create-yss-spec 3.0.0 → 3.1.0

package/template/.hermes/skills/yss-ddd-scaffold-generator/scripts/run_scaffold_verification.mjs

@@ -1,112 +0,0 @@
-#!/usr/bin/env node
-/** 在生成项目根目录实际执行 YSS 脚手架的固定验证命令并留证。 */
-import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
-import path from "node:path";
-import process from "node:process";
-import { spawn } from "node:child_process";
-
-const PHASES = ["validate", "test", "package"];
-const COMMANDS = PHASES.map((phase) => `./mvnw ${phase}`);
-const isoNow = () => new Date().toISOString();
-async function isFile(target) { try { return (await stat(target)).isFile(); } catch (error) { if (error.code === "ENOENT") return false; throw error; } }
-async function writeText(target, content) { await mkdir(path.dirname(target), { recursive: true }); await writeFile(target, content, "utf8"); }
-async function isExecutable(target) {
-  try { const info = await stat(target); return info.isFile() && Boolean(info.mode & 0o111); }
-  catch (error) { if (error.code === "ENOENT") return false; throw error; }
-}
-async function readTextIfPresent(target) { try { return await readFile(target, "utf8"); } catch (error) { if (error.code === "ENOENT") return ""; throw error; } }
-function configured(value) { return typeof value === "string" && value.trim().length > 0; }
-function redactSecrets(text, environment = process.env) {
-  let output = text;
-  for (const name of ["MAVEN_REPO_USERNAME", "MAVEN_REPO_PASSWORD"]) {
-    const value = environment[name];
-    if (configured(value)) output = output.replaceAll(value, `[REDACTED:${name}]`);
-  }
-  return output;
-}
-function classifyFailure(phase, outcome) {
-  if (outcome.exitCode === 0) return null;
-  const output = `${outcome.stdout}\n${outcome.stderr}`.replaceAll(/\u001B\[[0-9;]*m/g, "");
-  if (/Non-resolvable parent POM|Could not transfer artifact|Could not resolve (?:dependencies|artifact)|status code: 401|\bUnauthorized\b|PKIX path building failed|Name or service not known|Unknown host/i.test(output)) return "repository-access";
-  if (/Unable to find main class|mainClass.*(?:not found|missing)/i.test(output)) return "bootstrap-entrypoint";
-  if (/COMPILATION ERROR|Compilation failure|maven-compiler-plugin/i.test(output)) return "compilation";
-  if (phase === "validate") return "project-model";
-  if (phase === "test") return "test-failure";
-  if (phase === "package") return "packaging";
-  return "maven-execution";
-}
-function parseArgs(argv) { const result = {}; for (let index = 0; index < argv.length; index += 1) { let token = argv[index]; if (token === "--help" || token === "-h") { result.help = true; continue; } const equals = token.indexOf("="); let value; if (equals !== -1) { value = token.slice(equals + 1); token = token.slice(0, equals); } if (!["--project-root", "--evidence-dir"].includes(token)) throw new Error(`不支持的参数: ${token}`); if (value === undefined) value = argv[++index]; if (!value || value.startsWith("--")) throw new Error(`参数 ${token} 缺少值`); result[token === "--project-root" ? "projectRoot" : "evidenceDir"] = path.resolve(value); } if (result.help) return result; if (!result.projectRoot || !result.evidenceDir) throw new Error("必须提供 --project-root 和 --evidence-dir"); return result; }
-function validateManifest(manifest) {
-  if (manifest.schema_version !== 2) throw new Error(`unsupported: scaffold Manifest schema_version=${manifest.schema_version}；只验证 Target Profile v2`);
-  const required = ["schema_version", "contract_id", "contract_version", "scaffold_request_id", "contract_digest", "profiles", "ownership", "readiness", "generation_policy", "completion_level", "approval_ref", "approver", "lifecycle_approval_ref", "router_draft_ref", "persisted_ref", "contract_file_ref", "current_version", "allowed_write_paths", "expected_evidence_files", "verification_commands", "generation_mode"];
-  const missing = required.filter((field) => manifest[field] === undefined || manifest[field] === null || manifest[field] === "");
-  if (manifest.generation_mode !== "controlled-generation" || missing.length) throw new Error(`脚手架生成元数据清单不完整或不是 controlled-generation: ${missing.join(", ")}`);
-  if (manifest.profiles.architecture !== "target-domain-model" || manifest.generation_policy.mode !== "initialize-only" || manifest.generation_policy.existing_target !== "unsupported" || manifest.generation_policy.old_project_migration !== "unsupported" || manifest.generation_policy.template_upgrade !== "unsupported") throw new Error("Manifest v2 必须声明 Target Profile 与严格 initialize-only；已有目标、旧项目迁移和模板升级均须为 unsupported");
-  if (manifest.current_version !== manifest.contract_version) throw new Error("脚手架生成元数据清单不是当前合同版本");
-  if (JSON.stringify(manifest.verification_commands) !== JSON.stringify(COMMANDS)) throw new Error("脚手架生成元数据清单验证命令不符合固定合同");
-}
-function execute(wrapper, phase, cwd, environment) { return new Promise((resolve) => { const child = spawn(wrapper, [phase], { cwd, env: environment, stdio: ["ignore", "pipe", "pipe"] }); let stdout = "", stderr = ""; child.stdout.on("data", (chunk) => { stdout += chunk; }); child.stderr.on("data", (chunk) => { stderr += chunk; }); child.on("error", (error) => resolve({ exitCode: 127, stdout: "", stderr: String(error) })); child.on("close", (code) => resolve({ exitCode: code ?? 1, stdout, stderr })); }); }
-export async function run(projectRoot, evidenceDir, environment = process.env) {
-  const wrapper = path.join(projectRoot, "mvnw"), manifestPath = path.join(projectRoot, ".yss", "scaffold-generation.json");
-  if (!await isFile(wrapper)) throw new Error(`项目根目录缺少 Maven wrapper: ${wrapper}`);
-  if (!await isFile(manifestPath)) throw new Error(`项目根目录缺少脚手架生成元数据清单: ${manifestPath}`);
-  let manifest; try { manifest = JSON.parse(await readFile(manifestPath, "utf8")); } catch { throw new Error(`脚手架生成元数据清单无法读取或不是合法 JSON: ${manifestPath}`); }
-  validateManifest(manifest);
-  await mkdir(evidenceDir, { recursive: true });
-  const mavenConfig = await readTextIfPresent(path.join(projectRoot, ".mvn", "maven.config"));
-  const preflight = {
-    wrapper_exists: true,
-    wrapper_executable: await isExecutable(wrapper),
-    java_home_configured: configured(environment.JAVA_HOME),
-    maven_repository_credentials_configured: configured(environment.MAVEN_REPO_USERNAME) && configured(environment.MAVEN_REPO_PASSWORD),
-    maven_repository_url_configured: configured(environment.YSS_MAVEN_REPOSITORY_URL),
-    project_settings_present: await isFile(path.join(projectRoot, ".mvn", "settings.xml")),
-    project_maven_config_present: await isFile(path.join(projectRoot, ".mvn", "maven.config")),
-    project_settings_wired: /(?:^|\s)-(?:s|-settings)\s+\.mvn\/settings\.xml(?:\s|$)/m.test(mavenConfig),
-    repository_profile: manifest.profiles.repository,
-    repository_profile_wired: /(?:^|\s)-(?:P|-activate-profiles)\s+yss-internal(?:\s|$)/m.test(mavenConfig),
-    maven_coordinates_source: manifest.maven_coordinates_source
-  };
-  const failed = [];
-  if (!preflight.wrapper_executable) failed.push("wrapper-not-executable");
-  if (!preflight.project_settings_present || !preflight.project_maven_config_present || !preflight.project_settings_wired || !preflight.repository_profile_wired) failed.push("repository-profile-not-wired");
-  if (!preflight.maven_repository_url_configured) failed.push("repository-url-not-configured");
-  if (!preflight.maven_repository_credentials_configured) failed.push("repository-credentials-not-configured");
-  if (failed.length) return { verification_mode: "controlled-generation", project_root: projectRoot, scaffold_manifest_ref: manifestPath, generated_at: isoNow(), status: "failed", failure_category: "verification-preflight", completion_level: "generated", preflight: { ...preflight, failures: failed }, commands: [] };
-  const commands = [];
-  for (const phase of PHASES) {
-    const stdoutPath = path.join(evidenceDir, `mvnw-${phase}.stdout.log`);
-    const stderrPath = path.join(evidenceDir, `mvnw-${phase}.stderr.log`);
-    const startedAt = isoNow();
-    const started = process.hrtime.bigint();
-    const outcome = await execute(wrapper, phase, projectRoot, environment);
-    const durationMs = Number(process.hrtime.bigint() - started) / 1e6;
-    await writeText(stdoutPath, redactSecrets(outcome.stdout, environment));
-    await writeText(stderrPath, redactSecrets(outcome.stderr, environment));
-    commands.push({
-      command: `./mvnw ${phase}`,
-      phase,
-      exit_code: outcome.exitCode,
-      failure_category: classifyFailure(phase, outcome),
-      duration_ms: Number(durationMs.toFixed(3)),
-      started_at: startedAt,
-      executed_at: isoNow(),
-      stdout_ref: stdoutPath,
-      stderr_ref: stderrPath
-    });
-  }
-  const failureCategory = commands.find((item) => item.failure_category)?.failure_category ?? null;
-  return {
-    verification_mode: "controlled-generation",
-    project_root: projectRoot,
-    scaffold_manifest_ref: manifestPath,
-    generated_at: isoNow(),
-    status: failureCategory === null ? "passed" : "failed",
-    failure_category: failureCategory,
-    completion_level: failureCategory === null ? "empty-scaffold-verified" : "generated",
-    preflight,
-    commands
-  };
-}
-async function main() { let args; try { args = parseArgs(process.argv.slice(2)); if (args.help) { console.log("运行 YSS 脚手架真实验证命令\n用法: node scripts/run_scaffold_verification.mjs --project-root <dir> --evidence-dir <dir>"); return 0; } const reportPath = path.join(args.evidenceDir, "scaffold-verification.json"); try { const report = await run(args.projectRoot, args.evidenceDir); await writeText(reportPath, `${JSON.stringify(report, null, 2)}\n`); console.log(`${report.status}: ${reportPath}`); return report.status === "passed" ? 0 : 1; } catch (error) { const report = { verification_mode: "controlled-generation", project_root: args.projectRoot, generated_at: isoNow(), status: "failed", failure_category: "verification-preflight", error: error.message, commands: [] }; await writeText(reportPath, `${JSON.stringify(report, null, 2)}\n`); process.stderr.write(`❌ 脚手架验证无法执行: ${error.message}\n`); return 1; } } catch (error) { process.stderr.write(`❌ 脚手架验证无法执行: ${error.message}\n`); return 1; } }
-if (process.argv[1] && import.meta.url === new URL(`file://${process.argv[1]}`).href) process.exitCode = await main();

package/template/.hermes/skills/yss-ddd-scaffold-generator/scripts/scaffold-generator.test.mjs

@@ -1,401 +0,0 @@
-import assert from "node:assert/strict";
-import { execFile } from "node:child_process";
-import { createHash } from "node:crypto";
-import { chmod, mkdtemp, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
-import { existsSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { fileURLToPath } from "node:url";
-import { run } from "./run_scaffold_verification.mjs";
-import { makeGitlinkFixture } from "../../../../scripts/lib/git-submodule-fixtures.mjs";
-import { GITLINK_MODE, gitLsFilesStage } from "../../../../scripts/lib/repository-scope-policy.mjs";
-
-const scripts = path.dirname(fileURLToPath(import.meta.url));
-const generator = path.join(scripts, "generate_scaffold.mjs");
-const workflow = path.join(scripts, "generate_and_verify_scaffold.mjs");
-const command = (args, options = {}) => new Promise((resolve) => execFile(process.execPath, [generator, ...args], { encoding: "utf8", ...options }, (error, stdout, stderr) => resolve({ code: error?.code ?? 0, stdout, stderr })));
-const workflowCommand = (args, options = {}) => new Promise((resolve) => execFile(process.execPath, [workflow, ...args], { encoding: "utf8", ...options }, (error, stdout, stderr) => resolve({ code: error?.code ?? 0, stdout, stderr })));
-async function treeDigest(root) {
-  const hash = createHash("sha256");
-  async function visit(directory) {
-    for (const entry of (await readdir(directory, { withFileTypes: true })).sort((left, right) => left.name.localeCompare(right.name))) {
-      const absolute = path.join(directory, entry.name);
-      if (entry.isDirectory()) await visit(absolute);
-      else if (entry.isFile()) hash.update(path.relative(root, absolute).split(path.sep).join("/")).update("\0").update(await readFile(absolute)).update("\0");
-    }
-  }
-  await visit(root);
-  return hash.digest("hex");
-}
-function contract(outputDir, overrides = {}) {
-  return {
-    schema_version: 2,
-    contract_id: "scaffold-1",
-    contract_version: 1,
-    scaffold_request_id: "scaffold-request-1",
-    status: "approved",
-    router_draft_ref: "router-1",
-    lifecycle_approval_ref: "approval-1",
-    persisted_ref: "persisted-1",
-    current_version: 1,
-    implementation_repository: "external",
-    backend_repository: "external",
-    scaffold_status: "required",
-    project_name: "demo-service",
-    target_output_dir: outputDir,
-    base_package: "com.yss.demo",
-    maven_coordinates: {
-      group_id: "com.yss.datamiddle",
-      project_version: "1.0.0-SNAPSHOT",
-      parent: { group_id: "com.yss.datamiddle", artifact_id: "yss-datamiddle-parent", version: "2.0.0-SNAPSHOT" },
-      yss_components_version: "2.0.0-SNAPSHOT"
-    },
-    profiles: {
-      architecture: "target-domain-model",
-      persistence: "mybatis-plus",
-      database: "mysql",
-      platform: "spring-boot-2.7-jdk8",
-      validation_namespace: "javax",
-      dto_placement: "web",
-      repository: "yss-internal"
-    },
-    allowed_write_paths: ["."],
-    expected_evidence_files: [".yss/scaffold-generation.json"],
-    verification_commands: ["./mvnw validate", "./mvnw test", "./mvnw package"],
-    approval: { approval_ref: "approval-1", approver: "reviewer", persisted_ref: "persisted-1", current_version: 1 },
-    work_unit: { id: "unit-1", behavior: "scaffold", primary_skill: "yss-ddd-scaffold-generator", supporting_skills: ["yss-router"], tdd_mode: "controlled-generation", allowed_write_paths: ["."], expected_evidence: ["manifest"], verification_commands: ["./mvnw validate", "./mvnw test", "./mvnw package"], controlled_generation: true },
-    generation_policy: { mode: "initialize-only", existing_target: "unsupported", old_project_migration: "unsupported", template_upgrade: "unsupported" },
-    ...overrides
-  };
-}
-async function fixture(contractOverrides = {}) { const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-node-")); const output = path.join(root, "implementation"); await mkdir(output); const contractFile = path.join(root, "contract.json"); await writeFile(contractFile, `${JSON.stringify(contract(output, contractOverrides), null, 2)}\n`); return { root, output, contractFile, args: ["--project-name", "demo-service", "--base-package", "com.yss.demo", "--output-dir", output, "--database", "mysql", "--contract-id", "scaffold-1", "--contract-version", "1", "--approval-ref", "approval-1", "--router-draft-ref", "router-1", "--persisted-ref", "persisted-1", "--contract-file", contractFile, "--group-id", "com.yss.datamiddle", "--project-version", "1.0.0-SNAPSHOT", "--parent-group-id", "com.yss.datamiddle", "--parent-artifact-id", "yss-datamiddle-parent", "--parent-version", "2.0.0-SNAPSHOT", "--yss-components-version", "2.0.0-SNAPSHOT"] }; }
-
-const controlledEnvironment = {
-  ...process.env,
-  YSS_MAVEN_REPOSITORY_URL: "https://repo.example.invalid/repository/maven-public/",
-  MAVEN_REPO_USERNAME: "test-user",
-  MAVEN_REPO_PASSWORD: "test-password"
-};
-function targetManifest(overrides = {}) {
-  return {
-    schema_version: 2,
-    contract_id: "id",
-    contract_version: 1,
-    scaffold_request_id: "request",
-    contract_digest: "a".repeat(64),
-    approval_ref: "approval",
-    approver: "reviewer",
-    lifecycle_approval_ref: "approval",
-    router_draft_ref: "router",
-    persisted_ref: "persisted",
-    contract_file_ref: "contract",
-    current_version: 1,
-    allowed_write_paths: ["."],
-    expected_evidence_files: ["manifest"],
-    verification_commands: ["./mvnw validate", "./mvnw test", "./mvnw package"],
-    generation_mode: "controlled-generation",
-    completion_level: "generated",
-    profiles: { architecture: "target-domain-model", repository: "yss-internal" },
-    ownership: { generated_files: [] },
-    readiness: { downstream_skills: {}, architecture_ruleset: "b".repeat(64) },
-    generation_policy: { mode: "initialize-only", existing_target: "unsupported", old_project_migration: "unsupported", template_upgrade: "unsupported" },
-    maven_coordinates_source: "approved-contract",
-    ...overrides
-  };
-}
-async function prepareVerifierProject(project, manifest = targetManifest()) {
-  await mkdir(path.join(project, ".yss"), { recursive: true });
-  await mkdir(path.join(project, ".mvn"), { recursive: true });
-  await writeFile(path.join(project, ".mvn", "maven.config"), "-s .mvn/settings.xml\n-P yss-internal\n");
-  await writeFile(path.join(project, ".mvn", "settings.xml"), "<settings/>\n");
-  await writeFile(path.join(project, ".yss", "scaffold-generation.json"), `${JSON.stringify(manifest)}\n`);
-}
-
-test("生成批准的服务级 target profile 骨架，并写入可追溯 Manifest v2", async (t) => { const data = await fixture(); t.after(() => rm(data.root, { recursive: true, force: true })); const result = await command(data.args); assert.equal(result.code, 0, result.stderr); const project = path.join(data.output, "demo-service"); const manifest = JSON.parse(await readFile(path.join(project, ".yss/scaffold-generation.json"), "utf8")); assert.equal(manifest.schema_version, 2); assert.equal(manifest.scaffold_request_id, "scaffold-request-1"); assert.equal(manifest.slice_id, undefined); assert.equal(manifest.completion_level, "generated"); assert.equal(manifest.profiles.architecture, "target-domain-model"); assert.deepEqual(manifest.generation_policy, { mode: "initialize-only", existing_target: "unsupported", old_project_migration: "unsupported", template_upgrade: "unsupported" }); assert.match(manifest.generator.template_digest, /^[a-f0-9]{64}$/); assert.match(manifest.contract_digest, /^[a-f0-9]{64}$/); assert.ok(manifest.ownership.generated_files.length > 8); assert.ok(manifest.ownership.generated_files.every((item) => item.owner === "generator" && /^[a-f0-9]{64}$/.test(item.sha256))); assert.equal(manifest.generation_mode, "controlled-generation"); assert.deepEqual(manifest.verification_commands, ["./mvnw validate", "./mvnw test", "./mvnw package"]); assert.equal(manifest.bootstrap_main_class, "com.yss.demo.DemoServiceApplication"); assert.equal(manifest.bootstrap_main_source, "demo-service-bootstrap/src/main/java/com/yss/demo/DemoServiceApplication.java"); assert.match(await readFile(path.join(project, manifest.bootstrap_main_source), "utf8"), /class DemoServiceApplication/); assert.match(await readFile(path.join(project, "pom.xml"), "utf8"), /demo-service/); assert.equal(manifest.readiness.downstream_skills["yss-domain"], await treeDigest(path.resolve(scripts, "../../yss-domain"))); assert.match(manifest.readiness.contracts.scaffold_parent, /^[a-f0-9]{64}$/); assert.match(manifest.readiness.contracts.router_contract, /^[a-f0-9]{64}$/); });
-
-test("schema v1 scaffold contract is unsupported and is never upgraded", async (t) => {
-  const data = await fixture({ schema_version: 1 });
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  const result = await command(data.args);
-  assert.equal(result.code, 1);
-  assert.match(result.stderr, /unsupported: scaffold contract schema_version=1/);
-  assert.equal(existsSync(path.join(data.output, "demo-service")), false);
-});
-
-test("一键工作流只有在真实 Maven 三命令全部通过后才报告完成", { timeout: 300_000 }, async (t) => {
-  if (!["YSS_MAVEN_REPOSITORY_URL", "MAVEN_REPO_USERNAME", "MAVEN_REPO_PASSWORD"].every((name) => process.env[name])) {
-    t.skip("缺少受控 YSS Maven 仓库环境，真实 Wrapper 验证由 L3 环境门禁执行");
-    return;
-  }
-  const data = await fixture();
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  const evidence = path.join(data.root, "workflow-evidence");
-  const result = await workflowCommand([...data.args, "--evidence-dir", evidence]);
-  assert.equal(result.code, 0, result.stderr);
-  assert.match(result.stdout, /脚手架生成与验证完成/);
-  const verification = JSON.parse(await readFile(path.join(evidence, "scaffold-verification.json"), "utf8"));
-  const workflowReport = JSON.parse(await readFile(path.join(evidence, "scaffold-workflow.json"), "utf8"));
-  assert.equal(verification.status, "passed");
-  assert.deepEqual(verification.commands.map((item) => item.command), ["./mvnw validate", "./mvnw test", "./mvnw package"]);
-  assert.ok(verification.commands.every((item) => item.exit_code === 0));
-  assert.equal(verification.preflight.project_settings_wired, true);
-  assert.equal(verification.preflight.repository_profile_wired, true);
-  assert.equal(workflowReport.status, "completed");
-  assert.equal(workflowReport.verification_ref, path.join(evidence, "scaffold-verification.json"));
-  const manifest = JSON.parse(await readFile(path.join(data.output, "demo-service", ".yss", "scaffold-generation.json"), "utf8"));
-  assert.equal(manifest.completion_level, "empty-scaffold-verified");
-});
-
-test("显式 Maven 坐标贯穿批准合同、生成参数、全部 POM 和生成清单", async (t) => {
-  const mavenCoordinates = {
-    group_id: "com.example.metadata",
-    project_version: "1.2.3-SNAPSHOT",
-    parent: {
-      group_id: "com.yss.datamiddle",
-      artifact_id: "yss-datamiddle-parent",
-      version: "2.0.0-SNAPSHOT"
-    },
-    yss_components_version: "2.0.0-SNAPSHOT"
-  };
-  const data = await fixture({ maven_coordinates: mavenCoordinates });
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  const result = await command([
-    ...data.args,
-    "--group-id", mavenCoordinates.group_id,
-    "--project-version", mavenCoordinates.project_version,
-    "--parent-group-id", mavenCoordinates.parent.group_id,
-    "--parent-artifact-id", mavenCoordinates.parent.artifact_id,
-    "--parent-version", mavenCoordinates.parent.version,
-    "--yss-components-version", mavenCoordinates.yss_components_version
-  ]);
-  assert.equal(result.code, 0, result.stderr);
-
-  const project = path.join(data.output, "demo-service");
-  const pomFiles = [
-    "pom.xml",
-    "demo-service-domain/pom.xml",
-    "demo-service-application/pom.xml",
-    "demo-service-infrastructure/pom.xml",
-    "demo-service-adapter/pom.xml",
-    "demo-service-adapter/demo-service-web/pom.xml",
-    "demo-service-bootstrap/pom.xml"
-  ];
-  const poms = await Promise.all(pomFiles.map((file) => readFile(path.join(project, file), "utf8")));
-  assert.ok(poms.every((pom) => pom.includes(mavenCoordinates.group_id)), "全部项目内坐标必须使用合同 groupId");
-  assert.ok(poms.every((pom) => pom.includes(mavenCoordinates.project_version)), "全部项目内坐标必须使用合同版本");
-  const manifest = JSON.parse(await readFile(path.join(project, ".yss/scaffold-generation.json"), "utf8"));
-  assert.deepEqual(manifest.maven_coordinates, mavenCoordinates);
-  assert.equal(manifest.maven_coordinates_source, "approved-contract");
-
-});
-
-test("生成工程声明命名仓库 profile、target DDD 依赖边界和构建门禁", async (t) => {
-  const data = await fixture();
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  const result = await command(data.args);
-  assert.equal(result.code, 0, result.stderr);
-  const project = path.join(data.output, "demo-service");
-  const mavenConfig = await readFile(path.join(project, ".mvn/maven.config"), "utf8");
-  const settings = await readFile(path.join(project, ".mvn/settings.xml"), "utf8");
-  assert.match(mavenConfig, /-s \.mvn\/settings\.xml/);
-  assert.match(mavenConfig, /-P yss-internal/);
-  assert.doesNotMatch(settings, /192\.168\.|<activeProfile>aliyun-only<\/activeProfile>/);
-  assert.match(settings, /\$\{env\.YSS_MAVEN_REPOSITORY_URL\}/);
-  assert.match(settings, /\$\{env\.MAVEN_REPO_USERNAME\}/);
-  assert.match(settings, /\$\{env\.MAVEN_REPO_PASSWORD\}/);
-
-  const domainPom = await readFile(path.join(project, "demo-service-domain/pom.xml"), "utf8");
-  const infrastructurePom = await readFile(path.join(project, "demo-service-infrastructure/pom.xml"), "utf8");
-  const bootstrapPom = await readFile(path.join(project, "demo-service-bootstrap/pom.xml"), "utf8");
-  assert.doesNotMatch(domainPom, /yss-component-(?:dto|exception)|jackson-databind|swagger-annotations|validation-api/);
-  assert.match(infrastructurePom, /yss-component-mybatis-plus-starter/);
-  assert.match(infrastructurePom, /spring-boot-starter-jdbc/);
-  assert.match(bootstrapPom, /spring-boot-starter-actuator/);
-  assert.match(bootstrapPom, /spring-boot-starter-test/);
-  const webPom = await readFile(path.join(project, "demo-service-adapter", "demo-service-web", "pom.xml"), "utf8");
-  assert.match(webPom, /yss-component-dto/);
-  assert.match(webPom, /yss-component-exception/);
-  assert.match(webPom, /io\.swagger\.core\.v3/);
-  const parentPom = await readFile(path.join(project, "pom.xml"), "utf8");
-  assert.match(parentPom, /lombok-mapstruct-binding/);
-  assert.match(parentPom, /maven-enforcer-plugin/);
-  assert.match(parentPom, /maven-compiler-plugin/);
-  assert.match(parentPom, /archunit-junit5/);
-});
-
-test("生成工程固定平台 profile、Wrapper checksum，并把调试日志隔离到 local 配置", async (t) => {
-  const data = await fixture();
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  const result = await command(data.args);
-  assert.equal(result.code, 0, result.stderr);
-  const project = path.join(data.output, "demo-service");
-  const wrapper = await readFile(path.join(project, ".mvn", "wrapper", "maven-wrapper.properties"), "utf8");
-  assert.match(wrapper, /^wrapperSha256Sum=[a-f0-9]{64}$/m);
-  assert.match(wrapper, /^distributionSha256Sum=[a-f0-9]{64}$/m);
-  const application = await readFile(path.join(project, "demo-service-bootstrap", "src", "main", "resources", "application.yml"), "utf8");
-  assert.doesNotMatch(application, /StdOutImpl|DEBUG/);
-  const local = await readFile(path.join(project, "demo-service-bootstrap", "src", "main", "resources", "application-local.yml"), "utf8");
-  assert.match(local, /StdOutImpl/);
-  assert.match(local, /DEBUG/);
-});
-
-test("initialize-only 在写文件前拒绝任何已存在目标和 --force", async (t) => { const data = await fixture(); t.after(() => rm(data.root, { recursive: true, force: true })); const rejected = await command(data.args.map((value) => value === data.contractFile ? path.join(data.root, "missing.json") : value)); assert.equal(rejected.code, 1); assert.match(rejected.stderr, /合同/); await mkdir(path.join(data.output, "demo-service")); await writeFile(path.join(data.output, "demo-service", "keep.txt"), "keep"); const noForce = await command(data.args); assert.equal(noForce.code, 1); assert.match(noForce.stderr, /initialize-only/); const forced = await command([...data.args, "--force"]); assert.equal(forced.code, 1); assert.match(forced.stderr, /initialize-only/); assert.equal(await readFile(path.join(data.output, "demo-service", "keep.txt"), "utf8"), "keep"); });
-
-test("拒绝基础包名与批准合同不一致", async (t) => {
-  const data = await fixture({ base_package: "com.example.approved" });
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  const result = await command(data.args);
-  assert.equal(result.code, 1);
-  assert.match(result.stderr, /--base-package 与脚手架合同不一致/);
-});
-
-test("合同 project_name、profile 和 allowed_write_paths 必须约束实际输出", async (t) => {
-  const wrongName = await fixture({ project_name: "other-service" });
-  t.after(() => rm(wrongName.root, { recursive: true, force: true }));
-  const nameResult = await command(wrongName.args);
-  assert.equal(nameResult.code, 1);
-  assert.match(nameResult.stderr, /--project-name 与脚手架合同不一致/);
-
-  const wrongProfile = await fixture({ profiles: { ...contract("unused").profiles, persistence: "mybatis" } });
-  t.after(() => rm(wrongProfile.root, { recursive: true, force: true }));
-  const profileResult = await command(wrongProfile.args);
-  assert.equal(profileResult.code, 1);
-  assert.match(profileResult.stderr, /unsupported persistence profile/);
-
-  const wrongPath = await fixture({ allowed_write_paths: ["another-service"], work_unit: { ...contract("unused").work_unit, allowed_write_paths: ["another-service"] } });
-  t.after(() => rm(wrongPath.root, { recursive: true, force: true }));
-  const pathResult = await command(wrongPath.args);
-  assert.equal(pathResult.code, 1);
-  assert.match(pathResult.stderr, /allowed_write_paths/);
-});
-
-test("initialize-only 拒绝以 --force 覆盖 .gitmodules 登记的挂载点", async (t) => {
-  const data = await fixture();
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  const superproject = path.join(data.root, "harness");
-  const output = path.join(superproject, "apps/backend");
-  await mkdir(path.join(output, "demo-service"), { recursive: true });
-  await writeFile(path.join(superproject, ".gitmodules"), "[submodule \"demo-service\"]\n\tpath = apps/backend/demo-service\n\turl = https://example.invalid/demo-service.git\n");
-  const contractFile = path.join(data.root, "gitlink-contract.json");
-  await writeFile(contractFile, `${JSON.stringify(contract(output), null, 2)}\n`);
-  const result = await command(["--project-name", "demo-service", "--base-package", "com.yss.demo", "--output-dir", output, "--database", "mysql", "--contract-id", "scaffold-1", "--contract-version", "1", "--approval-ref", "approval-1", "--router-draft-ref", "router-1", "--persisted-ref", "persisted-1", "--contract-file", contractFile, "--force"]);
-  assert.equal(result.code, 1, result.stderr);
-  assert.match(`${result.stdout}\n${result.stderr}`, /initialize-only|gitlink 不得由脚手架覆盖/);
-});
-
-test("拒绝在 detached HEAD 子仓工作树内当成普通目录生成", async (t) => {
-  const data = await fixture();
-  const detached = makeGitlinkFixture({ checkout: "detached-head" });
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  t.after(() => detached.cleanup());
-  const output = path.join(detached.superproject, detached.mount);
-  const contractFile = path.join(data.root, "detached-contract.json");
-  await writeFile(contractFile, `${JSON.stringify(contract(output), null, 2)}\n`);
-  const result = await command(["--project-name", "nested-service", "--base-package", "com.yss.demo", "--output-dir", output, "--database", "mysql", "--contract-id", "scaffold-1", "--contract-version", "1", "--approval-ref", "approval-1", "--router-draft-ref", "router-1", "--persisted-ref", "persisted-1", "--contract-file", contractFile]);
-  const text = `${result.stdout}\n${result.stderr}`;
-  assert.equal(result.code, 1, text);
-  assert.doesNotMatch(text, /请显式传入 --force/);
-  assert.match(text, /detached HEAD 不得当成普通目录写入/);
-  assert.equal(existsSync(path.join(output, "nested-service", "pom.xml")), false);
-  assert.equal((await readdir(output)).some((name) => name.includes("staging") || name === "nested-service"), false);
-});
-
-test("--force 覆盖真实 gitlink 不得走普通目录覆盖路径", async (t) => {
-  const data = await fixture();
-  const empty = makeGitlinkFixture({ checkout: "empty-gitlink" });
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  t.after(() => empty.cleanup());
-  const output = path.join(empty.superproject, "apps/backend");
-  const contractFile = path.join(data.root, "empty-gitlink-contract.json");
-  await writeFile(contractFile, `${JSON.stringify(contract(output), null, 2)}\n`);
-  const result = await command(["--project-name", "billing-service", "--base-package", "com.yss.demo", "--output-dir", output, "--database", "mysql", "--contract-id", "scaffold-1", "--contract-version", "1", "--approval-ref", "approval-1", "--router-draft-ref", "router-1", "--persisted-ref", "persisted-1", "--contract-file", contractFile, "--force"]);
-  const text = `${result.stdout}\n${result.stderr}`;
-  assert.equal(result.code, 1, text);
-  assert.doesNotMatch(text, /请显式传入 --force/);
-  assert.match(text, /initialize-only|--force 不得把 git-submodule 挂载点当成普通目录覆盖|gitlink 不得/);
-  assert.equal(existsSync(path.join(output, "billing-service", "pom.xml")), false);
-  assert.equal((await readdir(output)).some((name) => name.includes("backup")), false);
-  assert.equal(gitLsFilesStage(empty.superproject, empty.mount)?.mode, GITLINK_MODE);
-});
-
-test("验证器记录三条 wrapper 命令的成功和失败证据", async (t) => { const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-verifier-")); t.after(() => rm(root, { recursive: true, force: true })); const project = path.join(root, "project"); await prepareVerifierProject(project); const wrapper = path.join(project, "mvnw"); await writeFile(wrapper, "#!/bin/sh\n[ \"$1\" = test ] && exit 2\nprintf 'ran %s\\n' \"$1\"\n"); await chmod(wrapper, 0o755); const evidence = path.join(root, "evidence"); const report = await run(project, evidence, controlledEnvironment); assert.equal(report.status, "failed"); assert.equal(report.failure_category, "test-failure"); assert.equal(report.commands[1].failure_category, "test-failure"); assert.equal(report.preflight.wrapper_executable, true); assert.deepEqual(report.commands.map((item) => item.exit_code), [0, 2, 0]); assert.match(await readFile(path.join(evidence, "mvnw-test.stderr.log"), "utf8"), /^$/); });
-
-test("验证器把内部仓库解析失败与编译失败分开报告", async (t) => {
-  const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-repository-failure-"));
-  t.after(() => rm(root, { recursive: true, force: true }));
-  const project = path.join(root, "project");
-  await prepareVerifierProject(project);
-  const wrapper = path.join(project, "mvnw");
-  await writeFile(wrapper, "#!/bin/sh\nprintf 'Non-resolvable parent POM: Could not transfer artifact\\n'\nexit 1\n");
-  await chmod(wrapper, 0o755);
-  const report = await run(project, path.join(root, "evidence"), controlledEnvironment);
-  assert.equal(report.status, "failed");
-  assert.equal(report.failure_category, "repository-access");
-  assert.ok(report.commands.every((item) => item.failure_category === "repository-access"));
-  assert.equal(typeof report.preflight.maven_repository_credentials_configured, "boolean");
-});
-
-test("验证器单独标记 Java 编译失败和 Bootstrap 主类缺失", async (t) => {
-  const cases = [
-    { output: "[ERROR] COMPILATION ERROR", expected: "compilation" },
-    { output: "Unable to find main class", expected: "bootstrap-entrypoint" }
-  ];
-  for (const item of cases) {
-    const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-build-failure-"));
-    t.after(() => rm(root, { recursive: true, force: true }));
-    const project = path.join(root, "project");
-    await prepareVerifierProject(project);
-    const wrapper = path.join(project, "mvnw");
-    await writeFile(wrapper, `#!/bin/sh\n[ "$1" = package ] || exit 0\nprintf '%s\\n' '${item.output}' >&2\nexit 1\n`);
-    await chmod(wrapper, 0o755);
-    const report = await run(project, path.join(root, "evidence"), controlledEnvironment);
-    assert.equal(report.failure_category, item.expected);
-    assert.equal(report.commands[2].failure_category, item.expected);
-  }
-});
-
-test("验证器在全部 Maven 命令成功时通过并保留日志引用", async (t) => { const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-verifier-success-")); t.after(() => rm(root, { recursive: true, force: true })); const project = path.join(root, "project"); await prepareVerifierProject(project); const wrapper = path.join(project, "mvnw"); await writeFile(wrapper, "#!/bin/sh\nprintf 'ran %s\\n' \"$1\"\n"); await chmod(wrapper, 0o755); const report = await run(project, path.join(root, "evidence"), controlledEnvironment); assert.equal(report.status, "passed"); assert.ok(report.commands.every((item) => item.exit_code === 0 && item.stdout_ref.endsWith(".stdout.log"))); });
-
-test("Manifest v2 在缺少受控仓库环境时先于 Maven 执行阻断", async (t) => {
-  const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-v2-preflight-"));
-  t.after(() => rm(root, { recursive: true, force: true }));
-  const project = path.join(root, "project");
-  await prepareVerifierProject(project);
-  const wrapper = path.join(project, "mvnw");
-  await writeFile(wrapper, "#!/bin/sh\nprintf 'must not run'\nexit 99\n");
-  await chmod(wrapper, 0o755);
-  const report = await run(project, path.join(root, "evidence"), { ...process.env, YSS_MAVEN_REPOSITORY_URL: "", MAVEN_REPO_USERNAME: "", MAVEN_REPO_PASSWORD: "" });
-  assert.equal(report.status, "failed");
-  assert.equal(report.failure_category, "verification-preflight");
-  assert.deepEqual(report.commands, []);
-  assert.ok(report.preflight.failures.includes("repository-url-not-configured"));
-});
-
-test("Manifest schema v1 is unsupported and verifier never executes its wrapper", async (t) => {
-  const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-v1-unsupported-"));
-  t.after(() => rm(root, { recursive: true, force: true }));
-  const project = path.join(root, "project");
-  await prepareVerifierProject(project, { schema_version: 1, contract_id: "legacy", contract_version: 1 });
-  const wrapper = path.join(project, "mvnw");
-  await writeFile(wrapper, "#!/bin/sh\nprintf 'must not run' > wrapper-ran\n");
-  await chmod(wrapper, 0o755);
-  await assert.rejects(() => run(project, path.join(root, "evidence"), controlledEnvironment), /unsupported: scaffold Manifest schema_version=1/);
-  assert.equal(existsSync(path.join(project, "wrapper-ran")), false);
-});
-
-test("验证日志会脱敏 Maven 仓库凭据", async (t) => {
-  const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-redaction-"));
-  t.after(() => rm(root, { recursive: true, force: true }));
-  const project = path.join(root, "project");
-  await prepareVerifierProject(project);
-  const wrapper = path.join(project, "mvnw");
-  await writeFile(wrapper, "#!/bin/sh\nprintf '%s %s\\n' \"$MAVEN_REPO_USERNAME\" \"$MAVEN_REPO_PASSWORD\"\n");
-  await chmod(wrapper, 0o755);
-  const sensitiveEnvironment = { ...controlledEnvironment, MAVEN_REPO_USERNAME: "sensitive-user", MAVEN_REPO_PASSWORD: "sensitive-password" };
-  const evidence = path.join(root, "evidence");
-  await run(project, evidence, sensitiveEnvironment);
-  const log = await readFile(path.join(evidence, "mvnw-validate.stdout.log"), "utf8");
-  assert.doesNotMatch(log, /sensitive-user|sensitive-password/);
-  assert.match(log, /\[REDACTED:MAVEN_REPO_USERNAME\].*\[REDACTED:MAVEN_REPO_PASSWORD\]/);
-});

package/template/.hermes/skills/yss-design-system/SKILL.md

@@ -1,105 +0,0 @@
----
-name: yss-design-system
-description: Use when YSS 产品设计系统与 Ant Design 企业级 UI 风格基线。涉及页面设计、原型评审、UI 实现、组件选型、主题 token、颜色排版间距、响应式验收、Ant Design/YSS UI 风格一致性、docs/design/design.md 更新或从外部设计系统引入规范时必须使用。
----
-
-# YSS Design System
-
-本技能用于把项目 UI 统一到一套可执行的设计系统基线：Ant Design 企业后台风格、YSS 页面工程习惯、设计 token、组件语义、交互状态和响应式验收。
-
-## 权威资料
-
-- 项目设计系统文档：`docs/design/design.md`，作为团队可读的唯一规范来源。
-- 项目 token 快照：`docs/design/tokens/theme.json`、`docs/design/tokens/tokens.default.json`、`docs/design/tokens/tokens.dark.json`、`docs/design/tokens/tokens.compact.json`、`docs/design/tokens/variables.css`、`docs/design/tokens/variables.dark.css`。
-- 本技能执行清单：`references/design-system.md`，用于 Agent 执行和评审，不替代 `docs/design/design.md`。
-- 历史输入包：`/Users/zhudaoming/Downloads/Product-Design-System`，只用于追溯首次引入来源，不作为后续工程依赖。
-- 默认亮色覆盖：项目 Ant Design 5 Less / `:root` 变量已裁定进 `docs/design/design.md` 与 token 快照；原始 Less 不是实现语言。
-- Codex `$design-qa` 项目对照：`references/design-qa-theme.md`，不替代官方 `design-qa` 流程，也不改上游插件正文。
-- 原型阶段合同：`yss-prototype-stage`，用于统一跨 Agent 的原型资产和浏览器验证证据。AntD 事实由 `yss-antd-design` 提供，且只用于原型设计构建。
-
-如果只需要快速判断，先读本文件。若要写 UI 规范、实现页面、评审设计或调整 token，必须读项目内 `docs/design/design.md`；若要执行评审或实现检查，再读 `references/design-system.md`。
-
-## 使用流程
-
-1. 先判断任务阶段：设计系统引入 / 产品设计 / 原型评审 / 前端实现 / UI 改造 / 主题 token 落地。
-2. 读取已有资产：`docs/design/design.md`、相关 Spec、交互说明、状态矩阵、OpenAPI Draft、现有页面代码。
-3. 按设计系统基线约束输出或修改产物：颜色、排版、间距、圆角、动效、组件、状态、响应式。
-4. 若是产品设计阶段，先使用 `yss-prototype-stage`；Codex 以 `product-design:index` 为主入口，其他 Agent 必须交付等价合同资产和证据。
-5. 若是前端实现阶段，配合 `yss-ui`、`yss-ui-business-page-generation`、`yss-components`、`yss-formily`；生命周期编排和旧触发词兼容再使用 `yss-page-module-development`，但本技能负责风格与体验一致性门禁。
-6. 若发现现有设计系统文档不足，先更新 `docs/design/design.md`，再让实现或评审引用该文档。
-
-## 核心基线
-
-- UI 定位：中后台、数据密集、表单密集、流程密集、可扫描、低装饰。
-- 主色：`#3371ff`（`--primary-color` / `--brand-color-primary`），用于主操作、链接、焦点、选中态和激活导航。
-- 默认字号：14px；主要字重：400 / 600；字体栈为系统字体，不强制 `Inter`。
-- 默认控件高度：32px；默认圆角 6px。
-- 间距：4px 网格，优先使用 token，不写任意 magic number。
-- 运行时换肤：短名 CSS 变量必须指向 `--brand-*`，不要再维护第二套色值。
-- 表面层级：页面背景、内容容器、浮层三层模型。
-- 组件语言：优先 Ant Design / YSS UI 语义，不自造同类控件。
-- 状态完整性：loading、empty、error、readonly、disabled、no-permission、conflict、success 必须在设计或实现中可解释。
-- Ant Design v6 原型基线：先用语义 token 定义角色，再用组件 token 或 CSS variables 落地；不以局部硬编码替代主题层。
-- 双轨版本：主题/视觉标准为 React Ant Design v6；生产 API 为 Vue 3 + YSS UI + 实现仓 lockfile 的 Ant Design Vue 4.x。只迁移语义、Token、状态与验收行为。
-
-## 强制规则
-
-- 不把该系统改造成营销落地页风格；业务应用首屏应直接进入可用工作界面。
-- 不用大面积渐变、装饰插画、夸张 hero、过度卡片化或单色系视觉堆叠替代信息结构。
-- 不在同一决策区域放两个 primary 按钮。
-- 每个页面或决策区域只保留一个 single primary action；其余动作降级为默认、链接或危险操作。
-- 不硬编码表面色、边框色、状态色；优先使用 token 或主题变量。
-- 交互原型中的每个可点击主动作都必须给出 interaction feedback：状态变化、禁用原因、成功或失败反馈至少覆盖其一。
-- accessibility：品牌 Seed `#3371ff` 保持不变；实际文字/背景组合不满足 WCAG 2.2 AA 时，优先通过 `ConfigProvider` component token 调整，并验证 default/hover/active/disabled/focus、键盘焦点、200% zoom、reduced motion 与目标尺寸，不新增页面级特例色。
-- React + Ant Design 的暗色或紧凑密度必须使用 theme algorithm，不手工反转颜色或逐控件压缩尺寸。
-- 不用 Tag 表达关键错误、阻断或审批状态；关键状态必须有可读文本和语义反馈。
-- 不让按钮、标签、表头、弹窗、卡片中的文字溢出或遮挡。
-- 不在表格 / 筛选 / 批量操作密集页面使用松散营销式布局。
-
-## 产出要求
-
-设计类任务至少输出：
-
-- 设计系统引用：明确引用 `docs/design/design.md`。
-- 页面和模块：页面清单、布局结构、主路径、异常路径。
-- 组件选择：YSS UI / Ant Design 组件映射。
-- 状态矩阵：加载、空、错、禁用、只读、无权限、冲突、成功。
-- API 反推：字段、筛选、分页、动作、错误码、权限、并发或幂等规则。
-- 响应式要求：关键断点和窄屏替代形态。
-
-实现类任务至少检查：
-
-- 是否通过 `ConfigProvider`、CSS variables 或项目 token 消费主题。
-- 是否将颜色、圆角、阴影和状态样式绑定到 semantic token，而不是复制表面色和交互色。
-- 是否保持 32px 默认控件高度、14px 默认正文、4px 间距网格。
-- 是否使用 YSS UI / Ant Design 的语义组件，而不是自造同类组件。
-- 是否保留 hover、focus、active、disabled、loading、error、empty 状态。
-- 是否为可提交、导出、保存、发布、审批等操作提供明确的 interaction feedback 与不可逆操作确认。
-- 是否在核心视口无横向溢出；表格横向滚动必须被限定在表格容器内。
-
-## 与其他技能的关系
-
-| 场景 | 配合技能 |
-| --- | --- |
-| Spec 后做页面 / 原型 / 交互说明 | `yss-prototype-stage` → `product-design:index` |
-| 低保真原型进入高保真前评审 | `prototype-review` |
-| 低保真评审通过后的高保真 HTML 原型 | `yss-prototype-stage`；`high-fidelity-html-prototype` 仅兼容入口 |
-| 低保真线框或流程图 | `product-design:index` |
-| 前端页面实现 | `yss-ui` / `yss-ui-business-page-generation`；生命周期兼容使用 `yss-page-module-development` |
-| 表单 schema | `yss-formily` |
-| YTable / YTree / 高度自适应 | `yss-components` / `yss-use-table-height` / `yss-use-tree-height` |
-| 原型阶段的 Ant Design v6 组件 / token / demo 查询 | `yss-antd-design`（只用于原型设计构建；前端落地改用 `yss-ui`） |
-| Codex 原型交接前的视觉 QA | `design-qa`；token / 字体对照读 `references/design-qa-theme.md`，以项目覆盖为准 |
-| Product Design 通用 starter 接入 YSS | `yss-prototype-stage/references/product-design-adapter.md`；锁定 antd@6、pnpm、主题 adapter、feature 级 QA 与证据 |
-| API 契约 / 接入 | `yss-openapi-governance` / `yss-api-integration` |
-
-## 更新设计系统
-
-当用户要求“引入设计系统”“形成项目规范”“更新设计系统 skill”时：
-
-1. 分析来源设计系统，不原样堆拷贝。
-2. 将稳定规范落到 `docs/design/design.md`。
-3. 将 Agent 执行入口落到 `.agents/skills/yss-design-system/SKILL.md`。
-4. 将 Agent 执行检查清单更新到 `.agents/skills/yss-design-system/references/design-system.md`。
-5. 更新 `docs/design/README.md` 和必要的 `AGENTS.md` 入口规则。
-6. 运行 `node .agents/skills/yss-design-system/scripts/validate-frontmatter.mjs`、对应 `node --test` 和 markdown/diff 基础检查。