create-yss-spec 3.0.1 → 3.1.3

package/template/.codex/skills/yss-implementation-contract-compiler/SKILL.md

@@ -26,10 +26,12 @@ description: Use when a YSS vertical slice is entering implementation, spans mul
 
 ## 硬规则
 
+采用专职前端 profile 或显式 `frontend_delivery` 绑定时，先按 `docs/process/frontend-backend-delivery.md` 实际核验战略与后端联合交付。缺任一输入只能诊断和回交；输入通过后准备计划/合同，正式实现、生成和恢复仍须当前批准的 Slice Contract 冻结接收摘要。接口或部署版本漂移时重新接收，不复用旧成功输出。
+
 - 编译器不得输出 `approved`、`ready-for-agent` 或 `completed`。
 - Registry、Slice Contract 或编译器合同 schema v1 一律拒绝并给出迁移到 v2 的提示；不自动升级，不提供旧技能名兼容。
 - `required_capabilities` 与 `required_skills` 必须同时冻结；Registry 或编译器摘要变化后合同立即 `stale`，重新编译后仍须交生命周期重新批准。
-- UI 影响缺少正式原型确认时，不得路由页面实现。
+- UI 影响缺少正式原型确认、批准且 digest 当前的 Visual Baseline manifest 或当前切片 `case_id` 时，不得路由页面实现。模型必须先读 manifest 与语义引用，再查看对应 PNG；禁止目录 glob 和图片独立猜义。
 - Repository/数据模型影响缺少数据架构时，不得路由持久化实现。
 - 领域影响缺少批准且版本当前的 tactical-design contract 时，不得路由 Domain 实现；无领域影响必须记录 `not-applicable`。
 - API 变化必须回到生命周期 Draft/Review/Freeze；半成品 backend 不得冒充稳定 source of truth。
@@ -37,7 +39,7 @@ description: Use when a YSS vertical slice is entering implementation, spans mul
 - Harness 内实现路径必须落在 `apps/backend/<project>/` 或 `apps/frontend/<project>/` 的具体项目目录；`apps/backend/`、`apps/frontend/` 只能作为容器，`app/backend/`、`app/frontend/` 及其子路径一律阻断。外部实现仓库使用其登记的真实项目根路径。`git-submodule` 使用 `implementation_path_policy: git-submodule-harness-apps`，空 gitlink、detached HEAD 或 `--force` 覆盖挂载点不得脚手架；`inspectWorkingTreeScope.writable` 必须为显式布尔值。
 - 当前用户、缓存、审计、Excel、分布式 ID、请求校验、错误映射、加解密或网关韧性命中时，必须按 `compiler-contract.yaml` 的 `impact_to_capabilities` 补齐入口 capability；不能只在 `boundaries.md` 中提及。仅复用已经验证的平台认证 / 授权能力不算 component impact，不自动增加权限专项 skill。
 - 业务行为使用 `behavior-tdd`；只有机械脚手架/生成物可用 `controlled-generation`，并记录例外和验证。
-- 原型确认后若 backend `scaffold_status=required`，先由本编译器按 `scaffold_contract_schema` 编译 `yss-ddd-scaffold-generator` 的 `controlled-generation` 工作单元合同 draft；合同必须带 `contract_id`、`contract_version`、compiler draft、生命周期批准、持久化引用、允许写路径、预期证据和验证命令。经生命周期编排器批准并持久化后才能运行生成器，再由受控工作单元实际执行固定的 `./mvnw validate`、`./mvnw test`、`./mvnw package` 并记录逐条结果，随后加载 `yss-backend-scaffold-parent` 并重新编译业务合同；脚手架不承载业务行为。
+- 原型确认后若 backend `scaffold_status=required`，必须先读取工程基线中的 `scaffold-architecture-decisions.yaml`。编译器按已达到 `lifecycle-approved` 且 digest 当前的选择，把 `domain-driven` 解析为 `backend.ddd-scaffold` / `yss-ddd-scaffold-generator`，把 `layered-mvc` 解析为 `backend.mvc-scaffold` / `yss-layered-mvc-scaffold-generator`；处于 `undecided`、`recommended`、`awaiting-user-decision` 或 `stale` 时返回 `blocked`，不得默认 DDD。随后按 `scaffold_contract_schema` v3 编译 `controlled-generation` 工作单元合同 draft；合同必须带选择引用与 digest、`generator_skill`、Profile、能力模块闭包、批准/持久化引用、允许写路径、预期证据和验证命令。经生命周期批准并持久化后才能运行对应生成器，再由受控工作单元实际执行固定的 `./mvnw validate`、`./mvnw test`、`./mvnw package` 并记录逐条结果，随后重新编译业务合同；脚手架不承载业务行为。
 - 脚手架合同在编译阶段只能是 `draft` / `ready-for-lifecycle-review` / `blocked`；只有生命周期编排器可以把已持久化脚手架合同标记为 `approved`。脚手架合同只覆盖业务代码前的工程骨架工作单元；生成、基线校验和合同重编译完成后，它不能替代脚手架后的 Slice Implementation Contract。
 - 脚手架输出消费批准的脚手架合同；脚手架后的所有生成后端代码都必须绑定当前批准且版本当前的 Slice Implementation Contract、主 YSS skill、依赖闭包、允许写路径、预期证据和 YSS Skill Execution Result。打印命令、`./mvnw validate` 单项通过或脚手架成功不能替代合同批准；生成范围从机械内容变成业务行为时触发完整重路由。
 - 专项结果中的越界路径、缺失证据、`drift`、`violation` 或 `new_impacts` 必须阻断或重路由。
@@ -53,3 +55,9 @@ description: Use when a YSS vertical slice is entering implementation, spans mul
 ## 输出
 
 输出合同草案、capability/Recipe 解析记录、技能依赖闭包、不适用理由、阻塞项、TDD 模式、工作单元、预期证据、验证命令、人工审查点、完整重路由触发器，以及建议的 `suggested_owner_role_id`（UI 影响 → `role.frontend-engineer`，后端影响 → `role.backend-engineer`，测试/审查 → `role.test-engineer`）。自然语言说明不能替代结构化合同字段。编译器不得自行批准合同、设置 `ready-for-agent` 或关闭会签门禁；owner 建议只供主控派活。
+
+## 战略交接快照包
+
+跨仓交接使用 `scripts/strategic-handoff export / verify / import`。正式导出前补齐源战略的稳定规则 ID、关键场景和当前批准绑定；源资产原字节冻结、包内路径通过清单解析。目标导入只产生快照和对账/承接草案，正式 reconciliation 通过后才能进入战术设计。流程与字段见 `docs/process/strategic-handoff-package.md`。
+
+战术合同必须绑定 `strategic_handoff` 导入收据、包摘要、正式目标对账及逐条承接 rows。来自导入包时禁止仅填 `upstream_current: true`。批准前执行 `scripts/verify-strategic-handoff-consumption --root <target> <tactical>`；存在受控延期时按切片执行 `--slice <slice-id>`，实际核验通过且合同批准后才可继续相关切片。最新源规则、关键场景或资产变化使依赖项 stale；未知依赖扩大阻断，业务冲突回交战略方。结果绑定当前包与战术摘要，不能复用旧输出宣布 ready-for-agent。

package/template/.codex/skills/yss-implementation-contract-compiler/references/boundaries.md

@@ -18,6 +18,9 @@
 
 | Capability | Primary skill | Task modes |
 | --- | --- | --- |
+| `layer.mvc-service` | `yss-application` | `guidance`, `integration`, `slice-implementation`, `troubleshooting`, `review-input` |
+| `layer.mvc-persistence` | `yss-repository` | `guidance`, `integration`, `slice-implementation`, `troubleshooting`, `review-input` |
+| `layer.mvc-web` | `yss-web-controller` | `guidance`, `integration`, `slice-implementation`, `troubleshooting`, `review-input` |
 | `governance.implementation-contract` | `yss-implementation-contract-compiler` | `contract-compilation`, `reroute`, `result-validation` |
 | `maintenance.skill-source-index` | `yss-skill-source-index-refresh` | `component-maintenance`, `source-index-refresh` |
 | `architecture.tactical-domain` | `yss-tactical-design` | `guidance`, `integration`, `slice-implementation`, `review-input` |
@@ -40,7 +43,8 @@
 | `component.security-algorithm` | `yss-security-algorithm` | `guidance`, `integration`, `slice-implementation`, `troubleshooting`, `component-maintenance`, `review-input` |
 | `component.gateway-resilience` | `yss-resilience4j` | `guidance`, `integration`, `slice-implementation`, `troubleshooting`, `component-maintenance`, `review-input` |
 | `scaffold.ddd` | `yss-ddd-scaffold-generator` | `integration`, `component-maintenance` |
-| `scaffold.mvc` | `yss-mvc-scaffold-generator` | `integration`, `component-maintenance` |
+| `scaffold.layered-mvc` | `yss-layered-mvc-scaffold-generator` | `integration`, `component-maintenance` |
+| `project-init.mvc-data-analysis` | `yss-mvc-data-analysis-project-initializer` | `component-maintenance` |
 | `migration.springboot3` | `yss-up-springboot3` | `guidance`, `integration`, `troubleshooting`, `component-maintenance`, `review-input` |
 
 ## Narrow Recipes
@@ -49,6 +53,12 @@
 
 | Recipe | Capabilities |
 | --- | --- |
+| `backend.ddd-domain-behavior` | `layer.domain`, `layer.application`, `quality.java-code-style` |
+| `backend.ddd-persistence-mybatis` | `layer.persistence`, `framework.mybatis`, `codegen.mapstruct`, `codegen.lombok`, `quality.java-code-style` |
+| `backend.ddd-http-api` | `layer.web-adapter`, `contract.dto-wire`, `contract.request-validation`, `contract.error-mapping`, `codegen.mapstruct`, `codegen.lombok`, `quality.java-code-style` |
+| `backend.mvc-service-behavior` | `layer.mvc-service`, `quality.java-code-style` |
+| `backend.mvc-persistence-mybatis` | `layer.mvc-persistence`, `framework.mybatis`, `codegen.mapstruct`, `codegen.lombok`, `quality.java-code-style` |
+| `backend.mvc-http-api` | `layer.mvc-web`, `contract.dto-wire`, `contract.request-validation`, `contract.error-mapping`, `codegen.mapstruct`, `codegen.lombok`, `quality.java-code-style` |
 | `backend.domain-behavior` | `layer.domain`, `layer.application`, `quality.java-code-style` |
 | `backend.persistence-mybatis` | `layer.persistence`, `framework.mybatis`, `codegen.mapstruct`, `codegen.lombok`, `quality.java-code-style` |
 | `backend.http-api` | `layer.web-adapter`, `contract.dto-wire`, `contract.request-validation`, `contract.error-mapping`, `codegen.mapstruct`, `codegen.lombok`, `quality.java-code-style` |
@@ -60,7 +70,7 @@
 | `backend.security-algorithm` | `component.security-algorithm`, `contract.error-mapping` |
 | `backend.distributed-id` | `component.distributed-id` |
 | `backend.ddd-scaffold` | `scaffold.ddd`, `quality.java-code-style` |
-| `backend.mvc-scaffold` | `scaffold.mvc`, `quality.java-code-style` |
+| `backend.mvc-scaffold` | `scaffold.layered-mvc`, `quality.java-code-style` |
 | `backend.springboot3-migration` | `migration.springboot3`, `quality.java-code-style` |
 
 ## Impact Entry Mapping
@@ -84,7 +94,7 @@
 | `encryption-or-signing` | `component.security-algorithm` |
 | `gateway-resilience` | `component.gateway-resilience` |
 | `ddd-scaffold` | `scaffold.ddd` |
-| `mvc-scaffold` | `scaffold.mvc` |
+| `mvc-scaffold` | `scaffold.layered-mvc` |
 | `springboot3-migration` | `migration.springboot3` |
 
 ## Typed Skill Dependencies
@@ -93,9 +103,11 @@
 | --- | --- | --- | --- |
 | `yss-prototype-stage` | `prototype-review` | `review-only` | — |
 | `yss-prototype-stage` | `yss-design-system` | `coordination-only` | — |
-| `yss-prototype-stage` | `yss-antd-design` | `context-conditional` | `h2-react-antd` |
+| `yss-prototype-stage` | `yss-antdv-next-design` | `context-conditional` | `h2-vue-antdv-next-default` |
+| `yss-prototype-stage` | `yss-antd-design` | `context-conditional` | `h2-react-antd-explicit-compatibility` |
 | `yss-ddd-scaffold-generator` | `yss-backend-scaffold-parent` | `context-required` | — |
 | `yss-ddd-scaffold-generator` | `alibaba-java-code-style` | `context-required` | — |
+| `yss-layered-mvc-scaffold-generator` | `alibaba-java-code-style` | `context-required` | — |
 | `yss-domain` | `alibaba-java-code-style` | `context-required` | — |
 | `yss-domain` | `domain-modeling` | `coordination-only` | — |
 | `yss-domain` | `yss-tactical-design` | `context-conditional` | `tactical-domain` |
@@ -127,8 +139,4 @@
 | `yss-ui-business-page-generation` | `yss-hook` | `context-conditional` | `hooks` |
 | `yss-ui-business-page-generation` | `yss-formily` | `context-conditional` | `form` |
 | `yss-ui-business-page-generation` | `yss-api-integration` | `context-conditional` | `api` |
-| `yss-page-module-development` | `yss-components` | `context-conditional` | `components` |
-| `yss-page-module-development` | `yss-hook` | `context-conditional` | `hooks` |
-| `yss-page-module-development` | `yss-formily` | `context-conditional` | `form` |
-| `yss-page-module-development` | `yss-api-integration` | `context-conditional` | `api` |
 | `yss-api-integration` | `yss-openapi-governance` | `context-conditional` | `regeneration` |

package/template/.codex/skills/yss-implementation-contract-compiler/references/compiler-contract.yaml

@@ -1,4 +1,11 @@
 schema_version: 2
+backend_architecture:
+  registry_source: docs/agents/yss-skill-registry.yaml
+  identity_schema: docs/process/schemas/backend-architecture-identity.schema.json
+  required_evidence: [engineering_baseline, repository_registration, manifest]
+  required_identity_surfaces: [resolution, work_unit, execution_result]
+  family_recipe_selection: explicit-ddd-or-mvc-no-legacy-alias
+  readiness: supported-profile-and-current-identical-evidence
 compiled_by: yss-implementation-contract-compiler
 approved_by: yss-product-lifecycle
 capability_source: docs/agents/yss-skill-registry.yaml
@@ -54,6 +61,12 @@ readiness:
   data_impact: [data_architecture]
   backend_impact: [engineering_baseline, backend_repository, maven_wrapper]
   cross_repo: [repository_registry, delivery_order, integration_verification, rollback_order]
+  frontend_delivery:
+    when: specialized-frontend-profile-or-explicit-frontend-delivery-binding
+    source: docs/process/frontend-backend-delivery.md
+    verifier: scripts/verify-frontend-delivery
+    output_binding: frontend.delivery
+    inputs_verified_is_implementation_approval: false
 
 compiler_input_required:
   - slice_id
@@ -70,11 +83,11 @@ exclusive_flags:
 
 slice_contract_required:
   root: [schema_version, contract_id, contract_version, slice_id, status, lifecycle_refs, readiness, resolution, common, frontend, backend, contract, cross_repo, work_units]
-  lifecycle_refs: [spec, ticket, requirement_freeze, low_fidelity_review, prototype_review, prototype_profile_decision, prototype_deliverable, prototype_deliverable_verification, prototype_confirmation, openapi_freeze_or_no_impact, architecture_review, data_architecture, tactical_design, engineering_baseline, build_architecture_checklist, implementation_repository, frontend_repository, backend_repository, maven_wrapper]
+  lifecycle_refs: [spec, ticket, requirement_freeze, low_fidelity_review, prototype_review, prototype_profile_decision, prototype_deliverable, prototype_deliverable_verification, visual_baseline, prototype_confirmation, openapi_freeze_or_no_impact, architecture_review, data_architecture, tactical_design, engineering_baseline, build_architecture_checklist, implementation_repository, frontend_repository, backend_repository, maven_wrapper]
   readiness: [blockers, stale_inputs, not_applicable]
   resolution: [required_capabilities, required_skills, recipe_ids, conditions, reason_chains, registry_digest, compiler_contract_digest, compiled_at, freshness]
   common: [impacted_areas, implementation_path_policy, project_roots, required_capabilities, required_skills, optional_skills, unavailable_skills, allowed_write_paths, forbidden_patterns, expected_evidence_files, verification_commands, human_review_points, full_reroute_triggers, quality_baseline_ref, context_plan, doubt_driven_review]
-  frontend: [status, required_skills, approved_prototype_ref, state_matrix_ref, allowed_write_paths, component_test_seams, e2e_paths]
+  frontend: [status, required_skills, approved_prototype_ref, state_matrix_ref, visual_baseline_ref, visual_baseline_case_ids, allowed_write_paths, component_test_seams, e2e_paths]
   backend: [status, affected_layers, component_impacts, required_skills, application_boundary, transaction_boundary, persistence_strategy, allowed_write_paths, forbidden_patterns, expected_evidence_files, seam_deferred, verification_commands, tactical_ddd]
   contract: [api_impact, freeze_ref, no_api_impact_ref, generated_clients, contract_tests, regeneration_commands]
   cross_repo: [repositories, delivery_order, integration_verification, rollback_order]
@@ -91,6 +104,7 @@ lifecycle_ref_by_readiness:
   prototype_profile_decision: prototype_profile_decision
   prototype_deliverable: prototype_deliverable
   prototype_deliverable_verification: prototype_deliverable_verification
+  visual_baseline: visual_baseline
   prototype_confirmation: prototype_confirmation
   openapi_freeze: openapi_freeze_or_no_impact
   no_api_impact_record: openapi_freeze_or_no_impact
@@ -124,14 +138,23 @@ context_plan:
   missing_context_action: [blocked, reroute]
 
 scaffold_contract_schema:
-  schema_version: 2
+  schema_version: 3
   identity: service-engineering-baseline
   compiled_by: yss-implementation-contract-compiler
   approved_by: yss-product-lifecycle
   status_by_owner:
     compiler: [draft, ready-for-lifecycle-review, blocked]
     lifecycle: [approved, stale, blocked]
-  required: [contract_id, contract_version, scaffold_request_id, status, compiler_draft_ref, lifecycle_approval_ref, persisted_ref, current_version, implementation_repository, backend_repository, scaffold_status, project_name, target_output_dir, base_package, maven_coordinates, profiles, allowed_write_paths, expected_evidence_files, verification_commands, approval, work_unit, generation_policy]
+  required: [contract_id, contract_version, scaffold_request_id, status, compiler_draft_ref, lifecycle_approval_ref, persisted_ref, current_version, implementation_repository, backend_repository, scaffold_status, project_name, target_output_dir, base_package, architecture_family, generator_skill, decision_ref, decision_id, decision_digest, maven_coordinates, profiles, module_profile, allowed_write_paths, expected_evidence_files, verification_commands, approval, work_unit, generation_policy]
+  architecture_decision:
+    source: scaffold-architecture-decisions.yaml
+    required_status: lifecycle-approved
+    allowed_architectures: [domain-driven, layered-mvc]
+    blocked_statuses: [undecided, recommended, awaiting-user-decision, stale]
+    reference: [decision_ref, decision_id, decision_digest]
+    no_silent_default: true
+    user_confirmation_required: true
+    change_action: stale-and-recompile
   approval:
     required: [approval_ref, approver, persisted_ref, current_version]
   generation_policy:
@@ -145,29 +168,52 @@ scaffold_contract_schema:
     parent_required: [group_id, artifact_id, version]
     yss_components_version: 2.0.0-SNAPSHOT
   profiles:
-    required: [architecture, persistence, database, platform, validation_namespace, dto_placement, repository]
-    supported_initial:
-      architecture: target-domain-model
-      persistence: mybatis-plus
-      database: mysql
-      platform: spring-boot-2.7-jdk8
-      validation_namespace: javax
-      dto_placement: web
-      repository: yss-internal
-    unsupported: [old-architecture-profile, client-in-domain, mybatis, spring-boot-3, jakarta, separate-client-module]
+    discriminant: architecture_family
+    domain-driven:
+      generator_skill: yss-ddd-scaffold-generator
+      required: [architecture, persistence, verification_database, production_database, platform, validation_namespace, dto_placement, repository]
+      supported_initial: { architecture: target-domain-model, persistence: mybatis-plus, verification_database: h2, production_database: not-bound, platform: spring-boot-2.7-jdk8, validation_namespace: javax, dto_placement: web, repository: yss-internal }
+      resolved_modules: [domain, application, infrastructure, adapter, bootstrap]
+    layered-mvc:
+      generator_skill: yss-layered-mvc-scaffold-generator
+      required: [architecture, persistence, verification_database, production_database, platform, validation_namespace, repository]
+      supported_initial:
+        architecture: layered-mvc
+        persistence: mybatis-plus
+        verification_database: h2
+        production_database: not-bound
+        platform: spring-boot-2.7-jdk8
+        validation_namespace: javax
+        repository: yss-internal
+      module_resolution:
+        version: 1
+        core: [server, service, repository]
+        capabilities:
+          external-integration: [adapter]
+          published-client: [client]
+          feign-client: [client, feign-client]
+    unsupported: [old-architecture-profile, mybatis, spring-boot-3, jakarta, arbitrary-module-combination]
+  module_profile:
+    required: [requested_capabilities, resolved_modules, resolution_version]
+    resolution_version: 1
+    freeze_both_request_and_resolution: true
+    digest_change_status: stale
   unsupported_inputs:
     schema_v1: reject-no-auto-upgrade
+    schema_v2_new_generation: reject-no-auto-upgrade
     slice_id: forbidden-as-scaffold-identity
     existing_project: reject-no-scaffold-migration
   lifecycle_boundary:
     compiler_emits: [draft, ready-for-lifecycle-review, blocked]
     lifecycle_approves: [approved]
     generator_consumes: [approved]
-    after_generation: [yss-backend-scaffold-parent, yss-implementation-contract-compiler]
+    after_generation:
+      domain-driven: [yss-backend-scaffold-parent, yss-implementation-contract-compiler]
+      layered-mvc: [yss-implementation-contract-compiler]
   work_unit:
     required: [id, behavior, primary_skill, supporting_skills, tdd_mode, allowed_write_paths, expected_evidence, verification_commands, controlled_generation]
   generation_boundary:
-    allowed_for: [project_scaffold, pom, mechanical_config, wrapper, bootstrap_entrypoint, manifest_v2, architecture_rules, test_infrastructure]
+    allowed_for: [project_scaffold, pom, mechanical_config, wrapper, bootstrap_entrypoint, manifest_v3, architecture_rules, test_infrastructure]
     forbidden_when: [business_behavior, business_fields, business_state, permission, transaction, complex_query, error_mapping, business_example_crud]
     initialization: initialize-only
     regeneration: unsupported
@@ -182,8 +228,8 @@ scaffold_contract_schema:
 
 applicable_subcontract_nonempty:
   frontend:
-    scalar: [approved_prototype_ref, state_matrix_ref]
-    array: [required_skills, allowed_write_paths, component_test_seams, e2e_paths]
+    scalar: [approved_prototype_ref, state_matrix_ref, visual_baseline_ref]
+    array: [required_skills, visual_baseline_case_ids, allowed_write_paths, component_test_seams, e2e_paths]
   backend:
     scalar: [application_boundary, transaction_boundary, persistence_strategy]
     array: [affected_layers, required_skills, allowed_write_paths, forbidden_patterns, expected_evidence_files, verification_commands]
@@ -217,7 +263,7 @@ impact_to_capabilities:
   encryption-or-signing: [component.security-algorithm]
   gateway-resilience: [component.gateway-resilience]
   ddd-scaffold: [scaffold.ddd]
-  mvc-scaffold: [scaffold.mvc]
+  mvc-scaffold: [scaffold.layered-mvc]
   springboot3-migration: [migration.springboot3]
 
 tdd_modes:
@@ -229,9 +275,13 @@ tdd_modes:
 
 full_reroute_triggers:
   - scaffold-baseline-drift
+  - scaffold-architecture-decision-changed
+  - scaffold-profile-changed
+  - scaffold-module-resolution-changed
   - api-schema-impact
   - database-schema-impact
   - state-machine-impact
+  - visual-baseline-version-or-digest-changed
   - data-model-impact
   - new-write-path
   - new-repository
@@ -312,3 +362,12 @@ seam_deferred_required: [risk, owner, follow_up_ticket, verification_plan, targe
 deviation_required: [rule, reason, approval_ref]
 not_applicable_required: [item, reason]
 unavailable_skill_required: [skill, provider, fallback, resolution]
+
+strategic_handoff_consumption:
+  when: upstream-source-is-imported-strategic-handoff
+  required: [import_receipt_ref, bundle_digest, context_reconciliation_ref, rows]
+  verification: scripts/verify-strategic-handoff-consumption --root <target> --slice <slice-id> <approved-tactical-contract>
+  require_actual_exit_code: 0
+  stale_policy: latest-imported-source-digest-and-dependent-slices
+  unknown_dependency: block-all
+  compiler_must_not_approve: true

package/template/.codex/skills/yss-implementation-contract-compiler/references/slice-implementation-contract.md

@@ -1,7 +1,11 @@
 # Slice Implementation Contract
 
+后端合同还必须绑定 `architecture_identity`（schema 见 `docs/process/schemas/backend-architecture-identity.schema.json`），并与工程基线、登记和 Manifest 一致。将同一身份复制到 `resolution`、backend 工作单元和执行结果；Profile 的成熟度/Recipe 来源是技能注册表，draft 不得 ready-for-agent。旧 backend.domain-behavior/persistence-mybatis/http-api Recipe 只读退役，重新编译时显式选择 backend.ddd-* 或 backend.mvc-*。
+
 `yss-implementation-contract-compiler` 生成草案；`yss-product-lifecycle` 核验、批准并持久化。合同缺少必填字段时状态为 `blocked`。schema v1 已停止支持，必须重新编译为 v2，不提供自动升级。
 
+采用专职前端 profile 时，`frontend.delivery` 绑定 `{acceptance_ref, digest}`，来自 `scripts/verify-frontend-delivery` 的当前结果；也可由 `resolution.frontend_delivery` 承载，两处并存时必须一致。正式执行从持久化合同读取并重验输入。细则见 `docs/process/frontend-backend-delivery.md`。
+
 ```yaml
 slice_contract:
   schema_version: 2
@@ -83,6 +87,8 @@ slice_contract:
     required_skills: []
     approved_prototype_ref:
     state_matrix_ref:
+    visual_baseline_ref:
+    visual_baseline_case_ids: []
     generated_api_client_ref:
     allowed_write_paths: []
     component_test_seams: []
@@ -194,4 +200,4 @@ work_unit:
 
 `work_units` 中的前端、后端和测试任务是切片级子任务，不是新的生命周期阶段。每个子任务必须引用独立任务包；任务包只能消费同一份已批准且版本当前的 Slice Contract。`workflow_status` 追踪执行过程，不能替代生命周期状态；`contract_id`、`contract_version` 或 resolution digest 不一致时必须阻断并回到实现合同编译器。
 
-一个切片可以组合多个窄 Recipe，但只计算一次闭包。Recipe 只能引用 capability；合同同时冻结 `required_capabilities`、`required_skills`、完整原因链和 Registry/Compiler digest。任一 digest 改变时，当前合同标记 `stale`，重新编译后仍须由 `yss-product-lifecycle` 再批准。
+一个切片可以组合多个窄 Recipe，但只计算一次闭包。Recipe 只能引用 capability；合同同时冻结 `required_capabilities`、`required_skills`、完整原因链和 Registry/Compiler digest。任一 digest 或 Visual Baseline 版本 / digest 改变时，当前合同标记 `stale`，重新编译后仍须由 `yss-product-lifecycle` 再批准。UI 切片只消费 `visual_baseline_case_ids` 指定的图片，并先读取 manifest 与语义引用，禁止按目录 glob 猜测图片含义。

package/template/.codex/skills/yss-implementation-contract-compiler/references/yss-skill-execution-result.md

@@ -2,6 +2,8 @@
 
 核心 YSS skill 必须消费已批准合同版本，并返回：
 
+后端结果顶层带与当前 resolution 完全一致的 `architecture_identity`；每条验证记录还须有整数 `exit_code`。身份缺失、Profile 未 supported、验证非零或没有执行时间均不得 accepted。
+
 ```yaml
 execution_result:
   schema_version: 2

package/template/.codex/skills/yss-implementation-contract-compiler/tests/backend-profiles.test.mjs

@@ -0,0 +1,45 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { compileDefaultImplementationContract } from "../../../../scripts/lib/implementation-contract-compiler.mjs";
+import { validateArchitectureIdentity } from "../../../../scripts/lib/backend-architecture.mjs";
+import { loadSkillRegistry } from "../../../../scripts/lib/skill-registry.mjs";
+
+const registry = loadSkillRegistry();
+function input(name) {
+  const profile = registry.architecture_profiles[name];
+  const identity = { architecture_family: profile.architecture_family, architecture_profile: name,
+    generator_skill: profile.generator_skill, requested_capabilities: [], resolved_modules: profile.core_modules,
+    verification_database: "h2", production_database: "not-bound", contract_digest: "a".repeat(64) };
+  return { architecture_identity: identity, architecture_evidence: {
+    engineering_baseline: identity, repository_registration: identity, manifest: identity
+  }};
+}
+
+for (const name of Object.keys(registry.architecture_profiles)) {
+  test(`${name} selects architecture recipe and explicit Skill Profile`, () => {
+    const data = input(name);
+    const mvc = data.architecture_identity.architecture_family === "layered-mvc";
+    const result = compileDefaultImplementationContract({ ...data,
+      recipeIds: [mvc ? "backend.mvc-service-behavior" : "backend.ddd-domain-behavior", mvc ? "backend.mvc-http-api" : "backend.ddd-http-api"] });
+    assert.equal(result.required_skills.includes("yss-domain"), !mvc);
+    assert.equal(result.skill_profiles["yss-application"], name);
+    assert.equal(result.skill_profiles["yss-web-controller"], name);
+    assert.ok(result.readiness_blockers.includes("backend-profile-not-supported"));
+  });
+}
+
+test("rejects missing identity, deprecated recipe, wrong family and stale evidence", () => {
+  assert.throws(() => compileDefaultImplementationContract({ recipeIds: ["backend.mvc-http-api"] }), /architecture_identity/);
+  assert.throws(() => compileDefaultImplementationContract({ recipeIds: ["backend.http-api"] }), /deprecated/);
+  assert.throws(() => compileDefaultImplementationContract({ ...input("layered-mvc-service"), recipeIds: ["backend.ddd-http-api"] }), /架构族/);
+  const stale = input("layered-mvc-service");
+  stale.architecture_evidence.manifest = { ...stale.architecture_identity, contract_digest: "b".repeat(64) };
+  assert.throws(() => compileDefaultImplementationContract({ ...stale, recipeIds: ["backend.mvc-http-api"] }), /stale/);
+});
+
+test("rejects unsupported capability closure and production driver defaults", () => {
+  const identity = input("mvc-data-analysis-v1").architecture_identity;
+  assert.throws(() => validateArchitectureIdentity({ ...identity, resolved_modules: ["server"] }), /模块闭包/);
+  assert.throws(() => validateArchitectureIdentity({ ...identity, production_database: "oracle" }), /H2/);
+  assert.throws(() => compileDefaultImplementationContract({ ...input("layered-mvc-service"), requiredCapabilities: ["layer.domain"] }), /不匹配/);
+});

package/template/.codex/skills/yss-implementation-contract-compiler/tests/compiler-scenarios.test.mjs

@@ -12,17 +12,19 @@ import { loadSkillRegistry } from "../../../../scripts/lib/skill-registry.mjs";
 const registry = loadSkillRegistry();
 const compilerContract = loadCompilerContract();
 const fixed = "2026-09-04T00:00:00.000Z";
-const compile = (input) => compileImplementationContract({ registry, compilerContract, compiledAt: fixed, ...input });
+const identity = { architecture_family: "domain-driven", architecture_profile: "target-domain-model", generator_skill: "yss-ddd-scaffold-generator", requested_capabilities: [], resolved_modules: ["domain", "application", "infrastructure", "adapter", "bootstrap"], verification_database: "h2", production_database: "not-bound", contract_digest: "a".repeat(64) };
+const architecture = { architecture_identity: identity, architecture_evidence: { engineering_baseline: identity, repository_registration: identity, manifest: identity } };
+const compile = (input) => compileImplementationContract({ registry, compilerContract, compiledAt: fixed, ...architecture, ...input });
 
 test("combines narrow recipes once and preserves deterministic output", () => {
   const input = {
-    recipeIds: ["backend.http-api", "backend.domain-behavior", "backend.persistence-mybatis"],
+    recipeIds: ["backend.ddd-http-api", "backend.ddd-domain-behavior", "backend.ddd-persistence-mybatis"],
     conditions: ["mybatis", "conversion", "pojo", "request-validation", "error-mapping"]
   };
   const first = compile(input);
   const second = compile({ ...input, recipeIds: [...input.recipeIds].reverse(), conditions: [...input.conditions].reverse() });
   assert.deepEqual(first, second);
-  assert.deepEqual(first.recipe_ids, ["backend.domain-behavior", "backend.persistence-mybatis", "backend.http-api"]);
+  assert.deepEqual(first.recipe_ids, ["backend.ddd-domain-behavior", "backend.ddd-persistence-mybatis", "backend.ddd-http-api"]);
   for (const skill of ["yss-domain", "yss-application", "yss-repository", "yss-mybatis", "yss-web-controller", "yss-dto", "yss-validation", "yss-exception", "mapstruct", "lombok", "alibaba-java-code-style"]) {
     assert.equal(first.required_skills.filter((candidate) => candidate === skill).length, 1, `${skill} should appear once`);
   }
@@ -51,11 +53,11 @@ test("loads only explicitly satisfied context-conditional dependencies", () => {
 test("rejects recipes that reference skills and context-required cycles", () => {
   const invalidRecipeRegistry = structuredClone(registry);
   invalidRecipeRegistry.recipes[0].skills = ["yss-domain"];
-  assert.throws(() => compileImplementationContract({ registry: invalidRecipeRegistry, compilerContract, recipeIds: [invalidRecipeRegistry.recipes[0].id] }), /不得直接引用 skills/);
+  assert.throws(() => compileImplementationContract({ ...architecture, registry: invalidRecipeRegistry, compilerContract, recipeIds: [invalidRecipeRegistry.recipes[0].id] }), /不得直接引用 skills/);
 
   const cyclicRegistry = structuredClone(registry);
   cyclicRegistry.skill_dependencies["alibaba-java-code-style"] = [{ skill: "yss-domain", type: "context-required" }];
-  assert.throws(() => compileImplementationContract({ registry: cyclicRegistry, compilerContract, requiredCapabilities: ["layer.domain"] }), /依赖循环/);
+  assert.throws(() => compileImplementationContract({ ...architecture, registry: cyclicRegistry, compilerContract, requiredCapabilities: ["layer.domain"] }), /依赖循环/);
 });
 
 test("rejects removed ids and schema v1 without compatibility", () => {
@@ -65,7 +67,7 @@ test("rejects removed ids and schema v1 without compatibility", () => {
 });
 
 test("marks digest drift stale and validates v2 execution evidence", () => {
-  const resolution = compile({ requiredCapabilities: ["layer.domain"] });
+  const resolution = compile({ requiredCapabilities: ["contract.request-validation"], architecture_identity: undefined, architecture_evidence: undefined });
   const contract = { schema_version: 2, contract_id: "slice-1", contract_version: 1, resolution };
   assert.deepEqual(evaluateContractFreshness(contract, { registry, compilerContract }), { freshness: "current", reasons: [] });
   const changedRegistry = structuredClone(registry);

package/template/.codex/skills/yss-layered-mvc-scaffold-generator/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: yss-layered-mvc-scaffold-generator
+description: 用于在生命周期已批准的脚手架合同下生成通用 YSS Java 8 分层 MVC 后端工程；核心模块为 server、service、repository，并按能力确定性增加 adapter、client、feign-client。
+---
+
+# YSS Layered MVC Scaffold Generator
+
+本 skill 只为已登记的全新 backend project 生成机械工程骨架，不创建 `project-instance`、不初始化 Git、不生成业务 Controller、DTO、查询、状态机或 Mock 数据。
+
+## 进入条件
+
+- backend `scaffold_status=required`，目标目录已确认且不存在。
+- `scaffold-architecture-decisions.yaml` 中对应项目已达到 `lifecycle-approved`，确认架构为 `layered-mvc`。
+- `yss-implementation-contract-compiler` 已编译 scaffold contract schema v3，生命周期已批准并持久化。
+- 合同中的 `decision_id`、文件 digest、Profile、能力闭包、写路径和验证命令仍为当前版本。
+
+任一条件缺失时返回 `blocked`。本生成器无交互、无默认回退；用户选择由 `yss-product-lifecycle` 在 `work-unit.technical-analysis` 的工程基线内完成。
+
+## 架构与 Profile
+
+- 固定核心模块：`server`、`service`、`repository`。
+- `external-integration` 增加 `adapter`。
+- `published-client` 增加 `client`。
+- `feign-client` 增加 `client`、`feign-client`。
+- 固定平台：Java 8、Spring Boot 2.7、`javax`、YSS BOM、MyBatis-Plus。
+- 固定 architecture_profile=layered-mvc-service；verification_database=h2、production_database=not-bound。测试使用 H2，本地运行显式启用 scaffold-local；不引入外部驱动/数据源。
+
+能力解析规则、模块职责和依赖方向见 [architecture.md](references/architecture.md)。生成器必须同时校验 `requested_capabilities` 与 `resolved_modules`，不得自行补猜模块。
+
+## 执行
+
+优先使用一键入口：
+
+```bash
+node scripts/generate_and_verify_scaffold.mjs \
+  --project-name my-service \
+  --base-package com.yss.myservice \
+  --output-dir /path/to/backend-container \
+  --contract-file /path/to/approved-scaffold-contract.json \
+  --contract-id <id> \
+  --contract-version <version> \
+  --approval-ref <approval-ref> \
+  --compiler-draft-ref <compiler-ref> \
+  --persisted-ref <persisted-ref> \
+  --group-id com.yss.example \
+  --project-version 1.0.0-SNAPSHOT \
+  --parent-group-id com.yss.cloud \
+  --parent-artifact-id yss-cloud-microservice \
+  --parent-version 2.0.0-SNAPSHOT \
+  --yss-components-version 2.0.0-SNAPSHOT \
+  --evidence-dir /path/to/evidence
+```
+
+受控工作流必须在项目根实际执行 `./mvnw validate`、`./mvnw test`、`./mvnw package`，逐条记录退出码、时间、stdout/stderr 和失败分类。全部通过后只得到 `empty-scaffold-verified`。
+
+## 硬约束
+
+- 只接受 scaffold contract schema v3 和 Manifest schema v3；历史 v2 只读兼容，不用于新生成。
+- `architecture_family` 必须为 `layered-mvc`，`generator_skill` 必须为本 skill。
+- 目标存在、`--force`、旧项目迁移、模板升级均为 `unsupported`。
+- Harness 内只允许以 `apps/backend/` 为输出父容器；外部实现仓库使用已登记真实路径。
+- 不生成业务示例。健康检查、上下文加载测试和架构测试只能验证机械工程能力，不定义用户可见 API。
+- 生成后业务实现必须回到当前批准的 Slice Implementation Contract，使用适用 YSS skills 和 `behavior-tdd`。
+- DDD/MVC 互转不属于脚手架生成；已生成项目改变架构时必须建立独立迁移工作单元。

package/template/.codex/skills/yss-layered-mvc-scaffold-generator/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "YSS Layered MVC Scaffold Generator"
+  short_description: "Generate an approved YSS layered MVC backend skeleton."
+  default_prompt: "Use $yss-layered-mvc-scaffold-generator only after a user-confirmed scaffold architecture decision and a lifecycle-approved schema v3 scaffold contract."

package/template/.codex/skills/yss-layered-mvc-scaffold-generator/references/architecture.md

@@ -0,0 +1,29 @@
+# 通用分层 MVC 架构合同
+
+## 模块闭包
+
+| 能力 | 解析模块 |
+|---|---|
+| 核心 | `server`、`service`、`repository` |
+| `external-integration` | `adapter` |
+| `published-client` | `client` |
+| `feign-client` | `client`、`feign-client` |
+
+合同保存 `requested_capabilities`、`resolved_modules` 和 `resolution_version: 1`。模块按 `server`、`service`、`repository`、`adapter`、`client`、`feign-client` 的稳定顺序生成。
+
+## 职责和依赖
+
+| 模块 | 职责 | 允许依赖 |
+|---|---|---|
+| `server` | Spring Boot 启动、Controller 装配和 Web 配置 | `service`、可选 `client` |
+| `service` | 应用服务、事务脚本和用例编排 | `repository`、可选 `adapter` / `feign-client` |
+| `repository` | PO、Mapper、SQL 与数据库访问 | 无本项目上游模块 |
+| `adapter` | 外部系统适配实现 | 无本项目上游模块 |
+| `client` | 对外稳定调用契约 | 无本项目上游模块 |
+| `feign-client` | `client` 的 Feign 实现 | `client` |
+
+MVC 模式不等于禁止领域分析。若技术分析发现聚合不变量、复杂状态机、跨聚合一致性、Domain Event 或复杂并发，Agent 应推荐 `domain-driven`；用户仍选择 MVC 时必须记录覆盖理由和残余风险。局部 Tactical DDD Check 仍可按真实领域影响触发。
+
+## 生成边界
+
+允许生成 POM、Wrapper、启动入口、环境配置、包级占位、架构测试与上下文加载测试。禁止生成业务 API、DTO、字段、查询、状态、事务规则、权限、错误映射和 Mock 业务数据。

package/template/.codex/skills/yss-layered-mvc-scaffold-generator/scripts/generate_and_verify_scaffold.mjs

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+import { execFile } from "node:child_process";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+import { run } from "./run_scaffold_verification.mjs";
+
+const SCRIPT_DIR = path.dirname(fileURLToPath(import.meta.url));
+const GENERATOR = path.join(SCRIPT_DIR, "generate_scaffold.mjs");
+
+function parseArgs(argv) {
+  const generatorArgs = [];
+  let evidenceDir;
+  let outputDir;
+  let projectName;
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (token === "--evidence-dir" || token.startsWith("--evidence-dir=")) {
+      evidenceDir = token.includes("=") ? token.slice(token.indexOf("=") + 1) : argv[++index];
+      continue;
+    }
+    generatorArgs.push(token);
+    if (token === "--output-dir") outputDir = argv[index + 1];
+    if (token.startsWith("--output-dir=")) outputDir = token.slice(token.indexOf("=") + 1);
+    if (token === "--project-name") projectName = argv[index + 1];
+    if (token.startsWith("--project-name=")) projectName = token.slice(token.indexOf("=") + 1);
+  }
+  if (!evidenceDir || !outputDir || !projectName) throw new Error("必须提供 --evidence-dir、--output-dir 和 --project-name");
+  return { evidenceDir: path.resolve(evidenceDir), generatorArgs, projectRoot: path.join(path.resolve(outputDir), projectName) };
+}
+
+function executeGenerator(args) {
+  return new Promise((resolve) => execFile(process.execPath, [GENERATOR, ...args], { encoding: "utf8" }, (error, stdout, stderr) => resolve({ exitCode: error?.code ?? 0, stdout, stderr })));
+}
+
+async function main() {
+  try {
+    const args = parseArgs(process.argv.slice(2));
+    await mkdir(args.evidenceDir, { recursive: true });
+    const generation = await executeGenerator(args.generatorArgs);
+    await writeFile(path.join(args.evidenceDir, "generation.stdout.log"), generation.stdout, "utf8");
+    await writeFile(path.join(args.evidenceDir, "generation.stderr.log"), generation.stderr, "utf8");
+    if (generation.exitCode !== 0) throw new Error(`生成失败: ${generation.stderr.trim()}`);
+    const verification = await run(args.projectRoot, args.evidenceDir);
+    await writeFile(path.join(args.evidenceDir, "scaffold-verification.json"), `${JSON.stringify(verification, null, 2)}\n`, "utf8");
+    if (verification.status !== "passed") return 1;
+    const manifestPath = path.join(args.projectRoot, ".yss/scaffold-generation.json");
+    const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+    manifest.completion_level = "empty-scaffold-verified";
+    manifest.empty_scaffold_verification_ref = path.join(args.evidenceDir, "scaffold-verification.json");
+    manifest.empty_scaffold_verified_at = new Date().toISOString();
+    await writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+    return 0;
+  } catch (error) {
+    process.stderr.write(`❌ MVC 脚手架工作流失败: ${error.message}\n`);
+    return 1;
+  }
+}
+
+process.exitCode = await main();