create-yss-spec 3.3.7 → 3.3.8

package/template/scripts/lib/implementation-contract-compiler.mjs

@@ -1,3 +1,4 @@
+import { createApprovedExecutionContext, createApprovedRecompilationContext, assertApprovedExecutionContext } from './approved-execution-context.mjs';
 import { enforceTechnicalDesign } from './technical-design-boundary.mjs';
 import { enforceHarnessSkillScope } from "./harness-execution-scope.mjs";
 import { createHash } from "node:crypto";
@@ -6,7 +7,7 @@ import path from "node:path";
 import { parseDocument } from "../vendor/yaml.mjs";
 import { DEFAULT_REGISTRY, loadSkillRegistry } from "./skill-registry.mjs";
 import { ROOT } from "./skill-supply-chain.mjs";
-import { architectureDigest, assertArchitectureAgreement, validateArchitectureIdentity } from "./backend-architecture.mjs";
+import { architectureDigest, assertArchitectureAgreement, validateArchitectureIdentity, verifyArchitectureEvidence } from "./backend-architecture.mjs";
 import { enforceFrontendDelivery } from "./frontend-delivery-boundary.mjs";
 
 export const DEFAULT_COMPILER_CONTRACT = path.join(
@@ -65,12 +66,14 @@ export function compileImplementationContract({
   compilerContractDigest,
   architecture_identity,
   architecture_evidence,
+  approved_slice,
   root = ROOT,
   slice_id,
   frontend_delivery,
   technical_design
 }) {
   assertV2(registry, compilerContract);
+  const recompilationExecution=approved_slice?createApprovedRecompilationContext(approved_slice,{root}):undefined;
   const deliveryInput = enforceFrontendDelivery({ slice_id, frontend_delivery }, { root });
   if (!Array.isArray(recipeIds) || !Array.isArray(requiredCapabilities) || !Array.isArray(conditions)) {
     fail("recipeIds、requiredCapabilities 与 conditions 必须是数组");
@@ -89,11 +92,11 @@ export function compileImplementationContract({
   if (architectural || architecture_identity) {
     architectureProfile = validateArchitectureIdentity(architecture_identity, registry);
     if (!architecture_evidence?.engineering_baseline || !architecture_evidence?.repository_registration || !architecture_evidence?.manifest) fail("缺少工程基线、仓库登记或 Manifest 架构证据");
-    assertArchitectureAgreement(architecture_identity, architecture_evidence, registry);
+    verifyArchitectureEvidence(architecture_identity, architecture_evidence, { root, registry, execution:recompilationExecution });
     for (const recipe of orderedRecipes) if (recipe.architecture_family && recipe.architecture_family !== architecture_identity.architecture_family) fail(`Recipe ${recipe.id} 与架构族不匹配`);
   }
 
-  enforceTechnicalDesign({ technical_design, conditions, architecture_identity, slice_id }, { root });
+  enforceTechnicalDesign({ technical_design, conditions, architecture_identity, slice_id }, { root, execution:recompilationExecution });
 
   const capabilitySources = new Map();
   const orderedCapabilities = [];
@@ -175,6 +178,7 @@ export function compileImplementationContract({
     ...(architecture_identity ? {
       architecture_identity: structuredClone(architecture_identity),
       architecture_identity_digest: architectureDigest(architecture_identity),
+      ...(architecture_identity.schema_version === 2 ? { architecture_evidence: structuredClone(architecture_evidence) } : {}),
       profile_maturity: architectureProfile.maturity,
       readiness_blockers: architectureProfile.maturity === "supported" ? [] : ["backend-profile-not-supported"],
       skill_profiles: Object.fromEntries(orderedSkills.map((skill) => [skill, architecture_identity.architecture_profile]))
@@ -202,12 +206,17 @@ export function compileDefaultImplementationContract(input = {}) {
   });
 }
 
-export function evaluateContractFreshness(contract, { registry, compilerContract, root = ROOT }) {
+export function evaluateContractFreshness(contract, { registry, compilerContract, root = ROOT, approved_slice, readOnly = false }, execution) {
   assertV2(registry, compilerContract);
   if (contract?.schema_version !== 2) fail("Slice Implementation Contract schema v1 已停止支持；必须重新编译 v2 合同");
   const resolution = contract.resolution ?? contract;
   const reasons = [];
-  try { enforceTechnicalDesign({ ...resolution, slice_id: contract.slice_id ?? resolution.slice_id }, { root }); }
+  let trustedExecution;
+  try {
+    trustedExecution=approved_slice?createApprovedExecutionContext(approved_slice,{root,contract}):execution;
+    if(trustedExecution)assertApprovedExecutionContext(trustedExecution,{root,contract});
+  } catch(error) { reasons.push(error.code||'EXECUTION_APPROVAL_INVALID');trustedExecution=undefined; }
+  try { enforceTechnicalDesign({ ...resolution, slice_id: contract.slice_id ?? resolution.slice_id }, { root,execution:trustedExecution,readOnly }); }
   catch { reasons.push("technical-design-stale-or-unavailable"); }
   try { enforceFrontendDelivery(contract, { root }); }
   catch { reasons.push("frontend-delivery-stale-or-unavailable"); }
@@ -216,6 +225,10 @@ export function evaluateContractFreshness(contract, { registry, compilerContract
   if (resolution.architecture_identity) {
     try { validateArchitectureIdentity(resolution.architecture_identity, registry); }
     catch { reasons.push("architecture-identity-invalid"); }
+    if (resolution.architecture_identity.schema_version === 2) {
+      try { verifyArchitectureEvidence(resolution.architecture_identity, resolution.architecture_evidence, { root, registry, execution:trustedExecution }); }
+      catch (error) { reasons.push(error.code ?? "architecture-evidence-stale-or-unavailable"); }
+    }
     if (resolution.architecture_identity_digest !== architectureDigest(resolution.architecture_identity)) reasons.push("architecture-identity-digest-changed");
   }
   return { freshness: reasons.length ? "stale" : "current", reasons };
@@ -225,6 +238,7 @@ export function validateExecutionResult(result, contract, current) {
   if (result?.schema_version !== 2) fail("YSS Skill Execution Result schema v1 已停止支持；请迁移到 v2");
   if (contract?.schema_version !== 2) fail("Slice Implementation Contract schema v1 已停止支持；必须重新编译 v2 合同");
   if (!EXECUTION_STATUSES.has(result.status)) fail(`未知 execution result status: ${result.status}`);
+  if(contract.resolution?.architecture_identity?.schema_version===2&&!current?.approved_slice)return {status:'stale',blockers:['EXECUTION_APPROVAL_REQUIRED']};
   const freshness = evaluateContractFreshness(contract, current);
   if (freshness.freshness === "stale") return { status: "stale", blockers: freshness.reasons };
   const consumed = result.consumed_contract ?? {};

package/template/scripts/lib/json-schema.mjs

@@ -9,7 +9,15 @@ import traceback
 from jsonschema import Draft202012Validator, FormatChecker
 validators = {}
 results = []
-for item in json.load(sys.stdin):
+expected_bytes = int(sys.argv[1])
+payload = sys.stdin.buffer.read(expected_bytes)
+if len(payload) != expected_bytes:
+    raise ValueError(f"JSON_SCHEMA_PROTOCOL: truncated input frame: expected {expected_bytes} bytes, received {len(payload)}")
+try:
+    jobs = json.loads(payload.decode('utf-8'))
+except (UnicodeDecodeError, json.JSONDecodeError) as error:
+    raise ValueError(f"JSON_SCHEMA_PROTOCOL: invalid UTF-8 JSON input frame: {error}") from error
+for item in jobs:
     try:
         key = (item['schemaPath'], item['formatChecker'])
         if key not in validators:
@@ -29,7 +37,8 @@ json.dump(results, sys.stdout)
 `;
 
 /** One immutable validation phase, never a cache of successful work units. */
-export function validateJsonSchemas(items, { cwd = process.cwd() } = {}) {
+export function validateJsonSchemas(items, { cwd = process.cwd(), timeoutMs = 30000 } = {}) {
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) throw new TypeError("schema timeoutMs 必须是正整数毫秒数");
   if (!Array.isArray(items)) throw new TypeError("schema batch 必须是数组");
   if (!items.length) return [];
   const jobs = items.map(({ value, schemaPath, formatChecker = true, errorStyle = "compact", label = "JSON Schema" }) => {
@@ -38,9 +47,15 @@ export function validateJsonSchemas(items, { cwd = process.cwd() } = {}) {
     if (!["compact", "verbose"].includes(errorStyle)) throw new TypeError(`未知 schema errorStyle: ${errorStyle}`);
     return { value, schemaPath: effectiveSchema, formatChecker, errorStyle };
   });
-  const result = spawnSync("python3", ["-c", validator], { cwd, encoding: "utf8", input: JSON.stringify(jobs), maxBuffer: 16 * 1024 * 1024 });
+  // readall waits for EOF even after the complete JSON has arrived. A known UTF-8
+  // byte frame lets the validator finish when a transport keeps its write end open.
+  const input = Buffer.from(JSON.stringify(jobs), "utf8");
+  const result = spawnSync("python3", ["-c", validator, String(input.length)], { cwd, encoding: "utf8", input, timeout: timeoutMs, maxBuffer: 16 * 1024 * 1024 });
+  if (result.error?.code === "ETIMEDOUT") throw new TypeError(`JSON_SCHEMA_TIMEOUT: schema validation exceeded ${timeoutMs}ms`);
   if (result.error || result.status !== 0) throw new TypeError(result.error?.message || `${result.stdout}${result.stderr}`.trim());
-  const results = JSON.parse(result.stdout);
+  let results;
+  try { results = JSON.parse(result.stdout); } catch { throw new TypeError("JSON_SCHEMA_PROTOCOL: validator returned invalid JSON"); }
+  if (!Array.isArray(results) || results.some(item => !item || typeof item.valid !== "boolean" || typeof item.error !== "string")) throw new TypeError("JSON_SCHEMA_PROTOCOL: validator returned invalid result records");
   if (results.length !== jobs.length) throw new TypeError("schema batch 返回数量不匹配");
   return results;
 }

package/template/scripts/lib/profile-skill-sync.mjs

@@ -334,3 +334,29 @@ export function reportProfileSkillSync(plan) {
   for (const item of [...plan.changes, ...plan.issues]) counts[item.status] = (counts[item.status] ?? 0) + 1;
   return { ...plan, changes: plan.changes.map(({ content, ...item }) => item), counts };
 }
+
+export function formatProfileSkillSync(report, mode = "--dry-run") {
+  const affected = [...new Set([...report.changes, ...report.issues].map(({ profile }) => profile))];
+  const lines = [
+    `profile skills: ${report.profiles.join(", ")}`,
+    `模式：${mode === "--apply" ? "已执行同步" : mode === "--check" ? "只读检查" : "只读预览"}`,
+    `受影响 profile：${affected.join(", ") || "无"}`,
+  ];
+  for (const profile of affected) {
+    const skills = [...new Set(report.changes.filter((item) => item.profile === profile && item.skill).map(({ skill }) => skill))];
+    lines.push(`${profile} 变更技能：${skills.join(", ") || "无（请查看资产差异或问题）"}`);
+  }
+  lines.push(`已有问题：${report.issues.length} 项（含冲突、缺失依赖与未登记差异）`);
+  for (const [status, count] of Object.entries(report.counts)) lines.push(`${status}: ${count}`);
+  for (const item of report.changes) lines.push(`${item.profile}: ${item.status}: ${item.path}`);
+  if (!affected.length) lines.push("本次未发现同步差异或问题；不代表项目验证已通过。");
+  else {
+    // Profile names come from configuration; quote them as literal shell arguments.
+    const profiles = affected.map((profile) => `--profile '${profile.replaceAll("'", "'\\''")}'`).join(" ");
+    lines.push(`后续同步一致性检查（待执行；有差异或冲突时先处理）：scripts/sync-profile-skills --check ${profiles}`);
+    lines.push("本仓 Skill 治理验证（待执行）：scripts/verify-skill-governance");
+  }
+  lines.push("文件差异、分类与 SHA-256 继续使用现有 --json 报告；本摘要不判断下游项目兼容性。");
+  const issues = report.issues.map((item) => [item.profile, item.status, item.skill, item.path, item.message, item.marker === undefined ? undefined : `marker=${item.marker}`].filter((value) => value !== undefined).join(": "));
+  return { stdout: `${lines.join("\n")}\n`, stderr: issues.length ? `${issues.join("\n")}\n` : "" };
+}

package/template/scripts/lib/strategic-handoff-consumption.mjs

@@ -1,3 +1,4 @@
+import { uiBaselineSourceKeys, uiBaselineKind } from './ui-baseline.mjs';
 import { existsSync, readdirSync } from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
@@ -12,7 +13,7 @@ const strategyBasis=value=>({
   ...without(value,['domain_version','approval','rule_catalog','scenarios','invariants']),
   invariants:(value.invariants||[]).map(item=>without(item,['statement'])),
 });
-export async function verifyConsumption(data,{root=process.cwd(),sliceRef,consumer='tactical'}={}) {
+export async function verifyConsumption(data,{root=process.cwd(),sliceRef,consumer='tactical',readOnly=false}={}) {
   project(root);
   ensure(['tactical','frontend'].includes(consumer),'未知战略消费者');
   if (data.schema_version === 2 && consumer === 'tactical') ensure(['domain-driven','layered-mvc'].includes(data.architecture?.family), '未知技术设计架构');
@@ -74,15 +75,15 @@ export async function verifyConsumption(data,{root=process.cwd(),sliceRef,consum
         }else {ensure(['pending','conflict'].includes(row.disposition),`非法承接状态: ${id}`);mark(id,row.disposition,row);}
       }
       for(const[id,row]of rows)if(!known.has(id))mark(id,'removed-or-unknown-source',row);
-      for(const key of ['spec_ref','prototype_ref','visual_baseline_ref','business_ticket_set_ref'])if(original.handoff.source[key].digest!==current.handoff.source[key].digest){all=true;issues.push({source_id:key,reason:'upstream-asset-stale'});}
+      for(const key of new Set(['spec_ref','business_ticket_set_ref',...uiBaselineSourceKeys(original.handoff),...uiBaselineSourceKeys(current.handoff)]))if(original.handoff.source[key]?.digest!==current.handoff.source[key]?.digest){all=true;issues.push({source_id:key,reason:'upstream-asset-stale'});}
       // Rule changes can be scoped to declared dependencies. Boundary/decision or
       // runnable-prototype changes need the tactical contract rebound as a whole.
       const stageKeys=['package_version','approval','domain_strategy_ref'];
-      if(digest(strategyBasis(original.strategy))!==digest(strategyBasis(current.strategy)) || digest(without(original.stage,stageKeys))!==digest(without(current.stage,stageKeys)) || digest(original.config.prototype)!==digest(current.config.prototype)) {
+      if(digest(strategyBasis(original.strategy))!==digest(strategyBasis(current.strategy)) || digest(without(original.stage,stageKeys))!==digest(without(current.stage,stageKeys)) || uiBaselineKind(original.handoff)!==uiBaselineKind(current.handoff) || digest(original.config.prototype||null)!==digest(current.config.prototype||null)) {
         all=true;issues.push({source_id:'strategic-design-basis',reason:'upstream-design-stale'});
       }
       const blockedHere=all||(sliceRef?blocked.has(sliceRef):issues.length>0);
       return {result:blockedHere?'blocked':'verified',bundle_digest:current.manifest.bundle_digest,consumed_bundle_digest:receipt.bundle_digest,...(consumer==='frontend'?{frontend_acceptance_digest:digest(data)}:{tactical_digest:digest(data), ...(data.schema_version === 2 ? {technical_design_digest:digest(data)} : {})}),scope:sliceRef||`whole-${consumer}-design`,coverage_complete:[...known.keys()].every(id=>rows.has(id)),block_all:all,blocked_slice_refs:[...blocked].sort(),issues};
-    });
-  });
+    },{readOnly});
+  },{readOnly});
 }

package/template/scripts/lib/strategic-handoff-design-targets.mjs

@@ -2,14 +2,13 @@ import { ensure } from './strategic-handoff-io.mjs';
 
 export function designTargets(data) {
   const design = data.schema_version === 2 ? data.design : data;
-  const catalogs = data.schema_version === 2 && data.architecture?.family === 'layered-mvc'
+  const catalogs = data.schema_version === 2 && data.design_scope === 'engineering-only' ? ['component_catalog'] : data.schema_version === 2 && data.architecture?.family === 'layered-mvc'
     ? ['module_catalog', 'use_case_catalog', 'rule_catalog', 'state_transition_catalog', 'persistence_mapping', 'integration_catalog']
     : ['aggregate_catalog', 'entity_catalog', 'value_object_catalog', 'behavior_catalog', 'invariant_catalog', 'state_transition_catalog', 'domain_event_catalog', 'gateway_catalog'];
-  const primaryKeys = { module_catalog: 'module_id', use_case_catalog: 'use_case_id', rule_catalog: 'rule_id', state_transition_catalog: 'transition_id', persistence_mapping: 'mapping_id', integration_catalog: 'integration_id', aggregate_catalog: 'aggregate_id', entity_catalog: 'entity_id', value_object_catalog: 'value_object_id', behavior_catalog: 'behavior_id', invariant_catalog: 'invariant_id', domain_event_catalog: 'event_id', gateway_catalog: 'gateway_id' };
+  const primaryKeys = { component_catalog: 'component_id', module_catalog: 'module_id', use_case_catalog: 'use_case_id', rule_catalog: 'rule_id', state_transition_catalog: 'transition_id', persistence_mapping: 'mapping_id', integration_catalog: 'integration_id', aggregate_catalog: 'aggregate_id', entity_catalog: 'entity_id', value_object_catalog: 'value_object_id', behavior_catalog: 'behavior_id', invariant_catalog: 'invariant_id', domain_event_catalog: 'event_id', gateway_catalog: 'gateway_id' };
   const ids = catalogs.flatMap(key => (design?.[key] || []).map(item => item[primaryKeys[key]]).filter(Boolean));
   ensure(new Set(ids).size === ids.length, '设计对象 ID 重复');
   const seams = design?.test_seams || [];
   ensure(new Set(seams.map(item => item.seam_id)).size === seams.length, '测试 seam ID 重复');
   return { ids: new Set(ids), seams: new Map(seams.map(item => [item.seam_id, item])) };
 }
-

package/template/scripts/lib/strategic-handoff-io.mjs

@@ -1,11 +1,20 @@
 import { createHash } from 'node:crypto';
 import { existsSync, lstatSync, readdirSync, readFileSync, mkdirSync, writeFileSync, realpathSync } from 'node:fs';
 import path from 'node:path';
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { validateJsonSchemas } from './json-schema.mjs';
 import { parseDocument } from '../vendor/yaml.mjs';
 export const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+// A v5 package keeps the source glossary as a snapshot, never a nested CONTEXT.md.
+// Only this fixed alias is supported, isolated to the current asynchronous reader.
+const sourceContextSnapshots = new AsyncLocalStorage();
+export function withSourceContextSnapshot(root, action) {
+  const roots = new Set(sourceContextSnapshots.getStore() || []);
+  roots.add(path.resolve(root));
+  return sourceContextSnapshots.run(roots, action);
+}
 export const ensure = (condition, message) => { if (!condition) throw new TypeError(message); };
 export const canonical = value => Array.isArray(value) ? value.map(canonical) : value && typeof value === 'object' ? Object.fromEntries(Object.keys(value).sort().map(k => [k, canonical(value[k])])) : value;
 export const hash = bytes => `sha256:${createHash('sha256').update(bytes).digest('hex')}`;
@@ -23,6 +32,7 @@ export function relative(ref) {
 }
 export function safe(root, ref, { missing = false } = {}) {
   relative(ref);
+  if (ref === 'CONTEXT.md' && sourceContextSnapshots.getStore()?.has(path.resolve(root))) ref = 'source-context.snapshot.md';
   let current = path.resolve(root);
   ensure(!existsSync(current) || !lstatSync(current).isSymbolicLink(), `根目录不能是 symlink: ${root}`);
   for (const part of ref.split('/')) {

package/template/scripts/lib/strategic-handoff.mjs

@@ -1,21 +1,22 @@
 import { existsSync, lstatSync, readFileSync, mkdirSync, mkdtempSync, renameSync, rmSync, cpSync } from 'node:fs';
 import path from 'node:path';
 import { tmpdir } from 'node:os';
-import { ensure, canonical, digest, hash, json, parse, read, safe, relative, files, write, project, schema, schemaBatch, archive, ROOT, sourceApprovalPolicy } from './strategic-handoff-io.mjs';
+import { ensure, canonical, digest, hash, json, parse, read, safe, relative, files, write, project, schema, schemaBatch, archive, ROOT, sourceApprovalPolicy, withSourceContextSnapshot } from './strategic-handoff-io.mjs';
 import { parseContextSource, parseContextContract, resolveContextTermRefs } from './context-contract.mjs';
 import { countersignRuleForGate } from './digital-human-roles.mjs';
 import { validateApprovalRecord } from './approval-record.mjs';
 import { treeDigest } from './strategic-handoff-io.mjs';
-import { validateVisualBaseline } from '../../.agents/skills/yss-prototype-stage/scripts/visual-baseline-contract.mjs';
+import { uiBaselineKind, uiBaselineRef, uiBaselineCaseIds, hasConsumerRoutes, validateHandoffUiBaseline } from './ui-baseline.mjs';
 import { extractTraceability, compareIndexes } from './strategic-handoff-rules.mjs';
 const MAX_BYTES = 512 * 1024 * 1024;
 const own = (a,b) => JSON.stringify(canonical(a)) === JSON.stringify(canonical(b));
 const nonempty = x => typeof x === 'string' && x.trim();
 const bytesDigest = (bytes, kind) => kind === 'canonical-json' ? digest(parse(bytes)) : kind === 'sha256-bytes' ? hash(bytes) : (() => { throw new TypeError(`未知摘要算法: ${kind}`); })();
-const HANDOFF_SCHEMAS = new Map([[3,'docs/process/schemas/strategic-design-handoff-v3.schema.json'],[4,'docs/process/schemas/strategic-design-handoff-v4.schema.json']]);
+const HANDOFF_SCHEMAS = new Map([[3,'docs/process/schemas/strategic-design-handoff-v3.schema.json'],[4,'docs/process/schemas/strategic-design-handoff-v4.schema.json'],[5,'docs/process/schemas/strategic-design-handoff-v5.schema.json']]);
 const SOURCE_SCHEMAS = new Map([
   [3,['docs/process/schemas/strategic-handoff-domain-strategy.schema.json','docs/process/schemas/strategic-handoff-stage-decision-package.schema.json']],
   [4,['docs/process/schemas/strategic-handoff-domain-strategy-v3.schema.json','docs/process/schemas/strategic-handoff-stage-decision-package-v3.schema.json']],
+  [5,['docs/process/schemas/strategic-handoff-domain-strategy-v3.schema.json','docs/process/schemas/strategic-handoff-stage-decision-package-v3.schema.json']],
 ]);
 const CAPABILITIES=['backend-technical-design','frontend-engineering-design','delivery-coordination'];
 
@@ -25,7 +26,7 @@ function versionSchema(version, schemas, label) {
 }
 
 function validateConsumerRoutes(handoff, stage) {
-  if(handoff.schema_version!==4)return;
+  if(!hasConsumerRoutes(handoff))return;
   const routes=new Map();
   for(const route of handoff.consumer_routes||[]){
     ensure(!routes.has(route.capability),`消费者能力重复: ${route.capability}`);
@@ -128,7 +129,8 @@ export async function inspectSource(root, handoffRef) {
   schema(handoff,versionSchema(handoff?.schema_version,HANDOFF_SCHEMAS,'Strategic Handoff'));
   ensure(handoff.status==='approved', '交接包尚未批准');
   const config=handoff.package_export;
-  schema(config,'docs/process/schemas/strategic-handoff-export.schema.json');
+  schema(config,handoff.schema_version===5?'docs/process/schemas/strategic-handoff-export-v2.schema.json':'docs/process/schemas/strategic-handoff-export.schema.json');
+  if(handoff.schema_version===5)ensure(config.ui_baseline_kind===uiBaselineKind(handoff),'交接与导出 UI 基线类型不一致');
   const source=parseContextSource(readFileSync(safe(root,'CONTEXT.md'),'utf8'));
   snapshot(handoff.source_context_snapshot,source); checkDelta(handoff,source);
   const strategy=read(safe(root,handoff.source.domain_strategy_ref.persisted_ref));
@@ -142,6 +144,7 @@ export async function inspectSource(root, handoffRef) {
   ensure(stage.domain_strategy_ref.domain_strategy_id===strategy.domain_strategy_id && stage.domain_strategy_ref.domain_version===strategy.domain_version && stage.domain_strategy_ref.status==='approved' && stage.domain_strategy_ref.persisted_ref===handoff.source.domain_strategy_ref.persisted_ref && stage.domain_strategy_ref.digest===digest(strategy), '阶段包引用的战略内容不一致');
   ensure(!(stage.unresolved_items || []).some(x=>x.type==='blocker'), '阶段包含 blocker');
   validateConsumerRoutes(handoff,stage);
+  if(uiBaselineKind(handoff)==='existing-ui-baseline')ensure(stage.impact_assessment?.ui===false,'existing-ui-baseline 不支持 UI 影响，返回产品设计');
   const indexes=extractTraceability(strategy);
   const sourceRoles=read(safe(root,'docs/agents/digital-human-roles.yaml'));
   const roles=sourceApprovalPolicy(sourceRoles);
@@ -152,22 +155,24 @@ export async function inspectSource(root, handoffRef) {
   const currentPlan = (roles.gate_policy.dual_digital_human || []).some(rule => rule.gate === 'gate.plan-approved');
   const terminalGate=currentPlan?'gate.plan-approved':countersignRuleForGate(roles.gate_policy,'gate.strategic-design-handoff-approved')?'gate.strategic-design-handoff-approved':'gate.stage-decision-package-approved';
   const expectedGates={domain_strategy_ref:currentPlan?'gate.plan-approved':'gate.domain-strategy-approved',stage_decision_package_ref:currentPlan?'gate.plan-approved':'gate.stage-decision-package-approved',spec_ref:'gate.spec-baseline-approved',prototype_ref:currentPlan?'gate.product-design-approved':'gate.user-confirmation',visual_baseline_ref:currentPlan?'gate.product-design-approved':'gate.user-confirmation',business_ticket_set_ref:terminalGate,handoff:terminalGate};
+  expectedGates.existing_ui_baseline_ref=expectedGates.prototype_ref;
   const bindings={...handoff.source,handoff:{id:handoff.handoff_id,version:handoff.handoff_version,persisted_ref:handoffRef,status:'approved'}};
   for(const [key,ref] of Object.entries(bindings)) {
     const approval=config.approvals[key];
     ensure(approval,`缺少资产批准绑定: ${key}`);
     ensure(approval.gate_id===expectedGates[key],`资产使用错误批准门禁: ${key}`);
-    const bytes=key==='visual_baseline_ref'?null:readFileSync(safe(root,ref.persisted_ref));
+    const baselineKey=['visual_baseline_ref','existing_ui_baseline_ref'].includes(key);
     let actual;
-    if(key==='visual_baseline_ref') {
-      const baseline=read(safe(root,`${ref.persisted_ref}/${ref.manifest_ref}`));
-      const result=await validateVisualBaseline(baseline,{bundleRoot:safe(root,ref.persisted_ref)});
-      ensure(!result.errors.length,`视觉基线无效: ${result.errors.join('; ')}`);
-      ensure(baseline.baseline_id===ref.baseline_id && baseline.version===ref.version && own([...ref.case_ids].sort(),baseline.cases.map(x=>x.case_id).sort()),'视觉基线身份不一致');
-      actual=baseline.bundle.digest;
-    } else actual=bytesDigest(bytes,approval.digest_kind);
+    if(baselineKey) {
+      const validated=await validateHandoffUiBaseline(root,handoff);actual=validated.digest;
+      if(key==='existing_ui_baseline_ref') {
+        ensure(approval.digest_kind==='sha256-bytes','既有 UI 批准必须绑定 manifest 原字节');
+        ensure(roles.user_decision_policy.gates.includes(expectedGates.existing_ui_baseline_ref),'既有 UI 承接必须使用产品设计真实用户决定策略');
+      }
+    } else actual=bytesDigest(readFileSync(safe(root,ref.persisted_ref)),approval.digest_kind);
     if(key!=='handoff')ensure(ref.digest===actual,`源资产摘要过期: ${key}`);
     const record=read(safe(root,approval.record_ref));
+    if(key==='existing_ui_baseline_ref')ensure(record.subject_ref===`${ref.persisted_ref}/${ref.manifest_ref}`,'既有 UI 用户决定必须以当前 manifest 为批准主体');
     await sourceApproval(record,roles,root);
     ensure(record.gate_id===approval.gate_id,`批准门禁不匹配: ${key}`);
     ensure((record.artifact_bindings || []).some(x=>x.id===(ref.id||ref.baseline_id) && x.version===ref.version && x.digest===actual),`批准记录未绑定当前资产: ${key}`);
@@ -180,19 +185,22 @@ export async function inspectSource(root, handoffRef) {
     ensure(scope.delivery_ref && own(read(safe(root,scope.delivery_ref)),delivery), '交付范围清单未覆盖当前交接内容或风险');
     ensure(scope.assets?.some(asset=>asset.ref===scope.delivery_ref && asset.digest===hash(readFileSync(safe(root,scope.delivery_ref)))), '交接内容快照缺少批准覆盖');
     for (const [key,ref] of Object.entries(handoff.source)) {
-      const file=key==='visual_baseline_ref'?`${ref.persisted_ref}/${ref.manifest_ref}`:ref.persisted_ref;
+      const file=['visual_baseline_ref','existing_ui_baseline_ref'].includes(key)?`${ref.persisted_ref}/${ref.manifest_ref}`:ref.persisted_ref;
       const decisionBoundaries=key==='business_ticket_set_ref'?['gate.spec-baseline-approved',terminalGate]:[expectedGates[key]];
       ensure(scope.assets?.some(asset=>asset.ref===file && asset.version===ref.version && decisionBoundaries.includes(asset.boundary) && asset.digest===hash(readFileSync(safe(root,file)))), `交付范围清单遗漏当前资产: ${key}`);
     }
   }
-  const receipt=previewFiles(root,config.prototype);
-  ensure(handoff.source.visual_baseline_ref.case_ids.every(id=>receipt.case_ids.includes(id)), '离线验证未覆盖视觉基线 case');
+  if(uiBaselineKind(handoff)==='prototype') {
+    const receipt=previewFiles(root,config.prototype);
+    ensure(uiBaselineCaseIds(handoff).every(id=>receipt.case_ids.includes(id)), '离线验证未覆盖视觉基线 case');
+  }
   return {handoff,config,indexes,strategy,stage};
 }
 
 function collect(root, handoffRef, handoff, config) {
-  const collected=new Map(), queue=[handoffRef,'CONTEXT.md','docs/agents/digital-human-roles.yaml',...Object.values(handoff.source).map(x=>x.persisted_ref),...Object.values(config.approvals).map(x=>x.record_ref),...handoff.evidence_and_version_digests,...config.additional_files,config.prototype.preview_root,config.prototype.verification_ref];
-  if(config.prototype.profile==='H2')queue.push(config.prototype.source_root,config.prototype.lock_ref);
+  const collected=new Map(), queue=[handoffRef,'CONTEXT.md','docs/agents/digital-human-roles.yaml',...Object.values(handoff.source).map(x=>x.persisted_ref),...Object.values(config.approvals).map(x=>x.record_ref),...handoff.evidence_and_version_digests,...config.additional_files];
+  if(config.prototype)queue.push(config.prototype.preview_root,config.prototype.verification_ref);
+  if(config.prototype?.profile==='H2')queue.push(config.prototype.source_root,config.prototype.lock_ref);
   const symbolic=config.reference_map || {};
   const enqueue=ref=> { if(symbolic[ref])queue.push(symbolic[ref]); else if(/^https?:\/\//i.test(ref))return; else if(ref.startsWith('evidence.'))throw new TypeError(`未解析 evidence ID: ${ref}`); else if(ref.includes('/') || /\.(?:md|yaml|json|html|png|txt|log)$/.test(ref))queue.push(ref); };
   function refs(value,key='') {
@@ -208,20 +216,23 @@ function collect(root, handoffRef, handoff, config) {
     ensure(stat.isFile() && stat.size<=MAX_BYTES,`源文件类型/大小无效: ${ref}`);
     const bytes=readFileSync(full); collected.set(ref,bytes); totalBytes += bytes.length;
     ensure(collected.size<=20000 && totalBytes<=MAX_BYTES,'交接包大小超限');
-    if(/\.(yaml|yml|json)$/.test(ref))refs(parse(bytes));
-    queue.push(...documentLinks(ref,bytes));
+    const localBaseline=uiBaselineKind(handoff)==='existing-ui-baseline'&&ref.startsWith(`${uiBaselineRef(handoff).persisted_ref}/`);
+    if(!localBaseline&&/\.(yaml|yml|json)$/.test(ref))refs(parse(bytes));
+    // The entire existing UI observation directory was validated as a byte-bound file set.
+    // Its copied source documentation is evidence, not governance dependency instructions.
+    if(!localBaseline)queue.push(...documentLinks(ref,bytes));
   }
   return collected;
 }
 function materialize(captured, manifest, destination) {
   for(const file of manifest.files.filter(x=>x.original_ref))write(destination,file.original_ref,captured.get(file.path));
 }
-export async function openBundle(input, action) {
-  const temp=mkdtempSync(path.join(tmpdir(),'yss-handoff-'));
+export async function openBundle(input, action, {readOnly=false}={}) {
+  const temp=readOnly?null:mkdtempSync(path.join(tmpdir(),'yss-handoff-'));
   try {
     ensure(existsSync(input) && !lstatSync(input).isSymbolicLink(),'交接包不存在或是 symlink');
     let root=path.resolve(input);
-    if(lstatSync(root).isFile()){ root=path.join(temp,'unpacked');mkdirSync(root);archive('unpack',path.resolve(input),root); }
+    if(lstatSync(root).isFile()){ ensure(!readOnly,'readonly-extraction-required: 只读验证需要已展开目录');root=path.join(temp,'unpacked');mkdirSync(root);archive('unpack',path.resolve(input),root); }
     const manifest=read(safe(root,'manifest.json'));
     schema(manifest,'docs/process/schemas/strategic-handoff-package.schema.json');
     const {bundle_digest,...body}=manifest;ensure(bundle_digest===digest(body),'包清单摘要不一致');
@@ -233,7 +244,12 @@ export async function openBundle(input, action) {
     for(const file of manifest.files){const bytes=readFileSync(safe(root,file.path));ensure(bytes.length===file.size_bytes && hash(bytes)===file.sha256,`文件摘要不一致: ${file.path}`);if(file.original_ref)relative(file.original_ref);captured.set(file.path,bytes);}
     const originals=manifest.files.filter(x=>x.original_ref).map(x=>x.original_ref);
     ensure(new Set(originals.map(x=>x.toLowerCase())).size===originals.length,'源路径重复');
-    const source=path.join(temp,'source');mkdirSync(source);materialize(captured,manifest,source);
+    let source;
+    if(readOnly){
+      ensure(manifest.files.filter(file=>file.original_ref).every(file=>file.path===`payload/files/${file.original_ref==='CONTEXT.md'?'source-context.snapshot.md':file.original_ref}`),'readonly-source-layout-required: 原始源布局需要只读文件映射支持');
+      source=safe(root,'payload/files');
+    }else{source=path.join(temp,'source');mkdirSync(source);materialize(captured,manifest,source);}
+    const inspect=async()=>{
     const inspected=await inspectSource(source,manifest.handoff_ref);
     ensure(manifest.bundle_id===inspected.handoff.handoff_id && manifest.version===inspected.handoff.handoff_version,'包身份与源交接不一致');
     ensure(own(read(safe(root,'indexes/rules.json')),inspected.indexes.rules) && own(read(safe(root,'indexes/scenarios.json')),inspected.indexes.scenarios),'规则/场景索引与源资产不一致');
@@ -250,14 +266,16 @@ export async function openBundle(input, action) {
     }
     ensure(own(changes,{previous_bundle:manifest.previous_bundle,...compareIndexes(inspected.indexes,previousIndexes)}),'版本差异与实际索引不一致');
     return await action({root,manifest,...inspected,changes});
-  } finally {rmSync(temp,{recursive:true,force:true});}
+    };
+    return readOnly?await withSourceContextSnapshot(source,inspect):await inspect();
+  } finally {if(temp)rmSync(temp,{recursive:true,force:true});}
 }
 export async function exportBundle({sourceRoot,handoffRef,output,zip=false,previous}) {
   const root=project(sourceRoot); parseContextContract({root}); relative(handoffRef);
   const current=await inspectSource(root,handoffRef);
   let prior=null;
   if(previous)prior=await openBundle(previous, b=>({manifest:b.manifest,indexes:b.indexes,handoff:b.handoff,rulesBytes:readFileSync(safe(b.root,'indexes/rules.json')),scenariosBytes:readFileSync(safe(b.root,'indexes/scenarios.json'))}));
-  if(prior){ensure(prior.manifest.bundle_id===current.handoff.handoff_id,'前版属于不同交接');ensure(Number(current.handoff.handoff_version.slice(1))>Number(prior.manifest.version.slice(1)),'更新必须提升交接版本');for(const[key,ref]of Object.entries(current.handoff.source)){const old=prior.handoff.source[key];if(old.digest!==ref.digest)ensure(old.version!==ref.version,`源资产内容变化必须提升版本: ${key}`);}}
+  if(prior){ensure(prior.manifest.bundle_id===current.handoff.handoff_id,'前版属于不同交接');ensure(Number(current.handoff.handoff_version.slice(1))>Number(prior.manifest.version.slice(1)),'更新必须提升交接版本');for(const[key,ref]of Object.entries(current.handoff.source)){const old=prior.handoff.source[key];if(old&&old.digest!==ref.digest)ensure(old.version!==ref.version,`源资产内容变化必须提升版本: ${key}`);}}
   const previousBundle=prior?{bundle_id:prior.manifest.bundle_id,version:prior.manifest.version,digest:prior.manifest.bundle_digest}:null;
   const snapshotFiles=collect(root,handoffRef,current.handoff,current.config);
   const target=path.resolve(output);
@@ -270,7 +288,7 @@ export async function exportBundle({sourceRoot,handoffRef,output,zip=false,previ
     const entries=[];
     const put=(ref,bytes,original)=>{write(staging,ref,bytes);entries.push({path:ref,sha256:hash(bytes),size_bytes:bytes.length,...(original?{original_ref:original}:{})});};
     for(const [ref,bytes]of [...snapshotFiles].sort(([a],[b])=>a.localeCompare(b))) {
-      const dest=ref===handoffRef?'handoff.yaml':ref==='CONTEXT.md'?'payload/source-context.snapshot.md':`payload/files/${ref}`;
+      const dest=current.handoff.schema_version===5?`payload/files/${ref==='CONTEXT.md'?'source-context.snapshot.md':ref}`:ref===handoffRef?'handoff.yaml':ref==='CONTEXT.md'?'payload/source-context.snapshot.md':`payload/files/${ref}`;
       ensure(!dest.endsWith('/CONTEXT.md'),'只允许源根词汇快照，禁止嵌套 CONTEXT.md');put(dest,bytes,ref);
     }
     put('indexes/rules.json',Buffer.from(json(current.indexes.rules)));
@@ -339,8 +357,8 @@ export async function importBundle({bundle,targetRoot}) {
         const coordinationRoute=b.handoff.consumer_routes.find(route=>route.capability==='delivery-coordination');
         if(capabilities.includes('backend-technical-design')&&backendRoute.activation!=='not-applicable')write(stage,'backend-technical-traceability-draft.json',json({schema_version:2,route_id:backendRoute.route_id,import_receipt_ref:`${rel}/import-receipt.json`,bundle_digest:b.manifest.bundle_digest,rows}));
         if(capabilities.includes('frontend-engineering-design')&&frontendRoute.activation!=='not-applicable'){
-          const preflight={schema_version:1,status:'draft',route_id:frontendRoute.route_id,capability:frontendRoute.capability,import_receipt_ref:`${rel}/import-receipt.json`,bundle_digest:b.manifest.bundle_digest,context_reconciliation_ref:'',visual_baseline_ref:`${rel}/package/payload/files/${b.handoff.source.visual_baseline_ref.persisted_ref}/${b.handoff.source.visual_baseline_ref.manifest_ref}`,source_rule_refs:rows.map(row=>row.source_id),backend_dependency:{mode:backendRoute.activation==='not-applicable'?'not-applicable':'required',route_id:backendRoute.route_id,...(backendRoute.activation==='not-applicable'?{reason:backendRoute.reason,impact_refs:backendRoute.impact_refs,evidence_refs:backendRoute.evidence_refs}:{})},ready_for_agent:false};
-          schema(preflight,'docs/process/schemas/frontend-strategic-preflight.schema.json');
+          const preflight={schema_version:b.handoff.schema_version===5?2:1,status:'draft',route_id:frontendRoute.route_id,capability:frontendRoute.capability,import_receipt_ref:`${rel}/import-receipt.json`,bundle_digest:b.manifest.bundle_digest,context_reconciliation_ref:'',...(b.handoff.schema_version===5?{ui_baseline_kind:uiBaselineKind(b.handoff),ui_baseline_ref:`${rel}/package/payload/files/${uiBaselineRef(b.handoff).persisted_ref}/${uiBaselineRef(b.handoff).manifest_ref}`}:{visual_baseline_ref:`${rel}/package/payload/files/${uiBaselineRef(b.handoff).persisted_ref}/${uiBaselineRef(b.handoff).manifest_ref}`}),source_rule_refs:rows.map(row=>row.source_id),backend_dependency:{mode:backendRoute.activation==='not-applicable'?'not-applicable':'required',route_id:backendRoute.route_id,...(backendRoute.activation==='not-applicable'?{reason:backendRoute.reason,impact_refs:backendRoute.impact_refs,evidence_refs:backendRoute.evidence_refs}:{})},ready_for_agent:false};
+          schema(preflight,b.handoff.schema_version===5?'docs/process/schemas/frontend-strategic-preflight-v2.schema.json':'docs/process/schemas/frontend-strategic-preflight.schema.json');
           write(stage,'frontend-strategic-preflight-draft.json',json(preflight));write(stage,'frontend-traceability-draft.json',json({schema_version:1,route_id:frontendRoute.route_id,import_receipt_ref:`${rel}/import-receipt.json`,bundle_digest:b.manifest.bundle_digest,rows:rows.map(({tactical_refs,test_seam_refs,...row})=>({...row,frontend_case_refs:[]}))}));
         }
         if(capabilities.includes('delivery-coordination')&&coordinationRoute.activation!=='not-applicable')write(stage,'consumer-status-index-draft.json',json({schema_version:1,status:'draft',import_receipt_ref:`${rel}/import-receipt.json`,routes:b.handoff.consumer_routes.map(route=>({route_id:route.route_id,capability:route.capability,activation:route.activation,consumer_status:route.activation==='not-applicable'?'not-applicable':'pending',receipt_refs:[],acceptance_refs:[],feedback_refs:[]}))}));

package/template/scripts/lib/task-package.mjs

@@ -179,13 +179,21 @@ function validateContract(value, registry, lifecycle) {
   if (!existsSync(contractPath)) fail(`Slice Implementation Contract 不存在: ${contract.slice_contract_ref}`);
   const document = parseYaml(readFileSync(contractPath, "utf8"), "Slice Implementation Contract");
   const slice = document.slice_contract || document;
-  if (slice.schema_version !== 1 || typeof slice.slice_id !== "string" || !slice.lifecycle_refs || !slice.readiness || !Array.isArray(slice.work_units)) fail("Slice Implementation Contract 缺少 schema_version/slice_id/lifecycle_refs/readiness/work_units");
+  if (slice.schema_version !== 2 || typeof slice.slice_id !== "string" || !slice.lifecycle_refs || !slice.readiness || !Array.isArray(slice.work_units)) fail("Slice Implementation Contract 需要 schema v2 及 slice_id/lifecycle_refs/readiness/work_units");
   if (slice.contract_id !== contract.contract_id || slice.contract_version !== contract.contract_version || slice.status !== "approved") fail("Slice Contract 必须是当前 approved 版本");
   const sliceUnit = slice.work_units.find((item) => item && item.id === value.work_unit_id);
   if (!sliceUnit) fail(`Slice Implementation Contract 缺少 work_unit_id: ${value.work_unit_id}`);
   for (const field of ["role_id", "runtime_id", "task_package_ref", "contract_id", "contract_version", "allowed_write_paths"]) if (sliceUnit[field] === undefined) fail(`Slice Contract work_unit 缺少 ${field}`);
-  if (sliceUnit.role_id !== value.role_id || sliceUnit.runtime_id !== value.runtime_id || sliceUnit.contract_id !== contract.contract_id || sliceUnit.contract_version !== contract.contract_version || sliceUnit.task_package_ref !== value.work_unit_id) fail("任务包与 Slice Contract work_unit 不一致");
+  if (sliceUnit.role_id !== value.role_id || sliceUnit.runtime_id !== value.runtime_id || sliceUnit.contract_id !== contract.contract_id || sliceUnit.contract_version !== contract.contract_version) fail("任务包与 Slice Contract work_unit 不一致");
   for (const allowed of value.allowed_write_paths) if (!sliceUnit.allowed_write_paths.includes(allowed)) fail(`allowed_write_paths 未获 Slice Contract 授权: ${allowed}`);
+  // Older packages used the work-unit ID here; new packages bind a readable dispatch file.
+  if (sliceUnit.task_package_ref !== value.work_unit_id) {
+    const dispatchPath = assertSafeRelativePath(sliceUnit.task_package_ref, "Slice work_unit.task_package_ref");
+    if (!existsSync(dispatchPath)) fail("Slice task_package_ref 不可读");
+    const dispatched = parseDocument(readFileSync(dispatchPath, "utf8")).toJS();
+    for (const field of ["task_id", "work_unit_id", "actor_id", "role_id", "runtime_id"]) if (dispatched?.[field] !== value[field]) fail("Slice task_package_ref 与当前派发身份不一致");
+    if (JSON.stringify(dispatched.contract) !== JSON.stringify(value.contract) || JSON.stringify(dispatched.allowed_write_paths) !== JSON.stringify(value.allowed_write_paths)) fail("Slice task_package_ref 与当前合同或写范围不一致");
+  }
   if (value.execution_state === "Worker") assertImplementationDecision({ slice_contract_ref: contract.slice_contract_ref, vertical_slice_ticket_ref: slice.lifecycle_refs.ticket, user_decisions: value.user_decisions });
 }
 
@@ -223,7 +231,7 @@ export function validateTaskPackageSet(packages, options = {}) {
   packages.forEach((pkg) => validateTaskPackage(pkg, options));
   const slicePackages = packages.filter((pkg) => pkg.contract.kind === "slice-implementation");
   if (slicePackages.length > 0) {
-    const contracts = new Set(slicePackages.map((pkg) => `${pkg.contract.contract_id}@${pkg.contract.contract_version}`));
+    const contracts = new Set(slicePackages.map((pkg) => JSON.stringify([pkg.contract.contract_id, pkg.contract.contract_version])));
     if (contracts.size !== 1) fail("同一切片的任务包必须消费同一 contract_id/contract_version");
     const workers = new Set(slicePackages.filter((pkg) => pkg.execution_state === "Worker").map((pkg) => pkg.actor_id));
     slicePackages.filter((pkg) => pkg.execution_state === "Reviewer").forEach((pkg) => { if (workers.has(pkg.actor_id)) fail("Reviewer 不得与实现者使用同一 actor_id"); });

package/template/scripts/lib/technical-design-boundary.mjs

@@ -1,10 +1,11 @@
+import { assertApprovedExecutionContext, approvedExecutionBinding } from './approved-execution-context.mjs';
 import path from 'node:path';
 import { readFileSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import { ROOT, read, safe, ensure, hash } from './strategic-handoff-io.mjs';
 
 // The compiler's synchronous boundary reruns the design verifier against current files.
-export function enforceTechnicalDesign(state = {}, { root = ROOT } = {}) {
+export function enforceTechnicalDesign(state = {}, { root = ROOT, execution, readOnly = false } = {}) {
   const binding = state.technical_design;
   const affected = (state.conditions || []).some(value => ['backend-technical-design-impact','tactical-domain','tactical-domain-impact','aggregate-impact','state-machine-impact','invariant-impact','consistency-impact','domain-event-impact','gateway-boundary-impact','persistence-mapping-impact'].includes(value));
   if (!binding && !affected) return;
@@ -13,11 +14,18 @@ export function enforceTechnicalDesign(state = {}, { root = ROOT } = {}) {
   const file = safe(root, binding.ref);
   ensure(hash(readFileSync(file)) === binding.digest, '技术设计绑定摘要漂移');
   const data = read(file);
+  if(data.design_scope==='engineering-only')ensure(!(state.conditions||[]).some(value=>['tactical-domain','tactical-domain-impact','aggregate-impact','state-machine-impact','invariant-impact','domain-event-impact','gateway-boundary-impact','persistence-mapping-impact'].includes(value)),'engineering-only 技术设计不能承接领域模型、业务状态或持久化映射影响');
   ensure(data.status === 'approved' && data.version === binding.version, '技术设计必须为批准且绑定版本');
   const family = data.schema_version === 1 && binding.legacy_ddd === true ? 'domain-driven' : data.architecture?.family;
   ensure(family && family === state.architecture_identity?.architecture_family, '技术设计与实现架构不匹配');
   const args = [path.join(ROOT, '.agents/skills/yss-technical-design/scripts/validate-technical-design.mjs'), file, '--root', root, '--slice', state.slice_id];
   if (binding.legacy_ddd === true) args.push('--legacy-ddd');
+  if(readOnly)args.push('--read-only');
+  if(execution){
+    assertApprovedExecutionContext(execution,{root,technicalDesign:data,architectureIdentity:state.architecture_identity,sliceId:state.slice_id});
+    const approved=approvedExecutionBinding(execution);
+    args.push('--approved-slice',approved.ref,'--approved-slice-digest',approved.digest,'--approved-slice-approval',approved.approval_ref);
+  }
   const verified = spawnSync(process.execPath, args, { cwd: root, encoding: 'utf8', timeout: 60000, maxBuffer: 2 * 1024 * 1024 });
   ensure(verified.status === 0, `技术设计不可消费: ${verified.error?.message || verified.stderr}`);
 }

package/template/scripts/lib/ui-baseline.mjs

@@ -0,0 +1,26 @@
+import { readFileSync } from 'node:fs';
+import { ensure, read, safe, hash } from './strategic-handoff-io.mjs';
+import { validateVisualBaseline } from '../../.agents/skills/yss-prototype-stage/scripts/visual-baseline-contract.mjs';
+import { validateExistingUiBaseline } from './existing-ui-baseline.mjs';
+
+export function hasConsumerRoutes(handoff) { return [4,5].includes(handoff?.schema_version); }
+export function uiBaselineKind(handoff) {
+  ensure([3,4,5].includes(handoff?.schema_version),'未知 Strategic Handoff schema_version');
+  if(handoff.schema_version<5)return 'prototype';
+  ensure(['prototype','existing-ui-baseline'].includes(handoff.ui_baseline_kind),'未知 ui_baseline_kind');
+  return handoff.ui_baseline_kind;
+}
+export function uiBaselineRef(handoff) {
+  const kind=uiBaselineKind(handoff),ref=handoff.source?.[kind==='prototype'?'visual_baseline_ref':'existing_ui_baseline_ref'];
+  ensure(ref,'缺少 UI 基线引用');return ref;
+}
+export function uiBaselineCaseIds(handoff) { return uiBaselineRef(handoff).case_ids; }
+export function uiBaselineSourceKeys(handoff) { return uiBaselineKind(handoff)==='prototype'?['prototype_ref','visual_baseline_ref']:['existing_ui_baseline_ref']; }
+export async function validateHandoffUiBaseline(root,handoff) {
+  const kind=uiBaselineKind(handoff),ref=uiBaselineRef(handoff),file=safe(root,`${ref.persisted_ref}/${ref.manifest_ref}`),baseline=read(file);
+  const result=kind==='prototype'?await validateVisualBaseline(baseline,{bundleRoot:safe(root,ref.persisted_ref)}):validateExistingUiBaseline(baseline,{bundleRoot:safe(root,ref.persisted_ref)});
+  ensure(!result.errors.length,`UI 基线无效: ${result.errors.join('; ')}`);
+  // The immutable existing manifest records readiness; the caller verifies its current approval chain.
+  ensure((kind==='existing-ui-baseline'||baseline.status==='approved')&&baseline.baseline_id===ref.baseline_id&&baseline.version===ref.version&&JSON.stringify([...ref.case_ids].sort())===JSON.stringify(baseline.cases.map(item=>item.case_id).sort()),'UI 基线身份不一致');
+  return {kind,ref,baseline,digest:kind==='prototype'?baseline.bundle.digest:hash(readFileSync(file))};
+}

package/template/scripts/lib/user-decision.mjs

@@ -113,8 +113,11 @@ export function validateUserDecision(record, options = {}) {
     previousTime = time;
     if (response.decision === "approved") {
       const explicit = source.decision === "approved" && Array.isArray(source.item_ids) && response.item_ids.every((id) => source.item_ids.includes(id));
+      const contextualAll = response.selection === "explicit-all" && items.size > 1
+        && /是否\s*(?:明确)?(?:确认|批准|同意|接受)[^\n]{0,32}(?:以上)?全部\s*(?:\d+|[一二三四五六七八九十]+)?\s*(?:项|事项)/i.test(presentation.text)
+        && /^(?:确认|同意|批准|接受|可以|好的|好|yes|ok)[。.!！\s]*$/i.test(source.text.trim());
       if (!explicit && (!/(同意|批准|确认|接受|可以|好的|^好[。！!\s]*$|\b(?:approve|approved|agree|agreed|accept|yes|ok)\b)/i.test(source.text) || /(不同意|不批准|拒绝|反对|不要|需[要]?修改|请修改|暂不|reject|decline|do not approve|don't approve|disagree)/i.test(source.text))) decisionError("user-decision-ambiguous", "原文不能明确支持批准结论");
-      if (!explicit && response.selection === "explicit-all" && items.size > 1 && !/(全部|所有|\ball\b)/i.test(source.text)) decisionError("user-decision-ambiguous", "批量批准原文必须明确全部事项");
+      if (!explicit && !contextualAll && response.selection === "explicit-all" && items.size > 1 && !/(全部|所有|\ball\b)/i.test(source.text)) decisionError("user-decision-ambiguous", "批量批准原文必须明确全部事项，或直接回复明确询问全部事项的当前展示");
       if (!explicit && response.selection === "explicit-items" && items.size > 1 && response.item_ids.some((id) => !source.text.includes(id) && !source.text.includes(items.get(id)?.title))) decisionError("user-decision-ambiguous", "原文未指向所选事项");
     }
     if (response.selection === "single" && items.size !== 1) decisionError("user-decision-ambiguous", "多事项不能用单项回复");

package/template/scripts/preflight-delivery

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { parseArgs } from 'node:util';
+import { read } from './lib/strategic-handoff-io.mjs';
+import { preflightDelivery, invalidPreflightInput } from './lib/delivery-preflight.mjs';
+
+let result;
+try {
+  const {values}=parseArgs({options:{input:{type:'string'},stage:{type:'string'},json:{type:'boolean'}},strict:true});
+  if(!values.input||!values.stage) throw new TypeError('必须提供 --input <file> 和 --stage prepare|build|export|accept');
+  result=await preflightDelivery(read(path.resolve(values.input)),{stage:values.stage,root:process.cwd()});
+} catch(error) { result=invalidPreflightInput(error.message); }
+process.stdout.write(`${JSON.stringify(result,null,2)}\n`);
+process.exitCode=result.exit_code;