create-yss-spec 3.3.1 → 3.3.3

package/template/.qoder/skills/archify/test/workflow-semantic-contract.test.mjs

@@ -1,131 +0,0 @@
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-
-import { compileWorkflow } from '../renderers/workflow/workflow-compiler.mjs';
-
-function document(semanticChecks) {
-  return {
-    schema_version: 2,
-    diagram_type: 'workflow',
-    meta: {
-      title: 'Workflow semantic contract fixture',
-      legend: { mode: 'hidden' },
-    },
-    lanes: [
-      { id: 'main', label: 'Main' },
-      { id: 'recovery', label: 'Recovery' },
-    ],
-    nodes: [
-      { id: 'input', lane: 'main', col: 0, type: 'external', label: 'Input' },
-      { id: 'process', lane: 'main', col: 2, type: 'backend', label: 'Process' },
-      { id: 'result', lane: 'main', col: 4, type: 'frontend', label: 'Result' },
-      { id: 'ledger', lane: 'recovery', col: 4, type: 'database', label: 'Ledger' },
-      { id: 'resume', lane: 'recovery', col: 1, type: 'backend', label: 'Resume' },
-    ],
-    edges: [
-      { id: 'start', from: 'input', to: 'process' },
-      { id: 'finish', from: 'process', to: 'result' },
-      { id: 'record', from: 'process', to: 'ledger' },
-    ],
-    ...(semanticChecks ? { semanticChecks } : {}),
-  };
-}
-
-test('semanticChecks rejects an undeclared root instead of accepting an orphan recovery node', () => {
-  const workflow = document({
-    allowedRoots: ['input'],
-  });
-
-  const result = compileWorkflow({ workflow, qualityProfile: 'standard' });
-
-  assert.equal(result.ok, false);
-  assert.ok(
-    result.diagnostics.some((diagnostic) => (
-      diagnostic.code === 'workflow/unexpected-root'
-      && diagnostic.subject?.node === 'resume'
-    )),
-    JSON.stringify(result.diagnostics, null, 2),
-  );
-});
-
-test('semanticChecks rejects a missing required edge with its exact endpoints', () => {
-  const workflow = document({
-    requiredEdges: [{ from: 'ledger', to: 'resume' }],
-  });
-
-  const result = compileWorkflow({ workflow, qualityProfile: 'standard' });
-
-  assert.equal(result.ok, false);
-  assert.ok(
-    result.diagnostics.some((diagnostic) => (
-      diagnostic.code === 'workflow/required-edge'
-      && diagnostic.subject?.from === 'ledger'
-      && diagnostic.subject?.to === 'resume'
-    )),
-    JSON.stringify(result.diagnostics, null, 2),
-  );
-});
-
-test('semanticChecks accepts required reachability through intermediate nodes without changing SVG bytes', () => {
-  const baseline = document();
-  const constrained = document({
-    allowedRoots: ['input', 'resume'],
-    allowedTerminals: ['result', 'ledger', 'resume'],
-    requiredEdges: [{ from: 'process', to: 'ledger' }],
-    requiredPaths: [{ from: 'input', to: 'result' }],
-  });
-
-  const baselineResult = compileWorkflow({ workflow: baseline, qualityProfile: 'standard' });
-  const constrainedResult = compileWorkflow({ workflow: constrained, qualityProfile: 'standard' });
-
-  assert.equal(baselineResult.ok, true, JSON.stringify(baselineResult.diagnostics, null, 2));
-  assert.equal(constrainedResult.ok, true, JSON.stringify(constrainedResult.diagnostics, null, 2));
-  assert.equal(constrainedResult.svg, baselineResult.svg);
-  assert.deepEqual(constrainedResult.receipt, baselineResult.receipt);
-});
-
-test('semanticChecks rejects a required path that is not reachable in authored direction', () => {
-  const workflow = document({
-    requiredPaths: [{ from: 'ledger', to: 'resume' }],
-  });
-
-  const result = compileWorkflow({ workflow, qualityProfile: 'standard' });
-
-  assert.equal(result.ok, false);
-  assert.ok(
-    result.diagnostics.some((diagnostic) => diagnostic.code === 'workflow/required-path'),
-    JSON.stringify(result.diagnostics, null, 2),
-  );
-});
-
-test('semanticChecks rejects an undeclared terminal', () => {
-  const workflow = document({
-    allowedTerminals: ['result', 'ledger'],
-  });
-
-  const result = compileWorkflow({ workflow, qualityProfile: 'standard' });
-
-  assert.equal(result.ok, false);
-  assert.ok(
-    result.diagnostics.some((diagnostic) => (
-      diagnostic.code === 'workflow/unexpected-terminal'
-      && diagnostic.subject?.node === 'resume'
-    )),
-    JSON.stringify(result.diagnostics, null, 2),
-  );
-});
-
-test('semanticChecks reports unknown contract node ids before graph analysis', () => {
-  const workflow = document({
-    requiredEdges: [{ from: 'missing', to: 'resume' }],
-  });
-
-  const result = compileWorkflow({ workflow, qualityProfile: 'standard' });
-
-  assert.equal(result.ok, false);
-  assert.deepEqual(
-    result.diagnostics.map(({ code }) => code),
-    ['workflow/semantic-node-reference'],
-  );
-  assert.equal(result.diagnostics[0].subject.path, '/semanticChecks/requiredEdges/0/from');
-});

package/template/.qoder/skills/archify/test/yss-safe-deliver.test.mjs

@@ -1,153 +0,0 @@
-import assert from 'node:assert/strict';
-import { spawnSync } from 'node:child_process';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import test from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const skillRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const wrapper = path.join(skillRoot, 'scripts', 'yss-safe-deliver.mjs');
-const example = path.join(skillRoot, 'examples', 'web-app.architecture.json');
-
-function repository(mode = 'project-instance') {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'yss-archify-safe-'));
-  fs.writeFileSync(path.join(root, 'yss-project.yaml'), `schema_version: 1\nrepository_mode: ${mode}\n`);
-  return root;
-}
-
-function run(root, input, output, extra = []) {
-  return spawnSync(process.execPath, [wrapper, 'architecture', input, output, ...extra], {
-    cwd: root,
-    encoding: 'utf8',
-  });
-}
-
-test('rejects stable output outside the repository-mode allowlist', () => {
-  const root = repository();
-  const input = path.join(root, 'diagram.archify.json');
-  fs.copyFileSync(example, input);
-  const result = run(root, input, path.join(root, 'docs', 'architecture', 'diagram.html'));
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /输出目录必须先随配对的 JSON 源建立|稳定图必须位于/);
-});
-
-test('refuses to overwrite an unrelated file inside the allowlist', () => {
-  const root = repository();
-  const directory = path.join(root, 'docs', 'architecture', 'diagrams', 'runtime-map');
-  fs.mkdirSync(directory, { recursive: true });
-  const input = path.join(directory, 'runtime-map.archify.json');
-  const output = path.join(directory, 'runtime-map.html');
-  fs.copyFileSync(example, input);
-  fs.writeFileSync(output, 'do-not-overwrite');
-  const result = run(root, input, output);
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /拒绝覆盖非 Archify 产物/);
-  assert.equal(fs.readFileSync(output, 'utf8'), 'do-not-overwrite');
-});
-
-test('refuses to overwrite an unrelated receipt inside the allowlist', () => {
-  const root = repository();
-  const directory = path.join(root, 'docs', 'architecture', 'diagrams', 'runtime-map');
-  fs.mkdirSync(directory, { recursive: true });
-  const input = path.join(directory, 'runtime-map.archify.json');
-  const output = path.join(directory, 'runtime-map.html');
-  const receipt = path.join(directory, 'runtime-map.receipt.json');
-  fs.copyFileSync(example, input);
-  fs.writeFileSync(receipt, '{"owner":"human"}\n');
-  const result = run(root, input, output);
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /拒绝覆盖非 YSS Archify receipt/);
-  assert.equal(fs.readFileSync(receipt, 'utf8'), '{"owner":"human"}\n');
-});
-
-test('rejects an allowlisted path that escapes through a symlink', () => {
-  const root = repository();
-  const base = path.join(root, 'docs', 'architecture', 'diagrams');
-  const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'yss-archify-escape-'));
-  fs.mkdirSync(base, { recursive: true });
-  fs.symlinkSync(outside, path.join(base, 'runtime-map'));
-  const input = path.join(outside, 'runtime-map.archify.json');
-  fs.copyFileSync(example, input);
-  const output = path.join(base, 'runtime-map', 'runtime-map.html');
-  const result = run(root, input, output);
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /稳定图必须位于|输出目录越过允许根|符号链接/);
-  assert.equal(fs.existsSync(path.join(outside, 'runtime-map.html')), false);
-});
-
-test('rejects interactive --open delivery in the YSS wrapper', () => {
-  const root = repository();
-  const directory = path.join(root, 'docs', 'architecture', 'diagrams', 'runtime-map');
-  fs.mkdirSync(directory, { recursive: true });
-  const input = path.join(directory, 'runtime-map.archify.json');
-  const output = path.join(directory, 'runtime-map.html');
-  fs.copyFileSync(example, input);
-  const result = run(root, input, output, ['--open']);
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /不允许 --open/);
-});
-
-test('delivers a paired project artifact and an auditable receipt', () => {
-  const root = repository();
-  const directory = path.join(root, 'docs', 'architecture', 'diagrams', 'runtime-map');
-  fs.mkdirSync(directory, { recursive: true });
-  const input = path.join(directory, 'runtime-map.archify.json');
-  const output = path.join(directory, 'runtime-map.html');
-  fs.copyFileSync(example, input);
-  const result = run(root, input, output);
-  assert.equal(result.status, 0, result.stderr);
-  assert.match(fs.readFileSync(output, 'utf8').slice(0, 2048), /meta name="generator" content="archify 2\.16\.0"/);
-  const receipt = JSON.parse(fs.readFileSync(path.join(directory, 'runtime-map.receipt.json'), 'utf8'));
-  assert.equal(receipt.yssArchifyReceipt, true);
-  assert.equal(receipt.archify.validation.checkCount, 9);
-  assert.equal(receipt.archify.validation.warnings, 0);
-});
-
-test('uses the template-source evidence root for stable maintenance diagrams', () => {
-  const root = repository('template-source');
-  const directory = path.join(root, '.template-source', 'evidence', 'maintenance', 'diagrams', 'workflow-map');
-  fs.mkdirSync(directory, { recursive: true });
-  const input = path.join(directory, 'workflow-map.archify.json');
-  const output = path.join(directory, 'workflow-map.html');
-  fs.copyFileSync(example, input);
-  const result = run(root, input, output);
-  assert.equal(result.status, 0, result.stderr);
-  assert.ok(fs.existsSync(path.join(directory, 'workflow-map.receipt.json')));
-});
-
-test('uses an exclusive unpredictable staging directory for the receipt', () => {
-  const source = fs.readFileSync(wrapper, 'utf8');
-  assert.match(source, /fs\.mkdtempSync\(/);
-  assert.match(source, /flag: 'wx'/);
-  assert.doesNotMatch(source, /receipt}\.tmp-\$\{process\.pid\}/);
-
-  const root = repository();
-  const directory = path.join(root, 'docs', 'architecture', 'diagrams', 'runtime-map');
-  fs.mkdirSync(directory, { recursive: true });
-  const input = path.join(directory, 'runtime-map.archify.json');
-  const output = path.join(directory, 'runtime-map.html');
-  const unrelated = path.join(root, 'unrelated.txt');
-  const legacySymlink = path.join(directory, 'runtime-map.receipt.json.tmp-12345');
-  const legacyFile = path.join(directory, 'runtime-map.receipt.json.tmp-67890');
-  fs.copyFileSync(example, input);
-  fs.writeFileSync(unrelated, 'preserve-me');
-  fs.symlinkSync(unrelated, legacySymlink);
-  fs.writeFileSync(legacyFile, 'preserve-this-too');
-
-  const result = run(root, input, output);
-  assert.equal(result.status, 0, result.stderr);
-  assert.equal(fs.readFileSync(unrelated, 'utf8'), 'preserve-me');
-  assert.equal(fs.readFileSync(legacyFile, 'utf8'), 'preserve-this-too');
-  assert.equal(fs.readlinkSync(legacySymlink), unrelated);
-  assert.deepEqual(
-    fs.readdirSync(directory).filter((entry) => entry.startsWith('.runtime-map.receipt.json.tmp-')),
-    [],
-  );
-});
-
-test('YSS override disables the upstream update checker', () => {
-  const skill = fs.readFileSync(path.join(skillRoot, 'SKILL.md'), 'utf8');
-  assert.match(skill, /Do not run `scripts\/check-update\.mjs`/);
-  assert.match(skill, /yss-safe-deliver\.mjs/);
-});

package/template/.qoder/skills/code-review/SKILL.md

@@ -1,126 +0,0 @@
----
-name: code-review
-description: Use when the user wants to review a branch, PR, committed candidate, uncommitted work-in-progress changes, or changes since a fixed point. For YSS implementation, Standards must load Slice contract required_skills plus specialist check inputs such as alibaba-java-code-style and yss-ui; do not add a second generic review skill.
----
-
-Review of a pinned candidate against a fixed point on two core axes, plus UI fidelity when UI is in scope:
-
-- **Standards** — does the code conform to this repo's documented coding standards **and**, for YSS slices, the specialist check inputs compiled in [yss-review-standards.md](references/yss-review-standards.md)?
-- **Spec** — does the code faithfully implement the originating issue / spec?
-- **UI fidelity** (only when the change has UI impact) — does the candidate match the confirmed prototype and `yss-design-system` / `yss-ui`? Type-check or claiming "already aligned" is not a pass. Invoke those skills' verification notes; do not collapse this axis into Standards or Spec. YSS page-module conventions stay on Standards.
-
-Standards and Spec run as **parallel sub-agents** so they don't pollute each other's context, then this skill aggregates their findings. When UI is in scope, add a separate UI fidelity pass after those two reports (do not merge it into either axis).
-
-If `docs/agents/issue-tracker.md` is missing, tell the user to run `/setup-matt-pocock-skills`; do not invoke another user-invoked skill yourself.
-
-## Process
-
-### 1. Pin the fixed point and candidate
-
-Whatever the user said is the fixed point — a commit SHA, branch name, tag, `main`, `HEAD~5`, etc. If they didn't specify one, ask for it.
-
-Choose one candidate mode from the request or an upstream review contract:
-
-- **Committed candidate** — review committed branch/PR state. Capture `git diff <fixed-point>...HEAD` and `git log <fixed-point>..HEAD --oneline`.
-- **Worktree candidate** — review work in progress without requiring a commit. Resolve `<merge-base>` with `git merge-base <fixed-point> HEAD`, then capture:
-  - `git diff --no-ext-diff --binary --full-index <merge-base>` for committed, staged and unstaged tracked content as it exists in the working tree;
-  - `git ls-files -z --others --exclude-standard` for NUL-delimited raw untracked paths;
-  - each untracked file's content, using `git diff --no-index --no-ext-diff --binary --full-index -- /dev/null <path>` when a diff representation is useful. Exit code `1` from this command means a difference was found, not that review failed;
-  - `git log <fixed-point>..HEAD --oneline` for the committed portion of the candidate.
-
-Record one **candidate manifest** before spawning reviewers:
-
-```yaml
-review_mode: committed # or worktree
-review_base_ref: <fixed-point>
-merge_base: <resolved-sha>
-implementation_candidate_ref: HEAD # or working-tree
-candidate_snapshot_ref: <immutable-commit-or-captured-snapshot>
-candidate_digest: <sha256-or-immutable-tree-id>
-tracked_diff_command: <command>
-untracked_inventory_command: <command-or-null>
-untracked_files: []
-commit_list_command: <command>
-```
-
-For a Committed candidate, resolve `HEAD` to an immutable commit and tree before review. Its manifest must include `merge_base`, `tracked_diff_command` and `commit_list_command`. For a Worktree candidate, the manifest must additionally include `untracked_inventory_command`, `untracked_diff_command` and the exact `untracked_files` inventory.
-
-For a Worktree candidate, capture the tracked binary diff and every untracked file's bytes once into an immutable snapshot, compute `candidate_digest`, and make that **captured candidate** available to both reviewers. The following is normative, not illustrative: use the `yss-worktree-candidate-v1` byte stream. Start with ASCII `YSS-WORKTREE-CANDIDATE-V1` followed by one NUL byte. Append one tracked record: byte `0x54`, unsigned 64-bit big-endian binary-diff byte length, then the exact stdout bytes from `git diff --no-ext-diff --binary --full-index <merge-base>`. Then append one untracked record for each NUL-delimited raw path from `git ls-files -z --others --exclude-standard`, sorted bytewise by the raw path: byte `0x55`, unsigned 64-bit big-endian path length, raw path bytes, unsigned 32-bit big-endian `lstat` mode, entry-kind byte (`0x52` regular or `0x4c` symlink), unsigned 64-bit big-endian content length, then raw regular-file bytes or raw symlink-target bytes. Other entry kinds block capture. This is the sole length-prefixed framing and bytewise path order for the digest. SHA-256 is calculated over exactly this stream. New captures use a previously nonexistent directory under `.template-source/evidence/maintenance/`, land atomically, and store exactly `candidate-manifest.yaml`, `candidate.bin` and `tracked.diff`; `candidate.bin` already contains every untracked byte, so do not duplicate hundreds of `untracked-content/000xxx` files. Explicit exclusions are fail-closed to `.template-source/evidence/maintenance/` evidence and cannot exclude implementation or authority assets. Historical per-file snapshots remain readable. Both reviewers must consume the captured stream and must not independently treat a live worktree as the reviewed candidate.
-
-Before going further, confirm the fixed point and merge-base resolve. A committed candidate must have a non-empty committed diff. A Worktree candidate is non-empty when either its tracked diff or untracked inventory is non-empty. A bad ref, missing candidate part or empty candidate should fail here — not inside two parallel sub-agents. Do not silently downgrade Worktree review to `HEAD`-only review.
-
-### 2. Identify the spec source
-
-Look for the originating spec, in this order:
-
-1. A spec/Ticket/contract reference supplied by the user or an upstream lifecycle review input.
-2. Issue references in the commit messages (`#123`, `Closes #45`, GitLab `!67`, etc.) — fetch via the workflow in `docs/agents/issue-tracker.md`.
-3. A spec file under `docs/`, `specs/`, or `docs/.scratch/` matching the branch name or feature.
-4. If nothing is found, ask the user where the spec is. If they say there isn't one, the **Spec** sub-agent will skip and report "no spec available".
-
-### 3. Identify the standards sources
-
-Compile sources **before** spawning reviewers. For YSS implementation candidates follow [yss-review-standards.md](references/yss-review-standards.md): run machine checks that exist in the implementation repo; then collect repo docs (`CODING_STANDARDS.md` / `CONTRIBUTING.md` if present), every Slice `required_skills` skill file, the impact-conditioned specialist inputs (`alibaba-java-code-style`, `yss-ui`, `yss-domain`, …), and `docs/templates/review-report-template.md`. Missing applicable coverage is `missing_evidence`, not a pass.
-
-For YSS backend review, derive the review roots from the candidate project root, implementation-repository registry, Slice `project_roots` and `allowed_write_paths`. Review only the project itself and registered backend development projects; exclude frontend roots, unrelated submodules/vendor trees and unregistered directories. Never replace this resolution with a fixed `apps/backend` assumption.
-
-Every backend candidate must explicitly assess `yss-repository` and `yss-mybatis`. When the candidate changes persistence structure, Mapper/XML, SQL, pagination, batch operations, scanning/configuration or data-source behavior, read both skills and the selected Repository Profile; exact component claims also require a current `yss-mybatis` source index. When no persistence impact exists, record a concrete `not-applicable` reason for both instead of silently skipping them.
-
-Anything in the repo that documents how code should be written, such as `CODING_STANDARDS.md` or `CONTRIBUTING.md`, remains a source. It does **not** replace YSS or Alibaba specialist inputs.
-
-On top of whatever the repo documents, the Standards axis always carries the **smell baseline** below — a fixed set of Fowler code smells (_Refactoring_, ch.3) that applies even when a repo documents nothing. Two rules bind it:
-
-- **The repo overrides.** A documented repo standard always wins; where it endorses something the baseline would flag, suppress the smell.
-- **Always a judgement call.** Each smell is a labelled heuristic ("possible Feature Envy"), never a hard violation — and, like any standard here, skip anything tooling already enforces.
-
-Each smell reads *what it is* → *how to fix*; match it against the diff:
-
-- **Mysterious Name** — a function, variable, or type whose name doesn't reveal what it does or holds. → rename it; if no honest name comes, the design's murky.
-- **Duplicated Code** — the same logic shape appears in more than one hunk or file in the change. → extract the shared shape, call it from both.
-- **Feature Envy** — a method that reaches into another object's data more than its own. → move the method onto the data it envies.
-- **Data Clumps** — the same few fields or params keep travelling together (a type wanting to be born). → bundle them into one type, pass that.
-- **Primitive Obsession** — a primitive or string standing in for a domain concept that deserves its own type. → give the concept its own small type.
-- **Repeated Switches** — the same `switch`/`if`-cascade on the same type recurs across the change. → replace with polymorphism, or one map both sites share.
-- **Shotgun Surgery** — one logical change forces scattered edits across many files in the diff. → gather what changes together into one module.
-- **Divergent Change** — one file or module is edited for several unrelated reasons. → split so each module changes for one reason.
-- **Speculative Generality** — abstraction, parameters, or hooks added for needs the spec doesn't have. → delete it; inline back until a real need shows.
-- **Message Chains** — long `a.b().c().d()` navigation the caller shouldn't depend on. → hide the walk behind one method on the first object.
-- **Middle Man** — a class or function that mostly just delegates onward. → cut it, call the real target direct.
-- **Refused Bequest** — a subclass or implementer that ignores or overrides most of what it inherits. → drop the inheritance, use composition.
-
-### 4. Spawn both sub-agents in parallel
-
-**Standards sub-agent prompt** — include:
-
-- The full candidate manifest, captured candidate, `candidate_digest`, diff/inventory commands and commit list. For Worktree candidates, explicitly include every untracked file.
-- The list of standards-source files you found in step 3, **plus the smell baseline from step 3** pasted in full. Paste Fowler smells in full. For YSS specialist inputs, pass the exact skill file paths; the reviewer must read them and cite `skill + rule + location`. Do not summarise away mandatory Alibaba or YSS violations to fit a word cap. The 400-word cap applies only to the Fowler smell section.
-- Machine-check commands, exit codes and evidence from step 3. Tooling failure is a hard Standards violation.
-- The brief: "Report — per file/hunk where relevant — (a) every place the diff violates a documented standard or a required YSS / Alibaba specialist rule: cite the skill or file and the rule; (b) any baseline smell you spot: name it and quote the hunk. Distinguish hard violations from judgement calls — documented-standard and mandatory specialist breaches can be hard, but baseline smells are always judgement calls, and a documented repo standard overrides the baseline. Skip anything the machine checks already enforced. Smell section under 400 words; specialist findings have no word cap."
-
-**Spec sub-agent prompt** — include:
-
-- The same candidate manifest, captured candidate, `candidate_digest`, diff/inventory commands and commit list.
-- The path or fetched contents of the spec.
-- The brief: "Report: (a) requirements the spec asked for that are missing or partial; (b) behaviour in the diff that wasn't asked for (scope creep); (c) requirements that look implemented but where the implementation looks wrong. Quote the spec line for each finding. Under 400 words."
-
-If the spec is missing, skip the Spec sub-agent and note this in the final report.
-
-### 5. Aggregate
-
-For template-maintenance task packages carrying `review_round`, preserve the frozen scope and apply the two-round convergence contract. A hard requirement added during review must cite a rule that already applied when the candidate was frozen; otherwise report it as `judgement-call` for the backlog. Round 1 blocking findings return to the implementer and require a new digest plus all review axes. If Round 2 still has an open `violation`, `drift`, or `new_impacts`, return `needs-human` and stop; do not silently start Round 3. Candidate byte changes invalidate every earlier axis report.
-
-Present the reports under `## Standards` and `## Spec` headings, verbatim or lightly cleaned. If UI is in scope, add `## UI fidelity` from the separate pass. Fill `docs/templates/review-report-template.md` specialist tables as part of Standards evidence, not a fourth axis. Do **not** merge or rerank findings — the axes are deliberately separate (see _Why separate axes_). A YSS candidate with blank applicable specialist rows, skipped `required_skills`, or unaddressed mandatory violations is `blocked`, not `completed`. Do not close findings by writing implementation in the review session. `violation` / machine-check failure / blank applicable rows go back to the implementer on the original contract path, then recapture the candidate and rerun every axis. `drift` / `new_impacts` / `required_skills` mismatch mark the contract `stale` and return to 实现合同编译器; do not keep coding on the old contract. `not-applicable` is only for untriggered impacts; mandatory gates have no waiver, only repair or a complete `seam-deferred` record.
-
-For Worktree mode, recapture the candidate digest after both reports return. If it differs from `candidate_digest`, mark both reports as reviewing a **stale candidate** and return `blocked`; the caller may start a new review against a new capture, but this invocation must not aggregate findings from different bytes. Recheck the same digest again at the completion/checkpoint boundary.
-
-State the reviewed `review_mode`, fixed point, candidate digest and coverage before the two reports. End with a one-line summary: total findings per axis, and the worst issue _within each axis_ (if any). Don't pick a single winner across axes — that's the reranking the separation exists to prevent.
-
-## Why separate axes
-
-A change can pass one axis and fail the other:
-
-- Code that follows every standard but implements the wrong thing → **Standards pass, Spec fail.**
-- Code that does exactly what the issue asked but breaks the project's conventions → **Spec pass, Standards fail.**
-- Code that implements the spec but diverges from the confirmed prototype or design system → **Spec pass, UI fidelity fail.**
-
-Reporting them separately stops one axis from masking the other.

package/template/.qoder/skills/code-review/agents/openai.yaml

@@ -1,3 +0,0 @@
-interface:
-  display_name: "Code Review"
-  short_description: "Review standards/spec plus YSS backend Repository/MyBatis and UI inputs"

package/template/.qoder/skills/code-review/references/yss-review-standards.md

@@ -1,61 +0,0 @@
-# YSS 审查标准源与机器检查
-
-本文件只服务唯一默认审查技能 `code-review`。Alibaba Java、YSS 前端 / 后端 skill 是 **Standards 轴的专项检查输入**，不是第二个通用审查 skill。
-
-权威接线：`yss-product-lifecycle/references/orchestration-contract.yaml` 的 `work-unit.code-review.review_standards_route` 与 `review_input`。报告形状：`docs/templates/review-report-template.md`。
-
-## 1. 编译标准源
-
-按顺序收集，缺项写 `not-applicable` 及原因，不得省略适用项：
-
-1. 仓库文档：`CODING_STANDARDS.md`、`CONTRIBUTING.md` 或实现仓等价文件（若存在）。
-2. Slice Implementation Contract 的 `required_skills`：对每个技能读取 `.agents/skills/<id>/SKILL.md` 及该 skill 指明的 references。
-3. 影响面专项检查输入（与合同并集，不得互相替代）：
-   - 后端：`alibaba-java-code-style`、`yss-domain`、`yss-application`、`yss-repository`、`yss-mybatis`、`yss-web-controller`、`yss-dto`、`mapstruct`、`lombok`
-   - UI：`yss-ui`、`yss-design-system`、`yss-ui-business-page-generation`
-4. 报告模板中的后端 / 前端门禁表。空着的适用行视为 `missing_evidence`。
-
-YSS 页面模块约定（YTable、YFormily、页面骨架等）走 Standards，不并入 UI fidelity。UI fidelity 只核原型与状态矩阵。
-
-审查者只读这些 skill，不得用它们写实现路径。`role.test-engineer` 任务包禁止 `implement` 与脚手架生成器。
-
-### 后端范围与持久化适用性
-
-- Review roots 从候选本体项目、实现仓登记、Slice `project_roots` 和 `allowed_write_paths` 解析；只包含本体项目和已登记后端研发项目，不固定为 `apps/backend`，不扫描前端、无关 submodule/vendor 或未登记目录。
-- 每个后端候选都必须分别评估 `yss-repository` 与 `yss-mybatis`。命中 PO、Repository、Mapper/XML、SQL、分页、批量、扫描/配置或数据源行为时，两者均为 applicable，并加载所选 Repository Profile 与当前 MyBatis source index。
-- 精确组件 API/配置结论要求 source index 的组件 tree 与当前源码一致且组件子树 clean；不满足时为 `missing_evidence` / `stale`，不能判 pass。
-- 无持久化影响时，两项 Skill 分别记录具体 `not-applicable` 原因；仅写“未命中”或留空不构成证据。
-
-## 2. 机器检查
-
-在派发 Standards / Spec 子审查之前，对实现仓**已登记且当前可执行**的命令实际跑一遍：
-
-- 后端优先：对本体项目和每个已登记后端研发项目分别执行其切片合同里的 `./mvnw` 验证；若工程已配置 Checkstyle / P3C / Spotless / `validate`，一并执行。
-- 前端优先：切片合同里的 `pnpm` 验证；若存在 `pnpm lint` / `pnpm type-check`，一并执行。
-
-记录命令、退出码、时间和证据引用。退出码非 0 记为 Standards **hard violation**。
-
-仓库没有对应工具时，该工具行写 `not-applicable` 加原因。可被工具检查的 Alibaba / ESLint 规则若工具没跑、LLM 也没按原文引用规则，不得记 `pass`。无法 lint 的分层、页面骨架、Formily 约定由 LLM 按 skill 原文引用。
-
-## 3. 完成阻断
-
-出现以下任一情况时，`work-unit.code-review` 不得 `completed`：
-
-- 未消费合同 `required_skills` 或漏掉命中影响面的专项检查输入
-- 报告模板适用行空白或只写“符合 YSS / 符合阿里规范”
-- mandatory Alibaba 或 YSS 门禁 `violation` 未关闭
-- 机器检查失败，或可检查规则既无工具结果也无原文引用
-- 用第二个通用审查 skill 代替 `code-review`
-
-## 4. Finding 分流与豁免
-
-产品切片与模板维护使用**同一闭环**；只是强度不同：切片绑定当前 Slice Implementation Contract，模板维护绑定 L1 / L2 / L3。权威字段：`review_standards_route.finding_disposition`。
-
-审查者只记录 finding，不得当场改实现代码。
-
-| 类型 | 动作 |
-|---|---|
-| `violation`、机器检查失败、适用行空白、`missing_evidence` | 实现者在**原合同允许路径**内修复；任何修复使候选失效，必须重新捕获并重跑 Standards、Spec、UI fidelity（若命中）和 fresh verification |
-| `drift`、`new_impacts`、`required_skills` 与真实影响不一致 | 合同标 `stale`，回 实现合同编译器 或更早生命周期阶段；禁止在旧合同上继续编码 |
-
-`not-applicable` 仅当影响面未命中。命中后的 mandatory 不得豁免；只允许修复，或写完整 `seam-deferred`（风险、责任人、后续 Ticket、验证计划、目标版本或发布日期）。禁止为日常 Alibaba / YSS 新增生物人豁免门禁；安全 / 公共 API 仍走既有 `TODO-HUMAN-REVIEW` 与生物人门禁。

package/template/.qoder/skills/codebase-design/DEEPENING.md

@@ -1,37 +0,0 @@
-# Deepening
-
-How to deepen a cluster of shallow modules safely, given its dependencies. Assumes the vocabulary in [SKILL.md](SKILL.md) — **module**, **interface**, **seam**, **adapter**.
-
-## Dependency categories
-
-When assessing a candidate for deepening, classify its dependencies. The category determines how the deepened module is tested across its seam.
-
-### 1. In-process
-
-Pure computation, in-memory state, no I/O. Always deepenable — merge the modules and test through the new interface directly. No adapter needed.
-
-### 2. Local-substitutable
-
-Dependencies that have local test stand-ins (PGLite for Postgres, in-memory filesystem). Deepenable if the stand-in exists. The deepened module is tested with the stand-in running in the test suite. The seam is internal; no port at the module's external interface.
-
-### 3. Remote but owned (Ports & Adapters)
-
-Your own services across a network boundary (microservices, internal APIs). Define a **port** (interface) at the seam. The deep module owns the logic; the transport is injected as an **adapter**. Tests use an in-memory adapter. Production uses an HTTP/gRPC/queue adapter.
-
-Recommendation shape: *"Define a port at the seam, implement an HTTP adapter for production and an in-memory adapter for testing, so the logic sits in one deep module even though it's deployed across a network."*
-
-### 4. True external (Mock)
-
-Third-party services (Stripe, Twilio, etc.) you don't control. The deepened module takes the external dependency as an injected port; tests provide a mock adapter.
-
-## Seam discipline
-
-- **One adapter means a hypothetical seam. Two adapters means a real one.** Don't introduce a port unless at least two adapters are justified (typically production + test). A single-adapter seam is just indirection.
-- **Internal seams vs external seams.** A deep module can have internal seams (private to its implementation, used by its own tests) as well as the external seam at its interface. Don't expose internal seams through the interface just because tests use them.
-
-## Testing strategy: replace, don't layer
-
-- Old unit tests on shallow modules become waste once tests at the deepened module's interface exist — delete them.
-- Write new tests at the deepened module's interface. The **interface is the test surface**.
-- Tests assert on observable outcomes through the interface, not internal state.
-- Tests should survive internal refactors — they describe behaviour, not implementation. If a test has to change when the implementation changes, it's testing past the interface.

package/template/.qoder/skills/codebase-design/DESIGN-IT-TWICE.md

@@ -1,44 +0,0 @@
-# Design It Twice
-
-When the user wants to explore alternative interfaces for a chosen deepening candidate, use this parallel sub-agent pattern. Based on "Design It Twice" (Ousterhout) — your first idea is unlikely to be the best.
-
-Uses the vocabulary in [SKILL.md](SKILL.md) — **module**, **interface**, **seam**, **adapter**, **leverage**.
-
-## Process
-
-### 1. Frame the problem space
-
-Before spawning sub-agents, write a user-facing explanation of the problem space for the chosen candidate:
-
-- The constraints any new interface would need to satisfy
-- The dependencies it would rely on, and which category they fall into (see [DEEPENING.md](DEEPENING.md))
-- A rough illustrative code sketch to ground the constraints — not a proposal, just a way to make the constraints concrete
-
-Show this to the user, then immediately proceed to Step 2. The user reads and thinks while the sub-agents work in parallel.
-
-### 2. Spawn sub-agents
-
-Spawn 3+ sub-agents in parallel. Each must produce a **radically different** interface for the deepened module.
-
-Prompt each sub-agent with a separate technical brief (file paths, coupling details, dependency category from [DEEPENING.md](DEEPENING.md), what sits behind the seam). The brief is independent of the user-facing problem-space explanation in Step 1. Give each agent a different design constraint:
-
-- Agent 1: "Minimize the interface — aim for 1–3 entry points max. Maximise leverage per entry point."
-- Agent 2: "Maximise flexibility — support many use cases and extension."
-- Agent 3: "Optimise for the most common caller — make the default case trivial."
-- Agent 4 (if applicable): "Design around ports & adapters for cross-seam dependencies."
-
-Include both [SKILL.md](SKILL.md) vocabulary and CONTEXT.md vocabulary in the brief so each sub-agent names things consistently with the architecture language and the project's domain language.
-
-Each sub-agent outputs:
-
-1. Interface (types, methods, params — plus invariants, ordering, error modes)
-2. Usage example showing how callers use it
-3. What the implementation hides behind the seam
-4. Dependency strategy and adapters (see [DEEPENING.md](DEEPENING.md))
-5. Trade-offs — where leverage is high, where it's thin
-
-### 3. Present and compare
-
-Present designs sequentially so the user can absorb each one, then compare them in prose. Contrast by **depth** (leverage at the interface), **locality** (where change concentrates), and **seam placement**.
-
-After comparing, give your own recommendation: which design you think is strongest and why. If elements from different designs would combine well, propose a hybrid. Be opinionated — the user wants a strong read, not a menu.