hyb-oa-delivery-trellis-only 移除项目交付 Skill 并统一 Trellis-only 治理

.agents/skills/hyb-oa-delivery/agents/openai.yaml

@@ -1,4 +0,0 @@
-interface:
-  display_name: "hyb-oa交付"
-  short_description: "按hyb-oa自然语言派工、Issue合同和试运行规则推进交付"
-  default_prompt: "继续推进hyb-oa需求，先自动拆解自然语言输入，读取Issue CSV和项目事实源，尽量用自动化与视觉验证。"

.agents/skills/hyb-oa-delivery/references/reimbursement.md

@@ -1,35 +0,0 @@
-# Reimbursement Reference
-
-Primary fact source: `docs/报销发票附件规则.md`.
-
-## Checks Before Editing
-
-- PC and mobile must have the same business capability.
-- Ordinary users should see "添加发票", not "绑定整单", "不绑定明细", "发票池", or "ERP 同步".
-- Invoice constraints belong on the server; frontend restrictions are only convenience.
-- Attachments are supporting materials and must not enter invoice OCR or invoice dedup.
-
-## Backend Hotspots
-
-- `server/src/routes/invoicePool.js`
-- `server/src/routes/invoicePool/read.js`
-- `server/src/jobs/ocrJob.js`
-- `server/src/services/invoiceGovernance.js`
-- `server/src/routes/reimbursements.js`
-- `server/prisma/schema.prisma`
-
-## Frontend Hotspots
-
-- `client/src/pages/ReimbursementDetailPage.tsx`
-- `client/src/pages/MobileReimbursementDetailPage.tsx`
-- `client/src/pages/InvoicePoolPage.tsx`
-- `client/src/api/invoicePool.ts`
-- `client/src/api/reimbursements.ts`
-
-## Minimum Tests
-
-- Invoice upload/dedup tests.
-- OCR job duplicate handling tests.
-- Reimbursement invoice bind/unbind tests.
-- Attachment upload/download/delete tests.
-- PC and mobile Playwright flow.

.agents/skills/hyb-oa-delivery/references/trialrun.md

@@ -1,43 +0,0 @@
-# Trial-Run Reference
-
-Primary fact source: `docs/试运行与自动化验证手册.md`.
-
-## Automatic First
-
-Use automation before asking the user to manually reproduce:
-
-- Backend unit/regression commands.
-- Frontend typecheck/build.
-- Playwright PC/mobile/WeCom UA.
-- Visual screenshots under `output/playwright/<issue-id>/`.
-
-## Manual Stop Points
-
-Ask the user to act or confirm for:
-
-- Enterprise WeChat admin console changes.
-- Phone Enterprise WeChat real login/authorization confirmation.
-- Production Caddy/domain/systemd/database changes.
-- Prisma migration drift resolution.
-
-## Common WeCom Checks
-
-- App homepage URL and callback URL.
-- Trusted domain verification file.
-- Visible range includes the user.
-- OAuth returns `UserId`.
-- Local OA account is bound to WeCom userId.
-- Cookies survive Caddy reverse proxy.
-
-## OCR Checks
-
-When upload stays in "上传中" or "识别中", inspect:
-
-1. Upload response.
-2. Invoice DB status.
-3. OCR provider mode.
-4. OCR worker/job status.
-5. Tencent credentials and network.
-6. Dedup result.
-7. Status polling endpoint.
-8. Frontend cache invalidation.

.agents/skills/hyb-oa-delivery/references/visual-qa.md

@@ -1,38 +0,0 @@
-# Visual QA Reference
-
-Primary fact source: `docs/产品设计规则.md`.
-
-## Brand Baseline
-
-Use `www.hyinda.com` as the visual reference:
-
-- Brand blue around `rgb(0,57,138)`.
-- White, light gray-blue, slate text.
-- Clean cards, restrained radius, no black-heavy mobile navigation.
-- OA pages should feel like a workbench, not a marketing page.
-
-## PC Checks
-
-- Header has title, core filters, primary action only.
-- Tables do not expose UUID as the main business number.
-- Actions are consistent: view/edit/delete/withdraw use coherent variants.
-- Destructive actions need confirmation.
-
-## Mobile/WeCom Checks
-
-- No desktop sidebar/topbar.
-- No visible desktop table as primary layout.
-- Bottom nav is compact and selected state is solid, not thin outline.
-- Dialogs do not auto-focus search inputs unless it is clearly a search task.
-- Text does not overflow buttons/cards.
-- Common flows fit the viewport without incoherent blank/packed regions.
-
-## Playwright Metrics
-
-Collect or assert when relevant:
-
-- `scrollWidth <= viewportWidth + 2`.
-- visible table count is 0 on mobile workflow pages.
-- bottom nav height is reasonable.
-- active nav background is visible and not black/empty outline.
-- body text excludes banned internal terms.

.trellis/tasks/05-26-hyb-oa-delivery-trellis-only/check.jsonl

@@ -0,0 +1,4 @@
+{"file": ".trellis/spec/hyb-oa/index.md", "reason": "hyb-oa spec entry point for verification"}
+{"file": ".trellis/spec/hyb-oa/project-governance.md", "reason": "verify Trellis task contract and approval rules"}
+{"file": ".trellis/spec/hyb-oa/docs-and-evidence.md", "reason": "verify docs registry and evidence consistency"}
+{"file": ".trellis/spec/hyb-oa/security-privacy.md", "reason": "verify no sensitive data is introduced"}

.trellis/tasks/05-26-hyb-oa-delivery-trellis-only/implement.jsonl

@@ -0,0 +1,4 @@
+{"file": ".trellis/spec/hyb-oa/index.md", "reason": "hyb-oa spec entry point for Trellis-only governance"}
+{"file": ".trellis/spec/hyb-oa/project-governance.md", "reason": "Trellis task contract and approval rules"}
+{"file": ".trellis/spec/hyb-oa/docs-and-evidence.md", "reason": "docs registry and evidence-source rules"}
+{"file": ".trellis/spec/hyb-oa/security-privacy.md", "reason": "privacy and sensitive-data boundaries during docs migration"}

.trellis/tasks/05-26-hyb-oa-delivery-trellis-only/implement.md

@@ -0,0 +1,24 @@
+# Implementation Notes
+
+## Approach
+
+- Remove the project-local delivery skill as an executable governance source.
+- Move current operational guidance to Trellis workflow/spec/task files and existing docs fact sources.
+- Keep historical Issue CSVs untouched.
+- Update governance checks so deleted skill references in current governance files fail the Trellis gate.
+
+## Files
+
+- `AGENTS.md`
+- `docs/Agent开发交付实践.md`
+- `docs/文档索引.md`
+- `docs/文档事实源状态矩阵.md`
+- `scripts/qa/audit-docs.mjs`
+- `scripts/qa/check-process-contract.mjs`
+- `scripts/qa/check-trellis-governance.mjs`
+- `.trellis/tasks/05-26-trellis2-official-task-contract/`
+- `.agents/skills/`
+
+## Rollback
+
+This is a docs/governance-only cleanup. Roll back by reverting this task's file changes and restoring the deleted project skill files from git history if the Trellis-only gate proves too strict.

.trellis/tasks/05-26-hyb-oa-delivery-trellis-only/prd.md

@@ -0,0 +1,82 @@
+# Remove hyb-oa Delivery Skill And Enforce Trellis-Only Governance
+
+## Goal
+
+Make Trellis the single development and governance entry point for hyb-oa by
+removing the project-local `hyb-oa-delivery` skill and moving any current
+governance responsibility to `.trellis/workflow.md`, `.trellis/spec/hyb-oa/`,
+current Trellis task PRDs, and `docs/` fact sources.
+
+## Scope
+
+- Remove `.agents/skills/hyb-oa-delivery/` from the repo.
+- Update `AGENTS.md` so it no longer requires or recommends the project skill.
+- Update docs and registries that currently list `hyb-oa-delivery` as a current
+  fact source.
+- Update governance QA scripts so they validate Trellis workflow/spec/docs/task
+  contracts without requiring the deleted skill path.
+- Preserve Trellis built-in skills such as `trellis-start`, `trellis-before-dev`,
+  `trellis-check`, `trellis-update-spec`, and `trellis-meta`.
+- Preserve `docs/` as the business fact source and historical Issue CSVs as
+  audit evidence only.
+
+## Out Of Scope
+
+- No backend or frontend business-code changes.
+- No deployment or public OA verification.
+- No database, Enterprise WeChat, payment, production config, or real-data write.
+- No deletion or bulk rewrite of historical `issues/*.csv` files.
+- No removal of generic Trellis skills generated by Trellis init.
+
+## Requirements
+
+- `hyb-oa-delivery` must no longer be an auto-triggerable project skill.
+- Stable project rules that still matter must be reachable through
+  `.trellis/spec/hyb-oa/` and `docs/文档索引.md`, not through the deleted skill.
+- Governance checks must fail if future docs or scripts still require the
+  deleted skill as a current path.
+- Historical mentions may remain only when clearly historical evidence, not as
+  a current execution source.
+- The current task must remain the execution contract for this migration.
+
+## Acceptance
+
+- `.agents/skills/hyb-oa-delivery/` is deleted.
+- `AGENTS.md` describes Trellis-only entry and no longer points to
+  `.agents/skills/hyb-oa-delivery`.
+- `docs/文档索引.md` and `docs/文档事实源状态矩阵.md` no longer register the deleted
+  skill as a current fact source.
+- `scripts/qa/check-trellis-governance.mjs` and
+  `scripts/qa/check-process-contract.mjs` no longer require the deleted skill.
+- `rg -n "hyb-oa-delivery|\\.agents/skills/hyb-oa-delivery|项目 Skill 优先"`
+  returns no current operational references, except this task or historical
+  notes if explicitly marked as historical.
+- Trellis governance and docs registry checks pass.
+
+## Test Plan
+
+- `python3 ./.trellis/scripts/task.py validate 05-26-hyb-oa-delivery-trellis-only`
+- `node --check scripts/qa/check-trellis-governance.mjs`
+- `node --check scripts/qa/check-process-contract.mjs`
+- `node --check scripts/qa/audit-docs.mjs`
+- `node scripts/qa/check-trellis-governance.mjs`
+- `node scripts/qa/check-process-contract.mjs --baseline --json`
+- `node scripts/qa/audit-docs.mjs --check-registry`
+- `rg -n "hyb-oa-delivery|\\.agents/skills/hyb-oa-delivery|项目 Skill 优先" AGENTS.md .trellis docs scripts .agents .codex .github`
+- `git diff --check`
+
+## Privacy
+
+Do not write passwords, token, Secret, real invoice originals, contract bodies,
+bank materials, full accounts, complete local paths, or raw payloads in Trellis
+tasks, docs, reports, or chat.
+
+## Implementation Plan
+
+1. Remove project-skill references from AGENTS and docs current-source lists.
+2. Update governance scripts to require Trellis spec/docs instead of the deleted
+   project skill.
+3. Delete `.agents/skills/hyb-oa-delivery/`.
+4. Run the test plan above.
+5. If checks expose stale references, update only current governance/docs paths
+   needed for Trellis-only consistency.

.trellis/tasks/05-26-hyb-oa-delivery-trellis-only/task.json

@@ -0,0 +1,39 @@
+{
+  "id": "hyb-oa-delivery-trellis-only",
+  "name": "hyb-oa-delivery-trellis-only",
+  "title": "Remove hyb-oa delivery skill and enforce Trellis-only governance",
+  "description": "Remove the project-local hyb-oa-delivery skill and make Trellis workflow/spec/tasks/docs the single governance entry point.",
+  "status": "in_progress",
+  "dev_type": "docs",
+  "scope": "trellis-governance",
+  "package": "docs",
+  "priority": "P2",
+  "creator": "shunli",
+  "assignee": "shunli",
+  "createdAt": "2026-05-26",
+  "completedAt": null,
+  "branch": null,
+  "base_branch": "main",
+  "worktree_path": null,
+  "commit": null,
+  "pr_url": null,
+  "subtasks": [],
+  "children": [],
+  "parent": null,
+  "relatedFiles": [
+    "AGENTS.md",
+    ".trellis/spec/hyb-oa/",
+    "scripts/qa/check-trellis-governance.mjs",
+    "scripts/qa/check-process-contract.mjs",
+    "scripts/qa/audit-docs.mjs",
+    "docs/文档索引.md",
+    "docs/文档事实源状态矩阵.md",
+    "docs/Agent开发交付实践.md",
+    ".agents/skills/hyb-oa-delivery/"
+  ],
+  "notes": "No business code, no deployment, no public OA data writes. Requires user approval before deleting the project-local skill.",
+  "meta": {
+    "contractMode": "trellis_task",
+    "intent": "trellis_only_governance"
+  }
+}

.trellis/tasks/05-26-trellis2-official-task-contract/prd.md

@@ -29,7 +29,7 @@ holds the PRD, implementation context, verification context and finish record.
   without requiring Issue CSV bindings.
 - Current active Trellis tasks have PRD/test/scope information sufficient for
   the new check.
-- Documentation and the project skill agree on Trellis task-first operation.
+- Documentation, AGENTS and Trellis specs agree on Trellis task-first operation.
 
 ## Test Plan
 
@@ -38,7 +38,6 @@ holds the PRD, implementation context, verification context and finish record.
 - `node --check scripts/qa/check-trellis-governance.mjs`
 - `node scripts/qa/check-trellis-governance.mjs`
 - `node scripts/qa/audit-docs.mjs --check-registry`
-- `python3 /home/shunli/.codex/skills/.system/skill-creator/scripts/quick_validate.py .agents/skills/hyb-oa-delivery`
 - `git diff --check`
 - `bash scripts/check-minimal.sh`
 

.trellis/tasks/05-26-trellis2-official-task-contract/task.json

@@ -24,11 +24,11 @@
     "AGENTS.md",
     ".trellis/workflow.md",
     ".trellis/spec/hyb-oa/project-governance.md",
+    ".trellis/spec/hyb-oa/index.md",
     "scripts/qa/check-trellis-governance.mjs",
     "docs/Agent开发交付实践.md",
     "docs/文档索引.md",
-    "docs/文档事实源状态矩阵.md",
+    "docs/文档事实源状态矩阵.md"
-    ".agents/skills/hyb-oa-delivery/SKILL.md"
   ],
   "notes": "No business code, no deployment, no public OA data writes. TRELLIS2 intentionally creates no Issue CSV.",
   "meta": {

AGENTS.md

@@ -15,7 +15,7 @@
 - 编码前先方案：非微小改动必须先给实现方案并等待批准。
 - 先有 Trellis task 再开发：非微小改动必须先创建或更新 `.trellis/tasks/<task>/`。
 - 计划工具约束：使用 Codex 原生 `update_plan` 做执行清单，不用外部自定义 plan 替代。
-- 项目 Skill 优先：hyb-oa 交付、试运行、视觉复核、报销/OCR/附件、企业微信或部署类任务继续使用 `.agents/skills/hyb-oa-delivery`，再按 Trellis task/spec 组织上下文。
+- Trellis-only：hyb-oa 交付、试运行、视觉复核、报销/OCR/附件、企业微信或部署类任务统一从当前 Trellis task、`.trellis/workflow.md`、`.trellis/spec/hyb-oa/` 和 `docs/` 组织上下文。
 - 中文沟通；commit message 使用中文并引用 Trellis task 名称或任务 ID。
 - 不泄露密码、token、Secret、真实票据、合同正文、银行资料、完整账号、完整本地路径或原始 payload。
 - 不轻易新建文档；优先更新现有事实源、模块规约、操作手册、证据文档或当前 Trellis task。
@@ -29,7 +29,6 @@
 - 产品与视觉规则：`docs/产品设计规则.md`
 - 报销、发票、OCR、附件规则：`docs/报销发票附件规则.md`
 - 试运行与自动化验证：`docs/试运行与自动化验证手册.md`
-- 项目交付 Skill：`.agents/skills/hyb-oa-delivery/SKILL.md`
 - Trellis workflow：`.trellis/workflow.md`
 - Trellis project specs：`.trellis/spec/hyb-oa/`
 

docs/Agent开发交付实践.md

@@ -47,16 +47,16 @@ Trellis 的定位是“开发执行合同和上下文组织层”，不是业务
 
 历史 `issues/*.csv` 不删除、不批量回写；需要表格化审计时，可以从 Trellis task 摘要导出，而不是重新维护一套并行合同。
 
-### 3. Skill 只沉淀操作流程
+### 3. Trellis spec 固化操作流程
 
-Skill 用于减少重复沟通和降低遗漏风险，适合沉淀：
+TRELLIS2 后，项目不再维护独立的交付 Skill。每轮固定流程、验证顺序和高频边界应按稳定程度分别落到 `.trellis/workflow.md`、`.trellis/spec/hyb-oa/`、当前 Trellis task 或 `docs/`：
 
-- 每轮交付固定流程。
+- 每轮交付固定流程：优先进入 `.trellis/workflow.md` 或 `.trellis/spec/hyb-oa/project-governance.md`。
-- 试运行和验证顺序。
+- 试运行和验证顺序：优先进入 `docs/试运行与自动化验证手册.md` 或对应 Trellis task。
-- Playwright 视觉巡检要求。
+- Playwright 视觉巡检要求：优先进入 `docs/产品设计规则.md` 和相关 QA 脚本。
-- 报销、发票、企业微信等高频业务的检查入口。
+- 报销、发票、企业微信等高频业务入口：优先进入对应业务规约和 `.trellis/spec/hyb-oa/` 领域 spec。
 
-Skill 不复制长文档。详细业务规则放在 `docs/`，稳定开发规则沉淀到 `.trellis/spec/`，Skill 通过 references 指向需要时再读取。
+详细业务规则放在 `docs/`，稳定开发规则沉淀到 `.trellis/spec/`，当前任务上下文由 `.trellis/tasks/<task>/prd.md`、`implement.jsonl` 和 `check.jsonl` 串联。
 
 ### 4. 文档保存事实源
 
@@ -78,7 +78,7 @@ AGENTS.md 只放 Trellis-first 入口和硬约束，不复制长规则。
 - 后端：`npm run prisma:validate`、`node --check`、相关 Vitest、回归脚本。
 - 前端：`npm run typecheck`、`npm run build`。
 - 视觉：Playwright PC、mobile、WeCom UA 截图和 DOM 指标。
-- 文档/Skill：CSV validator、Skill quick_validate、`git diff --check`。
+- 文档/流程：Trellis governance check、docs registry check、`git diff --check`。
 
 验证失败时先定位是代码问题、测试桩问题、环境问题还是数据问题。数据库迁移漂移、生产配置、远程服务变更属于高风险操作，必须暂停确认。
 
@@ -155,7 +155,7 @@ commit message 使用中文并引用 Trellis task 名称或任务 ID，例如 `t
 
 agent 在声明 blocker 前，必须先查项目内已有资产：
 
-- `issues/*.csv`、`docs/`、`.agents/skills/hyb-oa-delivery/` 和 `AGENTS.md`。
+- `issues/*.csv`、`docs/`、`.trellis/spec/hyb-oa/`、当前 Trellis task 和 `AGENTS.md`。
 - 已有测试脚本、Playwright 用例、回归脚本、试运行报告和覆盖矩阵。
 - `artifacts/`、`output/`、手工复核证据、测试样本和历史日志。
 - 环境变量示例、部署 runbook、可用的公网健康检查和本地启动脚本。
@@ -230,5 +230,5 @@ agent 在声明 blocker 前，必须先查项目内已有资产：
 当连续两轮以上重复提醒同一类 agent 行为，或者同一类遗漏导致返工时，先判断：
 
 - 是项目事实源：更新 `docs/`。
-- 是每轮操作流程：更新 `.agents/skills/hyb-oa-delivery/`。
+- 是每轮操作流程：更新 `.trellis/workflow.md`、`.trellis/spec/hyb-oa/` 或当前 Trellis task。
 - 是不可违反硬规则：更新 `AGENTS.md`。

docs/文档事实源状态矩阵.md

@@ -137,10 +137,10 @@
 | `WECOM-API-CATALOG` | `docs/企微API能力目录.md` | 集成事实源 | 企微 API 能力目录和 Secret 矩阵事实源 | `CURRENT` | product/backend/qa | `WAPI,WRRA,WAPC1,WAPC2,WPROC1,WPROC2,WAPC2F,WAPC2FLIVE,WCBK1,WEGOV1,WACP3,WACP3R,WREAD1,WADM1,WARCH1,WARCH2,WROAD2,WARCH3,WCHECK1,WEXT1,WAPPR1,WTCLOSE1,WRULE1,WTCLOSE2` | 官方企业微信开发者中心链接/Issue CSV | none | 2026-05-22 | `rg` | high | 企微开发先读；只保存摘要、链接和项目决策，不保存 Secret、token、完整 userid、手机号、邮箱或原始 payload；记录审批补偿、打卡摘要、巡检只写 OA 留存、不写企业微信、企微原生审批规则不可只读 API 化、需人工门禁，以及 WRULE1/WTCLOSE2 只读审批链校验和最终收口边界 |
 | `DELIVERY` | `docs/开发交付与变更管理规约.md` | 开发治理 | 开发交付事实源 | `CURRENT` | dev/qa | `GOV8,WDRG,WRRA,WAPC1,WPROC1,WPROC2,WCBK1,WEGOV1,WOPS1,WROAD2C,WROAD2B,WAPPR1,WAUTO1,WEXT1LD,WFULLSMOKE1` | `rg` | none | 2026-05-20 | `rg` | high | Issue、review、commit、交付规则；WFULLSMOKE1 后固定 WAUTO1、WEXT1LD、全域最终目标测试和 WEXT1-FORMAL/WREAL1 前置门禁 |
 | `QA-GATE` | `docs/测试规约与回归门禁.md` | 测试验收 | 测试和回归门禁事实源 | `CURRENT` | qa | `QAF8,GOV8,WPROC1,WPROC2,WAPC2FLIVE,WCBK1,WEGOV1` | 回归脚本/Playwright | none | 2026-05-19 | `rg` | high | 测试计划、DONE 门禁、企微三层门禁、自动化优先、非自审、无完整 sandbox 假设、WREAD1 真机可读性和 WARCH1 留存验收门禁 |
-| `AGENT-PRACTICE` | `docs/Agent开发交付实践.md` | Agent 治理 | Agent 协作事实源 | `CURRENT` | dev | `GOV8,DG8,TRELLIS2` | Skill 校验 | none | 2026-05-26 | `rg` | medium | Agent 协作开发实践、设计主参考层级和 TRELLIS2 官方 task-first 执行合同口径 |
+| `AGENT-PRACTICE` | `docs/Agent开发交付实践.md` | Agent 治理 | Agent 协作事实源 | `CURRENT` | dev | `GOV8,DG8,TRELLIS2` | Trellis governance check | none | 2026-05-26 | `rg` | medium | Agent 协作开发实践、设计主参考层级和 TRELLIS2 官方 task-first 执行合同口径 |
 | `AGENTS` | `AGENTS.md` | 执行硬约束 | 项目硬规则 | `CURRENT` | lead | `GOV8` | 人工核对 | none | 2026-05-13 | `rg` | high | 不可违反约束 |
-| `SKILL-HYB` | `.agents/skills/hyb-oa-delivery/SKILL.md` | Skill | 项目交付 Skill | `CURRENT` | dev | `GOV8,DG8,WFDG,WDRG,WCP1,WCPC,WHMS,WHMSLIVE,WOUA,WAPI,WRRA,WRV1,WRA1,WMSG1,WAPC1,WAPC2,WPROC1,WPROC2,WAPC2F,WAPC2FLIVE,WCBK1,WEGOV1,WACP3,WACP3R,WREAD1,WREAD1F,WADM1,WARCH1,WARCH2,WROAD2,WARCH3,WCHECK1,WEXT1,WOPS1,WROAD2C,WROAD2B,WAPPR1,WRULE1,WAUTO1,WEXT1LD,WFULLSMOKE1,WROUTE2,WTCLOSE1,WTCLOSE2,WREAL1P,OAOPS1,ASSET1,OSMOKE1,OALAUNCH1,OMAT1,OPOLICY1,OAFLOW1,OAFRONT6,TRELLIS2` | quick_validate | none | 2026-05-26 | `quick_validate.py` | medium | 每轮交付操作入口；TRELLIS2 后非微小工作先读当前 Trellis task；企微/OA 后续先读 API 能力目录、Secret 矩阵、路线图、ASSET1 资产边界、OSMOKE1、OALAUNCH1、OPOLICY1、OAFLOW1 和 OAFRONT6；不得绕过真实业务闭环、权限矩阵、备份恢复、制度签收、Day 7 Go/No-Go 或后续独立合同直接宣布最终启用完成 |
 | `TRELLIS-WORKFLOW` | `.trellis/workflow.md` | Trellis | 开发主流程入口 | `CURRENT` | dev | `TRELLIS2` | `check-trellis-governance` | `AGENTS.md,.trellis/spec/hyb-oa/` | 2026-05-26 | `node scripts/qa/check-trellis-governance.mjs` | medium | TRELLIS2 后后续非微小开发默认从官方 Trellis task 进入；Issue CSV 只作历史审计或可选导出格式，docs 仍是业务事实源 |
+| `TRELLIS-SPEC` | `.trellis/spec/hyb-oa/index.md` | Trellis | 项目稳定规则入口 | `CURRENT` | dev | `TRELLIS2` | `check-trellis-governance` | `AGENTS.md,.trellis/workflow.md` | 2026-05-26 | `node scripts/qa/check-trellis-governance.mjs` | medium | TRELLIS2 后稳定开发规则、高频工程边界和业务域实施约束从 `.trellis/spec/hyb-oa/` 注入；详细业务事实仍以 docs 为准 |
 | `REQ-WF` | `docs/需求-统一审批中心规约.md` | 需求事实源 | 审批模块规约 | `CURRENT` | product/backend | `AP6,WF8,WFOC,DBWFOC,WFDG,WOUA,WAPI,WRRA,WRV1,WRA1,WMSG1,WAPC1,WAPC2,WPROC1,WPROC2,WAPC2F,WAPC2FLIVE,WCBK1,WEGOV1,WACP3,WACP3R,WREAD1,WREAD1F,WADM1,WARCH1,WAPPR1,WAUTO1,WEXT1LD,WFULLSMOKE1,WTCLOSE1,WRULE1,WTCLOSE2,OAFLOW1` | workflow 回归 | none | 2026-05-24 | `rg` | high | OA 主办审批、企微主办 HR/考勤审批、OA 自建留存、真实回调事件证据、WACP3R 补偿拉取 findings、WREAD1 请假/补卡真机可读性结论、WARCH1 最小历史留存、WAPPR1 审批规则规范化和 API 不支持读取规则边界、WTCLOSE1 小团队一层审批 + 管理员兜底目标 A、WRULE1 理论审批人与实际审批链校验、WTCLOSE2 测试号最终收口、OAFLOW1 负责人本人报销兜底、WAUTO1/WEXT1LD/WFULLSMOKE1 前置和 OA 应急接管边界 |
 | `REQ-OCR` | `docs/需求-报销发票OCR规约.md` | 需求事实源 | OCR 模块规约 | `CURRENT` | product/backend | `RI6,OCR8,BIZ8` | OCR 回归 | none | 2026-05-13 | `rg` | high | OCR 和发票边界 |
 | `RULE-REIMB` | `docs/报销发票附件规则.md` | 需求事实源 | 报销发票附件规则 | `CURRENT` | product/finance | `RI6,BIZ8` | 报销回归 | none | 2026-05-13 | `rg` | high | 报销、发票、附件细则 |
@@ -180,7 +180,8 @@
 | `docs/开发交付与变更管理规约.md` | 当前事实源 | Trellis task、review、提交和交付 |
 | `docs/Agent开发交付实践.md` | 当前事实源 | Agent 协作开发实践 |
 | `AGENTS.md` | 当前事实源 | 项目硬约束 |
-| `.agents/skills/hyb-oa-delivery/SKILL.md` | 当前事实源 | 项目交付 Skill |
+| `.trellis/workflow.md` | 当前执行合同 | Trellis task 开发主流程入口 |
+| `.trellis/spec/hyb-oa/index.md` | 当前执行合同 | 稳定开发规则和高频工程边界入口 |
 
 ## 当前操作手册
 

docs/文档索引.md

@@ -10,7 +10,7 @@
 
 ## 读取规则
 
-- 判断当前需求、开发、验收：读当前 Trellis task、当前 PRD、模块规约和本索引。
+- 判断当前需求、开发、验收：读当前 Trellis task、`.trellis/spec/hyb-oa/`、当前 PRD、模块规约和本索引。
 - 判断历史证据：读轻量历史索引，必要时用 `git show <commit>:<old-path>` 恢复旧文档。
 - 判断冲突：当前 Trellis task PRD/设计 > 当前 PRD/模块规约 > 设计和产品规则 > 当前操作手册 > 技术参考 > 历史证据。
 - 英文文件名只在技术生态或脚本强引用时保留，例如 `docs/mcp-tools.md`。
@@ -220,6 +220,7 @@ R6 -> PC6 -> PA6 -> FL6 -> AP6 -> RI6 -> LP6 -> ME6/QG6 -> DG7/MRF7 -> MIA7 -> M
 | [Agent开发交付实践](./Agent开发交付实践.md) | Agent 协作和交付实践 |
 | [AGENTS 项目规则](../AGENTS.md) | 执行硬约束 |
 | [Trellis Workflow](../.trellis/workflow.md) | TRELLIS2 后官方 Trellis task 开发主流程入口 |
+| [Trellis Project Specs](../.trellis/spec/hyb-oa/index.md) | TRELLIS2 后稳定开发规则和高频工程边界入口 |
 
 ## 当前操作手册
 

scripts/qa/audit-docs.mjs

@@ -39,7 +39,8 @@ const requiredCorePaths = [
   'docs/产品设计规则.md',
   'docs/产品口径.md',
   'AGENTS.md',
-  '.agents/skills/hyb-oa-delivery/SKILL.md',
+  '.trellis/workflow.md',
+  '.trellis/spec/hyb-oa/index.md',
 ];
 
 function printHelp() {

scripts/qa/check-process-contract.mjs

@@ -440,7 +440,8 @@ export function evaluateBaseline({ root = repoRoot } = {}) {
     "docs/企微API能力目录.md",
     "docs/文档索引.md",
     "docs/文档事实源状态矩阵.md",
-    ".agents/skills/hyb-oa-delivery/SKILL.md",
+    ".trellis/workflow.md",
+    ".trellis/spec/hyb-oa/project-governance.md",
     WAPC2F_ISSUE,
   ];
 

scripts/qa/check-trellis-governance.mjs

@@ -19,10 +19,12 @@ const requiredSpecs = [
 ];
 
 const requiredDocMentions = [
+  "AGENTS.md",
   "docs/Agent开发交付实践.md",
   "docs/文档索引.md",
   "docs/文档事实源状态矩阵.md",
-  ".agents/skills/hyb-oa-delivery/SKILL.md",
+  ".trellis/workflow.md",
+  ".trellis/spec/hyb-oa/index.md",
 ];
 
 const validTaskStatuses = new Set(["planning", "in_progress", "review", "completed"]);
@@ -242,6 +244,31 @@ function checkDocsRegistration(result) {
   if (result.status === "PASS") pass(result, "docs_registration", `${requiredDocMentions.length} fact sources mention Trellis`);
 }
 
+function checkRemovedProjectSkillReferences(result) {
+  const removedSkill = ["hyb", "oa", "delivery"].join("-");
+  const removedSkillPath = [".agents", "skills", removedSkill, "SKILL.md"].join("/");
+  const removedSkillDir = [".agents", "skills", removedSkill].join("/");
+  const legacyPriorityText = ["项目", "Skill 优先"].join(" ");
+  const files = [
+    "AGENTS.md",
+    "docs/Agent开发交付实践.md",
+    "docs/文档索引.md",
+    "docs/文档事实源状态矩阵.md",
+    "scripts/qa/audit-docs.mjs",
+    "scripts/qa/check-process-contract.mjs",
+  ];
+
+  for (const file of files) {
+    if (!exists(file)) continue;
+    const text = readText(file);
+    const staleTerms = [removedSkill, removedSkillPath, removedSkillDir, legacyPriorityText].filter((term) => text.includes(term));
+    if (staleTerms.length > 0) {
+      fail(result, "removed_project_skill.reference", `${file} still references removed project delivery skill`);
+    }
+  }
+  if (result.status === "PASS") pass(result, "removed_project_skill", "current governance files are Trellis-only");
+}
+
 function checkSensitiveData(result) {
   const scanFiles = [
     "AGENTS.md",
@@ -270,6 +297,7 @@ try {
   checkCoreFiles(result);
   checkTaskContracts(result);
   checkDocsRegistration(result);
+  checkRemovedProjectSkillReferences(result);
   checkSensitiveData(result);
 } catch (error) {
   fail(result, "exception", error instanceof Error ? error.message : String(error));