create-yss-spec 3.3.1 → 3.3.4

package/template/.claude/skills/yss-ddd-scaffold-generator/scripts/run_scaffold_verification.mjs

@@ -1,124 +0,0 @@
-#!/usr/bin/env node
-/** 在生成项目根目录实际执行 YSS 脚手架的固定验证命令并留证。 */
-import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
-import path from "node:path";
-import process from "node:process";
-import { runCommand } from "../../../../scripts/lib/command-runner.mjs";
-import { assertArchitectureAgreement } from "../../../../scripts/lib/backend-architecture.mjs";
-import { assertLocalDatabaseProfile, scaffoldArchitectureIdentity } from "../../../../scripts/lib/scaffold-local-database.mjs";
-
-const PHASES = ["validate", "test", "package"];
-const COMMANDS = PHASES.map((phase) => `./mvnw ${phase}`);
-const isoNow = () => new Date().toISOString();
-async function isFile(target) { try { return (await stat(target)).isFile(); } catch (error) { if (error.code === "ENOENT") return false; throw error; } }
-async function writeText(target, content) { await mkdir(path.dirname(target), { recursive: true }); await writeFile(target, content, "utf8"); }
-async function isExecutable(target) {
-  try { const info = await stat(target); return info.isFile() && Boolean(info.mode & 0o111); }
-  catch (error) { if (error.code === "ENOENT") return false; throw error; }
-}
-async function readTextIfPresent(target) { try { return await readFile(target, "utf8"); } catch (error) { if (error.code === "ENOENT") return ""; throw error; } }
-function configured(value) { return typeof value === "string" && value.trim().length > 0; }
-function redactSecrets(text, environment = process.env) {
-  let output = text;
-  for (const name of ["MAVEN_REPO_USERNAME", "MAVEN_REPO_PASSWORD"]) {
-    const value = environment[name];
-    if (configured(value)) output = output.replaceAll(value, `[REDACTED:${name}]`);
-  }
-  return output;
-}
-function classifyFailure(phase, outcome) {
-  if (outcome.exitCode === 0) return null;
-  const output = `${outcome.stdout}\n${outcome.stderr}`.replaceAll(/\u001B\[[0-9;]*m/g, "");
-  if (/Non-resolvable parent POM|Could not transfer artifact|Could not resolve (?:dependencies|artifact)|status code: 401|\bUnauthorized\b|PKIX path building failed|Name or service not known|Unknown host/i.test(output)) return "repository-access";
-  if (/Unable to find main class|mainClass.*(?:not found|missing)/i.test(output)) return "bootstrap-entrypoint";
-  if (/COMPILATION ERROR|Compilation failure|maven-compiler-plugin/i.test(output)) return "compilation";
-  if (phase === "validate") return "project-model";
-  if (phase === "test") return "test-failure";
-  if (phase === "package") return "packaging";
-  return "maven-execution";
-}
-function parseArgs(argv) { const result = {}; for (let index = 0; index < argv.length; index += 1) { let token = argv[index]; if (token === "--help" || token === "-h") { result.help = true; continue; } const equals = token.indexOf("="); let value; if (equals !== -1) { value = token.slice(equals + 1); token = token.slice(0, equals); } if (!["--project-root", "--evidence-dir", "--timeout-ms"].includes(token)) throw new Error(`不支持的参数: ${token}`); if (value === undefined) value = argv[++index]; if (!value || value.startsWith("--")) throw new Error(`参数 ${token} 缺少值`); if (token === "--timeout-ms") result.timeoutMs = Number(value); else result[token === "--project-root" ? "projectRoot" : "evidenceDir"] = path.resolve(value); } if (result.help) return result; if (!result.projectRoot || !result.evidenceDir) throw new Error("必须提供 --project-root 和 --evidence-dir"); return result; }
-function validateManifest(manifest) {
-  if (![2, 3, 4].includes(manifest.schema_version)) throw new Error(`unsupported: scaffold Manifest schema_version=${manifest.schema_version}；只读兼容 v2，并验证当前 v3/v4`);
-  const required = ["schema_version", "contract_id", "contract_version", "scaffold_request_id", "contract_digest", "profiles", "ownership", "readiness", "generation_policy", "completion_level", "approval_ref", "approver", "lifecycle_approval_ref", "compiler_draft_ref", "persisted_ref", "contract_file_ref", "current_version", "allowed_write_paths", "expected_evidence_files", "verification_commands", "generation_mode"];
-  if (manifest.schema_version === 3) required.push("architecture_family", "generator_skill", "decision_id", "decision_digest", "module_profile");
-  const missing = required.filter((field) => manifest[field] === undefined || manifest[field] === null || manifest[field] === "");
-  if (manifest.generation_mode !== "controlled-generation" || missing.length) throw new Error(`脚手架生成元数据清单不完整或不是 controlled-generation: ${missing.join(", ")}`);
-  if (manifest.schema_version === 3) {
-    if (manifest.kind || manifest.architecture_identity) {
-      assertLocalDatabaseProfile(manifest.profiles);
-      assertArchitectureAgreement(manifest.architecture_identity, { manifest_fields: scaffoldArchitectureIdentity(manifest, manifest.contract_digest) });
-    }
-    const supportedArchitecture = manifest.architecture_family === "domain-driven" && manifest.generator_skill === "yss-ddd-scaffold-generator" && manifest.profiles.architecture === "target-domain-model"
-      || manifest.architecture_family === "layered-mvc" && ["yss-layered-mvc-scaffold-generator", "yss-mvc-data-analysis-project-initializer"].includes(manifest.generator_skill) && manifest.profiles.architecture === "layered-mvc";
-    if (!supportedArchitecture || manifest.module_profile?.resolution_version !== 1 || !Array.isArray(manifest.module_profile?.resolved_modules)) throw new Error("Manifest v3 的架构族、生成器、Profile 或模块闭包不一致");
-  } else if (manifest.profiles.architecture !== "target-domain-model") throw new Error("历史 Manifest v2 只读兼容仅支持 target-domain-model");
-  if (manifest.generation_policy.mode !== "initialize-only" || manifest.generation_policy.existing_target !== "unsupported" || manifest.generation_policy.old_project_migration !== "unsupported" || manifest.generation_policy.template_upgrade !== "unsupported") throw new Error("Manifest 必须声明严格 initialize-only；已有目标、旧项目迁移和模板升级均须为 unsupported");
-  if (manifest.current_version !== manifest.contract_version) throw new Error("脚手架生成元数据清单不是当前合同版本");
-  if (JSON.stringify(manifest.verification_commands) !== JSON.stringify(COMMANDS)) throw new Error("脚手架生成元数据清单验证命令不符合固定合同");
-}
-export async function run(projectRoot, evidenceDir, environment = process.env, { timeoutMs = 0, signal } = {}) {
-  const wrapper = path.join(projectRoot, "mvnw"), manifestPath = path.join(projectRoot, ".yss", "scaffold-generation.json");
-  if (!await isFile(wrapper)) throw new Error(`项目根目录缺少 Maven wrapper: ${wrapper}`);
-  if (!await isFile(manifestPath)) throw new Error(`项目根目录缺少脚手架生成元数据清单: ${manifestPath}`);
-  let manifest; try { manifest = JSON.parse(await readFile(manifestPath, "utf8")); } catch { throw new Error(`脚手架生成元数据清单无法读取或不是合法 JSON: ${manifestPath}`); }
-  validateManifest(manifest);
-  await mkdir(evidenceDir, { recursive: true });
-  const mavenConfig = await readTextIfPresent(path.join(projectRoot, ".mvn", "maven.config"));
-  const preflight = {
-    wrapper_exists: true,
-    wrapper_executable: await isExecutable(wrapper),
-    java_home_configured: configured(environment.JAVA_HOME),
-    maven_repository_credentials_configured: configured(environment.MAVEN_REPO_USERNAME) && configured(environment.MAVEN_REPO_PASSWORD),
-    maven_repository_url_configured: configured(environment.YSS_MAVEN_REPOSITORY_URL),
-    project_settings_present: await isFile(path.join(projectRoot, ".mvn", "settings.xml")),
-    project_maven_config_present: await isFile(path.join(projectRoot, ".mvn", "maven.config")),
-    project_settings_wired: /(?:^|\s)-(?:s|-settings)\s+\.mvn\/settings\.xml(?:\s|$)/m.test(mavenConfig),
-    repository_profile: manifest.profiles.repository,
-    repository_profile_wired: /(?:^|\s)-(?:P|-activate-profiles)\s+yss-internal(?:\s|$)/m.test(mavenConfig),
-    maven_coordinates_source: manifest.maven_coordinates_source
-  };
-  const failed = [];
-  if (!preflight.wrapper_executable) failed.push("wrapper-not-executable");
-  if (!preflight.project_settings_present || !preflight.project_maven_config_present || !preflight.project_settings_wired || !preflight.repository_profile_wired) failed.push("repository-profile-not-wired");
-  if (!preflight.maven_repository_url_configured) failed.push("repository-url-not-configured");
-  if (!preflight.maven_repository_credentials_configured) failed.push("repository-credentials-not-configured");
-  if (failed.length) return { verification_mode: "controlled-generation", project_root: projectRoot, scaffold_manifest_ref: manifestPath, generated_at: isoNow(), status: "failed", failure_category: "verification-preflight", completion_level: "generated", preflight: { ...preflight, failures: failed }, commands: [] };
-  const commands = [];
-  for (const phase of PHASES) {
-    const stdoutPath = path.join(evidenceDir, `mvnw-${phase}.stdout.log`);
-    const stderrPath = path.join(evidenceDir, `mvnw-${phase}.stderr.log`);
-    const startedAt = isoNow();
-    const started = process.hrtime.bigint();
-    const execution = await runCommand(wrapper, [phase], { cwd: projectRoot, env: environment, timeoutMs, signal, stdoutFile: stdoutPath, stderrFile: stderrPath, secrets: [environment.MAVEN_REPO_USERNAME, environment.MAVEN_REPO_PASSWORD], progress: true });
-    const outcome = { ...execution, exitCode: execution.status };
-    const durationMs = Number(process.hrtime.bigint() - started) / 1e6;
-    await writeText(stdoutPath, redactSecrets(outcome.stdout, environment));
-    await writeText(stderrPath, redactSecrets(outcome.stderr, environment));
-    commands.push({
-      command: `./mvnw ${phase}`,
-      phase,
-      exit_code: outcome.exitCode,
-      failure_category: outcome.termination || classifyFailure(phase, outcome),
-      duration_ms: Number(durationMs.toFixed(3)),
-      started_at: startedAt,
-      executed_at: isoNow(),
-      stdout_ref: stdoutPath,
-      stderr_ref: stderrPath
-    });
-  }
-  const failureCategory = commands.find((item) => item.failure_category)?.failure_category ?? null;
-  return {
-    verification_mode: "controlled-generation",
-    project_root: projectRoot,
-    scaffold_manifest_ref: manifestPath,
-    generated_at: isoNow(),
-    status: failureCategory === null ? "passed" : "failed",
-    failure_category: failureCategory,
-    completion_level: failureCategory === null ? "empty-scaffold-verified" : "generated",
-    preflight,
-    commands
-  };
-}
-async function main() { let args; try { args = parseArgs(process.argv.slice(2)); if (args.help) { console.log("运行 YSS 脚手架真实验证命令\n用法: node scripts/run_scaffold_verification.mjs --project-root <dir> --evidence-dir <dir>"); return 0; } const reportPath = path.join(args.evidenceDir, "scaffold-verification.json"); try { const report = await run(args.projectRoot, args.evidenceDir, process.env, { timeoutMs: args.timeoutMs ?? 0 }); await writeText(reportPath, `${JSON.stringify(report, null, 2)}\n`); console.log(`${report.status}: ${reportPath}`); return report.status === "passed" ? 0 : 1; } catch (error) { const report = { verification_mode: "controlled-generation", project_root: args.projectRoot, generated_at: isoNow(), status: "failed", failure_category: "verification-preflight", error: error.message, commands: [] }; await writeText(reportPath, `${JSON.stringify(report, null, 2)}\n`); process.stderr.write(`❌ 脚手架验证无法执行: ${error.message}\n`); return 1; } } catch (error) { process.stderr.write(`❌ 脚手架验证无法执行: ${error.message}\n`); return 1; } }
-if (process.argv[1] && import.meta.url === new URL(`file://${process.argv[1]}`).href) process.exitCode = await main();

package/template/.claude/skills/yss-ddd-scaffold-generator/scripts/scaffold-generator.test.mjs

@@ -1,439 +0,0 @@
-import { attachScaffoldDecisionFixture } from "../../../../scripts/fixtures/user-decision/build-fixture.mjs";
-import assert from "node:assert/strict";
-import { execFile } from "node:child_process";
-import { createHash } from "node:crypto";
-import { chmod, mkdtemp, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
-import { existsSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { fileURLToPath } from "node:url";
-import { run } from "./run_scaffold_verification.mjs";
-import { makeGitlinkFixture } from "../../../../scripts/lib/git-submodule-fixtures.mjs";
-import { GITLINK_MODE, gitLsFilesStage } from "../../../../scripts/lib/repository-scope-policy.mjs";
-
-const scripts = path.dirname(fileURLToPath(import.meta.url));
-const generator = path.join(scripts, "generate_scaffold.mjs");
-const workflow = path.join(scripts, "generate_and_verify_scaffold.mjs");
-const command = (args, options = {}) => new Promise((resolve) => execFile(process.execPath, [generator, ...args], { encoding: "utf8", ...options }, (error, stdout, stderr) => resolve({ code: error?.code ?? 0, stdout, stderr })));
-const workflowCommand = (args, options = {}) => new Promise((resolve) => execFile(process.execPath, [workflow, ...args], { encoding: "utf8", ...options }, (error, stdout, stderr) => resolve({ code: error?.code ?? 0, stdout, stderr })));
-async function treeDigest(root) {
-  const hash = createHash("sha256");
-  async function visit(directory) {
-    for (const entry of (await readdir(directory, { withFileTypes: true })).sort((left, right) => left.name.localeCompare(right.name))) {
-      const absolute = path.join(directory, entry.name);
-      if (entry.isDirectory()) await visit(absolute);
-      else if (entry.isFile()) hash.update(path.relative(root, absolute).split(path.sep).join("/")).update("\0").update(await readFile(absolute)).update("\0");
-    }
-  }
-  await visit(root);
-  return hash.digest("hex");
-}
-function contract(outputDir, overrides = {}) {
-  return {
-    schema_version: 3,
-    contract_id: "scaffold-1",
-    contract_version: 1,
-    scaffold_request_id: "scaffold-request-1",
-    status: "approved",
-    compiler_draft_ref: "compiler-1",
-    lifecycle_approval_ref: "approval-1",
-    persisted_ref: "persisted-1",
-    current_version: 1,
-    implementation_repository: "external",
-    backend_repository: "external",
-    scaffold_status: "required",
-    project_name: "demo-service",
-    target_output_dir: outputDir,
-    base_package: "com.yss.demo",
-    architecture_family: "domain-driven", architecture_profile: "target-domain-model",
-    generator_skill: "yss-ddd-scaffold-generator",
-    decision_ref: "scaffold-architecture-decisions.yaml",
-    decision_id: "scaffold-decision.demo-service",
-    decision_digest: `sha256:${"0".repeat(64)}`,
-    maven_coordinates: {
-      group_id: "com.yss.datamiddle",
-      project_version: "1.0.0-SNAPSHOT",
-      parent: { group_id: "com.yss.datamiddle", artifact_id: "yss-datamiddle-parent", version: "2.0.0-SNAPSHOT" },
-      yss_components_version: "2.0.0-SNAPSHOT"
-    },
-    profiles: {
-      architecture: "target-domain-model",
-      persistence: "mybatis-plus",
-      verification_database: "h2", production_database: "not-bound",
-      platform: "spring-boot-2.7-jdk8",
-      validation_namespace: "javax",
-      dto_placement: "web",
-      repository: "yss-internal"
-    },
-    module_profile: { resolution_version: 1, requested_capabilities: [], resolved_modules: ["domain", "application", "infrastructure", "adapter", "bootstrap"] },
-    allowed_write_paths: ["."],
-    expected_evidence_files: [".yss/scaffold-generation.json"],
-    verification_commands: ["./mvnw validate", "./mvnw test", "./mvnw package"],
-    approval: { approval_ref: "approval-1", approver: "reviewer", persisted_ref: "persisted-1", current_version: 1 },
-    work_unit: { id: "unit-1", behavior: "scaffold", primary_skill: "yss-ddd-scaffold-generator", supporting_skills: ["yss-implementation-contract-compiler"], tdd_mode: "controlled-generation", allowed_write_paths: ["."], expected_evidence: ["manifest"], verification_commands: ["./mvnw validate", "./mvnw test", "./mvnw package"], controlled_generation: true },
-    generation_policy: { mode: "initialize-only", existing_target: "unsupported", old_project_migration: "unsupported", template_upgrade: "unsupported" },
-    ...overrides
-  };
-}
-async function fixture(contractOverrides = {}) {
-  const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-node-"));
-  const output = path.join(root, "implementation");
-  await mkdir(output);
-  const decisionFile = path.join(root, "scaffold-architecture-decisions.yaml");
-  let decisionText = `${JSON.stringify({ schema_version: 1, kind: "scaffold-architecture-decisions", template: false, status: "current", decisions: [{ decision_id: "scaffold-decision.demo-service", project_id: "demo-service", parent_project_id: null, status: "lifecycle-approved", recommended_architecture: "domain-driven", recommendation_reasons: ["存在复杂领域规则"], confirmed_architecture: "domain-driven", override_reason: null, inheritance_mode: "root-default", inherited_from: null, platform_profile: "spring-boot-2.7-jdk8", architecture_profile: "target-domain-model", verification_database: "h2", production_database: "not-bound", requested_capabilities: [], resolved_modules: ["domain", "application", "infrastructure", "adapter", "bootstrap"], resolution_version: 1, user_confirmation: { confirmed_by: "tester", channel: "test", confirmation_ref: "test://confirmation", confirmed_at: "2026-09-05T00:00:00Z", normalized_text: "确认使用 DDD" }, decision_inputs_digest: `sha256:${"1".repeat(64)}` }] }, null, 2)}\n`;
-  const decisionSet = JSON.parse(decisionText);
-  decisionSet.decisions = decisionSet.decisions.map((decision) => attachScaffoldDecisionFixture(path.join(root, "user-decision"), decision));
-  decisionText = JSON.stringify(decisionSet, null, 2) + "\n";
-  await writeFile(decisionFile, decisionText);
-  const decisionDigest = `sha256:${createHash("sha256").update(decisionText).digest("hex")}`;
-  const contractFile = path.join(root, "contract.json");
-  await writeFile(contractFile, `${JSON.stringify(contract(output, { decision_digest: decisionDigest, ...contractOverrides }), null, 2)}\n`);
-  return { root, output, contractFile, decisionFile, args: ["--project-name", "demo-service", "--base-package", "com.yss.demo", "--output-dir", output, "--contract-id", "scaffold-1", "--contract-version", "1", "--approval-ref", "approval-1", "--compiler-draft-ref", "compiler-1", "--persisted-ref", "persisted-1", "--contract-file", contractFile, "--group-id", "com.yss.datamiddle", "--project-version", "1.0.0-SNAPSHOT", "--parent-group-id", "com.yss.datamiddle", "--parent-artifact-id", "yss-datamiddle-parent", "--parent-version", "2.0.0-SNAPSHOT", "--yss-components-version", "2.0.0-SNAPSHOT"] };
-}
-
-const controlledEnvironment = {
-  ...process.env,
-  YSS_MAVEN_REPOSITORY_URL: "https://repo.example.invalid/repository/maven-public/",
-  MAVEN_REPO_USERNAME: "test-user",
-  MAVEN_REPO_PASSWORD: "test-password"
-};
-function targetManifest(overrides = {}) {
-  return {
-    schema_version: 3,
-    contract_id: "id",
-    contract_version: 1,
-    scaffold_request_id: "request",
-    contract_digest: "a".repeat(64),
-    approval_ref: "approval",
-    approver: "reviewer",
-    lifecycle_approval_ref: "approval",
-    compiler_draft_ref: "router",
-    persisted_ref: "persisted",
-    contract_file_ref: "contract",
-    current_version: 1,
-    allowed_write_paths: ["."],
-    expected_evidence_files: ["manifest"],
-    verification_commands: ["./mvnw validate", "./mvnw test", "./mvnw package"],
-    generation_mode: "controlled-generation",
-    completion_level: "generated",
-    architecture_family: "domain-driven", architecture_profile: "target-domain-model",
-    generator_skill: "yss-ddd-scaffold-generator",
-    decision_id: "scaffold-decision.demo-service",
-    decision_digest: `sha256:${"a".repeat(64)}`,
-    module_profile: { resolution_version: 1, requested_capabilities: [], resolved_modules: ["domain", "application", "infrastructure", "adapter", "bootstrap"] },
-    profiles: { architecture: "target-domain-model", repository: "yss-internal" },
-    ownership: { generated_files: [] },
-    readiness: { downstream_skills: {}, architecture_ruleset: "b".repeat(64) },
-    generation_policy: { mode: "initialize-only", existing_target: "unsupported", old_project_migration: "unsupported", template_upgrade: "unsupported" },
-    maven_coordinates_source: "approved-contract",
-    ...overrides
-  };
-}
-async function prepareVerifierProject(project, manifest = targetManifest()) {
-  await mkdir(path.join(project, ".yss"), { recursive: true });
-  await mkdir(path.join(project, ".mvn"), { recursive: true });
-  await writeFile(path.join(project, ".mvn", "maven.config"), "-s .mvn/settings.xml\n-P yss-internal\n");
-  await writeFile(path.join(project, ".mvn", "settings.xml"), "<settings/>\n");
-  await writeFile(path.join(project, ".yss", "scaffold-generation.json"), `${JSON.stringify(manifest)}\n`);
-}
-
-test("生成批准的服务级 target profile 骨架，并写入可追溯 Manifest v3", async (t) => { const data = await fixture(); t.after(() => rm(data.root, { recursive: true, force: true })); const result = await command(data.args); assert.equal(result.code, 0, result.stderr); const project = path.join(data.output, "demo-service"); const manifest = JSON.parse(await readFile(path.join(project, ".yss/scaffold-generation.json"), "utf8")); assert.equal(manifest.schema_version, 3); assert.equal(manifest.architecture_family, "domain-driven"); assert.equal(manifest.generator_skill, "yss-ddd-scaffold-generator"); assert.equal(manifest.decision_id, "scaffold-decision.demo-service"); assert.equal(manifest.scaffold_request_id, "scaffold-request-1"); assert.equal(manifest.slice_id, undefined); assert.equal(manifest.completion_level, "generated"); assert.equal(manifest.profiles.architecture, "target-domain-model"); assert.deepEqual(manifest.generation_policy, { mode: "initialize-only", existing_target: "unsupported", old_project_migration: "unsupported", template_upgrade: "unsupported" }); assert.match(manifest.generator.template_digest, /^[a-f0-9]{64}$/); assert.match(manifest.contract_digest, /^[a-f0-9]{64}$/); assert.ok(manifest.ownership.generated_files.length > 8); assert.ok(manifest.ownership.generated_files.every((item) => item.owner === "generator" && /^[a-f0-9]{64}$/.test(item.sha256))); assert.equal(manifest.generation_mode, "controlled-generation"); assert.deepEqual(manifest.verification_commands, ["./mvnw validate", "./mvnw test", "./mvnw package"]); assert.equal(manifest.bootstrap_main_class, "com.yss.demo.DemoServiceApplication"); assert.equal(manifest.bootstrap_main_source, "demo-service-bootstrap/src/main/java/com/yss/demo/DemoServiceApplication.java"); assert.match(await readFile(path.join(project, manifest.bootstrap_main_source), "utf8"), /class DemoServiceApplication/); assert.match(await readFile(path.join(project, "pom.xml"), "utf8"), /demo-service/); assert.equal(manifest.readiness.downstream_skills["yss-domain"], await treeDigest(path.resolve(scripts, "../../yss-domain"))); assert.match(manifest.readiness.contracts.scaffold_parent, /^[a-f0-9]{64}$/); assert.match(manifest.readiness.contracts.compiler_contract, /^[a-f0-9]{64}$/); });
-
-test("统一 Project Scaffold Contract v4 可生成 DDD 后端并保留 v4 Manifest", async (t) => {
-  const data = await fixture({ schema_version: 4, kind: "project-scaffold-contract", delivery_role: "backend", scaffold_kind: "backend-ddd", repository_scope: "external-repository", init_git: false, current_version: true });
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  const result = await command(data.args);
-  assert.equal(result.code, 0, result.stderr);
-  const manifest = JSON.parse(await readFile(path.join(data.output, "demo-service", ".yss/scaffold-generation.json"), "utf8"));
-  assert.equal(manifest.schema_version, 4);
-});
-
-test("schema v1 scaffold contract is unsupported and is never upgraded", async (t) => {
-  const data = await fixture({ schema_version: 1 });
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  const result = await command(data.args);
-  assert.equal(result.code, 1);
-  assert.match(result.stderr, /unsupported: scaffold contract schema_version=1/);
-  assert.equal(existsSync(path.join(data.output, "demo-service")), false);
-});
-
-test("一键工作流只有在真实 Maven 三命令全部通过后才报告完成", { timeout: 300_000 }, async (t) => {
-  if (!["YSS_MAVEN_REPOSITORY_URL", "MAVEN_REPO_USERNAME", "MAVEN_REPO_PASSWORD"].every((name) => process.env[name])) {
-    t.skip("缺少受控 YSS Maven 仓库环境，真实 Wrapper 验证由 L3 环境门禁执行");
-    return;
-  }
-  const data = await fixture();
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  const evidence = path.join(data.root, "workflow-evidence");
-  const result = await workflowCommand([...data.args, "--evidence-dir", evidence]);
-  assert.equal(result.code, 0, result.stderr);
-  assert.match(result.stdout, /脚手架生成与验证完成/);
-  const verification = JSON.parse(await readFile(path.join(evidence, "scaffold-verification.json"), "utf8"));
-  const workflowReport = JSON.parse(await readFile(path.join(evidence, "scaffold-workflow.json"), "utf8"));
-  assert.equal(verification.status, "passed");
-  assert.deepEqual(verification.commands.map((item) => item.command), ["./mvnw validate", "./mvnw test", "./mvnw package"]);
-  assert.ok(verification.commands.every((item) => item.exit_code === 0));
-  assert.equal(verification.preflight.project_settings_wired, true);
-  assert.equal(verification.preflight.repository_profile_wired, true);
-  assert.equal(workflowReport.status, "completed");
-  assert.equal(workflowReport.verification_ref, path.join(evidence, "scaffold-verification.json"));
-  const manifest = JSON.parse(await readFile(path.join(data.output, "demo-service", ".yss", "scaffold-generation.json"), "utf8"));
-  assert.equal(manifest.completion_level, "empty-scaffold-verified");
-});
-
-test("显式 Maven 坐标贯穿批准合同、生成参数、全部 POM 和生成清单", async (t) => {
-  const mavenCoordinates = {
-    group_id: "com.example.metadata",
-    project_version: "1.2.3-SNAPSHOT",
-    parent: {
-      group_id: "com.yss.datamiddle",
-      artifact_id: "yss-datamiddle-parent",
-      version: "2.0.0-SNAPSHOT"
-    },
-    yss_components_version: "2.0.0-SNAPSHOT"
-  };
-  const data = await fixture({ maven_coordinates: mavenCoordinates });
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  const result = await command([
-    ...data.args,
-    "--group-id", mavenCoordinates.group_id,
-    "--project-version", mavenCoordinates.project_version,
-    "--parent-group-id", mavenCoordinates.parent.group_id,
-    "--parent-artifact-id", mavenCoordinates.parent.artifact_id,
-    "--parent-version", mavenCoordinates.parent.version,
-    "--yss-components-version", mavenCoordinates.yss_components_version
-  ]);
-  assert.equal(result.code, 0, result.stderr);
-
-  const project = path.join(data.output, "demo-service");
-  const pomFiles = [
-    "pom.xml",
-    "demo-service-domain/pom.xml",
-    "demo-service-application/pom.xml",
-    "demo-service-infrastructure/pom.xml",
-    "demo-service-adapter/pom.xml",
-    "demo-service-adapter/demo-service-web/pom.xml",
-    "demo-service-bootstrap/pom.xml"
-  ];
-  const poms = await Promise.all(pomFiles.map((file) => readFile(path.join(project, file), "utf8")));
-  assert.ok(poms.every((pom) => pom.includes(mavenCoordinates.group_id)), "全部项目内坐标必须使用合同 groupId");
-  assert.ok(poms.every((pom) => pom.includes(mavenCoordinates.project_version)), "全部项目内坐标必须使用合同版本");
-  const manifest = JSON.parse(await readFile(path.join(project, ".yss/scaffold-generation.json"), "utf8"));
-  assert.deepEqual(manifest.maven_coordinates, mavenCoordinates);
-  assert.equal(manifest.maven_coordinates_source, "approved-contract");
-
-});
-
-test("生成工程声明命名仓库 profile、target DDD 依赖边界和构建门禁", async (t) => {
-  const data = await fixture();
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  const result = await command(data.args);
-  assert.equal(result.code, 0, result.stderr);
-  const project = path.join(data.output, "demo-service");
-  const mavenConfig = await readFile(path.join(project, ".mvn/maven.config"), "utf8");
-  const settings = await readFile(path.join(project, ".mvn/settings.xml"), "utf8");
-  assert.match(mavenConfig, /-s \.mvn\/settings\.xml/);
-  assert.match(mavenConfig, /-P yss-internal/);
-  assert.doesNotMatch(settings, /192\.168\.|<activeProfile>aliyun-only<\/activeProfile>/);
-  assert.match(settings, /\$\{env\.YSS_MAVEN_REPOSITORY_URL\}/);
-  assert.match(settings, /\$\{env\.MAVEN_REPO_USERNAME\}/);
-  assert.match(settings, /\$\{env\.MAVEN_REPO_PASSWORD\}/);
-
-  const domainPom = await readFile(path.join(project, "demo-service-domain/pom.xml"), "utf8");
-  const infrastructurePom = await readFile(path.join(project, "demo-service-infrastructure/pom.xml"), "utf8");
-  const bootstrapPom = await readFile(path.join(project, "demo-service-bootstrap/pom.xml"), "utf8");
-  assert.doesNotMatch(domainPom, /yss-component-(?:dto|exception)|jackson-databind|swagger-annotations|validation-api/);
-  assert.match(infrastructurePom, /yss-component-mybatis-plus-starter/);
-  assert.match(infrastructurePom, /spring-boot-starter-jdbc/);
-  assert.match(bootstrapPom, /spring-boot-starter-actuator/);
-  assert.match(bootstrapPom, /spring-boot-starter-test/);
-  const webPom = await readFile(path.join(project, "demo-service-adapter", "demo-service-web", "pom.xml"), "utf8");
-  assert.match(webPom, /yss-component-dto/);
-  assert.match(webPom, /yss-component-exception/);
-  assert.match(webPom, /io\.swagger\.core\.v3/);
-  const parentPom = await readFile(path.join(project, "pom.xml"), "utf8");
-  assert.match(parentPom, /lombok-mapstruct-binding/);
-  assert.match(parentPom, /maven-enforcer-plugin/);
-  assert.match(parentPom, /maven-compiler-plugin/);
-  assert.match(parentPom, /archunit-junit5/);
-});
-
-test("生成工程固定平台 profile、Wrapper checksum，并把调试日志隔离到 local 配置", async (t) => {
-  const data = await fixture();
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  const result = await command(data.args);
-  assert.equal(result.code, 0, result.stderr);
-  const project = path.join(data.output, "demo-service");
-  const wrapper = await readFile(path.join(project, ".mvn", "wrapper", "maven-wrapper.properties"), "utf8");
-  assert.match(wrapper, /^wrapperSha256Sum=[a-f0-9]{64}$/m);
-  assert.match(wrapper, /^distributionSha256Sum=[a-f0-9]{64}$/m);
-  const application = await readFile(path.join(project, "demo-service-bootstrap", "src", "main", "resources", "application.yml"), "utf8");
-  assert.doesNotMatch(application, /StdOutImpl|DEBUG/);
-  assert.doesNotMatch(application, /datasource|jdbc:|profiles:/);
-  const local = await readFile(path.join(project, "demo-service-bootstrap", "src", "main", "resources", "application-scaffold-local.yml"), "utf8");
-  assert.match(local, /jdbc:h2:mem:/);
-  assert.match(local, /mode: never/);
-  const pom = await readFile(path.join(project, "demo-service-infrastructure/pom.xml"), "utf8");
-  assert.doesNotMatch(pom, /mysql-connector|ojdbc|oceanbase|druid/);
-});
-
-test("initialize-only 在写文件前拒绝任何已存在目标和 --force", async (t) => { const data = await fixture(); t.after(() => rm(data.root, { recursive: true, force: true })); const rejected = await command(data.args.map((value) => value === data.contractFile ? path.join(data.root, "missing.json") : value)); assert.equal(rejected.code, 1); assert.match(rejected.stderr, /合同/); await mkdir(path.join(data.output, "demo-service")); await writeFile(path.join(data.output, "demo-service", "keep.txt"), "keep"); const noForce = await command(data.args); assert.equal(noForce.code, 1); assert.match(noForce.stderr, /initialize-only/); const forced = await command([...data.args, "--force"]); assert.equal(forced.code, 1); assert.match(forced.stderr, /initialize-only/); assert.equal(await readFile(path.join(data.output, "demo-service", "keep.txt"), "utf8"), "keep"); });
-
-test("拒绝基础包名与批准合同不一致", async (t) => {
-  const data = await fixture({ base_package: "com.example.approved" });
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  const result = await command(data.args);
-  assert.equal(result.code, 1);
-  assert.match(result.stderr, /--base-package 与脚手架合同不一致/);
-});
-
-test("合同 project_name、profile 和 allowed_write_paths 必须约束实际输出", async (t) => {
-  const wrongName = await fixture({ project_name: "other-service" });
-  t.after(() => rm(wrongName.root, { recursive: true, force: true }));
-  const nameResult = await command(wrongName.args);
-  assert.equal(nameResult.code, 1);
-  assert.match(nameResult.stderr, /--project-name 与脚手架合同不一致/);
-
-  const wrongProfile = await fixture({ profiles: { ...contract("unused").profiles, persistence: "mybatis" } });
-  t.after(() => rm(wrongProfile.root, { recursive: true, force: true }));
-  const profileResult = await command(wrongProfile.args);
-  assert.equal(profileResult.code, 1);
-  assert.match(profileResult.stderr, /unsupported persistence profile/);
-
-  const wrongPath = await fixture({ allowed_write_paths: ["another-service"], work_unit: { ...contract("unused").work_unit, allowed_write_paths: ["another-service"] } });
-  t.after(() => rm(wrongPath.root, { recursive: true, force: true }));
-  const pathResult = await command(wrongPath.args);
-  assert.equal(pathResult.code, 1);
-  assert.match(pathResult.stderr, /allowed_write_paths/);
-});
-
-test("initialize-only 拒绝以 --force 覆盖 .gitmodules 登记的挂载点", async (t) => {
-  const data = await fixture();
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  const superproject = path.join(data.root, "harness");
-  const output = path.join(superproject, "apps/backend");
-  await mkdir(path.join(output, "demo-service"), { recursive: true });
-  await writeFile(path.join(superproject, ".gitmodules"), "[submodule \"demo-service\"]\n\tpath = apps/backend/demo-service\n\turl = https://example.invalid/demo-service.git\n");
-  const contractFile = path.join(data.root, "gitlink-contract.json");
-  await writeFile(contractFile, `${JSON.stringify(contract(output), null, 2)}\n`);
-  const result = await command(["--project-name", "demo-service", "--base-package", "com.yss.demo", "--output-dir", output, "--contract-id", "scaffold-1", "--contract-version", "1", "--approval-ref", "approval-1", "--compiler-draft-ref", "compiler-1", "--persisted-ref", "persisted-1", "--contract-file", contractFile, "--force"]);
-  assert.equal(result.code, 1, result.stderr);
-  assert.match(`${result.stdout}\n${result.stderr}`, /initialize-only|gitlink 不得由脚手架覆盖/);
-});
-
-test("拒绝在 detached HEAD 子仓工作树内当成普通目录生成", async (t) => {
-  const data = await fixture();
-  const detached = makeGitlinkFixture({ checkout: "detached-head" });
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  t.after(() => detached.cleanup());
-  const output = path.join(detached.superproject, detached.mount);
-  const contractFile = path.join(data.root, "detached-contract.json");
-  await writeFile(contractFile, `${JSON.stringify(contract(output), null, 2)}\n`);
-  const result = await command(["--project-name", "nested-service", "--base-package", "com.yss.demo", "--output-dir", output, "--contract-id", "scaffold-1", "--contract-version", "1", "--approval-ref", "approval-1", "--compiler-draft-ref", "compiler-1", "--persisted-ref", "persisted-1", "--contract-file", contractFile]);
-  const text = `${result.stdout}\n${result.stderr}`;
-  assert.equal(result.code, 1, text);
-  assert.doesNotMatch(text, /请显式传入 --force/);
-  assert.match(text, /detached HEAD 不得当成普通目录写入/);
-  assert.equal(existsSync(path.join(output, "nested-service", "pom.xml")), false);
-  assert.equal((await readdir(output)).some((name) => name.includes("staging") || name === "nested-service"), false);
-});
-
-test("--force 覆盖真实 gitlink 不得走普通目录覆盖路径", async (t) => {
-  const data = await fixture();
-  const empty = makeGitlinkFixture({ checkout: "empty-gitlink" });
-  t.after(() => rm(data.root, { recursive: true, force: true }));
-  t.after(() => empty.cleanup());
-  const output = path.join(empty.superproject, "apps/backend");
-  const contractFile = path.join(data.root, "empty-gitlink-contract.json");
-  await writeFile(contractFile, `${JSON.stringify(contract(output), null, 2)}\n`);
-  const result = await command(["--project-name", "billing-service", "--base-package", "com.yss.demo", "--output-dir", output, "--contract-id", "scaffold-1", "--contract-version", "1", "--approval-ref", "approval-1", "--compiler-draft-ref", "compiler-1", "--persisted-ref", "persisted-1", "--contract-file", contractFile, "--force"]);
-  const text = `${result.stdout}\n${result.stderr}`;
-  assert.equal(result.code, 1, text);
-  assert.doesNotMatch(text, /请显式传入 --force/);
-  assert.match(text, /initialize-only|--force 不得把 git-submodule 挂载点当成普通目录覆盖|gitlink 不得/);
-  assert.equal(existsSync(path.join(output, "billing-service", "pom.xml")), false);
-  assert.equal((await readdir(output)).some((name) => name.includes("backup")), false);
-  assert.equal(gitLsFilesStage(empty.superproject, empty.mount)?.mode, GITLINK_MODE);
-});
-
-test("验证器记录三条 wrapper 命令的成功和失败证据", async (t) => { const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-verifier-")); t.after(() => rm(root, { recursive: true, force: true })); const project = path.join(root, "project"); await prepareVerifierProject(project); const wrapper = path.join(project, "mvnw"); await writeFile(wrapper, "#!/bin/sh\n[ \"$1\" = test ] && exit 2\nprintf 'ran %s\\n' \"$1\"\n"); await chmod(wrapper, 0o755); const evidence = path.join(root, "evidence"); const report = await run(project, evidence, controlledEnvironment); assert.equal(report.status, "failed"); assert.equal(report.failure_category, "test-failure"); assert.equal(report.commands[1].failure_category, "test-failure"); assert.equal(report.preflight.wrapper_executable, true); assert.deepEqual(report.commands.map((item) => item.exit_code), [0, 2, 0]); assert.match(await readFile(path.join(evidence, "mvnw-test.stderr.log"), "utf8"), /^$/); });
-
-test("验证器把内部仓库解析失败与编译失败分开报告", async (t) => {
-  const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-repository-failure-"));
-  t.after(() => rm(root, { recursive: true, force: true }));
-  const project = path.join(root, "project");
-  await prepareVerifierProject(project);
-  const wrapper = path.join(project, "mvnw");
-  await writeFile(wrapper, "#!/bin/sh\nprintf 'Non-resolvable parent POM: Could not transfer artifact\\n'\nexit 1\n");
-  await chmod(wrapper, 0o755);
-  const report = await run(project, path.join(root, "evidence"), controlledEnvironment);
-  assert.equal(report.status, "failed");
-  assert.equal(report.failure_category, "repository-access");
-  assert.ok(report.commands.every((item) => item.failure_category === "repository-access"));
-  assert.equal(typeof report.preflight.maven_repository_credentials_configured, "boolean");
-});
-
-test("验证器单独标记 Java 编译失败和 Bootstrap 主类缺失", async (t) => {
-  const cases = [
-    { output: "[ERROR] COMPILATION ERROR", expected: "compilation" },
-    { output: "Unable to find main class", expected: "bootstrap-entrypoint" }
-  ];
-  for (const item of cases) {
-    const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-build-failure-"));
-    t.after(() => rm(root, { recursive: true, force: true }));
-    const project = path.join(root, "project");
-    await prepareVerifierProject(project);
-    const wrapper = path.join(project, "mvnw");
-    await writeFile(wrapper, `#!/bin/sh\n[ "$1" = package ] || exit 0\nprintf '%s\\n' '${item.output}' >&2\nexit 1\n`);
-    await chmod(wrapper, 0o755);
-    const report = await run(project, path.join(root, "evidence"), controlledEnvironment);
-    assert.equal(report.failure_category, item.expected);
-    assert.equal(report.commands[2].failure_category, item.expected);
-  }
-});
-
-test("验证器在全部 Maven 命令成功时通过并保留日志引用", async (t) => { const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-verifier-success-")); t.after(() => rm(root, { recursive: true, force: true })); const project = path.join(root, "project"); await prepareVerifierProject(project); const wrapper = path.join(project, "mvnw"); await writeFile(wrapper, "#!/bin/sh\nprintf 'ran %s\\n' \"$1\"\n"); await chmod(wrapper, 0o755); const report = await run(project, path.join(root, "evidence"), controlledEnvironment); assert.equal(report.status, "passed"); assert.ok(report.commands.every((item) => item.exit_code === 0 && item.stdout_ref.endsWith(".stdout.log"))); });
-
-test("Manifest v3 在缺少受控仓库环境时先于 Maven 执行阻断", async (t) => {
-  const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-v2-preflight-"));
-  t.after(() => rm(root, { recursive: true, force: true }));
-  const project = path.join(root, "project");
-  await prepareVerifierProject(project);
-  const wrapper = path.join(project, "mvnw");
-  await writeFile(wrapper, "#!/bin/sh\nprintf 'must not run'\nexit 99\n");
-  await chmod(wrapper, 0o755);
-  const report = await run(project, path.join(root, "evidence"), { ...process.env, YSS_MAVEN_REPOSITORY_URL: "", MAVEN_REPO_USERNAME: "", MAVEN_REPO_PASSWORD: "" });
-  assert.equal(report.status, "failed");
-  assert.equal(report.failure_category, "verification-preflight");
-  assert.deepEqual(report.commands, []);
-  assert.ok(report.preflight.failures.includes("repository-url-not-configured"));
-});
-
-test("Manifest schema v1 is unsupported and verifier never executes its wrapper", async (t) => {
-  const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-v1-unsupported-"));
-  t.after(() => rm(root, { recursive: true, force: true }));
-  const project = path.join(root, "project");
-  await prepareVerifierProject(project, { schema_version: 1, contract_id: "legacy", contract_version: 1 });
-  const wrapper = path.join(project, "mvnw");
-  await writeFile(wrapper, "#!/bin/sh\nprintf 'must not run' > wrapper-ran\n");
-  await chmod(wrapper, 0o755);
-  await assert.rejects(() => run(project, path.join(root, "evidence"), controlledEnvironment), /unsupported: scaffold Manifest schema_version=1/);
-  assert.equal(existsSync(path.join(project, "wrapper-ran")), false);
-});
-
-test("验证日志会脱敏 Maven 仓库凭据", async (t) => {
-  const root = await mkdtemp(path.join(os.tmpdir(), "yss-scaffold-redaction-"));
-  t.after(() => rm(root, { recursive: true, force: true }));
-  const project = path.join(root, "project");
-  await prepareVerifierProject(project);
-  const wrapper = path.join(project, "mvnw");
-  await writeFile(wrapper, "#!/bin/sh\nprintf '%s %s\\n' \"$MAVEN_REPO_USERNAME\" \"$MAVEN_REPO_PASSWORD\"\n");
-  await chmod(wrapper, 0o755);
-  const sensitiveEnvironment = { ...controlledEnvironment, MAVEN_REPO_USERNAME: "sensitive-user", MAVEN_REPO_PASSWORD: "sensitive-password" };
-  const evidence = path.join(root, "evidence");
-  await run(project, evidence, sensitiveEnvironment);
-  const log = await readFile(path.join(evidence, "mvnw-validate.stdout.log"), "utf8");
-  assert.doesNotMatch(log, /sensitive-user|sensitive-password/);
-  assert.match(log, /\[REDACTED:MAVEN_REPO_USERNAME\].*\[REDACTED:MAVEN_REPO_PASSWORD\]/);
-});