create-yss-spec 3.3.0 → 3.3.3

package/template/.claude/skills/yss-repository/tests/profile-routing.test.mjs

@@ -1,59 +0,0 @@
-import assert from "node:assert/strict";
-import { access, readFile, readdir } from "node:fs/promises";
-import path from "node:path";
-import test from "node:test";
-import { fileURLToPath } from "node:url";
-
-const repositorySkillRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const skillsRoot = path.resolve(repositorySkillRoot, "..");
-const projectRoot = path.resolve(skillsRoot, "../..");
-
-async function text(target) {
-  return readFile(target, "utf8");
-}
-
-test("repository router exposes exactly the registered profile entry points", async () => {
-  const profilesRoot = path.join(repositorySkillRoot, "references/profiles");
-  const profiles = (await readdir(profilesRoot)).filter((name) => name.endsWith(".md")).sort();
-  assert.deepEqual(profiles, ["layered-mvc-service.md", "mvc-data-analysis-v1.md", "target-domain-model.md"]);
-
-  const skill = await text(path.join(repositorySkillRoot, "SKILL.md"));
-  for (const profile of profiles) assert.match(skill, new RegExp(`references/profiles/${profile.replace(".md", "")}`));
-  assert.match(skill, /且只.*加载一个文件/);
-  assert.doesNotMatch(skill, /infrastructure-layer-guide/);
-});
-
-test("normative persistence skills do not contain business-specific templates or production source mirrors", async () => {
-  const normativeFiles = [
-    path.join(repositorySkillRoot, "SKILL.md"),
-    ...["layered-mvc-service.md", "mvc-data-analysis-v1.md", "target-domain-model.md"]
-      .map((name) => path.join(repositorySkillRoot, "references/profiles", name)),
-  ];
-  for (const target of normativeFiles) {
-    const contents = await text(target);
-    assert.doesNotMatch(contents, /QualityTemplate|id\.value\(\)|insertOrUpdate\(/);
-  }
-
-  const mybatisAssets = path.join(skillsRoot, "yss-mybatis/assets");
-  try {
-    const javaMirrors = (await readdir(mybatisAssets)).filter((name) => name.endsWith(".java"));
-    assert.deepEqual(javaMirrors, []);
-  } catch (error) {
-    if (error.code !== "ENOENT") throw error;
-  }
-});
-
-test("code review wires Repository and MyBatis with registered backend scope", async () => {
-  const standards = await text(path.join(skillsRoot, "code-review/references/yss-review-standards.md"));
-  const report = await text(path.join(projectRoot, "docs/templates/review-report-template.md"));
-  const lifecycle = await text(path.join(skillsRoot, "yss-product-lifecycle/references/orchestration-contract.yaml"));
-
-  for (const source of [standards, report, lifecycle]) {
-    assert.match(source, /yss-repository/);
-    assert.match(source, /yss-mybatis/);
-  }
-  assert.match(standards, /本体项目和已登记后端研发项目/);
-  assert.match(report, /<review-root\.\.\.>/);
-  assert.match(lifecycle, /registered-backend-development-projects/);
-  await access(path.join(skillsRoot, "yss-mybatis/references/source-index.md"));
-});

package/template/.claude/skills/yss-research/SKILL.md

@@ -1,73 +0,0 @@
----
-name: yss-research
-description: Research technical or product-strategy questions with traceable evidence before YSS Discovery, Spec, domain-strategy, API, architecture, or implementation decisions. Use for current facts, standards, third-party APIs, business constraints, user problems, domain-boundary evidence, or when the deprecated `research` alias is invoked.
----
-
-# YSS Research
-
-Investigate facts that a YSS decision depends on. Produce evidence and bounded conclusions; do not make or approve the downstream product, domain, architecture, or release decision.
-
-`research` is a deprecated compatibility alias. Use `yss-research` in new assets and routing.
-
-## Profiles
-
-- `technical-evidence`: standards, official documentation, source code, third-party APIs, framework behavior, protocols, or implementation constraints. Decision-bearing claims must trace to primary sources.
-- `strategy-evidence`: user problems, business constraints, MVP/non-goal evidence, success criteria, domain-boundary signals, core business-rule evidence, and stage-decision inputs. This profile may consume direct-experience and near-primary evidence with explicit limitations.
-
-Route competitor, pricing, category, and market-position research to `competitive-intelligence`; consume its cited result rather than duplicating it. Route product UI and workflow-friction scans to `product-design:research` when that platform skill is available. `yss-research` may synthesize their outputs but does not replace their specialist contracts.
-
-## Modes
-
-- `quick` is the default for exploratory fact finding. Return an in-chat brief unless the user asks to persist it.
-- `evidence-audited` is required when research directly informs a persisted Spec, domain strategy, stage decision, OpenAPI, architecture decision, or another lifecycle approval input. It is also used when the user explicitly asks for deep, strict, reproducible, or auditable research.
-
-Do not silently promote an exploratory request solely because more rigor would be nice. State the active profile and mode before searching; explain when a downstream lifecycle use requires promotion.
-
-## Source policy
-
-1. Start from the decision, audience, time horizon, scope, and questions the research must answer.
-2. Search user-provided or registered material first, using the same inclusion and exclusion criteria as external material. Record exclusions and access failures.
-3. For `technical-evidence`, follow each decision-bearing claim to the official specification, official docs, source code, or first-party API that owns it.
-4. For `strategy-evidence`, classify sources as primary, direct experience, near-primary, secondary, or lead-only. Interviews, tickets, support records, dated reviews, surveys, and credible industry reports are allowed with their sampling and access limits.
-5. Treat untraceable reposts, aggregator snippets, and AI-generated summaries as leads only. They cannot support a published claim.
-6. Seek counter-signals and conflicting evidence. Source count alone is not frequency or confidence.
-
-## Delegation
-
-Use a background Agent when the runtime supports it and the reading can proceed independently while other useful work continues. Otherwise research in the current Agent. Delegation is an execution optimization, not a trust signal.
-
-Lifecycle dispatches must use the repository's structured task package, write isolation, role binding, and handoff contract. The owner receiving the result remains responsible for verifying material claims before consuming them.
-
-## Evidence-audited workflow
-
-Follow [evidence-contract.md](references/evidence-contract.md):
-
-1. Predeclare the research scope, source classes, inclusion/exclusion criteria, and known access limits.
-2. Maintain a reproducible Search Log and independently locatable Evidence Ledger.
-3. Separate observations, inference, hypotheses, and decisions.
-4. Audit each decision-bearing claim against the evidence it cites, including counter-signals.
-5. Narrow partially supported claims; mark unsupported claims `needs-deeper-research`.
-6. Persist `<slug>-research-brief.md` with adjacent `<slug>-evidence.yaml` and run the bundled validator.
-
-For `strategy-evidence`, every claim that determines a user problem, MVP/non-goal, domain boundary, core business rule, success criterion, important business constraint, or stage-decision basis is decision-bearing and must be audited. Background context may be sampled only when explicitly marked non-decision-bearing.
-
-## Ownership boundary
-
-- Research output is evidence, not approval.
-- `domain-modeling` owns glossary changes; `yss-stage-decision` owns domain strategy and the stage-decision package.
-- The lifecycle orchestrator and designated reviewers own gate state.
-- Do not modify `CONTEXT.md`, Spec, domain-strategy, OpenAPI, architecture, Ticket status, or approval records unless a separately authorized owning work unit performs that change.
-
-## Output
-
-A quick brief includes scope, findings, sources, inference, confidence, counter-signals, gaps, and the next decision it informs.
-
-For persisted `evidence-audited` work, start from [research-brief-template.md](assets/research-brief-template.md) and [evidence-template.yaml](assets/evidence-template.yaml). Run from this skill directory:
-
-```bash
-node scripts/validate-research-package.mjs <slug>-research-brief.md <slug>-evidence.yaml
-```
-
-In `template-source`, save reusable maintenance research under the existing `.template-source/evidence/maintenance/` convention. In `project-instance`, use the project research/evidence convention and bind any decision-bearing output from the lifecycle asset that consumes it.
-
-If sources are unavailable or conflict, state the limitation. Ordinary gaps lower confidence; a missing or mismatched source for a decision-bearing claim prevents that claim from being treated as established.

package/template/.claude/skills/yss-research/agents/openai.yaml

@@ -1,3 +0,0 @@
-interface:
-  display_name: "YSS Research"
-  short_description: "Research technical and strategy evidence"

package/template/.claude/skills/yss-research/assets/evidence-template.yaml

@@ -1,68 +0,0 @@
-{
-  "schema_version": 1,
-  "profile": "strategy-evidence",
-  "mode": "evidence-audited",
-  "scope": {
-    "topic": "<topic>",
-    "audience": "<audience>",
-    "time_horizon": "<time horizon>",
-    "research_questions": ["<question>"],
-    "inclusion_criteria": ["<criterion>"],
-    "exclusion_criteria": ["<criterion>"]
-  },
-  "ownership": {
-    "research_owner": "yss-research",
-    "downstream_owner": "<lifecycle skill or role>",
-    "decision_ref": null
-  },
-  "search_log": [
-    {
-      "id": "search-001",
-      "channel": "<channel or corpus>",
-      "query_or_corpus": "<query or inspected material>",
-      "searched_at": "YYYY-MM-DD",
-      "result": "results-found"
-    },
-    {
-      "id": "search-002",
-      "channel": "<counter-signal channel>",
-      "query_or_corpus": "<counter-signal query>",
-      "searched_at": "YYYY-MM-DD",
-      "result": "none-found"
-    }
-  ],
-  "evidence_items": [
-    {
-      "id": "evidence-001",
-      "source_level": "direct-experience",
-      "visibility": "internal",
-      "source_class": "<interview, support, ticket, docs, specification, source-code, dataset, report>",
-      "source_ref": "<URL or repository reference>",
-      "locator": "<line, section, record, timestamp, or comment>",
-      "stance": "support",
-      "observed_at": "YYYY-MM-DD",
-      "evidence_date": "YYYY-MM-DD",
-      "observation": "<what the source directly shows>",
-      "limitations": ["<sampling, recency, access, or independence limit>"]
-    }
-  ],
-  "claims": [
-    {
-      "id": "claim-001",
-      "claim_kind": "user-problem",
-      "statement": "<decision-bearing claim>",
-      "decision_bearing": true,
-      "evidence_refs": ["evidence-001"],
-      "counter_signal_refs": ["search-002"],
-      "audit_status": "supported",
-      "confidence": "medium",
-      "disposition": "publish"
-    }
-  ],
-  "source_gaps": [],
-  "audit_summary": {
-    "status": "complete",
-    "audited_claim_ids": ["claim-001"],
-    "notes": []
-  }
-}

package/template/.claude/skills/yss-research/assets/research-brief-template.md

@@ -1,36 +0,0 @@
-# <Topic> Research Brief
-
-## Research Scope
-
-- Profile: `technical-evidence` or `strategy-evidence`
-- Mode: `evidence-audited`
-- Decision informed:
-- Audience:
-- Time horizon:
-- Inclusion criteria:
-- Exclusion criteria:
-- Access limitations:
-
-## Executive Read
-
-Summarize the evidence-backed answer and its decision boundary.
-
-## Findings
-
-For every decision-bearing finding, cite its `claim-*` ID and source links. Separate observation, inference, hypothesis, and recommendation.
-
-## Counter-Signals
-
-Describe conflicting evidence and unsuccessful counterexample searches without treating `none-found` as proof of absence.
-
-## Source Map
-
-Explain what each source class contributed, exclusions, access failures, and weak areas.
-
-## Decision Handoff
-
-Identify the downstream owner and asset. State explicitly that this research does not approve or mutate that asset.
-
-## Evidence Limitations
-
-List sampling, recency, independence, access, and provenance limits plus any `needs-deeper-research` claims.

package/template/.claude/skills/yss-research/references/evidence-contract.md

@@ -1,42 +0,0 @@
-# YSS Research Evidence Contract
-
-This contract defines the persisted `evidence-audited` package. The Markdown brief is the readable narrative; the adjacent evidence file is the source of truth for search execution, provenance, claim mapping, audit state, and downstream ownership.
-
-## Evidence levels
-
-| Level | Meaning | Allowed use |
-|---|---|---|
-| `primary` | Official specification, official documentation, first-party API, source code, filing, or original dataset | Required for decision-bearing `technical-evidence` claims |
-| `direct-experience` | Interview, support record, ticket, direct observation, telemetry, or original user report | May support `strategy-evidence`; state sampling and access limits |
-| `near-primary` | Dated review, vendor case study, marketplace record, or a report with inspectable methodology | May support strategy claims with qualification |
-| `secondary` | Reputable synthesis that identifies its underlying evidence | Context or corroboration; avoid as the sole basis for high-impact decisions |
-| `lead-only` | Aggregator snippet, unattributed repost, or AI-generated summary | Search lead only; never a supporting evidence reference |
-
-## Search and counter-signals
-
-Each material query or corpus inspection has a stable `search-*` ID, execution date, channel, query/corpus, and result. Allowed results are `results-found`, `none-found`, `access-failed`, and `excluded`.
-
-Each claim must name supporting evidence and at least one counter-signal. A counter-signal is either an `evidence-*` item marked `counter` or a `search-*` entry with `none-found`. A `none-found` search only proves that the declared search did not find a counterexample.
-
-## Claim audit
-
-Allowed outcomes:
-
-- `supported`: the evidence directly supports the wording;
-- `partially-supported`: only a narrower, qualified wording is supportable;
-- `unsupported`: the source does not support the claim;
-- `not-audited`: temporary state, forbidden when the package says audit is complete.
-
-`partially-supported` requires disposition `qualify`. `unsupported` requires `needs-deeper-research`. `lead-only` items cannot be cited as support. In `technical-evidence`, every decision-bearing claim needs at least one `primary` supporting item.
-
-In `strategy-evidence`, decision-bearing kinds are `user-problem`, `business-constraint`, `domain-boundary`, `business-rule`, `mvp`, `non-goal`, `success-criterion`, and `stage-decision-basis`. These claims must all be present in `audit_summary.audited_claim_ids` before downstream lifecycle consumption.
-
-## Ownership and failure
-
-The package names its downstream owner and optional decision reference. It does not change the owned artifact or gate. Structure errors, unresolved references, decision-bearing unaudited claims, or a false `complete` declaration fail validation. Access gaps and conflicting evidence are recorded in `source_gaps`; they do not fail the entire brief unless they leave a decision-bearing claim unsupported.
-
-The evidence file uses JSON syntax, which is valid YAML 1.2, so validation is portable and dependency-free.
-
-## Design provenance
-
-The Search Log, evidence passport, and claim-source alignment concepts are adapted from [Academic Research Skills](https://github.com/Imbad0202/academic-research-skills). This YSS contract omits academic writing, publication, fixed agent teams, and cross-model review machinery, and retains YSS lifecycle ownership boundaries.

package/template/.claude/skills/yss-research/scripts/validate-research-package.mjs

@@ -1,128 +0,0 @@
-#!/usr/bin/env node
-import { readFileSync } from "node:fs";
-import path from "node:path";
-
-const PROFILE_VALUES = ["technical-evidence", "strategy-evidence"];
-const SOURCE_LEVELS = ["primary", "direct-experience", "near-primary", "secondary", "lead-only"];
-const CLAIM_KINDS = ["technical-fact", "user-problem", "business-constraint", "domain-boundary", "business-rule", "mvp", "non-goal", "success-criterion", "stage-decision-basis", "background"];
-const STRATEGY_DECISION_KINDS = new Set(["user-problem", "business-constraint", "domain-boundary", "business-rule", "mvp", "non-goal", "success-criterion", "stage-decision-basis"]);
-
-function fail(message) { throw new TypeError(message); }
-function requireString(value, label) { if (typeof value !== "string" || !value.trim()) fail(`${label} must be a non-empty string`); }
-function requireArray(value, label, nonEmpty = false) { if (!Array.isArray(value) || (nonEmpty && value.length === 0)) fail(`${label} must be ${nonEmpty ? "a non-empty" : "an"} array`); }
-function requireChoice(value, choices, label) { if (!choices.includes(value)) fail(`${label} must be one of: ${choices.join(", ")}`); }
-
-function indexed(items, label) {
-  const result = new Map();
-  items.forEach((item, index) => {
-    requireString(item?.id, `${label}[${index}].id`);
-    if (result.has(item.id)) fail(`${label} contains duplicate id: ${item.id}`);
-    result.set(item.id, item);
-  });
-  return result;
-}
-
-function readEvidence(file) {
-  try {
-    const value = JSON.parse(readFileSync(file, "utf8"));
-    if (!value || typeof value !== "object" || Array.isArray(value)) fail("evidence root must be an object");
-    return value;
-  } catch (error) {
-    if (error instanceof TypeError && error.message === "evidence root must be an object") throw error;
-    fail(`${path.basename(file)} must use JSON-compatible YAML 1.2 syntax: ${error.message}`);
-  }
-}
-
-function validate(briefFile, evidenceFile) {
-  if (!briefFile || !evidenceFile) fail("usage: validate-research-package.mjs <brief.md> <evidence.yaml>");
-  const briefPath = path.resolve(briefFile);
-  const evidencePath = path.resolve(evidenceFile);
-  if (path.dirname(briefPath) !== path.dirname(evidencePath)) fail("brief and evidence files must be adjacent");
-  if (!briefPath.endsWith("-research-brief.md") || !evidencePath.endsWith("-evidence.yaml")) fail("expected <slug>-research-brief.md and <slug>-evidence.yaml");
-  const briefSlug = path.basename(briefPath, "-research-brief.md");
-  if (!briefSlug || briefSlug !== path.basename(evidencePath, "-evidence.yaml")) fail("brief and evidence files must use the same non-empty slug");
-
-  const brief = readFileSync(briefPath, "utf8");
-  ["Research Scope", "Executive Read", "Findings", "Counter-Signals", "Source Map", "Decision Handoff", "Evidence Limitations"].forEach((heading) => {
-    if (!brief.includes(`## ${heading}`)) fail(`brief is missing heading: ## ${heading}`);
-  });
-
-  const data = readEvidence(evidencePath);
-  if (data.schema_version !== 1) fail("schema_version must be 1");
-  requireChoice(data.profile, PROFILE_VALUES, "profile");
-  if (data.mode !== "evidence-audited") fail("mode must be evidence-audited");
-  ["topic", "audience", "time_horizon"].forEach((field) => requireString(data.scope?.[field], `scope.${field}`));
-  ["research_questions", "inclusion_criteria", "exclusion_criteria"].forEach((field) => requireArray(data.scope?.[field], `scope.${field}`, true));
-  if (data.ownership?.research_owner !== "yss-research") fail("ownership.research_owner must be yss-research");
-  requireString(data.ownership?.downstream_owner, "ownership.downstream_owner");
-  if (data.ownership.decision_ref !== null && (typeof data.ownership.decision_ref !== "string" || !data.ownership.decision_ref.trim())) fail("ownership.decision_ref must be null or a non-empty string");
-
-  requireArray(data.search_log, "search_log", true);
-  const searches = indexed(data.search_log, "search_log");
-  data.search_log.forEach((entry, index) => {
-    ["channel", "query_or_corpus", "searched_at"].forEach((field) => requireString(entry[field], `search_log[${index}].${field}`));
-    requireChoice(entry.result, ["results-found", "none-found", "access-failed", "excluded"], `search_log[${index}].result`);
-  });
-
-  requireArray(data.evidence_items, "evidence_items", true);
-  const evidence = indexed(data.evidence_items, "evidence_items");
-  data.evidence_items.forEach((item, index) => {
-    requireChoice(item.source_level, SOURCE_LEVELS, `evidence_items[${index}].source_level`);
-    requireChoice(item.visibility, ["public", "internal"], `evidence_items[${index}].visibility`);
-    requireChoice(item.stance, ["support", "counter"], `evidence_items[${index}].stance`);
-    ["source_class", "source_ref", "locator", "observed_at", "observation"].forEach((field) => requireString(item[field], `evidence_items[${index}].${field}`));
-    requireArray(item.limitations, `evidence_items[${index}].limitations`);
-  });
-
-  requireArray(data.claims, "claims", true);
-  const claims = indexed(data.claims, "claims");
-  data.claims.forEach((claim, index) => {
-    requireChoice(claim.claim_kind, CLAIM_KINDS, `claims[${index}].claim_kind`);
-    requireString(claim.statement, `claims[${index}].statement`);
-    if (typeof claim.decision_bearing !== "boolean") fail(`claims[${index}].decision_bearing must be boolean`);
-    requireArray(claim.evidence_refs, `claims[${index}].evidence_refs`, true);
-    requireArray(claim.counter_signal_refs, `claims[${index}].counter_signal_refs`, true);
-    requireChoice(claim.audit_status, ["supported", "partially-supported", "unsupported", "not-audited"], `claims[${index}].audit_status`);
-    requireChoice(claim.confidence, ["low", "medium", "high"], `claims[${index}].confidence`);
-    requireChoice(claim.disposition, ["publish", "qualify", "needs-deeper-research"], `claims[${index}].disposition`);
-
-    const supporting = claim.evidence_refs.map((ref) => {
-      if (!evidence.has(ref)) fail(`${claim.id} has unresolved evidence ref: ${ref}`);
-      const item = evidence.get(ref);
-      if (item.stance !== "support") fail(`${claim.id} support ref is not marked support: ${ref}`);
-      if (item.source_level === "lead-only") fail(`${claim.id} uses lead-only evidence as support: ${ref}`);
-      return item;
-    });
-    claim.counter_signal_refs.forEach((ref) => {
-      if (!evidence.has(ref) && !searches.has(ref)) fail(`${claim.id} has unresolved counter-signal ref: ${ref}`);
-      if (evidence.has(ref) && evidence.get(ref).stance !== "counter") fail(`${claim.id} counter-signal evidence is not marked counter: ${ref}`);
-      if (searches.has(ref) && searches.get(ref).result !== "none-found") fail(`${claim.id} counter-signal search must have result none-found: ${ref}`);
-    });
-    if (data.profile === "technical-evidence" && claim.decision_bearing && !supporting.some((item) => item.source_level === "primary")) fail(`${claim.id} is a decision-bearing technical claim without primary evidence`);
-    if (data.profile === "strategy-evidence" && STRATEGY_DECISION_KINDS.has(claim.claim_kind) && claim.decision_bearing !== true) fail(`${claim.id} strategy claim kind must be decision-bearing: ${claim.claim_kind}`);
-    if (claim.audit_status === "partially-supported" && claim.disposition !== "qualify") fail(`${claim.id} is partially supported and must use qualify`);
-    if (claim.audit_status === "unsupported" && claim.disposition !== "needs-deeper-research") fail(`${claim.id} is unsupported and must use needs-deeper-research`);
-    if (claim.decision_bearing && claim.audit_status === "unsupported") fail(`${claim.id} is decision-bearing and cannot remain unsupported`);
-    if (!brief.includes(claim.id)) fail(`brief does not reference claim: ${claim.id}`);
-  });
-
-  requireArray(data.source_gaps, "source_gaps");
-  if (data.audit_summary?.status !== "complete") fail("audit_summary.status must be complete");
-  requireArray(data.audit_summary.audited_claim_ids, "audit_summary.audited_claim_ids", true);
-  requireArray(data.audit_summary.notes, "audit_summary.notes");
-  const audited = new Set(data.audit_summary.audited_claim_ids);
-  audited.forEach((id) => { if (!claims.has(id)) fail(`audit_summary has unknown claim: ${id}`); });
-  claims.forEach((claim, id) => {
-    if (claim.decision_bearing && !audited.has(id)) fail(`audit_summary is missing decision-bearing claim: ${id}`);
-    if (claim.decision_bearing && claim.audit_status === "not-audited") fail(`${id} remains not-audited`);
-  });
-  return { claims: claims.size, evidence: evidence.size, searches: searches.size, profile: data.profile };
-}
-
-try {
-  const result = validate(process.argv[2], process.argv[3]);
-  process.stdout.write(`YSS research package valid (${result.profile}, ${result.claims} claims, ${result.evidence} evidence items, ${result.searches} searches)\n`);
-} catch (error) {
-  process.stderr.write(`YSS research package invalid: ${error.message}\n`);
-  process.exitCode = 1;
-}

package/template/.claude/skills/yss-research/tests/run-scenarios.mjs

@@ -1,81 +0,0 @@
-#!/usr/bin/env node
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const validator = path.join(root, "scripts/validate-research-package.mjs");
-const template = JSON.parse(readFileSync(path.join(root, "assets/evidence-template.yaml"), "utf8"));
-const directory = mkdtempSync(path.join(tmpdir(), "yss-research-"));
-const brief = path.join(directory, "sample-research-brief.md");
-const evidence = path.join(directory, "sample-evidence.yaml");
-const headings = ["Research Scope", "Executive Read", "Findings", "Counter-Signals", "Source Map", "Decision Handoff", "Evidence Limitations"];
-
-function run(payload, status, expected) {
-  writeFileSync(brief, `${headings.map((heading) => `## ${heading}`).join("\n\n")}\n\n${payload.claims.map((claim) => claim.id).join(" ")}\n`);
-  writeFileSync(evidence, `${JSON.stringify(payload, null, 2)}\n`);
-  const result = spawnSync(process.execPath, [validator, brief, evidence], { encoding: "utf8" });
-  if (result.status !== status || !`${result.stdout}${result.stderr}`.includes(expected)) throw new Error(`expected ${status}/${expected}, got ${result.status}: ${result.stdout}${result.stderr}`);
-}
-
-try {
-  template.scope.topic = "Example strategy question";
-  template.scope.audience = "Product team";
-  template.scope.time_horizon = "Last 12 months";
-  template.scope.research_questions = ["Which problem should the domain address?"];
-  template.scope.inclusion_criteria = ["Direct experience in scope"];
-  template.scope.exclusion_criteria = ["Untraceable reposts"];
-  template.ownership.downstream_owner = "yss-stage-decision";
-  template.search_log[0].channel = "Support records";
-  template.search_log[0].query_or_corpus = "failed approval workflow";
-  template.search_log[0].searched_at = "2026-09-03";
-  template.search_log[1].channel = "Support records";
-  template.search_log[1].query_or_corpus = "successful approval workflow";
-  template.search_log[1].searched_at = "2026-09-03";
-  template.evidence_items[0].source_class = "support";
-  template.evidence_items[0].source_ref = "support-case-001";
-  template.evidence_items[0].locator = "event-3";
-  template.evidence_items[0].observed_at = "2026-09-03";
-  template.evidence_items[0].evidence_date = "2026-08-30";
-  template.evidence_items[0].observation = "The approval stopped when the owner was missing.";
-  template.evidence_items[0].limitations = ["Single support case"];
-  template.claims[0].statement = "A missing owner can block the approval workflow.";
-  run(template, 0, "YSS research package valid");
-
-  const falseStrategyBackground = structuredClone(template);
-  falseStrategyBackground.claims[0].decision_bearing = false;
-  run(falseStrategyBackground, 1, "strategy claim kind must be decision-bearing");
-
-  const unsupported = structuredClone(template);
-  unsupported.claims[0].audit_status = "unsupported";
-  unsupported.claims[0].disposition = "publish";
-  run(unsupported, 1, "must use needs-deeper-research");
-
-  const unsupportedDecision = structuredClone(template);
-  unsupportedDecision.claims[0].audit_status = "unsupported";
-  unsupportedDecision.claims[0].disposition = "needs-deeper-research";
-  run(unsupportedDecision, 1, "decision-bearing and cannot remain unsupported");
-
-  const falseCounter = structuredClone(template);
-  falseCounter.claims[0].counter_signal_refs = ["search-001"];
-  run(falseCounter, 1, "counter-signal search must have result none-found");
-
-  const technicalWithoutPrimary = structuredClone(template);
-  technicalWithoutPrimary.profile = "technical-evidence";
-  technicalWithoutPrimary.claims[0].claim_kind = "technical-fact";
-  run(technicalWithoutPrimary, 1, "technical claim without primary evidence");
-
-  const leadOnly = structuredClone(template);
-  leadOnly.evidence_items[0].source_level = "lead-only";
-  run(leadOnly, 1, "uses lead-only evidence as support");
-
-  const unaudited = structuredClone(template);
-  unaudited.audit_summary.audited_claim_ids = [];
-  run(unaudited, 1, "must be a non-empty array");
-
-  process.stdout.write("YSS research scenarios passed (8)\n");
-} finally {
-  rmSync(directory, { recursive: true, force: true });
-}

package/template/.claude/skills/yss-resilience4j/SKILL.md

@@ -1,46 +0,0 @@
----
-name: yss-resilience4j
-description: Use when 用于 YSS Resilience4j starter、网关熔断、限流降级、GlobalCircuitExceptionAdvice、GatewayConfiguration 和断路器配置排障。
----
-
-# yss-resilience4j
-
-Use this skill for YSS Resilience4j 组件. Keep implementation grounded in the local project and resolvable YSS backend component source.
-
-中文说明：本技能用于 YSS Resilience4j 组件。执行时优先读取源码索引，避免凭记忆猜类名、配置项或接入方式。
-
-## Source Index First
-
-- Backend source location is environment-specific; resolve it with `yss-skill-source-index-refresh/references/source-location.md`.
-- Generated index: `references/source-index.md`
-- Component path hints: `yss-microservice-components/yss-component-resilience4j-starter`
-
-Read `references/source-index.md` as a path-hint index whenever the task depends on exact modules, annotations, auto configuration, properties, controllers, clients, repositories, DTOs, handlers, or troubleshooting.
-
-## Workflow
-
-1. Read `references/source-index.md`, then read component `readme.md`.
-2. Identify whether the task is gateway circuit breaker configuration, fallback response, global circuit exception handling, or resilience troubleshooting.
-3. Inspect `GatewayConfiguration` for route/filter wiring and `GlobalCircuitExceptionAdvice` for exception response behavior.
-4. Tune thresholds/timeouts in configuration rather than hardcoding resilience behavior in business handlers.
-5. Keep fallback responses consistent with gateway/API response contracts.
-
-## Capability Split
-
-- Gateway resilience wiring: `GatewayConfiguration`.
-- Circuit exception mapping: `GlobalCircuitExceptionAdvice`.
-- Operational guidance: README "轻量微服务断路器".
-
-## Checklist
-
-- Required dependency or starter module is present.
-- Circuit breaker names and route IDs match gateway configuration.
-- Fallback status/body are acceptable for frontend/API consumers.
-- Timeout, slow-call, and failure thresholds match service SLOs.
-- Logs/metrics make open/half-open/recovered states diagnosable.
-
-## Do Not
-
-- Do not invent class names or configuration keys without checking the source index.
-- Do not replace component extension points with business-local framework code.
-- Do not broaden the task into unrelated YSS components unless the user asks.

package/template/.claude/skills/yss-resilience4j/agents/openai.yaml

@@ -1,4 +0,0 @@
-interface:
-  display_name: "yss-resilience4j"
-  short_description: "YSS component skill for yss-resilience4j"
-  default_prompt: "Use yss-resilience4j for this YSS backend component task."

package/template/.claude/skills/yss-resilience4j/references/source-index.md

@@ -1,33 +0,0 @@
-# yss-resilience4j Source Index
-
-Generated: 2026-08-17T12:03:37.436Z
-Source commit: `38b556a5081e6c66c0c538cbc1ef839b19996ed3`
-Source worktree: `dirty`
-Indexed source root: resolved at refresh time; set `YSS_SOURCE_ROOT` to reproduce or refresh.
-
-This file is generated by `yss-skill-source-index-refresh/scripts/refresh-yss-skill-index.mjs`. Do not hand-edit generated sections.
-
-Paths below are source path hints captured at refresh time. If they do not exist in the current workspace, locate sources using `YSS_SOURCE_ROOT`, CodeGraph, package/class names, Maven artifact names, or repository search before assuming the source is unavailable.
-
-## Component Path Hints
-
-- `yss-microservice-components/yss-component-resilience4j-starter` (existed when indexed)
-
-## Documentation Files
-
-- `yss-microservice-components/yss-component-resilience4j-starter/readme.md`
-
-## Maven Modules
-
-- `yss-microservice-components/yss-component-resilience4j-starter`
-
-## Key Java Entry Points
-
-- `yss-microservice-components/yss-component-resilience4j-starter/src/main/java/com/yss/cloud/breaker/config/GatewayConfiguration.java`
-- `yss-microservice-components/yss-component-resilience4j-starter/src/main/java/com/yss/cloud/breaker/exception/GlobalCircuitExceptionAdvice.java`
-
-## Recommended Next Reads
-
-- Start with the documentation files above when learning component usage.
-- Search the key Java entry points for annotations, auto configuration, properties, aspects, interceptors, handlers, and result objects before changing application code.
-- Prefer existing component extension points over rewriting framework logic in business modules.

package/template/.claude/skills/yss-security-algorithm/SKILL.md

@@ -1,52 +0,0 @@
----
-name: yss-security-algorithm
-description: Use when YSS RSA/AES/DES/SM2/SM4 encryption, JWT/JWK configuration, password encoding, key loading, rotation, or decryption failures are involved.
----
-
-# yss-security-algorithm
-
-Use this skill for YSS 安全算法组件. Keep implementation grounded in the local project and resolvable YSS backend component source.
-
-中文说明：本技能用于 YSS 安全算法组件。执行时优先读取源码索引，避免凭记忆猜类名、配置项或接入方式。
-
-## Source Index First
-
-- Backend source location is environment-specific; resolve it with `yss-skill-source-index-refresh/references/source-location.md`.
-- Generated index: `references/source-index.md`
-- Component path hints: `yss-microservice-components/yss-component-security-algorithm`
-
-Read `references/source-index.md` as a path-hint index whenever the task depends on exact modules, annotations, auto configuration, properties, controllers, clients, repositories, DTOs, handlers, or troubleshooting.
-
-## Workflow
-
-1. Identify whether the task is symmetric encryption, asymmetric encryption, SM algorithms, JWT key generation/configuration, or decryption troubleshooting.
-2. Read `references/source-index.md`, then inspect `CryptoType`, `SecurityCryptoUtil`, `KeyGeneratorUtils`, and `DefaultJwtConfiguration`.
-3. Use `CryptoType` to route algorithm-specific behavior; current enum values include `RSA`, `AES`, `DES`, `SM2`, and `SM4`.
-4. Treat `SecurityCryptoUtil` and `Jwks` as compatibility/legacy references only. The current `Jwks.generateRsa()` decodes hardcoded `PK`/`SK` constants rather than generating or loading a managed key, while EC/secret keys can be process-local or regenerated at startup; none is production key management.
-5. For production changes, externalize keys/secrets and avoid copying hardcoded sample keys into business modules.
-
-## Security Notes
-
-- The current utility contains a complete hardcoded RSA private key and fixed key material; do not use it for production data. Existing exposure requires rotation/revocation planning, not merely avoiding new constants.
-- `Jwks.generateRsa()` contains a complete hardcoded RSA private key; the key identifier is static and must be treated as compromised until rotated.
-- `DefaultJwtConfiguration` generates or selects JWK material at startup and currently selects `noop` as the DelegatingPasswordEncoder default; persistence, rotation, an external secret source, and an explicit password-encoder override are production prerequisites.
-- Verify whether callers need encryption for storage, transport, signing, or compatibility; choose algorithm and key lifecycle accordingly.
-- Prefer environment/config/secret-manager backed keys for deployable code.
-- Keep plaintext, ciphertext, encoding format, and key type explicit in API contracts.
-
-## Checklist
-
-- Required dependency or starter module is present.
-- Algorithm choice is explicit and compatible with the caller.
-- Key source and rotation story are documented for production code.
-- JWT signatures are verified with issuer/audience/expiry policy; payload parsing alone is never authentication.
-- Encoding format is clear: Base64, hex, UTF-8 string, or raw bytes.
-- Decrypt path uses the matching algorithm/key type.
-- No passwords, private keys, or long-lived secrets are added to source files.
-- If external key storage, rotation/revocation, algorithm parameters, compatibility tests, or security-owner review is missing, return `blocked-for-production` instead of generating crypto code.
-
-## Do Not
-
-- Do not invent class names or configuration keys without checking the source index.
-- Do not replace component extension points with business-local framework code.
-- Do not broaden the task into unrelated YSS components unless the user asks.

package/template/.claude/skills/yss-security-algorithm/agents/openai.yaml

@@ -1,4 +0,0 @@
-interface:
-  display_name: "yss-security-algorithm"
-  short_description: "YSS component skill for yss-security-algorithm"
-  default_prompt: "Use yss-security-algorithm for this YSS backend component task."