create-yss-spec 2.1.4 → 2.1.6

package/template/docs/design/templates/prototype-review-checklist.md

@@ -10,8 +10,8 @@
 | 交互说明 | `docs/.scratch/<feature>/design/<feature>-interaction-spec.md` |  |
 | 原型 / 线框图 | `<链接或导出图片路径>` |  |
 | 状态矩阵 | `docs/.scratch/<feature>/design/<feature>-state-matrix.md` |  |
-| Product Design 路由记录 | `product-design:index -> <focused skill>` |  |
-| AntD CLI 校验证据 | `<命令输出或记录路径>` |  |
+| 原型阶段合同 / Product Design 路由记录 | `yss-prototype-stage -> product-design:index -> <focused skill>` |  |
+| 原型验证清单 | `docs/.scratch/<feature>/verification/prototype-evidence.yaml` | 高保真完成后补齐 CLI 与浏览器验证 |
 | 现有 API 草案 | `docs/.scratch/<feature>/api/<feature>.yaml` | 可选 |
 
 ## 门禁清单
@@ -26,8 +26,7 @@
 | 权限行为能区分隐藏、禁用和调用后拒绝 |  |  |
 | 校验错误能区分模型级和字段级展示位置 |  |  |
 | 能从界面需求反推出 API 影响和契约草案 |  |  |
-| AntD v6 设计语言、组件 API、demo、token 和 semantic 已用 `antd` CLI 查询并记录 |  |  |
-| 高保真 HTML 原型未使用旧原型技能作为主入口，已通过 `product-design:index` 路由产出或记录例外原因 |  |  |
+| 高保真 HTML 原型已按 `yss-prototype-stage` 通过 `product-design:index` 路由产出，或记录等价 Agent 适配及例外原因 |  |  |
 | 前端验收、组件状态和数据依赖已明确 |  |  |
 | 风险 / 回滚约束和人工确认项已记录 |  |  |
 
@@ -58,6 +57,7 @@
 
 ```text
 结论：通过 / 阻断
+生命周期门禁：`gate.prototype-reviewed` 通过 / 不通过
 阻断项：
 - 
 非阻断建议：

package/template/docs/process/lifecycle-artifact-map.md

@@ -28,7 +28,9 @@
 |---|---|---|---|---|
 | `gate.repository-identity-valid` | 仓库身份校验 | `stage.entry-triage` | 每次进入流程。 | `evidence.repository-identity-check` |
 | `gate.spec-baseline-approved` | Spec 基线批准 | `stage.spec-architecture` | 新功能、行为变化或范围扩大进入 Spec 基线。 | `evidence.approval-record` |
-| `gate.user-confirmation` | 用户确认 | `stage.product-design` | 产品设计影响尚未被人工确认。 | `evidence.approval-record` |
+| `gate.prototype-reviewed` | 原型评审 | `stage.product-design` | 命中产品设计影响，且低保真页面、流程、状态或 API 反推需要独立评审。 | `evidence.prototype-review-result` |
+| `gate.prototype-verified` | 高保真原型验证 | `stage.product-design` | 需要高保真 HTML 原型进行视觉与交互校准。 | `evidence.antd-cli-validation`、`evidence.browser-prototype-verification` |
+| `gate.user-confirmation` | 用户确认 | `stage.product-design` | 产品设计影响尚未被人工确认。 | `evidence.prototype-confirmation` |
 | `gate.openapi-draft-reviewed` | OpenAPI Draft Review | `stage.system-data-engineering` | 有 API 影响且 Draft 已生成。 | `evidence.openapi-draft-review` |
 | `gate.design-reviewed` | 设计审查 | `stage.system-data-engineering` | API 或架构影响。 | `evidence.design-review-result` |
 | `gate.openapi-frozen` | OpenAPI Freeze | `stage.system-data-engineering` | API 进入实现。 | `evidence.approval-record` |
@@ -47,9 +49,12 @@
 | `artifact.spec` | Spec | `stage.spec-architecture` | 新功能、行为变化或范围扩大。 |
 | `artifact.product-overview` | 产品总体设计 | `stage.spec-architecture` | 进入 Spec 基线。 |
 | `artifact.functional-architecture` | 功能架构 | `stage.spec-architecture` | 新模块或跨边界变化。 |
+| `artifact.interaction-spec` | 交互说明 | `stage.product-design` | 命中产品设计影响。 |
 | `artifact.low-fidelity-prototype` | 低保真原型 | `stage.product-design` | 命中产品设计影响。 |
 | `artifact.state-matrix` | 状态矩阵 | `stage.product-design` | 存在状态流转、异常或恢复。 |
 | `artifact.high-fidelity-html-prototype` | 高保真 HTML 原型 | `stage.product-design` | 需要视觉与交互校准。 |
+| `artifact.prototype-review` | 原型评审记录 | `stage.product-design` | 命中 gate.prototype-reviewed。 |
+| `artifact.prototype-confirmation` | 原型确认记录 | `stage.product-design` | 命中 gate.user-confirmation。 |
 | `artifact.openapi-draft` | OpenAPI Draft | `stage.system-data-engineering` | 有 API 影响。 |
 | `artifact.openapi-freeze-record` | OpenAPI Freeze 记录 | `stage.system-data-engineering` | API 进入实现。 |
 | `artifact.data-architecture` | 数据架构 | `stage.system-data-engineering` | 数据模型、存储或一致性变化。 |
@@ -69,6 +74,10 @@
 | `evidence.repository-identity-check` | 仓库身份校验结果 | yss-project.yaml 的合法性与 repository_mode 裁决。 |
 | `evidence.approval-record` | 人工批准记录 | 对需要人工批准的 Spec、设计、契约或发布裁决的可追溯记录。 |
 | `evidence.design-review-result` | 设计审查结果 | API、架构或产品设计审查意见及处理结果。 |
+| `evidence.prototype-review-result` | 原型评审结果 | 低保真页面、流程、状态与 API 反推的独立评审结论和阻断项。 |
+| `evidence.antd-cli-validation` | Ant Design CLI 校验证据 | 设计语言、组件、demo、token、semantic 与 lint 的实际 CLI/目标版本和可读输出引用。 |
+| `evidence.browser-prototype-verification` | 浏览器原型验证证据 | 高保真原型的非空渲染、主流程、异常状态、视口和控制台验证记录。 |
+| `evidence.prototype-confirmation` | 原型用户确认记录 | 高保真原型、验证清单和进入下游阶段范围的人工确认结论。 |
 | `evidence.openapi-draft-review` | OpenAPI Draft 审查记录 | P0、错误、分页、幂等和契约测试审查记录。 |
 | `evidence.contract-approval` | Slice 合同批准记录 | 生命周期编排器批准且已持久化的当前版本合同引用。 |
 | `evidence.yss-skill-execution-result` | YSS Skill Execution Result | 专项 skill 的合同版本、写入、验证、延期 seam 与偏离证据。 |

package/template/docs/process/lifecycle-registry-baseline.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "registry_id": "yss.lifecycle",
-  "semantic_sha256": "33fcc66059b7c630d15541d615dc13b3c5907c77f5f2bf77a5d9e753a2a58c8e",
+  "semantic_sha256": "6261529654dba3e3738aa950e42d6af5b5db1b3be4ac6c2e4dc86a395c49ec6f",
   "published_ids": [
     "artifact.architecture-review",
     "artifact.data-architecture",
@@ -10,24 +10,31 @@
     "artifact.functional-architecture",
     "artifact.high-fidelity-html-prototype",
     "artifact.impact-assessment",
+    "artifact.interaction-spec",
     "artifact.low-fidelity-prototype",
     "artifact.openapi-draft",
     "artifact.openapi-freeze-record",
     "artifact.parent-ticket",
     "artifact.product-overview",
+    "artifact.prototype-confirmation",
+    "artifact.prototype-review",
     "artifact.retrospective",
     "artifact.slice-implementation-contract",
     "artifact.spec",
     "artifact.spec-delta",
     "artifact.state-matrix",
     "artifact.vertical-slice-ticket",
+    "evidence.antd-cli-validation",
     "evidence.approval-record",
+    "evidence.browser-prototype-verification",
     "evidence.checkpoint-and-rollback",
     "evidence.contract-approval",
     "evidence.design-review-result",
     "evidence.fresh-verification",
     "evidence.impact-assessment",
     "evidence.openapi-draft-review",
+    "evidence.prototype-confirmation",
+    "evidence.prototype-review-result",
     "evidence.repository-identity-check",
     "evidence.yss-skill-execution-result",
     "gate.architecture-reviewed",
@@ -35,6 +42,8 @@
     "gate.engineering-baseline-accepted",
     "gate.openapi-draft-reviewed",
     "gate.openapi-frozen",
+    "gate.prototype-reviewed",
+    "gate.prototype-verified",
     "gate.release-ready",
     "gate.repository-identity-valid",
     "gate.slice-contract-approved",

package/template/docs/process/lifecycle-registry.yaml

@@ -57,6 +57,18 @@ evidence:
   - id: evidence.design-review-result
     name: 设计审查结果
     description: API、架构或产品设计审查意见及处理结果。
+  - id: evidence.prototype-review-result
+    name: 原型评审结果
+    description: 低保真页面、流程、状态与 API 反推的独立评审结论和阻断项。
+  - id: evidence.antd-cli-validation
+    name: Ant Design CLI 校验证据
+    description: 设计语言、组件、demo、token、semantic 与 lint 的实际 CLI/目标版本和可读输出引用。
+  - id: evidence.browser-prototype-verification
+    name: 浏览器原型验证证据
+    description: 高保真原型的非空渲染、主流程、异常状态、视口和控制台验证记录。
+  - id: evidence.prototype-confirmation
+    name: 原型用户确认记录
+    description: 高保真原型、验证清单和进入下游阶段范围的人工确认结论。
   - id: evidence.openapi-draft-review
     name: OpenAPI Draft 审查记录
     description: P0、错误、分页、幂等和契约测试审查记录。
@@ -84,11 +96,21 @@ gates:
     stage: stage.spec-architecture
     trigger: 新功能、行为变化或范围扩大进入 Spec 基线。
     evidence: [evidence.approval-record]
+  - id: gate.prototype-reviewed
+    name: 原型评审
+    stage: stage.product-design
+    trigger: 命中产品设计影响，且低保真页面、流程、状态或 API 反推需要独立评审。
+    evidence: [evidence.prototype-review-result]
+  - id: gate.prototype-verified
+    name: 高保真原型验证
+    stage: stage.product-design
+    trigger: 需要高保真 HTML 原型进行视觉与交互校准。
+    evidence: [evidence.antd-cli-validation, evidence.browser-prototype-verification]
   - id: gate.user-confirmation
     name: 用户确认
     stage: stage.product-design
     trigger: 产品设计影响尚未被人工确认。
-    evidence: [evidence.approval-record]
+    evidence: [evidence.prototype-confirmation]
   - id: gate.openapi-draft-reviewed
     name: OpenAPI Draft Review
     stage: stage.system-data-engineering
@@ -151,6 +173,10 @@ artifacts:
     name: 功能架构
     stage: stage.spec-architecture
     trigger: 新模块或跨边界变化。
+  - id: artifact.interaction-spec
+    name: 交互说明
+    stage: stage.product-design
+    trigger: 命中产品设计影响。
   - id: artifact.low-fidelity-prototype
     name: 低保真原型
     stage: stage.product-design
@@ -163,6 +189,14 @@ artifacts:
     name: 高保真 HTML 原型
     stage: stage.product-design
     trigger: 需要视觉与交互校准。
+  - id: artifact.prototype-review
+    name: 原型评审记录
+    stage: stage.product-design
+    trigger: 命中 gate.prototype-reviewed。
+  - id: artifact.prototype-confirmation
+    name: 原型确认记录
+    stage: stage.product-design
+    trigger: 命中 gate.user-confirmation。
   - id: artifact.openapi-draft
     name: OpenAPI Draft
     stage: stage.system-data-engineering

package/template/docs/user-guide//345/244/226/351/203/250/345/221/275/344/273/244/350/241/214/345/267/245/345/205/267/345/256/236/350/267/265/346/214/207/345/215/227.md

@@ -114,4 +114,4 @@ YSS_SPEC_TEMPLATE_REF=<pinned-commit> npm test
 YSS_SPEC_TEMPLATE_REF=<pinned-commit> npm pack --dry-run
 ```
 
-发布顺序为：模板修复与验证 → CLI 绑定 commit 并完成跨仓库测试 → 独立审查 → 发布 CLI `2.1.4`。任一仓库未通过共同验证时，不声明整体可发布。
+发布顺序为：模板修复与验证 → CLI 绑定 commit 并完成跨仓库测试 → 独立审查 → 发布 CLI `2.1.6`。任一仓库未通过共同验证时，不声明整体可发布。

package/template/docs/user-guide//350/247/204/346/240/274/344/270/216/344/273/273/345/212/241/350/277/201/347/247/273/346/214/207/345/215/227.md

@@ -35,6 +35,10 @@ Local Markdown 项目不再使用上述旧目录作为主 tracker：新的完整
 6. 运行 `scripts/update-skill-lock` 更新完整树哈希。
 7. 运行 `scripts/verify-template`；修复全部结构、语义、压力场景和链接错误后再进入发布审查。
 
+## 模板工具运行时迁移
+
+从包含 Ruby 模板治理脚本的历史快照升级时，新的受管 Node 脚本直接随模板快照分发，项目实例不执行依赖安装。实例需要 Node `>=22 <27`；缺失或不兼容时先停止同步并恢复原 metadata。历史 `.rb` 文件由 CLI 的模板删除规则以 `remove-report` 告知，默认不静默删除。升级后运行三个固定门禁；失败时按 CLI 操作日志回滚。
+
 ## 外部初始化 CLI
 
 `create-yss-spec` 必须在初始化和升级时写入正确的 `repository_mode`，并执行等价的路径迁移与集成测试。模板仓库与 CLI 仓库未共同通过集成验证前，不得单独声明新版模板可发布。

package/template/scripts/export-yss-skills

@@ -1,385 +1,3 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require "digest"
-require "fileutils"
-require "json"
-require "optparse"
-require "pathname"
-require "tmpdir"
-
-ROOT = Pathname.new(__dir__).parent.expand_path
-CANONICAL_ROOT = ROOT.join(".agents", "skills")
-CONFIG_PATH = ROOT.join("yss-public-skills.json")
-MANAGED_PATHS = %w[skills skills.sh.json .yss-export-manifest.json].freeze
-FORBIDDEN_TOP_LEVEL = %w[
-  AGENTS.md
-  CONTEXT.md
-  docs
-  skills-lock.json
-  .agents
-  .claude
-  .codex
-  .hermes
-  .pi
-  .qoder
-  .trae
-].freeze
-PORTABILITY_NOTE = <<~MARKDOWN
-
-  > **消费项目上下文：** 本公开技能包不携带消费项目的 `AGENTS.md`、`CONTEXT.md` 或 `docs/`。文档中出现的这些路径均指可选的消费项目上下文；技能自身所需的参考资料、资源和脚本已随技能一同提供。
-MARKDOWN
-
-def abort_with(message)
-  warn "export-yss-skills: #{message}"
-  exit 1
-end
-
-def normalized_name(name)
-  name.downcase.gsub(/[\s_]+/, "-")
-end
-
-def parse_frontmatter(path)
-  text = File.binread(path).force_encoding(Encoding::UTF_8)
-  match = /\A---[ \t]*\r?\n(.*?)\r?\n---[ \t]*(?:\r?\n|\z)/m.match(text)
-  abort_with("invalid frontmatter: #{path}") unless match
-
-  fields = {}
-  match[1].each_line do |line|
-    key, value = line.chomp.split(":", 2)
-    next unless key && value
-
-    key = key.strip
-    value = value.strip
-    value = value[1..-2] if value.length >= 2 && ((value.start_with?("\"") && value.end_with?("\"")) || (value.start_with?("'") && value.end_with?("'")))
-    fields[key] = value
-  end
-
-  %w[name description].each do |key|
-    abort_with("frontmatter #{key} must be a string: #{path}") unless fields[key].is_a?(String) && !fields[key].empty?
-  end
-  [fields, match.end(0)]
-end
-
-def public_relative_prefix(relative_file)
-  current_dir = Pathname.new("skills").join(File.dirname(relative_file))
-  prefix = Pathname.new("skills").relative_path_from(current_dir).to_s
-  prefix == "." ? "" : prefix
-end
-
-def portable_skill_path(relative_file)
-  prefix = public_relative_prefix(relative_file)
-  prefix.empty? ? "" : "#{prefix}/"
-end
-
-def sanitize_text(text, relative_file)
-  text = text.dup.force_encoding(Encoding::UTF_8)
-  return text unless text.valid_encoding?
-
-  if relative_file.end_with?("assets/wrapper/.mvn/maven.config")
-    return <<~CONFIG
-      # Optional consuming-project Maven deployment configuration.
-      # Configure repository URLs and profiles in the consuming project or CI.
-    CONFIG
-  end
-
-  # Convert source-tree paths to links in the public `skills/` layout.
-  # Protect an explicit skills-root assignment from the generic source-path
-  # and Agent-root rewrites below, then restore it as a relative placeholder.
-  text = text.gsub(%r{(YSS_SKILLS_ROOT\s*=\s*[\"']?)/path/to/\.agents/skills}) do
-    "#{Regexp.last_match(1)}__YSS_SKILLS_ROOT_PATH__"
-  end
-  text = text.gsub(%r{/path/to/\.agents/skills}) { "$YSS_SKILLS_ROOT" }
-  text = text.gsub(%r{(?:\$\{base_project\}/)?(?:/path/to/)?\.(?:agents|claude|codex|hermes|pi|qoder|trae)/skills/}) { portable_skill_path(relative_file) }
-  text = text.gsub(%r{\.(?:agents|claude|codex|hermes|pi|qoder|trae)/skills\b}) { "the canonical public skill source" }
-  text = text.gsub(%r{/path/to/skill-creator}) { "skill-creator" }
-  # Make standalone placeholder paths portable without corrupting paths such
-  # as `/absolute/path/...`, where `/path/` is only a later path segment.
-  text = text.gsub(%r{(?<![\w.])/path/}) { "./path/" }
-
-  # Remove workstation-only paths and private-network documentation endpoints.
-  text = text.gsub(%r{/(?:Users|home|private)/[^\s`"'()<>\]]+}) { "<local-path-removed>" }
-  text = text.gsub(%r{/tmp/}) { "./tmp/" }
-  text = text.gsub("yss-spec-project-template", "the consuming project")
-  text = text.gsub(/\[([^\]]*)\]\(https?:\/\/192\.168\.[^\s)]+\)/) { Regexp.last_match(1) }
-  text = text.gsub(%r{https?://192\.168\.[^\s)`>]+}) { "the consuming project's optional YSS documentation" }
-  text = text.gsub("${base_project}", "the consuming project")
-
-  # One bundled guide links to a sibling guide through an extra `guide/`
-  # segment; normalize that link only in the directory where it is valid.
-  text = text.gsub(%r{(\]\(\./)guide/}, '\\1') if relative_file.include?("/assets/docs/guide/")
-
-  # Convert the bundled YSS UI site's root-relative documentation routes to
-  # files in this skill's local `assets/docs` tree.
-  if relative_file.include?("/assets/docs/")
-    text = text.gsub(/\[([^\]]+)\]\(\/(guide|components|hooks|utils)(\/[^)#]+)?(#[^)]*)?\)/) do
-      label, section, suffix, fragment = Regexp.last_match.captures
-      next label if section == "utils"
-
-      route = suffix ? suffix.delete_prefix("/") : nil
-      target = if section == "guide"
-                 route ? "./#{route}.md" : "./"
-               elsif section == "components"
-                 "../components/#{route}.md"
-               else
-                 route ? "../hooks/#{route}.md" : "../hooks/"
-               end
-      "[#{label}](#{target}#{fragment})"
-    end
-  end
-
-  # Public examples must not carry usable passwords or token-like values.
-  text = text.gsub(/((?:["']?(?:password|passwd|secret|token|api[_-]?key|access[_-]?key)["']?\s*[:=]\s*["']))[^"'\r\n]*(["'])/i) { "#{$1}CHANGE_ME#{$2}" }
-  text = text.gsub(/(["'])(?:admin123|guest|123456)\1/i) { "#{$1}CHANGE_ME#{$1}" }
-  text = text.gsub("__YSS_SKILLS_ROOT_PATH__", "./path/to/yss-skills")
-
-  if relative_file.end_with?("SKILL.md") && !text.include?("消费项目上下文")
-    frontmatter = /\A---[ \t]*\r?\n.*?\r?\n---[ \t]*(?:\r?\n|\z)/m.match(text)
-    text = "#{frontmatter[0]}#{PORTABILITY_NOTE}#{text[frontmatter.end(0)..]}" if frontmatter
-  end
-  text = text.lines.map(&:rstrip).join("\n")
-  text.empty? ? text : "#{text.rstrip}\n"
-end
-
-def safe_source_files(skill_dir)
-  files = []
-  Dir.glob(skill_dir.join("**", "*").to_s, File::FNM_DOTMATCH).sort.each do |entry|
-    next if [".", ".."].include?(File.basename(entry)) || File.basename(entry) == ".DS_Store"
-
-    stat = File.lstat(entry)
-    abort_with("symbolic links are not allowed: #{entry}") if stat.symlink?
-    abort_with("unsupported source entry: #{entry}") unless stat.file? || stat.directory?
-    files << Pathname.new(entry) if stat.file?
-  end
-  files
-end
-
-def relative_files(root)
-  return [] unless root.directory?
-
-  Dir.glob(root.join("**", "*").to_s, File::FNM_DOTMATCH).each_with_object([]) do |entry, files|
-    next if [".", ".."].include?(File.basename(entry))
-
-    path = Pathname.new(entry)
-    files << path.relative_path_from(root).to_s if path.file?
-  end.sort
-end
-
-def suspicious_content?(text)
-  text.match?(/-----BEGIN (?:[A-Z0-9 ]+ )?PRIVATE KEY-----/) ||
-    text.match?(/(?:ghp_|github_pat_|github_token_|xox[baprs]-)[A-Za-z0-9_-]+/) ||
-    text.match?(/AKIA[0-9A-Z]{16}/)
-end
-
-def validate_markdown_links(root)
-  relative_files(root).each do |relative|
-    next unless relative.end_with?(".md")
-
-    path = root.join(relative)
-    text = File.binread(path).force_encoding(Encoding::UTF_8)
-    next unless text.valid_encoding?
-
-    text.scan(/!?\[[^\]]*\]\(([^)]+)\)/).each do |match|
-      href = match[0].strip.split(/[ \t]+/, 2).first
-      href = href[1..-2] if href&.start_with?("<") && href.end_with?(">")
-      next if href.nil? || href.empty? || href.start_with?("#", "http://", "https://", "mailto:", "<", "${")
-
-      target = href.split("#", 2).first
-      next if target.empty?
-
-      resolved = path.dirname.join(target).cleanpath
-      abort_with("link escapes public export: #{relative} -> #{href}") unless resolved.to_s.start_with?(root.to_s)
-      abort_with("broken internal link: #{relative} -> #{href}") unless resolved.file? || resolved.directory?
-    end
-  end
-end
-
-def ensure_output_destination(output)
-  abort_with("canonical skill root is missing: #{CANONICAL_ROOT}") unless CANONICAL_ROOT.directory?
-  abort_with("canonical skill root must not be a symbolic link: #{CANONICAL_ROOT}") if File.symlink?(CANONICAL_ROOT)
-
-  canonical = CANONICAL_ROOT.realpath
-  if output == canonical || output.to_s.start_with?("#{canonical}/") || canonical.to_s.start_with?("#{output}/")
-    abort_with("output directory must not overlap canonical skills: #{output}")
-  end
-  abort_with("output directory must not be a symbolic link: #{output}") if output.exist? && File.symlink?(output)
-
-  if output.directory?
-    MANAGED_PATHS.each do |entry|
-      abort_with("managed export path must not be a symbolic link: #{output.join(entry)}") if File.symlink?(output.join(entry))
-    end
-    FORBIDDEN_TOP_LEVEL.each do |entry|
-      abort_with("forbidden project file in public export: #{entry}") if output.join(entry).exist?
-    end
-  end
-end
-
-def validate_export(output, expected_names)
-  expected_names.each do |directory|
-    path = output.join("skills", directory, "SKILL.md")
-    abort_with("missing exported skill: #{path}") unless path.file?
-  end
-
-  FORBIDDEN_TOP_LEVEL.each do |entry|
-    abort_with("forbidden project file in public export: #{entry}") if output.join(entry).exist?
-  end
-
-  relative_files(output.join("skills")).each do |relative|
-    path = output.join("skills", relative)
-    abort_with("symbolic link in public export: #{path}") if File.symlink?(path)
-    text = File.binread(path)
-    next if text.include?("\x00")
-
-    decoded = text.force_encoding(Encoding::UTF_8)
-    next unless decoded.valid_encoding?
-    abort_with("suspicious credential-like content: #{path}") if suspicious_content?(decoded)
-    abort_with("absolute local path in public export: #{path}") if decoded.match?(%r{(?:\A|[^.\w])/(?:Users|home|private|tmp)/})
-    abort_with("Agent root path in public export: #{path}") if decoded.match?(%r{\.(?:agents|claude|codex|hermes|pi|qoder|trae)/skills})
-  end
-
-  validate_markdown_links(output.join("skills"))
-end
-
-def load_config
-  abort_with("missing #{CONFIG_PATH}") unless CONFIG_PATH.file?
-
-  config = JSON.parse(CONFIG_PATH.read)
-  skills = config["skills"]
-  abort_with("yss-public-skills.json skills must be a non-empty array") unless skills.is_a?(Array) && !skills.empty?
-  abort_with("duplicate skill directory in public list") unless skills.uniq.length == skills.length
-  skills.each do |skill|
-    abort_with("invalid skill directory: #{skill.inspect}") unless skill.is_a?(String) && skill.match?(/\Ayss-[a-z0-9]+(?:-[a-z0-9]+)*\z/)
-  end
-
-  abort_with("canonical_root must be .agents/skills") unless config["canonical_root"] == ".agents/skills"
-  groupings = config["groupings"]
-  abort_with("yss-public-skills.json groupings must be an array") unless groupings.is_a?(Array) && !groupings.empty?
-  grouped = []
-  groupings.each do |group|
-    abort_with("invalid public skill grouping") unless group.is_a?(Hash) && group["title"].is_a?(String) && !group["title"].empty? && group["description"].is_a?(String) && group["skills"].is_a?(Array) && !group["skills"].empty?
-    group["skills"].each do |skill|
-      abort_with("unknown grouped skill: #{skill}") unless skills.include?(skill)
-      grouped << skill
-    end
-  end
-  abort_with("a skill appears in more than one public grouping") unless grouped.uniq.length == grouped.length
-  abort_with("public grouping does not cover every listed skill") unless grouped.sort == skills.sort
-
-  config
-rescue JSON::ParserError => e
-  abort_with("invalid yss-public-skills.json: #{e.message}")
-end
-
-def build_export(output, config)
-  output = Pathname.new(output).expand_path
-  ensure_output_destination(output)
-  FileUtils.mkdir_p(output)
-  FileUtils.rm_rf(output.join("skills"))
-  FileUtils.rm_f(output.join("skills.sh.json"))
-  FileUtils.rm_f(output.join(".yss-export-manifest.json"))
-  FileUtils.mkdir_p(output.join("skills"))
-
-  exported = []
-  config.fetch("skills").each do |directory|
-    source = CANONICAL_ROOT.join(directory)
-    abort_with("listed skill directory must not be a symbolic link: #{source}") if File.symlink?(source)
-    abort_with("listed skill directory does not exist: #{source}") unless source.directory?
-    source_skill = source.join("SKILL.md")
-    abort_with("listed skill has no SKILL.md: #{source_skill}") unless source_skill.file?
-    fields, = parse_frontmatter(source_skill)
-    normalized = normalized_name(fields.fetch("name"))
-    abort_with("duplicate normalized skill name: #{fields.fetch('name')}") if exported.any? { |item| normalized_name(item.fetch("name")) == normalized }
-
-    destination = output.join("skills", directory)
-    FileUtils.mkdir_p(destination)
-    exported_files = []
-    safe_source_files(source).each do |file|
-      relative = file.relative_path_from(source).to_s
-      target = destination.join(relative)
-      FileUtils.mkdir_p(target.dirname)
-      bytes = File.binread(file)
-      source_text = bytes.dup.force_encoding(Encoding::UTF_8)
-      public_relative = File.join(directory, relative)
-      File.binwrite(target, bytes.include?("\x00") || !source_text.valid_encoding? ? bytes : sanitize_text(bytes, public_relative))
-      FileUtils.chmod(file.stat.mode & 0o7777, target)
-      exported_files << relative
-    end
-
-    exported << {
-      "directory" => directory,
-      "name" => fields.fetch("name"),
-      "description" => fields.fetch("description"),
-      "files" => exported_files.sort
-    }
-  end
-
-  public_names = exported.to_h { |item| [item.fetch("directory"), item.fetch("name")] }
-  skills_sh_groupings = config.fetch("groupings").map do |group|
-    group.merge("skills" => group.fetch("skills").map { |directory| public_names.fetch(directory) })
-  end
-  skills_sh = {
-    "$schema" => "https://skills.sh/schemas/skills.sh.schema.json",
-    "notGrouped" => "bottom",
-    "groupings" => skills_sh_groupings
-  }
-  File.write(output.join("skills.sh.json"), JSON.pretty_generate(skills_sh) + "\n")
-
-  manifest = {
-    "format_version" => 1,
-    "source" => {
-      "repository" => config.fetch("repository"),
-      "canonical_root" => config.fetch("canonical_root")
-    },
-    "skills" => exported,
-    "generated_files_sha256" => relative_files(output.join("skills")).to_h do |relative|
-      [relative, Digest::SHA256.file(output.join("skills", relative)).hexdigest]
-    end
-  }
-  File.write(output.join(".yss-export-manifest.json"), JSON.pretty_generate(manifest) + "\n")
-  validate_export(output, config.fetch("skills"))
-end
-
-def compare_managed(expected, actual)
-  expected_paths = MANAGED_PATHS.flat_map do |path|
-    root = expected.join(path)
-    root.directory? ? relative_files(root).map { |file| Pathname.new(path).join(file).to_s } : [path]
-  end.sort
-  actual_paths = MANAGED_PATHS.flat_map do |path|
-    root = actual.join(path)
-    root.directory? ? relative_files(root).map { |file| Pathname.new(path).join(file).to_s } : [path]
-  end.sort
-  abort_with("export is out of date; managed file list differs") unless expected_paths == actual_paths
-
-  expected_paths.each do |relative|
-    expected_bytes = File.binread(expected.join(relative))
-    actual_path = actual.join(relative)
-    abort_with("export is out of date: #{relative}") unless actual_path.file? && File.binread(actual_path) == expected_bytes
-  end
-end
-
-options = { check: false }
-parser = OptionParser.new do |opts|
-  opts.banner = "Usage: scripts/export-yss-skills --output DIR [--check]"
-  opts.on("--output DIR", "Export destination") { |value| options[:output] = value }
-  opts.on("--check", "Validate an existing export without writing") { options[:check] = true }
-  opts.on("-h", "--help", "Show this help") { puts opts; exit 0 }
-end
-parser.parse!
-abort_with("--output is required") unless options[:output]
-
-config = load_config
-output = Pathname.new(options[:output]).expand_path
-if options[:check]
-  ensure_output_destination(output)
-  abort_with("export directory does not exist: #{output}") unless output.directory?
-  Dir.mktmpdir("yss-export-check-") do |temporary|
-    expected = Pathname.new(temporary)
-    build_export(expected, config)
-    validate_export(output, config.fetch("skills"))
-    compare_managed(expected, output)
-  end
-  puts "YSS public export is up to date: #{output}"
-else
-  build_export(output, config)
-  puts "Exported #{config.fetch('skills').length} YSS skills to #{output}"
-end
+#!/usr/bin/env node
+import { exportSkills } from "./lib/export-skills.mjs";
+try { process.stdout.write(`${exportSkills()}\n`); } catch (error) { process.stderr.write(`${error.message}\n`); process.exitCode = 1; }

package/template/scripts/generate-lifecycle-artifacts

@@ -1,26 +1,2 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require "optparse"
-require_relative "lifecycle-registry"
-
-options = { check: false, write: false, registry: LifecycleRegistry::DEFAULT_REGISTRY }
-OptionParser.new do |parser|
-  parser.on("--check", "仅校验派生文档是否与注册表一致") { options[:check] = true }
-  parser.on("--write", "写入派生文档的受管结构区") { options[:write] = true }
-  parser.on("--registry PATH", "使用指定注册表") { |path| options[:registry] = Pathname.new(path) }
-end.parse!
-
-abort("--check 与 --write 不能同时使用") if options[:check] && options[:write]
-
-registry = LifecycleRegistry.validate!(LifecycleRegistry.load_registry(options[:registry]))
-targets = [
-  [LifecycleRegistry::ROOT.join("docs/process/lifecycle-artifact-map.md"), "<!-- lifecycle-registry:structure:start -->", "<!-- lifecycle-registry:structure:end -->", LifecycleRegistry.render_lifecycle_structure(registry)],
-  [LifecycleRegistry::ROOT.join("docs/process/harness-work-unit-map.md"), "<!-- lifecycle-registry:work-units:start -->", "<!-- lifecycle-registry:work-units:end -->", LifecycleRegistry.render_work_units(registry)]
-]
-
-targets.each do |path, start_marker, end_marker, rendered|
-  LifecycleRegistry.replace_region!(path, start_marker, end_marker, rendered, check: options[:check])
-end
-
-puts(options[:check] ? "生命周期派生产物与注册表一致" : "生命周期派生产物已更新")
+#!/usr/bin/env node
+import "./node-generate-lifecycle-artifacts.mjs";

package/template/scripts/implementation-path-policy

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+export {
+  normalizeImplementationPath as normalize,
+  validImplementationPath as valid,
+  violation
+} from "./lib/implementation-path-policy.mjs";