create-yss-spec 3.0.0 → 3.1.0

package/template/.pi/skills/yss-implementation-contract-compiler/references/compiler-contract.yaml

@@ -0,0 +1,367 @@
+schema_version: 2
+backend_architecture:
+  registry_source: docs/agents/yss-skill-registry.yaml
+  identity_schema: docs/process/schemas/backend-architecture-identity.schema.json
+  required_evidence: [engineering_baseline, repository_registration, manifest]
+  required_identity_surfaces: [resolution, work_unit, execution_result]
+  family_recipe_selection: explicit-ddd-or-mvc-no-legacy-alias
+  readiness: supported-profile-and-current-identical-evidence
+compiled_by: yss-implementation-contract-compiler
+approved_by: yss-product-lifecycle
+capability_source: docs/agents/yss-skill-registry.yaml
+recipe_source: docs/agents/yss-skill-registry.yaml
+digest_algorithm: sha256
+unsupported_inputs:
+  registry_schema_v1: reject-with-migration-guidance
+  slice_contract_schema_v1: reject-with-migration-guidance
+allowed_statuses: [draft, blocked, ready-for-lifecycle-review]
+forbidden_statuses: [approved, ready-for-agent, completed]
+implementation_path_policy:
+  applies_to: harness-resident-runtime-code
+  project_roots:
+    backend: apps/backend/<project>/
+    frontend: apps/frontend/<project>/
+  container_roots:
+    - apps/backend/
+    - apps/frontend/
+  forbidden_roots:
+    - app/backend/
+    - app/frontend/
+  policies:
+    - harness-apps-multi-project
+    - external-repository-native
+    - git-submodule-harness-apps
+  git_submodule:
+    repository_scope: git-submodule
+    layout_policy: git-submodule-harness-apps
+    git_entry_mode: "160000"
+    empty_gitlink_scaffold: blocked
+    treat_empty_gitlink_as_regular_dir: blocked
+    treat_detached_head_as_regular_dir: blocked
+    force_overlay_mount: blocked
+    write_inside_detached_head: blocked
+    copy_source_into_harness: forbidden
+    inspect_working_tree_writable: explicit-boolean
+    empty_gitlink_writable: false
+    force_overlay_regular_dir_path: blocked
+  rules:
+    - "Harness 内每个运行时工程必须位于具体 project 目录，不能直接写入 apps/backend/ 或 apps/frontend/。"
+    - "app/backend/、app/frontend/ 及其子路径不是兼容别名，必须阻断。"
+    - "外部实现仓库使用登记的真实项目根路径，不用 Harness 容器路径冒充。"
+    - "git-submodule 挂载路径使用 git-submodule-harness-apps，必须是 gitlink 且分别登记；不得登记为 harness-apps。"
+    - "空 gitlink、detached HEAD、--force 覆盖挂载点不得当成普通目录；也不得在 detached HEAD 工作树内当普通目录写入。"
+    - "inspectWorkingTreeScope 必须返回 { writable }；空 gitlink / detached HEAD 的 writable 必为 false；--force 覆盖 gitlink 不得走普通目录覆盖路径。"
+subcontract_statuses: [required, not-applicable]
+
+readiness:
+  common: [spec, slice_ticket, architecture_review, build_architecture_checklist, implementation_repository, verification_commands]
+  ui_impact: [requirement_freeze, low_fidelity_review, prototype_review, prototype_profile_decision, prototype_deliverable, prototype_deliverable_verification, prototype_confirmation]
+  api_impact: [openapi_freeze]
+  no_api_impact: [no_api_impact_record]
+  data_impact: [data_architecture]
+  backend_impact: [engineering_baseline, backend_repository, maven_wrapper]
+  cross_repo: [repository_registry, delivery_order, integration_verification, rollback_order]
+
+compiler_input_required:
+  - slice_id
+  - impact_flags
+  - required_capabilities
+  - recipe_ids
+  - conditions
+  - lifecycle
+  - implementation
+  - acceptance
+impact_flags_required: [ui_impact, api_impact, no_api_impact, data_impact, backend_impact, cross_repo, existing_frozen_baseline]
+exclusive_flags:
+  - [api_impact, no_api_impact]
+
+slice_contract_required:
+  root: [schema_version, contract_id, contract_version, slice_id, status, lifecycle_refs, readiness, resolution, common, frontend, backend, contract, cross_repo, work_units]
+  lifecycle_refs: [spec, ticket, requirement_freeze, low_fidelity_review, prototype_review, prototype_profile_decision, prototype_deliverable, prototype_deliverable_verification, visual_baseline, prototype_confirmation, openapi_freeze_or_no_impact, architecture_review, data_architecture, tactical_design, engineering_baseline, build_architecture_checklist, implementation_repository, frontend_repository, backend_repository, maven_wrapper]
+  readiness: [blockers, stale_inputs, not_applicable]
+  resolution: [required_capabilities, required_skills, recipe_ids, conditions, reason_chains, registry_digest, compiler_contract_digest, compiled_at, freshness]
+  common: [impacted_areas, implementation_path_policy, project_roots, required_capabilities, required_skills, optional_skills, unavailable_skills, allowed_write_paths, forbidden_patterns, expected_evidence_files, verification_commands, human_review_points, full_reroute_triggers, quality_baseline_ref, context_plan, doubt_driven_review]
+  frontend: [status, required_skills, approved_prototype_ref, state_matrix_ref, visual_baseline_ref, visual_baseline_case_ids, allowed_write_paths, component_test_seams, e2e_paths]
+  backend: [status, affected_layers, component_impacts, required_skills, application_boundary, transaction_boundary, persistence_strategy, allowed_write_paths, forbidden_patterns, expected_evidence_files, seam_deferred, verification_commands, tactical_ddd]
+  contract: [api_impact, freeze_ref, no_api_impact_ref, generated_clients, contract_tests, regeneration_commands]
+  cross_repo: [repositories, delivery_order, integration_verification, rollback_order]
+
+lifecycle_ref_by_readiness:
+  spec: spec
+  slice_ticket: ticket
+  architecture_review: architecture_review
+  build_architecture_checklist: build_architecture_checklist
+  implementation_repository: implementation_repository
+  requirement_freeze: requirement_freeze
+  low_fidelity_review: low_fidelity_review
+  prototype_review: prototype_review
+  prototype_profile_decision: prototype_profile_decision
+  prototype_deliverable: prototype_deliverable
+  prototype_deliverable_verification: prototype_deliverable_verification
+  visual_baseline: visual_baseline
+  prototype_confirmation: prototype_confirmation
+  openapi_freeze: openapi_freeze_or_no_impact
+  no_api_impact_record: openapi_freeze_or_no_impact
+  data_architecture: data_architecture
+  tactical_design: tactical_design
+  engineering_baseline: engineering_baseline
+  backend_repository: backend_repository
+  maven_wrapper: maven_wrapper
+
+work_unit_required: [id, behavior, primary_skill, supporting_skills, tdd_mode, allowed_write_paths, expected_evidence, verification_commands, controlled_generation]
+work_unit_nonempty_arrays: [allowed_write_paths, expected_evidence, verification_commands]
+slice_contract_nonempty: [contract_id, contract_version, slice_id, status]
+slice_contract_array_fields:
+  common: [impacted_areas, implementation_path_policy, project_roots, required_capabilities, required_skills, allowed_write_paths, forbidden_patterns, expected_evidence_files, verification_commands, full_reroute_triggers, quality_baseline_ref, context_plan, doubt_driven_review]
+
+resolution_contract:
+  required_capabilities_source: registry-capability-or-recipe-only
+  recipes_reference: capabilities-only
+  closure_recursive_types: [context-required]
+  closure_conditional_type: context-conditional
+  closure_non_expanding_types: [coordination-only, review-only, component-dependency]
+  deduplicate_skills: true
+  preserve_all_reasons: true
+  deterministic_order: [recipe-declaration, dependency-topology, skill-id]
+  digest_change_status: stale
+  stale_action: recompile-and-return-to-lifecycle-approval
+
+context_plan:
+  required: [required_context_refs, on_demand_context_refs, context_stop_rule, missing_context_action]
+  context_stop_rule: minimal-sufficient-evidence
+  missing_context_action: [blocked, reroute]
+
+scaffold_contract_schema:
+  schema_version: 3
+  identity: service-engineering-baseline
+  compiled_by: yss-implementation-contract-compiler
+  approved_by: yss-product-lifecycle
+  status_by_owner:
+    compiler: [draft, ready-for-lifecycle-review, blocked]
+    lifecycle: [approved, stale, blocked]
+  required: [contract_id, contract_version, scaffold_request_id, status, compiler_draft_ref, lifecycle_approval_ref, persisted_ref, current_version, implementation_repository, backend_repository, scaffold_status, project_name, target_output_dir, base_package, architecture_family, generator_skill, decision_ref, decision_id, decision_digest, maven_coordinates, profiles, module_profile, allowed_write_paths, expected_evidence_files, verification_commands, approval, work_unit, generation_policy]
+  architecture_decision:
+    source: scaffold-architecture-decisions.yaml
+    required_status: lifecycle-approved
+    allowed_architectures: [domain-driven, layered-mvc]
+    blocked_statuses: [undecided, recommended, awaiting-user-decision, stale]
+    reference: [decision_ref, decision_id, decision_digest]
+    no_silent_default: true
+    user_confirmation_required: true
+    change_action: stale-and-recompile
+  approval:
+    required: [approval_ref, approver, persisted_ref, current_version]
+  generation_policy:
+    required: [mode, existing_target, old_project_migration, template_upgrade]
+    mode: initialize-only
+    existing_target: unsupported
+    old_project_migration: unsupported
+    template_upgrade: unsupported
+  maven_coordinates:
+    required: [group_id, project_version, parent, yss_components_version]
+    parent_required: [group_id, artifact_id, version]
+    yss_components_version: 2.0.0-SNAPSHOT
+  profiles:
+    discriminant: architecture_family
+    domain-driven:
+      generator_skill: yss-ddd-scaffold-generator
+      required: [architecture, persistence, verification_database, production_database, platform, validation_namespace, dto_placement, repository]
+      supported_initial: { architecture: target-domain-model, persistence: mybatis-plus, verification_database: h2, production_database: not-bound, platform: spring-boot-2.7-jdk8, validation_namespace: javax, dto_placement: web, repository: yss-internal }
+      resolved_modules: [domain, application, infrastructure, adapter, bootstrap]
+    layered-mvc:
+      generator_skill: yss-layered-mvc-scaffold-generator
+      required: [architecture, persistence, verification_database, production_database, platform, validation_namespace, repository]
+      supported_initial:
+        architecture: layered-mvc
+        persistence: mybatis-plus
+        verification_database: h2
+        production_database: not-bound
+        platform: spring-boot-2.7-jdk8
+        validation_namespace: javax
+        repository: yss-internal
+      module_resolution:
+        version: 1
+        core: [server, service, repository]
+        capabilities:
+          external-integration: [adapter]
+          published-client: [client]
+          feign-client: [client, feign-client]
+    unsupported: [old-architecture-profile, mybatis, spring-boot-3, jakarta, arbitrary-module-combination]
+  module_profile:
+    required: [requested_capabilities, resolved_modules, resolution_version]
+    resolution_version: 1
+    freeze_both_request_and_resolution: true
+    digest_change_status: stale
+  unsupported_inputs:
+    schema_v1: reject-no-auto-upgrade
+    schema_v2_new_generation: reject-no-auto-upgrade
+    slice_id: forbidden-as-scaffold-identity
+    existing_project: reject-no-scaffold-migration
+  lifecycle_boundary:
+    compiler_emits: [draft, ready-for-lifecycle-review, blocked]
+    lifecycle_approves: [approved]
+    generator_consumes: [approved]
+    after_generation:
+      domain-driven: [yss-backend-scaffold-parent, yss-implementation-contract-compiler]
+      layered-mvc: [yss-implementation-contract-compiler]
+  work_unit:
+    required: [id, behavior, primary_skill, supporting_skills, tdd_mode, allowed_write_paths, expected_evidence, verification_commands, controlled_generation]
+  generation_boundary:
+    allowed_for: [project_scaffold, pom, mechanical_config, wrapper, bootstrap_entrypoint, manifest_v3, architecture_rules, test_infrastructure]
+    forbidden_when: [business_behavior, business_fields, business_state, permission, transaction, complex_query, error_mapping, business_example_crud]
+    initialization: initialize-only
+    regeneration: unsupported
+    template_upgrade: unsupported
+    old_project_migration: unsupported-separate-architecture-modernization-initiative
+  verification:
+    commands: ["./mvnw validate", "./mvnw test", "./mvnw package"]
+    requires_execution: true
+    completion_levels: [generated, empty-scaffold-verified, first-slice-verified]
+    downstream_readiness_claim_requires: first-slice-verified
+    evidence: [preflight, command, exit_code, failure_category, duration_ms, stdout_ref, stderr_ref, executed_at]
+
+applicable_subcontract_nonempty:
+  frontend:
+    scalar: [approved_prototype_ref, state_matrix_ref, visual_baseline_ref]
+    array: [required_skills, visual_baseline_case_ids, allowed_write_paths, component_test_seams, e2e_paths]
+  backend:
+    scalar: [application_boundary, transaction_boundary, persistence_strategy]
+    array: [affected_layers, required_skills, allowed_write_paths, forbidden_patterns, expected_evidence_files, verification_commands]
+    conditional_tactical_ddd:
+      when: [aggregate-impact, state-machine-impact, invariant-impact, consistency-impact, domain-event-impact, gateway-boundary-impact, persistence-mapping-impact]
+      scalar: [tactical_design_ref, tactical_design_version, gateway_boundary_ref]
+      array: [aggregate_refs, invariant_refs, state_behavior_refs, domain_test_seams, application_test_seams]
+  contract_api:
+    scalar: [freeze_ref]
+    array: [contract_tests]
+  contract_no_api:
+    scalar: [no_api_impact_ref]
+  cross_repo:
+    array: [repositories, delivery_order, integration_verification, rollback_order]
+
+impact_to_capabilities:
+  domain-impact: [layer.domain, layer.application]
+  tactical-domain-impact: [architecture.tactical-domain]
+  persistence-impact: [layer.persistence]
+  mybatis-framework-impact: [framework.mybatis]
+  web-adapter-impact: [layer.web-adapter]
+  dto-wire-impact: [contract.dto-wire]
+  request-validation: [contract.request-validation]
+  error-mapping: [contract.error-mapping, contract.dto-wire]
+  cache: [component.cache]
+  current-user-context: [component.current-user-context]
+  user-cache-lookup: [component.current-user-context, component.cache]
+  audit-event: [component.audit-log, component.current-user-context, contract.dto-wire]
+  excel-import-export: [component.excel-import-export]
+  distributed-id: [component.distributed-id]
+  encryption-or-signing: [component.security-algorithm]
+  gateway-resilience: [component.gateway-resilience]
+  ddd-scaffold: [scaffold.ddd]
+  mvc-scaffold: [scaffold.layered-mvc]
+  springboot3-migration: [migration.springboot3]
+
+tdd_modes:
+  behavior-tdd:
+    impacts: [domain-rule, state-machine, transaction, complex-query, permission, error-mapping, page-interaction, user-visible-state]
+  controlled-generation:
+    impacts: [project-scaffold, dto-boilerplate, po-boilerplate, mapstruct-generated, frozen-openapi-client, mechanical-config]
+    required: [exception_reason, generator, generator_inputs, expected_files, verification_commands, behavior_tests_after_generation]
+
+full_reroute_triggers:
+  - scaffold-baseline-drift
+  - scaffold-architecture-decision-changed
+  - scaffold-profile-changed
+  - scaffold-module-resolution-changed
+  - api-schema-impact
+  - database-schema-impact
+  - state-machine-impact
+  - visual-baseline-version-or-digest-changed
+  - data-model-impact
+  - new-write-path
+  - new-repository
+  - aggregate-impact
+  - invariant-impact
+  - consistency-impact
+  - domain-event-impact
+  - gateway-boundary-impact
+  - persistence-mapping-impact
+  - new-required-skill
+  - not-applicable-invalidated
+  - architecture-drift
+  - contract-violation
+  - generation-became-behavior
+  - test-seam-changed
+  - verification-command-changed
+  - delivery-order-changed
+  - doubt-review-triggered
+
+reroute_destinations:
+  scaffold-baseline-drift: stage7-scaffold-revalidation
+  api-schema-impact: system-data-architecture-and-contract-review
+  database-schema-impact: data-architecture-and-migration-review
+  state-machine-impact: spec-system-data-and-contract-review
+  data-model-impact: data-architecture-and-contract-review
+  new-write-path: stage7-contract-recompile
+  new-repository: stage7-contract-recompile
+  new-required-skill: stage7-contract-recompile
+  not-applicable-invalidated: lifecycle-impact-reassessment
+  architecture-drift: architecture-recheck
+  contract-violation: stage7-contract-recompile
+  generation-became-behavior: stage7-contract-recompile
+  test-seam-changed: spec-ticket-test-seam-review
+  verification-command-changed: stage7-contract-recompile
+  delivery-order-changed: cross-repo-release-review
+  doubt-review-triggered: high-risk-decision-review
+
+doubt_driven_review:
+  applies_when:
+    - api-schema-impact
+    - database-schema-impact
+    - cross-repo-contract
+    - release-or-rollback
+    - authentication-authorization-tenant-or-sensitive-data-behavior
+    - lifecycle-or-generation-semantics
+  required: [claim, counterclaim, evidence_refs, residual_risks, reviewer_ref]
+  status_values: [not-applicable, required, completed, blocked]
+  blocking_when: [missing-counterclaim, insufficient-evidence, unresolved-residual-risk]
+  evidence_owner: decision-or-review-record
+  no_new_lifecycle_stage: true
+
+quality_baseline:
+  source: lifecycle_refs.engineering_baseline
+  required_for: [project-instance]
+  reused_by: [slice-contract, yss-skill-execution-result, code-review, release]
+  redefinition: forbidden
+
+execution_result_allowed_statuses: [implemented, seam-deferred, drift, violation, not-applicable]
+execution_blockers: [path-outside-contract, missing-evidence, verification-not-executed, verification-command-mismatch, seam-deferred-without-owner, constraint-failed, doubt-review-missing, unapproved-deviation, drift, violation, new-impacts]
+
+contract_versioning:
+  full_reroute_current_status: stale
+  next_version: increment
+  required_history: [previous_contract_ref, stale_reason, reroute_trigger]
+  affected_work_units_status: paused
+
+execution_result_required:
+  - consumed_contract
+  - changed_files
+  - evidence_files
+  - verification_results
+  - constraint_results
+  - seam_deferred
+  - deviations
+  - new_impacts
+  - not_applicable_reason
+seam_deferred_required: [risk, owner, follow_up_ticket, verification_plan, target_version_or_release_date]
+deviation_required: [rule, reason, approval_ref]
+not_applicable_required: [item, reason]
+unavailable_skill_required: [skill, provider, fallback, resolution]
+
+strategic_handoff_consumption:
+  when: upstream-source-is-imported-strategic-handoff
+  required: [import_receipt_ref, bundle_digest, context_reconciliation_ref, rows]
+  verification: scripts/verify-strategic-handoff-consumption --root <target> --slice <slice-id> <approved-tactical-contract>
+  require_actual_exit_code: 0
+  stale_policy: latest-imported-source-digest-and-dependent-slices
+  unknown_dependency: block-all
+  compiler_must_not_approve: true

package/template/.pi/skills/yss-implementation-contract-compiler/references/slice-implementation-contract.md

@@ -0,0 +1,201 @@
+# Slice Implementation Contract
+
+后端合同还必须绑定 `architecture_identity`（schema 见 `docs/process/schemas/backend-architecture-identity.schema.json`），并与工程基线、登记和 Manifest 一致。将同一身份复制到 `resolution`、backend 工作单元和执行结果；Profile 的成熟度/Recipe 来源是技能注册表，draft 不得 ready-for-agent。旧 backend.domain-behavior/persistence-mybatis/http-api Recipe 只读退役，重新编译时显式选择 backend.ddd-* 或 backend.mvc-*。
+
+`yss-implementation-contract-compiler` 生成草案；`yss-product-lifecycle` 核验、批准并持久化。合同缺少必填字段时状态为 `blocked`。schema v1 已停止支持，必须重新编译为 v2，不提供自动升级。
+
+```yaml
+slice_contract:
+  schema_version: 2
+  contract_id:
+  contract_version: 1
+  slice_id:
+  status: draft
+  suggested_owner_role_id: # role.frontend-engineer | role.backend-engineer | role.test-engineer；编译器只建议，生命周期编排器派活并批准
+  lifecycle_refs:
+    spec:
+    ticket:
+    requirement_freeze:
+    low_fidelity_review:
+    prototype_review:
+    prototype_profile_decision:
+    prototype_deliverable:
+    prototype_deliverable_verification:
+    prototype_confirmation:
+    openapi_freeze_or_no_impact:
+    architecture_review:
+    data_architecture:
+    engineering_baseline:
+    tactical_design:
+    build_architecture_checklist:
+    implementation_repository:
+    frontend_repository:
+    backend_repository:
+    maven_wrapper:
+  readiness:
+    blockers: []
+    stale_inputs: []
+    not_applicable:
+      - item:
+        reason:
+  resolution:
+    required_capabilities: []
+    required_skills: []
+    recipe_ids: []
+    conditions: []
+    reason_chains: {}
+    registry_digest: # sha256 of normalized docs/agents/yss-skill-registry.yaml
+    compiler_contract_digest: # sha256 of normalized compiler-contract.yaml
+    compiled_at:
+    freshness: current # digest 变化后为 stale
+  common:
+    impacted_areas: []
+    implementation_path_policy: harness-apps-multi-project # or external-repository-native | git-submodule-harness-apps
+    project_roots: []
+    required_capabilities: []
+    required_skills: []
+    optional_skills: []
+    unavailable_skills:
+      - skill:
+        provider:
+        fallback: blocked | approved-equivalent
+        resolution:
+    allowed_write_paths: []
+    forbidden_patterns: []
+    expected_evidence_files: []
+    verification_commands: []
+    human_review_points: []
+    full_reroute_triggers: []
+    quality_baseline_ref:
+    context_plan:
+      required_context_refs: []
+      on_demand_context_refs: []
+      context_stop_rule: minimal-sufficient-evidence
+      missing_context_action: blocked # or reroute
+    doubt_driven_review:
+      status: not-applicable # or required / completed / blocked
+      trigger_impacts: []
+      claim:
+      counterclaim:
+      evidence_refs: []
+      residual_risks: []
+      reviewer_ref:
+  frontend:
+    status: not-applicable
+    required_skills: []
+    approved_prototype_ref:
+    state_matrix_ref:
+    visual_baseline_ref:
+    visual_baseline_case_ids: []
+    generated_api_client_ref:
+    allowed_write_paths: []
+    component_test_seams: []
+    e2e_paths: []
+  backend:
+    status: not-applicable
+    affected_layers: []
+    component_impacts: []
+    required_skills: []
+    application_boundary:
+    transaction_boundary:
+    persistence_strategy:
+    tactical_design_ref:
+    tactical_design_version:
+    aggregate_refs: []
+    invariant_refs: []
+    state_behavior_refs: []
+    gateway_boundary_ref:
+    domain_test_seams: []
+    application_test_seams: []
+    tactical_ddd:
+      status: not-applicable
+      tactical_design_ref:
+      tactical_design_version:
+      aggregate_refs: []
+      invariant_refs: []
+      state_behavior_refs: []
+      gateway_boundary_ref:
+      domain_test_seams: []
+      application_test_seams: []
+    allowed_write_paths: []
+    forbidden_patterns: []
+    expected_evidence_files: []
+    seam_deferred: []
+    verification_commands: []
+  contract:
+    api_impact: false
+    freeze_ref:
+    no_api_impact_ref:
+    generated_clients: []
+    contract_tests: []
+    regeneration_commands: []
+  cross_repo:
+    repositories: []
+    delivery_order: []
+    integration_verification: []
+    rollback_order: []
+  work_units:
+    - id: slice-frontend
+      role_id: role.frontend-engineer
+      runtime_id: runtime.skill-projection
+      execution_state: Worker
+      workflow_status: not-started
+      task_package_ref:
+      contract_id: # must equal slice_contract.contract_id
+      contract_version: # must equal slice_contract.contract_version
+      downstream_consumers: []
+      convergence_ref:
+      work_unit:
+        behavior:
+        primary_skill:
+        supporting_skills: []
+        tdd_mode: behavior-tdd
+        allowed_write_paths: []
+        expected_evidence: []
+        verification_commands: []
+    - id: slice-backend
+      role_id: role.backend-engineer
+      runtime_id: runtime.skill-projection
+      execution_state: Worker
+      workflow_status: not-started
+      task_package_ref:
+      contract_id:
+      contract_version:
+      downstream_consumers: []
+      convergence_ref:
+      work_unit:
+        behavior:
+        primary_skill:
+        supporting_skills: []
+        tdd_mode: behavior-tdd
+        allowed_write_paths: []
+        expected_evidence: []
+        verification_commands: []
+```
+
+工作单元：
+
+```yaml
+work_unit:
+  id:
+  behavior:
+  primary_skill:
+  supporting_skills: []
+  tdd_mode: behavior-tdd
+  allowed_write_paths: []
+  expected_evidence: []
+  verification_commands: []
+  controlled_generation:
+    exception_reason:
+    generator:
+    generator_inputs: []
+    expected_files: []
+    verification_commands: []
+    behavior_tests_after_generation: []
+```
+
+`controlled_generation` 仅在 `tdd_mode: controlled-generation` 时必填；其他模式标记 `not-applicable`。明确写入需求的权限业务行为仍使用 `behavior-tdd`；API schema 与 database schema 分别触发契约或数据架构回退，不得用一个含糊的 schema 类型决定路线。
+
+`work_units` 中的前端、后端和测试任务是切片级子任务，不是新的生命周期阶段。每个子任务必须引用独立任务包；任务包只能消费同一份已批准且版本当前的 Slice Contract。`workflow_status` 追踪执行过程，不能替代生命周期状态；`contract_id`、`contract_version` 或 resolution digest 不一致时必须阻断并回到实现合同编译器。
+
+一个切片可以组合多个窄 Recipe，但只计算一次闭包。Recipe 只能引用 capability；合同同时冻结 `required_capabilities`、`required_skills`、完整原因链和 Registry/Compiler digest。任一 digest 或 Visual Baseline 版本 / digest 改变时，当前合同标记 `stale`，重新编译后仍须由 `yss-product-lifecycle` 再批准。UI 切片只消费 `visual_baseline_case_ids` 指定的图片，并先读取 manifest 与语义引用，禁止按目录 glob 猜测图片含义。

package/template/.pi/skills/yss-implementation-contract-compiler/references/yss-skill-execution-result.md

@@ -0,0 +1,71 @@
+# YSS Skill Execution Result
+
+核心 YSS skill 必须消费已批准合同版本，并返回：
+
+后端结果顶层带与当前 resolution 完全一致的 `architecture_identity`；每条验证记录还须有整数 `exit_code`。身份缺失、Profile 未 supported、验证非零或没有执行时间均不得 accepted。
+
+```yaml
+execution_result:
+  schema_version: 2
+  skill:
+  slice_id:
+  work_unit_id:
+  status: implemented
+  consumed_contract:
+    contract_ref:
+    contract_id:
+    contract_version:
+    registry_digest:
+    compiler_contract_digest:
+    quality_baseline_ref:
+    context_plan_ref:
+  changed_files:
+    - path:
+      contract_area: common | frontend | backend | contract | cross_repo
+  evidence_files:
+    - path:
+      evidence_type: code | test | generated | review | verification
+      behavior_ref:
+  verification_results:
+    - command:
+      result:
+      executed_at:
+  constraint_results:
+    - constraint:
+      status: passed | failed | not-applicable
+      evidence_ref:
+  doubt_driven_review:
+    status: not-applicable | completed | blocked
+    record_ref:
+  seam_deferred:
+    - risk:
+      owner:
+      follow_up_ticket:
+      verification_plan:
+      target_version_or_release_date:
+  deviations:
+    - rule:
+      reason:
+      approval_ref:
+  new_impacts:
+    - impact_type:
+      evidence_ref:
+  not_applicable_reason:
+```
+
+允许状态：`implemented`、`seam-deferred`、`drift`、`violation`、`not-applicable`。
+
+实现合同编译器必须验证：
+
+1. `consumed_contract.contract_version` 与当前批准版本一致，两个 resolution digest 与批准合同一致且保持 current。
+2. `changed_files` 全部位于工作单元和切片允许路径内。
+3. `expected_evidence_files` 全部存在并能回指行为。
+4. 验证命令包含实际结果和时间；计划命令不算证据。
+5. `seam_deferred` 有风险、责任人、补齐 Ticket、验证计划和目标版本 / 发布日期。
+6. `new_impacts` 非空时暂停并重路由。
+7. `drift` 触发 Architecture Re-check；`violation` 阻断 build。
+8. `status: not-applicable` 必须填写 `not_applicable_reason`；其他状态保留字段但可为空。
+
+专项 skill 自报 `implemented` 不等于最终通过，生命周期编排器和独立 Reviewer 必须复核。
+
+`verification_results` 不得为空，每项必须包含非空 `command`、`result` 和 `executed_at`。路径校验按完整目录边界判断，`apps/backend/project1-escape` 不属于 `apps/backend/project1/`；Harness 内路径还必须通过项目路径策略。完整重路由时旧合同必须标记 `stale`，新合同版本递增并保留旧合同引用、失效原因和触发器。

package/template/.pi/skills/yss-implementation-contract-compiler/tests/backend-profiles.test.mjs

@@ -0,0 +1,45 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { compileDefaultImplementationContract } from "../../../../scripts/lib/implementation-contract-compiler.mjs";
+import { validateArchitectureIdentity } from "../../../../scripts/lib/backend-architecture.mjs";
+import { loadSkillRegistry } from "../../../../scripts/lib/skill-registry.mjs";
+
+const registry = loadSkillRegistry();
+function input(name) {
+  const profile = registry.architecture_profiles[name];
+  const identity = { architecture_family: profile.architecture_family, architecture_profile: name,
+    generator_skill: profile.generator_skill, requested_capabilities: [], resolved_modules: profile.core_modules,
+    verification_database: "h2", production_database: "not-bound", contract_digest: "a".repeat(64) };
+  return { architecture_identity: identity, architecture_evidence: {
+    engineering_baseline: identity, repository_registration: identity, manifest: identity
+  }};
+}
+
+for (const name of Object.keys(registry.architecture_profiles)) {
+  test(`${name} selects architecture recipe and explicit Skill Profile`, () => {
+    const data = input(name);
+    const mvc = data.architecture_identity.architecture_family === "layered-mvc";
+    const result = compileDefaultImplementationContract({ ...data,
+      recipeIds: [mvc ? "backend.mvc-service-behavior" : "backend.ddd-domain-behavior", mvc ? "backend.mvc-http-api" : "backend.ddd-http-api"] });
+    assert.equal(result.required_skills.includes("yss-domain"), !mvc);
+    assert.equal(result.skill_profiles["yss-application"], name);
+    assert.equal(result.skill_profiles["yss-web-controller"], name);
+    assert.ok(result.readiness_blockers.includes("backend-profile-not-supported"));
+  });
+}
+
+test("rejects missing identity, deprecated recipe, wrong family and stale evidence", () => {
+  assert.throws(() => compileDefaultImplementationContract({ recipeIds: ["backend.mvc-http-api"] }), /architecture_identity/);
+  assert.throws(() => compileDefaultImplementationContract({ recipeIds: ["backend.http-api"] }), /deprecated/);
+  assert.throws(() => compileDefaultImplementationContract({ ...input("layered-mvc-service"), recipeIds: ["backend.ddd-http-api"] }), /架构族/);
+  const stale = input("layered-mvc-service");
+  stale.architecture_evidence.manifest = { ...stale.architecture_identity, contract_digest: "b".repeat(64) };
+  assert.throws(() => compileDefaultImplementationContract({ ...stale, recipeIds: ["backend.mvc-http-api"] }), /stale/);
+});
+
+test("rejects unsupported capability closure and production driver defaults", () => {
+  const identity = input("mvc-data-analysis-v1").architecture_identity;
+  assert.throws(() => validateArchitectureIdentity({ ...identity, resolved_modules: ["server"] }), /模块闭包/);
+  assert.throws(() => validateArchitectureIdentity({ ...identity, production_database: "oracle" }), /H2/);
+  assert.throws(() => compileDefaultImplementationContract({ ...input("layered-mvc-service"), requiredCapabilities: ["layer.domain"] }), /不匹配/);
+});