create-yss-spec 2.2.9 → 3.0.0

package/template/.codex/skills/yss-ddd-scaffold-generator/scripts/run_scaffold_verification.mjs

@@ -10,23 +10,103 @@ const COMMANDS = PHASES.map((phase) => `./mvnw ${phase}`);
 const isoNow = () => new Date().toISOString();
 async function isFile(target) { try { return (await stat(target)).isFile(); } catch (error) { if (error.code === "ENOENT") return false; throw error; } }
 async function writeText(target, content) { await mkdir(path.dirname(target), { recursive: true }); await writeFile(target, content, "utf8"); }
+async function isExecutable(target) {
+  try { const info = await stat(target); return info.isFile() && Boolean(info.mode & 0o111); }
+  catch (error) { if (error.code === "ENOENT") return false; throw error; }
+}
+async function readTextIfPresent(target) { try { return await readFile(target, "utf8"); } catch (error) { if (error.code === "ENOENT") return ""; throw error; } }
+function configured(value) { return typeof value === "string" && value.trim().length > 0; }
+function redactSecrets(text, environment = process.env) {
+  let output = text;
+  for (const name of ["MAVEN_REPO_USERNAME", "MAVEN_REPO_PASSWORD"]) {
+    const value = environment[name];
+    if (configured(value)) output = output.replaceAll(value, `[REDACTED:${name}]`);
+  }
+  return output;
+}
+function classifyFailure(phase, outcome) {
+  if (outcome.exitCode === 0) return null;
+  const output = `${outcome.stdout}\n${outcome.stderr}`.replaceAll(/\u001B\[[0-9;]*m/g, "");
+  if (/Non-resolvable parent POM|Could not transfer artifact|Could not resolve (?:dependencies|artifact)|status code: 401|\bUnauthorized\b|PKIX path building failed|Name or service not known|Unknown host/i.test(output)) return "repository-access";
+  if (/Unable to find main class|mainClass.*(?:not found|missing)/i.test(output)) return "bootstrap-entrypoint";
+  if (/COMPILATION ERROR|Compilation failure|maven-compiler-plugin/i.test(output)) return "compilation";
+  if (phase === "validate") return "project-model";
+  if (phase === "test") return "test-failure";
+  if (phase === "package") return "packaging";
+  return "maven-execution";
+}
 function parseArgs(argv) { const result = {}; for (let index = 0; index < argv.length; index += 1) { let token = argv[index]; if (token === "--help" || token === "-h") { result.help = true; continue; } const equals = token.indexOf("="); let value; if (equals !== -1) { value = token.slice(equals + 1); token = token.slice(0, equals); } if (!["--project-root", "--evidence-dir"].includes(token)) throw new Error(`不支持的参数: ${token}`); if (value === undefined) value = argv[++index]; if (!value || value.startsWith("--")) throw new Error(`参数 ${token} 缺少值`); result[token === "--project-root" ? "projectRoot" : "evidenceDir"] = path.resolve(value); } if (result.help) return result; if (!result.projectRoot || !result.evidenceDir) throw new Error("必须提供 --project-root 和 --evidence-dir"); return result; }
 function validateManifest(manifest) {
-  const required = ["schema_version", "contract_id", "contract_version", "slice_id", "approval_ref", "approver", "lifecycle_approval_ref", "router_draft_ref", "persisted_ref", "contract_file_ref", "current_version", "allowed_write_paths", "expected_evidence_files", "verification_commands", "generation_mode"];
+  if (manifest.schema_version !== 2) throw new Error(`unsupported: scaffold Manifest schema_version=${manifest.schema_version}；只验证 Target Profile v2`);
+  const required = ["schema_version", "contract_id", "contract_version", "scaffold_request_id", "contract_digest", "profiles", "ownership", "readiness", "generation_policy", "completion_level", "approval_ref", "approver", "lifecycle_approval_ref", "router_draft_ref", "persisted_ref", "contract_file_ref", "current_version", "allowed_write_paths", "expected_evidence_files", "verification_commands", "generation_mode"];
   const missing = required.filter((field) => manifest[field] === undefined || manifest[field] === null || manifest[field] === "");
   if (manifest.generation_mode !== "controlled-generation" || missing.length) throw new Error(`脚手架生成元数据清单不完整或不是 controlled-generation: ${missing.join(", ")}`);
+  if (manifest.profiles.architecture !== "target-domain-model" || manifest.generation_policy.mode !== "initialize-only" || manifest.generation_policy.existing_target !== "unsupported" || manifest.generation_policy.old_project_migration !== "unsupported" || manifest.generation_policy.template_upgrade !== "unsupported") throw new Error("Manifest v2 必须声明 Target Profile 与严格 initialize-only；已有目标、旧项目迁移和模板升级均须为 unsupported");
   if (manifest.current_version !== manifest.contract_version) throw new Error("脚手架生成元数据清单不是当前合同版本");
   if (JSON.stringify(manifest.verification_commands) !== JSON.stringify(COMMANDS)) throw new Error("脚手架生成元数据清单验证命令不符合固定合同");
 }
-function execute(wrapper, phase, cwd) { return new Promise((resolve) => { const child = spawn(wrapper, [phase], { cwd, stdio: ["ignore", "pipe", "pipe"] }); let stdout = "", stderr = ""; child.stdout.on("data", (chunk) => { stdout += chunk; }); child.stderr.on("data", (chunk) => { stderr += chunk; }); child.on("error", (error) => resolve({ exitCode: 127, stdout: "", stderr: String(error) })); child.on("close", (code) => resolve({ exitCode: code ?? 1, stdout, stderr })); }); }
-export async function run(projectRoot, evidenceDir) {
+function execute(wrapper, phase, cwd, environment) { return new Promise((resolve) => { const child = spawn(wrapper, [phase], { cwd, env: environment, stdio: ["ignore", "pipe", "pipe"] }); let stdout = "", stderr = ""; child.stdout.on("data", (chunk) => { stdout += chunk; }); child.stderr.on("data", (chunk) => { stderr += chunk; }); child.on("error", (error) => resolve({ exitCode: 127, stdout: "", stderr: String(error) })); child.on("close", (code) => resolve({ exitCode: code ?? 1, stdout, stderr })); }); }
+export async function run(projectRoot, evidenceDir, environment = process.env) {
   const wrapper = path.join(projectRoot, "mvnw"), manifestPath = path.join(projectRoot, ".yss", "scaffold-generation.json");
   if (!await isFile(wrapper)) throw new Error(`项目根目录缺少 Maven wrapper: ${wrapper}`);
   if (!await isFile(manifestPath)) throw new Error(`项目根目录缺少脚手架生成元数据清单: ${manifestPath}`);
   let manifest; try { manifest = JSON.parse(await readFile(manifestPath, "utf8")); } catch { throw new Error(`脚手架生成元数据清单无法读取或不是合法 JSON: ${manifestPath}`); }
-  validateManifest(manifest); await mkdir(evidenceDir, { recursive: true }); const commands = [];
-  for (const phase of PHASES) { const stdoutPath = path.join(evidenceDir, `mvnw-${phase}.stdout.log`), stderrPath = path.join(evidenceDir, `mvnw-${phase}.stderr.log`), startedAt = isoNow(), started = process.hrtime.bigint(); const outcome = await execute(wrapper, phase, projectRoot); const durationMs = Number(process.hrtime.bigint() - started) / 1e6; await writeText(stdoutPath, outcome.stdout); await writeText(stderrPath, outcome.stderr); commands.push({ command: `./mvnw ${phase}`, phase, exit_code: outcome.exitCode, duration_ms: Number(durationMs.toFixed(3)), started_at: startedAt, executed_at: isoNow(), stdout_ref: stdoutPath, stderr_ref: stderrPath }); }
-  return { verification_mode: "controlled-generation", project_root: projectRoot, scaffold_manifest_ref: manifestPath, generated_at: isoNow(), status: commands.every((item) => item.exit_code === 0) ? "passed" : "failed", commands };
+  validateManifest(manifest);
+  await mkdir(evidenceDir, { recursive: true });
+  const mavenConfig = await readTextIfPresent(path.join(projectRoot, ".mvn", "maven.config"));
+  const preflight = {
+    wrapper_exists: true,
+    wrapper_executable: await isExecutable(wrapper),
+    java_home_configured: configured(environment.JAVA_HOME),
+    maven_repository_credentials_configured: configured(environment.MAVEN_REPO_USERNAME) && configured(environment.MAVEN_REPO_PASSWORD),
+    maven_repository_url_configured: configured(environment.YSS_MAVEN_REPOSITORY_URL),
+    project_settings_present: await isFile(path.join(projectRoot, ".mvn", "settings.xml")),
+    project_maven_config_present: await isFile(path.join(projectRoot, ".mvn", "maven.config")),
+    project_settings_wired: /(?:^|\s)-(?:s|-settings)\s+\.mvn\/settings\.xml(?:\s|$)/m.test(mavenConfig),
+    repository_profile: manifest.profiles.repository,
+    repository_profile_wired: /(?:^|\s)-(?:P|-activate-profiles)\s+yss-internal(?:\s|$)/m.test(mavenConfig),
+    maven_coordinates_source: manifest.maven_coordinates_source
+  };
+  const failed = [];
+  if (!preflight.wrapper_executable) failed.push("wrapper-not-executable");
+  if (!preflight.project_settings_present || !preflight.project_maven_config_present || !preflight.project_settings_wired || !preflight.repository_profile_wired) failed.push("repository-profile-not-wired");
+  if (!preflight.maven_repository_url_configured) failed.push("repository-url-not-configured");
+  if (!preflight.maven_repository_credentials_configured) failed.push("repository-credentials-not-configured");
+  if (failed.length) return { verification_mode: "controlled-generation", project_root: projectRoot, scaffold_manifest_ref: manifestPath, generated_at: isoNow(), status: "failed", failure_category: "verification-preflight", completion_level: "generated", preflight: { ...preflight, failures: failed }, commands: [] };
+  const commands = [];
+  for (const phase of PHASES) {
+    const stdoutPath = path.join(evidenceDir, `mvnw-${phase}.stdout.log`);
+    const stderrPath = path.join(evidenceDir, `mvnw-${phase}.stderr.log`);
+    const startedAt = isoNow();
+    const started = process.hrtime.bigint();
+    const outcome = await execute(wrapper, phase, projectRoot, environment);
+    const durationMs = Number(process.hrtime.bigint() - started) / 1e6;
+    await writeText(stdoutPath, redactSecrets(outcome.stdout, environment));
+    await writeText(stderrPath, redactSecrets(outcome.stderr, environment));
+    commands.push({
+      command: `./mvnw ${phase}`,
+      phase,
+      exit_code: outcome.exitCode,
+      failure_category: classifyFailure(phase, outcome),
+      duration_ms: Number(durationMs.toFixed(3)),
+      started_at: startedAt,
+      executed_at: isoNow(),
+      stdout_ref: stdoutPath,
+      stderr_ref: stderrPath
+    });
+  }
+  const failureCategory = commands.find((item) => item.failure_category)?.failure_category ?? null;
+  return {
+    verification_mode: "controlled-generation",
+    project_root: projectRoot,
+    scaffold_manifest_ref: manifestPath,
+    generated_at: isoNow(),
+    status: failureCategory === null ? "passed" : "failed",
+    failure_category: failureCategory,
+    completion_level: failureCategory === null ? "empty-scaffold-verified" : "generated",
+    preflight,
+    commands
+  };
 }
-async function main() { let args; try { args = parseArgs(process.argv.slice(2)); if (args.help) { console.log("运行 YSS 脚手架真实验证命令\n用法: node scripts/run_scaffold_verification.mjs --project-root <dir> --evidence-dir <dir>"); return 0; } const reportPath = path.join(args.evidenceDir, "scaffold-verification.json"); try { const report = await run(args.projectRoot, args.evidenceDir); await writeText(reportPath, `${JSON.stringify(report, null, 2)}\n`); console.log(`${report.status}: ${reportPath}`); return report.status === "passed" ? 0 : 1; } catch (error) { const report = { verification_mode: "controlled-generation", project_root: args.projectRoot, generated_at: isoNow(), status: "failed", error: error.message, commands: [] }; await writeText(reportPath, `${JSON.stringify(report, null, 2)}\n`); process.stderr.write(`❌ 脚手架验证无法执行: ${error.message}\n`); return 1; } } catch (error) { process.stderr.write(`❌ 脚手架验证无法执行: ${error.message}\n`); return 1; } }
+async function main() { let args; try { args = parseArgs(process.argv.slice(2)); if (args.help) { console.log("运行 YSS 脚手架真实验证命令\n用法: node scripts/run_scaffold_verification.mjs --project-root <dir> --evidence-dir <dir>"); return 0; } const reportPath = path.join(args.evidenceDir, "scaffold-verification.json"); try { const report = await run(args.projectRoot, args.evidenceDir); await writeText(reportPath, `${JSON.stringify(report, null, 2)}\n`); console.log(`${report.status}: ${reportPath}`); return report.status === "passed" ? 0 : 1; } catch (error) { const report = { verification_mode: "controlled-generation", project_root: args.projectRoot, generated_at: isoNow(), status: "failed", failure_category: "verification-preflight", error: error.message, commands: [] }; await writeText(reportPath, `${JSON.stringify(report, null, 2)}\n`); process.stderr.write(`❌ 脚手架验证无法执行: ${error.message}\n`); return 1; } } catch (error) { process.stderr.write(`❌ 脚手架验证无法执行: ${error.message}\n`); return 1; } }
 if (process.argv[1] && import.meta.url === new URL(`file://${process.argv[1]}`).href) process.exitCode = await main();

package/template/.codex/skills/yss-ddd-scaffold-generator/scripts/scaffold-generator.test.mjs

@@ -1,5 +1,6 @@
 import assert from "node:assert/strict";
 import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
 import { chmod, mkdtemp, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { existsSync } from "node:fs";
 import os from "node:os";
@@ -12,19 +13,264 @@ import { GITLINK_MODE, gitLsFilesStage } from "../../../../scripts/lib/repositor
 
 const scripts = path.dirname(fileURLToPath(import.meta.url));
 const generator = path.join(scripts, "generate_scaffold.mjs");
+const workflow = path.join(scripts, "generate_and_verify_scaffold.mjs");
 const command = (args, options = {}) => new Promise((resolve) => execFile(process.execPath, [generator, ...args], { encoding: "utf8", ...options }, (error, stdout, stderr) => resolve({ code: error?.code ?? 0, stdout, stderr })));
+const workflowCommand = (args, options = {}) => new Promise((resolve) => execFile(process.execPath, [workflow, ...args], { encoding: "utf8", ...options }, (error, stdout, stderr) => resolve({ code: error?.code ?? 0, stdout, stderr })));
+async function treeDigest(root) {
+  const hash = createHash("sha256");
+  async function visit(directory) {
+    for (const entry of (await readdir(directory, { withFileTypes: true })).sort((left, right) => left.name.localeCompare(right.name))) {
+      const absolute = path.join(directory, entry.name);
+      if (entry.isDirectory()) await visit(absolute);
+      else if (entry.isFile()) hash.update(path.relative(root, absolute).split(path.sep).join("/")).update("\0").update(await readFile(absolute)).update("\0");
+    }
+  }
+  await visit(root);
+  return hash.digest("hex");
+}
 function contract(outputDir, overrides = {}) {
-  return { schema_version: 1, contract_id: "scaffold-1", contract_version: 1, slice_id: "slice-1", status: "approved", router_draft_ref: "router-1", lifecycle_approval_ref: "approval-1", persisted_ref: "persisted-1", current_version: 1, implementation_repository: "external", backend_repository: "external", scaffold_status: "required", target_git_url_or_output_dir: outputDir, allowed_write_paths: ["."], expected_evidence_files: [".yss/scaffold-generation.json"], verification_commands: ["./mvnw validate", "./mvnw test", "./mvnw package"], approval: { approval_ref: "approval-1", approver: "reviewer", persisted_ref: "persisted-1", current_version: 1 }, work_unit: { id: "unit-1", behavior: "scaffold", primary_skill: "yss-ddd-scaffold-generator", supporting_skills: ["yss-router"], tdd_mode: "controlled-generation", allowed_write_paths: ["."], expected_evidence: ["manifest"], verification_commands: ["./mvnw validate", "./mvnw test", "./mvnw package"], controlled_generation: true }, overwrite_policy: { force_allowed: true, overwrite_scope: "replace-service", rollback_ref: "checkpoint-1" }, ...overrides };
+  return {
+    schema_version: 2,
+    contract_id: "scaffold-1",
+    contract_version: 1,
+    scaffold_request_id: "scaffold-request-1",
+    status: "approved",
+    router_draft_ref: "router-1",
+    lifecycle_approval_ref: "approval-1",
+    persisted_ref: "persisted-1",
+    current_version: 1,
+    implementation_repository: "external",
+    backend_repository: "external",
+    scaffold_status: "required",
+    project_name: "demo-service",
+    target_output_dir: outputDir,
+    base_package: "com.yss.demo",
+    maven_coordinates: {
+      group_id: "com.yss.datamiddle",
+      project_version: "1.0.0-SNAPSHOT",
+      parent: { group_id: "com.yss.datamiddle", artifact_id: "yss-datamiddle-parent", version: "2.0.0-SNAPSHOT" },
+      yss_components_version: "2.0.0-SNAPSHOT"
+    },
+    profiles: {
+      architecture: "target-domain-model",
+      persistence: "mybatis-plus",
+      database: "mysql",
+      platform: "spring-boot-2.7-jdk8",
+      validation_namespace: "javax",
+      dto_placement: "web",
+      repository: "yss-internal"
+    },
+    allowed_write_paths: ["."],
+    expected_evidence_files: [".yss/scaffold-generation.json"],
+    verification_commands: ["./mvnw validate", "./mvnw test", "./mvnw package"],
+    approval: { approval_ref: "approval-1", approver: "reviewer", persisted_ref: "persisted-1", current_version: 1 },
+    work_unit: { id: "unit-1", behavior: "scaffold", primary_skill: "yss-ddd-scaffold-generator", supporting_skills: ["yss-router"], tdd_mode: "controlled-generation", allowed_write_paths: ["."], expected_evidence: ["manifest"], verification_commands: ["./mvnw validate", "./mvnw test", "./mvnw package"], controlled_generation: true },
+    generation_policy: { mode: "initialize-only", existing_target: "unsupported", old_project_migration: "unsupported", template_upgrade: "unsupported" },
+    ...overrides
+  };
 }
-async function fixture() { const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-node-")); const output = path.join(root, "implementation"); await mkdir(output); const contractFile = path.join(root, "contract.json"); await writeFile(contractFile, `${JSON.stringify(contract(output), null, 2)}\n`); return { root, output, contractFile, args: ["--project-name", "demo-service", "--base-package", "com.yss.demo", "--output-dir", output, "--database", "mysql", "--contract-id", "scaffold-1", "--contract-version", "1", "--approval-ref", "approval-1", "--router-draft-ref", "router-1", "--persisted-ref", "persisted-1", "--contract-file", contractFile] }; }
+async function fixture(contractOverrides = {}) { const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-node-")); const output = path.join(root, "implementation"); await mkdir(output); const contractFile = path.join(root, "contract.json"); await writeFile(contractFile, `${JSON.stringify(contract(output, contractOverrides), null, 2)}\n`); return { root, output, contractFile, args: ["--project-name", "demo-service", "--base-package", "com.yss.demo", "--output-dir", output, "--database", "mysql", "--contract-id", "scaffold-1", "--contract-version", "1", "--approval-ref", "approval-1", "--router-draft-ref", "router-1", "--persisted-ref", "persisted-1", "--contract-file", contractFile, "--group-id", "com.yss.datamiddle", "--project-version", "1.0.0-SNAPSHOT", "--parent-group-id", "com.yss.datamiddle", "--parent-artifact-id", "yss-datamiddle-parent", "--parent-version", "2.0.0-SNAPSHOT", "--yss-components-version", "2.0.0-SNAPSHOT"] }; }
 
-test("生成批准合同下的纯工程骨架，并写入清单", async (t) => { const data = await fixture(); t.after(() => rm(data.root, { recursive: true, force: true })); const result = await command(data.args); assert.equal(result.code, 0, result.stderr); const project = path.join(data.output, "demo-service"); const manifest = JSON.parse(await readFile(path.join(project, ".yss/scaffold-generation.json"), "utf8")); assert.equal(manifest.generation_mode, "controlled-generation"); assert.deepEqual(manifest.verification_commands, ["./mvnw validate", "./mvnw test", "./mvnw package"]); assert.match(await readFile(path.join(project, "pom.xml"), "utf8"), /demo-service/); });
+const controlledEnvironment = {
+  ...process.env,
+  YSS_MAVEN_REPOSITORY_URL: "https://repo.example.invalid/repository/maven-public/",
+  MAVEN_REPO_USERNAME: "test-user",
+  MAVEN_REPO_PASSWORD: "test-password"
+};
+function targetManifest(overrides = {}) {
+  return {
+    schema_version: 2,
+    contract_id: "id",
+    contract_version: 1,
+    scaffold_request_id: "request",
+    contract_digest: "a".repeat(64),
+    approval_ref: "approval",
+    approver: "reviewer",
+    lifecycle_approval_ref: "approval",
+    router_draft_ref: "router",
+    persisted_ref: "persisted",
+    contract_file_ref: "contract",
+    current_version: 1,
+    allowed_write_paths: ["."],
+    expected_evidence_files: ["manifest"],
+    verification_commands: ["./mvnw validate", "./mvnw test", "./mvnw package"],
+    generation_mode: "controlled-generation",
+    completion_level: "generated",
+    profiles: { architecture: "target-domain-model", repository: "yss-internal" },
+    ownership: { generated_files: [] },
+    readiness: { downstream_skills: {}, architecture_ruleset: "b".repeat(64) },
+    generation_policy: { mode: "initialize-only", existing_target: "unsupported", old_project_migration: "unsupported", template_upgrade: "unsupported" },
+    maven_coordinates_source: "approved-contract",
+    ...overrides
+  };
+}
+async function prepareVerifierProject(project, manifest = targetManifest()) {
+  await mkdir(path.join(project, ".yss"), { recursive: true });
+  await mkdir(path.join(project, ".mvn"), { recursive: true });
+  await writeFile(path.join(project, ".mvn", "maven.config"), "-s .mvn/settings.xml\n-P yss-internal\n");
+  await writeFile(path.join(project, ".mvn", "settings.xml"), "<settings/>\n");
+  await writeFile(path.join(project, ".yss", "scaffold-generation.json"), `${JSON.stringify(manifest)}\n`);
+}
 
-test("拒绝不一致合同和未经明确批准的非空目录覆盖", async (t) => { const data = await fixture(); t.after(() => rm(data.root, { recursive: true, force: true })); const rejected = await command([...data.args.slice(0, -1), path.join(data.root, "missing.json")]); assert.equal(rejected.code, 1); assert.match(rejected.stderr, /合同/); await mkdir(path.join(data.output, "demo-service")); await writeFile(path.join(data.output, "demo-service", "keep.txt"), "keep"); const noForce = await command(data.args); assert.equal(noForce.code, 1); assert.match(noForce.stderr, /--force/); const forceMissingRollback = await command([...data.args, "--force"]); assert.equal(forceMissingRollback.code, 1); assert.match(forceMissingRollback.stderr, /覆盖范围和回滚引用/); });
+test("生成批准的服务级 target profile 骨架，并写入可追溯 Manifest v2", async (t) => { const data = await fixture(); t.after(() => rm(data.root, { recursive: true, force: true })); const result = await command(data.args); assert.equal(result.code, 0, result.stderr); const project = path.join(data.output, "demo-service"); const manifest = JSON.parse(await readFile(path.join(project, ".yss/scaffold-generation.json"), "utf8")); assert.equal(manifest.schema_version, 2); assert.equal(manifest.scaffold_request_id, "scaffold-request-1"); assert.equal(manifest.slice_id, undefined); assert.equal(manifest.completion_level, "generated"); assert.equal(manifest.profiles.architecture, "target-domain-model"); assert.deepEqual(manifest.generation_policy, { mode: "initialize-only", existing_target: "unsupported", old_project_migration: "unsupported", template_upgrade: "unsupported" }); assert.match(manifest.generator.template_digest, /^[a-f0-9]{64}$/); assert.match(manifest.contract_digest, /^[a-f0-9]{64}$/); assert.ok(manifest.ownership.generated_files.length > 8); assert.ok(manifest.ownership.generated_files.every((item) => item.owner === "generator" && /^[a-f0-9]{64}$/.test(item.sha256))); assert.equal(manifest.generation_mode, "controlled-generation"); assert.deepEqual(manifest.verification_commands, ["./mvnw validate", "./mvnw test", "./mvnw package"]); assert.equal(manifest.bootstrap_main_class, "com.yss.demo.DemoServiceApplication"); assert.equal(manifest.bootstrap_main_source, "demo-service-bootstrap/src/main/java/com/yss/demo/DemoServiceApplication.java"); assert.match(await readFile(path.join(project, manifest.bootstrap_main_source), "utf8"), /class DemoServiceApplication/); assert.match(await readFile(path.join(project, "pom.xml"), "utf8"), /demo-service/); assert.equal(manifest.readiness.downstream_skills["yss-domain"], await treeDigest(path.resolve(scripts, "../../yss-domain"))); assert.match(manifest.readiness.contracts.scaffold_parent, /^[a-f0-9]{64}$/); assert.match(manifest.readiness.contracts.router_contract, /^[a-f0-9]{64}$/); });
 
-test("已批准的 --force 先备份非空目标，再提交 staging 工程", async (t) => { const data = await fixture(); t.after(() => rm(data.root, { recursive: true, force: true })); const oldProject = path.join(data.output, "demo-service"); await mkdir(oldProject); await writeFile(path.join(oldProject, "old.txt"), "recoverable"); const result = await command([...data.args, "--force", "--overwrite-scope", "replace-service", "--rollback-ref", "checkpoint-1"]); assert.equal(result.code, 0, result.stderr); const entries = await readdir(data.output); const backup = entries.find((entry) => entry.startsWith(".demo-service.backup-")); assert.ok(backup); assert.equal(await readFile(path.join(data.output, backup, "old.txt"), "utf8"), "recoverable"); assert.ok((await readdir(path.join(data.output, "demo-service"))).includes("pom.xml")); });
+test("schema v1 scaffold contract is unsupported and is never upgraded", async (t) => {
+  const data = await fixture({ schema_version: 1 });
+  t.after(() => rm(data.root, { recursive: true, force: true }));
+  const result = await command(data.args);
+  assert.equal(result.code, 1);
+  assert.match(result.stderr, /unsupported: scaffold contract schema_version=1/);
+  assert.equal(existsSync(path.join(data.output, "demo-service")), false);
+});
 
-test("拒绝覆盖 .gitmodules 登记的 git-submodule 挂载点", async (t) => {
+test("一键工作流只有在真实 Maven 三命令全部通过后才报告完成", { timeout: 300_000 }, async (t) => {
+  if (!["YSS_MAVEN_REPOSITORY_URL", "MAVEN_REPO_USERNAME", "MAVEN_REPO_PASSWORD"].every((name) => process.env[name])) {
+    t.skip("缺少受控 YSS Maven 仓库环境，真实 Wrapper 验证由 L3 环境门禁执行");
+    return;
+  }
+  const data = await fixture();
+  t.after(() => rm(data.root, { recursive: true, force: true }));
+  const evidence = path.join(data.root, "workflow-evidence");
+  const result = await workflowCommand([...data.args, "--evidence-dir", evidence]);
+  assert.equal(result.code, 0, result.stderr);
+  assert.match(result.stdout, /脚手架生成与验证完成/);
+  const verification = JSON.parse(await readFile(path.join(evidence, "scaffold-verification.json"), "utf8"));
+  const workflowReport = JSON.parse(await readFile(path.join(evidence, "scaffold-workflow.json"), "utf8"));
+  assert.equal(verification.status, "passed");
+  assert.deepEqual(verification.commands.map((item) => item.command), ["./mvnw validate", "./mvnw test", "./mvnw package"]);
+  assert.ok(verification.commands.every((item) => item.exit_code === 0));
+  assert.equal(verification.preflight.project_settings_wired, true);
+  assert.equal(verification.preflight.repository_profile_wired, true);
+  assert.equal(workflowReport.status, "completed");
+  assert.equal(workflowReport.verification_ref, path.join(evidence, "scaffold-verification.json"));
+  const manifest = JSON.parse(await readFile(path.join(data.output, "demo-service", ".yss", "scaffold-generation.json"), "utf8"));
+  assert.equal(manifest.completion_level, "empty-scaffold-verified");
+});
+
+test("显式 Maven 坐标贯穿批准合同、生成参数、全部 POM 和生成清单", async (t) => {
+  const mavenCoordinates = {
+    group_id: "com.example.metadata",
+    project_version: "1.2.3-SNAPSHOT",
+    parent: {
+      group_id: "com.yss.datamiddle",
+      artifact_id: "yss-datamiddle-parent",
+      version: "2.0.0-SNAPSHOT"
+    },
+    yss_components_version: "2.0.0-SNAPSHOT"
+  };
+  const data = await fixture({ maven_coordinates: mavenCoordinates });
+  t.after(() => rm(data.root, { recursive: true, force: true }));
+  const result = await command([
+    ...data.args,
+    "--group-id", mavenCoordinates.group_id,
+    "--project-version", mavenCoordinates.project_version,
+    "--parent-group-id", mavenCoordinates.parent.group_id,
+    "--parent-artifact-id", mavenCoordinates.parent.artifact_id,
+    "--parent-version", mavenCoordinates.parent.version,
+    "--yss-components-version", mavenCoordinates.yss_components_version
+  ]);
+  assert.equal(result.code, 0, result.stderr);
+
+  const project = path.join(data.output, "demo-service");
+  const pomFiles = [
+    "pom.xml",
+    "demo-service-domain/pom.xml",
+    "demo-service-application/pom.xml",
+    "demo-service-infrastructure/pom.xml",
+    "demo-service-adapter/pom.xml",
+    "demo-service-adapter/demo-service-web/pom.xml",
+    "demo-service-bootstrap/pom.xml"
+  ];
+  const poms = await Promise.all(pomFiles.map((file) => readFile(path.join(project, file), "utf8")));
+  assert.ok(poms.every((pom) => pom.includes(mavenCoordinates.group_id)), "全部项目内坐标必须使用合同 groupId");
+  assert.ok(poms.every((pom) => pom.includes(mavenCoordinates.project_version)), "全部项目内坐标必须使用合同版本");
+  const manifest = JSON.parse(await readFile(path.join(project, ".yss/scaffold-generation.json"), "utf8"));
+  assert.deepEqual(manifest.maven_coordinates, mavenCoordinates);
+  assert.equal(manifest.maven_coordinates_source, "approved-contract");
+
+});
+
+test("生成工程声明命名仓库 profile、target DDD 依赖边界和构建门禁", async (t) => {
+  const data = await fixture();
+  t.after(() => rm(data.root, { recursive: true, force: true }));
+  const result = await command(data.args);
+  assert.equal(result.code, 0, result.stderr);
+  const project = path.join(data.output, "demo-service");
+  const mavenConfig = await readFile(path.join(project, ".mvn/maven.config"), "utf8");
+  const settings = await readFile(path.join(project, ".mvn/settings.xml"), "utf8");
+  assert.match(mavenConfig, /-s \.mvn\/settings\.xml/);
+  assert.match(mavenConfig, /-P yss-internal/);
+  assert.doesNotMatch(settings, /192\.168\.|<activeProfile>aliyun-only<\/activeProfile>/);
+  assert.match(settings, /\$\{env\.YSS_MAVEN_REPOSITORY_URL\}/);
+  assert.match(settings, /\$\{env\.MAVEN_REPO_USERNAME\}/);
+  assert.match(settings, /\$\{env\.MAVEN_REPO_PASSWORD\}/);
+
+  const domainPom = await readFile(path.join(project, "demo-service-domain/pom.xml"), "utf8");
+  const infrastructurePom = await readFile(path.join(project, "demo-service-infrastructure/pom.xml"), "utf8");
+  const bootstrapPom = await readFile(path.join(project, "demo-service-bootstrap/pom.xml"), "utf8");
+  assert.doesNotMatch(domainPom, /yss-component-(?:dto|exception)|jackson-databind|swagger-annotations|validation-api/);
+  assert.match(infrastructurePom, /yss-component-mybatis-plus-starter/);
+  assert.match(infrastructurePom, /spring-boot-starter-jdbc/);
+  assert.match(bootstrapPom, /spring-boot-starter-actuator/);
+  assert.match(bootstrapPom, /spring-boot-starter-test/);
+  const webPom = await readFile(path.join(project, "demo-service-adapter", "demo-service-web", "pom.xml"), "utf8");
+  assert.match(webPom, /yss-component-dto/);
+  assert.match(webPom, /yss-component-exception/);
+  assert.match(webPom, /io\.swagger\.core\.v3/);
+  const parentPom = await readFile(path.join(project, "pom.xml"), "utf8");
+  assert.match(parentPom, /lombok-mapstruct-binding/);
+  assert.match(parentPom, /maven-enforcer-plugin/);
+  assert.match(parentPom, /maven-compiler-plugin/);
+  assert.match(parentPom, /archunit-junit5/);
+});
+
+test("生成工程固定平台 profile、Wrapper checksum，并把调试日志隔离到 local 配置", async (t) => {
+  const data = await fixture();
+  t.after(() => rm(data.root, { recursive: true, force: true }));
+  const result = await command(data.args);
+  assert.equal(result.code, 0, result.stderr);
+  const project = path.join(data.output, "demo-service");
+  const wrapper = await readFile(path.join(project, ".mvn", "wrapper", "maven-wrapper.properties"), "utf8");
+  assert.match(wrapper, /^wrapperSha256Sum=[a-f0-9]{64}$/m);
+  assert.match(wrapper, /^distributionSha256Sum=[a-f0-9]{64}$/m);
+  const application = await readFile(path.join(project, "demo-service-bootstrap", "src", "main", "resources", "application.yml"), "utf8");
+  assert.doesNotMatch(application, /StdOutImpl|DEBUG/);
+  const local = await readFile(path.join(project, "demo-service-bootstrap", "src", "main", "resources", "application-local.yml"), "utf8");
+  assert.match(local, /StdOutImpl/);
+  assert.match(local, /DEBUG/);
+});
+
+test("initialize-only 在写文件前拒绝任何已存在目标和 --force", async (t) => { const data = await fixture(); t.after(() => rm(data.root, { recursive: true, force: true })); const rejected = await command(data.args.map((value) => value === data.contractFile ? path.join(data.root, "missing.json") : value)); assert.equal(rejected.code, 1); assert.match(rejected.stderr, /合同/); await mkdir(path.join(data.output, "demo-service")); await writeFile(path.join(data.output, "demo-service", "keep.txt"), "keep"); const noForce = await command(data.args); assert.equal(noForce.code, 1); assert.match(noForce.stderr, /initialize-only/); const forced = await command([...data.args, "--force"]); assert.equal(forced.code, 1); assert.match(forced.stderr, /initialize-only/); assert.equal(await readFile(path.join(data.output, "demo-service", "keep.txt"), "utf8"), "keep"); });
+
+test("拒绝基础包名与批准合同不一致", async (t) => {
+  const data = await fixture({ base_package: "com.example.approved" });
+  t.after(() => rm(data.root, { recursive: true, force: true }));
+  const result = await command(data.args);
+  assert.equal(result.code, 1);
+  assert.match(result.stderr, /--base-package 与脚手架合同不一致/);
+});
+
+test("合同 project_name、profile 和 allowed_write_paths 必须约束实际输出", async (t) => {
+  const wrongName = await fixture({ project_name: "other-service" });
+  t.after(() => rm(wrongName.root, { recursive: true, force: true }));
+  const nameResult = await command(wrongName.args);
+  assert.equal(nameResult.code, 1);
+  assert.match(nameResult.stderr, /--project-name 与脚手架合同不一致/);
+
+  const wrongProfile = await fixture({ profiles: { ...contract("unused").profiles, persistence: "mybatis" } });
+  t.after(() => rm(wrongProfile.root, { recursive: true, force: true }));
+  const profileResult = await command(wrongProfile.args);
+  assert.equal(profileResult.code, 1);
+  assert.match(profileResult.stderr, /unsupported persistence profile/);
+
+  const wrongPath = await fixture({ allowed_write_paths: ["another-service"], work_unit: { ...contract("unused").work_unit, allowed_write_paths: ["another-service"] } });
+  t.after(() => rm(wrongPath.root, { recursive: true, force: true }));
+  const pathResult = await command(wrongPath.args);
+  assert.equal(pathResult.code, 1);
+  assert.match(pathResult.stderr, /allowed_write_paths/);
+});
+
+test("initialize-only 拒绝以 --force 覆盖 .gitmodules 登记的挂载点", async (t) => {
   const data = await fixture();
   t.after(() => rm(data.root, { recursive: true, force: true }));
   const superproject = path.join(data.root, "harness");
@@ -33,9 +279,9 @@ test("拒绝覆盖 .gitmodules 登记的 git-submodule 挂载点", async (t) =>
   await writeFile(path.join(superproject, ".gitmodules"), "[submodule \"demo-service\"]\n\tpath = apps/backend/demo-service\n\turl = https://example.invalid/demo-service.git\n");
   const contractFile = path.join(data.root, "gitlink-contract.json");
   await writeFile(contractFile, `${JSON.stringify(contract(output), null, 2)}\n`);
-  const result = await command(["--project-name", "demo-service", "--base-package", "com.yss.demo", "--output-dir", output, "--database", "mysql", "--contract-id", "scaffold-1", "--contract-version", "1", "--approval-ref", "approval-1", "--router-draft-ref", "router-1", "--persisted-ref", "persisted-1", "--contract-file", contractFile, "--force", "--overwrite-scope", "replace-service", "--rollback-ref", "checkpoint-1"]);
+  const result = await command(["--project-name", "demo-service", "--base-package", "com.yss.demo", "--output-dir", output, "--database", "mysql", "--contract-id", "scaffold-1", "--contract-version", "1", "--approval-ref", "approval-1", "--router-draft-ref", "router-1", "--persisted-ref", "persisted-1", "--contract-file", contractFile, "--force"]);
   assert.equal(result.code, 1, result.stderr);
-  assert.match(`${result.stdout}\n${result.stderr}`, /gitlink 不得由脚手架覆盖/);
+  assert.match(`${result.stdout}\n${result.stderr}`, /initialize-only|gitlink 不得由脚手架覆盖/);
 });
 
 test("拒绝在 detached HEAD 子仓工作树内当成普通目录生成", async (t) => {
@@ -63,16 +309,93 @@ test("--force 覆盖真实 gitlink 不得走普通目录覆盖路径", async (t)
   const output = path.join(empty.superproject, "apps/backend");
   const contractFile = path.join(data.root, "empty-gitlink-contract.json");
   await writeFile(contractFile, `${JSON.stringify(contract(output), null, 2)}\n`);
-  const result = await command(["--project-name", "billing-service", "--base-package", "com.yss.demo", "--output-dir", output, "--database", "mysql", "--contract-id", "scaffold-1", "--contract-version", "1", "--approval-ref", "approval-1", "--router-draft-ref", "router-1", "--persisted-ref", "persisted-1", "--contract-file", contractFile, "--force", "--overwrite-scope", "replace-service", "--rollback-ref", "checkpoint-1"]);
+  const result = await command(["--project-name", "billing-service", "--base-package", "com.yss.demo", "--output-dir", output, "--database", "mysql", "--contract-id", "scaffold-1", "--contract-version", "1", "--approval-ref", "approval-1", "--router-draft-ref", "router-1", "--persisted-ref", "persisted-1", "--contract-file", contractFile, "--force"]);
   const text = `${result.stdout}\n${result.stderr}`;
   assert.equal(result.code, 1, text);
   assert.doesNotMatch(text, /请显式传入 --force/);
-  assert.match(text, /--force 不得把 git-submodule 挂载点当成普通目录覆盖|gitlink 不得/);
+  assert.match(text, /initialize-only|--force 不得把 git-submodule 挂载点当成普通目录覆盖|gitlink 不得/);
   assert.equal(existsSync(path.join(output, "billing-service", "pom.xml")), false);
   assert.equal((await readdir(output)).some((name) => name.includes("backup")), false);
   assert.equal(gitLsFilesStage(empty.superproject, empty.mount)?.mode, GITLINK_MODE);
 });
 
-test("验证器记录三条 wrapper 命令的成功和失败证据", async (t) => { const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-verifier-")); t.after(() => rm(root, { recursive: true, force: true })); const project = path.join(root, "project"); await mkdir(path.join(project, ".yss"), { recursive: true }); await writeFile(path.join(project, ".yss/scaffold-generation.json"), `${JSON.stringify({ schema_version: 1, contract_id: "id", contract_version: 1, slice_id: "slice", approval_ref: "approval", approver: "reviewer", lifecycle_approval_ref: "approval", router_draft_ref: "router", persisted_ref: "persisted", contract_file_ref: "contract", current_version: 1, allowed_write_paths: ["."], expected_evidence_files: ["manifest"], verification_commands: ["./mvnw validate", "./mvnw test", "./mvnw package"], generation_mode: "controlled-generation" })}\n`); const wrapper = path.join(project, "mvnw"); await writeFile(wrapper, "#!/bin/sh\n[ \"$1\" = test ] && exit 2\nprintf 'ran %s\\n' \"$1\"\n"); await chmod(wrapper, 0o755); const evidence = path.join(root, "evidence"); const report = await run(project, evidence); assert.equal(report.status, "failed"); assert.deepEqual(report.commands.map((item) => item.exit_code), [0, 2, 0]); assert.match(await readFile(path.join(evidence, "mvnw-test.stderr.log"), "utf8"), /^$/); });
+test("验证器记录三条 wrapper 命令的成功和失败证据", async (t) => { const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-verifier-")); t.after(() => rm(root, { recursive: true, force: true })); const project = path.join(root, "project"); await prepareVerifierProject(project); const wrapper = path.join(project, "mvnw"); await writeFile(wrapper, "#!/bin/sh\n[ \"$1\" = test ] && exit 2\nprintf 'ran %s\\n' \"$1\"\n"); await chmod(wrapper, 0o755); const evidence = path.join(root, "evidence"); const report = await run(project, evidence, controlledEnvironment); assert.equal(report.status, "failed"); assert.equal(report.failure_category, "test-failure"); assert.equal(report.commands[1].failure_category, "test-failure"); assert.equal(report.preflight.wrapper_executable, true); assert.deepEqual(report.commands.map((item) => item.exit_code), [0, 2, 0]); assert.match(await readFile(path.join(evidence, "mvnw-test.stderr.log"), "utf8"), /^$/); });
 
-test("验证器在全部 Maven 命令成功时通过并保留日志引用", async (t) => { const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-verifier-success-")); t.after(() => rm(root, { recursive: true, force: true })); const project = path.join(root, "project"); await mkdir(path.join(project, ".yss"), { recursive: true }); await writeFile(path.join(project, ".yss/scaffold-generation.json"), `${JSON.stringify({ schema_version: 1, contract_id: "id", contract_version: 1, slice_id: "slice", approval_ref: "approval", approver: "reviewer", lifecycle_approval_ref: "approval", router_draft_ref: "router", persisted_ref: "persisted", contract_file_ref: "contract", current_version: 1, allowed_write_paths: ["."], expected_evidence_files: ["manifest"], verification_commands: ["./mvnw validate", "./mvnw test", "./mvnw package"], generation_mode: "controlled-generation" })}\n`); const wrapper = path.join(project, "mvnw"); await writeFile(wrapper, "#!/bin/sh\nprintf 'ran %s\\n' \"$1\"\n"); await chmod(wrapper, 0o755); const report = await run(project, path.join(root, "evidence")); assert.equal(report.status, "passed"); assert.ok(report.commands.every((item) => item.exit_code === 0 && item.stdout_ref.endsWith(".stdout.log"))); });
+test("验证器把内部仓库解析失败与编译失败分开报告", async (t) => {
+  const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-repository-failure-"));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  const project = path.join(root, "project");
+  await prepareVerifierProject(project);
+  const wrapper = path.join(project, "mvnw");
+  await writeFile(wrapper, "#!/bin/sh\nprintf 'Non-resolvable parent POM: Could not transfer artifact\\n'\nexit 1\n");
+  await chmod(wrapper, 0o755);
+  const report = await run(project, path.join(root, "evidence"), controlledEnvironment);
+  assert.equal(report.status, "failed");
+  assert.equal(report.failure_category, "repository-access");
+  assert.ok(report.commands.every((item) => item.failure_category === "repository-access"));
+  assert.equal(typeof report.preflight.maven_repository_credentials_configured, "boolean");
+});
+
+test("验证器单独标记 Java 编译失败和 Bootstrap 主类缺失", async (t) => {
+  const cases = [
+    { output: "[ERROR] COMPILATION ERROR", expected: "compilation" },
+    { output: "Unable to find main class", expected: "bootstrap-entrypoint" }
+  ];
+  for (const item of cases) {
+    const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-build-failure-"));
+    t.after(() => rm(root, { recursive: true, force: true }));
+    const project = path.join(root, "project");
+    await prepareVerifierProject(project);
+    const wrapper = path.join(project, "mvnw");
+    await writeFile(wrapper, `#!/bin/sh\n[ "$1" = package ] || exit 0\nprintf '%s\\n' '${item.output}' >&2\nexit 1\n`);
+    await chmod(wrapper, 0o755);
+    const report = await run(project, path.join(root, "evidence"), controlledEnvironment);
+    assert.equal(report.failure_category, item.expected);
+    assert.equal(report.commands[2].failure_category, item.expected);
+  }
+});
+
+test("验证器在全部 Maven 命令成功时通过并保留日志引用", async (t) => { const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-verifier-success-")); t.after(() => rm(root, { recursive: true, force: true })); const project = path.join(root, "project"); await prepareVerifierProject(project); const wrapper = path.join(project, "mvnw"); await writeFile(wrapper, "#!/bin/sh\nprintf 'ran %s\\n' \"$1\"\n"); await chmod(wrapper, 0o755); const report = await run(project, path.join(root, "evidence"), controlledEnvironment); assert.equal(report.status, "passed"); assert.ok(report.commands.every((item) => item.exit_code === 0 && item.stdout_ref.endsWith(".stdout.log"))); });
+
+test("Manifest v2 在缺少受控仓库环境时先于 Maven 执行阻断", async (t) => {
+  const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-v2-preflight-"));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  const project = path.join(root, "project");
+  await prepareVerifierProject(project);
+  const wrapper = path.join(project, "mvnw");
+  await writeFile(wrapper, "#!/bin/sh\nprintf 'must not run'\nexit 99\n");
+  await chmod(wrapper, 0o755);
+  const report = await run(project, path.join(root, "evidence"), { ...process.env, YSS_MAVEN_REPOSITORY_URL: "", MAVEN_REPO_USERNAME: "", MAVEN_REPO_PASSWORD: "" });
+  assert.equal(report.status, "failed");
+  assert.equal(report.failure_category, "verification-preflight");
+  assert.deepEqual(report.commands, []);
+  assert.ok(report.preflight.failures.includes("repository-url-not-configured"));
+});
+
+test("Manifest schema v1 is unsupported and verifier never executes its wrapper", async (t) => {
+  const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-v1-unsupported-"));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  const project = path.join(root, "project");
+  await prepareVerifierProject(project, { schema_version: 1, contract_id: "legacy", contract_version: 1 });
+  const wrapper = path.join(project, "mvnw");
+  await writeFile(wrapper, "#!/bin/sh\nprintf 'must not run' > wrapper-ran\n");
+  await chmod(wrapper, 0o755);
+  await assert.rejects(() => run(project, path.join(root, "evidence"), controlledEnvironment), /unsupported: scaffold Manifest schema_version=1/);
+  assert.equal(existsSync(path.join(project, "wrapper-ran")), false);
+});
+
+test("验证日志会脱敏 Maven 仓库凭据", async (t) => {
+  const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-redaction-"));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  const project = path.join(root, "project");
+  await prepareVerifierProject(project);
+  const wrapper = path.join(project, "mvnw");
+  await writeFile(wrapper, "#!/bin/sh\nprintf '%s %s\\n' \"$MAVEN_REPO_USERNAME\" \"$MAVEN_REPO_PASSWORD\"\n");
+  await chmod(wrapper, 0o755);
+  const sensitiveEnvironment = { ...controlledEnvironment, MAVEN_REPO_USERNAME: "sensitive-user", MAVEN_REPO_PASSWORD: "sensitive-password" };
+  const evidence = path.join(root, "evidence");
+  await run(project, evidence, sensitiveEnvironment);
+  const log = await readFile(path.join(evidence, "mvnw-validate.stdout.log"), "utf8");
+  assert.doesNotMatch(log, /sensitive-user|sensitive-password/);
+  assert.match(log, /\[REDACTED:MAVEN_REPO_USERNAME\].*\[REDACTED:MAVEN_REPO_PASSWORD\]/);
+});

package/template/.codex/skills/yss-design-system/SKILL.md

@@ -25,7 +25,7 @@ description: Use when YSS 产品设计系统与 Ant Design 企业级 UI 风格
 2. 读取已有资产：`docs/design/design.md`、相关 Spec、交互说明、状态矩阵、OpenAPI Draft、现有页面代码。
 3. 按设计系统基线约束输出或修改产物：颜色、排版、间距、圆角、动效、组件、状态、响应式。
 4. 若是产品设计阶段，先使用 `yss-prototype-stage`；Codex 以 `product-design:index` 为主入口，其他 Agent 必须交付等价合同资产和证据。
-5. 若是前端实现阶段，配合 `yss-ui`、`yss-components`、`yss-formily`、`yss-page-module-development`，但本技能负责风格与体验一致性门禁。
+5. 若是前端实现阶段，配合 `yss-ui`、`yss-ui-business-page-generation`、`yss-components`、`yss-formily`；生命周期编排和旧触发词兼容再使用 `yss-page-module-development`，但本技能负责风格与体验一致性门禁。
 6. 若发现现有设计系统文档不足，先更新 `docs/design/design.md`，再让实现或评审引用该文档。
 
 ## 核心基线
@@ -85,7 +85,7 @@ description: Use when YSS 产品设计系统与 Ant Design 企业级 UI 风格
 | 低保真原型进入高保真前评审 | `prototype-review` |
 | 低保真评审通过后的高保真 HTML 原型 | `yss-prototype-stage`；`high-fidelity-html-prototype` 仅兼容入口 |
 | 低保真线框或流程图 | `product-design:index` |
-| 前端页面实现 | `yss-ui` / `yss-page-module-development` |
+| 前端页面实现 | `yss-ui` / `yss-ui-business-page-generation`；生命周期兼容使用 `yss-page-module-development` |
 | 表单 schema | `yss-formily` |
 | YTable / YTree / 高度自适应 | `yss-components` / `yss-use-table-height` / `yss-use-tree-height` |
 | 原型阶段的 Ant Design v6 组件 / token / demo 查询 | `yss-antd-design`（只用于原型设计构建；前端落地改用 `yss-ui`） |

package/template/.codex/skills/yss-design-system/references/design-system.md

@@ -214,8 +214,8 @@ React + Ant Design：
 
 YSS UI / Vue：
 
-- 业务页面优先走 `yss-ui` 和 `yss-page-module-development`。
-- 表单使用 `YssFormily` schema。
+- 业务页面优先走 `yss-ui` 和 `yss-ui-business-page-generation`；生命周期编排和旧触发词兼容使用 `yss-page-module-development`。
+- 新业务表单使用 `YFormily` schema；`YssFormily` 仅用于历史兼容。
 - 表格使用 `YTable`，列定义使用项目约定字段。
 - 高度自适应使用 `useTableHeight` / `useTreeHeight`。
 - 请求、分页、筛选参数下沉到 Hook。

package/template/.codex/skills/yss-domain/SKILL.md

@@ -7,7 +7,7 @@ description: 用于构建或重构 YSS 领域层代码。当用户要求设计
 
 这是一个领域实现 skill。核心目标是消费已批准的战术模型，将领域行为落实为代码；战术模型的设计与批准由 `yss-tactical-design` 和 `yss-product-lifecycle` 负责。
 
-默认输出是新 DDD target profile；现有 YSS 组件仓库常见 `core/client/repository`、贫血对象和 VO 型 Gateway 只是 legacy profile，不得静默复制成新模块架构。
+本 skill 在新脚手架链路只支持 `target-domain-model`。`core/client/repository`、贫血对象和 VO 型 Gateway 对该链路均为 `unsupported`，不提供旧架构分支。
 
 ## 何时使用
 
@@ -41,13 +41,14 @@ description: 用于构建或重构 YSS 领域层代码。当用户要求设计
 - Gateway 只暴露领域能力，不暴露持久化细节。
 - 对关键状态流转给出明确方法，如 `publish()`、`cancel()`、`terminate()`。
 - 明确 Aggregate Root、Entity identity、Value Object、不变量、Domain Event 和一致性边界；没有业务行为时不要伪造富领域模型。
-- 发现 legacy profile 时先记录迁移/兼容决策，不把 Repository Entity 当 Domain Entity。
+- 发现旧架构时停止套用新脚手架合同并返回 `unsupported`；旧项目继续按原工程维护，现代化改造单独立项。
 
 ## 质量要求
 
 - 命名体现业务语义，不照抄表名缩写。
 - 生成代码应可编译，且没有跨层依赖泄漏。
-- 对不确定规则写出假设或 TODO，不要伪装成已确认事实。
+- Domain Gateway interface 由本 skill 唯一拥有；Infrastructure 只能实现，不得由 `yss-repository` 反向创建或改写其签名。
+- 对不确定规则返回 `new_impacts` / `drift` 并暂停；不要把未批准假设或 TODO 写进实现冒充已确认事实。
 
 ## 协同顺序
 
@@ -58,7 +59,7 @@ description: 用于构建或重构 YSS 领域层代码。当用户要求设计
 
 ## 分层开发规范
 
-脚手架生成或进入 Domain 实现前，必须加载 `references/domain-layer-guide.md`：其中定义 DTO/Gateway/Domain Service 包结构、命名、校验与示例，与本 skill 的建模约束一并生效。
+脚手架生成或进入 Domain 实现前，必须加载 `references/domain-layer-guide.md`：其中定义 Aggregate、Domain Gateway、Domain Error、依赖门禁与旧架构 `unsupported` 边界；HTTP DTO/VO 明确不属于 Domain。
 
 ## 阶段 7 合同
 

package/template/.codex/skills/yss-domain/agents/openai.yaml

@@ -1,5 +1,5 @@
 version: 1
 interface:
   display_name: "YSS Domain"
-  short_description: "领域建模、聚合根、规则与网关设计实践落地标准化规范"
-  default_prompt: "Use $yss-domain to design aggregates, entities, domain gateways, and business rules for a YSS domain model."
+  short_description: "按批准战术模型实现聚合、规则与 Domain Gateway 接口"
+  default_prompt: "Use $yss-domain to implement approved aggregates, entities, business rules, domain tests, and the sole Domain Gateway interfaces; reroute instead of inventing unresolved rules."