create-yss-spec 3.3.8 → 3.4.3

package/template/.cursor/skills/yss-repository/SKILL.md

@@ -42,3 +42,7 @@ description: 用于按批准的 YSS 架构与持久化合同实现或重构 PO
 ## Review 输入
 
 `code-review` 仅对本体项目及合同/实现仓登记的后端研发项目执行本 Skill。候选命中持久化结构或数据访问时，Standards 轴必须读取所选 Profile 并引用规则与代码证据；未命中时记录带原因的 `not-applicable`。Reviewer 只报告 finding，不写实现。
+
+## 新脚手架平台约束
+
+消费批准切片架构身份中的 `platform_configuration`，与工程 Manifest 核对后使用对应 YSS 组件。Boot 2.7 使用 `javax` Web/Validation API；Boot 3.5/4.1 使用 `jakarta`。Boot 4 按 Jackson 3、对应自动配置和 starter 适配；不替换 `javax.sql` 等 Java SE 包。平台不一致、兼容条目缺失或候选未验证时回合同编译器阻断，不在业务实现中升级或替换组件。详见 仓库共享合同 `docs/engineering/backend-platforms.md`。

package/template/.cursor/skills/yss-research/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: yss-research
-description: Research technical or product-strategy questions with traceable evidence before YSS Plan, Spec, domain-strategy, API, architecture, or implementation decisions. Use for current facts, standards, third-party APIs, business constraints, user problems, domain-boundary evidence, or when the deprecated `research` alias is invoked.
+description: "研究 YSS 技术或产品策略事实并提供可追溯证据；用于标准、第三方行为、业务约束和 research 兼容入口。"
 ---
 
 # YSS Research

package/template/.cursor/skills/yss-resilience4j/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: yss-resilience4j
-description: Use when 用于 YSS Resilience4j starter、网关熔断、限流降级、GlobalCircuitExceptionAdvice、GatewayConfiguration 和断路器配置排障。
+description: "接入或排查 YSS Resilience4j starter、网关熔断、限流降级与断路器配置。"
 ---
 
 # yss-resilience4j

package/template/.cursor/skills/yss-security-algorithm/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: yss-security-algorithm
-description: Use when YSS RSA/AES/DES/SM2/SM4 encryption, JWT/JWK configuration, password encoding, key loading, rotation, or decryption failures are involved.
+description: "接入或排查 YSS 加解密、JWT/JWK、密码编码、密钥加载与轮换。"
 ---
 
 # yss-security-algorithm

package/template/.cursor/skills/yss-skill-source-index-refresh/references/source-map-config.md

@@ -23,7 +23,6 @@ Frontend docs are written to these skills:
 | Skill | Frontend references |
 | --- | --- |
 | `yss-ui` | components, hooks, skills docs |
-| `yss-components` | components docs |
 | `yss-hook` | hooks docs |
 | `yss-use-table-height` | hooks docs |
 | `yss-use-tree-height` | hooks docs |

package/template/.cursor/skills/yss-skill-source-index-refresh/scripts/refresh-yss-skill-index.mjs

@@ -31,7 +31,6 @@ const BACKEND = {
 
 const FRONTEND = {
   "yss-ui": ["components", "hooks", "skills"],
-  "yss-components": ["components"],
   "yss-hook": ["hooks"],
   "yss-ui-business-page-generation": ["components", "hooks", "skills"],
   "yss-use-table-height": ["hooks"],

package/template/.cursor/skills/yss-tactical-design/SKILL.md

@@ -10,7 +10,7 @@ description: 在 YSS 技术分析阶段将批准的战略领域输入细化为
 ## 适用边界
 
 - 由 `yss-technical-design` 在已确认 `domain-driven` 的技术设计分支中调用；传统 MVC 使用 `yss-mvc-design`，不得按状态或一致性影响单独推断为 DDD。
-- 输入必须是版本当前的 Spec、功能架构、战略 DDD、状态矩阵、OpenAPI Draft / Freeze、ADR 和工程约束。若输入来自 Strategic Design Handoff，必须先用 `scripts/verify-strategic-context-import` 验证 schema v3 `source_context_snapshot` / `context_delta` 已对账到目标仓根 `CONTEXT.md`，Visual Baseline Bundle 可读取且 digest 当前，并且目标侧 `context_reconciliation` 有效；未完成时不得开始战术建模。
+- 输入必须是版本当前的 Spec、功能架构、战略 DDD、状态矩阵、OpenAPI Draft / Freeze、ADR 和工程约束。若输入来自 Strategic Design Handoff，必须先用 `scripts/verify-strategic-context-import` 验证历史 v3/v4 或当前 v5 的 `source_context_snapshot` / `context_delta` 已对账到目标仓根 `CONTEXT.md`，对应的 prototype 或 existing UI baseline 可读取且摘要当前，并且目标侧 `context_reconciliation` 有效；未完成时不得开始战术建模。
 - 默认将结果写入系统概要设计 / 数据架构中的 Tactical DDD Check；聚合、状态机、一致性或持久化映射复杂到无法清楚表达时，才升级为独立战术设计文档。
 - 没有聚合、状态、不变量、一致性或领域边界影响时返回 `not-applicable` 及原因，不生成空设计。
 
@@ -39,3 +39,7 @@ description: 在 YSS 技术分析阶段将批准的战略领域输入细化为
 跨仓交接使用 `scripts/strategic-handoff export / verify / import`。正式导出前补齐源战略的稳定规则 ID、关键场景和当前批准绑定；源资产原字节冻结、包内路径通过清单解析。目标导入只产生快照和对账/承接草案，正式 reconciliation 通过后才能进入战术设计。流程与字段见 `docs/process/strategic-handoff-package.md`。
 
 战术合同必须绑定 `strategic_handoff` 导入收据、包摘要、正式目标对账及逐条承接 rows。来自导入包时禁止仅填 `upstream_current: true`。批准前执行 `scripts/verify-strategic-handoff-consumption --root <target> <tactical>`；存在受控延期时按切片执行 `--slice <slice-id>`，实际核验通过且合同批准后才可继续相关切片。最新源规则、关键场景或资产变化使依赖项 stale；未知依赖扩大阻断，业务冲突回交战略方。结果绑定当前包与战术摘要，不能复用旧输出宣布 ready-for-agent。
+
+## 后端脚手架平台承接
+
+消费生命周期已确认的架构与 `platform_configuration` v2；不得自行选择、批准或静默升级 Boot/Java。平台清单执行 `scripts/backend-platforms` 查询；只允许已验证 YSS 组合，新生成缺少配置或证据即阻断。决定、合同、Manifest 与下游架构身份须绑定同一平台及兼容摘要。详见 仓库共享合同 `docs/engineering/backend-platforms.md`。

package/template/.cursor/skills/yss-technical-design/SKILL.md

@@ -37,3 +37,7 @@ schema v1 战术合同只按 DDD 显式兼容读取；使用 `--legacy-ddd`，
 ## 交接
 
 按现有架构审查门禁进行独立评审。批准且版本当前后交回生命周期，再交编译器；DDD 实现使用 `yss-domain`，MVC 实现按已登记 Profile 的能力与 Recipe 路由。发现 `stale`、`drift`、`new_impacts` 或路径越界时回交重路由。需要图示时按用户或合同要求调用 `archify`，图只作派生证据。
+
+## 后端脚手架平台承接
+
+消费生命周期已确认的架构与 `platform_configuration` v2；不得自行选择、批准或静默升级 Boot/Java。平台清单执行 `scripts/backend-platforms` 查询；只允许已验证 YSS 组合，新生成缺少配置或证据即阻断。决定、合同、Manifest 与下游架构身份须绑定同一平台及兼容摘要。详见 仓库共享合同 `docs/engineering/backend-platforms.md`。

package/template/.cursor/skills/yss-technical-design/scripts/validate-technical-design.mjs

@@ -135,11 +135,11 @@ export async function validateTechnicalDesign(data, { root = process.cwd(), slic
 }
 
 async function main() {
-  const { values, positionals } = parseArgs({ allowPositionals: true, options: { root: { type: 'string', default: process.cwd() }, slice: { type: 'string' }, 'legacy-ddd': { type: 'boolean', default: false }, 'read-only': {type:'boolean',default:false}, 'approved-slice': {type:'string'}, 'approved-slice-digest': {type:'string'}, 'approved-slice-approval': {type:'string'} } });
+  const { values, positionals } = parseArgs({ allowPositionals: true, options: { root: { type: 'string', default: process.cwd() }, slice: { type: 'string' }, 'legacy-ddd': { type: 'boolean', default: false }, 'read-only': {type:'boolean',default:false}, 'work-unit': {type:'string'}, 'approved-slice': {type:'string'}, 'approved-slice-digest': {type:'string'}, 'approved-slice-approval': {type:'string'} } });
   ensure(positionals.length === 1, '用法: validate-technical-design.mjs <合同> --root <项目根> [--slice <ID>] [--legacy-ddd]');
   const approvedOptions=['approved-slice','approved-slice-digest','approved-slice-approval'];
   ensure(!approvedOptions.some(key=>values[key])||approvedOptions.every(key=>values[key]),'执行增量必须完整给出持久化 Slice、字节摘要及本地批准引用');
-  const execution=values['approved-slice']?createApprovedExecutionContext({ref:values['approved-slice'],digest:values['approved-slice-digest'],approval_ref:values['approved-slice-approval']},{root:values.root}):undefined;
+  const execution=values['approved-slice']?createApprovedExecutionContext({ref:values['approved-slice'],digest:values['approved-slice-digest'],approval_ref:values['approved-slice-approval']},{root:values.root,work_unit_id:values['work-unit']}):undefined;
   const result = await validateTechnicalDesign(read(path.resolve(positionals[0])), { root: values.root, sliceRef: values.slice, legacyDdd: values['legacy-ddd'], readOnly:values['read-only'], execution });
   process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
 }

package/template/.cursor/skills/yss-ui/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: "yss-ui"
-description: Use when implementing or reviewing YSS Vue pages that combine YSS wrappers with Ant Design Vue, including component selection, version compatibility, layout, Formily, tables, trees, hooks, overlays, themes, accessibility, API integration, and delivery verification.
+description: "选择和核验 YSS Vue 生产页面组件及 Ant Design Vue 兼容性；原型任务用 yss-prototype-stage。"
 ---
 
 # YSS UI 统一路由与交付门禁
@@ -32,7 +32,7 @@ pnpm why vue @yss-ui/components @yss-ui/hooks ant-design-vue vxe-table
 
 记录实际版本、lockfile、验证命令和环境阻塞。完整策略见 `references/antdv-compatibility.md`。
 
-产品设计使用的 Antdv Next 或 Ant Design v6 视觉/token 语义，不等于 Vue 生产实现 API。生产代码必须使用项目安装的 Ant Design Vue 4.x API，禁止把原型 props、events、slots、hook 或组件写法当作生产合同。`yss-antdv-next-design` 只用于默认 H2 Vue 原型，`yss-antd-design` 只用于显式 React 兼容原型；原型阶段不得调用本技能。只有进入前端实现计划、已批准切片的生产实现或实现还原验证后，才从目标 lockfile、类型、本地文档和既有用法取得真实组件事实。
+产品设计使用的 Antdv Next 或 Ant Design v6 视觉/token 语义，不等于 Vue 生产实现 API。生产代码必须使用项目安装的 Ant Design Vue 4.x API，禁止把原型 props、events、slots、hook 或组件写法当作生产合同。原型统一使用 HTML/CSS/JavaScript；原型阶段不得调用本技能。只有进入前端实现计划、已批准切片的生产实现或实现还原验证后，才从目标 lockfile、类型、本地文档和既有用法取得真实组件事实。
 
 ## 3. 组件选型门禁
 
@@ -56,7 +56,7 @@ pnpm why vue @yss-ui/components @yss-ui/hooks ant-design-vue vxe-table
 | 任务 | 必须路由 |
 |---|---|
 | 新建或改造完整业务页面 | `yss-ui-business-page-generation` |
-| 页面布局、组件和交互 | `yss-components` |
+| 页面布局与无独立 Skill 的专项组件 | `page-skeleton`、`component-selection-imports`、`references/specialized-components.md` |
 | 请求、分页、参数、树数据映射 | `yss-hook` |
 | Formily schema、联动、校验、详情态 | `yss-formily` |
 | 表格高度 | `yss-use-table-height` |
@@ -153,6 +153,7 @@ verification: pnpm type-check
 ## 10. 按需读取
 
 - 组件路由：`references/component-routing.md`
+- 无独立 Skill 的专项组件：`references/specialized-components.md`
 - 版本兼容：`references/antdv-compatibility.md`
 - 主题/locale/浮层：`references/theme-locale-overlay.md`
 - 可访问性与性能：`references/accessibility.md`

package/template/.cursor/skills/yss-ui/references/component-routing.md

@@ -6,17 +6,18 @@
 |---|---|---|---|---|
 | 普通按钮、权限按钮 | `YButton` | AntDV Button | required | 权限、主题和统一动作语义；不得直接导入 Button |
 | 卡片 | `YCard` | AntDV Card | required | YSS 布局与间距扩展 |
-| 数据表格 | `YTable` | VXE Table + AntDV Pagination | specialized | 使用 `yss-components`、`field/type`、字段插槽 |
-| 编辑表格 | `YEditTable` | VXE Table | specialized | 对照 edit-table docs/demo |
-| 树 | `YTree` | AntDV Tree | specialized | 搜索、Tooltip、动作和高度路由 |
+| 数据表格 | `YTable` | VXE Table + AntDV Pagination | specialized | 使用 `ytable-usage`；远程分页交给 `page-list-module`，高度交给 `yss-use-table-height` |
+| 编辑表格 | `YEditTable` | VXE Table | specialized | 使用 `yedit-table-usage`，不要把编辑与普通展示表格混为一套 API |
+| 树 | `YTree` | AntDV Tree | specialized | 使用 `ytree-usage`；高度交给 `yss-use-tree-height` |
 | Schema 表单 | `YFormily` | Formily + AntDV | specialized | `YFormily` 为 canonical；`YssFormily` 仅为历史兼容名；加载 `yss-formily` |
-| 分栏布局 | `YSplitPane` | YSS layout | required | 统一主从页面与容器高度 |
-| 文件导入 | `YFileImport` | Upload/业务适配 | required | 使用 YSS 上传结果和表单适配 |
-| 条件构建 | `YConditionBuilder` | YSS domain component | required | 使用对应 docs/demo |
-| Cron | `YCron` | YSS domain component | required | 底层 Popover 可 fallback |
-| 图表 | `YEcharts` | ECharts | required | 主题、resize、darkMode 使用 YSS API |
-| 编辑器 | `YMonaco` | Monaco | required | 按需加载和尺寸治理 |
-| Sheet | `YSheet` | Univer | required | locale 与资源包按 YSS 文档 |
+| 分栏布局 | `YSplitPane` | YSS layout | required | 页面骨架使用 `page-skeleton`；组件边界见 `specialized-components.md` |
+| 文件导入 | `YFileImport` | Upload/业务适配 | required | 两步导入边界见 `specialized-components.md` |
+| 条件构建 | `YConditionBuilder` | YSS domain component | required | 标准模型与校验边界见 `specialized-components.md` |
+| 月历 | `YMonthCalendar` | YSS domain component | required | 日期、月份、高度与事件边界见 `specialized-components.md` |
+| Cron | `YCron` | YSS domain component | required | 七段表达式边界见 `specialized-components.md` |
+| 图表 | `YssEcharts` | ECharts | required | 主题、更新和尺寸边界见 `specialized-components.md` |
+| 编辑器 | `YMonaco` / `YMonacoDiff` | Monaco | required | 按需加载和尺寸治理见 `specialized-components.md` |
+| Sheet | `YSheet` | Univer | required | Facade、释放和依赖边界见 `specialized-components.md` |
 | 输入、选择、日期 | 无独立通用 Wrapper | AntDV Input/Select/DatePicker 等 | fallback | 读取实际 AntDV 版本；服从 theme/locale/popup 规则 |
 | 浮层反馈 | 无统一 Wrapper | Modal/Drawer/Popover/Tooltip/Alert | fallback | 服从容器、焦点、销毁、z-index 规则 |
 | 服务式反馈 | 无统一 Wrapper | message/notification | fallback | 检查 App/ConfigProvider 上下文 |

package/template/.cursor/skills/yss-ui/references/specialized-components.md

@@ -0,0 +1,52 @@
+# YSS 专项组件契约
+
+本文件只承载尚无独立 Skill 的组件边界。页面编排使用 `yss-ui-business-page-generation`，表格、树、Formily、请求和高度分别加载对应专项 Skill。
+
+## YSplitPane
+
+- 轻内容可使用实时拖拽；树、宽表、编辑器、图表等重内容优先 `resize-mode="deferred"` 与 `collapse-animation="transform"`。
+- 尺寸受控时使用 `v-model:left-width`，纵向使用 `v-model:top-height`；`storage-key` 只保存尺寸，不替代页面状态。
+- 折叠默认保留内容状态。只有允许丢失展开、勾选、滚动等内部状态时才启用销毁。
+
+## YConditionBuilder
+
+- 根值是 `ConditionGroup`；叶子保持字段、操作符和值的标准模型。接口 DSL 的序列化、恢复与错误兜底放入 Hook。
+- 字段切换需要动态操作符或候选值时使用组件公开的加载入口；提交前执行公开校验。
+- 默认严格校验，只有明确允许未完成草稿时才关闭；展示态使用 `disabled`，不使用已废弃的 `readonly`。
+- 组件资料见 `../assets/component-docs/condition-builder-*`，实现前仍须核对目标项目安装版本。
+
+## YMonthCalendar
+
+- `v-model` 管理选中日期，`v-model:month` 管理展示月份，不把二者当作日期范围。
+- `valid-range` 限制范围，`disabled-date` 表达业务禁用日期；业务层仍需规范化起止输入。
+- 自定义日期单元格应保留 today、selected、disabled 等状态语义。
+- `fill-height` 仅用于父容器已有明确高度的场景；键盘、右键和双击动作使用公开事件，不覆盖默认焦点行为。
+
+## YFileImport
+
+- 文件选择、预检、结果回显和最终确认组成两步流程；业务上传与校验由 `nextStep` / `finalImport` 接入。
+- 默认 `beforeUpload=false`，不能期待 `action` 自动上传；直传只通过 `upload-props.customRequest`。
+- `importResult` 展示结果，失败数据通过 `exportErrorData` 下载。弹窗配置与上传器配置保持分离。
+- 组件资料见 `../assets/component-docs/file-import-*`。
+
+## YMonaco / YMonacoDiff
+
+- 分栏折叠或 Drawer 打开等容器尺寸变化后确认已重新布局。
+- 日志增量使用 `appendContent()`，避免频繁重设超大完整字符串。
+- 编辑器必须按需加载并在页面卸载时释放相关资源。
+
+## YCron
+
+- 业务值是七段表达式：秒、分、时、天、月、周、年。
+- 页面只负责双向绑定和禁用态；时区、后端模型转换和生效校验属于 API/Hook 层。
+
+## YSheet
+
+- 必须提供明确容器高度。
+- 初始化后只通过公开 Facade API 修改工作簿，并通过公开保存入口取值；不得直接修改工作簿原始数据对象。
+- 卸载时释放实例，接入前确认 Univer、React、RxJS 等可选依赖及包体影响。
+
+## YssEcharts
+
+- option、更新策略和容器尺寸以目标版本手册与项目已验证实践为准。
+- 不在页面层重复原生 ECharts 初始化、销毁或 ResizeObserver 管理。

package/template/.cursor/skills/yss-ui-business-page-generation/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: yss-ui-business-page-generation
-description: 指导生成或改造 Vue3 YSS UI CRUD、列表、表单、详情、左树右表和弹窗抽屉页面，覆盖组件选型、模块拆分、Orval API、响应式高度、主题和原型验收；当用户要求生成 YSS UI 业务页或 CRUD 模块时使用。
+description: "生成或改造完整 YSS UI CRUD、列表、表单、详情或左树右表模块；组织页面、API 与验收。"
 ---
 
 # YSS UI 业务页面生成 Skill

package/template/.cursor/skills/yss-up-springboot3/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: yss-up-springboot3
-description: Use when YSS Spring Boot 3 / Spring Cloud 升级辅助技能。Use when auditing or migrating YSS backend services/components from Spring Boot 2.x or Spring Cloud 2021-era dependencies toward Spring Boot 3, Jakarta namespace, newer Spring Security, MyBatis, OpenFeign, gateway, validation, and related compatibility changes.
+description: "审查或迁移 YSS Spring Boot 2 到 3 的依赖、Jakarta 与 Spring Cloud 兼容性。"
 ---
 
 # yss-up-springboot3

package/template/.cursor/skills/yss-use-table-height/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: yss-use-table-height
-description: 指导 YTable、YEditTable、左树右表、分页列表、工具栏表格和弹窗/抽屉内表格使用 @yss-ui/hooks 的 useTableHeight 实现稳定自适应高度；当需要避免双滚动条、底部空白、容器撑开闪烁，或需要计入分页、工具栏、添加按钮偏移时使用。
+description: "用 useTableHeight 修复 YTable、YEditTable 自适应高度、双滚动条及分页或工具栏偏移。"
 ---
 
 # useTableHeight 使用

package/template/.cursor/skills/yss-use-tree-height/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: yss-use-tree-height
-description: 指导 YTree、左树右表、组织树、分类树、树搜索和 Tab/抽屉内树区域使用 @yss-ui/hooks 的 useTreeHeight 实现自适应高度；当树区域需要独立滚动、容器切换后高度不正确或需要扣除 YTree 内置搜索高度时使用。
+description: "用 useTreeHeight 实现 YTree 独立滚动，修复搜索区、Tab 或抽屉切换后的高度。"
 ---
 
 # useTreeHeight 使用

package/template/.cursor/skills/yss-userinfo/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: yss-userinfo
-description: Use when YSS current-user context, `AuthUserInfoUtil`, propagated user headers, JWT user payloads, Redis user cache, or background-user fallback is involved.
+description: "接入或排查 YSS AuthUserInfoUtil、用户头透传、JWT、Redis 用户缓存与后台用户上下文。"
 ---
 
 # yss-userinfo

package/template/.cursor/skills/yss-validation/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: yss-validation
-description: Use when YSS Bean Validation/JSR-303 dependencies, validation messages, LiteFlow EL parsing, `ExpressParserFactory`, parser registration, or validation-error mapping is involved.
+description: "接入或排查 YSS Bean Validation、校验消息、LiteFlow EL 解析器与校验错误映射。"
 ---
 
 # yss-validation
@@ -55,3 +55,7 @@ Read `references/source-index.md` as a path-hint index whenever the task depends
 - Do not invent class names or configuration keys without checking the source index.
 - Do not replace component extension points with business-local framework code.
 - Do not broaden the task into unrelated YSS components unless the user asks.
+
+## 新脚手架平台约束
+
+消费批准切片架构身份中的 `platform_configuration`，与工程 Manifest 核对后使用对应 YSS 组件。Boot 2.7 使用 `javax` Web/Validation API；Boot 3.5/4.1 使用 `jakarta`。Boot 4 按 Jackson 3、对应自动配置和 starter 适配；不替换 `javax.sql` 等 Java SE 包。平台不一致、兼容条目缺失或候选未验证时回合同编译器阻断，不在业务实现中升级或替换组件。详见 仓库共享合同 `docs/engineering/backend-platforms.md`。

package/template/.cursor/skills/yss-web-controller/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: yss-web-controller
-description: Use when generating or refactoring YSS Web Adapter Controllers, request DTOs, response VOs, validation, result wrappers, or Web Convertors from frozen contracts and stable Application interfaces.
+description: "按冻结合同与稳定 Application 接口生成或重构 YSS Controller、请求 DTO、响应 VO 和 Web Convertor。"
 ---
 
 # yss-web-controller
@@ -89,3 +89,7 @@ node scripts/generate_controller.mjs \
 - DTO/VO/WebConvertor 机械骨架可用 `controlled-generation`；权限、错误映射、校验语义和接口行为必须使用 `behavior-tdd`。
 - 写入必须位于合同 `allowed_write_paths`，并提供 Controller、DTO/VO、WebConvertor、契约/API 测试和实际验证结果。
 - 按统一 `YSS Skill Execution Result` 返回偏离与新增影响；出现新 API/schema、权限或响应包装变化时暂停并回到 实现合同编译器/生命周期。
+
+## 新脚手架平台约束
+
+消费批准切片架构身份中的 `platform_configuration`，与工程 Manifest 核对后使用对应 YSS 组件。Boot 2.7 使用 `javax` Web/Validation API；Boot 3.5/4.1 使用 `jakarta`。Boot 4 按 Jackson 3、对应自动配置和 starter 适配；不替换 `javax.sql` 等 Java SE 包。平台不一致、兼容条目缺失或候选未验证时回合同编译器阻断，不在业务实现中升级或替换组件。详见 仓库共享合同 `docs/engineering/backend-platforms.md`。

package/template/.cursor/skills/yss-web-controller/scripts/generate_controller.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { loadBackendPlatforms, assertPlatformAgreement } from "../../../../scripts/lib/backend-platform.mjs";
 import { createHash } from "node:crypto";
 import { constants, access, copyFile, mkdir, mkdtemp, readFile, rm, unlink, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
@@ -10,8 +11,8 @@ import { assertArchitectureAgreement, validateArchitectureIdentity } from "../..
 
 const TYPE_MAPPING = { bigint: "Long", int: "Integer", integer: "Integer", smallint: "Integer", tinyint: "Integer", number: "Long", numeric: "BigDecimal", decimal: "BigDecimal", float: "Float", double: "Double", real: "Float", varchar: "String", varchar2: "String", nvarchar2: "String", char: "String", nchar: "String", text: "String", clob: "String", nclob: "String", date: "LocalDateTime", datetime: "LocalDateTime", timestamp: "LocalDateTime", "timestamp with time zone": "LocalDateTime", boolean: "Boolean", bool: "Boolean", bit: "Boolean", json: "String", jsonb: "String", uuid: "String" };
 const PLATFORM_VALIDATION_NAMESPACES = {
-  "spring-boot-2.7-jdk8": "javax",
-  "spring-boot-3-jdk17": "jakarta"
+  ...Object.fromEntries(loadBackendPlatforms().profiles.map(profile => [profile.id, profile.validation_namespace])),
+  "spring-boot-3-jdk17": "jakarta" // Existing-project compatibility only; new scaffolds use exact catalog profiles.
 };
 const required = ["metadata-file", "contract-file", "dto-wire-profile-file", "base-package", "module-name", "domain-segment"];
 const valued = new Set([...required, "output-dir", "web-project-dir", "web-output-dir", "author", "application-service-package", "validation-namespace", "scaffold-manifest-file"]);
@@ -158,17 +159,20 @@ async function validateContract(contract, args) {
   if (manifestPath !== path.resolve(contract.scaffold_manifest_ref)) throw new Error("--scaffold-manifest-file does not match the approved web generation contract");
   if (!await exists(manifestPath)) throw new Error(`scaffold manifest not found: ${manifestPath}`);
   const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
-  if (![2, 3].includes(manifest.schema_version)) throw new Error("scaffold manifest must use historical schema_version=2 or current schema_version=3");
-  if (mvc && manifest.schema_version !== 3) throw new Error("MVC requires schema v3 scaffold identity");
+  if (![2, 3, 4].includes(manifest.schema_version)) throw new Error("scaffold manifest must use supported schema_version=2/3/4");
+  if (manifest.schema_version === 3 && manifest.legacy_reconciliation?.status !== "approved") throw new Error("historical schema v3 scaffold requires approved legacy reconciliation before business generation");
+  if (mvc && ![3, 4].includes(manifest.schema_version)) throw new Error("MVC requires schema v3/v4 scaffold identity");
   if (manifest.architecture_identity || mvc) {
     assertArchitectureAgreement(contract.architecture_identity, { manifest });
     if (contract.architecture_identity.architecture_profile !== contract.architecture_profile) throw new Error("Web architecture profile differs from its identity");
-  } else if (manifest.schema_version === 3 && (manifest.architecture_family !== "domain-driven" || manifest.generator_skill !== "yss-ddd-scaffold-generator")) throw new Error("schema v3 scaffold manifest must bind the domain-driven generator for Web adapter generation");
+  } else if (manifest.schema_version >= 3 && (manifest.architecture_family !== "domain-driven" || manifest.generator_skill !== "yss-ddd-scaffold-generator")) throw new Error("schema v3/v4 scaffold manifest must bind the domain-driven generator for Web adapter generation");
   if (!["empty-scaffold-verified", "first-slice-verified"].includes(manifest.completion_level)) throw new Error("scaffold manifest must be empty-scaffold-verified before Web generation");
   const scaffoldRoot = path.dirname(path.dirname(manifestPath));
   if (implementationRoot !== scaffoldRoot) throw new Error("implementation_project_root does not match the scaffold manifest project root");
   const expectedWebProject = mvc ? path.join(scaffoldRoot, `${manifest.project_name}-server`) : path.join(scaffoldRoot, `${manifest.project_name}-adapter`, `${manifest.project_name}-web`);
   if (!args["web-project-dir"] || path.resolve(args["web-project-dir"]) !== expectedWebProject) throw new Error("--web-project-dir does not match the scaffold manifest project layout");
+  if (manifest.platform_verification === "candidate") throw new Error("backend-platform: candidate scaffold is not ready for downstream generation");
+  if (manifest.platform_configuration) assertPlatformAgreement(manifest.platform_configuration, contract.architecture_identity?.platform_configuration);
   const profilePairs = mvc ? [["platform", "platform_profile"], ["validation_namespace", "validation_namespace"]] : [["architecture", "architecture_profile"], ["platform", "platform_profile"], ["validation_namespace", "validation_namespace"], ["dto_placement", "dto_placement"]];
   for (const [manifestField, contractField] of profilePairs) {
     if (manifest.profiles?.[manifestField] !== contract[contractField]) throw new Error(`scaffold manifest ${manifestField} profile does not match the approved Web contract`);

package/template/.cursor/skills/yss-web-controller/scripts/generate_controller.test.mjs

@@ -20,7 +20,7 @@ for (const [profile, module, placement, modules, generator] of [
   const identity = { architecture_family: "layered-mvc", architecture_profile: profile, generator_skill: generator, requested_capabilities: [], resolved_modules: modules, contract_digest: "a".repeat(64), verification_database: "h2", production_database: "not-bound" };
   const project = path.join(data.root, "demo-service");
   const manifestFile = path.join(project, ".yss/scaffold-generation.json");
-  const manifest = { schema_version: 3, project_name: "demo-service", base_package: "com.yss.demo", completion_level: "empty-scaffold-verified", architecture_identity: identity, profiles: { platform: "spring-boot-2.7-jdk8", validation_namespace: "javax" } };
+  const manifest = { schema_version: 4, project_name: "demo-service", base_package: "com.yss.demo", completion_level: "empty-scaffold-verified", architecture_identity: identity, profiles: { platform: "spring-boot-2.7-jdk8", validation_namespace: "javax" } };
   await mkdir(path.dirname(manifestFile), { recursive: true });
   await writeFile(manifestFile, JSON.stringify(manifest));
   const contract = webContract(project, { architecture_profile: profile, architecture_identity: identity, dto_placement: placement, integration_mode: "scaffold-v2", scaffold_manifest_ref: manifestFile, platform_profile: "spring-boot-2.7-jdk8", validation_namespace: "javax", application_service_package: `com.yss.demo.${module}.service` });

package/template/.cursor/skills/ytable-usage/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ytable-usage
-description: 指导 YSS UI 业务列表页、CRUD 表格、远程分页、操作列、气泡确认、列筛选、字典翻译、行拖拽、工具栏和自定义插槽正确使用 @yss-ui/components 的 YTable；当需要配置 YTableColumn、YTableActionConfig、pagination、filter-change 或表格实例方法时使用。
+description: "配置或修复 YSS UI YTable 的列、分页、行操作、筛选、拖拽与插槽；完整列表流程用 page-list-module。"
 ---
 
 # YTable 使用

package/template/.cursor/skills/ytree-usage/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ytree-usage
-description: 指导 YSS UI 左树右表、组织树、分类树、目录树和节点管理页使用 @yss-ui/components 的 YTree，覆盖 fieldNames 字段映射、搜索过滤、受控选中、节点动作、删除确认、虚拟滚动和自适应高度；当生成或修改树形筛选、左树右表、树搜索或树节点操作时使用。
+description: "配置或修复 YSS UI YTree 的字段映射、搜索、选中与节点操作；用于树形筛选和节点管理。"
 ---
 
 # YTree 使用

package/template/.pi/skills/archify/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: archify
-description: Create polished, validated architecture, workflow, sequence, data-flow, and lifecycle/state diagrams as explorable standalone HTML with inline SVG, dark/light themes, optional trace motion, and PNG/JPEG/WebP/SVG/WebM export. Accept plain-language requirements or pasted Mermaid flowchart, sequenceDiagram, and stateDiagram input; inspect repository evidence when the diagram must reflect real code. Use when the user asks to visualize system architecture, infrastructure, cloud/security/network topology, technical workflows, API call sequences, request lifecycles, data pipelines, ETL/ELT, data lineage, state machines, or to convert/beautify Mermaid.
+description: "Create interactive HTML architecture, workflow, sequence, data-flow or state diagrams. Use for requested diagrams or Mermaid conversion."
 license: MIT
 metadata:
   version: "2.16"

package/template/.pi/skills/code-review/SKILL.md

@@ -9,7 +9,7 @@ Review of a pinned candidate against a fixed point on two core axes, plus UI fid
 - **Spec** — does the code faithfully implement the originating issue / spec?
 - **UI fidelity** (only when the change has UI impact) — does the candidate match the confirmed prototype and `yss-design-system` / `yss-ui`? Type-check or claiming "already aligned" is not a pass. Invoke those skills' verification notes; do not collapse this axis into Standards or Spec. YSS page-module conventions stay on Standards.
 
-Standards and Spec run as **parallel sub-agents** so they don't pollute each other's context, then this skill aggregates their findings. When UI is in scope, add a separate UI fidelity pass after those two reports (do not merge it into either axis).
+普通功能默认由一名与实现者独立的审查者完成 Standards、Spec 和适用的 UI fidelity 检查，分别报告结论。只有专业能力缺口、结论冲突、明确外部制度或用户指定时，才拆成多个审查者；多个无依赖审查可以并行。检查轴不等于会签人数，不能要求用户为每个轴重复确认。
 
 If `docs/agents/issue-tracker.md` is missing, tell the user to run `/setup-matt-pocock-skills`; do not invoke another user-invoked skill yourself.
 
@@ -34,7 +34,7 @@ Choose one candidate mode from the request or an upstream review contract:
   - each untracked file's content, using `git diff --no-index --no-ext-diff --binary --full-index -- /dev/null <path>` when a diff representation is useful. Exit code `1` from this command means a difference was found, not that review failed;
   - `git log <fixed-point>..HEAD --oneline` for the committed portion of the candidate.
 
-Record one **candidate manifest** before spawning reviewers:
+Record one **candidate manifest** before review:
 
 ```yaml
 review_mode: committed # or worktree
@@ -51,9 +51,9 @@ commit_list_command: <command>
 
 For a Committed candidate, resolve `HEAD` to an immutable commit and tree before review. Its manifest must include `merge_base`, `tracked_diff_command` and `commit_list_command`. For a Worktree candidate, the manifest must additionally include `untracked_inventory_command`, `untracked_diff_command` and the exact `untracked_files` inventory.
 
-For a Worktree candidate, capture the tracked binary diff and every untracked file's bytes once into an immutable snapshot, compute `candidate_digest`, and make that **captured candidate** available to both reviewers. The following is normative, not illustrative: use the `yss-worktree-candidate-v1` byte stream. Start with ASCII `YSS-WORKTREE-CANDIDATE-V1` followed by one NUL byte. Append one tracked record: byte `0x54`, unsigned 64-bit big-endian binary-diff byte length, then the exact stdout bytes from `git diff --no-ext-diff --binary --full-index <merge-base>`. Then append one untracked record for each NUL-delimited raw path from `git ls-files -z --others --exclude-standard`, sorted bytewise by the raw path: byte `0x55`, unsigned 64-bit big-endian path length, raw path bytes, unsigned 32-bit big-endian `lstat` mode, entry-kind byte (`0x52` regular or `0x4c` symlink), unsigned 64-bit big-endian content length, then raw regular-file bytes or raw symlink-target bytes. Other entry kinds block capture. This is the sole length-prefixed framing and bytewise path order for the digest. SHA-256 is calculated over exactly this stream. New captures use a previously nonexistent directory under `.template-source/evidence/maintenance/`, land atomically, and store exactly `candidate-manifest.yaml`, `candidate.bin` and `tracked.diff`; `candidate.bin` already contains every untracked byte, so do not duplicate hundreds of `untracked-content/000xxx` files. Explicit exclusions are fail-closed to `.template-source/evidence/maintenance/` evidence and cannot exclude implementation or authority assets. Historical per-file snapshots remain readable. Both reviewers must consume the captured stream and must not independently treat a live worktree as the reviewed candidate.
+For a Worktree candidate, capture the tracked binary diff and every untracked file's bytes once into an immutable snapshot, compute `candidate_digest`, and make that **captured candidate** available to the assigned reviewer(s). The following is normative, not illustrative: use the `yss-worktree-candidate-v1` byte stream. Start with ASCII `YSS-WORKTREE-CANDIDATE-V1` followed by one NUL byte. Append one tracked record: byte `0x54`, unsigned 64-bit big-endian binary-diff byte length, then the exact stdout bytes from `git diff --no-ext-diff --binary --full-index <merge-base>`. Then append one untracked record for each NUL-delimited raw path from `git ls-files -z --others --exclude-standard`, sorted bytewise by the raw path: byte `0x55`, unsigned 64-bit big-endian path length, raw path bytes, unsigned 32-bit big-endian `lstat` mode, entry-kind byte (`0x52` regular or `0x4c` symlink), unsigned 64-bit big-endian content length, then raw regular-file bytes or raw symlink-target bytes. Other entry kinds block capture. This is the sole length-prefixed framing and bytewise path order for the digest. SHA-256 is calculated over exactly this stream. New captures use a previously nonexistent directory under `.template-source/evidence/maintenance/`, land atomically, and store exactly `candidate-manifest.yaml`, `candidate.bin` and `tracked.diff`; `candidate.bin` already contains every untracked byte, so do not duplicate hundreds of `untracked-content/000xxx` files. Explicit exclusions are fail-closed to `.template-source/evidence/maintenance/` evidence and cannot exclude implementation or authority assets. Historical per-file snapshots remain readable. Every assigned reviewer must consume the captured stream and must not independently treat a live worktree as the reviewed candidate.
 
-Before going further, confirm the fixed point and merge-base resolve. A committed candidate must have a non-empty committed diff. A Worktree candidate is non-empty when either its tracked diff or untracked inventory is non-empty. A bad ref, missing candidate part or empty candidate should fail here — not inside two parallel sub-agents. Do not silently downgrade Worktree review to `HEAD`-only review.
+Before going further, confirm the fixed point and merge-base resolve. A committed candidate must have a non-empty committed diff. A Worktree candidate is non-empty when either its tracked diff or untracked inventory is non-empty. A bad ref, missing candidate part or empty candidate should fail here — not during professional review. Do not silently downgrade Worktree review to `HEAD`-only review.
 
 ### 2. Identify the spec source
 
@@ -66,7 +66,7 @@ Look for the originating spec, in this order:
 
 ### 3. Identify the standards sources
 
-Compile sources **before** spawning reviewers. For YSS implementation candidates follow [yss-review-standards.md](references/yss-review-standards.md): run machine checks that exist in the implementation repo; then collect repo docs (`CODING_STANDARDS.md` / `CONTRIBUTING.md` if present), every Slice `required_skills` skill file, the impact-conditioned specialist inputs (`alibaba-java-code-style`, `yss-ui`, `yss-domain`, …), and `docs/templates/review-report-template.md`. Missing applicable coverage is `missing_evidence`, not a pass.
+Compile sources **before** review. For YSS implementation candidates follow [yss-review-standards.md](references/yss-review-standards.md): run machine checks that exist in the implementation repo; then collect repo docs (`CODING_STANDARDS.md` / `CONTRIBUTING.md` if present), every Slice `required_skills` skill file, the impact-conditioned specialist inputs (`alibaba-java-code-style`, `yss-ui`, `yss-domain`, …), and `docs/templates/review-report-template.md`. Missing applicable coverage is `missing_evidence`, not a pass.
 
 For YSS backend review, derive the review roots from the candidate project root, implementation-repository registry, Slice `project_roots` and `allowed_write_paths`. Review only the project itself and registered backend development projects; exclude frontend roots, unrelated submodules/vendor trees and unregistered directories. Never replace this resolution with a fixed `apps/backend` assumption.
 
@@ -94,7 +94,9 @@ Each smell reads *what it is* → *how to fix*; match it against the diff:
 - **Middle Man** — a class or function that mostly just delegates onward. → cut it, call the real target direct.
 - **Refused Bequest** — a subclass or implementer that ignores or overrides most of what it inherits. → drop the inheritance, use composition.
 
-### 4. Spawn both sub-agents in parallel
+### 4. Complete each applicable review axis
+
+默认由当前独立 Reviewer 连续完成下列两份检查提纲，按轴保留结论，不派发额外 subagent。需要多专业参与时，按角色表和协作协议派发对应提纲；只增加缺少的能力，不默认启动两个额外 Agent。下面的 sub-agent prompts 同样是单 Reviewer 的检查清单。
 
 **Standards sub-agent prompt** — include:
 
@@ -111,13 +113,15 @@ Each smell reads *what it is* → *how to fix*; match it against the diff:
 
 If the spec is missing, skip the Spec sub-agent and note this in the final report.
 
+普通审查只复验修复影响的结论及其依赖；候选摘要变化后仍须重新绑定当前候选，不能沿用过期证据。未受影响项记录依据后复用。已明确采用下节历史候选/多轴合同的审查继续遵守其约定。
+
 ### 5. Aggregate
 
 For template-maintenance task packages carrying `review_round`, preserve the frozen scope and apply the two-round convergence contract. A hard requirement added during review must cite a rule that already applied when the candidate was frozen; otherwise report it as `judgement-call` for the backlog. Round 1 blocking findings return to the implementer and require a new digest plus all review axes. If Round 2 still has an open `violation`, `drift`, or `new_impacts`, return `needs-human` and stop; do not silently start Round 3. Candidate byte changes invalidate every earlier axis report.
 
-Present the reports under `## Standards` and `## Spec` headings, verbatim or lightly cleaned. If UI is in scope, add `## UI fidelity` from the separate pass. Fill `docs/templates/review-report-template.md` specialist tables as part of Standards evidence, not a fourth axis. Do **not** merge or rerank findings — the axes are deliberately separate (see _Why separate axes_). A YSS candidate with blank applicable specialist rows, skipped `required_skills`, or unaddressed mandatory violations is `blocked`, not `completed`. Do not close findings by writing implementation in the review session. `violation` / machine-check failure / blank applicable rows go back to the implementer on the original contract path, then recapture the candidate and rerun every axis. `drift` / `new_impacts` / `required_skills` mismatch mark the contract `stale` and return to 实现合同编译器; do not keep coding on the old contract. `not-applicable` is only for untriggered impacts; mandatory gates have no waiver, only repair or a complete `seam-deferred` record.
+Present the reports under `## Standards` and `## Spec` headings, verbatim or lightly cleaned. If UI is in scope, add `## UI fidelity` from the separate pass. Fill `docs/templates/review-report-template.md` specialist tables as part of Standards evidence, not a fourth axis. Do **not** merge or rerank findings — the axes are deliberately separate (see _Why separate axes_). A YSS candidate with blank applicable specialist rows, skipped `required_skills`, or unaddressed mandatory violations is `blocked`, not `completed`. Do not close findings by writing implementation in the review session. `violation` / machine-check failure / blank applicable rows go back to the implementer on the original contract path, then recapture the candidate and rerun affected axes and their dependencies; explicitly rebind unchanged evidence. `drift` / `new_impacts` / `required_skills` mismatch mark the contract `stale` and return to 实现合同编译器; do not keep coding on the old contract. `not-applicable` is only for untriggered impacts; mandatory gates have no waiver, only repair or a complete `seam-deferred` record.
 
-For Worktree mode, recapture the candidate digest after both reports return. If it differs from `candidate_digest`, mark both reports as reviewing a **stale candidate** and return `blocked`; the caller may start a new review against a new capture, but this invocation must not aggregate findings from different bytes. Recheck the same digest again at the completion/checkpoint boundary.
+For Worktree mode, recapture the candidate digest after all applicable checks finish. If it differs from `candidate_digest`, mark the affected reports as reviewing a **stale candidate** and return `blocked`; the caller may start a new review against a new capture, but this invocation must not aggregate findings from different bytes. Recheck the same digest again at the completion/checkpoint boundary.
 
 State the reviewed `review_mode`, fixed point, candidate digest and coverage before the two reports. End with a one-line summary: total findings per axis, and the worst issue _within each axis_ (if any). Don't pick a single winner across axes — that's the reranking the separation exists to prevent.
 

package/template/.pi/skills/file-export-download/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: file-export-download
-description: 指导 Vue3 YSS UI 微应用实现文件导出、报表下载、模板下载和附件下载，覆盖 OpenAPI binary 响应、Orval 生成方法检查、responseType blob 兜底、Blob 响应类型、Content-Disposition 文件名、handleBlobResponse、loading 与错误处理；当需求出现导出、下载、Excel、CSV、PDF、ZIP、Blob 或文件流时使用。
+description: "在 Vue3 YSS UI 中实现或修复文件下载与导出，处理 Orval 文件流、Blob、文件名和错误响应。"
 ---
 
 # YSS 文件导出下载 Skill

package/template/.pi/skills/frontend-commit/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: frontend-commit
-description: 分析并提交 Vue、React、TypeScript、JavaScript、Vite、微前端和前端 monorepo 项目的 Git 改动；当用户要求生成 commit message、检查提交规范、拆分原子提交、暂存并执行 git commit，或修复 commitlint 与 commit-msg hook 拒绝时使用。读取仓库实际规则和 diff，选择业务 scope，生成英文 type/scope 与中文标题和正文，并安全验证提交。
+description: "为前端改动生成提交信息、审查原子提交或修复 Git hook；用户明确要求提交时执行 git commit。"
 ---
 
 # 前端规范提交

package/template/.pi/skills/java-backend-commit/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: java-backend-commit
-description: 分析并提交 Java、Spring Boot、Maven、Gradle、单体服务和多模块后端项目的 Git 改动；当用户要求生成 commit message、检查提交规范、拆分原子提交、暂存并执行 git commit，或修复 commitlint 与 commit-msg hook 拒绝时使用。读取仓库实际规则、模块结构和 diff，选择服务或业务域 scope，生成英文 type/scope 与中文标题和正文，并安全验证提交。
+description: "为 Java 后端改动生成提交信息、审查原子提交或修复 Git hook；用户明确要求提交时执行 git commit。"
 ---
 
 # Java 后端规范提交

package/template/.pi/skills/llm-wiki/SKILL.md

@@ -1,11 +1,6 @@
 ---
 name: llm-wiki
-description: >
-  Compile and maintain a Karpathy-pattern LLM wiki (raw + wiki + schema) with
-  init, incremental refresh, global rebuild, lint, and narrow ingest. Use when
-  the user wants a local knowledge wiki, incremental wiki refresh, wiki rebuild,
-  compiling a named research note into the wiki, `/llm-wiki`, or an answer from
-  an existing wiki.
+description: "Build or refresh a local LLM wiki; use for wiki init, ingest, rebuild, lint, or source-backed wiki questions."
 ---
 
 # llm-wiki