and workflow boundaries"}
+{"file": ".trellis/spec/hyb-oa/reimbursement-invoice-ocr.md", "reason": "Reimbursement, invoice and attachment policy mapping"}
+{"file": ".trellis/spec/hyb-oa/docs-and-evidence.md", "reason": "Company policy evidence and matrix handling"}
+{"file": ".trellis/spec/hyb-oa/security-privacy.md", "reason": "Exclude sensitive company documents and full paths from persisted records"}
diff --git a/.trellis/tasks/05-27-oa-business-flow-policy-alignment/implement.md b/.trellis/tasks/05-27-oa-business-flow-policy-alignment/implement.md
new file mode 100644
index 00000000..38c374d2
--- /dev/null
+++ b/.trellis/tasks/05-27-oa-business-flow-policy-alignment/implement.md
@@ -0,0 +1,18 @@
+# 实施策略
+
+## Planning 口径
+
+本子任务先保持 planning。总任务完成后，再启动制度映射专项审查。
+
+## 后续执行方式
+
+1. 读取可安全引用的公司制度导航和摘要材料。
+2. 抽取审批、报销付款、合同、采购、员工制度、保密、资产和账号交接规则。
+3. 映射到 OA 角色、权限、字段、附件、审批人、台账和审计证据。
+4. 标记正式启用前必须补齐的流程缺口和 30-60 天可后置事项。
+
+## 边界
+
+- 不保存公司制度敏感原文、合同正文、证照、银行资料或完整路径。
+- 不做正式法律审查。
+- 不自动改权限、审批阈值或生产配置。
diff --git a/.trellis/tasks/05-27-oa-business-flow-policy-alignment/prd.md b/.trellis/tasks/05-27-oa-business-flow-policy-alignment/prd.md
new file mode 100644
index 00000000..250e45fb
--- /dev/null
+++ b/.trellis/tasks/05-27-oa-business-flow-policy-alignment/prd.md
@@ -0,0 +1,46 @@
+# 业务流程合理性与公司制度对齐
+
+## Goal
+
+将公司制度资料抽象为 OA 可执行的角色、权限、审批阈值、字段、附件、台账、签收、培训和审计要求，审查当前 OA 业务流程是否符合小团队 V1 管理制度。
+
+## Scope
+
+- 报销、付款、AP、采购/费用、合同台账、项目、资产/账号交接、员工制度签收、保密与知识产权、印章/证照、权限和审计。
+- 公司制度资料只做规则映射，不导入敏感原文。
+- 与当前 OAOPS1 七天试运行反馈结合，但不替代每日巡检。
+
+## Requirements
+
+- 读取公司制度导航、总览和可安全引用的制度摘要，抽取 OA 相关规则。
+- 建立制度到 OA 的映射矩阵：制度条目、OA 页面/流程、字段、附件、审批人、证据、当前缺口和优先级。
+- 明确哪些制度要求是正式启用前必须具备，哪些进入后续 30-60 天迭代。
+- 对员工规章制度签收、公示、培训和版本留痕给出 OA 落地建议。
+
+## Acceptance Criteria
+
+- [ ] 输出制度映射矩阵。
+- [ ] 明确高风险制度缺口：越权审批、口头审批、付款证据、合同归档、员工制度告知/签收、资料保密和账号权限回收。
+- [ ] 不保存合同正文、证照、完整路径、账号凭据、银行资料或敏感员工资料。
+- [ ] 给出第一批 OA 流程调整建议和后置事项。
+
+## Out of Scope
+
+- 不做正式法律审查。
+- 不直接发布员工规章制度。
+- 不把制度全文上传到公网 OA。
+- 不自动改审批阈值或权限配置。
+
+## Test Plan
+
+```bash
+python3 ./.trellis/scripts/task.py validate 05-27-oa-business-flow-policy-alignment
+node scripts/qa/check-trellis-governance.mjs
+git diff --check
+```
+
+## Technical Notes
+
+- Security/privacy spec: `.trellis/spec/hyb-oa/security-privacy.md`
+- Docs/evidence spec: `.trellis/spec/hyb-oa/docs-and-evidence.md`
+- Company policy source: repository-external company materials; only abstract rule mapping may be persisted.
diff --git a/.trellis/tasks/05-27-oa-business-flow-policy-alignment/task.json b/.trellis/tasks/05-27-oa-business-flow-policy-alignment/task.json
new file mode 100644
index 00000000..08d814c8
--- /dev/null
+++ b/.trellis/tasks/05-27-oa-business-flow-policy-alignment/task.json
@@ -0,0 +1,26 @@
+{
+  "id": "oa-business-flow-policy-alignment",
+  "name": "oa-business-flow-policy-alignment",
+  "title": "业务流程合理性与公司制度对齐",
+  "description": "将公司制度资料中的审批、报销付款、合同、采购、员工制度、保密和资产账号交接规则映射到OA流程。",
+  "status": "planning",
+  "dev_type": null,
+  "scope": "business-policy-alignment",
+  "package": null,
+  "priority": "P1",
+  "creator": "shunli",
+  "assignee": "shunli",
+  "createdAt": "2026-05-27",
+  "completedAt": null,
+  "branch": null,
+  "base_branch": "main",
+  "worktree_path": null,
+  "commit": null,
+  "pr_url": null,
+  "subtasks": [],
+  "children": [],
+  "parent": "05-27-oa-product-flow-test-policy-audit",
+  "relatedFiles": [],
+  "notes": "",
+  "meta": {}
+}
\ No newline at end of file
diff --git a/.trellis/tasks/05-27-oa-frontend-layout-page-fit-review/check.jsonl b/.trellis/tasks/05-27-oa-frontend-layout-page-fit-review/check.jsonl
new file mode 100644
index 00000000..abe0b689
--- /dev/null
+++ b/.trellis/tasks/05-27-oa-frontend-layout-page-fit-review/check.jsonl
@@ -0,0 +1,3 @@
+{"file": ".trellis/spec/hyb-oa/frontend-react-vite-design.md", "reason": "Validate frontend review and later UI changes against current design authority"}
+{"file": ".trellis/spec/hyb-oa/docs-and-evidence.md", "reason": "Validate page evidence is registered and redacted"}
+{"file": ".trellis/spec/hyb-oa/security-privacy.md", "reason": "Validate no sensitive screenshots or identifiers are persisted"}
diff --git a/.trellis/tasks/05-27-oa-frontend-layout-page-fit-review/implement.jsonl b/.trellis/tasks/05-27-oa-frontend-layout-page-fit-review/implement.jsonl
new file mode 100644
index 00000000..737d5035
--- /dev/null
+++ b/.trellis/tasks/05-27-oa-frontend-layout-page-fit-review/implement.jsonl
@@ -0,0 +1,4 @@
+{"file": ".trellis/spec/hyb-oa/project-governance.md", "reason": "Trellis task and approval boundaries for frontend review"}
+{"file": ".trellis/spec/hyb-oa/frontend-react-vite-design.md", "reason": "Frontend design authority, Wave conventions and implementation constraints"}
+{"file": ".trellis/spec/hyb-oa/docs-and-evidence.md", "reason": "Page audit matrix and evidence handling"}
+{"file": ".trellis/spec/hyb-oa/security-privacy.md", "reason": "Avoid screenshots or reports containing sensitive content"}
diff --git a/.trellis/tasks/05-27-oa-frontend-layout-page-fit-review/implement.md b/.trellis/tasks/05-27-oa-frontend-layout-page-fit-review/implement.md
new file mode 100644
index 00000000..c1e0eb7a
--- /dev/null
+++ b/.trellis/tasks/05-27-oa-frontend-layout-page-fit-review/implement.md
@@ -0,0 +1,18 @@
+# 实施策略
+
+## Planning 口径
+
+本子任务先保持 planning。总任务完成后，再根据优先级启动。
+
+## 后续执行方式
+
+1. 使用 `frontend-design` 作为前端体验裁决来源。
+2. 先审查 PC 页面，再审查移动和企业微信关键页。
+3. 输出页面矩阵，标记必须改、建议改和可后置。
+4. 后续代码改造按页面波次分批执行，并分别跑 typecheck、build、Playwright 和公网检查。
+
+## 边界
+
+- 不恢复旧的重复设计规则。
+- 不把所有页面一次性重构。
+- 不用视觉优化替代业务流程和权限审查。
diff --git a/.trellis/tasks/05-27-oa-frontend-layout-page-fit-review/prd.md b/.trellis/tasks/05-27-oa-frontend-layout-page-fit-review/prd.md
new file mode 100644
index 00000000..2b171f8d
--- /dev/null
+++ b/.trellis/tasks/05-27-oa-frontend-layout-page-fit-review/prd.md
@@ -0,0 +1,46 @@
+# 前端页面布局统一与页面适用性审查
+
+## Goal
+
+使用 `frontend-design` 作为前端体验裁决来源，审查 OA 当前 PC、移动和企业微信页面的布局统一性、信息架构、操作复杂度和业务适用性，产出页面分级改造清单。
+
+## Scope
+
+- PC 优先：登录页、工作台、报销列表/详情、审批中心/详情、通知中心、财务/付款/AP/票据池、系统管理和审计页。
+- 移动/企业微信：移动首页、报销、审批、通知、我的、企业微信入口和 deeplink 回流体验。
+- 页面适用性：页面是否为目标角色解决真实任务，是否有多余文案、过多步骤、信息优先级错误或布局不统一。
+
+## Requirements
+
+- 建立页面清单和页面类型：工作台、列表、详情、审批操作、财务处理、系统管理、移动轻操作。
+- 按 `frontend-design` 判断每类页面的布局规则、信息密度、操作区位置、状态展示、空状态、筛选区和移动适配。
+- 识别“必须改”“建议改”“可后置”的页面问题。
+- 给出第一批改造建议，优先 PC 页面统一，移动/企业微信后置或作为独立批次。
+
+## Acceptance Criteria
+
+- [ ] 输出页面审查矩阵。
+- [ ] 标记每个关键页面的角色、主要任务、布局问题、视觉问题、交互问题和优先级。
+- [ ] 明确第一批要改的页面，不把所有页面混成一次大改。
+- [ ] 不直接替代业务流程审查和测试覆盖审查。
+
+## Out of Scope
+
+- 本任务 planning 阶段不直接改代码。
+- 不恢复旧的重复前端设计规则。
+- 不把企业官网视觉照搬到业务系统；只保留品牌一致性和专业感。
+
+## Test Plan
+
+```bash
+python3 ./.trellis/scripts/task.py validate 05-27-oa-frontend-layout-page-fit-review
+node scripts/qa/check-trellis-governance.mjs
+git diff --check
+```
+
+## Technical Notes
+
+- Product/design authority: `frontend-design` skill
+- Frontend spec: `.trellis/spec/hyb-oa/frontend-react-vite-design.md`
+- Product facts: `docs/产品设计规则.md`
+- Current Wave evidence: `05-26-oa-seven-day-trial-live-ops` postdeploy Wave2/Wave3/Wave4 reports.
diff --git a/.trellis/tasks/05-27-oa-frontend-layout-page-fit-review/task.json b/.trellis/tasks/05-27-oa-frontend-layout-page-fit-review/task.json
new file mode 100644
index 00000000..ca8c7460
--- /dev/null
+++ b/.trellis/tasks/05-27-oa-frontend-layout-page-fit-review/task.json
@@ -0,0 +1,26 @@
+{
+  "id": "oa-frontend-layout-page-fit-review",
+  "name": "oa-frontend-layout-page-fit-review",
+  "title": "前端页面布局统一与页面适用性审查",
+  "description": "使用frontend-design作为裁决来源，审查PC、移动、企业微信页面布局统一性和业务页面适用性。",
+  "status": "planning",
+  "dev_type": null,
+  "scope": "frontend-design-review",
+  "package": null,
+  "priority": "P1",
+  "creator": "shunli",
+  "assignee": "shunli",
+  "createdAt": "2026-05-27",
+  "completedAt": null,
+  "branch": null,
+  "base_branch": "main",
+  "worktree_path": null,
+  "commit": null,
+  "pr_url": null,
+  "subtasks": [],
+  "children": [],
+  "parent": "05-27-oa-product-flow-test-policy-audit",
+  "relatedFiles": [],
+  "notes": "",
+  "meta": {}
+}
\ No newline at end of file
diff --git a/.trellis/tasks/05-27-oa-product-flow-test-policy-audit/check.jsonl b/.trellis/tasks/05-27-oa-product-flow-test-policy-audit/check.jsonl
new file mode 100644
index 00000000..ea2ef6a9
--- /dev/null
+++ b/.trellis/tasks/05-27-oa-product-flow-test-policy-audit/check.jsonl
@@ -0,0 +1,3 @@
+{"file": ".trellis/spec/hyb-oa/project-governance.md", "reason": "Validate task hierarchy and current-task boundaries"}
+{"file": ".trellis/spec/hyb-oa/docs-and-evidence.md", "reason": "Validate evidence and matrix records do not persist sensitive content"}
+{"file": ".trellis/spec/hyb-oa/security-privacy.md", "reason": "Validate company materials and reports remain redacted"}
diff --git a/.trellis/tasks/05-27-oa-product-flow-test-policy-audit/implement.jsonl b/.trellis/tasks/05-27-oa-product-flow-test-policy-audit/implement.jsonl
new file mode 100644
index 00000000..9116d0ec
--- /dev/null
+++ b/.trellis/tasks/05-27-oa-product-flow-test-policy-audit/implement.jsonl
@@ -0,0 +1,5 @@
+{"file": ".trellis/spec/hyb-oa/project-governance.md", "reason": "Trellis task hierarchy, planning and approval boundaries"}
+{"file": ".trellis/spec/hyb-oa/docs-and-evidence.md", "reason": "Evidence, matrix and sensitive-data handling contracts"}
+{"file": ".trellis/spec/hyb-oa/frontend-react-vite-design.md", "reason": "Frontend design authority and UI governance context"}
+{"file": ".trellis/spec/hyb-oa/security-privacy.md", "reason": "Sensitive company material exclusion rules"}
+{"file": ".trellis/spec/hyb-oa/reimbursement-invoice-ocr.md", "reason": "Invoice OCR, duplicate check and future verification boundaries"}
diff --git a/.trellis/tasks/05-27-oa-product-flow-test-policy-audit/implement.md b/.trellis/tasks/05-27-oa-product-flow-test-policy-audit/implement.md
new file mode 100644
index 00000000..a7417075
--- /dev/null
+++ b/.trellis/tasks/05-27-oa-product-flow-test-policy-audit/implement.md
@@ -0,0 +1,24 @@
+# 实施策略
+
+## 总体节奏
+
+本任务先做治理审查，不直接改业务代码。执行顺序为：
+
+1. 汇总关键页面、业务流程、测试覆盖、制度映射和发票验真候选项。
+2. 形成五张矩阵：页面矩阵、流程矩阵、测试矩阵、制度矩阵、发票验真候选矩阵。
+3. 根据阻断风险、用户影响、实施成本和试运行阶段，给出子任务启动顺序。
+4. 只启动当前总任务；四个子任务保持 planning，待总审查收敛后逐个启动。
+
+## 子任务关系
+
+- `05-27-oa-frontend-layout-page-fit-review`：页面布局统一和业务页面适用性。
+- `05-27-oa-business-flow-policy-alignment`：业务流程和公司制度映射。
+- `05-27-oa-test-coverage-matrix`：前后端自动化测试覆盖矩阵。
+- `05-27-invoice-verification-api-poc`：发票验真 API POC 和采购建议。
+
+## 边界
+
+- 不导入公司敏感原文。
+- 不采购或开通付费 API。
+- 不替代 OAOPS1 七天真实试运行和 Day 7 Go/No-Go。
+- 不在没有专项任务的情况下直接做大规模前端或流程改造。
diff --git a/.trellis/tasks/05-27-oa-product-flow-test-policy-audit/prd.md b/.trellis/tasks/05-27-oa-product-flow-test-policy-audit/prd.md
new file mode 100644
index 00000000..899ae723
--- /dev/null
+++ b/.trellis/tasks/05-27-oa-product-flow-test-policy-audit/prd.md
@@ -0,0 +1,85 @@
+# OA 产品、流程、测试与制度对齐总审查
+
+## Goal
+
+建立 OA 后续治理总账，系统梳理页面布局、业务页面适用性、业务流程合理性、自动化测试覆盖、发票验真方案和公司制度资料映射。目标是先形成审查矩阵和分批路线图，再按优先级启动子任务，避免把前端、流程、测试、制度和付费 API 混在一次大改里。
+
+## What I Already Know
+
+- 用户希望同步推进 6 类工作：页面布局统一、业务页面适用性、业务流程合理性、前后端测试覆盖、发票验真 API、公司制度资料对 OA 的参考映射。
+- 当前 OA 仍处于 `05-26-oa-seven-day-trial-live-ops` 七天真实试运行主线，Day 7 Go/No-Go 之前不能宣称最终正式启用完成。
+- 前端视觉和布局裁决以 `frontend-design` skill 为准，项目旧的重复设计规则不再作为主要审美来源。
+- 公司制度资料位于仓库外公司资料区，包含制度体系建设、费用报销与付款、合同、采购、员工手册、保密/IP、资产/账号交接等材料。
+- 公司资料只能抽取规则、字段、角色、流程和证据要求，不得把合同正文、证照、真实路径、账号凭据、银行资料或敏感材料写入 OA、公网、仓库、Trellis 或聊天。
+- 当前已建立四个子任务：
+  - `05-27-oa-frontend-layout-page-fit-review`
+  - `05-27-oa-business-flow-policy-alignment`
+  - `05-27-oa-test-coverage-matrix`
+  - `05-27-invoice-verification-api-poc`
+
+## Scope
+
+- 本任务是治理总审查任务，覆盖页面、流程、测试、制度和发票验真的关系梳理。
+- 本任务负责输出矩阵、优先级和子任务启动顺序。
+- 子任务负责后续专项审查、POC 或代码改造。
+- OA 七天真实试运行任务仍独立存在；试运行阻断优先处理。
+
+## Assumptions
+
+- 本总任务先做审查、矩阵和路线图，不直接修改业务代码。
+- 子任务保持 `planning` backlog，只有总审查收敛后才逐个启动。
+- 真实试运行期间发现的阻断问题优先级高于治理型优化。
+- 发票验真属于付费 API 和合规能力选型，先 POC 和采购决策，不直接接入生产主链路。
+
+## Requirements
+
+- 建立页面审查矩阵，覆盖 PC、移动和企业微信关键页面，标记布局统一性、信息密度、操作复杂度、角色适配和待改优先级。
+- 建立业务流程审查矩阵，覆盖报销、审批、付款/AP、采购/费用、合同台账、项目、资产、通知、权限、审计和员工制度签收。
+- 建立测试覆盖矩阵，明确每条业务流程已有后端测试、前端 PC E2E、移动 E2E、企业微信 UA/真机验证和公网只读巡检覆盖情况。
+- 建立制度映射矩阵，将公司制度资料抽象为 OA 角色、权限、审批阈值、字段、附件、台账、签收、培训和审计要求。
+- 建立发票验真候选方案矩阵，至少比较腾讯云、华为云、百度、百望/诺诺类平台的成本、接口能力、集成复杂度、采购和合规风险。
+- 给出分批执行建议：哪些先做审查，哪些先做代码改造，哪些只进入后续 backlog。
+
+## Acceptance Criteria
+
+- [ ] 总审查输出页面矩阵、流程矩阵、测试覆盖矩阵、制度映射矩阵和发票验真候选矩阵。
+- [ ] 四个子任务 PRD 均有目标、范围、验收标准和边界说明。
+- [ ] 子任务状态保持 planning，除本总任务外不提前启动。
+- [ ] 总审查结论明确第一批执行任务和不做事项。
+- [ ] 不保存公司敏感原文、完整本地路径、真实账号、合同正文、证照、银行资料、密码、token、Secret 或 raw payload。
+
+## Definition of Done
+
+- 形成可执行的后续治理路线图。
+- 明确每个子任务的启动顺序、验收证据和风险边界。
+- 更新当前任务 PRD 或研究材料，不把结论留在聊天中。
+- Trellis task 校验和治理检查通过。
+
+## Out of Scope
+
+- 本总任务不直接重构前端页面。
+- 本总任务不直接修改审批、报销、付款、合同或采购流程代码。
+- 本总任务不采购或开通付费 API。
+- 本总任务不导入公司制度原文、合同正文、证照、银行资料或完整本地路径。
+- 本总任务不替代 `05-26-oa-seven-day-trial-live-ops` 的每日真实试运行巡检和 Day 7 Go/No-Go。
+
+## Test Plan
+
+```bash
+python3 ./.trellis/scripts/task.py validate 05-27-oa-product-flow-test-policy-audit
+python3 ./.trellis/scripts/task.py validate 05-27-oa-frontend-layout-page-fit-review
+python3 ./.trellis/scripts/task.py validate 05-27-oa-business-flow-policy-alignment
+python3 ./.trellis/scripts/task.py validate 05-27-oa-test-coverage-matrix
+python3 ./.trellis/scripts/task.py validate 05-27-invoice-verification-api-poc
+node scripts/qa/check-trellis-governance.mjs
+git diff --check
+```
+
+## Technical Notes
+
+- Workflow: `.trellis/workflow.md`
+- Project specs: `.trellis/spec/hyb-oa/`
+- Product/design authority: `frontend-design` skill
+- Trial ops task: `.trellis/tasks/05-26-oa-seven-day-trial-live-ops/`
+- Business docs: `docs/文档索引.md`、`docs/管理员手册.md`、`docs/试运行与自动化验证手册.md`、`docs/报销发票附件规则.md`
+- Company policy source: repository-external company materials; only abstract rule mapping may be recorded.
diff --git a/.trellis/tasks/05-27-oa-product-flow-test-policy-audit/task.json b/.trellis/tasks/05-27-oa-product-flow-test-policy-audit/task.json
new file mode 100644
index 00000000..21758d72
--- /dev/null
+++ b/.trellis/tasks/05-27-oa-product-flow-test-policy-audit/task.json
@@ -0,0 +1,31 @@
+{
+  "id": "oa-product-flow-test-policy-audit",
+  "name": "oa-product-flow-test-policy-audit",
+  "title": "OA产品流程测试与制度对齐总审查",
+  "description": "建立OA页面、业务流程、自动化测试覆盖、发票验真和公司制度映射的总审查任务，作为后续分批治理总账。",
+  "status": "in_progress",
+  "dev_type": null,
+  "scope": "product-governance",
+  "package": null,
+  "priority": "P1",
+  "creator": "shunli",
+  "assignee": "shunli",
+  "createdAt": "2026-05-27",
+  "completedAt": null,
+  "branch": null,
+  "base_branch": "main",
+  "worktree_path": null,
+  "commit": null,
+  "pr_url": null,
+  "subtasks": [],
+  "children": [
+    "05-27-oa-frontend-layout-page-fit-review",
+    "05-27-oa-business-flow-policy-alignment",
+    "05-27-oa-test-coverage-matrix",
+    "05-27-invoice-verification-api-poc"
+  ],
+  "parent": null,
+  "relatedFiles": [],
+  "notes": "",
+  "meta": {}
+}
\ No newline at end of file
diff --git a/.trellis/tasks/05-27-oa-test-coverage-matrix/check.jsonl b/.trellis/tasks/05-27-oa-test-coverage-matrix/check.jsonl
new file mode 100644
index 00000000..e215bc6a
--- /dev/null
+++ b/.trellis/tasks/05-27-oa-test-coverage-matrix/check.jsonl
@@ -0,0 +1,3 @@
+{"file": ".trellis/spec/hyb-oa/docs-and-evidence.md", "reason": "Validate test matrix and generated reports follow evidence contracts"}
+{"file": ".trellis/spec/hyb-oa/deployment-trialrun.md", "reason": "Validate public smoke and live-readiness claims"}
+{"file": ".trellis/spec/hyb-oa/security-privacy.md", "reason": "Validate automated test evidence is redacted"}
diff --git a/.trellis/tasks/05-27-oa-test-coverage-matrix/implement.jsonl b/.trellis/tasks/05-27-oa-test-coverage-matrix/implement.jsonl
new file mode 100644
index 00000000..dd3c2b24
--- /dev/null
+++ b/.trellis/tasks/05-27-oa-test-coverage-matrix/implement.jsonl
@@ -0,0 +1,5 @@
+{"file": ".trellis/spec/hyb-oa/project-governance.md", "reason": "Trellis task and phased implementation boundaries"}
+{"file": ".trellis/spec/hyb-oa/docs-and-evidence.md", "reason": "Test evidence, reportRef and finding aggregation contracts"}
+{"file": ".trellis/spec/hyb-oa/deployment-trialrun.md", "reason": "Public OA smoke, live readiness and deployment verification boundaries"}
+{"file": ".trellis/spec/hyb-oa/security-privacy.md", "reason": "Test reports must not persist secrets or sensitive business data"}
+{"file": ".trellis/spec/hyb-oa/frontend-react-vite-design.md", "reason": "Frontend visual and interaction test expectations"}
diff --git a/.trellis/tasks/05-27-oa-test-coverage-matrix/implement.md b/.trellis/tasks/05-27-oa-test-coverage-matrix/implement.md
new file mode 100644
index 00000000..2e9f2074
--- /dev/null
+++ b/.trellis/tasks/05-27-oa-test-coverage-matrix/implement.md
@@ -0,0 +1,18 @@
+# 实施策略
+
+## Planning 口径
+
+本子任务先保持 planning。总任务完成后，再启动测试覆盖专项。
+
+## 后续执行方式
+
+1. 列出规划业务流程和关键异常场景。
+2. 逐项盘点后端、PC、移动、企业微信 UA/真机和公网只读巡检覆盖。
+3. 标记缺口等级：阻断、重要、体验、低频管理。
+4. 分批补齐测试，优先权限、状态机、核心提交/审批/付款闭环。
+
+## 边界
+
+- 不自动创建真实业务数据。
+- 不执行真实付款、ERP 写入、企业微信写入或数据库重置。
+- 不把只读巡检误写成完整业务写入测试通过。
diff --git a/.trellis/tasks/05-27-oa-test-coverage-matrix/prd.md b/.trellis/tasks/05-27-oa-test-coverage-matrix/prd.md
new file mode 100644
index 00000000..2d21a0f8
--- /dev/null
+++ b/.trellis/tasks/05-27-oa-test-coverage-matrix/prd.md
@@ -0,0 +1,48 @@
+# 业务流程自动化测试覆盖矩阵与补齐
+
+## Goal
+
+盘点 OA 规划业务流程是否已经被后端和前端自动化测试覆盖，形成“业务流程 -> 后端测试 -> PC E2E -> 移动 E2E -> 企业微信 UA/真机 -> 公网只读巡检”的覆盖矩阵，并分批补齐缺口。
+
+## Scope
+
+- 报销/PDF OCR/查重/审批/驳回/撤回/归档。
+- 审批中心、通知、企业微信 deeplink、权限和自审阻断。
+- 财务付款批次、线下付款、银行回单、已付款、AP 导出。
+- 采购/费用、合同台账、项目、资产、系统管理、审计日志。
+- 后端 API/服务/权限/状态机测试和前端 PC/移动/企业微信 E2E 均纳入。
+
+## Requirements
+
+- 建立业务流程清单和自动化测试覆盖矩阵。
+- 标记已覆盖、部分覆盖、仅只读覆盖、缺测试、需要人工真机验证的流程。
+- 区分阻断级测试缺口和体验型测试缺口。
+- 给出补齐顺序，先补核心业务闭环和权限/状态机，再补页面视觉和低频管理页。
+
+## Acceptance Criteria
+
+- [ ] 输出测试覆盖矩阵。
+- [ ] 明确每条业务流程是否有后端和前端覆盖。
+- [ ] 明确公网试运行只读巡检不能替代真实业务写入流程测试。
+- [ ] 给出第一批要补的测试清单和命令。
+
+## Out of Scope
+
+- 本 planning 任务不直接新增测试代码。
+- 不自动创建真实业务数据。
+- 不执行真实付款、ERP 写入、企业微信写入或数据库重置。
+
+## Test Plan
+
+```bash
+python3 ./.trellis/scripts/task.py validate 05-27-oa-test-coverage-matrix
+node scripts/qa/check-trellis-governance.mjs
+git diff --check
+```
+
+## Technical Notes
+
+- Trial runbook: `docs/试运行与自动化验证手册.md`
+- Testing facts: `docs/测试规约与回归门禁.md`
+- Daily runner: `scripts/qa/run-oa-real-use-daily.sh`
+- Final readiness runner: `scripts/qa/run-oa-final-launch-readiness.sh`
diff --git a/.trellis/tasks/05-27-oa-test-coverage-matrix/task.json b/.trellis/tasks/05-27-oa-test-coverage-matrix/task.json
new file mode 100644
index 00000000..0928f291
--- /dev/null
+++ b/.trellis/tasks/05-27-oa-test-coverage-matrix/task.json
@@ -0,0 +1,26 @@
+{
+  "id": "oa-test-coverage-matrix",
+  "name": "oa-test-coverage-matrix",
+  "title": "业务流程自动化测试覆盖矩阵与补齐",
+  "description": "盘点并补齐OA规划业务流程的后端、前端PC、移动和企业微信自动化测试覆盖。",
+  "status": "planning",
+  "dev_type": null,
+  "scope": "qa-coverage-governance",
+  "package": null,
+  "priority": "P1",
+  "creator": "shunli",
+  "assignee": "shunli",
+  "createdAt": "2026-05-27",
+  "completedAt": null,
+  "branch": null,
+  "base_branch": "main",
+  "worktree_path": null,
+  "commit": null,
+  "pr_url": null,
+  "subtasks": [],
+  "children": [],
+  "parent": "05-27-oa-product-flow-test-policy-audit",
+  "relatedFiles": [],
+  "notes": "",
+  "meta": {}
+}
\ No newline at end of file