create-yss-spec 2.1.3 → 2.1.5

package/template/.pi/skills/yss-product-lifecycle/references/orchestration-contract.yaml

@@ -68,16 +68,90 @@ flow_preconditions:
   to-tickets:
     required: [openapi_freeze_or_no_api_impact, required_gates_satisfied, vertical_slice_scope, blocking_edges]
     output: vertical-slice-tickets
+    output_role: ready-for-human
   implement:
     required: [ready_for_agent, slice_contract_approved, slice_contract_persisted, slice_contract_current_version, build_architecture_checklist, implementation_repo, implementation_branch, ci, verification_commands, rollback_point, backend_slice_contract_if_applicable, backend_scaffold_policy_satisfied]
     applies_to_single_session: true
 
+ticket_role_transition:
+  yss_active:
+    to_tickets_initial_role: ready-for-human
+    promotion_owner: yss-product-lifecycle
+    promoted_role: ready-for-agent
+    promotion_requires: ready_for_agent
+
+review_input:
+  schema_version: 1
+  required: [review_mode, review_base_ref, implementation_candidate_ref, candidate_snapshot_ref, candidate_digest, spec_ref, ticket_ref, slice_contract_ref, build_architecture_checklist_ref, yss_execution_result_refs]
+  nullable: [spec_ref]
+  modes: [committed, worktree]
+  committed:
+    candidate_ref: HEAD
+    diff_scope: merge-base-to-head
+  worktree:
+    candidate_ref: working-tree
+    diff_scope: merge-base-to-working-tree
+    required_coverage: [committed, staged, unstaged, untracked]
+    tracked_diff_command: git diff --no-ext-diff --binary --full-index <merge-base>
+    untracked_inventory_command: git ls-files -z --others --exclude-standard
+    untracked_files_encoding: nul-delimited-raw-path-bytes
+    untracked_diff_command: git diff --no-index --no-ext-diff --binary --full-index -- /dev/null <path>
+    capture_once: true
+    verify_unchanged_after_review: true
+  manifest_required_by_mode:
+    committed: [merge_base, tracked_diff_command, commit_list_command]
+    worktree: [merge_base, tracked_diff_command, untracked_inventory_command, untracked_diff_command, untracked_files, commit_list_command]
+  snapshot:
+    immutable: true
+    protocol: yss-worktree-candidate-v1
+    digest_algorithm: sha256
+    digest_framing: length-prefixed-path-and-bytes
+    path_order: bytewise
+    path_encoding: raw-bytes
+    length_encoding: uint64-big-endian
+    header_ascii: YSS-WORKTREE-CANDIDATE-V1
+    terminator_byte: "0x00"
+    tracked_record:
+      type_byte: "0x54"
+      fields: [type_byte, uint64be_content_length, binary_diff_bytes]
+      source: tracked_diff_command_stdout
+    untracked_record:
+      type_byte: "0x55"
+      fields: [type_byte, uint64be_path_length, raw_path_bytes, uint32be_file_mode, entry_kind_byte, uint64be_content_length, content_bytes]
+      order: bytewise-raw-path
+      entry_kinds: {regular: "0x52", symlink: "0x4c"}
+      regular_content_source: file_bytes
+      symlink_content_source: link_target_bytes
+    unsupported_entry_action: blocked
+    snapshot_artifact:
+      identity: candidate_digest
+      required: [candidate-manifest.yaml, tracked.diff, untracked/]
+      access: immutable-read-only
+    on_digest_change: blocked
+    completion_requires_current_digest: true
+
+git_authorization:
+  commit:
+    requires_explicit_user_authorization: true
+    required: [commit_authorized, commit_scope, commit_authorization_ref]
+    authorized_value: true
+    non_empty: [commit_scope, commit_authorization_ref]
+    unauthorized_action: checkpoint-only
+  push:
+    requires_explicit_user_authorization: true
+    required: [push_authorized, push_scope, push_authorization_ref]
+    authorized_value: true
+    non_empty: [push_scope, push_authorization_ref]
+    unauthorized_action: checkpoint-only
+
+seam_deferred_required: [risk, owner, follow_up_ticket, verification_plan, target_version_or_release_date]
+
 backend_scaffold:
   applies_when: [backend_impact]
   scaffold_statuses: [existing, required, initialized]
   required_status: required
   sequence:
-    after: [prototype_confirmation, engineering_baseline]
+    after: [prototype_review, prototype_verification, antd_cli_verification, browser_verification, prototype_confirmation, engineering_baseline]
     before_generator: [yss-router-scaffold-contract, lifecycle-approve-scaffold-contract]
     before: [business_code_generation, implement]
   generator_skill: yss-ddd-scaffold-generator
@@ -115,7 +189,7 @@ scaffold_work_unit_policy:
   scope: pre_business_code_generation
   required: [approved_scaffold_contract, primary_yss_skill, allowed_write_paths, expected_evidence_files, verification_commands]
   controlled_generation:
-    allowed_for: [project_scaffold, pom, mechanical_config, wrapper, smart_doc_baseline]
+    allowed_for: [project_scaffold, pom, mechanical_config, wrapper]
     forbidden_when: [business_behavior, business_fields, business_state, permission, transaction, complex_query, error_mapping, business_example_crud]
   on_violation: blocked
 
@@ -195,19 +269,6 @@ impact_propagation:
       - {kind: artifact, name: openapi-draft, level: transitive, when: api_impact}
       - {kind: gate, name: openapi-freeze, level: transitive, when: api_impact}
       - {kind: artifact, name: vertical-slice-tickets, level: transitive, when: always}
-  permission:
-    targets:
-      - {kind: artifact, name: spec, level: direct, when: always}
-      - {kind: artifact, name: spec-delta, level: direct, when: existing_frozen_baseline}
-      - {kind: artifact, name: product-design, level: direct, when: ui_impact}
-      - {kind: gate, name: requirement-freeze, level: direct, when: always}
-      - {kind: artifact, name: openapi-draft, level: transitive, when: api_impact}
-      - {kind: gate, name: draft-review, level: transitive, when: api_impact}
-      - {kind: gate, name: design-review, level: transitive, when: always}
-      - {kind: gate, name: openapi-freeze, level: transitive, when: api_impact}
-      - {kind: artifact, name: vertical-slice-tickets, level: transitive, when: always}
-      - {kind: artifact, name: implementation-contract, level: transitive, when: always}
-      - {kind: artifact, name: test-mapping, level: transitive, when: always}
   api-schema:
     targets:
       - {kind: artifact, name: spec, level: direct, when: always}
@@ -263,20 +324,6 @@ impact_propagation:
       - {kind: artifact, name: rollback-plan, level: direct, when: always}
       - {kind: gate, name: design-review, level: transitive, when: always}
       - {kind: artifact, name: release-plan, level: transitive, when: always}
-  security:
-    targets:
-      - {kind: artifact, name: spec, level: direct, when: always}
-      - {kind: artifact, name: spec-delta, level: direct, when: existing_frozen_baseline}
-      - {kind: artifact, name: product-design, level: direct, when: ui_impact}
-      - {kind: artifact, name: system-architecture, level: direct, when: always}
-      - {kind: artifact, name: data-architecture, level: direct, when: data_impact}
-      - {kind: gate, name: requirement-freeze, level: direct, when: always}
-      - {kind: gate, name: architecture-review, level: direct, when: always}
-      - {kind: artifact, name: openapi-draft, level: transitive, when: api_impact}
-      - {kind: gate, name: openapi-freeze, level: transitive, when: api_impact}
-      - {kind: artifact, name: vertical-slice-tickets, level: transitive, when: always}
-      - {kind: artifact, name: release-plan, level: transitive, when: always}
-
 prototype_return_evidence:
   required: [prototype_mode, source_handoff, prototype_asset_or_run, conclusion, updated_authoritative_asset, remaining_questions, return_handoff]
   allowed_modes: [matt_logic, yss_high_fidelity]
@@ -313,7 +360,7 @@ prototype_modes:
     replaces_yss_high_fidelity: false
   yss_high_fidelity:
     asset: ant_design_v6_html
-    required: [prototype_mode, prototype_review, antd_cli_verification, user_confirmation]
+    required: [prototype_mode, prototype_review, antd_cli_verification, browser_verification, prototype_evidence, user_confirmation]
     purpose: product_design_review
     replaces_matt_logic: false
 

package/template/.pi/skills/yss-product-lifecycle/references/orchestration.md

@@ -52,20 +52,25 @@ tracker 选择和冲突按 `docs/agents/issue-tracker.md` 裁决：已持久化
 ## Matt flow 进入条件
 
 - `to-spec` 只能在 `grill-with-docs` 退出条件满足且没有未回流 runnable blocker 时进入；产物默认为 `ready-for-human`。
-- `to-tickets` 只能在 OpenAPI Freeze 或无 API 影响记录完成后进入，并且只能生成垂直切片 Ticket。
+- `to-tickets` 只能在 OpenAPI Freeze 或无 API 影响记录完成后进入，并且只能生成垂直切片 Ticket；YSS active 下初始角色统一为 `ready-for-human`，不得沿用 Matt 的通用 `ready-for-agent` 默认值。
 - `implement` 无论是多会话还是单会话，都必须满足 `ready-for-agent` 公式、批准并持久化的 Slice Implementation Contract 和 Build Architecture Checklist。
 - `implement` 遇到 backend `scaffold_status=required` 时，还必须满足原型确认后的脚手架策略：脚手架 Execution Result、`yss-backend-scaffold-parent` 基线、Wrapper 验证和 Router 合同重编译均已回写；否则停在工程基线，不得写业务代码。
 - Matt Result 出现 `drift`、`new_impacts`、`stale_candidates`、`violation`、`missing_evidence`、空 `evidence_refs` 或缺少必需字段时暂停当前工作单元。
 
 ## 审查与验证
 
+- 调用 `code-review` 前先固定 review input：`review_mode`、`review_base_ref`、`implementation_candidate_ref`、`candidate_snapshot_ref`、`candidate_digest`、Spec/Ticket、Slice Implementation Contract、Build Architecture Checklist 和 YSS Skill Execution Result 引用。`committed` 模式审查不可变 `HEAD`；`worktree` 模式一次捕获 committed、staged、unstaged 和 untracked 内容。必须按 `orchestration-contract.yaml.review_input` 的 manifest 按模式必填字段及 `yss-worktree-candidate-v1` 字节流（raw path、uint64 big-endian 长度、tracked/untracked record）计算 SHA-256，两个 Reviewer 必须消费同一不可变快照。返回后或完成 checkpoint 摘要变化时返回 `blocked`，由编排器决定重新审查。候选为空、漏项或 fixed point 不可解析时阻断。
 - 小改动和中等变更可由同一独立执行者完成 `code-review` 与 fresh verification，并在同一报告中分别记录 findings、命令、结果和残余风险。
 - 该执行者必须独立于实现者；新模块、高风险变更、职责冲突或需双人控制时，Reviewer 与 Verifier 分开。
 - `code-review` 是唯一默认代码审查 skill。GitLab、CI、Sonar、Alibaba Java 等治理事实作为仓库规则或专项检查输入，不再叠加第二个通用审查 skill。
 
+## Git 授权
+
+实现授权、`orchestrate`/`resume` 的有界写入、当前分支和 Git checkpoint 都不蕴含 commit 或 push 授权。执行 commit 前必须同时取得 `commit_authorized=true`、非空 `commit_scope` 和 `commit_authorization_ref`；执行 push 前必须同时取得 `push_authorized=true`、非空 `push_scope` 和 `push_authorization_ref`。任一缺失时只记录 checkpoint 判断并保持 Git 状态不变；负责人要求、时间压力、测试通过或“本地 commit 可逆”都不能补足用户授权。
+
 ## 必须暂停
 
-- Spec baseline、需求冻结、原型确认、OpenAPI Freeze、Architecture Review 或安全红线等待人工裁决。
+- Spec baseline、需求冻结、原型确认、OpenAPI Freeze 或 Architecture Review 等普通门禁等待人工裁决。
 - 需要目标仓库、外部凭据、发布窗口或其他新授权。
 - 状态与证据冲突且无法可靠重建。
 - 专项 skill 失败或返回不可验收结果。

package/template/.pi/skills/yss-product-lifecycle/references/state-model.md

@@ -50,6 +50,14 @@ AND 所有后续生成代码均绑定主 YSS skill、依赖闭包、允许写路
 
 父 Ticket、Spec、设计、原型、OpenAPI Draft、wayfinder map 和 decision ticket 不得使用 `ready-for-agent`。
 
+YSS active 调用 `to-tickets` 时，垂直切片初始角色固定为 `ready-for-human`。只有 `yss-product-lifecycle` 复算上述公式全部为真后，才能把它提升为 `ready-for-agent`；Matt `to-tickets` 的独立默认值不参与该裁决。
+
+## Review 与 Git 授权状态
+
+进入代码审查时保存 `review_mode`、`review_base_ref`、`implementation_candidate_ref`、`candidate_snapshot_ref`、`candidate_digest` 及 Spec、Ticket、合同、Checklist、YSS Execution Result 引用。`worktree` 候选必须一次捕获 committed、staged、unstaged 和 untracked 文件；manifest 的按模式必填字段以及 `yss-worktree-candidate-v1`（raw path、uint64 big-endian 长度、tracked/untracked record、symlink 和不支持条目）以 `orchestration-contract.yaml.review_input` 为唯一执行定义。两个 Reviewer 消费同一不可变快照；返回后或完成 checkpoint 摘要变化则返回 `blocked` 并重新审查。不新增生命周期状态，只把该清单作为审查证据。
+
+Git 动作分别保存 `commit_authorized`、`commit_scope`、`commit_authorization_ref`、`push_authorized`、`push_scope`、`push_authorization_ref`。只有授权值严格为 `true`、范围和用户授权引用均非空时才执行相应动作；缺失授权时保持工作区不变并记录 checkpoint 判断。
+
 ## 状态块
 
 状态块位于主 tracker 的功能父 Ticket；Local Markdown 使用 `docs/.scratch/<feature>/parent-ticket.md`，远程 tracker 使用 Issue 并在本地功能包保留引用。平台不可用时才位于 stage checkpoint。只保存索引、状态、引用和因果关系：

package/template/.pi/skills/yss-prototype-stage/SKILL.md

@@ -0,0 +1,40 @@
+---
+name: yss-prototype-stage
+description: Use when a YSS feature has product-design impact on a primary flow, navigation, state, recovery, permission experience, or UI-driven API contract and needs prototype assets before implementation readiness.
+---
+
+# YSS Prototype Stage
+
+把产品设计影响收敛为跨 Agent 一致的产物、证据和生命周期回流合同。它不替代 `yss-product-lifecycle` 的门禁裁决，也不把原型当作生产前端代码。
+
+## 进入条件与主入口
+
+- 先由 `yss-product-lifecycle` 判断产品设计影响；无行为变化的孤立视觉修复记录 `not-applicable`，不创建空资产。
+- Codex 的产出主入口是 `product-design:index`；其他 Agent 使用等价的产品设计能力，但必须产出本技能规定的相同资产和证据。能力或证据不能等价时，暂停并回到人工确认。
+- 旧 `product-design-prototype`、`wireframe-prototype`、`high-fidelity-html-prototype` 仅为兼容入口；从它们进入时立即回到本合同。
+
+## 资产与门禁顺序
+
+1. 以 Spec、产品总体设计和 `docs/design/design.md` 形成交互说明、低保真页面/流程与状态矩阵。
+2. 用 `prototype-review` 形成独立评审结论；未通过不得生成高保真或进入需求冻结。
+3. 通过 `product-design:index` 产出 `docs/.scratch/<feature>/design/prototypes/index.html`。
+4. 写入 `docs/.scratch/<feature>/verification/prototype-evidence.yaml`，完成 AntD CLI 与浏览器验证。
+5. 用户确认后，才可校准 Spec、分析 API 影响或进入 Router readiness。
+
+## 设计与 AntD 依据
+
+优先级固定为：官方 `design.md` 的上游默认 → `docs/design/design.md` 与项目 token 的 `project_design` 项目覆盖 → 当前功能的语义组件映射。不得用上游默认覆盖项目 token。
+
+使用官方 `antd` skill / CLI 查询事实，始终用 `--format json`，并记录实际 `antd`、CLI 和目标组件版本。至少保存 `antd design.md`、已选组件的 `info`/`demo`/`token`/`semantic` 查询和 `antd lint` 结果；目标版本存在时，将同一 `<target_antd_version>` 传给版本敏感查询，禁止在模板中固化某个 CLI 或组件版本。
+
+## 验证与回流
+
+`browser_verification` 至少覆盖非空渲染、主流程、一个失败/权限/冲突状态、桌面与窄屏视口和控制台错误；优先使用 Browser 或可执行浏览器自动化，Computer Use 只作人工交互补充。把路径、命令、版本、视口、结果和阻塞项写入证据清单。
+
+`gate.prototype-reviewed` 的证据是评审记录；`gate.prototype-verified` 的证据是 AntD CLI 与浏览器验证；`gate.user-confirmation` 的证据是确认记录。三者均不是实现授权。
+
+## 常见错误
+
+- 仅有截图或 HTML，却没有可复现的 CLI、浏览器和确认记录。
+- 把 `product-design:index` 或某个旧技能当作生命周期批准者。
+- 直接复制官方默认颜色、圆角或间距，忽略项目覆盖。

package/template/.pi/skills/yss-router/SKILL.md

@@ -30,7 +30,7 @@ description: Use when a YSS vertical slice is entering implementation, spans mul
 - API 变化必须回到生命周期 Draft/Review/Freeze；半成品 backend 不得冒充稳定 source of truth。
 - 后端端到端切片必须包含 Application；对象/POJO 影响按契约自动补 `mapstruct`、`lombok`、`alibaba-java-code-style`。
 - Harness 内实现路径必须落在 `apps/backend/<project>/` 或 `apps/frontend/<project>/` 的具体项目目录；`apps/backend/`、`apps/frontend/` 只能作为容器，`app/backend/`、`app/frontend/` 及其子路径一律阻断。外部实现仓库使用其登记的真实项目根路径。
-- 当前用户、审计事件、普通技术日志、请求校验、错误映射或加解密命中时，必须按 `router-contract.yaml` 的 `component_impact_routing` 补齐长尾 skill；不能只在 `boundaries.md` 中提及。
+- 当前用户、审计事件、普通技术日志、请求校验、错误映射或加解密命中时，必须按 `router-contract.yaml` 的 `component_impact_routing` 补齐长尾 skill；不能只在 `boundaries.md` 中提及。仅复用已经验证的平台认证 / 授权能力不算 component impact，不自动增加权限专项 skill。
 - 业务行为使用 `behavior-tdd`；只有机械脚手架/生成物可用 `controlled-generation`，并记录例外和验证。
 - 原型确认后若 backend `scaffold_status=required`，先由本 Router 按 `scaffold_contract_schema` 编译 `yss-ddd-scaffold-generator` 的 `controlled-generation` 工作单元合同 draft；合同必须带 `contract_id`、`contract_version`、Router draft、生命周期批准、持久化引用、允许写路径、预期证据和验证命令。经生命周期编排器批准并持久化后才能运行生成器，再由受控工作单元实际执行固定的 `./mvnw validate`、`./mvnw test`、`./mvnw package` 并记录逐条结果，随后加载 `yss-backend-scaffold-parent` 并重新编译业务合同；脚手架不承载业务行为。
 - 脚手架合同在 Router 阶段只能是 `draft` / `ready-for-lifecycle-review` / `blocked`；只有生命周期编排器可以把已持久化脚手架合同标记为 `approved`。脚手架合同只覆盖业务代码前的工程骨架工作单元；生成、基线校验和 Router 重编译完成后，它不能替代脚手架后的 Slice Implementation Contract。
@@ -42,7 +42,7 @@ description: Use when a YSS vertical slice is entering implementation, spans mul
 
 - 切片基线路由：生成完整合同和技能闭包。
 - 工作单元增量路由：绑定一个行为、主/辅 skills、TDD 模式、路径和证据。
-- 完整重路由：API/schema、权限、状态机、数据模型、仓库、写路径、skill、测试 seam 或架构约束发生实质变化时触发。
+- 完整重路由：API/schema、状态机、数据模型、仓库、写路径、skill、测试 seam 或架构约束发生实质变化时触发。实现中出现未冻结的新行为（包括明确的权限业务行为）统一写入 `new_impacts`，由生命周期按普通影响面重新分诊。
 
 ## 输出
 

package/template/.pi/skills/yss-router/references/router-contract.yaml

@@ -20,7 +20,7 @@ subcontract_statuses: [required, not-applicable]
 
 readiness:
   common: [spec, slice_ticket, architecture_review, build_architecture_checklist, implementation_repository, verification_commands]
-  ui_impact: [requirement_freeze, low_fidelity_review, high_fidelity_html, antd_cli_evidence, prototype_confirmation]
+  ui_impact: [requirement_freeze, low_fidelity_review, prototype_review, high_fidelity_html, prototype_verification, antd_cli_evidence, browser_verification_evidence, prototype_confirmation]
   api_impact: [openapi_freeze]
   no_api_impact: [no_api_impact_record]
   data_impact: [data_architecture]
@@ -33,13 +33,13 @@ routing_input_required:
   - lifecycle
   - implementation
   - acceptance
-impact_flags_required: [ui_impact, api_impact, no_api_impact, data_impact, backend_impact, cross_repo]
+impact_flags_required: [ui_impact, api_impact, no_api_impact, data_impact, backend_impact, cross_repo, existing_frozen_baseline]
 exclusive_flags:
   - [api_impact, no_api_impact]
 
 slice_contract_required:
   root: [schema_version, contract_id, contract_version, slice_id, status, lifecycle_refs, readiness, common, frontend, backend, contract, cross_repo, work_units]
-  lifecycle_refs: [spec, ticket, requirement_freeze, low_fidelity_review, high_fidelity_html, antd_cli_evidence, prototype_confirmation, openapi_freeze_or_no_impact, architecture_review, data_architecture, engineering_baseline, build_architecture_checklist, implementation_repository, frontend_repository, backend_repository, maven_wrapper]
+  lifecycle_refs: [spec, ticket, requirement_freeze, low_fidelity_review, prototype_review, high_fidelity_html, prototype_verification, antd_cli_evidence, browser_verification_evidence, prototype_confirmation, openapi_freeze_or_no_impact, architecture_review, data_architecture, engineering_baseline, build_architecture_checklist, implementation_repository, frontend_repository, backend_repository, maven_wrapper]
   readiness: [blockers, stale_inputs, not_applicable]
   common: [impacted_areas, implementation_path_policy, project_roots, required_skills, optional_skills, unavailable_skills, allowed_write_paths, forbidden_patterns, expected_evidence_files, verification_commands, human_review_points, full_reroute_triggers]
   frontend: [status, required_skills, approved_prototype_ref, state_matrix_ref, allowed_write_paths, component_test_seams, e2e_paths]
@@ -55,8 +55,11 @@ lifecycle_ref_by_readiness:
   implementation_repository: implementation_repository
   requirement_freeze: requirement_freeze
   low_fidelity_review: low_fidelity_review
+  prototype_review: prototype_review
   high_fidelity_html: high_fidelity_html
+  prototype_verification: prototype_verification
   antd_cli_evidence: antd_cli_evidence
+  browser_verification_evidence: browser_verification_evidence
   prototype_confirmation: prototype_confirmation
   openapi_freeze: openapi_freeze_or_no_impact
   no_api_impact_record: openapi_freeze_or_no_impact
@@ -91,7 +94,7 @@ scaffold_contract_schema:
   work_unit:
     required: [id, behavior, primary_skill, supporting_skills, tdd_mode, allowed_write_paths, expected_evidence, verification_commands, controlled_generation]
   generation_boundary:
-    allowed_for: [project_scaffold, pom, mechanical_config, wrapper, smart_doc_baseline]
+    allowed_for: [project_scaffold, pom, mechanical_config, wrapper]
     forbidden_when: [business_behavior, business_fields, business_state, permission, transaction, complex_query, error_mapping, business_example_crud]
   verification:
     commands: ["./mvnw validate", "./mvnw test", "./mvnw package"]
@@ -147,7 +150,7 @@ dependency_closure:
     when_form: [yss-formily]
     when_api: [api-integration]
   api-integration:
-    when_regeneration: [yss-openapi]
+    when_regeneration: [yss-openapi-governance]
 
 component_impact_values:
   - current-user-context
@@ -191,7 +194,6 @@ full_reroute_triggers:
   - scaffold-baseline-drift
   - api-schema-impact
   - database-schema-impact
-  - permission-impact
   - state-machine-impact
   - data-model-impact
   - new-write-path
@@ -209,7 +211,6 @@ reroute_destinations:
   scaffold-baseline-drift: stage7-scaffold-revalidation
   api-schema-impact: system-data-architecture-and-contract-review
   database-schema-impact: data-architecture-and-migration-review
-  permission-impact: spec-product-design-and-contract-review
   state-machine-impact: spec-system-data-and-contract-review
   data-model-impact: data-architecture-and-contract-review
   new-write-path: stage7-contract-recompile
@@ -242,7 +243,7 @@ execution_result_required:
   - deviations
   - new_impacts
   - not_applicable_reason
-seam_deferred_required: [risk, owner, follow_up_ticket, verification_plan]
+seam_deferred_required: [risk, owner, follow_up_ticket, verification_plan, target_version_or_release_date]
 deviation_required: [rule, reason, approval_ref]
 not_applicable_required: [item, reason]
 unavailable_skill_required: [skill, provider, fallback, resolution]

package/template/.pi/skills/yss-router/references/slice-implementation-contract.md

@@ -14,8 +14,11 @@ slice_contract:
     ticket:
     requirement_freeze:
     low_fidelity_review:
+    prototype_review:
     high_fidelity_html:
+    prototype_verification:
     antd_cli_evidence:
+    browser_verification_evidence:
     prototype_confirmation:
     openapi_freeze_or_no_impact:
     architecture_review:
@@ -107,4 +110,4 @@ work_unit:
     behavior_tests_after_generation: []
 ```
 
-`controlled_generation` 仅在 `tdd_mode: controlled-generation` 时必填；其他模式标记 `not-applicable`。API schema 与 database schema 分别触发契约或数据架构回退，不得用一个含糊的 schema 类型决定路线。
+`controlled_generation` 仅在 `tdd_mode: controlled-generation` 时必填；其他模式标记 `not-applicable`。明确写入需求的权限业务行为仍使用 `behavior-tdd`；API schema 与 database schema 分别触发契约或数据架构回退，不得用一个含糊的 schema 类型决定路线。

package/template/.pi/skills/yss-router/references/yss-skill-execution-result.md

@@ -33,6 +33,7 @@ execution_result:
       owner:
       follow_up_ticket:
       verification_plan:
+      target_version_or_release_date:
   deviations:
     - rule:
       reason:
@@ -51,7 +52,7 @@ Router 必须验证：
 2. `changed_files` 全部位于工作单元和切片允许路径内。
 3. `expected_evidence_files` 全部存在并能回指行为。
 4. 验证命令包含实际结果和时间；计划命令不算证据。
-5. `seam_deferred` 有风险、责任人、补齐 Ticket 和验证计划。
+5. `seam_deferred` 有风险、责任人、补齐 Ticket、验证计划和目标版本 / 发布日期。
 6. `new_impacts` 非空时暂停并重路由。
 7. `drift` 触发 Architecture Re-check；`violation` 阻断 build。
 8. `status: not-applicable` 必须填写 `not_applicable_reason`；其他状态保留字段但可为空。

package/template/.qoder/skills/code-review/SKILL.md

@@ -1,9 +1,9 @@
 ---
 name: code-review
-description: Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes — Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/spec asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to "review since X".
+description: Use when the user wants to review a branch, PR, committed candidate, uncommitted work-in-progress changes, or changes since a fixed point.
 ---
 
-Two-axis review of the diff between `HEAD` and a fixed point the user supplies:
+Two-axis review of a pinned candidate against a fixed point:
 
 - **Standards** — does the code conform to this repo's documented coding standards?
 - **Spec** — does the code faithfully implement the originating issue / spec?
@@ -14,20 +14,46 @@ The issue tracker should have been provided to you — run `/setup-matt-pocock-s
 
 ## Process
 
-### 1. Pin the fixed point
+### 1. Pin the fixed point and candidate
 
 Whatever the user said is the fixed point — a commit SHA, branch name, tag, `main`, `HEAD~5`, etc. If they didn't specify one, ask for it.
 
-Capture the diff command once: `git diff <fixed-point>...HEAD` (three-dot, so the comparison is against the merge-base). Also note the list of commits via `git log <fixed-point>..HEAD --oneline`.
+Choose one candidate mode from the request or an upstream review contract:
 
-Before going further, confirm the fixed point resolves (`git rev-parse <fixed-point>`) and the diff is non-empty. A bad ref or empty diff should fail here — not inside two parallel sub-agents.
+- **Committed candidate** — review committed branch/PR state. Capture `git diff <fixed-point>...HEAD` and `git log <fixed-point>..HEAD --oneline`.
+- **Worktree candidate** — review work in progress without requiring a commit. Resolve `<merge-base>` with `git merge-base <fixed-point> HEAD`, then capture:
+  - `git diff --no-ext-diff --binary --full-index <merge-base>` for committed, staged and unstaged tracked content as it exists in the working tree;
+  - `git ls-files -z --others --exclude-standard` for NUL-delimited raw untracked paths;
+  - each untracked file's content, using `git diff --no-index --no-ext-diff --binary --full-index -- /dev/null <path>` when a diff representation is useful. Exit code `1` from this command means a difference was found, not that review failed;
+  - `git log <fixed-point>..HEAD --oneline` for the committed portion of the candidate.
+
+Record one **candidate manifest** before spawning reviewers:
+
+```yaml
+review_mode: committed # or worktree
+review_base_ref: <fixed-point>
+merge_base: <resolved-sha>
+implementation_candidate_ref: HEAD # or working-tree
+candidate_snapshot_ref: <immutable-commit-or-captured-snapshot>
+candidate_digest: <sha256-or-immutable-tree-id>
+tracked_diff_command: <command>
+untracked_inventory_command: <command-or-null>
+untracked_files: []
+commit_list_command: <command>
+```
+
+For a Committed candidate, resolve `HEAD` to an immutable commit and tree before review. Its manifest must include `merge_base`, `tracked_diff_command` and `commit_list_command`. For a Worktree candidate, the manifest must additionally include `untracked_inventory_command`, `untracked_diff_command` and the exact `untracked_files` inventory.
+
+For a Worktree candidate, capture the tracked binary diff and every untracked file's bytes once into an immutable snapshot, compute `candidate_digest`, and make that **captured candidate** available to both reviewers. The following is normative, not illustrative: use the `yss-worktree-candidate-v1` byte stream. Start with ASCII `YSS-WORKTREE-CANDIDATE-V1` followed by one NUL byte. Append one tracked record: byte `0x54`, unsigned 64-bit big-endian binary-diff byte length, then the exact stdout bytes from `git diff --no-ext-diff --binary --full-index <merge-base>`. Then append one untracked record for each NUL-delimited raw path from `git ls-files -z --others --exclude-standard`, sorted bytewise by the raw path: byte `0x55`, unsigned 64-bit big-endian path length, raw path bytes, unsigned 32-bit big-endian `lstat` mode, entry-kind byte (`0x52` regular or `0x4c` symlink), unsigned 64-bit big-endian content length, then raw regular-file bytes or raw symlink-target bytes. Other entry kinds block capture. This is the sole length-prefixed framing and bytewise path order for the digest. SHA-256 is calculated over exactly this stream. The immutable snapshot stores `candidate-manifest.yaml`, `tracked.diff` and the `untracked/` bytes under the digest identity; both reviewers must consume those captured bytes and must not independently reread a live worktree.
+
+Before going further, confirm the fixed point and merge-base resolve. A committed candidate must have a non-empty committed diff. A Worktree candidate is non-empty when either its tracked diff or untracked inventory is non-empty. A bad ref, missing candidate part or empty candidate should fail here — not inside two parallel sub-agents. Do not silently downgrade Worktree review to `HEAD`-only review.
 
 ### 2. Identify the spec source
 
 Look for the originating spec, in this order:
 
-1. Issue references in the commit messages (`#123`, `Closes #45`, GitLab `!67`, etc.) — fetch via the workflow in `docs/agents/issue-tracker.md`.
-2. A path the user passed as an argument.
+1. A spec/Ticket/contract reference supplied by the user or an upstream lifecycle review input.
+2. Issue references in the commit messages (`#123`, `Closes #45`, GitLab `!67`, etc.) — fetch via the workflow in `docs/agents/issue-tracker.md`.
 3. A spec file under `docs/`, `specs/`, or `docs/.scratch/` matching the branch name or feature.
 4. If nothing is found, ask the user where the spec is. If they say there isn't one, the **Spec** sub-agent will skip and report "no spec available".
 
@@ -59,13 +85,13 @@ Each smell reads *what it is* → *how to fix*; match it against the diff:
 
 **Standards sub-agent prompt** — include:
 
-- The full diff command and commit list.
+- The full candidate manifest, captured candidate, `candidate_digest`, diff/inventory commands and commit list. For Worktree candidates, explicitly include every untracked file.
 - The list of standards-source files you found in step 3, **plus the smell baseline from step 3** pasted in full — the sub-agent has no other access to it.
 - The brief: "Report — per file/hunk where relevant — (a) every place the diff violates a documented standard: cite the standard (file + the rule); and (b) any baseline smell you spot: name it and quote the hunk. Distinguish hard violations from judgement calls — documented-standard breaches can be hard, but baseline smells are always judgement calls, and a documented repo standard overrides the baseline. Skip anything tooling enforces. Under 400 words."
 
 **Spec sub-agent prompt** — include:
 
-- The diff command and commit list.
+- The same candidate manifest, captured candidate, `candidate_digest`, diff/inventory commands and commit list.
 - The path or fetched contents of the spec.
 - The brief: "Report: (a) requirements the spec asked for that are missing or partial; (b) behaviour in the diff that wasn't asked for (scope creep); (c) requirements that look implemented but where the implementation looks wrong. Quote the spec line for each finding. Under 400 words."
 
@@ -75,7 +101,9 @@ If the spec is missing, skip the Spec sub-agent and note this in the final repor
 
 Present the two reports under `## Standards` and `## Spec` headings, verbatim or lightly cleaned. Do **not** merge or rerank findings — the two axes are deliberately separate (see _Why two axes_).
 
-End with a one-line summary: total findings per axis, and the worst issue _within each axis_ (if any). Don't pick a single winner across axes — that's the reranking the separation exists to prevent.
+For Worktree mode, recapture the candidate digest after both reports return. If it differs from `candidate_digest`, mark both reports as reviewing a **stale candidate** and return `blocked`; the caller may start a new review against a new capture, but this invocation must not aggregate findings from different bytes. Recheck the same digest again at the completion/checkpoint boundary.
+
+State the reviewed `review_mode`, fixed point, candidate digest and coverage before the two reports. End with a one-line summary: total findings per axis, and the worst issue _within each axis_ (if any). Don't pick a single winner across axes — that's the reranking the separation exists to prevent.
 
 ## Why two axes
 

package/template/.qoder/skills/high-fidelity-html-prototype/SKILL.md

@@ -5,6 +5,10 @@ description: Use after low-fidelity prototype review is approved and before Spec
 
 # High Fidelity HTML Prototype
 
+## 兼容入口
+
+本 skill 仅服务旧名称或既有链接；新的高保真产出遵循 `yss-prototype-stage`，在 Codex 由 `product-design:index` 路由。它不批准生命周期门禁或实现就绪状态。
+
 Use this skill only after `prototype-review` approves the low-fidelity prototype / interaction design. It turns reviewed product design into a high-fidelity, browser-runnable HTML artifact for business, UX, frontend, and API review.
 
 ## Required Inputs
@@ -16,33 +20,33 @@ Use this skill only after `prototype-review` approves the low-fidelity prototype
 - Approved low-fidelity prototype review: `docs/.scratch/<feature>/design/<feature>-prototype-review.md` or equivalent issue comment.
 - Project design system: `docs/design/design.md` and `docs/design/tokens/*`.
 
-If low-fidelity `prototype-review` is blocked or missing, stop and return to `product-design-prototype` / `prototype-review`.
+If low-fidelity `prototype-review` is blocked or missing, stop and return to `yss-prototype-stage` / `prototype-review`.
 
 ## Ant Design Official Agent Baseline
 
-Use the official Ant Design agent guidance as the implementation baseline:
+Use the official Ant Design agent guidance as the fact baseline through `yss-prototype-stage`:
 
 - Read or reference `https://ant.design/docs/react/for-agents` when the task starts.
 - Use `@ant-design/cli` before choosing unfamiliar components, props, tokens, or migration-sensitive APIs.
 - Prefer direct CLI subcommands because `--help` may fail in some Node environments while subcommands still work.
 
-Recommended commands:
+Record the installed CLI version and the target AntD version in `prototype-evidence.yaml`. Use `--format json`; pass the recorded target version to version-sensitive queries:
 
 ```bash
-npm view antd version
-npm view @ant-design/cli version
-npx -y @ant-design/cli@6.5.0 info Button
-npx -y @ant-design/cli@6.5.0 token Button
-npx -y @ant-design/cli@6.5.0 demo Select basic
-npx -y @ant-design/cli@6.5.0 changelog 5.0.0 6.5.0 Table
+antd design.md --format json
+antd info Button --version <target_antd_version> --format json
+antd token Button --version <target_antd_version> --format json
+antd demo Select basic --version <target_antd_version> --format json
+antd semantic Button --version <target_antd_version> --format json
+antd lint <prototype-path> --format json
 ```
 
-Use the latest verified v6.x version instead of `6.5.0` when npm reports a newer v6 release. Record the exact version and any queried components in the output.
+Use the project-selected version when one exists; otherwise record the CLI's actual default version before making version-sensitive decisions. Record every queried component in the evidence manifest.
 
 ## Core Rules
 
 - Output is HTML: `docs/.scratch/<feature>/design/prototypes/index.html`.
-- The prototype must use Ant Design v6. Before generating or updating code, verify the current v6 package with `npm view antd version` and `npm view @ant-design/cli version`. If the latest version is not v6.x, pin the newest available v6.x version and record the choice.
+- The prototype must use the approved Ant Design v6 target. Obtain component facts from the official `antd` CLI and record the exact CLI/target versions; do not infer version-sensitive APIs from memory.
 - Use React >= 18, `antd@6.x`, and `@ant-design/icons@6.x` for interactive prototypes.
 - Prefer Ant Design components and tokens over hand-built controls: `Layout`, `Menu`, `Breadcrumb`, `Button`, `Input`, `Select`, `Table`, `Form`, `Tabs`, `Steps`, `Drawer`, `Modal`, `Alert`, `Tooltip`, `Tag`, `Badge`, `DatePicker`, `Upload`, `Pagination`, `Empty`, `Spin`, `Result`.
 - Do not create extra data-service or fixture artifacts. Use embedded sample data inside the HTML/JS for visual and interaction demonstration only.
@@ -71,7 +75,7 @@ Run a local browser verification before calling the artifact ready:
 - Check that the page renders nonblank.
 - Exercise the main flow and at least one failure / permission / conflict state.
 - Check at least one desktop and one mobile viewport.
-- Record verification evidence in the response or in the related review / issue.
+- Record verification evidence in `docs/.scratch/<feature>/verification/prototype-evidence.yaml` and link it from the review and confirmation record.
 
 ## Output Contract
 

package/template/.qoder/skills/product-design-prototype/SKILL.md

@@ -5,7 +5,11 @@ description: Use when a Spec baseline or user story has UI impact and needs page
 
 # Product Design Prototype
 
-Use this skill after Spec baseline and before Spec calibration / OpenAPI Draft for features with user interfaces. Its job is to turn requirements into design assets that can drive a calibrated Spec, API, frontend acceptance, and vertical slices.
+## 兼容入口
+
+本 skill 仅服务旧名称或既有链接；它不是新的原型主入口。进入后先加载 `yss-prototype-stage`，并在 Codex 使用 `product-design:index` 产出设计资产。生命周期门禁仍由 `yss-product-lifecycle` 裁决。
+
+其余内容只描述可复用的交互说明检查项，不能替代统一合同中的 AntD CLI、浏览器验证或用户确认。
 
 ## Required Inputs
 
@@ -25,7 +29,7 @@ If no Spec baseline exists, route back to `yss-product-lifecycle` / `grill-with-
 5. Write the OpenAPI implication list: fields, filters, actions, errors, permissions, pagination, optimistic/concurrency states, and audit/version data.
 6. For every primary page action, add an action-to-contract row: page/component, action label, `actionKey`, endpoint or explicit non-goal, request fields, response shape, permission behavior, state transition, idempotency/concurrency rule, and error codes.
 7. For every P0 requirement containing verbs such as manage, maintain, configure, create, update, archive, retry, cancel, publish, export, or create draft, confirm the interaction spec either names the API implication or records that the capability is intentionally out of scope.
-8. Hand off to `prototype-review`. After low-fidelity review is approved, hand off to `high-fidelity-html-prototype`. Do not freeze/calibrate the Spec or enter OpenAPI Draft for UI work until the Ant Design v6 high-fidelity HTML prototype exists and has no blocking findings.
+8. Hand off to `prototype-review`. After approval, return to `yss-prototype-stage` for `product-design:index` 高保真产出、AntD CLI 与浏览器验证；未形成确认记录前不得冻结/校准 Spec 或进入 OpenAPI Draft。
 9. 交互原型应标注 semantic token 角色、single primary action、interaction feedback 和不可逆操作确认；若页面使用 Ant Design，主题密度或暗色策略必须使用 theme algorithm，并在关键文本上复核 accessibility contrast。
 
 ## Tool Routing

package/template/.qoder/skills/prototype-review/SKILL.md

@@ -5,7 +5,7 @@ description: Use when reviewing low-fidelity UI design, wireframes, prototype li
 
 # Prototype Review
 
-Use this skill as the low-fidelity gate between product design/prototype work and high-fidelity HTML prototype work. The review is fail-closed: if the design cannot drive calibrated requirements, API, frontend acceptance, and slices, send it back to product design.
+Use this skill as the independent low-fidelity review in `yss-prototype-stage`. The review is fail-closed: if the design cannot drive calibrated requirements, API, frontend acceptance, and slices, send it back to product design. `yss-product-lifecycle` alone records the resulting `gate.prototype-reviewed` decision.
 
 ## Trigger Boundary
 
@@ -17,6 +17,7 @@ Run this independent gate only when UI changes affect a primary user flow, navig
 - `docs/.scratch/<feature>/design/<feature>-interaction-spec.md` or prototype link.
 - State matrix, preferably based on `docs/design/templates/state-matrix-template.md`.
 - Existing OpenAPI Draft only if the review is checking alignment; do not require OpenAPI before product design.
+- `docs/.scratch/<feature>/verification/prototype-evidence.yaml` may be created as a pending evidence record, but CLI/browser validation belongs to the following high-fidelity verification gate.
 
 ## Review Gates
 
@@ -63,8 +64,11 @@ Run this independent gate only when UI changes affect a primary user flow, navig
 ### Frontend Prototype Readiness
 - <component states, data dependencies, frontend acceptance notes>
 
+### Lifecycle Evidence
+- <persistent review path; blockers; `gate.prototype-reviewed` candidate result>
+
 ### Next Action
-- <high-fidelity-html-prototype / return to product-design-prototype>
+- <yss-prototype-stage / return to product design>
 ```
 
 Use `docs/design/templates/prototype-review-checklist.md` when writing a persistent review artifact.

package/template/.qoder/skills/wireframe-prototype/SKILL.md

@@ -5,6 +5,10 @@ description: Use when low-fidelity product screens, user flows, whiteboards, Exc
 
 # Wireframe Prototype
 
+## 兼容入口
+
+本 skill 仅服务旧名称或既有链接；新的低保真产出遵循 `yss-prototype-stage`，在 Codex 由 `product-design:index` 路由。它不批准产品设计门禁。
+
 Use this skill for low-fidelity product decisions. It favors fast, inspectable artifacts over polished visuals.
 
 ## Choose The Medium
@@ -49,4 +53,4 @@ Then link or paste this into `docs/.scratch/<feature>/design/<feature>-interacti
 
 ## Handoff
 
-After the wireframe is captured, return to `product-design-prototype` to fill state matrix and API implications, then run `prototype-review`.
+After the wireframe is captured, return to `yss-prototype-stage` to fill the interaction spec, state matrix, API implications, and then run `prototype-review`.