create-yss-spec 3.3.6 → 3.3.8

package/template/docs/user-guide//350/256/276/345/244/207/345/200/237/347/224/250/350/264/257/347/251/277/346/241/210/344/276/213.md

@@ -1,4 +1,4 @@
-# 内部设备借用：贯穿五类项目的教学案例
+# 内部设备借用：贯穿四个现行家族的教学案例
 
 本文是虚构教学说明，不是已批准 Spec、真实交付包或可直接执行的产品合同。示例路径、规则和标识由学习者在独立 `project-instance` 中确认后落盘；模板源不登记这些业务词汇。
 
@@ -17,7 +17,7 @@
 
 ## 1. 选择工作组织
 
-综合模板可承载从澄清到业务验收的管理资产。战略模板只负责上游方案；研发既可以交给通用研发模板，也可以交给后端/前端专职模板。后两者必须登记统一管理方及独立实现仓，不把源代码复制进模板。
+综合模板可承载从澄清到业务验收的管理资产。战略模板只负责上游方案，后端和前端模板按交付协议接力；专职路线必须登记统一管理方及独立实现仓，不把源代码复制进模板。既有通用研发实例只按原固定版本维护，不作为本案例的新建路线。
 
 ## 2. 战略方形成可交接输入
 
@@ -29,18 +29,19 @@
 列出准备交接的规则、关键场景、版本、批准证据和研发待决事项。
 ```
 
-用户逐项核对业务和页面。预期输出为本仓合同要求的已批准战略资产、根词汇、交接描述及证据闭包，不能只交聊天摘要。战略方不在此生成后端工程或冻结工程 API。
+用户逐项核对业务和页面。预期输出为本仓合同要求的已批准战略资产、根词汇、交接描述及证据闭包，不能只交聊天摘要。战略方不在此生成后端工程或冻结工程 API。UI 有变化时交付已批准原型；确认无 UI 变化的既有工程使用 `existing-ui-baseline`，不能用截图把既有界面伪装成原型。
 
 由 Agent 给出实际交接描述路径后，在战略实例执行以下命令。尖括号必须替换为真实路径，输出目录须新建；`--handoff` 是相对源实例的文件路径。
 
 ```bash
+node scripts/preflight-delivery --input <战略预检输入.json> --stage export --json
 node scripts/strategic-handoff export --source-root . --handoff <交接描述相对路径> --output <新包目录> --zip
 node scripts/strategic-handoff verify --bundle <包目录或ZIP>
 ```
 
-预期验包输出 `result: verified` 及包摘要；缺证据或被修改的包会失败。把完整目录/ZIP交给下游，保留版本与摘要，不手改包内文件。
+预检输入使用 `delivery_kind: strategic-handoff`，绑定交接描述和当前 UI 基线。预期验包输出 `result: verified` 及包摘要；缺证据或被修改的包会失败。把完整目录/ZIP 交给下游，保留版本与摘要，不手改包内文件。
 
-## 3. 后端或通用研发接收
+## 3. 后端接收
 
 在接收实例运行：
 
@@ -52,11 +53,11 @@ node scripts/strategic-handoff import --bundle <包目录或ZIP> --target-root .
 ```text
 请读取导入收据和包内规则/场景，核对本仓根 CONTEXT.md 并形成正式对账。
 为“已批准申请领用设备”逐项登记承接、冲突和依赖。
-按当前流程准备战术设计、API Draft/Freeze 和后端 Slice Contract，
+按当前流程核对既有工程身份，准备技术设计、API Draft/Freeze 和后端 Slice Contract，
 登记真实实现仓、验证命令和回滚点。合同获准前只准备材料，不写代码。
 ```
 
-预期保存导入收据、目标词汇对账、规则/场景承接与当前合同；导入成功不会自动批准这些资产。设备占用竞争应落实到设计与可执行测试，不能只在页面禁用按钮。API 变化回到冻结流程。后端专职只承担后端；通用研发按本仓合同承担实际受影响的两端工作。
+预期保存导入收据、目标词汇对账、规则/场景承接与当前合同；导入成功不会自动批准这些资产。既有 Java/Maven 工程需要 repository registration、engineering baseline 和 observation manifest 三份当前原始证据。设备占用竞争应落实到设计与可执行测试，不能只在页面禁用按钮；API 变化回到冻结流程。
 
 ## 4. 后端交付当前切片
 
@@ -70,11 +71,12 @@ node scripts/strategic-handoff import --bundle <包目录或ZIP> --target-root .
 在后端实例执行（交付描述已由实际证据形成）：
 
 ```bash
+node scripts/preflight-delivery --input <后端预检输入.json> --stage export --json
 node scripts/backend-delivery export --source-root . --delivery <交付描述相对路径> --output <新交付包目录> --zip
 node scripts/backend-delivery verify --bundle <交付包目录或ZIP>
 ```
 
-预期 `verified`，但 `live_service_checked: false`：这里只验证快照，不能证明环境当前可用。交付包含战略绑定、冻结接口、批准合同、构建部署及成功/失败验证；不把账号密码装入包。实际 API 和版本探测由已登记环境提供，不凭手册假设已有固定端点。
+后端预检输入使用 `delivery_kind: backend-delivery`，绑定工程身份、技术设计、冻结接口、批准合同、实际制品、部署证据和后端交付源记录。预期 `verified`，但离线验包不能证明环境当前可用。交付不包含账号密码；实际 API 和版本探测由已登记环境提供。
 
 ## 5. 前端联合接收与准备
 
@@ -82,6 +84,7 @@ node scripts/backend-delivery verify --bundle <交付包目录或ZIP>
 
 ```bash
 node scripts/backend-delivery import --bundle <交付包目录或ZIP> --target-root .
+node scripts/preflight-delivery --input <前端接收预检输入.json> --stage accept --json
 ```
 
 战略快照随交付链导入，后端包与战略包分别验证。导入产生接收草稿；核对目标词汇、规则/场景、接口和视觉用例后才能形成正式接收记录。
@@ -99,7 +102,7 @@ node scripts/backend-delivery import --bundle <交付包目录或ZIP> --target-r
 node scripts/verify-frontend-delivery --root . --slice <切片ID> <接收记录相对路径>
 ```
 
-成功是 `inputs-verified` 且 `ready_for_agent: false`。这允许准备计划和合同，正式编码仍须批准且当前的 Slice Contract。前端实现消费冻结 API；发现业务/API缺口回交维护方，不在前端仓悄悄重定义。
+成功是 `inputs-verified` 且 `ready_for_agent: false`。这允许准备前端工程设计、实现计划和合同，正式编码仍须批准且当前的 Slice Contract。Handoff v5 必须明确 `prototype`、`existing-ui-baseline` 或有原因的 `not-applicable`；发现业务、API 或 UI 基线缺口时回交维护方，不在前端仓悄悄重定义。
 
 ## 6. 实现、联调与业务验收
 

package/template/scripts/backend-delivery

@@ -2,13 +2,29 @@
 import { parseArgs } from 'node:util';
 import path from 'node:path';
 import { exportBackendDelivery, openBackendDelivery, importBackendDelivery } from './lib/backend-delivery.mjs';
+import { read, safe, ensure } from './lib/strategic-handoff-io.mjs';
+
+async function preflightExport(values) {
+  const root=path.resolve(values['source-root']),delivery=read(safe(root,values.delivery));
+  const document=read(safe(root,delivery.slice_contract.ref)),contract=document.slice_contract||document;
+  const identity=contract.resolution?.architecture_identity||contract.backend?.architecture_identity||contract.architecture_identity;
+  ensure(identity?.schema_version!==2||values['preflight-input'],'preflight-required: 既有工程身份 v2 导出必须提供 --preflight-input <file>；先按 docs/process/delivery-preflight.md 准备源资产清单并执行 export 阶段只读预检');
+  if(!values['preflight-input'])return;
+  const {preflightDelivery}=await import('./lib/delivery-preflight.mjs');
+  const input=read(path.resolve(values['preflight-input']));
+  ensure(!input.delivery_kind||input.delivery_kind==='backend-delivery','preflight-scope-conflict: 后端导出只能使用 backend-delivery 清单');
+  ensure(path.resolve(root,input.governance_root||'.')===root,'preflight-scope-conflict: 预检治理根与导出来源不同');
+  ensure(input.assets?.backend_delivery?.ref===values.delivery,'preflight-scope-conflict: 预检未绑定本次导出的 delivery 源文件');
+  const result=await preflightDelivery({...input,delivery_kind:'backend-delivery'},{stage:'export',root});
+  if(result.exit_code!==0){const error=new TypeError('delivery-preflight-blocked: 请按每项 recovery 补证，再从正常导出入口重试');error.preflight=result;throw error;}
+}
 try {
-  const {values,positionals}=parseArgs({allowPositionals:true,options:{'source-root':{type:'string'},delivery:{type:'string'},output:{type:'string'},zip:{type:'boolean'},bundle:{type:'string'},'target-root':{type:'string'}}});
+  const {values,positionals}=parseArgs({allowPositionals:true,options:{'source-root':{type:'string'},delivery:{type:'string'},output:{type:'string'},zip:{type:'boolean'},bundle:{type:'string'},'target-root':{type:'string'},'preflight-input':{type:'string'}}});
   if(positionals.length!==1)throw new TypeError('必须指定 export / verify / import');
   let result;
-  if(positionals[0]==='export'&&values['source-root']&&values.delivery&&values.output)result=await exportBackendDelivery({sourceRoot:values['source-root'],deliveryRef:values.delivery,output:values.output,zip:values.zip});
+  if(positionals[0]==='export'&&values['source-root']&&values.delivery&&values.output){await preflightExport(values);result=await exportBackendDelivery({sourceRoot:values['source-root'],deliveryRef:values.delivery,output:values.output,zip:values.zip});}
   else if(positionals[0]==='verify'&&values.bundle)result=await openBackendDelivery(path.resolve(values.bundle),b=>({result:'verified',delivery_id:b.delivery.delivery_id,version:b.delivery.version,bundle_digest:b.manifest.bundle_digest,live_service_checked:false}));
   else if(positionals[0]==='import'&&values.bundle&&values['target-root'])result=await importBackendDelivery({bundle:path.resolve(values.bundle),targetRoot:values['target-root']});
-  else throw new TypeError('用法: backend-delivery export --source-root <repo> --delivery <ref> --output <new-dir> [--zip] | verify --bundle <dir|zip> | import --bundle <dir|zip> --target-root <repo>');
+  else throw new TypeError('用法: backend-delivery export --source-root <repo> --delivery <ref> --output <new-dir> [--preflight-input <file>] [--zip] | verify --bundle <dir|zip> | import --bundle <dir|zip> --target-root <repo>');
   process.stdout.write(`${JSON.stringify(result,null,2)}\n`);
-} catch(error) { process.stderr.write(`${JSON.stringify({result:'blocked',error:error.message})}\n`);process.exitCode=1; }
+} catch(error) { process.stderr.write(`${JSON.stringify({result:'blocked',error:error.message,...(error.preflight?{preflight:error.preflight}:{})})}\n`);process.exitCode=1; }

package/template/scripts/lib/approval-record.mjs

@@ -1,3 +1,4 @@
+import { assertApprovalUserDecision } from './user-decision-reuse.mjs';
 import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { parseDocument } from "../vendor/yaml.mjs";
@@ -101,7 +102,7 @@ export function validateApprovalRecord(record, { rolesDoc, requireApproved = fal
 
 function assertRecordUserDecision(record, registry, options) {
   if (!registry.user_decision_policy.gates.includes(record.gate_id) && countersignRuleForGate(registry.gate_policy, record.gate_id)?.bucket !== "biological_human") return;
-  const result = assertUserDecisionRequirement({ boundary: record.gate_id, subject_ref: record.subject_ref, scope: record.approval_scope, user_decision_ref: record.user_decision_ref }, { ...options, rolesDoc: registry });
+  const result = assertApprovalUserDecision(record, registry, options);
   if (record.actor_kind === "biological-human" && result.validated.some((item) => item.principal_ref !== record.principal_ref)) fail("user-decision-responder-mismatch: 生物人会签者与原始回复者不一致");
 }
 

package/template/scripts/lib/approved-execution-context.mjs

@@ -0,0 +1,106 @@
+import path from 'node:path';
+import { readFileSync } from 'node:fs';
+import { ROOT, read, parse, safe, hash, digest, schema } from './strategic-handoff-io.mjs';
+import { countersignRuleForGate } from './digital-human-roles.mjs';
+import { validateApprovalRecord } from './approval-record.mjs';
+import { assertImplementationDecision } from './user-decision.mjs';
+import { loadSkillRegistry } from './skill-registry.mjs';
+
+const contexts=new WeakMap();
+const gateId='gate.slice-contract-approved';
+const check=(ok,code,message)=>{if(!ok){const error=new TypeError(`${code}: ${message}`);error.code=code;throw error;}};
+const same=(a,b)=>digest(a)===digest(b);
+const ioFor=root=>({root,read:ref=>readFileSync(safe(root,path.relative(root,ref).split(path.sep).join('/')))});
+
+/** Existing registrations require persisted input sections; array properties disappear in JSON. */
+export function assertExistingSliceStructure(contract) {
+  const identity=contract?.resolution?.architecture_identity;
+  if(identity?.schema_version!==2||identity.source_kind!=='existing-registration')return;
+  const object=value=>value!==null&&typeof value==='object'&&!Array.isArray(value);
+  check(object(contract.lifecycle_refs),'EXECUTION_CONTRACT_INVALID','既有工程 Slice lifecycle_refs 必须是对象');
+  for(const field of ['ticket','engineering_baseline'])check(typeof contract.lifecycle_refs[field]==='string'&&contract.lifecycle_refs[field].trim(),'EXECUTION_CONTRACT_INVALID',`既有工程 Slice 缺少 lifecycle_refs.${field}`);
+  check(object(contract.readiness),'EXECUTION_CONTRACT_INVALID','既有工程 Slice readiness 必须是对象');
+  for(const field of ['blockers','stale_inputs','not_applicable'])check(Array.isArray(contract.readiness[field]),'EXECUTION_CONTRACT_INVALID',`既有工程 Slice readiness.${field} 必须是数组`);
+}
+
+/** Reads original local approval; a contract's own approved status never establishes permission. */
+export function verifySliceContractApproval(binding,{root=process.cwd(),contract:expected}={}) {
+  root=path.resolve(root);
+  check(binding?.ref&&binding?.digest&&binding?.approval_ref,'EXECUTION_APPROVAL_REQUIRED','需要当前持久化 Slice 的 ref/digest/approval_ref');
+  const bytes=readFileSync(safe(root,binding.ref));
+  check(hash(bytes)===binding.digest,'EXECUTION_CONTRACT_STALE','Slice 原始字节与绑定不一致');
+  const document=parse(bytes),contract=document.slice_contract||document;
+  check(contract.schema_version===2&&contract.status==='approved'&&typeof contract.contract_id==='string'&&contract.contract_id&&typeof contract.contract_version==='string'&&contract.contract_version&&typeof contract.slice_id==='string'&&contract.slice_id,'EXECUTION_CONTRACT_INVALID','需要已批准且有身份的持久化 Slice v2');
+  assertExistingSliceStructure(contract);
+  check((!binding.id||binding.id===contract.contract_id)&&(!binding.version||binding.version===contract.contract_version),'EXECUTION_CONTRACT_CONFLICT','当前合同身份或版本不匹配');
+  if(expected)check(same(expected.slice_contract||expected,contract),'EXECUTION_CONTRACT_CONFLICT','调用方合同与持久化原字节不一致');
+  const roles=read(safe(root,'docs/agents/digital-human-roles.yaml'));
+  const approval=read(safe(root,binding.approval_ref));
+  if(!countersignRuleForGate(roles.gate_policy,gateId)&&roles.gate_policy.orchestrator?.includes(gateId)) {
+    // The current lifecycle already owns this gate. Consume its checkpoint and existing
+    // implementation-scope decision instead of inventing an approval-record countersignature.
+    check(approval?.gates&&approval?.human_review&&!approval.gate_id,'EXECUTION_APPROVAL_PROTOCOL','当前主控 gate 需要生命周期 checkpoint，不接受伪造 approval-record');
+    schema(approval,'docs/process/schemas/lifecycle-checkpoint.schema.json');
+    const gate=approval.gates?.[gateId],review=approval.human_review||{};
+    check(approval.repository_mode==='project-instance'&&approval.status!=='blocked'&&approval.blockers.length===0,'EXECUTION_APPROVAL_BLOCKED','主控 checkpoint 仍有阻断或不是产品实例');
+    check(gate?.status==='approved'&&gate.subject_ref===binding.ref,'EXECUTION_APPROVAL_SCOPE','主控 gate 未批准当前持久化 Slice');
+    check(review.implementation?.slice_contract_ref===binding.ref,'EXECUTION_APPROVAL_SCOPE','实施批准不指向当前 Slice 原始文件');
+    assertImplementationDecision({...review.implementation,user_decisions:review.user_decisions||[]},{...ioFor(root),rolesDoc:roles});
+  } else {
+    // Historical source profiles that declared this a countersign gate retain their policy.
+    validateApprovalRecord(approval,{...ioFor(root),rolesDoc:roles,requireApproved:true});
+    check(approval.gate_id===gateId&&approval.artifact_bindings?.some(item=>item.id===contract.contract_id&&item.version===contract.contract_version&&item.digest===binding.digest),'EXECUTION_APPROVAL_SCOPE','源会签未绑定当前 Slice 的身份、版本和字节');
+  }
+  return {contract,binding:structuredClone(binding),root};
+}
+
+function executionBasis(verified,{allowCompilerDrift=false}={}) {
+  const {contract}=verified,resolution=contract.resolution||{};
+  const compiler=read(safe(ROOT,'.agents/skills/yss-implementation-contract-compiler/references/compiler-contract.yaml'));
+  if(!allowCompilerDrift)for(const [section,fields] of Object.entries(compiler.slice_contract_required))for(const field of fields)check(Object.hasOwn(section==='root'?contract:contract[section]||{},field),'EXECUTION_CONTRACT_INVALID',`合同缺少 ${section}.${field}`);
+  check(Array.isArray(contract.common?.allowed_write_paths)&&contract.common.allowed_write_paths.length>0&&contract.common.allowed_write_paths.every(value=>typeof value==='string'&&value.trim()),'EXECUTION_SCOPE_MISSING','合同缺少已批准写范围');
+  check(Array.isArray(contract.readiness?.blockers)&&!contract.readiness.blockers.length&&Array.isArray(contract.readiness?.stale_inputs)&&!contract.readiness.stale_inputs.length,'EXECUTION_CONTRACT_STALE','合同就绪条件仍有阻断或过期输入');
+  if(!allowCompilerDrift)check(resolution.registry_digest===digest(loadSkillRegistry()).slice(7)&&resolution.compiler_contract_digest===digest(compiler).slice(7),'EXECUTION_CONTRACT_STALE','编译依据已改变，应重新编译批准');
+  check(resolution.freshness==='current','EXECUTION_CONTRACT_STALE','resolution 不是 current');
+  if(resolution.architecture_identity)check(resolution.architecture_identity_digest===digest(resolution.architecture_identity).slice(7),'EXECUTION_CONTRACT_STALE','编译架构身份摘要不一致');
+  return verified;
+}
+
+export function createApprovedExecutionContext(binding,options={}) {
+  const verified=executionBasis(verifySliceContractApproval(binding,options));
+  const context=Object.freeze({kind:'approved-slice-execution-context'});
+  contexts.set(context,{binding:verified.binding,root:verified.root,allowCompilerDrift:false});
+  return context;
+}
+
+/** A prior approved scope may authenticate bounded output while current compiler facts are recomputed. */
+export function createApprovedRecompilationContext(binding,options={}) {
+  const verified=executionBasis(verifySliceContractApproval(binding,options),{allowCompilerDrift:true});
+  const context=Object.freeze({kind:'approved-slice-recompilation-context'});
+  contexts.set(context,{binding:verified.binding,root:verified.root,allowCompilerDrift:true});
+  return context;
+}
+
+/** Revalidate original bytes on every boundary; a serialized/caller-invented context is rejected. */
+export function assertApprovedExecutionContext(context,{root=process.cwd(),contract,architectureIdentity,architectureEvidence,technicalDesign,sliceId}={}) {
+  const saved=contexts.get(context);
+  check(saved&&saved.root===path.resolve(root),'EXECUTION_CONTEXT_UNTRUSTED','只允许从当前原始 Slice 与本地批准生成的执行上下文');
+  const verified=executionBasis(verifySliceContractApproval(saved.binding,{root,contract}),{allowCompilerDrift:saved.allowCompilerDrift});
+  const current=verified.contract,resolution=current.resolution;
+  if(sliceId)check(current.slice_id===sliceId,'EXECUTION_SCOPE_CONFLICT','执行上下文属于另一切片');
+  if(architectureIdentity)check(same(resolution.architecture_identity,architectureIdentity),'EXECUTION_INPUT_REPLACED','执行上下文不允许替换架构身份或固定源码输入');
+  if(architectureEvidence)check(same(resolution.architecture_evidence,architectureEvidence),'EXECUTION_INPUT_REPLACED','执行上下文不允许替换原始架构证据');
+  if(technicalDesign) {
+    const binding=resolution.technical_design;
+    check(binding?.ref&&binding.digest,'EXECUTION_DESIGN_MISSING','Slice 未绑定当前技术设计');
+    const bytes=readFileSync(safe(root,binding.ref));
+    check(hash(bytes)===binding.digest&&same(parse(bytes),technicalDesign),'EXECUTION_INPUT_REPLACED','执行上下文不允许替换技术设计');
+  }
+  return {allowed_write_paths:[...current.common.allowed_write_paths],contract:current};
+}
+
+export function approvedExecutionBinding(context) {
+  const saved=contexts.get(context);
+  check(saved,'EXECUTION_CONTEXT_UNTRUSTED','不能序列化未验证的执行上下文');
+  return structuredClone(saved.binding);
+}

package/template/scripts/lib/backend-architecture.mjs

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { loadSkillRegistry } from "./skill-registry.mjs";
+import { validateExistingArchitecture, verifyExistingArchitecture } from "./existing-backend-architecture.mjs";
 
 export function architectureDigest(value) {
   const stable = (item) => Array.isArray(item) ? item.map(stable) : item && typeof item === "object"
@@ -9,6 +10,8 @@ export function architectureDigest(value) {
 
 export function validateArchitectureIdentity(identity, registry = loadSkillRegistry()) {
   if (!identity || typeof identity !== "object") throw new TypeError("缺少 architecture_identity；请从工程基线重新编译");
+  if (identity.schema_version === 2) return validateExistingArchitecture(identity, registry);
+  if (identity.schema_version !== undefined || identity.source_kind !== undefined) throw new TypeError("不支持的 architecture_identity 来源或版本");
   const profile = registry.architecture_profiles?.[identity.architecture_profile];
   if (!profile || identity.architecture_family !== profile.architecture_family || identity.generator_skill !== profile.generator_skill) {
     throw new TypeError("architecture_identity 的架构族、Profile 或生成器不匹配");
@@ -28,6 +31,15 @@ export function validateArchitectureIdentity(identity, registry = loadSkillRegis
   return profile;
 }
 
+// Existing projects must present original on-disk evidence, not three copies supplied by a caller.
+export function verifyArchitectureEvidence(identity, evidence, { root, registry = loadSkillRegistry(), execution } = {}) {
+  validateArchitectureIdentity(identity, registry);
+  if (identity.schema_version === 2) return verifyExistingArchitecture(identity, evidence, { root, registry, execution });
+  if (!evidence?.engineering_baseline || !evidence?.repository_registration || !evidence?.manifest) throw new TypeError("缺少工程基线、仓库登记或 Manifest 架构证据");
+  assertArchitectureAgreement(identity, evidence, registry);
+  return { source_kind: "scaffold", bindings: evidence };
+}
+
 export function assertArchitectureAgreement(identity, evidence, registry) {
   validateArchitectureIdentity(identity, registry);
   for (const [name, source] of Object.entries(evidence ?? {})) {

package/template/scripts/lib/backend-delivery.mjs

@@ -1,3 +1,4 @@
+import { verifySliceContractApproval } from './approved-execution-context.mjs';
 import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync } from 'node:fs';
 import path from 'node:path';
 import { tmpdir } from 'node:os';
@@ -6,7 +7,7 @@ import { read, safe, ensure, hash, digest, json, files, write, project, schema,
 
 // Evidence binds the deliverable basis, avoiding a circular hash through its own logs.
 export function backendDeliveryBasis(delivery) {
-  return digest(Object.fromEntries(['delivery_id','version','strategic_bundle_digest','scope','openapi','slice_contract','build','environment'].map(key=>[key,delivery[key]])));
+  return digest(Object.fromEntries(['delivery_id','version','strategic_bundle_digest','strategic_route_id','scope','openapi','slice_contract','build','environment'].filter(key=>delivery[key]!==undefined).map(key=>[key,delivery[key]])));
 }
 
 function boundFile(root, binding) {
@@ -17,6 +18,7 @@ function boundFile(root, binding) {
 
 async function approvedFile(root, binding, gate) {
   const bytes=boundFile(root,binding);
+  if(gate==='gate.slice-contract-approved'){verifySliceContractApproval(binding,{root});return bytes;}
   const record=read(safe(root,binding.approval_ref));
   const roles=sourceApprovalPolicy(read(safe(root,'docs/agents/digital-human-roles.yaml')));
   await sourceApproval(record,roles,root);
@@ -38,7 +40,7 @@ function verification(root, binding, basis, kind) {
   return record;
 }
 
-export async function inspectBackendDelivery(root, ref) {
+export async function inspectBackendDelivery(root, ref, { readOnly = false } = {}) {
   project(root);
   const delivery=read(safe(root,ref));
   schema(delivery,'docs/process/schemas/backend-delivery.schema.json');
@@ -57,6 +59,10 @@ export async function inspectBackendDelivery(root, ref) {
   verification(root,delivery.verification.deployment,basis,'backend-deployment');
   return openBundle(safe(root,delivery.strategic_bundle_ref),bundle=>{
     ensure(bundle.manifest.bundle_digest===delivery.strategic_bundle_digest,'后端交付与战略版本不一致');
+    if([4,5].includes(bundle.handoff.schema_version)){
+      const route=bundle.handoff.consumer_routes.find(item=>item.capability==='backend-technical-design');
+      ensure(route&&route.activation!=='not-applicable'&&delivery.strategic_route_id===route.route_id,'后端交付未绑定当前 backend-technical-design route_id');
+    }
     const sources=new Set([...bundle.indexes.rules.map(x=>x.rule_id),...bundle.indexes.scenarios.map(x=>x.scenario_id)]);
     ensure(delivery.scope.source_ids.every(id=>sources.has(id)),'后端交付引用未知规则/场景');
     const scenarios=bundle.indexes.scenarios.filter(x=>delivery.scope.source_ids.includes(x.scenario_id));
@@ -67,7 +73,7 @@ export async function inspectBackendDelivery(root, ref) {
     }
     ensure(delivery.scope.operation_ids.every(id=>tests.operation_ids.includes(id)),'后端契约验证未覆盖交付接口');
     return {delivery,basis};
-  });
+  }, { readOnly });
 }
 
 function validManifest(manifest,root) {
@@ -152,14 +158,24 @@ export async function importBackendDelivery({bundle,targetRoot}) {
     }
     const strategic=await importBundle({bundle:safe(b.source,b.delivery.strategic_bundle_ref),targetRoot:target});
     const strategicReceipt=read(safe(target,strategic.receipt_ref));
-    const trace=read(safe(target,`${path.posix.dirname(strategic.receipt_ref)}/tactical-traceability-draft.json`));
+    const strategicBase=path.posix.dirname(strategic.receipt_ref);
+    const frontendRoute=strategicReceipt.schema_version===2?strategicReceipt.routes.find(route=>route.capability==='frontend-engineering-design'):null;
+    const traceRef=frontendRoute?.artifact_refs.find(item=>item.endsWith('frontend-traceability-draft.json'))||`${strategicBase}/tactical-traceability-draft.json`;
+    const trace=read(safe(target,traceRef));
     mkdirSync(path.dirname(destination),{recursive:true});
     const staging=mkdtempSync(path.join(path.dirname(destination),'.backend-import-'));
     try {
       cpSync(b.root,path.join(staging,'package'),{recursive:true,errorOnExist:true,force:false});
       const receipt={schema_version:1,delivery_id:b.delivery.delivery_id,version:b.delivery.version,bundle_digest:b.manifest.bundle_digest,package_ref:`${ref}/package`};
       write(staging,'import-receipt.json',json(receipt));
-      write(staging,'frontend-acceptance-draft.json',json({schema_version:1,status:'draft',slice_id:b.delivery.scope.slice_id,backend_delivery:{import_receipt_ref:`${ref}/import-receipt.json`,bundle_digest:b.manifest.bundle_digest},strategic_handoff:{import_receipt_ref:strategic.receipt_ref,bundle_digest:strategicReceipt.bundle_digest,context_reconciliation_ref:'',rows:trace.rows.map(({tactical_refs,test_seam_refs,...row})=>({...row,frontend_case_refs:[]}))},frontend_cases:[]}));
+      const strategicHandoff={import_receipt_ref:strategic.receipt_ref,bundle_digest:strategicReceipt.bundle_digest,...(trace.route_id?{route_id:trace.route_id}:{}),context_reconciliation_ref:'',rows:trace.rows.map(({tactical_refs,test_seam_refs,...row})=>({...row,frontend_case_refs:[]}))};
+      if(strategicReceipt.schema_version===2){
+        ensure(frontendRoute,'Import Receipt 未选择 frontend-engineering-design 能力');
+        const preflightRef=frontendRoute.artifact_refs.find(item=>item.endsWith('frontend-strategic-preflight-draft.json'));ensure(preflightRef,'缺少 Frontend Strategic Preflight 草案');
+        const preflight=read(safe(target,preflightRef));
+        ensure([1,2].includes(preflight.schema_version),'未知 Frontend Strategic Preflight 版本');
+        write(staging,'frontend-acceptance-draft.json',json({schema_version:preflight.schema_version===2?3:2,...(preflight.schema_version===2?{ui_baseline_kind:preflight.ui_baseline_kind}:{}),status:'draft',slice_id:b.delivery.scope.slice_id,strategic_preflight:{ref:preflightRef,digest:hash(readFileSync(safe(target,preflightRef)))},backend_dependency:{mode:'required',route_id:b.delivery.strategic_route_id},backend_delivery:{import_receipt_ref:`${ref}/import-receipt.json`,bundle_digest:b.manifest.bundle_digest},strategic_handoff:strategicHandoff,frontend_cases:[]}));
+      }else write(staging,'frontend-acceptance-draft.json',json({schema_version:1,status:'draft',slice_id:b.delivery.scope.slice_id,backend_delivery:{import_receipt_ref:`${ref}/import-receipt.json`,bundle_digest:b.manifest.bundle_digest},strategic_handoff:strategicHandoff,frontend_cases:[]}));
       ensure(!existsSync(destination),'后端包导入并发冲突');renameSync(staging,destination);
       return {result:'imported-pending-acceptance',receipt_ref:`${ref}/import-receipt.json`,acceptance_ref:`${ref}/frontend-acceptance-draft.json`};
     } finally { rmSync(staging,{recursive:true,force:true}); }

package/template/scripts/lib/delivery-preflight.mjs

@@ -0,0 +1,238 @@
+import { assertExistingSliceStructure, createApprovedExecutionContext, verifySliceContractApproval } from './approved-execution-context.mjs';
+import path from 'node:path';
+import { readFileSync, existsSync } from 'node:fs';
+import { ROOT, read, parse, safe, hash, digest, ensure, schema, sourceApprovalPolicy } from './strategic-handoff-io.mjs';
+import { parseContextContract } from './context-contract.mjs';
+import { validateApprovalRecord } from './approval-record.mjs';
+import { loadSkillRegistry } from './skill-registry.mjs';
+import * as architecture from './backend-architecture.mjs';
+
+const STAGES=['prepare','build','export','accept'];
+const LATER=stage=>STAGES.slice(STAGES.indexOf(stage));
+const OWNERS={governance:'工程接入负责人',architecture:'工程基线与边界审查负责人',openapi:'接口契约负责人',technical_design:'技术设计负责人','slice_contract.execution':'生命周期编排与合同批准方',slice_contract:'生命周期编排与合同批准方',ui_baseline:'产品设计负责人',build_artifact:'后端构建负责人',build:'后端构建负责人',deployment:'后端部署与验证负责人',strategic_handoff:'战略交付方',backend_delivery:'后端交付方',local_authorization:'目标仓接收负责人'};
+const RECOVERY={governance:'完成工程接入登记或正常初始化，读取有效 yss-project.yaml 和根 CONTEXT.md 后重跑预检',architecture:'按工程接入与 backend-architecture 合同补齐原始登记、工程基线、观测 manifest，重新边界审查并编译',openapi:'回到 OpenAPI Draft 审查与 Freeze，绑定当前字节及真实批准',technical_design:'按已登记架构更新技术设计，补齐输入与审查并重新批准','slice_contract.execution':'读取当前 Slice 字节及本地主控批准，恢复 implementation-scope 原始决定后重试',slice_contract:'重新编译 Slice Implementation Contract 并取得当前合同批准',ui_baseline:'由产品设计负责人确认现有 UI 基线；有 UI 改动则回到原型设计',build_artifact:'绑定实际 JAR 文件并与构建 artifact_digest 核对',build:'使用批准合同正常构建，并记录实际输出摘要与验证',deployment:'部署当前构建，采集同进程身份与真实验证证据',strategic_handoff:'修正战略来源与批准，重新导出当前交接资产',backend_delivery:'从正常后端交付入口重新生成与当前来源一致的交付记录',local_authorization:'由目标仓负责人确认当前生产方、项目、route 和 slice 范围'};
+const ASSETS={openapi:'build',technical_design:'build',slice_contract:'build',ui_baseline:'export',build:'export',build_artifact:'export',deployment:'export',strategic_handoff:'export',backend_delivery:'accept',local_authorization:'accept'};
+const errorStatus=error=>error.code==='EXECUTION_CONTRACT_INVALID'?'conflict':/stale|漂移|过期|摘要/.test(error.message)?'stale':/unsupported|未知|不支持|版本/.test(error.message)?'unsupported':/不可读|ENOENT|缺少/.test(error.message)?'missing':'conflict';
+const docBinding=(root,binding)=>{
+  const bytes=readFileSync(safe(root,binding.ref));
+  ensure(hash(bytes)===binding.digest,`stale: 资产摘要漂移: ${binding.ref}`);
+  return parse(bytes);
+};
+const fileBinding=(root,binding)=>{ ensure(binding?.ref&&binding?.digest,'缺少证据 ref/digest');const bytes=readFileSync(safe(root,binding.ref));ensure(bytes.length>0&&hash(bytes)===binding.digest,`stale: 证据为空或摘要漂移: ${binding.ref}`);return bytes; };
+const same=(a,b)=>digest(a)===digest(b);
+
+export function invalidPreflightInput(message) {
+  return {schema_version:1,result:'invalid-input',exit_code:2,stage:null,checks:[{code:'input.protocol',status:'conflict',owner:'交付编排方',source:'delivery-preflight-input',evidence:[],blocking_stages:STAGES,recovery:'按 delivery-preflight-input.schema.json 修正输入协议',message}]};
+}
+
+/** Installed profile owns backend technical authoring; caller governance_root cannot grant it. */
+export function backendPreflightCapability() {
+  const profileRef=path.join(ROOT,'docs/process/harness-profile.yaml');
+  const profile=existsSync(profileRef)?read(profileRef):null;
+  const profileId=profile?.profile_id||'template.full';
+  const ownsBackend=!profile||profileId==='harness.backend-delivery';
+  const required=['.agents/skills/yss-technical-design/scripts/validate-technical-design.mjs','.agents/skills/yss-technical-design/references/technical-design.schema.json','.agents/skills/yss-implementation-contract-compiler/references/compiler-contract.yaml'];
+  const missing=ownsBackend?required.filter(ref=>!existsSync(path.join(ROOT,ref))):[];
+  return {profile_id:profileId,owns_backend:ownsBackend,available:ownsBackend&&!missing.length,missing,
+    reason:ownsBackend?(missing.length?`后端验证运行时分发不完整: ${missing.join(', ')}`:'当前安装拥有后端技术设计与合同验证能力'):`${profileId} 不拥有后端技术设计与实现合同编译职责；由主模板或 backend profile 验证`};
+}
+function requireBackendCapability(key) {
+  const capability=backendPreflightCapability();
+  if(capability.available)return;
+  const error=new TypeError(`unsupported: ${capability.reason}`);
+  error.code=key==='technical_design'?'PREFLIGHT_TECHNICAL_DESIGN_UNSUPPORTED':'PREFLIGHT_SLICE_CONTRACT_UNSUPPORTED';
+  error.recovery=capability.owns_backend?'恢复当前后端 profile 的完整验证运行时分发，再从正常预检入口重跑':'将原始技术资产与批准绑定交给主模板或 backend 工程负责人核验；本 profile 通过已导出的受控交付包接收，不安装另一方创作技能';
+  throw error;
+}
+
+/** Read-only: never executes input commands, starts services, unpacks archives or writes receipts. */
+export async function preflightDelivery(input,{stage,root=process.cwd()}={}) {
+  try { ensure(STAGES.includes(stage),'未知阶段；必须是 prepare|build|export|accept');schema(input,'docs/process/schemas/delivery-preflight-input.schema.json'); }
+  catch(error) { return invalidPreflightInput(error.message); }
+  root=path.resolve(root,input.governance_root||'.');
+  const deliveryKind=input.delivery_kind||'complete';
+  const checks=[], documents={}, valid=new Set(), assets=input.assets||{};
+  let execution;
+  const downstream=key=>deliveryKind==='strategic-handoff'&&(key.startsWith('architecture')||key.startsWith('slice_contract')||['technical_design','slice_contract','build','build_artifact','deployment','backend_delivery','local_authorization'].includes(key)||(key==='openapi'&&!input.assets?.openapi));
+  const add=(key,status,message,{code=key,from='prepare',evidence=[],source=key,recovery=RECOVERY[key]||RECOVERY.architecture}={})=>checks.push({code,status,owner:OWNERS[key]||OWNERS.architecture,source,evidence,blocking_stages:downstream(key)?[]:LATER(from),recovery,message});
+  const run=async(key,action,options={})=>{
+    try { await action();valid.add(key);add(key,'ready','当前原始资产与语义核验通过',options); }
+    catch(error) { add(key,errorStatus(error),error.message,{...options,...(error.recovery?{recovery:error.recovery}:{}),code:typeof error.code==='string'?error.code:options.code||key}); }
+  };
+  const pending=(key,deps,options)=>add(key,'pending',`尚不可判定，依赖未就绪: ${deps.join(', ')}`,options);
+  await run('governance',()=>{
+    const project=read(safe(root,'yss-project.yaml'));
+    ensure(project.schema_version===1&&project.repository_mode==='project-instance','交付预检只消费显式 project-instance；未知身份不得推测');
+    parseContextContract({root});
+  },{source:'yss-project.yaml / CONTEXT.md',evidence:['yss-project.yaml','CONTEXT.md']});
+  if(input.planned_initialization) add('governance','not-applicable','此为拟初始化目标的只读诊断；预检不初始化，缺失的当前阶段前提仍明确阻断',{code:'governance.planned-initialization'});
+
+  const bindings=input.architecture_bindings||{};
+  for(const key of ['repository_registration','engineering_baseline','manifest']) {
+    if(!bindings[key]) add('architecture','missing',`缺少原始架构来源: ${key}`,{code:`architecture.${key}`,source:key});
+    else await run(`architecture.${key}`,()=>{documents[key]=docBinding(root,bindings[key]);verifyArchitectureDocument(key,documents[key],input.scope,root);},{source:key,evidence:[bindings[key].ref]});
+  }
+  if(!input.architecture_identity) add('architecture','missing','缺少 architecture_identity；不能从目录或数据库字符串推断',{code:'architecture.identity'});
+  else await run('architecture.identity',()=>{
+    architecture.validateArchitectureIdentity(input.architecture_identity);
+    if(input.architecture_identity.source_kind==='existing-registration')ensure(input.architecture_identity.repository_id===input.scope.repository_id&&input.architecture_identity.project_id===input.scope.project_id,'架构身份与预检目标仓库/项目不一致');
+  },{source:'architecture_identity'});
+  if(valid.has('architecture.identity'))await run('architecture.profile',()=>{ensure(architecture.validateArchitectureIdentity(input.architecture_identity).maturity==='supported','不支持未达到 supported 的 architecture_profile');},{source:'architecture_profile'});
+  if(['build','export','accept'].includes(stage)&&assets.slice_contract)await run('slice_contract.execution',()=>{requireBackendCapability('slice_contract');execution=createApprovedExecutionContext(assets.slice_contract,{root});},{from:'build',source:assets.slice_contract.approval_ref||'slice_contract',evidence:[assets.slice_contract.ref,...(assets.slice_contract.approval_ref?[assets.slice_contract.approval_ref]:[])]});
+  const archDeps=['architecture.identity',...['repository_registration','engineering_baseline','manifest'].map(x=>`architecture.${x}`)];
+  if(archDeps.every(x=>valid.has(x)))await run('architecture',()=>{
+    ensure(typeof architecture.verifyArchitectureEvidence==='function','不支持既有工程原始证据验证，请同步支持该身份版本的模板运行时');
+    architecture.verifyArchitectureEvidence(input.architecture_identity,bindings,{root,registry:loadSkillRegistry(),execution});
+  },{source:'backend-architecture',evidence:Object.values(bindings).map(x=>x.ref)});
+  else pending('architecture',archDeps.filter(x=>!valid.has(x)),{source:'backend-architecture'});
+
+  // Load the delivery basis before checking deployment; dependency order must not hide drift.
+  if(assets.backend_delivery)try{documents.backend_delivery=docBinding(root,assets.backend_delivery);}catch{}
+  for(const [key,earliest] of Object.entries(ASSETS)) {
+    const from=key==='backend_delivery'&&deliveryKind==='backend-delivery'?'export':earliest;
+    if(deliveryKind==='backend-delivery'&&['ui_baseline','strategic_handoff'].includes(key)&&!assets[key])continue;
+    if(key==='local_authorization'&&documents.backend_delivery?.schema_version!==2) {
+      add(key,'not-applicable','当前未确认交付 v2；本地授权只在受控目标绑定协议 v2 生效',{from});continue;
+    }
+    if(key==='ui_baseline'&&input.scope.ui_mode==='not-applicable') {
+      if(input.scope.ui_not_applicable_reason?.trim())add(key,'not-applicable',input.scope.ui_not_applicable_reason,{from});
+      else add(key,'missing','无 UI 影响必须说明不适用原因',{from});
+      continue;
+    }
+    if(!assets[key]) {add(key,'missing',`缺少 ${key} 原始资产绑定${STAGES.indexOf(stage)<STAGES.indexOf(from)?`；到 ${from} 阶段前补齐`:''}`,{from});continue;}
+    await run(key,async()=>{
+      const binding=assets[key];
+      if(['technical_design','slice_contract'].includes(key))requireBackendCapability(key);
+      if(key==='build_artifact'){fileBinding(root,binding);ensure(documents.build?.artifact_digest===binding.digest,'stale: 实际制品与构建记录摘要不一致');return;}
+      const data=documents[key]=docBinding(root,binding);
+      await verifyAsset(key,data,binding,{root,input,documents,assets,execution});
+    },{from,source:assets[key].ref,evidence:[assets[key].ref,...(assets[key].approval_ref?[assets[key].approval_ref]:[])]});
+  }
+  if(deliveryKind==='backend-delivery')for(const key of ['ui_baseline','strategic_handoff'])if(!assets[key])add(key,valid.has('backend_delivery')?'ready':'pending',valid.has('backend_delivery')?'已通过交付绑定的战略包完成来源与 UI 基线只读复验':'尚不可判定，等待后端交付绑定的战略包核验',{code:`${key}.delivery-package`,from:'export',source:'backend_delivery.strategic_bundle_ref',evidence:assets.backend_delivery?[assets.backend_delivery.ref]:[]});
+  // A present but unreadable dependency must not turn cross-asset agreement into a success.
+  if(assets.slice_contract&&(!valid.has('technical_design')||!valid.has('architecture')))pending('slice_contract',['technical_design','architecture'].filter(x=>!valid.has(x)),{code:'slice_contract.dependencies',from:'build'});
+  if(assets.deployment&&!valid.has('backend_delivery'))pending('deployment',['backend_delivery'],{code:'deployment.delivery-basis',from:'export'});
+  const blocked=checks.some(x=>!['ready','not-applicable'].includes(x.status)&&x.blocking_stages.includes(stage));
+  return {schema_version:1,result:blocked?'blocked':'ready',exit_code:blocked?1:0,stage,checks};
+}
+
+async function approved(root,binding,gates) {
+  ensure(binding.approval_ref&&binding.id&&binding.version,'缺少当前资产 id/version/approval_ref');
+  const record=read(safe(root,binding.approval_ref));
+  const roles=sourceApprovalPolicy(read(safe(root,'docs/agents/digital-human-roles.yaml')));
+  validateApprovalRecord(record,{rolesDoc:roles,requireApproved:true,root,read:ref=>readFileSync(safe(root,path.relative(root,ref).split(path.sep).join('/')))});
+  ensure(gates.includes(record.gate_id),'资产批准使用错误门禁');
+  ensure(record.artifact_bindings?.some(x=>x.id===binding.id&&x.version===binding.version&&x.digest===binding.digest),'stale: 批准未绑定当前资产身份、版本及字节');
+}
+
+async function verifyAsset(key,data,binding,{root,input,documents,assets,execution}) {
+  ensure(data&&typeof data==='object'&&!Array.isArray(data),`${key} 必须是结构化资产`);
+  if(key==='openapi') {
+    ensure(/^3\.1\./.test(data.openapi)&&data.info?.title&&data.info?.version&&data.paths,'必须提供完整 OpenAPI 3.1 文档');
+    const operations=Object.values(data.paths).flatMap(item=>Object.entries(item).filter(([method])=>['get','put','post','delete','options','head','patch','trace'].includes(method)).map(([,operation])=>operation.operationId));
+    ensure(new Set(operations).size===operations.length&&operations.every(x=>typeof x==='string'&&x),'OpenAPI operationId 缺失或重复');
+    ensure(input.scope.operation_ids.every(id=>operations.includes(id)),'预检接口范围不在冻结 OpenAPI 中');
+    await approved(root,binding,['gate.engineering-contract-approved','gate.openapi-frozen','gate.openapi-freeze-confirmed']);
+  } else if(key==='technical_design') {
+    schema(data,'.agents/skills/yss-technical-design/references/technical-design.schema.json');
+    ensure(data.schema_version===2&&data.status==='approved','技术设计必须是已批准 v2 合同');
+    ensure(data.digest===digest(Object.fromEntries(Object.entries(data).filter(([k])=>k!=='digest'))),'stale: 技术设计自摘要不匹配');
+    ensure(data.architecture?.family===input.architecture_identity?.architecture_family,'技术设计与登记架构冲突');
+    for(const asset of data.inputs)fileBinding(root,asset);
+    const {validateTechnicalDesign}=await import('../../.agents/skills/yss-technical-design/scripts/validate-technical-design.mjs');
+    await validateTechnicalDesign(data,{root,sliceRef:input.scope.slice_id,readOnly:true,execution});
+    await approved(root,binding,['gate.engineering-contract-approved','gate.technical-design-approved']);
+  } else if(key==='slice_contract') {
+    const contract=data.slice_contract||data;
+    assertExistingSliceStructure(contract);
+    ensure(contract.schema_version===2&&contract.status==='approved'&&contract.slice_id===input.scope.slice_id,'Slice 合同版本、批准状态或切片不匹配');
+    ensure(binding.id===contract.contract_id&&binding.version===contract.contract_version,'Slice 合同身份与引用不一致');
+    const compiler=read(safe(ROOT,'.agents/skills/yss-implementation-contract-compiler/references/compiler-contract.yaml'));
+    for(const [section,fields]of Object.entries(compiler.slice_contract_required))for(const field of fields)ensure(Object.hasOwn(section==='root'?contract:contract[section]||{},field),`合同缺少 ${section}.${field}`);
+    ensure(contract.readiness.blockers.length===0&&contract.readiness.stale_inputs.length===0,'Slice 合同仍有 blocker 或 stale input');
+    const resolution=contract.resolution;
+    ensure(resolution.freshness==='current','Slice resolution 非 current');
+    ensure(resolution.registry_digest===digest(loadSkillRegistry()).slice(7)&&resolution.compiler_contract_digest===digest(compiler).slice(7),'stale: 编译事实源已变化，需重新编译');
+    ensure(same(resolution.architecture_identity,input.architecture_identity),'Slice 架构与登记不一致');
+    ensure(resolution.architecture_identity_digest===architecture.architectureDigest(input.architecture_identity),'stale: Slice 架构摘要漂移');
+    if(assets.technical_design)ensure(resolution.technical_design?.ref===assets.technical_design.ref&&resolution.technical_design?.digest===assets.technical_design.digest,'Slice 技术设计绑定不一致');
+    verifySliceContractApproval(binding,{root,contract});
+  } else if(key==='strategic_handoff') {
+    const {inspectSource}=await import('./strategic-handoff.mjs');
+    await inspectSource(root,binding.ref);
+    const {uiBaselineRef,uiBaselineKind}=await import('./ui-baseline.mjs');
+    const ui=uiBaselineRef(data);
+    ensure(input.scope.ui_mode!=='not-applicable','战略交接含 UI 基线，不能声明为无 UI 影响');
+    ensure(uiBaselineKind(data)===(input.scope.ui_mode==='prototype'?'prototype':'existing-ui-baseline'),'战略交接与预检 UI 来源类型不一致');
+    if(assets.ui_baseline)ensure(assets.ui_baseline.ref===`${ui.persisted_ref}/${ui.manifest_ref}`,'战略交接 UI 基线与预检输入不一致');
+  } else if(key==='ui_baseline') {
+    if(input.scope.ui_mode==='prototype') {
+      const {validateVisualBaseline}=await import('../../.agents/skills/yss-prototype-stage/scripts/visual-baseline-contract.mjs');
+      const result=await validateVisualBaseline(data,{bundleRoot:path.dirname(safe(root,binding.ref))});
+      ensure(!result.errors.length,result.errors.join('; '));
+    } else {
+      const modulePath=path.join(ROOT,'scripts/lib/existing-ui-baseline.mjs');
+      ensure(existsSync(modulePath),'不支持 existing-ui-baseline 的当前运行时');
+      const module=await import('./existing-ui-baseline.mjs');
+      const verify=module.validateExistingUiBaseline||module.verifyExistingUiBaseline;
+      ensure(typeof verify==='function','不支持既有 UI 基线验证接口');
+      const result=await verify(data,{bundleRoot:path.dirname(safe(root,binding.ref))});
+      ensure(!result?.errors?.length&&result?.result!=='blocked',JSON.stringify(result));
+    }
+    ensure((input.scope.ui_mode==='prototype'?data.status==='approved':['ready-for-human','approved'].includes(data.status))&&data.baseline_id===binding.id&&data.version===binding.version,'UI 基线身份、版本或待确认状态不一致');
+    if(data.openapi&&assets.openapi)ensure(data.openapi.digest===assets.openapi.digest,'UI 基线与冻结 API 字节不一致');
+    await approved(root,binding,['gate.product-design-approved','gate.user-confirmation']);
+  } else if(key==='build') {
+    // Same build shape used by backend-delivery, captured independently before packaging.
+    const deliverySchema=read(safe(ROOT,'docs/process/schemas/backend-delivery.schema.json'));
+    const buildRules=deliverySchema.properties.build;
+    // Validate in memory to avoid writing a generated schema: check the published required fields.
+    for(const field of buildRules.required||[])ensure(Object.hasOwn(data,field),`构建缺少交付协议字段: ${field}`);
+    ensure(/^[a-f0-9]{40}$/.test(data.source_commit),'构建 source_commit 必须为固定 Git 提交');
+    if(documents.manifest?.source?.base_commit)ensure(documents.manifest.source.base_commit===data.source_commit,'构建与观测 manifest 的固定源码提交不一致');
+    ensure(/^sha256:[0-9a-f]{64}$/.test(data.artifact_digest),'构建制品摘要无效');
+    ensure(Object.keys(data).every(key=>Object.hasOwn(buildRules.properties,key)),'构建包含交付协议未定义字段');
+  } else if(key==='deployment') {
+    schema(data,'docs/process/schemas/backend-delivery-verification.schema.json');
+    ensure(data.kind==='backend-deployment','部署证据 kind 必须为 backend-deployment');
+    for(const result of data.results) {
+      ensure(result.exit_code===0&&Number.isFinite(Date.parse(result.executed_at))&&Date.parse(result.executed_at)<=Date.now()+60000,'部署执行结果或时间无效');
+      result.evidence.forEach(file=>fileBinding(root,file));
+    }
+    if(documents.backend_delivery) {
+      const {backendDeliveryBasis}=await import('./backend-delivery.mjs');
+      ensure(data.subject_digest===backendDeliveryBasis(documents.backend_delivery),'stale: 部署验证未绑定当前交付依据');
+    }
+  } else if(key==='backend_delivery') {
+    schema(data,`docs/process/schemas/backend-delivery${data.schema_version===2?'-v2':''}.schema.json`);
+    ensure(data.scope.slice_id===input.scope.slice_id&&input.scope.operation_ids.every(id=>data.scope.operation_ids.includes(id)),'后端交付切片/接口范围不匹配');
+    for(const asset of ['openapi','slice_contract'])if(assets[asset])ensure(data[asset].ref===assets[asset].ref&&data[asset].digest===assets[asset].digest,'后端交付引用与预检输入不一致');
+    for(const asset of [data.environment.test_data,...Object.values(data.verification)])fileBinding(root,asset);
+    if(assets.build)ensure(same(data.build,documents.build),'后端交付构建与预检构建不一致');
+    if(assets.deployment)ensure(data.verification.deployment.ref===assets.deployment.ref&&data.verification.deployment.digest===assets.deployment.digest,'后端交付部署验证不一致');
+    const {inspectBackendDelivery}=await import('./backend-delivery.mjs');
+    await inspectBackendDelivery(root,binding.ref,{readOnly:true});
+  } else if(key==='local_authorization') {
+    throw new TypeError('不支持尚未确认的目标授权协议；须先执行 S3a 并使用确认后的只读授权验证入口');
+  }
+}
+
+function verifyArchitectureDocument(key,data,scope,root) {
+  ensure(data&&typeof data==='object'&&!Array.isArray(data),'原始架构资产必须是对象');
+  architecture.validateArchitectureIdentity(data.architecture_identity);
+  if(data.architecture_identity.schema_version!==2)return;
+  ensure(data.repository_id===scope.repository_id&&data.project_id===scope.project_id,'原始来源与目标仓库/项目不一致');
+  if(key==='repository_registration') {
+    ensure(data.status==='current','stale: 工程登记不是 current');
+    for(const field of ['local_worktree','project_root','owner','repository_url'])ensure(typeof data[field]==='string'&&data[field].trim(),`工程登记缺少 ${field}`);
+    ensure(Array.isArray(data.verification_commands)&&data.verification_commands.length,'工程登记缺少可执行验证入口');
+  } else {
+    ensure(data.schema_version===1&&data.kind===(key==='manifest'?'existing-project-observation':'existing-engineering-baseline'),'既有原始资产来源类型/版本不匹配');
+    ensure(data.source&&/^[a-f0-9]{40}$/.test(data.source.base_commit)&&Array.isArray(data.source.files)&&data.source.files.length&&Array.isArray(data.source.roots)&&data.source.roots.length,'原始资产缺少固定源码提交/文件集/根范围');
+    ensure(Array.isArray(data.build_units)&&data.build_units.length,'原始资产缺少实际构建单元');
+    if(key==='engineering_baseline') {
+      ensure(data.status==='current','stale: 工程基线不是 current');
+      fileBinding(root,data.boundary_review);
+    }
+  }
+}