create-yss-spec 3.0.0 → 3.1.0

package/template/.agents/skills/yss-product-lifecycle/references/matt-yss-adapter.md

@@ -7,35 +7,33 @@ Matt skills 决定如何工作；YSS 生命周期决定是否允许推进；YSS
 ## 入口与仓库身份裁决
 
 - 所有入口先读取 `yss-project.yaml`。缺失、解析失败、schema 不支持或 `repository_mode` 非法时，停止路由并进入 migration-check。
-- **直接调用 `ask-matt`** 时，它只能提供通用 Matt flow 导航，不得写生命周期资产、改变门禁或 Ticket 状态；有效 YSS 仓库必须在任何写入前把最终阶段、影响面、门禁和状态裁决交回 `yss-product-lifecycle`。
-- **直接调用生命周期管理的 Matt user-invoked skill**（`setup-matt-pocock-skills`、`grill-with-docs`、`to-spec`、`to-tickets`、`implement`）时，用户仍是正式资产的创建者；生命周期先校验前置条件，再接受结果并重新计算阶段、门禁和状态。它们不适用 `ask-matt` 的 `navigate-only` 限制。其他 user-invoked skill 同样不得由生命周期自动调用；只有在其专属适配合同存在时才进入 YSS 流程。
+- **直接调用生命周期管理的 Matt user-invoked skill**（`setup-matt-pocock-skills`、`grill-with-docs`、`to-spec`、`to-tickets`、`implement`）时，用户仍是正式资产的创建者；生命周期先校验前置条件，再接受结果并重新计算阶段、门禁和状态。其他 user-invoked skill 同样不得由生命周期自动调用；只有在其专属适配合同存在时才进入 YSS 流程。
 - **直接调用 `yss-product-lifecycle`** 时，不机械嵌套调用任何 Matt user-invoked skill；编排器直接使用原生工作单元和允许的 model-invoked 原语。Matt user-invoked skill 保持显式兼容入口，生命周期负责准备、校验并验收其结果。
-- `template-source` 只允许进入模板维护流程。命中 `to-spec`、`to-tickets`、`implement`、Release 或 Retrospective 时返回 `blocked`，原因是 `template-source-product-artifact-forbidden`；`ask-matt` 和 `setup-matt-pocock-skills` 都不得为具体产品生成 Spec、prototype、OpenAPI 或垂直切片 Ticket。
+- `template-source` 只允许进入模板维护流程。命中 `to-spec`、`to-tickets`、`implement`、Release 或 Retrospective 时返回 `blocked`，原因是 `template-source-product-artifact-forbidden`；`setup-matt-pocock-skills` 不得为具体产品生成 Spec、prototype、OpenAPI 或垂直切片 Ticket。
 - `project-instance` 才允许进入产品 Discovery → Spec → 设计 → 契约 → Ticket → 实现 → Release / Retrospective 链路。
 
 | 情形 | Matt flow | 生命周期验收 |
 |---|---|---|
 | 首次启用或配置缺失 | `setup-matt-pocock-skills`（用户显式） | `needs-human`，说明缺失项；用户完成 setup 后重新计算 readiness |
-| 通用入口 | `ask-matt` | 检测到 YSS 后由本编排器最终裁决 |
 | 需求澄清 | `grill-with-docs`（用户显式）或 `grilling`、`domain-modeling`（生命周期原语） | 按退出判定检查未决项和回流 |
 | 信息在其他人手中 | `to-questionnaire` | 使用 `external-input-required` 暂停；答案回流后记录 response、重新分类影响面，再进入 `grill-with-docs` 或 `to-spec` |
 | 大型模糊工作 | `wayfinder`（可选） | 仅在跨会话 / 跨 Agent 或 frontier 不清晰时启用；map 真正完成后 `handoff → to-spec` |
 | 技术或战略事实 | `yss-research`（`research` 为 deprecated alias） | `technical-evidence` 核验一手技术资料；`strategy-evidence` 为领域战略和阶段决策提供可审计证据；研究包不得自行修改或批准下游资产 |
-| runnable 问题 | `prototype` | 生成单文件可分享 HTML，保留 `prototype/<name>` 分支作为主来源；必须 source/return handoff 和结论回填，不得替代阶段 4 的低保真评审、Ant Design v6 高保真 HTML、AntD CLI 证据和用户确认 |
+| runnable 问题 | `prototype` | 生成单文件可分享 HTML，保留 `prototype/<name>` 分支作为主来源；必须 source/return handoff 和结论回填，只能作为阶段 4 输入，不得替代低保真评审、H1/H2 档位路由、schema v3 验证和用户确认 |
 | Spec 综合 | 原生 `work-unit.spec-synthesis`；`to-spec`（用户显式兼容） | 初稿进入 `ready-for-human`，不得直接实现 |
 | 切片 | 原生 `work-unit.ticket-decomposition`；`to-tickets`（用户显式兼容） | 仅在冻结/无影响记录后拆垂直切片，初始 Ticket 状态为 `ready-for-human` |
 | 实现 | 原生 `work-unit.slice-implementation`；`implement`（用户显式兼容） | 当前合同批准并持久化后执行；内部使用 `tdd`，结果回交后再次核验 |
 | Bug | `diagnosing-bugs`、`tdd` | 先建立红色反馈；高风险影响升级上游门禁 |
-| 审查 | `code-review` | 唯一默认代码审查入口；审查者独立且不得写实现；Standards 消费 Spec、仓库治理规则、Slice `required_skills` 和 YSS / Alibaba 专项检查输入；finding 按合同分流修复或 stale 回 Router |
+| 审查 | `code-review` | 唯一默认代码审查入口；审查者独立且不得写实现；Standards 消费 Spec、仓库治理规则、Slice `required_skills` 和 YSS / Alibaba 专项检查输入；finding 按合同分流修复或 stale 回 实现合同编译器 |
 | 跨上下文 | `handoff` | 保存来源、阶段、未决项、命令和下一责任人 |
-| 阶段边界 | `PHASE-BOUNDARIES.md` | 按 `Continue → /clear → /handoff → subagent → /compact` 选择上下文动作；只记录证据，不扩展生命周期状态 |
+| 阶段边界 | 生命周期 phase-boundary 合同 | 按 `Continue → /clear → /handoff → subagent → /compact` 选择上下文动作；只记录证据，不扩展生命周期状态 |
 | 解释未落地 | `wait-what` | 只重新解释当前结论，不改变阶段、门禁、Ticket 或 `ready-for-agent` |
 | 人工步骤 | 人工 checkpoint | 记录 Agent 无法替代的点击、审批、凭据和迁移步骤；秘密值必须隐藏并脱敏 |
 | 编写 Agent 文档 | `writing-for-agents`；维护 skill 时使用 `maintaining-skills` | 共享 skill 只改 `.agents/skills`；流程文档保持简体中文 |
 
 尽量不修改 Matt skill 以复制 YSS 规则。只有它违反模板硬门禁时才做最小兼容修改。
 
-Router 只能返回 `draft`、`blocked` 或 `ready-for-lifecycle-review`，不得自行批准合同、设置 `ready-for-agent` 或宣布完成。`new_impacts`、`drift`、`violation`、越界路径或缺失实际验证会暂停当前工作单元，并由本编排器决定增量重路由、完整重路由或回到更早生命周期阶段。
+实现合同编译器 只能返回 `draft`、`blocked` 或 `ready-for-lifecycle-review`，不得自行批准合同、设置 `ready-for-agent` 或宣布完成。`new_impacts`、`drift`、`violation`、越界路径或缺失实际验证会暂停当前工作单元，并由本编排器决定增量重路由、完整重路由或回到更早生命周期阶段。
 
 ## Workflow Execution Result
 
@@ -60,7 +58,7 @@ blocking_signals: []
 
 存在 `drift`、`new_impacts`、`violation`、`missing_evidence` 或 `stale_candidates`，以及证据缺失时，不得返回 `completed`；必须暂停并由编排器决定增量重路由、完整重路由或回到更早阶段。
 
-Router 状态映射为：`draft → completed`、`blocked → blocked`、`ready-for-lifecycle-review → needs-human`。这里的 `completed` 只表示 Matt 工作单元已产出可验收结果，不表示生命周期完成或可发布。
+实现合同编译器 状态映射为：`draft → completed`、`blocked → blocked`、`ready-for-lifecycle-review → needs-human`。这里的 `completed` 只表示 Matt 工作单元已产出可验收结果，不表示生命周期完成或可发布。
 
 `completed` 的 `evidence_refs` 至少包含一条可读取或可解析的证据引用；只有字段存在但为空，不能证明工作单元完成。兼容入口下的正式 Spec、Ticket 或实现资产仍只能由对应显式用户入口创建；原生工作单元由生命周期编排器创建并持有状态。
 
@@ -76,7 +74,7 @@ Router 状态映射为：`draft → completed`、`blocked → blocked`、`ready-
 
 ## Review 候选与 Git 授权
 
-YSS 调用 `code-review` 前必须形成 review input，至少包含 `review_mode`、`review_base_ref`、`implementation_candidate_ref`、`candidate_snapshot_ref`、`candidate_digest`、`spec_ref`、`ticket_ref`、`slice_contract_ref`、`build_architecture_checklist_ref` 和 `yss_execution_result_refs`，并满足 `orchestration-contract.yaml.review_input.manifest_required_by_mode`。Standards 还必须编译 `review_standards_route`：合同 `required_skills`、影响面专项检查输入、报告模板与 `finding_disposition`；机器检查按 `run_if_present` 执行。质量标准只从 `engineering-baseline` 引用，禁止在 review input 或切片中另起一份。命中高风险影响时，review input 还要引用 Doubt-Driven 主张 / 反证记录；缺少反证或残余风险未处理时返回 `blocked`。`committed` 审查 merge-base 到不可变 `HEAD`；`worktree` 一次捕获 merge-base 到 working tree 的 committed、staged、unstaged 和 untracked 内容，使用 `yss-worktree-candidate-v1` 规定的 raw path、uint64 big-endian 长度、tracked/untracked record 和不支持条目阻断规则计算 SHA-256，让两个 Reviewer 消费同一不可变快照，并在返回和完成 checkpoint 复核摘要未变化。缺少输入、候选为空、专项覆盖缺失、未关闭 mandatory `violation`、适用行空白或摘要变化时返回 `blocked`，不能缩小审查范围、另起通用审查 skill、由审查者改实现，或合并不同候选的结论。`violation` 类 finding 交实现者在原合同路径修复后全轴复审；`drift` / `new_impacts` 使合同 `stale` 并回 Router。
+YSS 调用 `code-review` 前必须形成 review input，至少包含 `review_mode`、`review_base_ref`、`implementation_candidate_ref`、`candidate_snapshot_ref`、`candidate_digest`、`spec_ref`、`ticket_ref`、`slice_contract_ref`、`build_architecture_checklist_ref` 和 `yss_execution_result_refs`，并满足 `orchestration-contract.yaml.review_input.manifest_required_by_mode`。Standards 还必须编译 `review_standards_route`：合同 `required_skills`、影响面专项检查输入、报告模板与 `finding_disposition`；机器检查按 `run_if_present` 执行。质量标准只从 `engineering-baseline` 引用，禁止在 review input 或切片中另起一份。命中高风险影响时，review input 还要引用 Doubt-Driven 主张 / 反证记录；缺少反证或残余风险未处理时返回 `blocked`。`committed` 审查 merge-base 到不可变 `HEAD`；`worktree` 一次捕获 merge-base 到 working tree 的 committed、staged、unstaged 和 untracked 内容，使用 `yss-worktree-candidate-v1` 规定的 raw path、uint64 big-endian 长度、tracked/untracked record 和不支持条目阻断规则计算 SHA-256，让两个 Reviewer 消费同一不可变快照，并在返回和完成 checkpoint 复核摘要未变化。缺少输入、候选为空、专项覆盖缺失、未关闭 mandatory `violation`、适用行空白或摘要变化时返回 `blocked`，不能缩小审查范围、另起通用审查 skill、由审查者改实现，或合并不同候选的结论。`violation` 类 finding 交实现者在原合同路径修复后全轴复审；`drift` / `new_impacts` 使合同 `stale` 并回 实现合同编译器。
 
 Matt `implement` 的通用提交指令不构成 YSS Git 授权。只有用户明确给出 `commit_authorized` 为 `true`、非空 `commit_scope` 和 `commit_authorization_ref` 时才能 commit；只有明确给出 `push_authorized` 为 `true`、非空 `push_scope` 和 `push_authorization_ref` 时才能 push。缺少任一字段时保持工作区不变，只输出 checkpoint 判断；不得把 `orchestrate`、实现授权、当前分支、测试通过或负责人要求解释为隐含授权。`git-submodule` 还必须按仓授权、禁止 detached HEAD 提交，并先推子仓再更新父仓 gitlink。
 
@@ -119,4 +117,4 @@ Matt 的上下文建议不能覆盖 YSS 的 phase-boundary 契约。固定按 `C
 
 ## Release / Retrospective
 
-Release 和 Retrospective 是生命周期编排器拥有的工作单元，不由 `ask-matt` 的默认 `idea → ship` 流程隐式完成。进入发布或完成结论前必须重新取得 fresh verification、发布/回滚证据和独立审查结果；复盘同样必须有 fresh verification，再按模板治理规则回流 `AGENTS.md`、`CONTEXT.md`、ADR 或 Skill。
+Release 和 Retrospective 是生命周期编排器拥有的工作单元，不由任何兼容流程隐式完成。进入发布或完成结论前必须重新取得 fresh verification、发布/回滚证据和独立审查结果；复盘同样必须有 fresh verification，再按模板治理规则回流 `AGENTS.md`、`CONTEXT.md`、ADR 或 Skill。

package/template/.agents/skills/yss-product-lifecycle/references/orchestration-contract.yaml

@@ -1,4 +1,19 @@
 schema_version: 1
+backend_architecture_identity_policy:
+  source: docs/agents/yss-skill-registry.yaml#architecture_profiles
+  schema: docs/process/schemas/backend-architecture-identity.schema.json
+  required_surfaces: [engineering-baseline, repository-registration, scaffold-manifest, slice-contract, work-unit, execution-result]
+  agreement: exact-identity-and-digest
+  missing_or_drift: blocked-and-recompile
+  new_profile_readiness: supported-only
+service_project_initialization:
+  work_unit: work-unit.service-project-initialization
+  skill: yss-mvc-data-analysis-project-initializer
+  architecture_profile: mvc-data-analysis-v1
+  context_inputs: [context_handoff_ref, context_handoff_digest]
+  approval: current-schema-v3-scaffold-contract-and-user-confirmed-architecture
+  parent_ownership: service-references-and-handoff-only
+  child_ownership: independent-git-project-instance-root-context-and-lifecycle
 supported_state_schema_versions: [1]
 
 implementation_path_policy:
@@ -25,6 +40,7 @@ checkpoint_policy:
   flush_immediately_on: [blocked, responsibility_changed, asset_approval]
   preserve_stage_causality: true
   required_stage_trace_fields: [stage, upstream_refs, artifact_refs, gate_decisions, downstream_impacts]
+  project_instance_stage_exit_requires_context_reconciliation: true
 
 modes:
   route: read_only
@@ -38,14 +54,6 @@ entry_routing:
   valid_modes: [template-source, project-instance]
   invalid_manifest:
     action: migration-check
-  direct_matt_entry:
-    skill: ask-matt
-    delegate_to: yss-product-lifecycle
-    requires_valid_manifest: true
-    action: navigate-only
-    lifecycle_state_mutation: forbidden
-    lifecycle_artifact_write: forbidden
-    return_to_orchestrator: required
   formal_user_entry:
     skills: [setup-matt-pocock-skills, grill-with-docs, to-spec, to-tickets, implement]
     action: lifecycle-validate-and-accept
@@ -87,7 +95,7 @@ workflow_execution_result:
       normalize_to: workflow-execution-result-v1
       removal_target: schema_version_2
   result_values: [completed, blocked, needs-human, failed]
-  required: [result_schema, work_unit, workflow_reference, result, evidence_refs, changed_artifacts, new_impacts, stale_candidates, next_route, blocking_signals]
+  required: [result_schema, work_unit, workflow_reference, result, context_reconciliation, evidence_refs, changed_artifacts, new_impacts, stale_candidates, next_route, blocking_signals]
   unavailable_skill:
     required: [skill, provider, fallback, resolution]
     blocking_result: blocked
@@ -97,6 +105,12 @@ workflow_execution_result:
   completed_requires_readable_evidence_refs: true
   evidence_ref_validation: readable-or-resolvable
   completed_requires_no_blocking_signals: true
+  context_reconciliation:
+    schema_ref: docs/process/schemas/context-reconciliation.schema.json
+    validator: scripts/verify-context-reconciliation
+    project-instance: {required_status: reconciled, readable_ref_required: true, transition_without_reconciliation: blocked}
+    template-source: {required_status: not-applicable, reason_required: true}
+    creates_gate: false
   workflow_reference:
     required: [source, skill, invocation_mode]
     allowed_sources: [yss-product-lifecycle, mattpocock/skills]
@@ -170,9 +184,9 @@ task_package:
 # may prepare, validate and accept their results, but cannot invoke them or create
 # their formal artifacts on their behalf.
 matt_invocation_boundary:
-  user_invoked_skills: [ask-matt, grill-me, grill-with-docs, handoff, implement, improve-codebase-architecture, loop-me, setup-matt-pocock-skills, setup-ts-deep-modules, teach, to-questionnaire, to-spec, to-tickets, triage, wait-what, wayfinder, writing-beats, writing-fragments, writing-shape]
+  user_invoked_skills: [grill-me, grill-with-docs, handoff, implement, improve-codebase-architecture, setup-matt-pocock-skills, to-questionnaire, to-spec, to-tickets, triage, wait-what, wayfinder]
   lifecycle_managed_user_entries: [setup-matt-pocock-skills, grill-with-docs, to-spec, to-tickets, implement]
-  model_invoked_skills: [code-review, codebase-design, diagnosing-bugs, domain-modeling, grilling, migrate-to-shoehorn, prototype, resolving-merge-conflicts, scaffold-exercises, setup-pre-commit, tdd, writing-for-agents, yss-research]
+  model_invoked_skills: [code-review, codebase-design, diagnosing-bugs, domain-modeling, grilling, prototype, resolving-merge-conflicts, tdd, writing-for-agents, yss-research]
   lifecycle_allowed_model_invoked_skills: [code-review, codebase-design, diagnosing-bugs, domain-modeling, grilling, prototype, tdd, yss-research]
   lifecycle_may_invoke_user_invoked: false
   formal_artifact_owner: explicit-user-entry
@@ -183,13 +197,13 @@ skill_source_contract:
   lock_version: 3
   source_revisions_required: [mattpocock/skills, iloveZzz/yss-ui]
   adaptation_ref_required_when_effective_diff: true
-  retired_shared_skills: [batch-grill-me, product-design-prototype, yss-dictionary, yss-jdbc, yss-log, yss-taskflow, yss-backend-scaffold-application, yss-backend-scaffold-domain, yss-backend-scaffold-infrastructure, yss-backend-scaffold-web]
+  retired_shared_skills: [ask-matt, batch-grill-me, dispatching-parallel-agents, loop-me, migrate-to-shoehorn, product-design-prototype, prototype-page-acceptance, scaffold-exercises, setup-pre-commit, setup-ts-deep-modules, teach, writing-beats, writing-fragments, writing-shape, yss-dictionary, yss-jdbc, yss-log, yss-microapp-commit, yss-page-module-development, yss-taskflow, yss-backend-scaffold-application, yss-backend-scaffold-domain, yss-backend-scaffold-infrastructure, yss-backend-scaffold-web]
 
 # 生命周期默认走原生工作单元；Matt user-invoked skill 仅保留为兼容入口。
 lifecycle_native_entries:
   default_entry: yss-product-lifecycle
   formal_artifact_owner: yss-product-lifecycle
-  user_confirmation_required_at: [spec-baseline, prototype-confirmation, openapi-freeze, merge-or-release]
+  user_confirmation_policy_ref: docs/agents/digital-human-roles.yaml#user_decision_policy
   compatibility_entries:
     to-spec: lifecycle-validate-and-accept
     to-tickets: lifecycle-validate-and-accept
@@ -241,20 +255,28 @@ work_unit_routes:
   work-unit.prototype-design:
     native: {source: yss-product-lifecycle, skill: yss-product-lifecycle, invocation_mode: model-invoked}
     primary_skill: yss-prototype-stage
-    supporting_skills: [prototype-review, yss-design-system, yss-antd-design, product-design:index]
-    skills: [prototype-review, yss-design-system, yss-prototype-stage, yss-antd-design, product-design:index]
-    execution_order: [yss-design-system, low-fidelity-assets, prototype-review, yss-antd-design-pre-build, product-design-focused-workflow, yss-antd-design-post-build, browser-design-qa-accessibility, user-confirmation]
+    supporting_skills: [prototype-review, yss-design-system, product-design:index, yss-antdv-next-design, yss-antd-design]
+    skills: [prototype-review, yss-design-system, yss-prototype-stage, product-design:index, yss-antdv-next-design, yss-antd-design]
+    execution_order: [yss-design-system, low-fidelity-assets, prototype-review, prototype-profile-routing, profile-adapter-build, browser-design-qa-accessibility, user-confirmation]
+    profile_routing_ref: .agents/skills/yss-prototype-stage/references/prototype-profile-routing.md
     prototype_adapter_ref: .agents/skills/yss-prototype-stage/references/product-design-adapter.md
-    evidence_schema_version: 2
-    version_boundary: {design_standard: ant-design-v6, prototype_components: react-antd-6.x, production_components: yss-ui-ant-design-vue-4.x, production_version_source: implementation-lockfile}
+    evidence_schema_version: 3
+    profile_contract:
+      default_when_uncertain: H2
+      highest_matching_profile_wins: true
+      profiles:
+        H1: {kind: visual-review, adapter: static-html, node_runtime_required: false, antd_facts: not-applicable}
+        H2: {kind: flow-review, adapter: runnable-flow, react_antd: supported-not-required, antd_facts: conditional}
+    implementation_handoff: {production_component_assumptions: required-array, verification_targets: frontend-implementation-only}
+    version_boundary: {h2_design_standard: vue-antdv-next-default-react-antd-explicit-compatibility, prototype_must_not_call: yss-ui, production_version_source: implementation-lockfile}
     human_gate: prototype-confirmation
     applies_when: product_design_impact
     not_applicable_reason: no_ui_or_product_design_impact
   work-unit.technical-analysis:
     native: {source: yss-product-lifecycle, skill: yss-product-lifecycle, invocation_mode: model-invoked}
-    primary_skill: yss-router
+    primary_skill: yss-implementation-contract-compiler
     supporting_skills: [yss-openapi-governance, yss-openapi-draft-review, codebase-design, implementation-repo-onboarding, yss-tactical-design]
-    skills: [yss-openapi-governance, yss-openapi-draft-review, codebase-design, implementation-repo-onboarding, yss-tactical-design, yss-router]
+    skills: [yss-openapi-governance, yss-openapi-draft-review, codebase-design, implementation-repo-onboarding, yss-tactical-design, yss-implementation-contract-compiler]
     tactical_ddd:
       applies_when: [aggregate-impact, state-machine-impact, invariant-impact, consistency-impact, domain-event-impact, gateway-boundary-impact, persistence-mapping-impact]
       not_applicable_reason: no_tactical_ddd_impact
@@ -270,22 +292,22 @@ work_unit_routes:
   work-unit.ticket-decomposition:
     native: {source: yss-product-lifecycle, skill: yss-product-lifecycle, invocation_mode: model-invoked}
     primary_skill: yss-product-lifecycle
-    supporting_skills: [yss-router]
+    supporting_skills: [yss-implementation-contract-compiler]
     compatibility: {source: mattpocock/skills, skill: to-tickets, invocation_mode: reference, formal_artifact_owner: explicit-user-entry}
-    skills: [yss-router]
+    skills: [yss-implementation-contract-compiler]
     applies_when: frozen_scope_ready_for_slicing
     not_applicable_reason: contract_or_scope_not_frozen
     must_complete_before: work-unit.slice-implementation
   work-unit.slice-implementation:
     native: {source: yss-product-lifecycle, skill: yss-product-lifecycle, invocation_mode: model-invoked}
-    primary_skill: yss-router
-    supporting_skills: [tdd, yss-ui, yss-ui-business-page-generation, yss-page-module-development]
+    primary_skill: yss-implementation-contract-compiler
+    supporting_skills: [tdd, yss-ui, yss-ui-business-page-generation]
     compatibility: {source: mattpocock/skills, skill: implement, invocation_mode: reference, formal_artifact_owner: explicit-user-entry}
-    skills: [tdd, yss-router, yss-ui, yss-ui-business-page-generation, yss-page-module-development]
+    skills: [tdd, yss-implementation-contract-compiler, yss-ui, yss-ui-business-page-generation]
     frontend_route:
       primary_skill: yss-ui
       page_generation_skill: yss-ui-business-page-generation
-      page_orchestration_skill: yss-page-module-development
+      page_orchestration_skill: yss-ui-business-page-generation
       conditional_skills:
         api_impact: [yss-api-integration]
         formily_impact: [yss-formily, formily-foundation, formily-linkage-effects, formily-mode-slot-detail, formily-step-flow]
@@ -315,8 +337,8 @@ work_unit_routes:
   work-unit.code-review:
     native: {source: yss-product-lifecycle, skill: code-review, invocation_mode: model-invoked}
     primary_skill: code-review
-    supporting_skills: [alibaba-java-code-style, yss-ui, yss-design-system, yss-page-module-development, yss-domain, yss-application, yss-repository, yss-web-controller, yss-dto, mapstruct, lombok]
-    skills: [code-review, alibaba-java-code-style, yss-ui, yss-design-system, yss-page-module-development, yss-domain, yss-application, yss-repository, yss-web-controller, yss-dto, mapstruct, lombok]
+    supporting_skills: [alibaba-java-code-style, yss-ui, yss-design-system, yss-ui-business-page-generation, yss-domain, yss-application, yss-repository, yss-web-controller, yss-dto, mapstruct, lombok]
+    skills: [code-review, alibaba-java-code-style, yss-ui, yss-design-system, yss-ui-business-page-generation, yss-domain, yss-application, yss-repository, yss-web-controller, yss-dto, mapstruct, lombok]
     review_standards_route:
       unique_default_skill: code-review
       second_generic_review_skill: forbidden
@@ -329,7 +351,7 @@ work_unit_routes:
         checkable_rule_without_machine: not-a-pass
       conditional_skills:
         backend_impact: [alibaba-java-code-style, yss-domain, yss-application, yss-repository, yss-web-controller, yss-dto, mapstruct, lombok]
-        ui_impact: [yss-ui, yss-design-system, yss-page-module-development]
+        ui_impact: [yss-ui, yss-design-system, yss-ui-business-page-generation]
       not_applicable_reasons:
         backend_impact: no_backend_impact
         ui_impact: no_ui_impact
@@ -348,7 +370,7 @@ work_unit_routes:
           kinds: [drift, new_impacts, required_skills_mismatch]
           mark_contract: stale
           continue_coding_on_old_contract: forbidden
-          next: router-or-earlier-lifecycle
+          next: compiler-or-earlier-lifecycle
         exemption_policy:
           not_applicable: impact_not_triggered_only
           mandatory_waiver: forbidden
@@ -498,6 +520,7 @@ review_input:
 
 git_authorization:
   natural_language_intent_is_authorization: false
+  explicit_scoped_user_reply_may_be_normalized: true
   commit:
     requires_explicit_user_authorization: true
     required: [commit_authorized, commit_scope, commit_authorization_ref]
@@ -533,21 +556,66 @@ git_authorization:
 
 seam_deferred_required: [risk, owner, follow_up_ticket, verification_plan, target_version_or_release_date]
 
+scaffold_architecture_decision:
+  applies_when: [backend_impact, scaffold_status_required]
+  owner: yss-product-lifecycle
+  stage: work-unit.technical-analysis
+  timing: after-impact-and-engineering-baseline-inputs-before-scaffold-contract-compilation
+  source: scaffold-architecture-decisions.yaml
+  schema_version: 1
+  statuses: [undecided, recommended, awaiting-user-decision, user-confirmed, lifecycle-approved, consumed, stale]
+  user_choices:
+    domain-driven:
+      display_name: DDD 开发脚手架
+      recommendation_signals: [aggregate-invariant, complex-state-machine, cross-aggregate-consistency, domain-event, complex-concurrency]
+    layered-mvc:
+      display_name: MVC 开发脚手架
+      recommendation_signals: [crud, reporting-query, data-transformation, external-system-orchestration, thin-domain]
+  recommendation_policy:
+    evidence_required: true
+    strong_domain_signal_prefers: domain-driven
+    all_strong_domain_signals_absent_and_thin_domain_prefers: layered-mvc
+    user_may_override_soft_recommendation: true
+    override_reason_required: true
+    unsupported_profile_is_hard_blocker: true
+  interaction:
+    generator_is_non_interactive: true
+    main_project_has_no_silent_default: true
+    child_projects_prefill_parent_default: true
+    batch_confirmation_required: true
+    prompt_fields: [project, responsibility, agent_recommendation, recommendation_reasons, inherited_from, current_choice, platform_profile, architecture_profile, verification_database, production_database, resolved_modules, warnings]
+    missing_or_deferred_action: blocked
+  inheritance:
+    modes: [root-default, inherit, override]
+    parent_change_stales_inherited_children: true
+    explicit_overrides_survive_parent_change: true
+    shared_profile_change_stales_all_affected: true
+    new_child_requires_confirmation: true
+  persistence:
+    required: [decision_id, project_id, parent_project_id, recommended_architecture, recommendation_reasons, confirmed_architecture, override_reason, inheritance_mode, inherited_from, platform_profile, architecture_profile, verification_database, production_database, requested_capabilities, resolved_modules, resolution_version, user_confirmation, decision_inputs_digest, status]
+    downstream_reference: [decision_ref, decision_id, decision_digest]
+    no_new_gate: true
+  change_policy:
+    before_lifecycle_approval: update-decision
+    after_lifecycle_approval_before_generation: stale-contract-and-recompile
+    after_generation: separate-architecture-migration-work-unit
+
 backend_scaffold:
   applies_when: [backend_impact]
   scaffold_statuses: [existing, required, initialized]
   required_status: required
   sequence:
     after: [prototype_review, prototype_verification, antd_cli_verification, browser_verification, prototype_confirmation, engineering_baseline]
-    before_generator: [yss-router-scaffold-contract, lifecycle-approve-scaffold-contract]
+    before_generator: [scaffold-architecture-decision-user-confirmed, scaffold-architecture-decision-lifecycle-approved, yss-implementation-contract-compiler-scaffold-contract, lifecycle-approve-scaffold-contract]
     before: [business_code_generation, implement]
-  generator_skill: yss-ddd-scaffold-generator
-  baseline_skill: yss-backend-scaffold-parent
+  generator_routes:
+    domain-driven: { recipe: backend.ddd-scaffold, generator_skill: yss-ddd-scaffold-generator, baseline_skills: [yss-backend-scaffold-parent] }
+    layered-mvc: { recipe: backend.mvc-scaffold, generator_skill: yss-layered-mvc-scaffold-generator, baseline_skills: [] }
   tdd_mode: controlled-generation
   contract_schema:
-    schema_version: 2
+    schema_version: 3
     identity: service-engineering-baseline
-    required: [contract_id, contract_version, scaffold_request_id, status, router_draft_ref, lifecycle_approval_ref, persisted_ref, current_version, implementation_repository, backend_repository, scaffold_status, project_name, target_output_dir, base_package, maven_coordinates, profiles, allowed_write_paths, expected_evidence_files, verification_commands, approval, work_unit, generation_policy]
+    required: [contract_id, contract_version, scaffold_request_id, status, compiler_draft_ref, lifecycle_approval_ref, persisted_ref, current_version, implementation_repository, backend_repository, scaffold_status, project_name, target_output_dir, base_package, architecture_family, generator_skill, decision_ref, decision_id, decision_digest, maven_coordinates, profiles, module_profile, allowed_write_paths, expected_evidence_files, verification_commands, approval, work_unit, generation_policy]
     status_by_owner:
       router: [draft, ready-for-lifecycle-review, blocked]
       lifecycle: [approved, stale, blocked]
@@ -564,22 +632,20 @@ backend_scaffold:
       parent_required: [group_id, artifact_id, version]
       yss_components_version: 2.0.0-SNAPSHOT
     profiles:
-      required: [architecture, persistence, database, platform, validation_namespace, dto_placement, repository]
-      supported_initial:
-        architecture: target-domain-model
-        persistence: mybatis-plus
-        database: mysql
-        platform: spring-boot-2.7-jdk8
-        validation_namespace: javax
-        dto_placement: web
-        repository: yss-internal
-      unsupported: [old-architecture-profile, client-in-domain, mybatis, spring-boot-3, jakarta, separate-client-module]
+      discriminant: architecture_family
+      domain-driven: { generator_skill: yss-ddd-scaffold-generator, architecture: target-domain-model, persistence: mybatis-plus, verification_database: h2, production_database: not-bound, platform: spring-boot-2.7-jdk8, validation_namespace: javax, dto_placement: web, repository: yss-internal }
+      layered-mvc: { generator_skill: yss-layered-mvc-scaffold-generator, architecture: layered-mvc, persistence: mybatis-plus, verification_database: h2, production_database: not-bound, platform: spring-boot-2.7-jdk8, validation_namespace: javax, repository: yss-internal }
+      unsupported: [old-architecture-profile, mybatis, spring-boot-3, jakarta, arbitrary-module-combination]
+    module_profile:
+      required: [requested_capabilities, resolved_modules, resolution_version]
+      resolution_version: 1
     unsupported_inputs:
       schema_v1: reject-no-auto-upgrade
+      schema_v2_new_generation: reject-no-auto-upgrade
       slice_id: forbidden-as-scaffold-identity
       existing_project: reject-no-scaffold-migration
-  required_inputs: [implementation_repository, backend_repository, scaffold_status, scaffold_target_confirmed, scaffold_request_id, target_output_dir, project_name, base_package, maven_group_id, project_version, parent_group_id, parent_artifact_id, parent_version, yss_components_version, architecture_profile, persistence_profile, database, platform_profile, validation_namespace, dto_placement, repository_profile, scaffold_contract_file, scaffold_contract_draft, scaffold_contract_id, scaffold_contract_version, scaffold_contract_status, scaffold_contract_approved, scaffold_contract_router_draft_ref, scaffold_contract_lifecycle_approval_ref, scaffold_contract_persisted, scaffold_contract_persisted_ref, scaffold_contract_current_version]
-  required_evidence: [generator_inputs, expected_files, scaffold_generation_manifest_v2, generated_project_structure, generation_execution_result, verification_execution_result, architecture_rules, ./mvnw_validate, ./mvnw_test, ./mvnw_package, yss_skill_execution_result]
+  required_inputs: [implementation_repository, backend_repository, scaffold_status, scaffold_target_confirmed, scaffold_request_id, target_output_dir, project_name, base_package, architecture_family, generator_skill, decision_ref, decision_id, decision_digest, maven_group_id, project_version, parent_group_id, parent_artifact_id, parent_version, yss_components_version, architecture_profile, persistence_profile, verification_database, production_database, platform_profile, validation_namespace, dto_placement, repository_profile, requested_capabilities, resolved_modules, resolution_version, scaffold_contract_file, scaffold_contract_draft, scaffold_contract_id, scaffold_contract_version, scaffold_contract_status, scaffold_contract_approved, scaffold_contract_compiler_draft_ref, scaffold_contract_lifecycle_approval_ref, scaffold_contract_persisted, scaffold_contract_persisted_ref, scaffold_contract_current_version]
+  required_evidence: [scaffold_architecture_decision, user_confirmation_ref, decision_digest, generator_inputs, expected_files, scaffold_generation_manifest_v3, generated_project_structure, generation_execution_result, verification_execution_result, architecture_rules, ./mvnw_validate, ./mvnw_test, ./mvnw_package, yss_skill_execution_result]
   generation_options:
     with_example: false
     force: forbidden-by-default
@@ -587,8 +653,10 @@ backend_scaffold:
     template_upgrade: unsupported
     old_project_migration: unsupported-separate-architecture-modernization-initiative
   forbidden_generation: [business_rules, state_machine, permission, transaction, complex_query, error_mapping, user_visible_behavior, business_example_crud, unapproved_force_overwrite]
-  after_generation: [yss-backend-scaffold-parent, yss-router]
-  existing_or_initialized: [baseline_evidence, wrapper_verification, yss_router_contract_recompile]
+  after_generation:
+    domain-driven: [yss-backend-scaffold-parent, yss-implementation-contract-compiler]
+    layered-mvc: [yss-implementation-contract-compiler]
+  existing_or_initialized: [baseline_evidence, wrapper_verification, implementation_contract_recompile]
   verification:
     commands: ["./mvnw validate", "./mvnw test", "./mvnw package"]
     requires_execution: true
@@ -731,19 +799,19 @@ ready_for_agent:
 frontend_implementation_plan:
   applies_when: [ui_impact]
   required_before: [ready_for_agent]
-  required: [prototype_ref, spec_ref, route_and_page_inventory, visual_acceptance_cases, desktop_viewport, narrow_viewport, state_cases, pnpm_commands]
+  required: [prototype_ref, spec_ref, visual_baseline, route_and_page_inventory, baseline_case_ids, desktop_viewport, narrow_viewport, state_cases, pnpm_commands]
   schema: docs/process/schemas/frontend-implementation-evidence.schema.json
   validator: scripts/verify-frontend-implementation-evidence
-  acceptance: [kind_plan, template_false, status_approved, no_template_placeholders, readable_baseline_refs, non_empty_acceptance_cases]
+  acceptance: [kind_plan, template_false, status_approved, no_template_placeholders, readable_baseline_refs, approved_visual_baseline_digest_current, selected_case_ids_exist]
 
 frontend_implementation_verification:
   applies_when: [ui_impact]
   required_before: [release]
-  required: [prototype_ref, spec_ref, route_and_page_inventory, desktop_visual_evidence, narrow_view_visual_evidence, loading_empty_error_permission_interaction_results, console_warning_check, pnpm_commands, uncovered_differences, difference_owner]
+  required: [prototype_ref, spec_ref, visual_baseline, route_and_page_inventory, case_results, interaction_results, console_warning_check, pnpm_commands, actual_verification, uncovered_differences, difference_owner]
   verification: [actual_command, exit_code, executed_at, evidence_ref]
   schema: docs/process/schemas/frontend-implementation-evidence.schema.json
   validator: scripts/verify-frontend-implementation-evidence
-  acceptance: [kind_verification, template_false, status_approved, no_template_placeholders, console_warning_pass, independent_review_approved]
+  acceptance: [kind_verification, template_false, status_approved, no_template_placeholders, visual_baseline_identity_and_digest_match, case_results_pair_every_selected_case, no_unexplained_difference, console_warning_pass, pnpm_exit_codes_zero, independent_review_approved]
   blocked_when: [unexplained_visual_difference, missing_visual_evidence, typecheck_only, claimed_alignment_without_evidence]
   on_new_impact: [new_impacts, drift, reroute]
 
@@ -842,8 +910,8 @@ external_input_pause:
   reason_code: external-input-required
   reason: required decision-maker input is not available to the Agent
   required: [questionnaire_ref, recipient_role, requested_outputs, resume_route]
-  response_required: [response_ref, reclassified_impact, updated_authoritative_asset]
-  resume_requires: [response_ref, reclassified_impact, updated_authoritative_asset]
+  response_required: [response_ref, user_decisions, reclassified_impact, updated_authoritative_asset]
+  resume_requires: [response_ref, user_decisions, reclassified_impact, updated_authoritative_asset]
 
 prototype_modes:
   matt_logic:
@@ -863,3 +931,16 @@ behavioral_invariants:
   wait_what_preserves_state: true
   human_checkpoint_required_for_manual_steps: true
   diagnostics_redact_secrets: true
+
+user_decision_evidence:
+  policy_ref: docs/agents/digital-human-roles.yaml#user_decision_policy
+  schema_ref: docs/process/schemas/user-decision.schema.json
+  protocol_ref: references/user-decisions.md
+  verifier: scripts/verify-user-decision
+  workflow_result_fields: [user_decisions, user_decision_not_applicable]
+  implementation_fields: [user_decisions, slice_contract_ref, vertical_slice_ticket_ref]
+  checkpoint_carrier: human_review
+  professional_review_replaced: false
+  response_absent: paused-human-gate
+  invalid_response: blocked
+  basis_changed: stale

package/template/.agents/skills/yss-product-lifecycle/references/orchestration.md

@@ -27,9 +27,11 @@ Matt phase boundary 是工作阶段之间的上下文决策，不是新的生命
 
 ## 原型到后端脚手架的接力
 
-`prototype_confirmation` 通过后，先判断实现仓库登记中的 backend `scaffold_status`。当状态为 `required` 时，先完成工程基线，由 `yss-router` 编译脚手架 `controlled-generation` 工作单元合同，生命周期编排器批准并持久化后才能运行生成器；顺序为：工程基线 → Router 脚手架合同 draft → 生命周期批准/持久化 → 脚手架生成 → `yss-backend-scaffold-parent` 基线校验 → Router 合同重编译。`existing` / `initialized` 不重复全量生成，但不能跳过基线校验和 Router 重编译。
+`prototype_confirmation` 通过后，先判断实现仓库登记中的 backend `scaffold_status`。当状态为 `required` 时，在工程基线中先完成脚手架架构选择：Agent 按领域复杂度给出 `domain-driven` / `layered-mvc` 推荐和依据，本体选择作为子项目预填默认值，用户通过批量表确认全部项目或逐项覆盖。选择写入 `scaffold-architecture-decisions.yaml`；处于 `undecided`、`recommended`、`awaiting-user-decision` 或 `stale` 时必须阻断，不得默认 DDD，也不得在生成器内交互。
 
-脚手架工作单元必须使用结构化合同 JSON 文件，至少记录 `contract_id`、`contract_version`、`slice_id`、Router draft 引用、生命周期批准引用、持久化引用、当前版本、允许写路径、预期证据文件和验证命令；批准记录至少含 `approval_ref`、`approver`、`persisted_ref`、`current_version`。生成器必须读取该合同文件并校验状态、版本、skill、工作模式和固定命令，不能只接受任意字符串参数。它还必须记录生成器输入、预期文件、目标目录、实际 `./mvnw validate` / `./mvnw test` / `./mvnw package` 结果和 YSS Skill Execution Result。三条命令必须由受控工作单元真实执行，逐条留存 `exit_code`、`duration_ms`、stdout/stderr 引用和执行时间；生成器打印的下一步命令不构成证据。生命周期生成关闭 `--with-example`；非空目标目录使用 `--force` 默认阻断，除非覆盖范围、备份、回滚点和批准引用已进入合同。脚手架不得把业务规则、状态机、权限、事务、复杂查询、错误映射或用户可见行为放进生成物；`validate` 通过、输出目录存在或生成器成功都不是生命周期批准、架构放行或 `ready-for-agent`。
+选择达到 `lifecycle-approved` 且 digest 当前后，由 `yss-implementation-contract-compiler` 编译脚手架 schema v3 `controlled-generation` 工作单元合同，生命周期批准并持久化后才能运行对应生成器。顺序为：工程基线与架构推荐 → 用户确认与选择持久化 → 实现合同编译器脚手架合同 draft → 生命周期批准/持久化 → `domain-driven` 使用 `yss-ddd-scaffold-generator` 或 `layered-mvc` 使用 `yss-layered-mvc-scaffold-generator` → 对应基线/Manifest v3 校验 → 实现合同编译器业务合同重编译。`existing` / `initialized` 不重复生成；架构转换必须单独立项。
+
+脚手架工作单元必须使用结构化 schema v3 合同 JSON，至少记录 `contract_id`、`contract_version`、`scaffold_request_id`、`architecture_family`、`generator_skill`、`decision_ref/id/digest`、Profile、能力模块闭包、实现合同编译器 draft 引用、生命周期批准引用、持久化引用、当前版本、允许写路径、预期证据文件和验证命令；不得使用 `slice_id` 伪造工程基线身份。生成器必须读取合同和决策文件并校验状态、digest、版本、skill、工作模式与固定命令。三条 Wrapper 命令必须由受控工作单元真实执行，逐条留存 `exit_code`、`duration_ms`、stdout/stderr 引用和执行时间；生成器打印的下一步命令不构成证据。非空目标、`--force`、旧项目迁移和模板升级均阻断。脚手架不得生成业务规则、状态机、权限、事务、复杂查询、错误映射、用户可见行为或示例业务 API；`validate` 通过、输出目录存在或生成器成功都不是生命周期批准、架构放行或 `ready-for-agent`。
 
 脚手架完成后，所有后续生成的后端代码仍必须重新消费当前版本的批准 Slice Implementation Contract、YSS skill 依赖闭包、允许写路径、预期证据和 Execution Result。业务行为使用 `behavior-tdd`；只有机械结构、样板、配置和冻结客户端使用 `controlled-generation`。缺少合同、skill、证据或实际验证时立即阻断；生成范围从机械内容变成业务行为时触发完整重路由。
 
@@ -57,7 +59,7 @@ tracker 选择和冲突按 `docs/agents/issue-tracker.md` 裁决：已持久化
 - 原生 `work-unit.ticket-decomposition` 只能在 OpenAPI Freeze 或无 API 影响记录后创建垂直切片，初始 Ticket 状态统一为 `ready-for-human`；生命周期复算完整公式后才能提升 `ready-for-agent`。该工作单元必须返回 `ticket_decomposition_result_ref` 和垂直切片引用，并作为实现的必经前置证据。
 - 原生 `work-unit.slice-implementation` 必须在生命周期批准并持久化 Slice Implementation Contract 和 Build Architecture Checklist 后执行；用户显式 `implement` 仍走兼容入口，不得绕过生命周期。
 - `Workflow Execution Result.next_route` 必须通过生命周期转换校验；Spec、原型和技术分析不得直接跳转到 `work-unit.slice-implementation`，只能先进入 `work-unit.ticket-decomposition`。
-- `implement` 遇到 backend `scaffold_status=required` 时，还必须满足原型确认后的脚手架策略：脚手架 Execution Result、`yss-backend-scaffold-parent` 基线、Wrapper 验证和 Router 合同重编译均已回写；否则停在工程基线，不得写业务代码。
+- `implement` 遇到 backend `scaffold_status=required` 时，还必须满足原型确认后的脚手架策略：脚手架 Execution Result、`yss-backend-scaffold-parent` 基线、Wrapper 验证和 实现合同编译器 合同重编译均已回写；否则停在工程基线，不得写业务代码。
 - `Workflow Execution Result` 出现 `drift`、`new_impacts`、`stale_candidates`、`violation`、`missing_evidence`、空 `evidence_refs` 或缺少必需字段时暂停当前工作单元；旧结果只能先经只读兼容 adapter 归一化。
 
 ## 审查与验证
@@ -66,7 +68,7 @@ tracker 选择和冲突按 `docs/agents/issue-tracker.md` 裁决：已持久化
 - 小改动和中等变更可由同一独立执行者完成 `code-review` 与 fresh verification，并在同一报告中分别记录 findings、命令、结果和残余风险。
 - 该执行者必须独立于实现者；新模块、高风险变更、职责冲突或需双人控制时，Reviewer 与 Verifier 分开。
 - `code-review` 是唯一默认代码审查 skill。GitLab、CI、Sonar、Alibaba Java 与 YSS 前端 / 后端 skill 作为仓库规则或专项检查输入接入 Standards 轴，由 `review_standards_route` 按影响面编译；不再叠加第二个通用审查 skill。漏掉合同 `required_skills`、适用报告行空白、mandatory `violation` 未关闭或可机器检查规则既无工具结果也无原文引用时，不得 `completed`。
-- 产品切片与模板维护共用同一 finding 闭环，强度分别绑定 Slice 合同与 L1 / L2 / L3。`violation`、机器检查失败、适用行空白由实现者在原合同路径修复，再重新捕获候选并全轴复审。`drift`、`new_impacts`、`required_skills` 与真实影响不一致时合同 `stale`，回 Router 或更早阶段，禁止在旧合同上继续编码。审查者不得写实现。`not-applicable` 仅当影响面未命中；命中后 mandatory 不得豁免，只允许修复或完整 `seam-deferred`。禁止为日常 Alibaba / YSS 新增生物人豁免门禁。
+- 产品切片与模板维护共用同一 finding 闭环，强度分别绑定 Slice 合同与 L1 / L2 / L3。`violation`、机器检查失败、适用行空白由实现者在原合同路径修复，再重新捕获候选并全轴复审。`drift`、`new_impacts`、`required_skills` 与真实影响不一致时合同 `stale`，回 实现合同编译器 或更早阶段，禁止在旧合同上继续编码。审查者不得写实现。`not-applicable` 仅当影响面未命中；命中后 mandatory 不得豁免，只允许修复或完整 `seam-deferred`。禁止为日常 Alibaba / YSS 新增生物人豁免门禁。
 - 独立 Reviewer 必须与实现者不同实例，并在能执行已登记 `pnpm` / `./mvnw` 的运行时中审查。模板源 `.cursor/environment.json` 只服务模板校验，不替代实现仓审查运行时。不为此再创建第二个 Cloud 审查环境或 `/code-review` skill。
 - UI 影响切片将 `UI fidelity` 作为 `code-review` 的条件第三轴；任何修复都会使候选摘要失效，必须重新捕获候选并重跑 Standards、Spec、UI fidelity 和 fresh verification。
 
@@ -76,9 +78,13 @@ tracker 选择和冲突按 `docs/agents/issue-tracker.md` 裁决：已持久化
 
 `repository_scope: git-submodule` 时授权按仓分别计算：禁止在 detached HEAD 提交；commit / push 顺序必须先子仓、再父仓 gitlink（`superproject-gitlink-update`）；父仓 push 使用 `git push --recurse-submodules=check`。空 gitlink、detached HEAD、`--force` 覆盖挂载点不得当成普通目录脚手架，也不得把实现源码复制进 Harness。登记字段必须能与 `harness-apps` / `external-repository` 区分，并对照工作树 gitlink。
 
+## 用户决定与恢复
+
+关键决定使用 [真实用户回复协议](user-decisions.md)，消费角色注册表的 `user_decision_policy`。会签前先形成可审阅资产；恢复、阶段流转、实施派发和发布时校验原始回复及当前资产摘要。普通会签的数字人审查与用户决定分别保留，关键决定不得以数字人会签、无反对意见或超时放行。等待只阻断依赖事项；新的 `user_decisions` 引用通过 Workflow Execution Result、checkpoint 和任务包传递。
+
 ## 必须暂停
 
-- Spec baseline、需求冻结、原型确认、OpenAPI Freeze 或 Architecture Review 等普通门禁等待会签裁决（数字人或生物人，以 `docs/agents/digital-human-roles.yaml` 的 `gate_policy` 为准）。暂停输出必须包含：门禁 ID、指定 `role_id`、`runtime_id`、会签文件路径。恢复前执行 `scripts/verify-approval-record`；角色错误、起草者自签或生物人门禁被数字人关闭时返回 `blocked`，不得标 `approved`。
+- Spec baseline、需求冻结、原型确认、OpenAPI Freeze 或 Architecture Review 等普通门禁等待会签裁决（数字人或生物人，以 `docs/agents/digital-human-roles.yaml` 的 `gate_policy` 为准）。暂停输出必须包含：门禁 ID、指定 `role_id`、`runtime_id`、会签文件路径。恢复前执行 `scripts/verify-approval-record --require-approved`；角色错误、起草者自签或生物人门禁被数字人关闭时返回 `blocked`，不得标 `approved`。
 - 需要目标仓库、外部凭据、发布窗口或其他新授权。
 - 状态与证据冲突且无法可靠重建。
 - 专项 skill 失败或返回不可验收结果。
@@ -109,7 +115,7 @@ Decision ticket 产生决策，不是实现切片，不得标记 `ready-for-agen
 
 Prototype 回流必须有可核验证据：来源 handoff、prototype 资产或运行记录、结论、被更新的 Spec/设计/ADR/Ticket 引用、剩余未决项和返回 handoff。仅在对话中声称“已验证”不算回流完成。
 
-Matt `prototype` 的回流还必须注明 `prototype_branch`，并保留单文件 HTML 主来源；YSS 高保真 HTML 原型另走阶段 4 的评审、AntD CLI 校验和用户确认，不得用 throwaway prototype 替代。
+Matt `prototype` 的回流还必须注明 `prototype_branch`，并保留单文件 HTML 主来源；该结果只能作为 YSS 原型输入，仍须完成阶段 4 的低保真评审、H1/H2 档位路由、schema v3 验证和用户确认，不得用 throwaway prototype 替代。
 
 `to-questionnaire` 未收到答案时使用 `external-input-required` 暂停，记录问卷、接收人、所需输出和恢复路由；收到答案后记录 response、重新分类影响面和更新后的权威资产，再回到 `grill-with-docs` 或 `to-spec`。
 

package/template/.agents/skills/yss-product-lifecycle/references/state-model.md

@@ -11,7 +11,7 @@
 | `tracker.kind` | `local-markdown`、`github`、`gitlab` |
 | `ticket.role` | `needs-triage`、`needs-info`、`ready-for-agent`、`ready-for-human`、`wontfix` |
 
-Matt 五态不得扩义。资产的 `ready-for-human` 与 Ticket label 必须带命名空间表达。`paused-human-gate` 表示等待 `docs/agents/digital-human-roles.yaml` 指定的会签人（数字人或生物人），不是「必须是生物人」。
+Matt 五态不得扩义。资产的 `ready-for-human` 与 Ticket label 必须带命名空间表达。`paused-human-gate` 表示等待 `docs/agents/digital-human-roles.yaml` 指定的会签人（数字人或生物人），不是「必须是生物人」。但 `user_decision_policy` 命中的关键决定还必须有真实用户回复，数字人会签不能解除该等待。
 
 ## 上下文与外部输入证据
 
@@ -38,6 +38,7 @@ phase_boundary:
 
 ```text
 required gates ∈ {approved, not-applicable}
+AND 关键决定及当前切片实施范围已有可追溯、当前且未撤回的真实用户批准
 AND related artifacts 不含 stale（若命中领域影响，`artifact.tactical-design` 或嵌入式 Tactical DDD Check 引用必须为当前版本）
 AND blocking edges 全部关闭
 AND implementation repo/branch/CI/test/rollback 已明确
@@ -49,7 +50,7 @@ AND Slice Implementation Contract 已由生命周期编排器批准并持久化
 AND Slice Implementation Contract 的 `ticket_ref` 与 `vertical_slice_ticket_ref` 完全一致
 AND 当前工作单元消费的 contract_id/version 与最新批准版本一致
 AND Backend Slice Implementation Contract（后端适用）和 Build Architecture Checklist 已完成
-AND backend 影响且 scaffold_status=required 时，原型确认后的脚手架策略、`yss-backend-scaffold-parent` 基线、Wrapper 验证和 Router 重编译均已完成
+AND backend 影响且 scaffold_status=required 时，脚手架架构选择已由用户确认并达到 lifecycle-approved、schema v3 合同与 Manifest v3 当前、对应 DDD / Layered MVC 基线、Wrapper 验证和 实现合同编译器重编译均已完成
 AND 所有后续生成代码均绑定主 YSS skill、依赖闭包、允许写路径、预期证据和 YSS Skill Execution Result
 AND UI 影响切片的前端实现还原计划已通过 schema 校验、`template=false`、`status=approved`，且基线引用可读取
 ```
@@ -58,6 +59,8 @@ AND UI 影响切片的前端实现还原计划已通过 schema 校验、`templat
 
 发布前还必须满足所有已触发门禁均为 `approved` 或 `not-applicable`；UI 影响切片必须额外通过 `gate.frontend-implementation-verified`，不能只凭 fresh verification 和回滚点放行。
 
+任何 `project-instance` 工作单元进入下一步、任何阶段会签暂停或阶段完成 checkpoint，还必须引用当前工作单元的 `context_reconciliation`。其中 `status=reconciled`、`context_ref=CONTEXT.md`、`document_digest` 与 `referenced_terms_digest` 必须和根目录唯一 `CONTEXT.md` 一致；该证据不改变门禁数量。`template-source` 仅允许以带原因的 `not-applicable` 表示它只校验模板合同，不产生产品业务术语。
+
 用户显式运行 `to-tickets` 后，垂直切片初始 Ticket 状态固定为 `ready-for-human`。原生路径执行 `work-unit.ticket-decomposition` 时同样必须产生等价的垂直切片和 `Workflow Execution Result` 证据。只有 `yss-product-lifecycle` 复算上述公式全部为真后，才能把它提升为 `ready-for-agent`；生命周期不会自动调用 `to-tickets`，但不得跳过 Ticket 正式化工作单元。其默认标签也不参与该裁决。
 
 ## Review 与 Git 授权状态
@@ -110,3 +113,5 @@ pause:
 读取状态块后必须重新读取引用资产、审查记录、Ticket 最新事件和相关 Git 变化。时间戳只能提示变化，不能单独证明语义失效；应比较内容和影响面。冲突时以权威资产为准，记录修复原因，然后重算依赖、门禁和可执行 frontier。
 
 所有暂停/阻塞必须填写结构化 `pause`：`reason_code`、`gate_ref` 或证据引用、`owner_or_authority`、`resume_condition`、`next_work_unit`。`lifecycle.status` 保持粗粒度，恢复条件以 `pause` 为准。
+
+用户决定不新增状态；等待和恢复的引用字段、失效与复用规则见 [user-decisions.md](user-decisions.md)。