create-yss-spec 2.2.10 → 3.0.1

package/template/.hermes/skills/yss-ddd-scaffold-generator/scripts/scaffold-generator.test.mjs

@@ -1,388 +0,0 @@
-import assert from "node:assert/strict";
-import { execFile } from "node:child_process";
-import { chmod, mkdtemp, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
-import { existsSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { fileURLToPath } from "node:url";
-import { run } from "./run_scaffold_verification.mjs";
-import { makeGitlinkFixture } from "../../../../scripts/lib/git-submodule-fixtures.mjs";
-import { GITLINK_MODE, gitLsFilesStage } from "../../../../scripts/lib/repository-scope-policy.mjs";
-
-const scripts = path.dirname(fileURLToPath(import.meta.url));
-const generator = path.join(scripts, "generate_scaffold.mjs");
-const workflow = path.join(scripts, "generate_and_verify_scaffold.mjs");
-const command = (args, options = {}) => new Promise((resolve) => execFile(process.execPath, [generator, ...args], { encoding: "utf8", ...options }, (error, stdout, stderr) => resolve({ code: error?.code ?? 0, stdout, stderr })));
-const workflowCommand = (args, options = {}) => new Promise((resolve) => execFile(process.execPath, [workflow, ...args], { encoding: "utf8", ...options }, (error, stdout, stderr) => resolve({ code: error?.code ?? 0, stdout, stderr })));
-function contract(outputDir, overrides = {}) {
-  return {
-    schema_version: 2,
-    contract_id: "scaffold-1",
-    contract_version: 1,
-    scaffold_request_id: "scaffold-request-1",
-    status: "approved",
-    router_draft_ref: "router-1",
-    lifecycle_approval_ref: "approval-1",
-    persisted_ref: "persisted-1",
-    current_version: 1,
-    implementation_repository: "external",
-    backend_repository: "external",
-    scaffold_status: "required",
-    project_name: "demo-service",
-    target_output_dir: outputDir,
-    base_package: "com.yss.demo",
-    maven_coordinates: {
-      group_id: "com.yss.datamiddle",
-      project_version: "1.0.0-SNAPSHOT",
-      parent: { group_id: "com.yss.datamiddle", artifact_id: "yss-datamiddle-parent", version: "2.0.0-SNAPSHOT" },
-      yss_components_version: "2.0.0-SNAPSHOT"
-    },
-    profiles: {
-      architecture: "target-domain-model",
-      persistence: "mybatis-plus",
-      database: "mysql",
-      platform: "spring-boot-2.7-jdk8",
-      validation_namespace: "javax",
-      dto_placement: "web",
-      repository: "yss-internal"
-    },
-    allowed_write_paths: ["."],
-    expected_evidence_files: [".yss/scaffold-generation.json"],
-    verification_commands: ["./mvnw validate", "./mvnw test", "./mvnw package"],
-    approval: { approval_ref: "approval-1", approver: "reviewer", persisted_ref: "persisted-1", current_version: 1 },
-    work_unit: { id: "unit-1", behavior: "scaffold", primary_skill: "yss-ddd-scaffold-generator", supporting_skills: ["yss-router"], tdd_mode: "controlled-generation", allowed_write_paths: ["."], expected_evidence: ["manifest"], verification_commands: ["./mvnw validate", "./mvnw test", "./mvnw package"], controlled_generation: true },
-    generation_policy: { mode: "initialize-only", existing_target: "unsupported", old_project_migration: "unsupported", template_upgrade: "unsupported" },
-    ...overrides
-  };
-}
-async function fixture(contractOverrides = {}) { const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-node-")); const output = path.join(root, "implementation"); await mkdir(output); const contractFile = path.join(root, "contract.json"); await writeFile(contractFile, `${JSON.stringify(contract(output, contractOverrides), null, 2)}\n`); return { root, output, contractFile, args: ["--project-name", "demo-service", "--base-package", "com.yss.demo", "--output-dir", output, "--database", "mysql", "--contract-id", "scaffold-1", "--contract-version", "1", "--approval-ref", "approval-1", "--router-draft-ref", "router-1", "--persisted-ref", "persisted-1", "--contract-file", contractFile, "--group-id", "com.yss.datamiddle", "--project-version", "1.0.0-SNAPSHOT", "--parent-group-id", "com.yss.datamiddle", "--parent-artifact-id", "yss-datamiddle-parent", "--parent-version", "2.0.0-SNAPSHOT", "--yss-components-version", "2.0.0-SNAPSHOT"] }; }
-
-const controlledEnvironment = {
-  ...process.env,
-  YSS_MAVEN_REPOSITORY_URL: "https://repo.example.invalid/repository/maven-public/",
-  MAVEN_REPO_USERNAME: "test-user",
-  MAVEN_REPO_PASSWORD: "test-password"
-};
-function targetManifest(overrides = {}) {
-  return {
-    schema_version: 2,
-    contract_id: "id",
-    contract_version: 1,
-    scaffold_request_id: "request",
-    contract_digest: "a".repeat(64),
-    approval_ref: "approval",
-    approver: "reviewer",
-    lifecycle_approval_ref: "approval",
-    router_draft_ref: "router",
-    persisted_ref: "persisted",
-    contract_file_ref: "contract",
-    current_version: 1,
-    allowed_write_paths: ["."],
-    expected_evidence_files: ["manifest"],
-    verification_commands: ["./mvnw validate", "./mvnw test", "./mvnw package"],
-    generation_mode: "controlled-generation",
-    completion_level: "generated",
-    profiles: { architecture: "target-domain-model", repository: "yss-internal" },
-    ownership: { generated_files: [] },
-    readiness: { downstream_skills: {}, architecture_ruleset: "b".repeat(64) },
-    generation_policy: { mode: "initialize-only", existing_target: "unsupported", old_project_migration: "unsupported", template_upgrade: "unsupported" },
-    maven_coordinates_source: "approved-contract",
-    ...overrides
-  };
-}
-async function prepareVerifierProject(project, manifest = targetManifest()) {
-  await mkdir(path.join(project, ".yss"), { recursive: true });
-  await mkdir(path.join(project, ".mvn"), { recursive: true });
-  await writeFile(path.join(project, ".mvn", "maven.config"), "-s .mvn/settings.xml\n-P yss-internal\n");
-  await writeFile(path.join(project, ".mvn", "settings.xml"), "<settings/>\n");
-  await writeFile(path.join(project, ".yss", "scaffold-generation.json"), `${JSON.stringify(manifest)}\n`);
-}
-
-test("生成批准的服务级 target profile 骨架，并写入可追溯 Manifest v2", async (t) => { const data = await fixture(); t.after(() => rm(data.root, { recursive: true, force: true })); const result = await command(data.args); assert.equal(result.code, 0, result.stderr); const project = path.join(data.output, "demo-service"); const manifest = JSON.parse(await readFile(path.join(project, ".yss/scaffold-generation.json"), "utf8")); assert.equal(manifest.schema_version, 2); assert.equal(manifest.scaffold_request_id, "scaffold-request-1"); assert.equal(manifest.slice_id, undefined); assert.equal(manifest.completion_level, "generated"); assert.equal(manifest.profiles.architecture, "target-domain-model"); assert.deepEqual(manifest.generation_policy, { mode: "initialize-only", existing_target: "unsupported", old_project_migration: "unsupported", template_upgrade: "unsupported" }); assert.match(manifest.generator.template_digest, /^[a-f0-9]{64}$/); assert.match(manifest.contract_digest, /^[a-f0-9]{64}$/); assert.ok(manifest.ownership.generated_files.length > 8); assert.ok(manifest.ownership.generated_files.every((item) => item.owner === "generator" && /^[a-f0-9]{64}$/.test(item.sha256))); assert.equal(manifest.generation_mode, "controlled-generation"); assert.deepEqual(manifest.verification_commands, ["./mvnw validate", "./mvnw test", "./mvnw package"]); assert.equal(manifest.bootstrap_main_class, "com.yss.demo.DemoServiceApplication"); assert.equal(manifest.bootstrap_main_source, "demo-service-bootstrap/src/main/java/com/yss/demo/DemoServiceApplication.java"); assert.match(await readFile(path.join(project, manifest.bootstrap_main_source), "utf8"), /class DemoServiceApplication/); assert.match(await readFile(path.join(project, "pom.xml"), "utf8"), /demo-service/); });
-
-test("schema v1 scaffold contract is unsupported and is never upgraded", async (t) => {
-  const data = await fixture({ schema_version: 1 });
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  const result = await command(data.args);
-  assert.equal(result.code, 1);
-  assert.match(result.stderr, /unsupported: scaffold contract schema_version=1/);
-  assert.equal(existsSync(path.join(data.output, "demo-service")), false);
-});
-
-test("一键工作流只有在真实 Maven 三命令全部通过后才报告完成", { timeout: 300_000 }, async (t) => {
-  if (!["YSS_MAVEN_REPOSITORY_URL", "MAVEN_REPO_USERNAME", "MAVEN_REPO_PASSWORD"].every((name) => process.env[name])) {
-    t.skip("缺少受控 YSS Maven 仓库环境，真实 Wrapper 验证由 L3 环境门禁执行");
-    return;
-  }
-  const data = await fixture();
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  const evidence = path.join(data.root, "workflow-evidence");
-  const result = await workflowCommand([...data.args, "--evidence-dir", evidence]);
-  assert.equal(result.code, 0, result.stderr);
-  assert.match(result.stdout, /脚手架生成与验证完成/);
-  const verification = JSON.parse(await readFile(path.join(evidence, "scaffold-verification.json"), "utf8"));
-  const workflowReport = JSON.parse(await readFile(path.join(evidence, "scaffold-workflow.json"), "utf8"));
-  assert.equal(verification.status, "passed");
-  assert.deepEqual(verification.commands.map((item) => item.command), ["./mvnw validate", "./mvnw test", "./mvnw package"]);
-  assert.ok(verification.commands.every((item) => item.exit_code === 0));
-  assert.equal(verification.preflight.project_settings_wired, true);
-  assert.equal(verification.preflight.repository_profile_wired, true);
-  assert.equal(workflowReport.status, "completed");
-  assert.equal(workflowReport.verification_ref, path.join(evidence, "scaffold-verification.json"));
-  const manifest = JSON.parse(await readFile(path.join(data.output, "demo-service", ".yss", "scaffold-generation.json"), "utf8"));
-  assert.equal(manifest.completion_level, "empty-scaffold-verified");
-});
-
-test("显式 Maven 坐标贯穿批准合同、生成参数、全部 POM 和生成清单", async (t) => {
-  const mavenCoordinates = {
-    group_id: "com.example.metadata",
-    project_version: "1.2.3-SNAPSHOT",
-    parent: {
-      group_id: "com.yss.datamiddle",
-      artifact_id: "yss-datamiddle-parent",
-      version: "2.0.0-SNAPSHOT"
-    },
-    yss_components_version: "2.0.0-SNAPSHOT"
-  };
-  const data = await fixture({ maven_coordinates: mavenCoordinates });
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  const result = await command([
-    ...data.args,
-    "--group-id", mavenCoordinates.group_id,
-    "--project-version", mavenCoordinates.project_version,
-    "--parent-group-id", mavenCoordinates.parent.group_id,
-    "--parent-artifact-id", mavenCoordinates.parent.artifact_id,
-    "--parent-version", mavenCoordinates.parent.version,
-    "--yss-components-version", mavenCoordinates.yss_components_version
-  ]);
-  assert.equal(result.code, 0, result.stderr);
-
-  const project = path.join(data.output, "demo-service");
-  const pomFiles = [
-    "pom.xml",
-    "demo-service-domain/pom.xml",
-    "demo-service-application/pom.xml",
-    "demo-service-infrastructure/pom.xml",
-    "demo-service-adapter/pom.xml",
-    "demo-service-adapter/demo-service-web/pom.xml",
-    "demo-service-bootstrap/pom.xml"
-  ];
-  const poms = await Promise.all(pomFiles.map((file) => readFile(path.join(project, file), "utf8")));
-  assert.ok(poms.every((pom) => pom.includes(mavenCoordinates.group_id)), "全部项目内坐标必须使用合同 groupId");
-  assert.ok(poms.every((pom) => pom.includes(mavenCoordinates.project_version)), "全部项目内坐标必须使用合同版本");
-  const manifest = JSON.parse(await readFile(path.join(project, ".yss/scaffold-generation.json"), "utf8"));
-  assert.deepEqual(manifest.maven_coordinates, mavenCoordinates);
-  assert.equal(manifest.maven_coordinates_source, "approved-contract");
-
-});
-
-test("生成工程声明命名仓库 profile、target DDD 依赖边界和构建门禁", async (t) => {
-  const data = await fixture();
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  const result = await command(data.args);
-  assert.equal(result.code, 0, result.stderr);
-  const project = path.join(data.output, "demo-service");
-  const mavenConfig = await readFile(path.join(project, ".mvn/maven.config"), "utf8");
-  const settings = await readFile(path.join(project, ".mvn/settings.xml"), "utf8");
-  assert.match(mavenConfig, /-s \.mvn\/settings\.xml/);
-  assert.match(mavenConfig, /-P yss-internal/);
-  assert.doesNotMatch(settings, /192\.168\.|<activeProfile>aliyun-only<\/activeProfile>/);
-  assert.match(settings, /\$\{env\.YSS_MAVEN_REPOSITORY_URL\}/);
-  assert.match(settings, /\$\{env\.MAVEN_REPO_USERNAME\}/);
-  assert.match(settings, /\$\{env\.MAVEN_REPO_PASSWORD\}/);
-
-  const domainPom = await readFile(path.join(project, "demo-service-domain/pom.xml"), "utf8");
-  const infrastructurePom = await readFile(path.join(project, "demo-service-infrastructure/pom.xml"), "utf8");
-  const bootstrapPom = await readFile(path.join(project, "demo-service-bootstrap/pom.xml"), "utf8");
-  assert.doesNotMatch(domainPom, /yss-component-(?:dto|exception)|jackson-databind|swagger-annotations|validation-api/);
-  assert.match(infrastructurePom, /yss-component-mybatis-plus-starter/);
-  assert.match(infrastructurePom, /spring-boot-starter-jdbc/);
-  assert.match(bootstrapPom, /spring-boot-starter-actuator/);
-  assert.match(bootstrapPom, /spring-boot-starter-test/);
-  const webPom = await readFile(path.join(project, "demo-service-adapter", "demo-service-web", "pom.xml"), "utf8");
-  assert.match(webPom, /yss-component-dto/);
-  assert.match(webPom, /yss-component-exception/);
-  assert.match(webPom, /io\.swagger\.core\.v3/);
-  const parentPom = await readFile(path.join(project, "pom.xml"), "utf8");
-  assert.match(parentPom, /lombok-mapstruct-binding/);
-  assert.match(parentPom, /maven-enforcer-plugin/);
-  assert.match(parentPom, /maven-compiler-plugin/);
-  assert.match(parentPom, /archunit-junit5/);
-});
-
-test("生成工程固定平台 profile、Wrapper checksum，并把调试日志隔离到 local 配置", async (t) => {
-  const data = await fixture();
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  const result = await command(data.args);
-  assert.equal(result.code, 0, result.stderr);
-  const project = path.join(data.output, "demo-service");
-  const wrapper = await readFile(path.join(project, ".mvn", "wrapper", "maven-wrapper.properties"), "utf8");
-  assert.match(wrapper, /^wrapperSha256Sum=[a-f0-9]{64}$/m);
-  assert.match(wrapper, /^distributionSha256Sum=[a-f0-9]{64}$/m);
-  const application = await readFile(path.join(project, "demo-service-bootstrap", "src", "main", "resources", "application.yml"), "utf8");
-  assert.doesNotMatch(application, /StdOutImpl|DEBUG/);
-  const local = await readFile(path.join(project, "demo-service-bootstrap", "src", "main", "resources", "application-local.yml"), "utf8");
-  assert.match(local, /StdOutImpl/);
-  assert.match(local, /DEBUG/);
-});
-
-test("initialize-only 在写文件前拒绝任何已存在目标和 --force", async (t) => { const data = await fixture(); t.after(() => rm(data.root, { recursive: true, force: true })); const rejected = await command(data.args.map((value) => value === data.contractFile ? path.join(data.root, "missing.json") : value)); assert.equal(rejected.code, 1); assert.match(rejected.stderr, /合同/); await mkdir(path.join(data.output, "demo-service")); await writeFile(path.join(data.output, "demo-service", "keep.txt"), "keep"); const noForce = await command(data.args); assert.equal(noForce.code, 1); assert.match(noForce.stderr, /initialize-only/); const forced = await command([...data.args, "--force"]); assert.equal(forced.code, 1); assert.match(forced.stderr, /initialize-only/); assert.equal(await readFile(path.join(data.output, "demo-service", "keep.txt"), "utf8"), "keep"); });
-
-test("拒绝基础包名与批准合同不一致", async (t) => {
-  const data = await fixture({ base_package: "com.example.approved" });
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  const result = await command(data.args);
-  assert.equal(result.code, 1);
-  assert.match(result.stderr, /--base-package 与脚手架合同不一致/);
-});
-
-test("合同 project_name、profile 和 allowed_write_paths 必须约束实际输出", async (t) => {
-  const wrongName = await fixture({ project_name: "other-service" });
-  t.after(() => rm(wrongName.root, { recursive: true, force: true }));
-  const nameResult = await command(wrongName.args);
-  assert.equal(nameResult.code, 1);
-  assert.match(nameResult.stderr, /--project-name 与脚手架合同不一致/);
-
-  const wrongProfile = await fixture({ profiles: { ...contract("unused").profiles, persistence: "mybatis" } });
-  t.after(() => rm(wrongProfile.root, { recursive: true, force: true }));
-  const profileResult = await command(wrongProfile.args);
-  assert.equal(profileResult.code, 1);
-  assert.match(profileResult.stderr, /unsupported persistence profile/);
-
-  const wrongPath = await fixture({ allowed_write_paths: ["another-service"], work_unit: { ...contract("unused").work_unit, allowed_write_paths: ["another-service"] } });
-  t.after(() => rm(wrongPath.root, { recursive: true, force: true }));
-  const pathResult = await command(wrongPath.args);
-  assert.equal(pathResult.code, 1);
-  assert.match(pathResult.stderr, /allowed_write_paths/);
-});
-
-test("initialize-only 拒绝以 --force 覆盖 .gitmodules 登记的挂载点", async (t) => {
-  const data = await fixture();
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  const superproject = path.join(data.root, "harness");
-  const output = path.join(superproject, "apps/backend");
-  await mkdir(path.join(output, "demo-service"), { recursive: true });
-  await writeFile(path.join(superproject, ".gitmodules"), "[submodule \"demo-service\"]\n\tpath = apps/backend/demo-service\n\turl = https://example.invalid/demo-service.git\n");
-  const contractFile = path.join(data.root, "gitlink-contract.json");
-  await writeFile(contractFile, `${JSON.stringify(contract(output), null, 2)}\n`);
-  const result = await command(["--project-name", "demo-service", "--base-package", "com.yss.demo", "--output-dir", output, "--database", "mysql", "--contract-id", "scaffold-1", "--contract-version", "1", "--approval-ref", "approval-1", "--router-draft-ref", "router-1", "--persisted-ref", "persisted-1", "--contract-file", contractFile, "--force"]);
-  assert.equal(result.code, 1, result.stderr);
-  assert.match(`${result.stdout}\n${result.stderr}`, /initialize-only|gitlink 不得由脚手架覆盖/);
-});
-
-test("拒绝在 detached HEAD 子仓工作树内当成普通目录生成", async (t) => {
-  const data = await fixture();
-  const detached = makeGitlinkFixture({ checkout: "detached-head" });
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  t.after(() => detached.cleanup());
-  const output = path.join(detached.superproject, detached.mount);
-  const contractFile = path.join(data.root, "detached-contract.json");
-  await writeFile(contractFile, `${JSON.stringify(contract(output), null, 2)}\n`);
-  const result = await command(["--project-name", "nested-service", "--base-package", "com.yss.demo", "--output-dir", output, "--database", "mysql", "--contract-id", "scaffold-1", "--contract-version", "1", "--approval-ref", "approval-1", "--router-draft-ref", "router-1", "--persisted-ref", "persisted-1", "--contract-file", contractFile]);
-  const text = `${result.stdout}\n${result.stderr}`;
-  assert.equal(result.code, 1, text);
-  assert.doesNotMatch(text, /请显式传入 --force/);
-  assert.match(text, /detached HEAD 不得当成普通目录写入/);
-  assert.equal(existsSync(path.join(output, "nested-service", "pom.xml")), false);
-  assert.equal((await readdir(output)).some((name) => name.includes("staging") || name === "nested-service"), false);
-});
-
-test("--force 覆盖真实 gitlink 不得走普通目录覆盖路径", async (t) => {
-  const data = await fixture();
-  const empty = makeGitlinkFixture({ checkout: "empty-gitlink" });
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  t.after(() => empty.cleanup());
-  const output = path.join(empty.superproject, "apps/backend");
-  const contractFile = path.join(data.root, "empty-gitlink-contract.json");
-  await writeFile(contractFile, `${JSON.stringify(contract(output), null, 2)}\n`);
-  const result = await command(["--project-name", "billing-service", "--base-package", "com.yss.demo", "--output-dir", output, "--database", "mysql", "--contract-id", "scaffold-1", "--contract-version", "1", "--approval-ref", "approval-1", "--router-draft-ref", "router-1", "--persisted-ref", "persisted-1", "--contract-file", contractFile, "--force"]);
-  const text = `${result.stdout}\n${result.stderr}`;
-  assert.equal(result.code, 1, text);
-  assert.doesNotMatch(text, /请显式传入 --force/);
-  assert.match(text, /initialize-only|--force 不得把 git-submodule 挂载点当成普通目录覆盖|gitlink 不得/);
-  assert.equal(existsSync(path.join(output, "billing-service", "pom.xml")), false);
-  assert.equal((await readdir(output)).some((name) => name.includes("backup")), false);
-  assert.equal(gitLsFilesStage(empty.superproject, empty.mount)?.mode, GITLINK_MODE);
-});
-
-test("验证器记录三条 wrapper 命令的成功和失败证据", async (t) => { const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-verifier-")); t.after(() => rm(root, { recursive: true, force: true })); const project = path.join(root, "project"); await prepareVerifierProject(project); const wrapper = path.join(project, "mvnw"); await writeFile(wrapper, "#!/bin/sh\n[ \"$1\" = test ] && exit 2\nprintf 'ran %s\\n' \"$1\"\n"); await chmod(wrapper, 0o755); const evidence = path.join(root, "evidence"); const report = await run(project, evidence, controlledEnvironment); assert.equal(report.status, "failed"); assert.equal(report.failure_category, "test-failure"); assert.equal(report.commands[1].failure_category, "test-failure"); assert.equal(report.preflight.wrapper_executable, true); assert.deepEqual(report.commands.map((item) => item.exit_code), [0, 2, 0]); assert.match(await readFile(path.join(evidence, "mvnw-test.stderr.log"), "utf8"), /^$/); });
-
-test("验证器把内部仓库解析失败与编译失败分开报告", async (t) => {
-  const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-repository-failure-"));
-  t.after(() => rm(root, { recursive: true, force: true }));
-  const project = path.join(root, "project");
-  await prepareVerifierProject(project);
-  const wrapper = path.join(project, "mvnw");
-  await writeFile(wrapper, "#!/bin/sh\nprintf 'Non-resolvable parent POM: Could not transfer artifact\\n'\nexit 1\n");
-  await chmod(wrapper, 0o755);
-  const report = await run(project, path.join(root, "evidence"), controlledEnvironment);
-  assert.equal(report.status, "failed");
-  assert.equal(report.failure_category, "repository-access");
-  assert.ok(report.commands.every((item) => item.failure_category === "repository-access"));
-  assert.equal(typeof report.preflight.maven_repository_credentials_configured, "boolean");
-});
-
-test("验证器单独标记 Java 编译失败和 Bootstrap 主类缺失", async (t) => {
-  const cases = [
-    { output: "[ERROR] COMPILATION ERROR", expected: "compilation" },
-    { output: "Unable to find main class", expected: "bootstrap-entrypoint" }
-  ];
-  for (const item of cases) {
-    const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-build-failure-"));
-    t.after(() => rm(root, { recursive: true, force: true }));
-    const project = path.join(root, "project");
-    await prepareVerifierProject(project);
-    const wrapper = path.join(project, "mvnw");
-    await writeFile(wrapper, `#!/bin/sh\n[ "$1" = package ] || exit 0\nprintf '%s\\n' '${item.output}' >&2\nexit 1\n`);
-    await chmod(wrapper, 0o755);
-    const report = await run(project, path.join(root, "evidence"), controlledEnvironment);
-    assert.equal(report.failure_category, item.expected);
-    assert.equal(report.commands[2].failure_category, item.expected);
-  }
-});
-
-test("验证器在全部 Maven 命令成功时通过并保留日志引用", async (t) => { const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-verifier-success-")); t.after(() => rm(root, { recursive: true, force: true })); const project = path.join(root, "project"); await prepareVerifierProject(project); const wrapper = path.join(project, "mvnw"); await writeFile(wrapper, "#!/bin/sh\nprintf 'ran %s\\n' \"$1\"\n"); await chmod(wrapper, 0o755); const report = await run(project, path.join(root, "evidence"), controlledEnvironment); assert.equal(report.status, "passed"); assert.ok(report.commands.every((item) => item.exit_code === 0 && item.stdout_ref.endsWith(".stdout.log"))); });
-
-test("Manifest v2 在缺少受控仓库环境时先于 Maven 执行阻断", async (t) => {
-  const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-v2-preflight-"));
-  t.after(() => rm(root, { recursive: true, force: true }));
-  const project = path.join(root, "project");
-  await prepareVerifierProject(project);
-  const wrapper = path.join(project, "mvnw");
-  await writeFile(wrapper, "#!/bin/sh\nprintf 'must not run'\nexit 99\n");
-  await chmod(wrapper, 0o755);
-  const report = await run(project, path.join(root, "evidence"), { ...process.env, YSS_MAVEN_REPOSITORY_URL: "", MAVEN_REPO_USERNAME: "", MAVEN_REPO_PASSWORD: "" });
-  assert.equal(report.status, "failed");
-  assert.equal(report.failure_category, "verification-preflight");
-  assert.deepEqual(report.commands, []);
-  assert.ok(report.preflight.failures.includes("repository-url-not-configured"));
-});
-
-test("Manifest schema v1 is unsupported and verifier never executes its wrapper", async (t) => {
-  const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-v1-unsupported-"));
-  t.after(() => rm(root, { recursive: true, force: true }));
-  const project = path.join(root, "project");
-  await prepareVerifierProject(project, { schema_version: 1, contract_id: "legacy", contract_version: 1 });
-  const wrapper = path.join(project, "mvnw");
-  await writeFile(wrapper, "#!/bin/sh\nprintf 'must not run' > wrapper-ran\n");
-  await chmod(wrapper, 0o755);
-  await assert.rejects(() => run(project, path.join(root, "evidence"), controlledEnvironment), /unsupported: scaffold Manifest schema_version=1/);
-  assert.equal(existsSync(path.join(project, "wrapper-ran")), false);
-});
-
-test("验证日志会脱敏 Maven 仓库凭据", async (t) => {
-  const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-redaction-"));
-  t.after(() => rm(root, { recursive: true, force: true }));
-  const project = path.join(root, "project");
-  await prepareVerifierProject(project);
-  const wrapper = path.join(project, "mvnw");
-  await writeFile(wrapper, "#!/bin/sh\nprintf '%s %s\\n' \"$MAVEN_REPO_USERNAME\" \"$MAVEN_REPO_PASSWORD\"\n");
-  await chmod(wrapper, 0o755);
-  const sensitiveEnvironment = { ...controlledEnvironment, MAVEN_REPO_USERNAME: "sensitive-user", MAVEN_REPO_PASSWORD: "sensitive-password" };
-  const evidence = path.join(root, "evidence");
-  await run(project, evidence, sensitiveEnvironment);
-  const log = await readFile(path.join(evidence, "mvnw-validate.stdout.log"), "utf8");
-  assert.doesNotMatch(log, /sensitive-user|sensitive-password/);
-  assert.match(log, /\[REDACTED:MAVEN_REPO_USERNAME\].*\[REDACTED:MAVEN_REPO_PASSWORD\]/);
-});

package/template/.hermes/skills/yss-design-system/SKILL.md

@@ -1,105 +0,0 @@
----
-name: yss-design-system
-description: Use when YSS 产品设计系统与 Ant Design 企业级 UI 风格基线。涉及页面设计、原型评审、UI 实现、组件选型、主题 token、颜色排版间距、响应式验收、Ant Design/YSS UI 风格一致性、docs/design/design.md 更新或从外部设计系统引入规范时必须使用。
----
-
-# YSS Design System
-
-本技能用于把项目 UI 统一到一套可执行的设计系统基线：Ant Design 企业后台风格、YSS 页面工程习惯、设计 token、组件语义、交互状态和响应式验收。
-
-## 权威资料
-
-- 项目设计系统文档：`docs/design/design.md`，作为团队可读的唯一规范来源。
-- 项目 token 快照：`docs/design/tokens/theme.json`、`docs/design/tokens/tokens.default.json`、`docs/design/tokens/tokens.dark.json`、`docs/design/tokens/tokens.compact.json`、`docs/design/tokens/variables.css`、`docs/design/tokens/variables.dark.css`。
-- 本技能执行清单：`references/design-system.md`，用于 Agent 执行和评审，不替代 `docs/design/design.md`。
-- 历史输入包：`/Users/zhudaoming/Downloads/Product-Design-System`，只用于追溯首次引入来源，不作为后续工程依赖。
-- 默认亮色覆盖：项目 Ant Design 5 Less / `:root` 变量已裁定进 `docs/design/design.md` 与 token 快照；原始 Less 不是实现语言。
-- Codex `$design-qa` 项目对照：`references/design-qa-theme.md`，不替代官方 `design-qa` 流程，也不改上游插件正文。
-- 原型阶段合同：`yss-prototype-stage`，用于统一跨 Agent 的原型资产和浏览器验证证据。AntD 事实由 `yss-antd-design` 提供，且只用于原型设计构建。
-
-如果只需要快速判断，先读本文件。若要写 UI 规范、实现页面、评审设计或调整 token，必须读项目内 `docs/design/design.md`；若要执行评审或实现检查，再读 `references/design-system.md`。
-
-## 使用流程
-
-1. 先判断任务阶段：设计系统引入 / 产品设计 / 原型评审 / 前端实现 / UI 改造 / 主题 token 落地。
-2. 读取已有资产：`docs/design/design.md`、相关 Spec、交互说明、状态矩阵、OpenAPI Draft、现有页面代码。
-3. 按设计系统基线约束输出或修改产物：颜色、排版、间距、圆角、动效、组件、状态、响应式。
-4. 若是产品设计阶段，先使用 `yss-prototype-stage`；Codex 以 `product-design:index` 为主入口，其他 Agent 必须交付等价合同资产和证据。
-5. 若是前端实现阶段，配合 `yss-ui`、`yss-ui-business-page-generation`、`yss-components`、`yss-formily`；生命周期编排和旧触发词兼容再使用 `yss-page-module-development`，但本技能负责风格与体验一致性门禁。
-6. 若发现现有设计系统文档不足，先更新 `docs/design/design.md`，再让实现或评审引用该文档。
-
-## 核心基线
-
-- UI 定位：中后台、数据密集、表单密集、流程密集、可扫描、低装饰。
-- 主色：`#3371ff`（`--primary-color` / `--brand-color-primary`），用于主操作、链接、焦点、选中态和激活导航。
-- 默认字号：14px；主要字重：400 / 600；字体栈为系统字体，不强制 `Inter`。
-- 默认控件高度：32px；默认圆角 6px。
-- 间距：4px 网格，优先使用 token，不写任意 magic number。
-- 运行时换肤：短名 CSS 变量必须指向 `--brand-*`，不要再维护第二套色值。
-- 表面层级：页面背景、内容容器、浮层三层模型。
-- 组件语言：优先 Ant Design / YSS UI 语义，不自造同类控件。
-- 状态完整性：loading、empty、error、readonly、disabled、no-permission、conflict、success 必须在设计或实现中可解释。
-- Ant Design v6 原型基线：先用语义 token 定义角色，再用组件 token 或 CSS variables 落地；不以局部硬编码替代主题层。
-- 双轨版本：主题/视觉标准为 React Ant Design v6；生产 API 为 Vue 3 + YSS UI + 实现仓 lockfile 的 Ant Design Vue 4.x。只迁移语义、Token、状态与验收行为。
-
-## 强制规则
-
-- 不把该系统改造成营销落地页风格；业务应用首屏应直接进入可用工作界面。
-- 不用大面积渐变、装饰插画、夸张 hero、过度卡片化或单色系视觉堆叠替代信息结构。
-- 不在同一决策区域放两个 primary 按钮。
-- 每个页面或决策区域只保留一个 single primary action；其余动作降级为默认、链接或危险操作。
-- 不硬编码表面色、边框色、状态色；优先使用 token 或主题变量。
-- 交互原型中的每个可点击主动作都必须给出 interaction feedback：状态变化、禁用原因、成功或失败反馈至少覆盖其一。
-- accessibility：品牌 Seed `#3371ff` 保持不变；实际文字/背景组合不满足 WCAG 2.2 AA 时，优先通过 `ConfigProvider` component token 调整，并验证 default/hover/active/disabled/focus、键盘焦点、200% zoom、reduced motion 与目标尺寸，不新增页面级特例色。
-- React + Ant Design 的暗色或紧凑密度必须使用 theme algorithm，不手工反转颜色或逐控件压缩尺寸。
-- 不用 Tag 表达关键错误、阻断或审批状态；关键状态必须有可读文本和语义反馈。
-- 不让按钮、标签、表头、弹窗、卡片中的文字溢出或遮挡。
-- 不在表格 / 筛选 / 批量操作密集页面使用松散营销式布局。
-
-## 产出要求
-
-设计类任务至少输出：
-
-- 设计系统引用：明确引用 `docs/design/design.md`。
-- 页面和模块：页面清单、布局结构、主路径、异常路径。
-- 组件选择：YSS UI / Ant Design 组件映射。
-- 状态矩阵：加载、空、错、禁用、只读、无权限、冲突、成功。
-- API 反推：字段、筛选、分页、动作、错误码、权限、并发或幂等规则。
-- 响应式要求：关键断点和窄屏替代形态。
-
-实现类任务至少检查：
-
-- 是否通过 `ConfigProvider`、CSS variables 或项目 token 消费主题。
-- 是否将颜色、圆角、阴影和状态样式绑定到 semantic token，而不是复制表面色和交互色。
-- 是否保持 32px 默认控件高度、14px 默认正文、4px 间距网格。
-- 是否使用 YSS UI / Ant Design 的语义组件，而不是自造同类组件。
-- 是否保留 hover、focus、active、disabled、loading、error、empty 状态。
-- 是否为可提交、导出、保存、发布、审批等操作提供明确的 interaction feedback 与不可逆操作确认。
-- 是否在核心视口无横向溢出；表格横向滚动必须被限定在表格容器内。
-
-## 与其他技能的关系
-
-| 场景 | 配合技能 |
-| --- | --- |
-| Spec 后做页面 / 原型 / 交互说明 | `yss-prototype-stage` → `product-design:index` |
-| 低保真原型进入高保真前评审 | `prototype-review` |
-| 低保真评审通过后的高保真 HTML 原型 | `yss-prototype-stage`；`high-fidelity-html-prototype` 仅兼容入口 |
-| 低保真线框或流程图 | `product-design:index` |
-| 前端页面实现 | `yss-ui` / `yss-ui-business-page-generation`；生命周期兼容使用 `yss-page-module-development` |
-| 表单 schema | `yss-formily` |
-| YTable / YTree / 高度自适应 | `yss-components` / `yss-use-table-height` / `yss-use-tree-height` |
-| 原型阶段的 Ant Design v6 组件 / token / demo 查询 | `yss-antd-design`（只用于原型设计构建；前端落地改用 `yss-ui`） |
-| Codex 原型交接前的视觉 QA | `design-qa`；token / 字体对照读 `references/design-qa-theme.md`，以项目覆盖为准 |
-| Product Design 通用 starter 接入 YSS | `yss-prototype-stage/references/product-design-adapter.md`；锁定 antd@6、pnpm、主题 adapter、feature 级 QA 与证据 |
-| API 契约 / 接入 | `yss-openapi-governance` / `yss-api-integration` |
-
-## 更新设计系统
-
-当用户要求“引入设计系统”“形成项目规范”“更新设计系统 skill”时：
-
-1. 分析来源设计系统，不原样堆拷贝。
-2. 将稳定规范落到 `docs/design/design.md`。
-3. 将 Agent 执行入口落到 `.agents/skills/yss-design-system/SKILL.md`。
-4. 将 Agent 执行检查清单更新到 `.agents/skills/yss-design-system/references/design-system.md`。
-5. 更新 `docs/design/README.md` 和必要的 `AGENTS.md` 入口规则。
-6. 运行 `node .agents/skills/yss-design-system/scripts/validate-frontmatter.mjs`、对应 `node --test` 和 markdown/diff 基础检查。

package/template/.hermes/skills/yss-design-system/agents/openai.yaml

@@ -1,5 +0,0 @@
-version: 1
-interface:
-  display_name: "YSS Design System"
-  short_description: "YSS 产品设计系统与 Ant Design 风格基线"
-  default_prompt: "Use $yss-design-system to design or review a YSS UI against the project design system."

package/template/.hermes/skills/yss-design-system/references/design-qa-theme.md

@@ -1,64 +0,0 @@
-# Design QA 项目主题对照
-
-本文件给 Codex `$design-qa` 使用。官方 `design-qa` skill 仍负责截图对比流程和 `final result: passed|blocked`；本文件只提供项目视觉真相，不改上游插件正文。
-
-## Source visual truth
-
-- 规范：`docs/design/design.md`
-- Token：`docs/design/tokens/theme.json`、`docs/design/tokens/tokens.default.json`、`docs/design/tokens/variables.css`
-- 实现截图：当前原型或页面在同一 viewport / 主题 / 状态下的渲染
-
-官方 `https://ant.design/design.md` 只是上游默认。项目覆盖与官方不同时，以项目覆盖为准。
-
-## 必查 fidelity surface（项目覆盖）
-
-### Colors and visual tokens
-
-| 角色 | 必须对照 | 记为 P1 token drift |
-| --- | --- | --- |
-| 主色 | `#3371ff` | `#1677ff` 或 `#3177ff` 当默认主色 |
-| 主色 hover / active | `#4096ff` / `#0958d9` | 用算法重算替代 `:root` 显式值且未记录 |
-| 错误色 | `#f5222d` | 官方 `#ff4d4f` 当默认错误色 |
-| 成功 / 警告 | `#52c41a` / `#faad14` | 改成非功能色装饰 |
-| 页面背景 | `#f0f2f5` | `#f5f5f5` 或其它灰底当默认 layout |
-| 容器 / 浮层 | `#ffffff` | 用卡片阴影堆叠替代表面层级 |
-| 主文本 / 次文本 | `rgba(0, 0, 0, 0.88)` / `rgba(0, 0, 0, 0.65)` | `#2e2e2e` / `#646464` 当默认文本 |
-| 边框 / 分割线 | `#d9d9d9` / `#f0f0f0` | `#dbdbdb` / `#f1f1f1` 当默认边框 |
-| 运行时变量 | `--primary-color` 指向 `--brand-color-primary` | 页面另写一套 Less 色值 |
-
-`blue` 预设色板里的 `#1677ff` 不是品牌主色，不要据此判定主色漂移。
-
-### Fonts and typography
-
-| 角色 | 必须对照 | 记为 P1 token drift |
-| --- | --- | --- |
-| 默认正文字号 | 14px | 16px 营销字号当正文 |
-| 默认控件高度 | 32px | 明显偏离 32px 且未走 compact algorithm |
-| 字体栈 | 系统栈（`-apple-system, BlinkMacSystemFont, "Segoe UI", ...`） | 强制 `Inter` 或其它未登记品牌字体 |
-| 字重 | 400 / 600 | 用 700+ 表达选中或激活 |
-
-### Spacing and layout rhythm
-
-| 角色 | 必须对照 | 记为 P1 token drift |
-| --- | --- | --- |
-| 圆角 | 小控件 4px、默认 6px、容器 8px | 历史品牌 8px / 10px，或 Less 前半 4px 当全局默认 |
-| 间距网格 | 4 / 8 / 12 / 16 / 20 / 24 / 32 / 48 | 任意 magic number 撑开中后台密度 |
-| 顶栏 / 侧栏 | 顶栏 64px，深色侧栏 `#001529` | 未说明就改成营销式顶栏 |
-
-### Image quality and copy
-
-沿用官方 `design-qa` 规则。本主题不引入插画、logo 或营销文案；出现这类素材时按官方 rubric 记 finding，并同时记为偏离中后台定位。
-
-## 判定
-
-- 仍用官方 `#1677ff`、强制 `Inter` 或 8px 品牌圆角作为默认主题：P1。
-- 只改局部组件、且 `prototype-evidence.yaml` 的 `theme_override` 已记录：按官方 severity 评估，不自动升 P1。
-- 暗色模式：本轮未重派生完整暗色色板；暗色对照前若缺少新的 algorithm 派生证据，`final result: blocked`，写明 blocker。
-
-## 报告要求
-
-`design-qa.md` 必须写明：
-
-- source visual truth path：`docs/design/design.md` 与对应 token 文件
-- 已按本清单核对 Colors/tokens 与 Fonts/typography
-- 与官方默认的差异是否被接受为项目覆盖