create-yss-spec 3.3.8 → 3.4.1

package/template/.codex/skills/yss-frontend-scaffold-generator/assets/data-quality-v1/pnpm-workspace.yaml

@@ -0,0 +1,7 @@
+packages:
+  - packages
+onlyBuiltDependencies:
+  - esbuild
+  - vue-demi
+  - '@formily/vue'
+  - core-js

package/template/.codex/skills/yss-frontend-scaffold-generator/references/data-quality-baseline.md

@@ -0,0 +1,17 @@
+# Data Quality v1 骨架基线
+
+采用 Data Quality 工程模式，随 Skill 提供可离线审阅的机械源文件。源工程 commit 为 `532509a59856fc02f3b9bcb28a062663ce887d71`；无 origin，因此不把本机路径伪装成可分发 Git 模板。文件列表及摘要由 `data-quality-v1.manifest.json` 固定，合同锁其字节摘要。
+
+| 保留 | 通用化调整 |
+| --- | --- |
+| `packages/` pnpm 工作区、Vue3 / TypeScript / Vite | 单一 Vite6.0.5 工具链，Node>=22.12；TypeScript5.9.3与ESLint parser8.70配套，满足Orval/Formily的TS4/5 peer约束，重建pnpm锁 |
+| Pinia、Vue Router、Ant Design Vue4.2.6、YSS UI | 空白首页 / 404，移除业务菜单、默认Admin、接口模块、Mock、任务抽屉 |
+| Qiankun mount/unmount/update与路由桥 | 版本检查、同源事件地址、app级恢复标记、销毁router监听；不带未取消timer和全局styleManager |
+| ConfigProvider及主题DTO | 根DESIGN派生，light32px默认；YSS/Ant/VXE变量只写当前容器，不改documentElement；不读取固定localStorage键 |
+| Orval本地OpenAPI与axios seam | 输入只为冻结JSON；无网络同步、schema删改、业务包装覆盖、硬编码token/401跳转 |
+
+Vue / Vue Router / Pinia / AntDV / YSS / Formily / Orval 等核心版本来自源 lock。TypeScript5.9.3和ESLint parser8.70是针对原TS6解析器及Orval/Formily peer冲突的兼容调整；依赖声明与锁文件重新生成并实际验证。运行 install 需要企业registry访问，认证仅通过环境配置；资产包不含 `.npmrc`、node_modules或构建产物。
+
+源 JSP 脚本引用的 Vite 配置缺失，所以当前只提供 Qiankun 与 standalone。资源 public base 与激活 route 分别配置，避免推测主门户部署规则。跨应用 CSS 隔离仍须由宿主合同定义；容器主题清理不能等同于完整样式沙箱。
+
+已有 Git 来源继续兼容，生成和验证遵守同一个批准 schema v4 合同、空目标目录、OpenAPI摘要和显式init_git边界。模板维护可以更新 bundled 源；目标应用生成不会自动升级已有工程。

package/template/.codex/skills/yss-frontend-scaffold-generator/references/data-quality-v1.manifest.json

@@ -0,0 +1,49 @@
+{
+  "schema_version": 1,
+  "baseline_id": "data-quality-v1",
+  "upstream": {
+    "project": "next-gen-data-quality",
+    "commit": "532509a59856fc02f3b9bcb28a062663ce887d71",
+    "use": "selected source patterns, reconstructed neutral scaffold; not a complete upstream Git tree",
+    "copied_and_adapted": [
+      "packages/src/types/microAppBridge.ts",
+      "packages/src/utils/microAppRouterBridge.ts"
+    ]
+  },
+  "design_source": "DESIGN.md",
+  "design_digest": "sha256:e84a6c175840efe9663a2d0aba37f5635c053f47452bb146d1025d65665b1bec",
+  "files": {
+    ".eslintrc.cjs": "sha256:3c2915cf2fff0efaba285fdc2d8c503a8597bcb062a396dfb54701e7672239f9",
+    ".gitignore": "sha256:fb8288522033f645a728dfb53cef24a11824bdbec858b93279d4809924b4539d",
+    ".npmrc.example": "sha256:cee4433295152854b58babea9072215a2d84b8de086d218b15ffb7e84f1fe9e1",
+    "DESIGN.md": "sha256:e84a6c175840efe9663a2d0aba37f5635c053f47452bb146d1025d65665b1bec",
+    "README.md": "sha256:6d8ed1aed45267f3c581733a7d12b0b891dc94c800d1416a0b172355031b4b96",
+    "micro-config.json": "sha256:8266b0eb806696d6bb2023a0d1e72113cdffc355bb0fafd8b2095d727f827711",
+    "orval.config.ts": "sha256:d918458e4ee972ae94740899dd15701530bdc31fd758240fc00e96aba3ba9b3a",
+    "package.json": "sha256:29cd516ba688ae3a3625b4f3a3921c47825134cff27622732ef942c4129c7222",
+    "packages/.env.development": "sha256:e698b56d83ad282c221e2c8067bc4e3e90789c610fd31da2489bd3ac2d8efc5f",
+    "packages/.env.example": "sha256:b8cf60af269af3f4dc3c167df88045af949683b302bd9b77e50fb77fa1adf81f",
+    "packages/.env.production": "sha256:b0a96ab02559a99fc95c37b967f604675686c8de336731a1721d54f43b047249",
+    "packages/.env.production.standalone": "sha256:e698b56d83ad282c221e2c8067bc4e3e90789c610fd31da2489bd3ac2d8efc5f",
+    "packages/index.html": "sha256:bdd33ab639ff63efe8f4c7d36dcae28f40f5b0586b1430714a86583789a3fd97",
+    "packages/package.json": "sha256:c680eaddad5e5a817ff31b65c80d45b12d7ef74d79b91e0bd5b6c16da5c96349",
+    "packages/public/favicon.svg": "sha256:9fb2de7c9d8b4333d5c660e81e6040195148afa2e05a4203e8be539cac915f2c",
+    "packages/src/App.vue": "sha256:fcc1e774142ba53dbeda8f425c0b00beffc4282c3d5254538be9b2cc104b811a",
+    "packages/src/api/mutator.ts": "sha256:7573bd2ff68454b0df42e120a049c75510df86579157d172a78cda97159747ea",
+    "packages/src/components/ThemeScope.vue": "sha256:216193e89cf104c72df8729f9ac2d616ac2ed7236f9d85f1a2744ab65e2efbef",
+    "packages/src/config/theme.json": "sha256:42a229ee534c87490924ddc0d9c985ae931c41da500d4be9bce819f4df638961",
+    "packages/src/env.d.ts": "sha256:65996936fbb042915f7b74a200fcdde7e410f32a669b1ab9597cfaa4b0faddb5",
+    "packages/src/main.ts": "sha256:7b91453f1f158b0da95a4195c5824d688f7556364c0e7dbffa9dd4a03c04c4e2",
+    "packages/src/router/index.ts": "sha256:c41c9400650c15945b9e6376a19ac6a9c08d2eb76d7a07b9624b266c39269c5a",
+    "packages/src/store/theme.ts": "sha256:1dc35947f93976f448e608298b593a873815b94442e263e15fbc4679187ae107",
+    "packages/src/styles/index.less": "sha256:90bbe2444c49eb983d49aa5618c27c57e0932e12f4f0d6aab52e266cb6843cb2",
+    "packages/src/types/microAppBridge.ts": "sha256:054f8c35eb33196f4bddb56d26957776b783e2a84f965229891d13fb0dae1274",
+    "packages/src/utils/microAppRouterBridge.ts": "sha256:f20d045be96c9034136da9296b718915555945a967a118d8aed9fd6ee93193bc",
+    "packages/src/views/NotFound.vue": "sha256:e420747300ff1b7c8575c6113cf276adcf5781d92ceeb92250e54bca9f977988",
+    "packages/src/views/Welcome.vue": "sha256:0498edee6e25b45644a2d12c6fded1e3c0fda830c9196d4fc5389b94fb1a0e0d",
+    "packages/tsconfig.json": "sha256:40e27bb07cd4ae8c0c636b5d9581fe378d00e21acb28423cc2a08bfa1a67c11f",
+    "packages/vite.config.ts": "sha256:d3c1775bdca54e1b0f2b267a7dae992cc61836891588e93e02caa49184cb2ab2",
+    "pnpm-lock.yaml": "sha256:dd05bbc9c948cb47de017fa215806d04f0f9f143d3c953b43076a62e5fd85d9b",
+    "pnpm-workspace.yaml": "sha256:d5cdbd2e0a167297976d11695d1593a4e71694ed462120569e20e98fd9c63fbe"
+  }
+}

package/template/.codex/skills/yss-frontend-scaffold-generator/scripts/generate_scaffold.mjs

@@ -9,6 +9,7 @@ import { validateJsonSchema } from "../../../../scripts/lib/json-schema.mjs";
 
 const fail = (message) => { throw new TypeError(message); };
 const REPOSITORY_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../../..");
+const SKILL_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const sha256 = (value) => `sha256:${createHash("sha256").update(value).digest("hex")}`;
 function argsOf(argv) {
   const args = {};
@@ -33,7 +34,11 @@ function validate(contract, outputDir) {
   if (contract.delivery_role !== "frontend" || contract.scaffold_kind !== "frontend-yss-vue3" || contract.generator_skill !== "yss-frontend-scaffold-generator") fail("contract is not for the YSS frontend generator");
   if (path.resolve(contract.target_output_dir) !== outputDir) fail("output directory differs from approved contract");
   if (contract.generation_policy?.mode !== "initialize-only" || contract.generation_policy?.existing_target !== "unsupported") fail("unsupported generation policy");
-  if (!contract.frontend?.template?.repository || !/^[a-f0-9]{40}$/.test(contract.frontend.template.commit || "")) fail("template repository and exact 40-character commit are required");
+  if (contract.frontend.template.kind === "bundled") {
+    for (const value of [contract.frontend.app_name, contract.frontend.microapp_name]) if (!/^[a-z][a-z0-9-]{0,62}$/.test(value)) fail("bundled app names must be lowercase kebab-case");
+    if (!/^\/(?:[a-zA-Z0-9_-]+\/?)*$/.test(contract.frontend.base_route)) fail("bundled base_route must be an absolute path without query, quotes or traversal");
+    if (Object.keys(contract.frontend.replacements || {}).length) fail("bundled baseline does not accept arbitrary replacements");
+  } else if (!contract.frontend?.template?.repository || !/^[a-f0-9]{40}$/.test(contract.frontend.template.commit || "")) fail("template repository and exact 40-character commit are required");
   if (contract.frontend.openapi_impact === "frozen" && (!contract.frontend.openapi_json_ref || !contract.frontend.openapi_json_digest)) fail("frozen OpenAPI JSON and digest are required");
   if (contract.frontend.openapi_impact === "not-applicable" && !contract.frontend.openapi_not_applicable_reason) fail("no-API scaffold requires a reason");
 }
@@ -41,20 +46,45 @@ function validate(contract, outputDir) {
 export function generate({ contractFile, templateCheckout, outputDir }) {
   const contract = JSON.parse(readFileSync(contractFile, "utf8"));
   outputDir = path.resolve(outputDir);
-  templateCheckout = path.resolve(templateCheckout);
   validate(contract, outputDir);
-  if (!existsSync(path.join(templateCheckout, ".git"))) fail("template checkout must be a Git worktree");
-  if (git(templateCheckout, "rev-parse", "HEAD") !== contract.frontend.template.commit) fail("template checkout does not match approved commit");
-  if (git(templateCheckout, "config", "--get", "remote.origin.url") !== contract.frontend.template.repository) fail("template repository differs from approved source");
+  const bundled = contract.frontend.template.kind === "bundled";
+  let sourceRoot;
+  if (bundled) {
+    const bytes = readFileSync(path.join(SKILL_ROOT, "references/data-quality-v1.manifest.json"));
+    if (sha256(bytes) !== contract.frontend.template.manifest_digest) fail("bundled manifest digest differs from approved contract");
+    const manifest = JSON.parse(bytes);
+    if (manifest.baseline_id !== contract.frontend.template.baseline_id) fail("bundled baseline mismatch");
+    sourceRoot = path.join(SKILL_ROOT, "assets/data-quality-v1");
+    const actual = walk(sourceRoot).map(file => path.relative(sourceRoot, file)).sort();
+    if (JSON.stringify(actual) !== JSON.stringify(Object.keys(manifest.files).sort())) fail("bundled file inventory mismatch");
+    for (const relative of actual) {
+      const file = path.join(sourceRoot, relative);
+      if (lstatSync(file).isSymbolicLink() || sha256(readFileSync(file)) !== manifest.files[relative]) fail(`bundled file digest mismatch: ${relative}`);
+    }
+  } else {
+    if (!templateCheckout) fail("Git template requires --template-checkout");
+    templateCheckout = path.resolve(templateCheckout);
+    if (!existsSync(path.join(templateCheckout, ".git"))) fail("template checkout must be a Git worktree");
+    if (git(templateCheckout, "rev-parse", "HEAD") !== contract.frontend.template.commit) fail("template checkout does not match approved commit");
+    if (git(templateCheckout, "config", "--get", "remote.origin.url") !== contract.frontend.template.repository) fail("template repository differs from approved source");
+  }
+  let openapi;
+  if (contract.frontend.openapi_impact === "frozen") {
+    openapi = readFileSync(contract.frontend.openapi_json_ref);
+    if (sha256(openapi) !== contract.frontend.openapi_json_digest) fail("OpenAPI JSON digest mismatch");
+  }
   if (existsSync(outputDir) && readdirSync(outputDir).length > 0) fail("target directory must not exist or must be empty");
   mkdirSync(outputDir, { recursive: true });
   const scratch = mkdtempSync(path.join(tmpdir(), "yss-frontend-source-"));
   try {
     // Read the approved Git tree, never dependency caches or edits in the checkout.
-    const archive = spawnSync("git", ["archive", contract.frontend.template.commit], { cwd: templateCheckout, maxBuffer: 256 * 1024 * 1024 });
-    if (archive.error || archive.status !== 0) fail(archive.error?.message || String(archive.stderr));
-    const unpack = spawnSync("tar", ["-xf", "-", "-C", scratch], { input: archive.stdout });
-    if (unpack.error || unpack.status !== 0) fail(unpack.error?.message || String(unpack.stderr));
+    if (bundled) cpSync(sourceRoot, scratch, { recursive: true });
+    else {
+      const archive = spawnSync("git", ["archive", contract.frontend.template.commit], { cwd: templateCheckout, maxBuffer: 256 * 1024 * 1024 });
+      if (archive.error || archive.status !== 0) fail(archive.error?.message || String(archive.stderr));
+      const unpack = spawnSync("tar", ["-xf", "-", "-C", scratch], { input: archive.stdout });
+      if (unpack.error || unpack.status !== 0) fail(unpack.error?.message || String(unpack.stderr));
+    }
     cpSync(scratch, outputDir, { recursive: true, verbatimSymlinks: true });
   } finally { rmSync(scratch, { recursive: true, force: true }); }
 
@@ -76,10 +106,8 @@ export function generate({ contractFile, templateCheckout, outputDir }) {
     if (replaced !== text) writeFileSync(file, replaced);
   }
   if (contract.frontend.openapi_impact === "frozen") {
-    const bytes = readFileSync(contract.frontend.openapi_json_ref);
-    if (sha256(bytes) !== contract.frontend.openapi_json_digest) fail("OpenAPI JSON digest mismatch");
     mkdirSync(path.join(outputDir, "openapi"), { recursive: true });
-    writeFileSync(path.join(outputDir, "openapi", "openapi.json"), bytes);
+    writeFileSync(path.join(outputDir, "openapi", "openapi.json"), openapi);
     if (!generatedFiles.includes("openapi/openapi.json")) generatedFiles.push("openapi/openapi.json");
   }
   if (contract.init_git === true) git(outputDir, "init");
@@ -95,7 +123,7 @@ export function generate({ contractFile, templateCheckout, outputDir }) {
     contract_file_ref: path.resolve(contractFile),
     persisted_ref: contract.persisted_ref,
     approval_ref: contract.approval.approval_ref,
-    template: { ...contract.frontend.template, checkout: templateCheckout },
+    template: { ...contract.frontend.template, ...(!bundled ? { checkout: templateCheckout } : {}) },
     repository_scope: contract.repository_scope,
     target_output_dir: outputDir,
     init_git: contract.init_git,

package/template/.codex/skills/yss-frontend-scaffold-generator/scripts/refresh_baseline.mjs

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+import { createHash } from 'node:crypto';
+import { readFileSync, writeFileSync, readdirSync, mkdirSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const skill = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const repository = path.resolve(skill, '../../..');
+const assets = path.join(skill, 'assets/data-quality-v1');
+const sha = bytes => `sha256:${createHash('sha256').update(bytes).digest('hex')}`;
+const walk = root => readdirSync(root, { withFileTypes: true }).flatMap(item => item.isDirectory() ? walk(path.join(root, item.name)) : [path.join(root, item.name)]);
+const design = readFileSync(path.join(repository, 'DESIGN.md'));
+const theme = JSON.parse(readFileSync(path.join(repository, 'docs/design/tokens/theme.json')));
+const css = readFileSync(path.join(repository, 'docs/design/tokens/variables.css'), 'utf8');
+const token = name => css.match(new RegExp(`--${name}: ([^;]+);`))[1];
+const projection = { ...theme, accessibility: { primaryControl: token('yss-color-primary-control'), primaryControlHover: token('yss-color-primary-control-hover') } };
+const generated = { 'DESIGN.md': design, 'packages/src/config/theme.json': Buffer.from(JSON.stringify(projection, null, 2) + '\n') };
+const write = process.argv.includes('--write');
+for (const [relative, bytes] of Object.entries(generated)) {
+ const file = path.join(assets, relative);
+ if (write) { mkdirSync(path.dirname(file), { recursive: true }); writeFileSync(file, bytes); }
+ else if (!readFileSync(file).equals(bytes)) throw new Error(`baseline theme drift: ${relative}`);
+}
+const files = Object.fromEntries(walk(assets).sort().map(file => [path.relative(assets, file), sha(readFileSync(file))]));
+const manifest = { schema_version: 1, baseline_id: 'data-quality-v1', upstream: { project: 'next-gen-data-quality', commit: '532509a59856fc02f3b9bcb28a062663ce887d71', use: 'selected source patterns, reconstructed neutral scaffold; not a complete upstream Git tree', copied_and_adapted: ['packages/src/types/microAppBridge.ts', 'packages/src/utils/microAppRouterBridge.ts'] }, design_source: 'DESIGN.md', design_digest: sha(design), files };
+const file = path.join(skill, 'references/data-quality-v1.manifest.json');
+const bytes = Buffer.from(JSON.stringify(manifest, null, 2) + '\n');
+if (write) { mkdirSync(path.dirname(file), { recursive: true }); writeFileSync(file, bytes); }
+else if (!readFileSync(file).equals(bytes)) throw new Error('baseline manifest drift; review files before refresh_baseline.mjs --write');
+console.log(sha(bytes));

package/template/.codex/skills/yss-frontend-scaffold-generator/scripts/run_scaffold_verification.mjs

@@ -6,8 +6,10 @@ import { runCommandSync } from "../../../../scripts/lib/command-runner.mjs";
 const ALLOWED = new Map([
   ["pnpm install --frozen-lockfile", ["install", "--frozen-lockfile"]],
   ["pnpm lint", ["lint"]],
+  ["pnpm lint:check", ["lint:check"]],
   ["pnpm type-check", ["type-check"]],
   ["pnpm build", ["build"]],
+  ["pnpm build:standalone", ["build:standalone"]],
 ]);
 function argsOf(argv) { const args = {}; for (let i = 0; i < argv.length; i += 2) args[argv[i].replace(/^--/, "")] = argv[i + 1]; return args; }
 export function verify(projectRoot, evidenceDir, { timeoutMs = 0 } = {}) {
@@ -17,7 +19,9 @@ export function verify(projectRoot, evidenceDir, { timeoutMs = 0 } = {}) {
   if (manifest.schema_version !== 4 || manifest.kind !== "frontend-scaffold" || manifest.generation_mode !== "controlled-generation") throw new TypeError("invalid frontend scaffold manifest");
   if (!manifest.generated_files.includes("pnpm-lock.yaml")) throw new TypeError("frontend template must contain pnpm-lock.yaml");
   const commands = manifest.verification_commands;
-  for (const required of ALLOWED.keys()) if (!commands.includes(required)) throw new TypeError(`missing required verification command: ${required}`);
+  const requiredCommands = ["pnpm install --frozen-lockfile", manifest.template?.kind === "bundled" ? "pnpm lint:check" : "pnpm lint", "pnpm type-check", "pnpm build", ...(manifest.template?.kind === "bundled" ? ["pnpm build:standalone"] : [])];
+  for (const required of requiredCommands) if (!commands.includes(required)) throw new TypeError(`missing required verification command: ${required}`);
+  for (const command of commands) if (!ALLOWED.has(command)) throw new TypeError(`unsupported verification command: ${command}`);
   mkdirSync(evidenceDir, { recursive: true });
   const results = commands.map((command, index) => {
     const argv = ALLOWED.get(command);

package/template/.codex/skills/yss-frontend-scaffold-generator/scripts/scaffold-generator.test.mjs

@@ -53,3 +53,35 @@ const second = spawnSync(process.execPath, [runner, "--contract-file", contractF
 assert.notEqual(second.status, 0);
 assert.match(second.stderr, /must not exist or must be empty/);
 process.stdout.write("前端脚手架受控生成场景验证通过\n");
+
+// Bundled source proves portability without the source project's checkout or credentials.
+const { generate } = await import('./generate_scaffold.mjs');
+const { createHash } = await import('node:crypto');
+const bundleManifest = readFileSync(path.resolve('.agents/skills/yss-frontend-scaffold-generator/references/data-quality-v1.manifest.json'));
+const bundle = structuredClone(contract);
+bundle.frontend.template = { kind: 'bundled', baseline_id: 'data-quality-v1', manifest_digest: `sha256:${createHash('sha256').update(bundleManifest).digest('hex')}` };
+bundle.verification_commands = ['pnpm install --frozen-lockfile', 'pnpm lint:check', 'pnpm type-check', 'pnpm build', 'pnpm build:standalone'];
+bundle.target_output_dir = path.join(root, 'bundled'); bundle.implementation_repository = bundle.target_output_dir; bundle.allowed_write_paths = [bundle.target_output_dir];
+const saveBundle = () => writeFileSync(contractFile, JSON.stringify(bundle));
+saveBundle();
+const bundled = generate({ contractFile, outputDir: bundle.target_output_dir });
+assert.equal(bundled.template.checkout, undefined);
+assert.equal(JSON.parse(readFileSync(path.join(bundle.target_output_dir, 'packages/package.json'))).dependencies['ant-design-vue'], '4.2.6');
+assert.equal(JSON.parse(readFileSync(path.join(bundle.target_output_dir, 'packages/src/config/theme.json'))).algorithm, 'default');
+for (const forbidden of ['.npmrc', 'node_modules', '.git', 'packages/src/views/datasource/index.vue', 'scripts/sync-openapi.js']) assert.equal(existsSync(path.join(bundle.target_output_dir, forbidden)), false, forbidden);
+assert.throws(() => generate({ contractFile, outputDir: bundle.target_output_dir }), /must not exist or must be empty/);
+bundle.target_output_dir = path.join(root, 'rejected'); bundle.implementation_repository = bundle.target_output_dir; bundle.allowed_write_paths = [bundle.target_output_dir];
+const goodDigest = bundle.frontend.template.manifest_digest;
+bundle.frontend.template.manifest_digest = `sha256:${'0'.repeat(64)}`; saveBundle();
+assert.throws(() => generate({ contractFile, outputDir: bundle.target_output_dir }), /manifest digest/);
+assert.equal(existsSync(bundle.target_output_dir), false);
+bundle.frontend.template.manifest_digest = goodDigest;
+bundle.frontend.app_name = 'invalid";execute()'; saveBundle();
+assert.throws(() => generate({ contractFile, outputDir: bundle.target_output_dir }), /kebab-case/);
+bundle.frontend.app_name = 'safe'; bundle.frontend.base_route = '/../escape'; saveBundle();
+assert.throws(() => generate({ contractFile, outputDir: bundle.target_output_dir }), /base_route/);
+bundle.frontend.base_route = '/safe'; bundle.frontend.openapi_impact = 'frozen'; bundle.frontend.openapi_json_ref = path.join(root, 'openapi.json'); bundle.frontend.openapi_json_digest = `sha256:${'0'.repeat(64)}`;
+writeFileSync(bundle.frontend.openapi_json_ref, '{"openapi":"3.1.0"}'); saveBundle();
+assert.throws(() => generate({ contractFile, outputDir: bundle.target_output_dir }), /OpenAPI JSON digest mismatch/);
+assert.equal(existsSync(bundle.target_output_dir), false);
+process.stdout.write('Data Quality bundled baseline / source binding / no-write rejection scenarios passed\n');

package/template/.codex/skills/yss-hook/SKILL.md

@@ -13,7 +13,7 @@ description: Use when YSS Vue 页面涉及 vue-hooks-plus/useRequest、分页、
 - Vue Hooks Plus `useRequest`: `https://inhiblabcore.github.io/vue-hooks-plus/zh/hooks/useRequest/quick-start`
 - Local reference index: `references/frontend-docs.md`
 
-本技能负责请求执行、分页/筛选参数、选择状态、响应映射和页面级调度。接口导入与 Orval mutator 使用 `yss-api-integration`；布局、组件与交互呈现使用 `yss-components`；高度计算分别使用 `yss-use-table-height` 或 `yss-use-tree-height`。
+本技能负责请求执行、分页/筛选参数、选择状态、响应映射和页面级调度。接口导入与 Orval mutator 使用 `yss-api-integration`；页面布局和组件选型从 `yss-ui` 路由到 `page-skeleton`、`component-selection-imports` 及具体组件 Skill；高度计算分别使用 `yss-use-table-height` 或 `yss-use-tree-height`。
 
 官方 `@yss-ui/hooks` 当前公开 `useFullscreen`、`useTreeHeight`、`useTableHeight`、`useLoading`、`usePollingTask` 与 `useUrlState`。`useRequest`、防抖、缓存或重试不属于这套公开 YSS Hooks 契约。仅当项目已批准 `vue-hooks-plus` 及其具体版本时，才可使用第 3 节的 `useRequest`；不得把它命名或包装成 YSS 官方 API。
 

package/template/.codex/skills/yss-implementation-contract-compiler/SKILL.md

@@ -45,7 +45,7 @@ description: Use when a YSS vertical slice is entering implementation, spans mul
 - Harness 内实现路径必须落在 `apps/backend/<project>/` 或 `apps/frontend/<project>/` 的具体项目目录；`apps/backend/`、`apps/frontend/` 只能作为容器，`app/backend/`、`app/frontend/` 及其子路径一律阻断。外部实现仓库使用其登记的真实项目根路径。`git-submodule` 使用 `implementation_path_policy: git-submodule-harness-apps`，空 gitlink、detached HEAD 或 `--force` 覆盖挂载点不得脚手架；`inspectWorkingTreeScope.writable` 必须为显式布尔值。
 - 当前用户、缓存、审计、Excel、分布式 ID、请求校验、错误映射、加解密或网关韧性命中时，必须按 `compiler-contract.yaml` 的 `impact_to_capabilities` 补齐入口 capability；不能只在 `boundaries.md` 中提及。仅复用已经验证的平台认证 / 授权能力不算 component impact，不自动增加权限专项 skill。
 - 业务行为使用 `behavior-tdd`；只有机械脚手架/生成物可用 `controlled-generation`，并记录例外和验证。
-- 阶段 5 若命中交付面且无已有工程，按 Project Scaffold Contract schema v4 编译 `controlled-generation` 合同 draft。后端先读取 `scaffold-architecture-decisions.yaml`，只接受已达到 `lifecycle-approved` 且 digest 当前的 DDD / Layered MVC 选择；前端绑定标准模板精确 commit、应用标识、路由、OpenAPI 影响、目标路径和 `init_git` 决定。合同经生命周期批准并持久化后才能运行生成器。历史后端 schema v3 只读兼容并可完成已批准生成；前端只接受 v4。生成与验证完成、仓库登记并通过 `check.implementation-repositories-ready` 后，才编译 Ticket 与业务 Slice Contract。
+- 阶段 5 若命中交付面且无已有工程，按 Project Scaffold Contract schema v4 编译 `controlled-generation` 合同 draft。后端先读取已确认的架构决定，并以原始字节 digest 绑定批准且当前的 Technical Design、Data Architecture Decision v1、API Contract Decision v1 及 `gate.engineering-contract-approved` 真实批准记录；API `required` 时工程批准还必须直接绑定冻结 OpenAPI YAML 的版本与摘要，`not-applicable` 时必须有影响评估、明确原因和证据。前端绑定标准模板精确 commit、应用标识、路由、OpenAPI 影响、目标路径和 `init_git` 决定。合同经生命周期批准并持久化后才能运行生成器。历史后端 schema v3 只允许 Manifest 只读恢复审计，并须补齐 API 对账，不得新生成；前端只接受 v4。生成与验证完成、仓库登记并通过 `check.implementation-repositories-ready` 后，才编译 Ticket 与业务 Slice Contract。
 - 脚手架合同在编译阶段只能是 `draft` / `ready-for-lifecycle-review` / `blocked`；只有生命周期编排器可以把已持久化脚手架合同标记为 `approved`。脚手架合同只覆盖业务代码前的工程骨架工作单元；生成、基线校验和合同重编译完成后，它不能替代脚手架后的 Slice Implementation Contract。
 - 脚手架输出消费批准的脚手架合同；脚手架后的所有生成后端代码都必须绑定当前批准且版本当前的 Slice Implementation Contract、主 YSS skill、依赖闭包、允许写路径、预期证据和 YSS Skill Execution Result。打印命令、`./mvnw validate` 单项通过或脚手架成功不能替代合同批准；生成范围从机械内容变成业务行为时触发完整重路由。
 - 专项结果中的越界路径、缺失证据、`drift`、`violation` 或 `new_impacts` 必须阻断或重路由。

package/template/.codex/skills/yss-implementation-contract-compiler/references/boundaries.md

@@ -118,8 +118,6 @@
 | `yss-prototype-stage` | `i-have-adhd` | `context-conditional` | `lifecycle-document-output` |
 | `yss-prototype-stage` | `prototype-review` | `review-only` | — |
 | `yss-prototype-stage` | `yss-design-system` | `coordination-only` | — |
-| `yss-prototype-stage` | `yss-antdv-next-design` | `context-conditional` | `h2-vue-antdv-next-default` |
-| `yss-prototype-stage` | `yss-antd-design` | `context-conditional` | `h2-react-antd-explicit-compatibility` |
 | `yss-ddd-scaffold-generator` | `yss-backend-scaffold-parent` | `context-required` | — |
 | `yss-ddd-scaffold-generator` | `alibaba-java-code-style` | `context-required` | — |
 | `yss-layered-mvc-scaffold-generator` | `alibaba-java-code-style` | `context-required` | — |
@@ -154,8 +152,12 @@
 | `yss-validation` | `yss-exception` | `component-dependency` | — |
 | `yss-security-algorithm` | `yss-exception` | `component-dependency` | — |
 | `yss-exception` | `yss-dto` | `context-required` | — |
-| `yss-ui-business-page-generation` | `yss-components` | `context-conditional` | `components` |
+| `yss-ui-business-page-generation` | `component-selection-imports` | `context-conditional` | `components` |
 | `yss-ui-business-page-generation` | `yss-hook` | `context-conditional` | `hooks` |
 | `yss-ui-business-page-generation` | `yss-formily` | `context-conditional` | `form` |
 | `yss-ui-business-page-generation` | `yss-api-integration` | `context-conditional` | `api` |
+| `yss-formily` | `formily-foundation` | `context-required` | — |
+| `yss-formily` | `formily-linkage-effects` | `context-conditional` | `formily-linkage` |
+| `yss-formily` | `formily-mode-slot-detail` | `context-conditional` | `formily-mode-detail` |
+| `yss-formily` | `formily-step-flow` | `context-conditional` | `formily-step-flow` |
 | `yss-api-integration` | `yss-openapi-governance` | `context-conditional` | `regeneration` |

package/template/.codex/skills/yss-implementation-contract-compiler/references/compiler-contract.yaml

@@ -149,9 +149,17 @@ project_scaffold_contract_schema:
   discriminant: delivery_role
   delivery_roles:
     backend:
-      scaffold_kinds: [backend-ddd, backend-layered-mvc]
-      generators: [yss-ddd-scaffold-generator, yss-layered-mvc-scaffold-generator]
-      requires: [scaffold_request_id, architecture_family, decision_ref, decision_id, decision_digest, project_name, base_package, maven_coordinates, profiles, module_profile]
+      scaffold_kinds: [backend-ddd, backend-layered-mvc, backend-mvc-data-analysis]
+      generators: [yss-ddd-scaffold-generator, yss-layered-mvc-scaffold-generator, yss-mvc-data-analysis-project-initializer]
+      requires: [scaffold_request_id, architecture_family, decision_ref, decision_id, decision_digest, project_name, base_package, maven_coordinates, profiles, module_profile, design_prerequisites]
+      design_prerequisites:
+        required: [technical_design, data_architecture_decision, api_contract_decision, engineering_contract_approval_ref]
+        artifact_binding: [ref, version, digest]
+        data_impact_modes: [required, not-applicable]
+        api_impact_modes: [required, not-applicable]
+        api_required_closure: [openapi_yaml, validation_record, independent_draft_review, freeze]
+        api_same_original_bytes: true
+        approval_gate: gate.engineering-contract-approved
     frontend:
       scaffold_kinds: [frontend-yss-vue3]
       generators: [yss-frontend-scaffold-generator]
@@ -163,7 +171,7 @@ project_scaffold_contract_schema:
   target_policy: nonexistent-or-empty
   force_overwrite: forbidden
   compatibility:
-    backend_schema_v3: read-only-and-complete-approved-generation
+    backend_schema_v3: historical-manifest-read-only-recovery-audit
     frontend_before_v4: unsupported
 
 scaffold_contract_schema:
@@ -236,7 +244,7 @@ scaffold_contract_schema:
   lifecycle_boundary:
     compiler_emits: [draft, ready-for-lifecycle-review, blocked]
     lifecycle_approves: [approved]
-    generator_consumes: [approved]
+    generator_consumes: []
     after_generation:
       domain-driven: [yss-backend-scaffold-parent, yss-implementation-contract-compiler]
       layered-mvc: [yss-implementation-contract-compiler]

package/template/.codex/skills/yss-layered-mvc-scaffold-generator/SKILL.md

@@ -11,7 +11,7 @@ description: 用于在生命周期已批准的脚手架合同下生成通用 YSS
 
 - backend `scaffold_status=required`，目标目录已确认且不存在。
 - `scaffold-architecture-decisions.yaml` 中对应项目已达到 `lifecycle-approved`，确认架构为 `layered-mvc`。
-- `yss-implementation-contract-compiler` 已编译统一 Project Scaffold Contract schema v4；已批准且当前的后端 schema v3 可完成兼容生成。合同须由生命周期批准并持久化。
+- `yss-implementation-contract-compiler` 已编译统一 Project Scaffold Contract schema v4，并绑定批准且当前的 Technical Design、Data Architecture Decision v1、API Contract Decision v1 和真实工程合同批准记录。API `required` 时 Draft、Validation、独立 Review、Freeze 与工程批准必须绑定同一 OpenAPI YAML 字节；`not-applicable` 时必须有评估、原因和证据且不得携带占位资产。合同须由生命周期批准并持久化。
 - 合同中的 `decision_id`、文件 digest、Profile、能力闭包、写路径和验证命令仍为当前版本。
 
 任一条件缺失时返回 `blocked`。本生成器无交互、无默认回退；用户选择由 `yss-product-lifecycle` 在 `work-unit.technical-analysis` 的工程基线内完成。
@@ -55,7 +55,7 @@ node scripts/generate_and_verify_scaffold.mjs \
 
 ## 硬约束
 
-- 接受统一 schema v4，兼容已批准后端 schema v3；验证器接受对应 Manifest v3/v4。历史 v2 只读兼容，不用于新生成。
+- 新生成只接受包含 API Contract Decision 的统一 schema v4；缺 API 字段的预发布 v4 不得静默接受。验证器可只读检查历史 Manifest v3，恢复必须另行完成所有权审计、技术/数据/API 设计补齐与当前批准。历史 v2/v3 均不用于新生成。
 - `architecture_family` 必须为 `layered-mvc`，`generator_skill` 必须为本 skill。
 - 目标存在、`--force`、旧项目迁移、模板升级均为 `unsupported`。
 - Harness 内只允许以 `apps/backend/` 为输出父容器；外部实现仓库使用已登记真实路径。

package/template/.codex/skills/yss-layered-mvc-scaffold-generator/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
   display_name: "YSS Layered MVC Scaffold Generator"
   short_description: "Generate an approved YSS layered MVC backend skeleton."
-  default_prompt: "Use $yss-layered-mvc-scaffold-generator only after a user-confirmed scaffold architecture decision and a lifecycle-approved schema v3 scaffold contract."
+  default_prompt: "Use $yss-layered-mvc-scaffold-generator only after a user-confirmed architecture decision and a lifecycle-approved schema v4 scaffold contract with approved technical and data design prerequisites."

package/template/.codex/skills/yss-layered-mvc-scaffold-generator/scripts/generate_scaffold.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
-/** 依据生命周期批准的兼容 schema v3 或统一 schema v4 合同生成纯机械 YSS 分层 MVC 后端骨架。 */
+/** 依据生命周期批准的 schema v4 合同生成纯机械 YSS 分层 MVC 后端骨架。 */
 import { assertScaffoldUserDecision } from "../../../../scripts/lib/user-decision.mjs";
+import { validateBackendScaffoldPrerequisites } from "../../../../scripts/lib/backend-scaffold-prerequisites.mjs";
 import { createHash } from "node:crypto";
 import { chmod, cp, lstat, mkdir, mkdtemp, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
@@ -152,13 +153,14 @@ async function validateContract(options, skillId, architectureProfile) {
   const contractText = await readFile(contractFile, "utf8").catch(() => fail(`脚手架合同不可读取: ${contractFile}`));
   let contract;
   try { contract = JSON.parse(contractText); } catch { fail("脚手架合同必须是 JSON 对象"); }
-  if (![3, 4].includes(contract.schema_version)) fail(`unsupported: 只接受兼容 scaffold contract v3 或统一 v4，收到 v${contract.schema_version}`);
-  if (contract.schema_version === 4 && (contract.kind !== "project-scaffold-contract" || contract.delivery_role !== "backend" || contract.scaffold_kind !== "backend-layered-mvc")) fail("schema v4 合同必须绑定 backend/backend-layered-mvc");
-  if (contract.schema_version === 4) validateJsonSchema(contract, path.join(REPOSITORY_ROOT, "docs/process/schemas/project-scaffold-contract.schema.json"), { label: "Project Scaffold Contract v4" });
+  if (contract.schema_version !== 4) fail(`unsupported: 新生成只接受 scaffold contract v4，收到 v${contract.schema_version}`);
+  const expectedScaffoldKind = architectureProfile === "mvc-data-analysis-v1" ? "backend-mvc-data-analysis" : "backend-layered-mvc";
+  if (contract.kind !== "project-scaffold-contract" || contract.delivery_role !== "backend" || contract.scaffold_kind !== expectedScaffoldKind) fail(`schema v4 合同必须绑定 backend/${expectedScaffoldKind}`);
+  validateJsonSchema(contract, path.join(REPOSITORY_ROOT, "docs/process/schemas/project-scaffold-contract.schema.json"), { label: "Project Scaffold Contract v4" });
   const required = ["contract_id", "contract_version", "scaffold_request_id", "status", "compiler_draft_ref", "lifecycle_approval_ref", "persisted_ref", "current_version", "implementation_repository", "backend_repository", "scaffold_status", "project_name", "target_output_dir", "base_package", "architecture_family", "generator_skill", "decision_ref", "decision_id", "decision_digest", "maven_coordinates", "profiles", "module_profile", "allowed_write_paths", "expected_evidence_files", "verification_commands", "approval", "work_unit", "generation_policy"];
   const missing = required.filter((field) => !isPresent(contract[field]));
   if (missing.length) fail(`脚手架合同缺少字段: ${missing.join(", ")}`);
-  if (contract.status !== "approved" || (contract.current_version !== contract.contract_version && !(contract.schema_version === 4 && contract.current_version === true))) fail("脚手架合同必须已批准且为当前版本");
+  if (contract.status !== "approved" || contract.current_version !== true) fail("脚手架合同必须已批准且为当前版本");
   if (contract.contract_id !== options.contractId || contract.contract_version !== options.contractVersion || contract.compiler_draft_ref !== options.compilerDraftRef || contract.lifecycle_approval_ref !== options.approvalRef || contract.persisted_ref !== options.persistedRef) fail("命令行合同元数据与批准合同不一致");
   if (contract.scaffold_status !== "required" || contract.architecture_family !== "layered-mvc" || contract.generator_skill !== skillId) fail("合同必须绑定 layered-mvc 与本生成器");
   if (contract.project_name !== options.projectName || contract.base_package !== options.basePackage || path.resolve(contract.target_output_dir) !== path.resolve(options.outputDir)) fail("项目身份或输出目录与合同不一致");
@@ -202,7 +204,8 @@ async function validateContract(options, skillId, architectureProfile) {
   if (!decision.user_confirmation || Object.values(decision.user_confirmation).some((value) => !isPresent(value))) fail("架构决策缺少完整用户确认记录");
   assertScaffoldUserDecision(decision);
   validateArchitectureIdentity(scaffoldArchitectureIdentity(contract, sha256(contractText)));
-  return { contract, contractText, modules: resolved };
+  const designPrerequisites = await validateBackendScaffoldPrerequisites(contract, { contractFile });
+  return { contract, contractText, modules: resolved, designPrerequisites };
 }
 
 async function validateOutputLayout(outputDir, projectName) {
@@ -221,7 +224,7 @@ async function validateOutputLayout(outputDir, projectName) {
 export async function generate(options, { skillId = SKILL_ID, architectureProfile = "layered-mvc-service", finalize } = {}) {
   if (!((skillId === SKILL_ID && architectureProfile === "layered-mvc-service") || (skillId === "yss-mvc-data-analysis-project-initializer" && architectureProfile === "mvc-data-analysis-v1"))) fail("unsupported MVC generator/Profile pair");
   await validateOutputLayout(options.outputDir, options.projectName);
-  const { contract, contractText, modules } = await validateContract(options, skillId, architectureProfile);
+  const { contract, contractText, modules, designPrerequisites } = await validateContract(options, skillId, architectureProfile);
   const outputDir = path.resolve(options.outputDir);
   await mkdir(outputDir, { recursive: true });
   const staging = await mkdtemp(path.join(outputDir, `.${options.projectName}.staging-`));
@@ -254,7 +257,7 @@ export async function generate(options, { skillId = SKILL_ID, architectureProfil
     const downstream = {};
     for (const skill of ["yss-application", "yss-repository", "yss-mybatis", "yss-web-controller", "yss-dto", "yss-exception", "yss-validation", "mapstruct", "lombok", "alibaba-java-code-style"]) downstream[skill] = (await treeDigest(path.join(REPOSITORY_ROOT, ".agents/skills", skill))).replace(/^sha256:/, "");
     const manifest = {
-      schema_version: contract.schema_version,
+      schema_version: 4,
       kind: architectureProfile === "mvc-data-analysis-v1" ? "service-project-initialization" : "backend-scaffold",
       architecture_profile: contract.architecture_profile,
       architecture_identity: scaffoldArchitectureIdentity(contract, sha256(contractText)),
@@ -274,6 +277,7 @@ export async function generate(options, { skillId = SKILL_ID, architectureProfil
       compiler_draft_ref: contract.compiler_draft_ref,
       persisted_ref: contract.persisted_ref,
       current_version: contract.current_version,
+      design_prerequisites: designPrerequisites,
       allowed_write_paths: contract.allowed_write_paths,
       expected_evidence_files: contract.expected_evidence_files,
       profiles: contract.profiles,

package/template/.codex/skills/yss-layered-mvc-scaffold-generator/scripts/run_scaffold_verification.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-/** 复用统一 Manifest v3 / Maven Wrapper 验证协议。 */
+/** 复用统一 Manifest v4 / Maven Wrapper 验证协议，并只读兼容历史 v2/v3。 */
 import path from "node:path";
 import process from "node:process";
 import { fileURLToPath } from "node:url";