create-yss-spec 2.1.10 → 2.1.11

package/template/.codex/skills/yss-ddd-scaffold-generator/SKILL.md

@@ -67,7 +67,7 @@ node scripts/generate_scaffold.mjs \
 - Harness 内多项目布局必须使用 `apps/backend/<project>/`；`apps/backend/` 只能是生成器的父容器，`app/backend/`、`app/frontend/` 及其子路径一律拒绝。
 - 不要在 skill 里硬编码用户业务字段或真实连接信息。
 - 生成后要检查依赖关系是否仍符合分层约束。
-- 生成后必须继续使用 `yss-backend-scaffold-parent` 校验工程基线，再按垂直切片加载 `yss-domain`、`yss-repository`、`yss-web-controller` 等局部技能。
+- 生成后必须继续使用 `yss-backend-scaffold-parent` 校验工程基线，再按垂直切片加载 `yss-domain`、`yss-application`、`yss-repository`、`yss-web-controller` 等行为 skill；各 skill 的 `references/*-layer-guide.md` 承载分层开发规范。
 - 当前脚手架第一阶段仅支持经过验证的 `mysql`；未提供完整模板和验证的数据库类型不得伪装成已支持。
 - 生成后的后端工程必须使用项目根目录 `./mvnw ...` 执行构建、测试、运行和 CI 验证；不得在 README、实施记录、Ticket、Review 或 Release 中默认写裸 `mvn ...`。既有仓库确实无法使用 wrapper 时，必须记录受控例外。
 - 原型确认后，`scaffold_status=required` 才能进入本 skill；本 skill 的生成边界是工程结构、POM、配置、Wrapper 和机械模板，不是业务实现。

package/template/.codex/skills/yss-ddd-scaffold-generator/references/ARCHITECTURE.md

@@ -188,7 +188,7 @@ Controller -> Service -> Gateway -> Repository -> Database
 ## 7. 参考资料
 
 - [YSS 后端开发规范](./yss-backend-scaffold-parent/SKILL.md)
-- [Domain 层开发指南](./yss-backend-scaffold-domain/SKILL.md)
-- [Application 层开发指南](./yss-backend-scaffold-application/SKILL.md)
-- [Infrastructure 层开发指南](./yss-backend-scaffold-infrastructure/SKILL.md)
-- [Web Adapter 开发指南](./yss-backend-scaffold-web/SKILL.md)
+- [Domain 层开发指南](./yss-backend-scaffold-domain/SKILL.md) → `yss-domain`
+- [Application 层开发指南](./yss-backend-scaffold-application/SKILL.md) → `yss-application`
+- [Infrastructure 层开发指南](./yss-backend-scaffold-infrastructure/SKILL.md) → `yss-repository`
+- [Web Adapter 开发指南](./yss-backend-scaffold-web/SKILL.md) → `yss-web-controller`

package/template/.codex/skills/yss-ddd-scaffold-generator/references/yss-backend-scaffold-application/SKILL.md

@@ -1,8 +1,8 @@
 ---
-name: yss-backend-scaffold-application-reference
+name: yss-application-layer-reference
 description: Use when the YSS DDD scaffold workflow reaches Application-layer implementation and needs the shared Application skill.
 ---
 
 # Application Layer Reference
 
-**REQUIRED SUB-SKILL:** Use `yss-backend-scaffold-application` as the single authoritative Application-layer implementation guide. Do not maintain a second copy under the scaffold generator.
+**REQUIRED SUB-SKILL:** Use `yss-application` as the single authoritative Application-layer implementation guide (`references/application-layer-guide.md`). Do not maintain a second copy under the scaffold generator.

package/template/.codex/skills/yss-ddd-scaffold-generator/references/yss-backend-scaffold-application/agents/openai.yaml

@@ -2,4 +2,4 @@ version: 1
 interface:
   display_name: "YSS Scaffold Application"
   short_description: "YSS 后端脚手架应用层、用例编排与 DTO 规范"
-  default_prompt: "Use $yss-backend-scaffold-application to implement the application layer for a YSS backend scaffold module."
+  default_prompt: "Use $yss-application to implement the application layer for a YSS backend scaffold module."

package/template/.codex/skills/yss-ddd-scaffold-generator/references/yss-backend-scaffold-domain/SKILL.md

@@ -1,8 +1,8 @@
 ---
-name: yss-backend-scaffold-domain-reference
+name: yss-domain-layer-reference
 description: Use when the YSS DDD scaffold workflow reaches Domain-layer implementation and needs the shared Domain skill.
 ---
 
 # Domain Layer Reference
 
-**REQUIRED SUB-SKILL:** Use `yss-backend-scaffold-domain` as the single authoritative Domain-layer implementation guide. Do not maintain a second copy under the scaffold generator.
+**REQUIRED SUB-SKILL:** Use `yss-domain` as the single authoritative Domain-layer implementation guide (`references/domain-layer-guide.md`). Do not maintain a second copy under the scaffold generator.

package/template/.codex/skills/yss-ddd-scaffold-generator/references/yss-backend-scaffold-domain/agents/openai.yaml

@@ -2,4 +2,4 @@ version: 1
 interface:
   display_name: "YSS Scaffold Domain"
   short_description: "YSS 后端脚手架领域层、聚合与规则建模实践落地规范"
-  default_prompt: "Use $yss-backend-scaffold-domain to implement the domain layer for a YSS backend scaffold module."
+  default_prompt: "Use $yss-domain to implement the domain layer for a YSS backend scaffold module."

package/template/.codex/skills/yss-ddd-scaffold-generator/references/yss-backend-scaffold-infrastructure/SKILL.md

@@ -1,8 +1,8 @@
 ---
-name: yss-backend-scaffold-infrastructure-reference
-description: Use when the YSS DDD scaffold workflow reaches Infrastructure-layer implementation and needs the shared Infrastructure skill.
+name: yss-infrastructure-layer-reference
+description: Use when the YSS DDD scaffold workflow reaches Infrastructure-layer implementation and needs the shared Repository skill.
 ---
 
 # Infrastructure Layer Reference
 
-**REQUIRED SUB-SKILL:** Use `yss-backend-scaffold-infrastructure` as the single authoritative Infrastructure-layer implementation guide. Do not maintain a second copy under the scaffold generator.
+**REQUIRED SUB-SKILL:** Use `yss-repository` as the single authoritative Infrastructure-layer implementation guide (`references/infrastructure-layer-guide.md`). Do not maintain a second copy under the scaffold generator.

package/template/.codex/skills/yss-ddd-scaffold-generator/references/yss-backend-scaffold-infrastructure/agents/openai.yaml

@@ -2,4 +2,4 @@ version: 1
 interface:
   display_name: "YSS Scaffold Infrastructure"
   short_description: "YSS 后端脚手架基础设施层与持久化实现设计落地规范"
-  default_prompt: "Use $yss-backend-scaffold-infrastructure to implement the infrastructure layer for a YSS backend scaffold module."
+  default_prompt: "Use $yss-repository to implement the infrastructure layer for a YSS backend scaffold module."

package/template/.codex/skills/yss-ddd-scaffold-generator/references/yss-backend-scaffold-web/SKILL.md

@@ -1,8 +1,8 @@
 ---
-name: yss-backend-scaffold-web-reference
-description: Use when the YSS DDD scaffold workflow reaches Web-layer implementation and needs the shared Web skill.
+name: yss-web-layer-reference
+description: Use when the YSS DDD scaffold workflow reaches Web Adapter implementation and needs the shared Web Controller skill.
 ---
 
-# Web Layer Reference
+# Web Adapter Layer Reference
 
-**REQUIRED SUB-SKILL:** Use `yss-backend-scaffold-web` as the single authoritative Web-layer implementation guide. Do not maintain a second copy under the scaffold generator.
+**REQUIRED SUB-SKILL:** Use `yss-web-controller` as the single authoritative Web-layer implementation guide (`references/web-adapter-layer-guide.md`). Do not maintain a second copy under the scaffold generator.

package/template/.codex/skills/yss-ddd-scaffold-generator/references/yss-backend-scaffold-web/agents/openai.yaml

@@ -2,4 +2,4 @@ version: 1
 interface:
   display_name: "YSS Scaffold Web"
   short_description: "YSS 后端脚手架 Web 层、DTO 与控制器规范"
-  default_prompt: "Use $yss-backend-scaffold-web to implement the web adapter layer for a YSS backend scaffold module."
+  default_prompt: "Use $yss-web-controller to implement the web adapter layer for a YSS backend scaffold module."

package/template/.codex/skills/yss-domain/SKILL.md

@@ -51,10 +51,15 @@ description: 用于构建或重构 YSS 领域层代码。当用户要求设计
 
 ## 协同顺序
 
+- 需要用例编排时，再接 `yss-application`
 - 需要持久层时，再接 `yss-repository`
 - 需要 Web 层时，再接 `yss-web-controller`
 - 需要完整工程时，先 `yss-ddd-scaffold-generator`
 
+## 分层开发规范
+
+脚手架生成或进入 Domain 实现前，必须加载 `references/domain-layer-guide.md`：其中定义 DTO/Gateway/Domain Service 包结构、命名、校验与示例，与本 skill 的建模约束一并生效。
+
 ## 阶段 7 合同
 
 - 只消费生命周期已批准的 `Slice Implementation Contract` 和当前 `work_unit`；不得扩大 `allowed_write_paths`。

package/template/.codex/skills/{yss-backend-scaffold-domain/SKILL.md → yss-domain/references/domain-layer-guide.md}

@@ -1,10 +1,3 @@
----
-name: "yss-backend-scaffold-domain"
-description: "YSS 管理服务领域层的脚手架和最佳实践。在实现业务逻辑、定义数据网关或创建领域模型时调用。"
----
-
-# Domain 层开发规范 (Domain Layer Development Guide)
-
 本 Skill 提供了 YSS 数据质量管理服务 **Domain (领域层)** 的开发规范。Domain 层是系统的核心，包含业务逻辑、领域模型和接口定义。
 
 ## 1. 核心职责 (Core Responsibilities)

package/template/.codex/skills/yss-microapp-commit/SKILL.md

@@ -5,6 +5,8 @@ description: Use when committing or analyzing changes in a YSS micro-frontend ap
 
 # 微应用提交规范 Skill
 
+目录与锁文件身份是 `yss-microapp-commit`；Agent 发现名是 `microapp-commit`。二者指向同一技能，注册表以 alias 对齐。
+
 ## 📋 目标
 
 帮助 AI 为微应用项目生成符合 **Conventional Commits** 规范的 Git 提交信息，支持智能分析变更内容并处理复杂提交场景。

package/template/.codex/skills/yss-product-lifecycle/references/orchestration-contract.yaml

@@ -111,7 +111,7 @@ skill_source_contract:
   lock_version: 3
   source_revisions_required: [mattpocock/skills]
   adaptation_ref_required_when_effective_diff: true
-  retired_shared_skills: [batch-grill-me]
+  retired_shared_skills: [batch-grill-me, product-design-prototype, yss-dictionary, yss-jdbc, yss-log, yss-taskflow, yss-backend-scaffold-application, yss-backend-scaffold-domain, yss-backend-scaffold-infrastructure, yss-backend-scaffold-web]
 
 # 生命周期默认走原生工作单元；Matt user-invoked skill 仅保留为兼容入口。
 lifecycle_native_entries:

package/template/.codex/skills/yss-prototype-stage/SKILL.md

@@ -11,7 +11,7 @@ description: Use when a YSS feature has product-design impact on a primary flow,
 
 - 先由 `yss-product-lifecycle` 判断产品设计影响；无行为变化的孤立视觉修复记录 `not-applicable`，不创建空资产。
 - Codex 的产出主入口是 `product-design:index`；其他 Agent 使用等价的产品设计能力，但必须产出本技能规定的相同资产和证据。能力或证据不能等价时，暂停并回到人工确认。
-- `product-design-prototype`、`high-fidelity-html-prototype` 仅为兼容入口；从它们进入时立即回到本合同。已退休的原型技能不得继续路由。
+- `high-fidelity-html-prototype` 仅为历史兼容入口；从它进入时立即回到本合同。已退休的原型技能（含 `product-design-prototype`）不得继续路由。
 
 ## 资产与门禁顺序
 

package/template/.codex/skills/yss-repository/SKILL.md

@@ -59,10 +59,15 @@ description: Use when generating or refactoring YSS persistence models, BaseRepo
 
 - metadata / DDL 输入准备：确认输入完整
 - 领域建模：`yss-domain`
+- 用例编排：`yss-application`
 - POJO 样板代码：`lombok`
 - 对象转换：`mapstruct`
 - Web 补齐：`yss-web-controller`
 
+## 分层开发规范
+
+实现 PO / Repository / GatewayImpl 前，必须加载 `references/infrastructure-layer-guide.md`：其中定义持久化对象、Repository、Convertor 与 Gateway 实现的结构与示例。
+
 ## 阶段 7 合同
 
 - 前置条件：数据架构、领域元数据、实现仓库和批准后的 `Slice Implementation Contract` 均可用；否则不执行本 skill，由 Router 返回 `blocked`。

package/template/{.hermes/skills/yss-backend-scaffold-infrastructure/SKILL.md → .codex/skills/yss-repository/references/infrastructure-layer-guide.md}

@@ -1,10 +1,3 @@
----
-name: "yss-backend-scaffold-infrastructure"
-description: "YSS 服务的基础设施层开发框架和技术指南。在实现数据访问层、数据库实体、外部服务适配器时需要用到。"
----
-
-# Infrastructure 层开发规范 (Infrastructure Layer Development Guide)
-
 本 Skill 提供了 YSS **Infrastructure (基础设施层)** 的通用开发规范。Infrastructure 层负责实现 Domain 层定义的网关接口，处理数据持久化、外部服务调用和配置管理。
 
 ## 1. 核心职责 (Core Responsibilities)

package/template/.codex/skills/yss-router/references/boundaries.md

@@ -22,8 +22,8 @@ Default for a new page: first verify the approved product design, state matrix,
 ## Backend Boundaries
 
 - `yss-ddd-scaffold-generator`: Create a whole multi-module backend skeleton.
-- `yss-domain`: Domain modeling and domain gateway contracts.
-- `yss-backend-scaffold-application`: Application use cases, transaction boundaries, and cross-aggregate orchestration.
+- `yss-domain`: Domain modeling, domain gateway contracts, and domain-layer conventions.
+- `yss-application`: Application use cases, transaction boundaries, and cross-aggregate orchestration.
 - `yss-repository`: Persistence implementation, PO, Repository, Convertor, GatewayImpl.
 - `yss-web-controller`: REST adapter layer, request/response DTOs, VO, web convertor.
 - `yss-mybatis`: Framework behavior for MyBatis/MyBatis-Plus, BaseRepository, pagination, mapper scanning, batch, datasource issues.
@@ -39,11 +39,7 @@ Default for end-to-end backend CRUD: include Domain, Application, Infrastructure
 - `yss-audit-log`: Audit annotations, SpEL summaries, async publication, subscribers.
 - `yss-excel-mvc`: Spring MVC Excel import/export annotations and handlers.
 - `yss-distributed-id`: ID strategies, AutoIdInterceptor, Leaf/CosId/Snowflake, batch ID injection.
-- `yss-jdbc`: Hutool Db, dynamic datasource JDBC, JdbcSqlUtil, batch SQL execution.
-- `yss-dictionary`: Dictionary/domain item APIs and dictionary component integration.
-- `yss-log`: DEBUG request-parameter/success-latency logging, starter auto-configuration, and centralized collection; current `CatchAndLog` is not exception logging.
 - `yss-resilience4j`: Circuit breaker, fallback, and gateway resilience integration.
-- `yss-taskflow`: Task flow definition/execution component behavior.
 - `yss-validation`: Validation engine and JSR-303 integration.
 - `yss-security-algorithm`: RSA/AES/SM/JWT/JWK/password-encoding compatibility and production key-management safety gates.
 - `yss-userinfo`: Current-user info propagation and starter integration.

package/template/.codex/skills/yss-router/references/router-contract.yaml

@@ -1,6 +1,9 @@
 schema_version: 1
 allowed_statuses: [draft, blocked, ready-for-lifecycle-review]
 forbidden_statuses: [approved, ready-for-agent, completed]
+skill_aliases:
+  api-integration: yss-api-integration
+  microapp-commit: yss-microapp-commit
 implementation_path_policy:
   applies_to: harness-resident-runtime-code
   project_roots:
@@ -120,24 +123,22 @@ dependency_closure:
   yss-ddd-scaffold-generator:
     always: [yss-backend-scaffold-parent, alibaba-java-code-style]
   yss-domain:
-    always: [yss-backend-scaffold-domain, alibaba-java-code-style]
+    always: [alibaba-java-code-style]
     when_modeling: [domain-modeling]
     when_pojo: [lombok]
-  yss-backend-scaffold-application:
+  yss-application:
     always: [alibaba-java-code-style]
     when_conversion: [mapstruct, lombok]
   yss-repository:
-    always: [yss-backend-scaffold-infrastructure, mapstruct, lombok, alibaba-java-code-style]
+    always: [mapstruct, lombok, alibaba-java-code-style]
     when_mybatis: [yss-mybatis]
   yss-web-controller:
-    always: [yss-dto, yss-backend-scaffold-web, mapstruct, lombok, alibaba-java-code-style]
+    always: [yss-dto, mapstruct, lombok, alibaba-java-code-style]
   yss-userinfo:
     always: [yss-dto]
     when_cache_lookup: [yss-cache]
   yss-audit-log:
     always: [yss-userinfo, yss-dto]
-  yss-log:
-    always: []
   yss-validation:
     always: [yss-exception]
   yss-security-algorithm:
@@ -156,7 +157,6 @@ component_impact_values:
   - current-user-context
   - user-cache-lookup
   - audit-event
-  - technical-request-logging
   - request-validation
   - error-mapping
   - encryption-or-signing
@@ -165,20 +165,16 @@ component_impact_routing:
   current-user-context: [yss-userinfo]
   user-cache-lookup: [yss-userinfo, yss-cache]
   audit-event: [yss-audit-log, yss-userinfo, yss-dto]
-  technical-request-logging: [yss-log]
   request-validation: [yss-validation, yss-exception]
   error-mapping: [yss-exception, yss-dto]
   encryption-or-signing: [yss-security-algorithm, yss-exception]
 
 end_to_end_backend_required:
   - yss-domain
-  - yss-backend-scaffold-domain
-  - yss-backend-scaffold-application
+  - yss-application
   - yss-repository
-  - yss-backend-scaffold-infrastructure
   - yss-web-controller
   - yss-dto
-  - yss-backend-scaffold-web
   - mapstruct
   - lombok
   - alibaba-java-code-style

package/template/.codex/skills/yss-source-index/references/source-map-config.md

@@ -12,11 +12,7 @@ The refresh script maps component source path hints to skill references. These p
 | `yss-audit-log` | `yss-microservice-components/yss-component-audit-log` |
 | `yss-excel-mvc` | `yss-microservice-components/yss-component-excel-mvc`, `yss-microservice-components/yss-component-excel-starter` |
 | `yss-distributed-id` | `yss-microservice-components/yss-component-distributed-id`, `yss-microservice-components/yss-component-leaf` |
-| `yss-jdbc` | `yss-microservice-components/yss-component-jdbc` |
-| `yss-dictionary` | `yss-microservice-components/yss-component-dictionary-parent` |
-| `yss-log` | `yss-microservice-components/yss-component-log-starter` |
 | `yss-resilience4j` | `yss-microservice-components/yss-component-resilience4j-starter` |
-| `yss-taskflow` | `yss-microservice-components/yss-component-taskflow` |
 | `yss-validation` | `yss-microservice-components/yss-component-validation-engine-parent`, `yss-microservice-components/yss-component-validation-jsr303` |
 | `yss-security-algorithm` | `yss-microservice-components/yss-component-security-algorithm` |
 | `yss-userinfo` | `yss-microservice-components/yss-component-userinfo-starter` |

package/template/.codex/skills/yss-source-index/scripts/refresh-yss-skill-index.mjs

@@ -5,7 +5,7 @@ import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
-const BACKEND = {"yss-cache":["yss-microservice-components/yss-component-cache-parent"],"yss-mybatis":["yss-microservice-components/yss-component-persistence"],"yss-dto":["yss-microservice-components/yss-component-dto"],"yss-audit-log":["yss-microservice-components/yss-component-audit-log"],"yss-excel-mvc":["yss-microservice-components/yss-component-excel-mvc","yss-microservice-components/yss-component-excel-starter"],"yss-distributed-id":["yss-microservice-components/yss-component-distributed-id","yss-microservice-components/yss-component-leaf"],"yss-jdbc":["yss-microservice-components/yss-component-jdbc"],"yss-dictionary":["yss-microservice-components/yss-component-dictionary-parent"],"yss-log":["yss-microservice-components/yss-component-log-starter"],"yss-resilience4j":["yss-microservice-components/yss-component-resilience4j-starter"],"yss-taskflow":["yss-microservice-components/yss-component-taskflow"],"yss-validation":["yss-microservice-components/yss-component-validation-engine-parent","yss-microservice-components/yss-component-validation-jsr303"],"yss-security-algorithm":["yss-microservice-components/yss-component-security-algorithm"],"yss-userinfo":["yss-microservice-components/yss-component-userinfo-starter"],"yss-exception":["yss-microservice-components/yss-component-exception"]};
+const BACKEND = {"yss-cache":["yss-microservice-components/yss-component-cache-parent"],"yss-mybatis":["yss-microservice-components/yss-component-persistence"],"yss-dto":["yss-microservice-components/yss-component-dto"],"yss-audit-log":["yss-microservice-components/yss-component-audit-log"],"yss-excel-mvc":["yss-microservice-components/yss-component-excel-mvc","yss-microservice-components/yss-component-excel-starter"],"yss-distributed-id":["yss-microservice-components/yss-component-distributed-id","yss-microservice-components/yss-component-leaf"],"yss-resilience4j":["yss-microservice-components/yss-component-resilience4j-starter"],"yss-validation":["yss-microservice-components/yss-component-validation-engine-parent","yss-microservice-components/yss-component-validation-jsr303"],"yss-security-algorithm":["yss-microservice-components/yss-component-security-algorithm"],"yss-userinfo":["yss-microservice-components/yss-component-userinfo-starter"],"yss-exception":["yss-microservice-components/yss-component-exception"]};
 const FRONTEND={"yss-ui":["components","hooks","skills"],"yss-components":["components"],"yss-hook":["hooks"],"yss-page-module-development":["components","hooks","skills"],"yss-use-table-height":["hooks"],"yss-use-tree-height":["hooks"]};
 const URLS={components:"http://192.168.164.27:3200/components",hooks:"http://192.168.164.27:3200/hooks",skills:"http://192.168.164.27:3200/skills"};
 const KEYS=["Audit","Cache","Clear","Command","Configuration","Controller","DTO","Data","Enable","Excel","Handler","Interceptor","Jdbc","Mapper","Mybatis","Page","Properties","Query","Repository","Request","Response","Result","Update","Aspect","Leaf","Id","Dir","Dic","Dictionary","File","Upload","Log","Message","Mail","Liquibase","Circuit","Breaker","Sql","Tpl","Tag","Task","Flow","Report","Validation","Validator","Security","Crypto","User","Variable","Quality","Search","Similarity","Scheduler","Runner","Duck","Dynamic","Factory","Client","Feign","Gateway","Convertor","Adapter","Advice","Bridge","Route","Uploader","Sftp","Minio","Parser","Express","Rule","Template","Generator","Importer","Engine","Event","Submitter","Executor","Context","Status","Type","State"];

package/template/.codex/skills/yss-web-controller/SKILL.md

@@ -63,6 +63,7 @@ node scripts/generate_controller.mjs \
 
 ## 按需读取
 
+- 分层开发规范：`references/web-adapter-layer-guide.md`
 - 生成脚本：`scripts/generate_controller.mjs`
 - Controller 模板：`assets/templates/Controller.java.template`
 - Convertor 模板：`assets/templates/WebConvertor.java.template`

package/template/{.hermes/skills/yss-backend-scaffold-web/SKILL.md → .codex/skills/yss-web-controller/references/web-adapter-layer-guide.md}

@@ -1,10 +1,3 @@
----
-name: "yss-backend-scaffold-web"
-description: "YSS 管理服务的 Web Adapter 开发框架和技术指南。在实现 REST API 控制器、请求处理和响应格式化时需要用到。"
----
-
-# Web Adapter Layer Development Guide
-
 本技能为开发 YSS 服务的**Web 适配器层**（REST API）提供指导和框架。
 Web 适配器负责通过 HTTP 公开业务功能、处理输入验证和格式化响应。
 

package/template/.cursor/environment.json

@@ -0,0 +1,5 @@
+{
+  "name": "YSS Spec Project Template",
+  "install": "pip3 install jsonschema\npnpm --dir .template-source/tooling/node install --frozen-lockfile",
+  "start": "pnpm dev"
+}

package/template/.cursor/skills/alibaba-java-code-style/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: alibaba-java-code-style
+description: Apply Alibaba Java Development Manual conventions when implementing, refactoring, or reviewing Java/JVM code, Spring-style services, MyBatis/ORM mappings, SQL, Maven dependencies, unit tests, exception/logging behavior, security checks, and design documentation. Use when the user asks for Java code规范, 阿里规范, P3C-style review, Java code style, or compliance with Alibaba Java coding guidelines.
+---
+
+# Alibaba Java Code Style
+
+This skill distills the provided `阿里巴巴 Java 开发手册` 1.4.0 PDF into execution rules for Codex. Treat rules marked mandatory as review blockers unless the repository's own `AGENTS.md`, security constraints, or existing framework conventions explicitly require a different pattern.
+
+## Workflow
+
+1. Identify the touched surface:
+   - Java source, naming, constants, OOP, collections, concurrency, control flow, comments: read `references/java-programming.md`.
+   - Exceptions, logging, unit tests, or security: read `references/reliability-test-security.md`.
+   - MySQL, ORM/MyBatis, Maven dependencies, layering, server/JVM settings, or design artifacts: read `references/database-engineering-design.md`.
+2. Apply mandatory rules first, then use recommended rules to improve maintainability, performance, and readability.
+3. When reviewing, report mandatory violations as findings. Mention recommended violations when they create real risk or are already in the changed area.
+4. When implementing, prefer the repository's existing framework helpers and code generation skills over inventing new local infrastructure.
+5. If a rule touches a project safety boundary such as auth, payment, encryption, raw SQL, database migration scripts, or public base library API changes, produce a draft or `TODO-HUMAN-REVIEW` rather than silently finalizing risky code.
+
+## Core Priorities
+
+- Keep names readable, English, and consistent with Java layer conventions.
+- Avoid null, equality, wrapper comparison, collection, and concurrency traps that compile cleanly but fail at runtime.
+- Make logs useful without wasting CPU, disk, or alert budget.
+- Keep unit tests automatic, independent, repeatable, and close to public behavior.
+- Bind SQL parameters, define explicit ORM mappings, and never rely on string-concatenated SQL.
+- Preserve layering: web/controller code validates and adapts; service/manager code owns business orchestration; DAO/repository code owns persistence.
+
+## Review Checklist
+
+- Naming and formatting are consistent: camel case, constants, package names, braces, spacing, line length, UTF-8/Unix line endings.
+- POJO, DTO, DO, VO, Query, enum, interface, implementation, and test names follow the expected suffixes and boolean naming rules.
+- `equals`, `hashCode`, wrapper comparisons, `toString`, `serialVersionUID`, constructors, access modifiers, and getters/setters avoid known pitfalls.
+- Collection code avoids unsafe `subList`, `Arrays.asList`, raw `toArray`, foreach removal, null-unsafe maps, and invalid comparators.
+- Thread code uses named thread pools, avoids `Executors` factories in production code, and handles locking order, date formatting, and scheduled tasks safely.
+- Exceptions are handled at the right layer, logged once with context and stack, and never swallowed or used for normal control flow.
+- Tests use assertions, avoid external dependence, live under `src/test/java`, and cover boundaries, correct cases, design cases, and error cases.
+- Security-sensitive inputs are validated, authorized, escaped, CSRF-protected, rate-limited, and never concatenated into SQL.
+- MySQL DDL/SQL/ORM code uses explicit fields, mappings, indexes, timestamps, `#{}`
+  parameter binding, and avoids dangerous cascades, stored procedures, `select *`, and uncontrolled pagination.
+
+## Source
+
+Based on the user-provided PDF: `阿里巴巴 Java 开发手册` version 1.4.0, Alibaba Group technical team, update date 2018-05-20.
+
+## 阶段 7 执行结果
+
+- 消费当前合同版本、changed files 和 verification results，只审查合同允许范围。
+- 必须把 mandatory violation 返回为 `violation`，并提供文件/位置/规则证据；高风险项保留 `TODO-HUMAN-REVIEW`。
+- 按统一 `YSS Skill Execution Result` 返回审查证据、偏离和新增安全/SQL/公共 API 影响，不得仅输出“符合规范”。

package/template/.cursor/skills/alibaba-java-code-style/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Alibaba Java Code Style"
+  short_description: "Apply Alibaba Java development guidelines"
+  default_prompt: "Use $alibaba-java-code-style to implement or review Java code against Alibaba Java development conventions."

package/template/.cursor/skills/alibaba-java-code-style/references/database-engineering-design.md

@@ -0,0 +1,147 @@
+# Database, Engineering, And Design Rules
+
+Use this reference for MySQL DDL/SQL, ORM mappings, Maven/library dependency rules, application layering, server/JVM settings, and design artifacts.
+
+## MySQL Table Design
+
+Mandatory:
+
+- Boolean database fields must be named `is_xxx` and use `unsigned tinyint`, where `1` means yes and `0` means no. POJO boolean fields must not use `is` prefix, so define explicit ORM mappings.
+- Table and field names must be lowercase letters or digits. Do not start with digits, use uppercase, or use patterns such as `level_3_name`.
+- Table names must be singular.
+- Do not use MySQL reserved words such as `desc`, `range`, `match`, or `delayed`.
+- Index names: primary key `pk_字段名`, unique index `uk_字段名`, normal index `idx_字段名`.
+- Use `decimal` for decimals. Do not use `float` or `double` for precise stored values.
+- Use `char` for nearly fixed-length strings.
+- `varchar` length must not exceed 5000. For longer content, use `text` in a separate table keyed by the primary key to avoid hurting other index efficiency.
+- Every table must include `id`, `gmt_create`, and `gmt_modified`. `id` is `bigint unsigned` primary key with auto-increment step 1 for single tables; timestamps are `datetime`.
+
+Recommended/reference:
+
+- Prefer table names like `业务名称_表作用`.
+- Keep database name aligned with application name where possible.
+- Update field comments when field meaning or status values change.
+- Redundant fields are allowed for performance only when consistency is considered, the value is not frequently changed, and the field is not long `varchar` or `text`.
+- Consider sharding only when a single table exceeds about 5 million rows or 2 GB, or when projections clearly require it.
+- Choose compact unsigned integer types where domain ranges allow.
+
+## Indexes
+
+Mandatory:
+
+- Business-unique fields must have unique indexes, even when uniqueness is also checked in application code.
+- Do not join more than 3 tables. Join column types must be exactly consistent and associated columns must have indexes.
+- When indexing `varchar`, specify an index length based on real selectivity instead of indexing the whole field.
+- Page search must not use left fuzzy or full fuzzy queries such as `%keyword` or `%keyword%`; use a search engine when needed.
+
+Recommended/reference:
+
+- For `order by`, align the ordered field with the last part of the composite index where possible, such as `where a=? and b=? order by c` with index `a_b_c`.
+- Use covering indexes to avoid table lookups where suitable.
+- For deep pagination, use delayed join/subquery techniques to locate IDs first, or cap total pages.
+- SQL optimization target: at least `range`, preferably `ref`, best `const`.
+- Put the most selective equality column on the left side of composite indexes. When mixed with range conditions, place equality conditions first.
+- Avoid implicit type conversion, which can invalidate indexes.
+- Avoid both extremes: indexing every query and resisting necessary indexes such as unique indexes.
+
+## SQL And ORM
+
+Mandatory:
+
+- Use `count(*)` for row counts, not `count(column)` or `count(constant)`.
+- Know `count(distinct col)` ignores nulls; `sum(col)` over all-null rows returns null, so guard against NPE.
+- Use `ISNULL()` or the project-standard equivalent to test nulls; direct equality comparisons with null do not behave as true/false.
+- In pagination code, return immediately when count is 0 instead of running the page query.
+- Do not use foreign keys or cascades; model those relationships in application logic for distributed/high-concurrency systems.
+- Do not use stored procedures in application code.
+- For data correction, especially delete/update, select first and confirm before mutating.
+- In queries, never use `*`; explicitly list required fields.
+- POJO boolean fields must not use `is` prefix, while database fields must use `is_`; define explicit result mappings.
+- Do not rely on `resultClass` for ORM returns. Define `resultMap` or equivalent explicit mappings.
+- MyBatis/iBATIS XML parameters must use `#{}`. Do not use `${}` for user-controlled values because it risks SQL injection.
+- Do not return raw `HashMap`/`Hashtable` as query results; use typed objects.
+- Every update to a table record must update `gmt_modified` to the current time.
+
+Recommended/reference:
+
+- Avoid large `IN` lists; keep them under about 1000 items if unavoidable.
+- For internationalized storage, use UTF-8; use `utf8mb4` when storing emoji.
+- Avoid `TRUNCATE TABLE` in application code; it has no transaction and does not trigger delete behavior.
+- Do not create a large all-fields update API. Update only changed target fields to reduce mistakes, binlog size, and work.
+- Do not overuse `@Transactional`; consider database QPS and rollback/compensation for cache, search, messages, and statistics.
+
+## Application Layering
+
+Recommended/reference:
+
+- Follow downward dependencies:
+  - Open API layer: exposes service methods as RPC/HTTP, handles gateway security and traffic controls.
+  - Terminal display layer: templates, JavaScript rendering, JSP, or mobile display.
+  - Web layer: forwarding, access control, basic parameter validation, and simple non-reused business handling.
+  - Service layer: concrete business logic.
+  - Manager layer: common business handling, third-party platform adaptation, service common capability extraction, cache/middleware handling, and DAO composition.
+  - DAO layer: persistence interaction with MySQL, Oracle, HBase, etc.
+  - External interfaces: other departments' RPC APIs, base platforms, or third-party HTTP APIs.
+- Exception handling by layer:
+  - DAO catches broad persistence exceptions and wraps them as `DAOException`; do not log again if the upper layer will log.
+  - Service logs exceptions with parameters and context.
+  - Manager follows DAO behavior when deployed with Service, or Service behavior when independently deployed.
+  - Web should not keep throwing to users; render friendly errors when the page cannot proceed.
+  - Open API converts exceptions to error code and message.
+- Domain model meanings:
+  - `DO`: database table object, passed upward by DAO.
+  - `DTO`: transfer object from Service/Manager outward.
+  - `BO`: business object output by Service.
+  - `AO`: application object between Web and Service, close to display and not highly reusable.
+  - `VO`: view object for Web/template rendering.
+  - `Query`: query request object. If a query has more than 2 parameters, wrap them; do not pass `Map`.
+
+## Maven And Library Dependencies
+
+Mandatory:
+
+- Use GAV conventions where applicable: `GroupId` as `com.{company/BU}.business[.subBusiness]`, `ArtifactId` as `product-module`, version as `major.minor.patch`.
+- Version meaning: major for direction/large incompatibility/architecture changes, minor for mostly compatible major features, patch for compatible bugfixes/minor features. Initial formal release should be `1.0.0`.
+- Online applications must not depend on `SNAPSHOT` versions except explicitly allowed security packages.
+- Adding/upgrading a library must preserve dependency mediation outside the intended functional change. Compare `dependency:resolve`/`dependency:tree` and exclude accidental differences.
+- Library APIs may define enum types and accept enum parameters, but should not return enum values or POJOs containing enum values across external library boundaries.
+- Define one version variable for a group of related libraries to avoid version drift.
+- Do not declare the same `GroupId` and `ArtifactId` with different versions across subprojects.
+
+Recommended/reference:
+
+- Put dependency declarations under `<dependencies>` and version mediation under `<dependencyManagement>`.
+- Avoid adding configuration items to reusable libraries unless truly necessary.
+- Library publishers should keep APIs/dependencies minimal and behavior stable/traceable.
+
+## Server And JVM
+
+Recommended/reference:
+
+- For high-concurrency servers, reduce TCP `time_wait` timeout where operations policy allows.
+- Increase maximum file descriptors for high concurrent connection counts.
+- Set `-XX:+HeapDumpOnOutOfMemoryError` so OOM events produce diagnostic dumps.
+- In production, set JVM `Xms` and `Xmx` to the same size to avoid heap resizing pressure after GC.
+- Use `forward` for internal redirects. Generate external redirect URLs through URL builder utilities to avoid inconsistent maintenance and potential security risk.
+
+## Design Rules
+
+Mandatory:
+
+- Storage schemes and base data structures must pass review and be documented before production execution. Data structure changes such as adding fields also need review.
+- If more than one user type interacts with the system and related use cases exceed 5, use a use-case diagram.
+- If a business object's states exceed 3, use a state diagram and define trigger conditions for state transitions.
+- If a feature call chain involves more than 3 objects, use a sequence diagram and define inputs/outputs at each call.
+- If model classes exceed 5 and dependencies are complex, use a class diagram.
+- If more than 2 objects collaborate and the process is complex, use an activity diagram with swimlanes where useful.
+
+Recommended/reference:
+
+- Consider exception flows and business boundaries during requirements analysis and system design.
+- Classes should follow single responsibility.
+- Prefer composition/aggregation over inheritance. If inheritance is necessary, obey Liskov substitution.
+- Depend on abstractions and interfaces where it improves extension and maintenance.
+- Design for extension and closed modification in stable business domains.
+- Extract common business behavior or public behavior into shared modules, config, classes, or methods to avoid duplicated code/config.
+- Do not treat agile as only stories plus coding plus release; keep necessary design and documentation for key decisions.
+- Design identifies hard parts, variation points, boundaries, module relations, evolution principles, and nonfunctional requirements such as security, availability, and extensibility.