create-yss-spec 3.0.1 → 3.1.3

package/template/scripts/lib/approval-record.mjs

@@ -8,6 +8,7 @@ import {
   collectCountersignGateIds
 } from "./digital-human-roles.mjs";
 import { ROOT } from "./lifecycle-registry.mjs";
+import { assertUserDecisionRequirement, assertWorkUnitUserDecision, assertImplementationDecision } from "./user-decision.mjs";
 
 const DECISIONS = new Set(["approved", "rejected", "vetoed"]);
 const ACTOR_KINDS = new Set(["digital-human", "biological-human", "orchestrator"]);
@@ -47,7 +48,7 @@ export function resolveApprovalRef(approvalRef, fromFile = ROOT) {
   return path.resolve(path.dirname(fromFile), approvalRef);
 }
 
-export function validateApprovalRecord(record, { rolesDoc, requireApproved = false } = {}) {
+export function validateApprovalRecord(record, { rolesDoc, requireApproved = false, ...decisionOptions } = {}) {
   if (!record || typeof record !== "object" || Array.isArray(record)) fail("会签记录必须是对象");
   if (record.schema_version !== 1) fail("会签记录 schema_version 必须为 1");
   requireString(record.gate_id, "gate_id");
@@ -77,6 +78,7 @@ export function validateApprovalRecord(record, { rolesDoc, requireApproved = fal
   if (rule.bucket === "biological_human") {
     if (record.actor_kind !== "biological-human") fail(`${record.gate_id} 必须由生物人会签`);
     if (record.role_id !== BIOLOGICAL_ROLE_ID) fail(`${record.gate_id} 的 role_id 必须为 ${BIOLOGICAL_ROLE_ID}`);
+    if (requireApproved) assertRecordUserDecision(record, registry, decisionOptions);
     return rule;
   }
 
@@ -91,9 +93,16 @@ export function validateApprovalRecord(record, { rolesDoc, requireApproved = fal
   if (rule.drafter && record.drafter_role_id && record.drafter_role_id !== rule.drafter) {
     fail(`${record.gate_id} drafter_role_id 必须为 ${rule.drafter}`);
   }
+  if (requireApproved) assertRecordUserDecision(record, registry, decisionOptions);
   return rule;
 }
 
+function assertRecordUserDecision(record, registry, options) {
+  if (!registry.user_decision_policy.gates.includes(record.gate_id) && countersignRuleForGate(registry.gate_policy, record.gate_id)?.bucket !== "biological_human") return;
+  const result = assertUserDecisionRequirement({ boundary: record.gate_id, subject_ref: record.subject_ref, scope: record.approval_scope, user_decision_ref: record.user_decision_ref }, { ...options, rolesDoc: registry });
+  if (record.actor_kind === "biological-human" && result.validated.some((item) => item.principal_ref !== record.principal_ref)) fail("user-decision-responder-mismatch: 生物人会签者与原始回复者不一致");
+}
+
 export function validateApprovalRecordFile(filePath, options = {}) {
   return validateApprovalRecord(loadApprovalRecord(filePath), options);
 }
@@ -111,6 +120,11 @@ export function assertApprovedGateHasValidApproval(gateId, gateState, { checkpoi
   if (!existsSync(resolved)) fail(`${gateId} 的 approval_ref 不可读: ${gateState.approval_ref}`);
   const record = loadApprovalRecord(resolved);
   if (record.gate_id !== gateId) fail(`${gateId} 的会签记录 gate_id 不匹配`);
+  if (rolesDoc.user_decision_policy.gates.includes(gateId) || countersignRuleForGate(rolesDoc.gate_policy, gateId)?.bucket === "biological_human") {
+    if (!gateState.subject_ref || gateState.subject_ref !== record.subject_ref || JSON.stringify([...(gateState.approval_scope || [])].sort()) !== JSON.stringify([...(record.approval_scope || [])].sort())) {
+      fail(`${gateId} user-decision-subject-mismatch: 当前门禁资产与会签范围不匹配`);
+    }
+  }
   validateApprovalRecord(record, { rolesDoc, requireApproved: true });
 }
 
@@ -121,3 +135,20 @@ export function assertCheckpointApprovals(checkpoint, checkpointPath) {
     assertApprovedGateHasValidApproval(gateId, state, { checkpointPath });
   }
 }
+
+// Called on resume/transition as well as completion; drafting while waiting stays allowed.
+export function assertCheckpointUserDecisions(checkpoint) {
+  if (checkpoint.repository_mode !== "project-instance") return;
+  const review = checkpoint.human_review || {};
+  const advancing = ["running", "completed"].includes(checkpoint.status) || (checkpoint.mode === "resume" && checkpoint.status === "routing");
+  if (!advancing) return;
+  const state = { user_decisions: review.user_decisions || [], user_decision_not_applicable: review.not_applicable || [] };
+  const completedUnit = checkpoint.stage_trace?.completed_work_unit;
+  if (completedUnit) assertWorkUnitUserDecision(completedUnit, state);
+  if (checkpoint.next_work_unit === "work-unit.slice-implementation") assertImplementationDecision({ ...review.implementation, ...state });
+  for (const requirement of review.required_decisions || []) assertUserDecisionRequirement(requirement);
+  if (review.external_input) assertUserDecisionRequirement({ ...review.external_input, boundary: "external-input" });
+  if (checkpoint.status === "completed") {
+    if (checkpoint.gates?.["gate.release-ready"]?.status !== "approved") throw new TypeError("user-decision-response-required: 阶段完成须发布就绪裁决");
+  }
+}

package/template/scripts/lib/backend-architecture.mjs

@@ -0,0 +1,43 @@
+import { createHash } from "node:crypto";
+import { loadSkillRegistry } from "./skill-registry.mjs";
+
+export function architectureDigest(value) {
+  const stable = (item) => Array.isArray(item) ? item.map(stable) : item && typeof item === "object"
+    ? Object.fromEntries(Object.keys(item).sort().map((key) => [key, stable(item[key])])) : item;
+  return createHash("sha256").update(JSON.stringify(stable(value))).digest("hex");
+}
+
+export function validateArchitectureIdentity(identity, registry = loadSkillRegistry()) {
+  if (!identity || typeof identity !== "object") throw new TypeError("缺少 architecture_identity；请从工程基线重新编译");
+  const profile = registry.architecture_profiles?.[identity.architecture_profile];
+  if (!profile || identity.architecture_family !== profile.architecture_family || identity.generator_skill !== profile.generator_skill) {
+    throw new TypeError("architecture_identity 的架构族、Profile 或生成器不匹配");
+  }
+  if (identity.verification_database !== "h2" || identity.production_database !== "not-bound") throw new TypeError("脚手架身份必须绑定 H2 验证和 production_database=not-bound");
+  if (!Array.isArray(identity.requested_capabilities) || !Array.isArray(identity.resolved_modules)) throw new TypeError("architecture_identity 缺少模块闭包");
+  if (new Set(identity.requested_capabilities).size !== identity.requested_capabilities.length) throw new TypeError("requested_capabilities 不允许重复");
+  const modules = [...profile.core_modules];
+  for (const capability of identity.requested_capabilities) {
+    const additions = profile.capability_modules[capability];
+    if (!additions) throw new TypeError(`Profile 不支持 capability: ${capability}`);
+    for (const module of additions) if (!modules.includes(module)) modules.push(module);
+  }
+  if (new Set(identity.resolved_modules).size !== identity.resolved_modules.length ||
+      modules.length !== identity.resolved_modules.length || modules.some((module) => !identity.resolved_modules.includes(module))) throw new TypeError("architecture_identity 模块闭包不匹配");
+  if (typeof identity.contract_digest !== "string" || !/^(sha256:)?[a-f0-9]{64}$/.test(identity.contract_digest)) throw new TypeError("architecture_identity 缺少有效 contract_digest");
+  return profile;
+}
+
+export function assertArchitectureAgreement(identity, evidence, registry) {
+  validateArchitectureIdentity(identity, registry);
+  for (const [name, source] of Object.entries(evidence ?? {})) {
+    const actual = source?.architecture_identity ?? source;
+    validateArchitectureIdentity(actual, registry);
+    if (architectureDigest(identity) !== architectureDigest(actual)) throw new TypeError(`stale: ${name} architecture_identity 与合同不一致`);
+  }
+}
+
+export function architectureReady(identity, registry = loadSkillRegistry()) {
+  const profile = validateArchitectureIdentity(identity, registry);
+  return profile.maturity === "supported";
+}

package/template/scripts/lib/backend-delivery.mjs

@@ -0,0 +1,164 @@
+import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync } from 'node:fs';
+import path from 'node:path';
+import { tmpdir } from 'node:os';
+import { openBundle, importBundle, sourceApproval } from './strategic-handoff.mjs';
+import { read, safe, ensure, hash, digest, json, files, write, project, schema, archive, sourceApprovalPolicy } from './strategic-handoff-io.mjs';
+
+// Evidence binds the deliverable basis, avoiding a circular hash through its own logs.
+export function backendDeliveryBasis(delivery) {
+  return digest(Object.fromEntries(['delivery_id','version','strategic_bundle_digest','scope','openapi','slice_contract','build','environment'].map(key=>[key,delivery[key]])));
+}
+
+function boundFile(root, binding) {
+  const bytes=readFileSync(safe(root,binding.ref));
+  ensure(hash(bytes)===binding.digest,`交付资产摘要不一致: ${binding.ref}`);
+  return bytes;
+}
+
+async function approvedFile(root, binding, gate) {
+  const bytes=boundFile(root,binding);
+  const record=read(safe(root,binding.approval_ref));
+  const roles=sourceApprovalPolicy(read(safe(root,'docs/agents/digital-human-roles.yaml')));
+  await sourceApproval(record,roles,root);
+  ensure((Array.isArray(gate)?gate:[gate]).includes(record.gate_id),`交付资产批准门禁不匹配: ${binding.ref}`);
+  ensure(record.artifact_bindings?.some(x=>x.id===binding.id&&x.version===binding.version&&x.digest===binding.digest),`批准未绑定当前交付资产: ${binding.ref}`);
+  return bytes;
+}
+
+function verification(root, binding, basis, kind) {
+  boundFile(root,binding);
+  const record=read(safe(root,binding.ref));
+  schema(record,'docs/process/schemas/backend-delivery-verification.schema.json');
+  ensure(record.kind===kind&&record.subject_digest===basis,`验证未绑定当前交付: ${kind}`);
+  ensure(record.results.every(x=>x.exit_code===0),`后端验证失败: ${kind}`);
+  for(const result of record.results) {
+    ensure(Number.isFinite(Date.parse(result.executed_at))&&Date.parse(result.executed_at)<=Date.now()+60000,'验证执行时间无效');
+    result.evidence.forEach(file=>boundFile(root,file));
+  }
+  return record;
+}
+
+export async function inspectBackendDelivery(root, ref) {
+  project(root);
+  const delivery=read(safe(root,ref));
+  schema(delivery,'docs/process/schemas/backend-delivery.schema.json');
+  ensure(boundFile(root,delivery.environment.test_data).length>0,'测试数据准备说明为空');
+  await approvedFile(root,delivery.openapi,['gate.openapi-frozen','gate.openapi-freeze-confirmed']);
+  await approvedFile(root,delivery.slice_contract,'gate.slice-contract-approved');
+  const contractDoc=read(safe(root,delivery.slice_contract.ref));
+  const contract=contractDoc.slice_contract||contractDoc;
+  ensure(contract.status==='approved'&&contract.slice_id===delivery.scope.slice_id&&contract.contract_id===delivery.slice_contract.id&&contract.contract_version===delivery.slice_contract.version,'后端 Slice Contract 身份/状态/切片不匹配');
+  const api=read(safe(root,delivery.openapi.ref));
+  ensure(/^3\.1\./.test(api.openapi),'后端交付必须使用 OpenAPI 3.1');
+  const operations=Object.values(api.paths||{}).flatMap(item=>Object.entries(item).filter(([method])=>['get','put','post','delete','options','head','patch','trace'].includes(method)).map(([,operation])=>operation.operationId));
+  ensure(delivery.scope.operation_ids.every(id=>operations.includes(id)),'交付接口不在冻结 OpenAPI 中');
+  const basis=backendDeliveryBasis(delivery);
+  const tests=verification(root,delivery.verification.contract,basis,'backend-contract');
+  verification(root,delivery.verification.deployment,basis,'backend-deployment');
+  return openBundle(safe(root,delivery.strategic_bundle_ref),bundle=>{
+    ensure(bundle.manifest.bundle_digest===delivery.strategic_bundle_digest,'后端交付与战略版本不一致');
+    const sources=new Set([...bundle.indexes.rules.map(x=>x.rule_id),...bundle.indexes.scenarios.map(x=>x.scenario_id)]);
+    ensure(delivery.scope.source_ids.every(id=>sources.has(id)),'后端交付引用未知规则/场景');
+    const scenarios=bundle.indexes.scenarios.filter(x=>delivery.scope.source_ids.includes(x.scenario_id));
+    ensure(scenarios.length>0,'后端交付范围缺少业务成功/失败场景');
+    for(const scenario of scenarios) {
+      ensure(scenario.rule_refs.every(id=>delivery.scope.source_ids.includes(id)),'交付场景缺少关联规则');
+      for(const outcome of ['success','failure'])ensure(tests.coverage.some(x=>x.source_id===scenario.scenario_id&&x.outcome===outcome),'后端交付缺少成功/失败场景验证');
+    }
+    ensure(delivery.scope.operation_ids.every(id=>tests.operation_ids.includes(id)),'后端契约验证未覆盖交付接口');
+    return {delivery,basis};
+  });
+}
+
+function validManifest(manifest,root) {
+  ensure(manifest.schema_version===1&&manifest.kind==='backend-delivery','后端包类型或 schema 不支持');
+  const {bundle_digest,...body}=manifest;
+  ensure(bundle_digest===digest(body),'后端包清单摘要不一致');
+  ensure(Array.isArray(manifest.files)&&manifest.files.length<=20000,'后端包文件清单无效');
+  const names=manifest.files.map(x=>x.path);
+  ensure(new Set(names.map(x=>x.toLowerCase())).size===names.length,'后端包路径重复');
+  ensure(json([...names,'manifest.json'].sort())===json(files(root).sort()),'后端包文件缺失或存在未登记文件');
+  ensure(manifest.files.reduce((total,file)=>total+file.size_bytes,0)<=512*1024*1024,'后端包大小超限');
+  const originals=manifest.files.filter(x=>x.original_ref).map(x=>x.original_ref);
+  ensure(new Set(originals.map(x=>x.toLowerCase())).size===originals.length,'后端包源路径重复');
+  for(const file of manifest.files) {
+    const bytes=readFileSync(safe(root,file.path));
+    ensure(bytes.length===file.size_bytes&&hash(bytes)===file.sha256,`后端包文件摘要不一致: ${file.path}`);
+  }
+}
+
+export async function openBackendDelivery(input, action) {
+  const temporary=mkdtempSync(path.join(tmpdir(),'yss-backend-delivery-'));
+  try {
+    ensure(existsSync(input)&&!lstatSync(input).isSymbolicLink(),'后端交付包不存在或是 symlink');
+    let root=path.resolve(input);
+    if(lstatSync(root).isFile()) { root=path.join(temporary,'unpacked');mkdirSync(root);archive('unpack',path.resolve(input),root); }
+    const manifest=read(safe(root,'manifest.json'));validManifest(manifest,root);
+    const source=path.join(temporary,'source');mkdirSync(source);
+    for(const file of manifest.files)if(file.original_ref)write(source,file.original_ref,readFileSync(safe(root,file.path)));
+    const inspected=await inspectBackendDelivery(source,manifest.delivery_ref);
+    ensure(manifest.delivery_id===inspected.delivery.delivery_id&&manifest.version===inspected.delivery.version,'后端包身份不一致');
+    return await action({root,source,manifest,...inspected});
+  } finally { rmSync(temporary,{recursive:true,force:true}); }
+}
+
+export async function exportBackendDelivery({sourceRoot,deliveryRef,output,zip=false}) {
+  const root=project(sourceRoot), target=path.resolve(output);
+  ensure(!existsSync(target)&&(!zip||!existsSync(`${target}.zip`)),'后端包输出已存在');
+  const {delivery}=await inspectBackendDelivery(root,deliveryRef);
+  const refs=new Set([deliveryRef,'yss-project.yaml','CONTEXT.md','docs/agents/digital-human-roles.yaml',delivery.openapi.ref,delivery.openapi.approval_ref,delivery.slice_contract.ref,delivery.slice_contract.approval_ref,delivery.environment.test_data.ref,...delivery.supporting_files]);
+  for(const binding of Object.values(delivery.verification)) {
+    refs.add(binding.ref);
+    for(const result of read(safe(root,binding.ref)).results)for(const file of result.evidence)refs.add(file.ref);
+  }
+  // Keep the original strategic bytes and paths; offline validation reconstructs a temporary source view.
+  const strategy=safe(root,delivery.strategic_bundle_ref);
+  if(lstatSync(strategy).isDirectory())files(root,delivery.strategic_bundle_ref).forEach(ref=>refs.add(ref));
+  else refs.add(delivery.strategic_bundle_ref);
+  ensure(refs.size<=20000,'后端包文件数量超限');
+  const captured=[...refs].sort().map(ref=>({ref,bytes:readFileSync(safe(root,ref))}));
+  mkdirSync(path.dirname(target),{recursive:true});
+  const staging=mkdtempSync(path.join(path.dirname(target),'.backend-export-'));
+  try {
+    const entries=[];
+    for(const {ref,bytes} of captured) {
+      const name=ref==='CONTEXT.md'?'payload/source-context.snapshot.md':`payload/files/${ref}`;
+      write(staging,name,bytes);entries.push({path:name,original_ref:ref,size_bytes:bytes.length,sha256:hash(bytes)});
+    }
+    const body={schema_version:1,kind:'backend-delivery',delivery_id:delivery.delivery_id,version:delivery.version,delivery_ref:deliveryRef,files:entries};
+    const manifest={...body,bundle_digest:digest(body)};write(staging,'manifest.json',json(manifest));
+    await openBackendDelivery(staging,()=>null);
+    for(const {ref,bytes} of captured)ensure(hash(readFileSync(safe(root,ref)))===hash(bytes),`导出期间后端源资产变化: ${ref}`);
+    if(zip)archive('pack',staging,`${staging}.zip`);
+    ensure(!existsSync(target)&&(!zip||!existsSync(`${target}.zip`)),'后端包输出并发冲突');
+    renameSync(staging,target);if(zip)renameSync(`${staging}.zip`,`${target}.zip`);
+    return {result:'exported',delivery_id:delivery.delivery_id,version:delivery.version,bundle_digest:manifest.bundle_digest,output:target,...(zip?{zip:`${target}.zip`}:{})};
+  } finally { rmSync(staging,{recursive:true,force:true});rmSync(`${staging}.zip`,{force:true}); }
+}
+
+export async function importBackendDelivery({bundle,targetRoot}) {
+  const target=project(targetRoot);
+  return openBackendDelivery(bundle,async b=>{
+    const ref=`docs/backend-deliveries/${b.delivery.delivery_id}/${b.delivery.version}`;
+    const destination=safe(target,ref,{missing:true});
+    if(existsSync(destination)) {
+      const receipt=read(safe(destination,'import-receipt.json'));
+      ensure(receipt.bundle_digest===b.manifest.bundle_digest,'同 ID/version 后端包内容冲突');
+      await openBackendDelivery(safe(destination,'package'),()=>null);
+      return {result:'already-imported',receipt_ref:`${ref}/import-receipt.json`,acceptance_ref:`${ref}/frontend-acceptance-draft.json`};
+    }
+    const strategic=await importBundle({bundle:safe(b.source,b.delivery.strategic_bundle_ref),targetRoot:target});
+    const strategicReceipt=read(safe(target,strategic.receipt_ref));
+    const trace=read(safe(target,`${path.posix.dirname(strategic.receipt_ref)}/tactical-traceability-draft.json`));
+    mkdirSync(path.dirname(destination),{recursive:true});
+    const staging=mkdtempSync(path.join(path.dirname(destination),'.backend-import-'));
+    try {
+      cpSync(b.root,path.join(staging,'package'),{recursive:true,errorOnExist:true,force:false});
+      const receipt={schema_version:1,delivery_id:b.delivery.delivery_id,version:b.delivery.version,bundle_digest:b.manifest.bundle_digest,package_ref:`${ref}/package`};
+      write(staging,'import-receipt.json',json(receipt));
+      write(staging,'frontend-acceptance-draft.json',json({schema_version:1,status:'draft',slice_id:b.delivery.scope.slice_id,backend_delivery:{import_receipt_ref:`${ref}/import-receipt.json`,bundle_digest:b.manifest.bundle_digest},strategic_handoff:{import_receipt_ref:strategic.receipt_ref,bundle_digest:strategicReceipt.bundle_digest,context_reconciliation_ref:'',rows:trace.rows.map(({tactical_refs,test_seam_refs,...row})=>({...row,frontend_case_refs:[]}))},frontend_cases:[]}));
+      ensure(!existsSync(destination),'后端包导入并发冲突');renameSync(staging,destination);
+      return {result:'imported-pending-acceptance',receipt_ref:`${ref}/import-receipt.json`,acceptance_ref:`${ref}/frontend-acceptance-draft.json`};
+    } finally { rmSync(staging,{recursive:true,force:true}); }
+  });
+}

package/template/scripts/lib/context-contract.mjs

@@ -0,0 +1,203 @@
+import { createHash } from "node:crypto";
+import { existsSync, lstatSync, readFileSync, readdirSync } from "node:fs";
+import path from "node:path";
+
+const CONTEXT_FILE = "CONTEXT.md";
+const CONTEXT_MAP_FILE = "CONTEXT-MAP.md";
+const PASCAL_CASE = /^[A-Z][A-Za-z0-9]+$/;
+const TERM_REF = /^(Global|[A-Z][A-Za-z0-9]+)\/([A-Z][A-Za-z0-9]+)$/;
+const SKIP_DIRECTORIES = new Set([".git", ".codegraph", ".template-source", "node_modules", "dist", "build"]);
+
+function fail(messages, code = "context-contract-invalid") {
+  const error = new TypeError(messages.join("；"));
+  error.code = code;
+  error.problems = messages;
+  throw error;
+}
+
+function sha256(value) {
+  return `sha256:${createHash("sha256").update(value).digest("hex")}`;
+}
+
+function normalizedSource(source) {
+  return source.replace(/\r\n/g, "\n").replace(/[ \t]+$/gm, "").replace(/\n*$/, "\n");
+}
+
+function collectContextFiles(root) {
+  const found = [];
+  function visit(directory, relative = "") {
+    if (relative && existsSync(path.join(directory, ".git"))) return;
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+      if (entry.isSymbolicLink()) continue;
+      const entryRelative = relative ? `${relative}/${entry.name}` : entry.name;
+      const entryPath = path.join(directory, entry.name);
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRECTORIES.has(entry.name)) visit(entryPath, entryRelative);
+        continue;
+      }
+      if (entry.isFile() && [CONTEXT_FILE, CONTEXT_MAP_FILE, "context.md"].includes(entry.name)) found.push(entryRelative);
+    }
+  }
+  visit(root);
+  return found;
+}
+
+function splitRow(line) {
+  const value = line.trim();
+  if (!value.startsWith("|") || !value.endsWith("|")) return null;
+  return value.slice(1, -1).split("|").map((cell) => cell.trim());
+}
+
+function tableAfterHeading(lines, heading, expectedHeaders, problems) {
+  const headerVariants = Array.isArray(expectedHeaders[0]) ? expectedHeaders : [expectedHeaders];
+  const primaryHeaders = headerVariants[0];
+  const headingIndex = lines.findIndex((line) => line.trim() === heading);
+  if (headingIndex < 0) {
+    problems.push(`缺少 ${heading}`);
+    return [];
+  }
+  let headerIndex = headingIndex + 1;
+  while (headerIndex < lines.length && !lines[headerIndex].trim().startsWith("|") && !lines[headerIndex].trim().startsWith("## ")) headerIndex += 1;
+  const headers = splitRow(lines[headerIndex] || "");
+  if (!headerVariants.some((candidate) => JSON.stringify(headers) === JSON.stringify(candidate))) {
+    problems.push(`${heading} 表头必须是 ${headerVariants.map((candidate) => candidate.join(" | ")).join("；兼容旧项目时也接受 ")}`);
+    return [];
+  }
+  const separator = splitRow(lines[headerIndex + 1] || "");
+  if (!separator || separator.length !== primaryHeaders.length || separator.some((cell) => !/^:?-{3,}:?$/.test(cell))) {
+    problems.push(`${heading} 缺少合法 Markdown 表格分隔行`);
+    return [];
+  }
+  const rows = [];
+  for (let index = headerIndex + 2; index < lines.length; index += 1) {
+    const row = splitRow(lines[index]);
+    if (!row) break;
+    if (row.length !== primaryHeaders.length) {
+      problems.push(`${heading} 第 ${index + 1} 行列数应为 ${primaryHeaders.length}`);
+      continue;
+    }
+    rows.push({ line: index + 1, cells: row });
+  }
+  return rows;
+}
+
+function parseForbiddenAliases(value) {
+  const match = value.match(/(?:^|；)\s*避免[：:]\s*([^；]+)/);
+  if (!match) return [];
+  return match[1].split(/[、,，]/).map((item) => item.trim().replace(/^`|`$/g, "")).filter(Boolean);
+}
+
+function canonicalTerm(term) {
+  return {
+    term_ref: term.term_ref,
+    term: term.term,
+    meaning: term.meaning,
+    english_identifier: term.english_identifier,
+    context_id: term.context_id,
+    forbidden_aliases: [...term.forbidden_aliases].sort(),
+  };
+}
+
+export function parseContextContract({ root = process.cwd(), allowedContextIds } = {}) {
+  const absoluteRoot = path.resolve(root);
+  const contextPath = path.join(absoluteRoot, CONTEXT_FILE);
+  const problems = [];
+  const discovered = collectContextFiles(absoluteRoot);
+  if (!existsSync(contextPath) || !lstatSync(contextPath).isFile()) problems.push(`项目根目录缺少大小写精确的 ${CONTEXT_FILE}`);
+  const nested = discovered.filter((entry) => entry.endsWith(`/${CONTEXT_FILE}`));
+  if (nested.length) problems.push(`只允许项目根目录的 ${CONTEXT_FILE}，发现嵌套文件: ${nested.join(", ")}`);
+  const contextMaps = discovered.filter((entry) => entry === CONTEXT_MAP_FILE || entry.endsWith(`/${CONTEXT_MAP_FILE}`));
+  if (contextMaps.length) problems.push(`${CONTEXT_MAP_FILE} 在 YSS Context Contract 中禁止使用: ${contextMaps.join(", ")}`);
+  if (discovered.includes("context.md")) problems.push(`文件名大小写错误：必须使用根目录 ${CONTEXT_FILE}`);
+  if (problems.length || !existsSync(contextPath)) fail(problems);
+
+  return parseContextSource(readFileSync(contextPath, "utf8"), { allowedContextIds });
+}
+
+export function parseContextSource(text, { allowedContextIds } = {}) {
+  const problems = [];
+  const source = normalizedSource(text);
+  if (!/^---\ncontext_schema_version:\s*1\n---\n/.test(source)) problems.push("CONTEXT.md 顶部必须声明 context_schema_version: 1");
+  const lines = source.split("\n");
+  const processRows = tableAfterHeading(lines, "## 流程术语", ["术语", "含义", "英文标识", "避免 / 备注"], problems);
+  const businessRows = tableAfterHeading(lines, "## 业务术语", [
+    ["术语", "含义", "英文标识", "适用业务责任区", "避免 / 备注"],
+    ["术语", "含义", "英文标识", "适用限界上下文", "避免 / 备注"],
+  ], problems);
+
+  for (const row of processRows) {
+    if (row.cells.some((cell, index) => index < 3 && !cell)) problems.push(`流程术语第 ${row.line} 行存在空必填列`);
+    if (row.cells[2] !== "—") problems.push(`流程术语第 ${row.line} 行英文标识必须为 —`);
+  }
+
+  const terms = [];
+  const identities = new Map();
+  const scopedNames = new Map();
+  const scopedAliases = new Map();
+  const allowed = allowedContextIds ? new Set(allowedContextIds) : null;
+  for (const row of businessRows) {
+    const [term, meaning, englishIdentifier, contextId, notes] = row.cells;
+    if (![term, meaning, englishIdentifier, contextId].every(Boolean)) {
+      problems.push(`业务术语第 ${row.line} 行存在空必填列`);
+      continue;
+    }
+    if (!PASCAL_CASE.test(englishIdentifier)) problems.push(`业务术语第 ${row.line} 行英文标识必须是 PascalCase`);
+    if (contextId !== "Global" && !PASCAL_CASE.test(contextId)) problems.push(`业务术语第 ${row.line} 行适用业务责任区格式非法`);
+    if (allowed && contextId !== "Global" && !allowed.has(contextId)) problems.push(`业务术语 ${contextId}/${englishIdentifier} 的业务责任区未在业务边界与规则设计中登记`);
+    const termRef = `${contextId}/${englishIdentifier}`;
+    if (identities.has(termRef)) problems.push(`术语身份重复: ${termRef}`);
+    const scopedName = `${contextId}/${term}`;
+    if (scopedNames.has(scopedName)) problems.push(`同一作用域中文术语重复: ${scopedName}`);
+    const forbiddenAliases = parseForbiddenAliases(notes);
+    const aliasSet = scopedAliases.get(contextId) || new Set();
+    for (const alias of forbiddenAliases) {
+      if (aliasSet.has(alias) || scopedNames.has(`${contextId}/${alias}`)) problems.push(`同一作用域禁用别名冲突: ${contextId}/${alias}`);
+      aliasSet.add(alias);
+    }
+    scopedAliases.set(contextId, aliasSet);
+    const parsed = { term_ref: termRef, term, meaning, english_identifier: englishIdentifier, context_id: contextId, forbidden_aliases: forbiddenAliases, notes, line: row.line };
+    identities.set(termRef, parsed);
+    scopedNames.set(scopedName, parsed);
+    terms.push(parsed);
+  }
+
+  const globalTerms = terms.filter((term) => term.context_id === "Global");
+  for (const globalTerm of globalTerms) {
+    for (const localTerm of terms.filter((term) => term.context_id !== "Global")) {
+      if (globalTerm.term === localTerm.term || globalTerm.english_identifier === localTerm.english_identifier) problems.push(`Global 术语不得被局部上下文重新定义: ${globalTerm.term_ref} / ${localTerm.term_ref}`);
+    }
+  }
+  if (problems.length) fail(problems);
+  return { context_ref: CONTEXT_FILE, context_schema_version: 1, document_digest: sha256(source), process_terms: processRows.length, business_terms: terms, terms_by_ref: identities };
+}
+
+export function resolveContextTermRefs(contract, termRefs = []) {
+  const problems = [];
+  const resolved = [];
+  for (const termRef of termRefs) {
+    if (typeof termRef !== "string" || !TERM_REF.test(termRef)) {
+      problems.push(`术语引用格式非法: ${String(termRef)}；必须使用 <ContextId>/<EnglishIdentifier>`);
+      continue;
+    }
+    const term = contract.terms_by_ref.get(termRef);
+    if (!term) problems.push(`术语引用无法解析: ${termRef}`);
+    else resolved.push(term);
+  }
+  if (problems.length) fail(problems, "context-reference-invalid");
+  const canonical = resolved.map(canonicalTerm).sort((left, right) => left.term_ref.localeCompare(right.term_ref));
+  return { terms: resolved, referenced_terms_digest: sha256(JSON.stringify(canonical)) };
+}
+
+export function verifyContextSnapshot(snapshot, { root = process.cwd(), allowedContextIds } = {}) {
+  if (!snapshot || typeof snapshot !== "object" || Array.isArray(snapshot)) fail(["context_snapshot 必须是对象"]);
+  if (snapshot.context_ref !== CONTEXT_FILE) fail([`context_snapshot.context_ref 必须精确为 ${CONTEXT_FILE}`]);
+  if (snapshot.context_schema_version !== 1) fail(["context_snapshot.context_schema_version 必须为 1"]);
+  if (!Array.isArray(snapshot.term_refs)) fail(["context_snapshot.term_refs 必须是数组"]);
+  const contract = parseContextContract({ root, allowedContextIds });
+  const resolved = resolveContextTermRefs(contract, snapshot.term_refs);
+  const problems = [];
+  if (snapshot.document_digest !== contract.document_digest) problems.push("context_snapshot.document_digest 与当前 CONTEXT.md 不一致");
+  if (snapshot.referenced_terms_digest !== resolved.referenced_terms_digest) problems.push("context_snapshot.referenced_terms_digest 与引用术语不一致");
+  if (problems.length) fail(problems, "context-snapshot-stale");
+  return { ...contract, ...resolved };
+}

package/template/scripts/lib/digital-human-roles.mjs

@@ -197,7 +197,7 @@ function validateSignRule(rule, { actors, gateIds, claimed, field }) {
 }
 
 export function collectCountersignGateIds(policy) {
-  const ids = [];
+  const ids = [...(policy.unlisted_kept_biological || [])];
   for (const bucket of COUNTERSIGN_STRING_BUCKETS) {
     const gates = policy?.[bucket];
     if (Array.isArray(gates)) ids.push(...gates);
@@ -208,7 +208,12 @@ export function collectCountersignGateIds(policy) {
   for (const rule of policy?.dual_digital_human || []) {
     if (rule?.gate) ids.push(rule.gate);
   }
-  return ids;
+  if (policy.default_if_unlisted === "biological-human") {
+    for (const gate of loadRegistry().gates) {
+      if (!(policy.evidence_only || []).includes(gate.id) && !(policy.orchestrator || []).includes(gate.id)) ids.push(gate.id);
+    }
+  }
+  return [...new Set(ids)];
 }
 
 export function countersignRuleForGate(policy, gateId) {
@@ -222,6 +227,10 @@ export function countersignRuleForGate(policy, gateId) {
   if ((policy?.biological_human || []).includes(gateId)) {
     return { bucket: "biological_human", gate: gateId, countersigners: [BIOLOGICAL_ROLE_ID] };
   }
+  if ((policy?.evidence_only || []).includes(gateId) || (policy?.orchestrator || []).includes(gateId)) return null;
+  if (policy?.default_if_unlisted === "biological-human" && loadRegistry().gates.some((gate) => gate.id === gateId)) {
+    return { bucket: "biological_human", gate: gateId, countersigners: [BIOLOGICAL_ROLE_ID] };
+  }
   return null;
 }
 
@@ -323,7 +332,7 @@ export function validateDigitalHumanRoles(doc, { skillIds, stageIds, gateIds, ar
   }
   const claimed = new Set();
   for (const bucket of STRING_GATE_BUCKETS) {
-    requireStringArray(policy[bucket], `gate_policy.${bucket}`);
+    if (bucket !== "product_digital_human_with_biological_veto" || policy[bucket]?.length !== 0) requireStringArray(policy[bucket], `gate_policy.${bucket}`);
     for (const gate of policy[bucket]) {
       if (!gateIds.has(gate)) fail(`gate_policy.${bucket} 引用了未知门禁: ${gate}`);
       if (claimed.has(gate)) fail(`门禁被多个会签桶重复占用: ${gate}`);
@@ -370,6 +379,15 @@ export function validateDigitalHumanRoles(doc, { skillIds, stageIds, gateIds, ar
     if (claimed.has(gate)) fail(`unlisted_kept_biological 与会签桶重复: ${gate}`);
   }
 
+  const decisions = doc.user_decision_policy;
+  if (decisions?.schema_version !== 1 || decisions.default_responder !== "requester" || decisions.delegate_requires_requester_evidence !== true) fail("缺少统一用户决定策略");
+  requireStringArray(decisions.gates, "user_decision_policy.gates");
+  for (const gate of decisions.gates) if (!gateIds.has(gate)) fail(`用户决定引用未知门禁: ${gate}`);
+  for (const unit of Object.keys(decisions.work_units || {})) if (!workUnitIds.has(unit)) fail(`用户决定引用未知工作单元: ${unit}`);
+  if (!policy.biological_human.includes("gate.user-confirmation")) fail("gate.user-confirmation 必须由真实用户裁决");
+  for (const gate of [...(policy.unlisted_kept_biological || []), ...policy.biological_human]) {
+    if (!decisions.gates.includes(gate)) fail(`${gate} 缺少真实回复要求`);
+  }
   return {
     role_count: doc.roles.length,
     group_count: doc.stage_groups.length,

package/template/scripts/lib/first-slice-architecture.mjs

@@ -0,0 +1,23 @@
+/** 首切片验证的 MVC 适配器；命令执行与报告由统一验证核心持有。 */
+export function mvcFirstSliceProfile(identity) {
+  const application = identity.architecture_profile === "mvc-data-analysis-v1" ? "core" : "service";
+  const dto = identity.architecture_profile === "mvc-data-analysis-v1" ? "client" : "(?:server|client)";
+  return {
+    skills: ["yss-application", "yss-repository", "yss-mybatis", "yss-web-controller", "yss-dto", "yss-exception", "yss-validation", "mapstruct", "lombok", "alibaba-java-code-style"],
+    layers: [application, "repository", "server"],
+    artifacts: [
+      ["application-input", new RegExp(`-${application}/src/main/java/.+/(?:command|query)/.+\\.java$`)],
+      ["application-result", new RegExp(`-${application}/src/main/java/.+/result/.+\\.java$`)],
+      ["application-service", new RegExp(`-${application}/src/main/java/.+/service/.+Service(?:Impl)?\\.java$`)],
+      ["application-test", new RegExp(`-${application}/src/test/java/.+Tests?\\.java$`)],
+      ["repository-po", /-repository\/src\/main\/java\/.+\/po\/.+PO\.java$/],
+      ["repository", /-repository\/src\/main\/java\/.+Repository\.java$/],
+      ["repository-test", /-repository\/src\/test\/java\/.+Tests?\.java$/],
+      ["controller", /-server\/src\/main\/java\/.+Controller\.java$/],
+      ["web-convertor", /-server\/src\/main\/java\/.+WebConvertor\.java$/],
+      ["request", new RegExp(`-${dto}/src/main/java/.+/dto/request/.+Request\\.java$`)],
+      ["response", new RegExp(`-${dto}/src/main/java/.+/dto/response/.+Response\\.java$`)],
+      ["api-test", /-server\/src\/test\/java\/.+Tests?\.java$/]
+    ]
+  };
+}

package/template/scripts/lib/frontend-delivery-boundary.mjs

@@ -0,0 +1,49 @@
+import { loadDeliveryProfile } from './harness-execution-scope.mjs';
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { ROOT, read, safe, ensure, digest } from './strategic-handoff-io.mjs';
+
+// Shared synchronous adapter for existing compiler, lifecycle and task-package seams.
+// Always re-executes the verifier; a caller-supplied "verified" flag is never evidence.
+export function enforceFrontendDelivery(state={}, {root=ROOT,phase='inputs'}={}) {
+  const profile=loadDeliveryProfile(root);
+  let contract;
+  const contractRef=state.slice_contract_ref||state.contract?.slice_contract_ref;
+  const selected=profile?.profile_id==='harness.frontend-delivery'||profile?.frontend_delivery?.required===true;
+  const identity=selected?read(safe(root,'yss-project.yaml')):null;
+  if(selected)ensure(identity.schema_version===1&&['template-source','project-instance'].includes(identity.repository_mode),'前端项目仓库身份无效');
+  const dedicated=selected&&identity.repository_mode==='project-instance';
+  if(dedicated)ensure(state.contract?.kind!=='template-maintenance','前端产品项目不得用模板维护任务绕过输入条件');
+  let binding=state.frontend_delivery||state.frontend?.delivery||state.resolution?.frontend_delivery;
+  if(contractRef) {
+    // Legacy callers may supply an absolute external contract. Discover whether
+    // the new boundary applies before enforcing its repository-relative policy.
+    const file=path.resolve(root,contractRef);
+    if(existsSync(file)) {
+      const document=read(file);contract=document.slice_contract||document;
+      const direct=contract.frontend?.delivery, resolved=contract.resolution?.frontend_delivery;
+      ensure(!direct||!resolved||digest(direct)===digest(resolved),'Slice Contract 前端交付绑定冲突');
+      binding=direct||resolved||binding;
+    }
+  }
+  if(!dedicated&&!binding)return {result:'not-applicable'};
+  if(contractRef)safe(root,contractRef);
+  ensure(binding?.acceptance_ref,'frontend-delivery-required: 缺少战略与后端联合接收记录');
+  const slice=contract?.slice_id||state.slice_id;
+  ensure(!contract?.slice_id||!state.slice_id||contract.slice_id===state.slice_id,'前端任务与 Slice Contract 切片不一致');
+  ensure(slice,'frontend-delivery-required: 缺少明确切片');
+  if(phase==='implementation') {
+    ensure(contract?.status==='approved','frontend-delivery-required: 必须读取已持久化的 approved Slice Contract');
+    ensure(contract.frontend?.delivery||contract.resolution?.frontend_delivery,'frontend-delivery-required: Slice Contract 未绑定前端交付');
+    ensure(binding.digest,'frontend-delivery-required: Slice Contract 未冻结接收记录摘要');
+  }
+  const args=[path.join(ROOT,'scripts/verify-frontend-delivery'),'--root',root,'--slice',slice];
+  if(binding.digest)args.push('--expected-digest',binding.digest);
+  args.push(binding.acceptance_ref);
+  const verified=spawnSync(process.execPath,args,{cwd:root,encoding:'utf8',timeout:60000,maxBuffer:2*1024*1024});
+  ensure(verified.status===0,`frontend-delivery-blocked: ${verified.error?.message||verified.stderr||verified.stdout}`);
+  const result=JSON.parse(verified.stdout);
+  ensure(result.result==='inputs-verified'&&result.ready_for_agent===false,'前端接收校验返回非法状态');
+  return result;
+}