create-yss-spec 2.1.3 → 2.1.4

package/template/scripts/verify-lifecycle-scenarios

@@ -2,9 +2,44 @@
 # frozen_string_literal: true
 
 require "pathname"
+require "set"
 require "yaml"
 
 ROOT = Pathname.new(__dir__).join("..").realpath
+REGISTRY = YAML.safe_load(
+  ROOT.join("docs/process/lifecycle-registry.yaml").read,
+  permitted_classes: [],
+  aliases: false
+)
+REGISTRY_IDS = %w[stages gates artifacts work_units evidence].flat_map do |collection|
+  REGISTRY.fetch(collection).map { |record| record.fetch("id") }
+end.to_set
+ROUTE_REGISTRY_IDS = {
+  "impact-assessment" => "artifact.impact-assessment",
+  "ssot-update" => "work-unit.ssot-update",
+  "skill-projection-sync" => "work-unit.skill-projection-sync",
+  "pressure-scenarios" => "evidence.fresh-verification",
+  "fresh-verification" => "work-unit.fresh-verification",
+  "independent-review" => "work-unit.independent-review",
+  "tracker-sync" => "evidence.checkpoint-and-rollback",
+  "spec" => "artifact.spec",
+  "product-overview" => "artifact.product-overview",
+  "functional-architecture" => "artifact.functional-architecture",
+  "low-fidelity-prototype" => "artifact.low-fidelity-prototype",
+  "state-matrix" => "artifact.state-matrix",
+  "high-fidelity-html-prototype" => "artifact.high-fidelity-html-prototype",
+  "user-confirmation" => "gate.user-confirmation",
+  "openapi-draft" => "artifact.openapi-draft",
+  "draft-review" => "gate.openapi-draft-reviewed",
+  "design-review" => "gate.design-reviewed",
+  "openapi-freeze" => "gate.openapi-frozen",
+  "engineering-baseline" => "artifact.engineering-baseline",
+  "architecture-review" => "artifact.architecture-review",
+  "data-architecture" => "artifact.data-architecture",
+  "spec-delta" => "artifact.spec-delta",
+  "parent-ticket" => "artifact.parent-ticket",
+  "vertical-slice-tickets" => "artifact.vertical-slice-ticket"
+}.freeze
 
 def route(facts)
   if facts.fetch(:repository_mode) == "template-source"
@@ -19,7 +54,10 @@ def route(facts)
   end
 
   gates = %w[impact-assessment tracker-sync fresh-verification]
-  return gates if facts.fetch(:scale) == :small && !facts.fetch(:high_risk)
+  small_change = facts.fetch(:scale) == :small && !facts.fetch(:high_risk) &&
+                 !facts.fetch(:ui_impact) && !facts.fetch(:api_impact) &&
+                 !facts.fetch(:backend_impact) && !facts.fetch(:data_impact)
+  return gates if small_change
 
   gates.concat(%w[spec product-overview functional-architecture])
 
@@ -32,7 +70,7 @@ def route(facts)
     ])
   end
 
-  gates.concat(%w[openapi-draft design-review openapi-freeze]) if facts.fetch(:api_impact)
+  gates.concat(%w[openapi-draft draft-review design-review openapi-freeze]) if facts.fetch(:api_impact)
 
   if facts.fetch(:backend_impact) || facts.fetch(:high_risk)
     gates.concat(%w[engineering-baseline architecture-review])
@@ -65,6 +103,16 @@ scenarios = [
     required: %w[spec product-overview functional-architecture openapi-draft engineering-baseline parent-ticket vertical-slice-tickets],
     forbidden: %w[low-fidelity-prototype state-matrix high-fidelity-html-prototype user-confirmation spec-delta]
   },
+  {
+    name: "普通 API 功能无需专项输入",
+    facts: {
+      repository_mode: "project-instance", scale: :small, high_risk: false,
+      ui_impact: false, api_impact: true, backend_impact: true,
+      data_impact: false, existing_frozen_baseline: false
+    },
+    required: %w[spec product-overview functional-architecture openapi-draft draft-review openapi-freeze engineering-baseline parent-ticket vertical-slice-tickets],
+    forbidden: %w[low-fidelity-prototype state-matrix high-fidelity-html-prototype user-confirmation spec-delta]
+  },
   {
     name: "有 UI 的新功能",
     facts: {
@@ -107,12 +155,22 @@ scenarios.each do |scenario|
   failures << "#{scenario.fetch(:name)} 错误触发: #{unexpected.join(', ')}" unless unexpected.empty?
 end
 
+route_keys = scenarios.flat_map { |scenario| scenario.fetch(:required) + scenario.fetch(:forbidden) }.uniq
+route_keys.each do |route_key|
+  registry_id = ROUTE_REGISTRY_IDS[route_key]
+  failures << "生命周期场景 route key 未映射稳定 ID: #{route_key}" unless registry_id
+  failures << "生命周期场景 route key 映射到不存在的稳定 ID: #{route_key} -> #{registry_id}" if registry_id && !REGISTRY_IDS.include?(registry_id)
+end
+
 semantic_markers = {
   "AGENTS.md" => [
-    "21 个门禁全部是条件强制门禁",
+    "生命周期注册表中的条件门禁全部按影响面强制",
     "只要进入 Spec 基线",
     "才构成产品设计影响",
     "Spec Delta 只记录相对既有冻结 Spec 基线",
+    "安全 / 权限不设独立生命周期资料或专属门禁",
+    "普通 action 注册",
+    "SQL / DDL / 迁移和上传 / 下载本身不构成安全 / 权限专项",
     "template-source",
     "apps/backend/<project>/",
     "apps/frontend/<project>/",
@@ -126,7 +184,17 @@ semantic_markers = {
     "不生成空文档",
     "最近可信阶段",
     "同一独立执行者",
-    "集中 checkpoint"
+    "集中 checkpoint",
+    "安全 / 权限不单独分诊",
+    "不自动升级为安全专项"
+  ],
+  "docs/process/lifecycle-artifact-map.md" => [
+    "安全 / 权限不形成独立门禁",
+    "按实际 UI、API、Backend、Data、High-risk 影响"
+  ],
+  ".agents/skills/yss-product-lifecycle/references/artifact-dependencies.md" => [
+    "不使用独立影响类型",
+    "不增加安全 / 权限传播"
   ],
   "docs/process/implementation-repo-integration.md" => [
     "apps/backend/<project>/",
@@ -171,7 +239,7 @@ unless failures.empty?
   exit 1
 end
 
-puts "五类生命周期压力场景验证通过"
+puts "六类生命周期压力场景验证通过"
 
 skill_root = ROOT.join(".agents/skills/yss-product-lifecycle")
 skill = skill_root.join("SKILL.md").read
@@ -235,7 +303,7 @@ reference_markers = {
   ]
 }.freeze
 
-removed_skills = %w[code-review-process yss-domain-modeling]
+removed_skills = %w[code-review-process yss-domain-modeling yss-openapi]
 removed_skills.each do |skill_name|
   failures << "已移除 skill 仍存在: #{skill_name}" if ROOT.join(".agents/skills", skill_name).exist?
 end
@@ -250,7 +318,8 @@ tracked_policy_files = [
 tracked_policy_files.each do |relative_path|
   body = ROOT.join(relative_path).read
   removed_skills.each do |skill_name|
-    failures << "#{relative_path} 仍引用已移除 skill: #{skill_name}" if body.include?(skill_name)
+    pattern = Regexp.new("(?<![a-z0-9-])#{Regexp.escape(skill_name)}(?![a-z0-9-])")
+    failures << "#{relative_path} 仍引用已移除 skill: #{skill_name}" if body.match?(pattern)
   end
 end
 
@@ -421,8 +490,9 @@ ready_required.each do |condition|
 end
 
 propagation = contract.fetch("impact_propagation")
-expected_types = %w[wording ui-state permission api-schema state-machine data-model service-boundary nfr deployment security]
+expected_types = %w[wording ui-state api-schema state-machine data-model service-boundary nfr deployment]
 failures << "影响类型不完整" unless (expected_types - propagation.keys).empty?
+failures << "安全 / 权限仍作为独立传播类型" unless (propagation.keys & %w[permission security]).empty?
 
 allowed_conditions = %w[always existing_frozen_baseline ui_impact api_impact data_impact backend_impact]
 propagation.each do |impact_type, definition|
@@ -464,14 +534,41 @@ expected_types.each do |impact_type|
   failures << "#{impact_type} 可执行传播结果为空" if targets.nil? || targets.empty?
 end
 
-new_module_permission = propagated_targets(
+new_module_api = propagated_targets(
   propagation,
-  "permission",
+  "api-schema",
   all_impacts_context.merge("existing_frozen_baseline" => false)
 )
-failures << "新模块错误激活 spec-delta" if new_module_permission.any? { |target| target["name"] == "spec-delta" }
-unless new_module_permission.any? { |target| target["kind"] == "gate" && target["name"] == "openapi-freeze" }
-  failures << "permission API 影响未使 openapi-freeze gate stale"
+failures << "新模块错误激活 spec-delta" if new_module_api.any? { |target| target["name"] == "spec-delta" }
+unless new_module_api.any? { |target| target["kind"] == "gate" && target["name"] == "openapi-freeze" }
+  failures << "普通 API 影响未使 openapi-freeze gate stale"
+end
+
+legacy_posture_key = %w[security permission posture].join("_")
+failures << "生命周期合同仍要求已废弃的专项输入" if contract.key?(legacy_posture_key)
+ordinary_route = route(
+  repository_mode: "project-instance", scale: :medium, high_risk: false,
+  ui_impact: true, api_impact: true, backend_impact: true,
+  data_impact: false, existing_frozen_baseline: false
+)
+%w[openapi-draft openapi-freeze engineering-baseline].each do |gate|
+  failures << "普通功能错误移除 #{gate} 门禁" unless ordinary_route.include?(gate)
+end
+
+data_targets = propagated_targets(propagation, "data-model", all_impacts_context)
+failures << "SQL / DDL 未按普通数据影响传播" unless data_targets.any? { |target| target["name"] == "data-architecture" }
+api_targets = propagated_targets(propagation, "api-schema", all_impacts_context)
+failures << "下载接口未按普通 API 影响传播" unless api_targets.any? { |target| target["name"] == "openapi-draft" }
+
+seam_required = contract.fetch("seam_deferred_required")
+def seam_field_filled?(value)
+  value.is_a?(Array) ? !value.empty? : !value.to_s.empty?
+end
+valid_seam = seam_required.to_h { |field| [field, "value"] }
+failures << "完整 seam-deferred 证据被错误阻断" unless seam_required.all? { |field| seam_field_filled?(valid_seam[field]) }
+%w[owner follow_up_ticket target_version_or_release_date].each do |field|
+  mutation = valid_seam.reject { |key, _| key == field }
+  failures << "seam-deferred 缺少 #{field} 时未阻断" if seam_required.all? { |required_field| seam_field_filled?(mutation[required_field]) }
 end
 
 no_api_ui = propagated_targets(
@@ -488,11 +585,11 @@ unless unknown_decision == {"action" => "pause", "reason_code" => "impact-classi
   failures << "未知 impact type 未返回结构化暂停"
 end
 
-permission_gate_stale = new_module_permission.any? { |target| target["kind"] == "gate" }
-permission_artifact_stale = new_module_permission.any? { |target| target["kind"] == "artifact" }
+api_gate_stale = new_module_api.any? { |target| target["kind"] == "gate" }
+api_artifact_stale = new_module_api.any? { |target| target["kind"] == "artifact" }
 linked_ready_facts = ready_slice.merge(
-  "gates_satisfied" => !permission_gate_stale,
-  "no_stale_artifacts" => !permission_artifact_stale
+  "gates_satisfied" => !api_gate_stale,
+  "no_stale_artifacts" => !api_artifact_stale
 )
 failures << "传播后未撤销 ready-for-agent" if ready_for_agent?(ready_required, linked_ready_facts)
 

package/template/scripts/verify-matt-yss-integration-scenarios

@@ -3,6 +3,7 @@
 
 require "pathname"
 require "yaml"
+require "digest"
 
 ROOT = Pathname.new(__dir__).join("..").realpath
 
@@ -76,6 +77,46 @@ def flow_decision(definition, repository_mode:, flow:)
   {"result" => "allowed", "reason" => nil}
 end
 
+def git_operation_authorized?(definition, facts)
+  return false unless definition["requires_explicit_user_authorization"] == true
+  return false unless definition["authorized_value"] == true
+
+  required = definition.fetch("required", [])
+  return false unless required.all? { |field| facts.key?(field) }
+
+  authorization_fields = required.grep(/_authorized\z/)
+  return false unless authorization_fields.all? { |field| facts[field] == definition["authorized_value"] }
+
+  definition.fetch("non_empty", []).all? { |field| !facts.fetch(field, "").to_s.empty? }
+end
+
+def uint64be(value)
+  [value].pack("Q>")
+end
+
+def uint32be(value)
+  [value].pack("N")
+end
+
+def canonical_worktree_candidate_stream(snapshot, tracked_diff:, untracked:)
+  header = snapshot.fetch("header_ascii").b + [Integer(snapshot.fetch("terminator_byte"))].pack("C")
+  tracked = snapshot.fetch("tracked_record")
+  stream = header + [Integer(tracked.fetch("type_byte"))].pack("C") + uint64be(tracked_diff.bytesize) + tracked_diff
+  kinds = snapshot.fetch("untracked_record").fetch("entry_kinds")
+
+  untracked.sort_by { |entry| entry.fetch(:path).b }.each do |entry|
+    path = entry.fetch(:path).b
+    content = entry.fetch(:content).b
+    kind = entry.fetch(:kind).to_s
+    stream << [Integer(snapshot.fetch("untracked_record").fetch("type_byte"))].pack("C")
+    stream << uint64be(path.bytesize) << path
+    stream << uint32be(entry.fetch(:mode))
+    stream << [Integer(kinds.fetch(kind))].pack("C")
+    stream << uint64be(content.bytesize) << content
+  end
+  stream
+end
+
 entry = contract.fetch("entry_routing", {})
 require_equal(failures, "entry manifest", entry["manifest"], "yss-project.yaml")
 require_equal(failures, "entry valid modes", entry["valid_modes"], %w[template-source project-instance])
@@ -196,6 +237,222 @@ ready_required = contract.dig("ready_for_agent", "required") || []
 (preconditions.dig("implement", "required") || []).reject { |field| field == "ready_for_agent" }.each do |field|
   require_include(failures, "ready-for-agent 与 implement 前置条件", ready_required, field)
 end
+
+ticket_role_transition = contract.fetch("ticket_role_transition", {})
+require_equal(
+  failures,
+  "YSS to-tickets initial role",
+  ticket_role_transition.dig("yss_active", "to_tickets_initial_role"),
+  "ready-for-human"
+)
+require_equal(
+  failures,
+  "YSS ticket promotion owner",
+  ticket_role_transition.dig("yss_active", "promotion_owner"),
+  "yss-product-lifecycle"
+)
+require_equal(
+  failures,
+  "YSS ticket promoted role",
+  ticket_role_transition.dig("yss_active", "promoted_role"),
+  "ready-for-agent"
+)
+require_equal(
+  failures,
+  "YSS ticket promotion condition",
+  ticket_role_transition.dig("yss_active", "promotion_requires"),
+  "ready_for_agent"
+)
+
+review_input = contract.fetch("review_input", {})
+require_equal(failures, "review input schema", review_input["schema_version"], 1)
+%w[
+  review_mode
+  review_base_ref
+  implementation_candidate_ref
+  candidate_snapshot_ref
+  candidate_digest
+  spec_ref
+  ticket_ref
+  slice_contract_ref
+  build_architecture_checklist_ref
+  yss_execution_result_refs
+].each do |field|
+  require_include(failures, "review input required fields", review_input["required"] || [], field)
+end
+%w[committed worktree].each do |mode|
+  require_include(failures, "review modes", review_input["modes"] || [], mode)
+end
+%w[committed staged unstaged untracked].each do |candidate_part|
+  require_include(
+    failures,
+    "worktree review coverage",
+    review_input.dig("worktree", "required_coverage") || [],
+    candidate_part
+  )
+end
+require_equal(
+  failures,
+  "worktree untracked inventory",
+  review_input.dig("worktree", "untracked_inventory_command"),
+  "git ls-files -z --others --exclude-standard"
+)
+require_equal(
+  failures,
+  "worktree tracked binary diff",
+  review_input.dig("worktree", "tracked_diff_command"),
+  "git diff --no-ext-diff --binary --full-index <merge-base>"
+)
+require_equal(
+  failures,
+  "worktree untracked binary diff",
+  review_input.dig("worktree", "untracked_diff_command"),
+  "git diff --no-index --no-ext-diff --binary --full-index -- /dev/null <path>"
+)
+require_equal(failures, "worktree capture once", review_input.dig("worktree", "capture_once"), true)
+require_equal(failures, "worktree verify unchanged", review_input.dig("worktree", "verify_unchanged_after_review"), true)
+require_equal(failures, "review snapshot immutable", review_input.dig("snapshot", "immutable"), true)
+require_equal(failures, "review digest algorithm", review_input.dig("snapshot", "digest_algorithm"), "sha256")
+require_equal(
+  failures,
+  "review digest framing",
+  review_input.dig("snapshot", "digest_framing"),
+  "length-prefixed-path-and-bytes"
+)
+require_equal(failures, "review digest path order", review_input.dig("snapshot", "path_order"), "bytewise")
+require_equal(failures, "review digest change action", review_input.dig("snapshot", "on_digest_change"), "blocked")
+require_equal(failures, "review completion digest guard", review_input.dig("snapshot", "completion_requires_current_digest"), true)
+require_equal(failures, "review snapshot protocol", review_input.dig("snapshot", "protocol"), "yss-worktree-candidate-v1")
+require_equal(failures, "review snapshot path encoding", review_input.dig("snapshot", "path_encoding"), "raw-bytes")
+require_equal(failures, "review snapshot length encoding", review_input.dig("snapshot", "length_encoding"), "uint64-big-endian")
+require_equal(failures, "review snapshot header", review_input.dig("snapshot", "header_ascii"), "YSS-WORKTREE-CANDIDATE-V1")
+require_equal(failures, "review snapshot terminator", review_input.dig("snapshot", "terminator_byte"), "0x00")
+require_equal(failures, "review snapshot tracked record", review_input.dig("snapshot", "tracked_record", "type_byte"), "0x54")
+require_equal(failures, "review snapshot untracked record", review_input.dig("snapshot", "untracked_record", "type_byte"), "0x55")
+require_equal(failures, "review snapshot unsupported entry action", review_input.dig("snapshot", "unsupported_entry_action"), "blocked")
+require_equal(
+  failures,
+  "review snapshot tracked fields",
+  review_input.dig("snapshot", "tracked_record", "fields"),
+  %w[type_byte uint64be_content_length binary_diff_bytes]
+)
+require_equal(
+  failures,
+  "review snapshot untracked fields",
+  review_input.dig("snapshot", "untracked_record", "fields"),
+  %w[type_byte uint64be_path_length raw_path_bytes uint32be_file_mode entry_kind_byte uint64be_content_length content_bytes]
+)
+require_equal(
+  failures,
+  "review snapshot entry kinds",
+  review_input.dig("snapshot", "untracked_record", "entry_kinds"),
+  {"regular" => "0x52", "symlink" => "0x4c"}
+)
+fixture_tracked_diff = "COMMITTED\\nSTAGED\\nUNSTAGED\\nDELETE\\nMODE-CHANGE\\n".b
+fixture_untracked = [
+  {path: "z\\nname".b, mode: 0o100644, kind: :regular, content: "untracked-bytes\\n".b},
+  {path: "a-link".b, mode: 0o120777, kind: :symlink, content: "target\\nname".b}
+]
+fixture_stream = canonical_worktree_candidate_stream(
+  review_input.fetch("snapshot"),
+  tracked_diff: fixture_tracked_diff,
+  untracked: fixture_untracked
+)
+require_equal(
+  failures,
+  "review snapshot canonical digest",
+  Digest::SHA256.hexdigest(fixture_stream),
+  "cc1b30990cc0d2a11721140cd94cb92a275f9dd24c6663e21ad7e5ea47898b7d"
+)
+reordered_stream = canonical_worktree_candidate_stream(
+  review_input.fetch("snapshot"),
+  tracked_diff: fixture_tracked_diff,
+  untracked: fixture_untracked.reverse
+)
+require_equal(failures, "review snapshot bytewise ordering", reordered_stream, fixture_stream)
+review_return_digest = Digest::SHA256.hexdigest(fixture_stream)
+completion_digest = Digest::SHA256.hexdigest(fixture_stream)
+require_equal(failures, "review return digest guard", review_return_digest, Digest::SHA256.hexdigest(fixture_stream))
+require_equal(failures, "review completion digest guard behavior", completion_digest, Digest::SHA256.hexdigest(fixture_stream))
+drift_stream = canonical_worktree_candidate_stream(
+  review_input.fetch("snapshot"),
+  tracked_diff: fixture_tracked_diff,
+  untracked: fixture_untracked.map { |entry| entry.merge(content: entry[:content] + "changed".b) }
+)
+failures << "review return digest drift 未阻断" if Digest::SHA256.hexdigest(drift_stream) == review_return_digest
+failures << "review completion digest drift 未阻断" if Digest::SHA256.hexdigest(drift_stream) == completion_digest
+%w[merge_base tracked_diff_command untracked_inventory_command untracked_diff_command untracked_files commit_list_command].each do |field|
+  require_include(
+    failures,
+    "worktree manifest required fields",
+    review_input.dig("manifest_required_by_mode", "worktree") || [],
+    field
+  )
+end
+%w[merge_base tracked_diff_command commit_list_command].each do |field|
+  require_include(
+    failures,
+    "committed manifest required fields",
+    review_input.dig("manifest_required_by_mode", "committed") || [],
+    field
+  )
+end
+
+git_authorization = contract.fetch("git_authorization", {})
+{
+  "commit" => %w[commit_authorized commit_scope commit_authorization_ref],
+  "push" => %w[push_authorized push_scope push_authorization_ref]
+}.each do |operation, required_fields|
+  require_equal(
+    failures,
+    "#{operation} explicit authorization",
+    git_authorization.dig(operation, "requires_explicit_user_authorization"),
+    true
+  )
+  required_fields.each do |field|
+    require_include(failures, "#{operation} authorization fields", git_authorization.dig(operation, "required") || [], field)
+  end
+  require_equal(
+    failures,
+    "#{operation} authorization value",
+    git_authorization.dig(operation, "authorized_value"),
+    true
+  )
+  required_fields.reject { |field| field.end_with?("_authorized") }.each do |field|
+    require_include(
+      failures,
+      "#{operation} non-empty authorization fields",
+      git_authorization.dig(operation, "non_empty") || [],
+      field
+    )
+  end
+  require_equal(
+    failures,
+    "#{operation} unauthorized action",
+    git_authorization.dig(operation, "unauthorized_action"),
+    "checkpoint-only"
+  )
+
+  definition = git_authorization.fetch(operation, {})
+  valid_facts = required_fields.to_h do |field|
+    [field, field.end_with?("_authorized") ? true : "explicit-value"]
+  end
+  allowed = git_operation_authorized?(definition, valid_facts)
+  failures << "#{operation} 完整显式授权被错误阻断" unless allowed
+
+  false_authorization = valid_facts.merge("#{operation}_authorized" => false)
+  false_allowed = git_operation_authorized?(definition, false_authorization)
+  failures << "#{operation} authorized=false 未阻断" if false_allowed
+
+  required_fields.reject { |field| field.end_with?("_authorized") }.each do |field|
+    blank = valid_facts.merge(field => "")
+    blank_allowed = git_operation_authorized?(definition, blank)
+    failures << "#{operation} #{field} 为空时未阻断" if blank_allowed
+  end
+
+  false_contract = definition.merge("authorized_value" => false)
+  failures << "#{operation} authorized_value=false 未阻断" if git_operation_authorized?(false_contract, valid_facts)
+end
 {
   "to-spec" => %w[user_problem mvp_and_non_goals success_criteria test_seam terminology_review]
 }.each do |flow, required|
@@ -447,6 +704,7 @@ end
 
 adapter = read(ROOT, ".agents/skills/yss-product-lifecycle/references/matt-yss-adapter.md")
 to_spec = read(ROOT, ".agents/skills/to-spec/SKILL.md")
+code_review = read(ROOT, ".agents/skills/code-review/SKILL.md")
 require_markers(
   failures,
   "Matt to-spec core contract",
@@ -466,17 +724,55 @@ require_markers(
     "发布提示由本适配层覆盖为 `ready-for-human`",
     "to-spec",
     "to-tickets",
+    "YSS active 的 `to-tickets`",
+    "`review_mode`",
+    "`commit_authorized`",
+    "`push_authorized`",
     "Release",
     "Retrospective"
   ]
 )
+require_markers(
+  failures,
+  "Matt code-review candidate modes",
+  code_review,
+  [
+    "Committed candidate",
+    "Worktree candidate",
+    "git diff --no-ext-diff --binary --full-index <merge-base>",
+    "git diff --no-index --no-ext-diff --binary --full-index -- /dev/null <path>",
+    "git ls-files -z --others --exclude-standard",
+    "staged",
+    "unstaged",
+    "untracked",
+    "candidate manifest",
+    "captured candidate",
+    "yss-worktree-candidate-v1",
+    "unsigned 64-bit big-endian",
+    "candidate_digest",
+    "stale candidate",
+    "immutable",
+    "length-prefixed",
+    "bytewise path order",
+    "return `blocked`"
+  ]
+)
 
 lifecycle_skill = read(ROOT, ".agents/skills/yss-product-lifecycle/SKILL.md")
 require_markers(
   failures,
   "lifecycle template-source guard",
   lifecycle_skill,
-  ["template-source", "必须返回 `blocked`", "template-source-product-artifact-forbidden", "YSS active 调用 `to-spec` 时", "ready-for-agent` 发布提示归一化为 Spec `ready-for-human`"]
+  [
+    "template-source",
+    "必须返回 `blocked`",
+    "template-source-product-artifact-forbidden",
+    "YSS active 调用 `to-spec` 时",
+    "ready-for-agent` 发布提示归一化为 Spec `ready-for-human`",
+    "YSS active 调用 `to-tickets` 时",
+    "`commit_authorized`",
+    "`push_authorized`"
+  ]
 )
 orchestration = read(ROOT, ".agents/skills/yss-product-lifecycle/references/orchestration.md")
 require_markers(