create-yss-spec 3.3.8 → 3.4.3

package/template/scripts/lib/decision-continuation.mjs

@@ -0,0 +1,79 @@
+import { decisionIO, decisionDigest, decisionError, assertUserDecisionRequirement } from './user-decision.mjs';
+
+export const CONTINUATION_CAPABILITY = 'approved-scope-continuation-v1';
+const fail = message => decisionError('user-decision-continuation-invalid', message);
+const strings = value => Array.isArray(value) && value.length > 0 && value.every(x => typeof x === 'string' && x.trim()) && new Set(value).size === value.length;
+const sameSet = (a, b) => strings(a) && strings(b) && a.length === b.length && a.every(x => b.includes(x));
+const basisFields = ['business_scope', 'acceptance', 'contract_commitments', 'authorization', 'risk_acceptance', 'quality', 'external_commitments'];
+
+// A continuation validates an explicit human mandate and an independent current
+// review. It never infers semantic equivalence from whitespace or a boolean flag.
+export function assertDecisionContinuation(requirement, roles, options = {}) {
+  const io = decisionIO(options);
+  const policy = roles.user_decision_policy.continuation;
+  if (policy?.capability !== CONTINUATION_CAPABILITY || !policy.boundaries.includes(requirement.boundary)) fail('未授权的延续边界');
+  const proof = io.document(requirement.continuation_ref);
+  if (proof.schema_version !== 1 || proof.kind !== CONTINUATION_CAPABILITY || proof.boundary !== requirement.boundary || proof.subject?.ref !== requirement.subject_ref || !sameSet(proof.scope, requirement.scope)) fail('当前边界、资产或范围不匹配');
+  const current = (asset, parse = true) => {
+    if (!asset?.ref || !asset.version || !asset.digest || decisionDigest(io.bytes(asset.ref)) !== asset.digest) fail(`当前证据缺失或过期: ${asset?.ref}`);
+    return parse ? io.document(asset.ref) : null;
+  };
+  if (!proof.source || proof.source.continuation_ref || proof.source.boundary !== 'delivery-scope') fail('必须引用原始交付范围批准，不能链式扩权');
+  const sourceResult = assertUserDecisionRequirement(proof.source, { ...options, rolesDoc: roles });
+  const mandate = io.document(proof.source.subject_ref);
+  if (mandate.schema_version !== 1 || mandate.kind !== 'delivery-authorization' || !Array.isArray(mandate.targets)) fail('缺少已展示并批准的交付授权清单');
+  if (!requirement.scope.every(x => proof.source.scope.includes(x))) fail('超出原始批准范围');
+  const matches = mandate.targets.filter(x => x.boundary === requirement.boundary && x.subject_ref === requirement.subject_ref && requirement.scope.every(s => x.scope?.includes(s)));
+  if (matches.length !== 1) fail('原授权未唯一覆盖当前边界、资产和范围');
+  const target = matches[0];
+  if (!basisFields.every(key => strings(target.decision_basis?.[key]))) fail('原授权缺少业务、验收、契约、授权、风险、质量或对外承诺依据');
+  if (!Array.isArray(mandate.basis) || !mandate.basis.length) fail('原授权缺少可读取的决定依据');
+  for (const asset of mandate.basis) {
+    if (!asset.ref || !asset.version || decisionDigest(io.bytes(asset.ref)) !== asset.digest) fail('原授权决定依据变化，须重新决定');
+  }
+  const external = current(mandate.external_policy);
+  if (external.status !== 'confirmed' || !Array.isArray(external.requirements)) fail('项目外部审批要求尚未确认，不能自动延续');
+  current(proof.subject, false);
+  if (requirement.boundary === 'implementation-scope') {
+    const manifest = io.document(proof.subject.ref);
+    if (manifest.kind !== 'implementation-scope' || !Array.isArray(manifest.slices)) fail('实施范围清单无效');
+    for (const ticket of requirement.scope) {
+      const slices = manifest.slices.filter(x => x.ticket_ref === ticket);
+      const limit = target.implementation_limits?.[ticket];
+      if (slices.length !== 1 || !limit || !sameSet(slices[0].repositories, limit.repositories) || !sameSet(slices[0].allowed_write_paths, limit.allowed_write_paths)) fail('实施仓库或写路径超出原授权边界');
+    }
+  }
+  if (!Array.isArray(proof.basis) || !proof.basis.length) fail('缺少本次实际验证证据');
+  for (const asset of proof.basis) {
+    if (!asset.ref || !asset.version || decisionDigest(io.bytes(asset.ref)) !== asset.digest) fail('本次验证证据过期');
+  }
+  const review = current(proof.review);
+  const actor = roles.roles.find(x => x.id === review.role_id);
+  if (!actor || !roles.runtimes.some(x => x.id === review.runtime_id) || !review.principal_ref || !review.drafter_principal_ref || review.principal_ref === review.drafter_principal_ref) fail('缺少独立专业审查身份');
+  const eligible = roles.gate_policy.continuation_reviews?.[requirement.boundary] || roles.gate_policy.dual_digital_human?.find(x => x.gate === requirement.boundary)?.countersigners;
+  if (!eligible?.includes(review.role_id)) fail('审查能力不覆盖当前边界');
+  if (review.decision !== 'approved' || !['within-approved-scope', 'presentation-only', 'implementation-detail'].includes(review.classification)) fail('未知或实质变化须重新决定');
+  if (!Array.isArray(review.material_changes) || review.material_changes.length || !Array.isArray(review.findings)) fail('存在实质变化或未完成影响分析');
+  for (const finding of review.findings) {
+    if (!finding.id || !finding.reason || !['requirement-violation', 'missing-evidence', 'important-risk', 'suggestion'].includes(finding.kind)) fail('审查发现未分类');
+    if (finding.kind === 'suggestion' && !finding.follow_up) fail('非阻断建议缺少待办去向');
+    if (finding.kind !== 'suggestion' && finding.status !== 'resolved') fail('未解决的缺陷、证据缺口或重要风险');
+  }
+  if (review.boundary !== requirement.boundary || !sameSet(review.scope, requirement.scope) || decisionDigest(review.subject) !== decisionDigest(proof.subject) || decisionDigest(review.basis) !== decisionDigest(proof.basis)) fail('审查未绑定当前资产、范围和验证证据');
+  if (decisionDigest(review.decision_basis) !== decisionDigest(target.decision_basis)) fail('决定依据有实质变化');
+  if (!review.reason?.trim() || !review.comparison?.before || !review.comparison?.after) fail('缺少可审阅的前后差异和等价性说明');
+  // Before is an immutable, originally approved snapshot; after is the current candidate.
+  const before = review.comparison.before;
+  if (!mandate.basis.some(x => decisionDigest(x) === decisionDigest(before)) || decisionDigest(review.comparison.after) !== decisionDigest(proof.subject)) fail('前后差异未绑定原授权快照和当前资产');
+  for (const obligation of external.requirements) {
+    if (!obligation.id || !strings(obligation.boundaries) || !strings(obligation.principals)) fail('外部审批制度记录不完整');
+    if (!obligation.boundaries.includes(requirement.boundary)) continue;
+    for (const principal of obligation.principals) {
+      const reply = proof.external_decisions?.find(x => x.obligation_id === obligation.id && x.principal_ref === principal);
+      if (!reply || reply.requirement?.continuation_ref || reply.requirement?.boundary !== requirement.boundary || reply.requirement?.subject_ref !== requirement.subject_ref || !sameSet(reply.requirement?.scope, requirement.scope)) fail('外部强制审批缺失或范围不符');
+      const result = assertUserDecisionRequirement(reply.requirement, { ...options, rolesDoc: roles });
+      if (!result.validated.length || result.validated.some(x => x.principal_ref !== principal)) fail('外部审批人与制度要求不符');
+    }
+  }
+  return { ...sourceResult, continued: true, review_ref: proof.review.ref };
+}

package/template/scripts/lib/delivery-preflight.mjs

@@ -1,3 +1,4 @@
+import { normalizeSliceContract, sourceSliceContract, parseSliceYaml } from './slice-contract.mjs';
 import { assertExistingSliceStructure, createApprovedExecutionContext, verifySliceContractApproval } from './approved-execution-context.mjs';
 import path from 'node:path';
 import { readFileSync, existsSync } from 'node:fs';
@@ -46,7 +47,7 @@ function requireBackendCapability(key) {
 }
 
 /** Read-only: never executes input commands, starts services, unpacks archives or writes receipts. */
-export async function preflightDelivery(input,{stage,root=process.cwd()}={}) {
+export async function preflightDelivery(input,{stage,root=process.cwd(),work_unit_id}={}) {
   try { ensure(STAGES.includes(stage),'未知阶段；必须是 prepare|build|export|accept');schema(input,'docs/process/schemas/delivery-preflight-input.schema.json'); }
   catch(error) { return invalidPreflightInput(error.message); }
   root=path.resolve(root,input.governance_root||'.');
@@ -78,7 +79,7 @@ export async function preflightDelivery(input,{stage,root=process.cwd()}={}) {
     if(input.architecture_identity.source_kind==='existing-registration')ensure(input.architecture_identity.repository_id===input.scope.repository_id&&input.architecture_identity.project_id===input.scope.project_id,'架构身份与预检目标仓库/项目不一致');
   },{source:'architecture_identity'});
   if(valid.has('architecture.identity'))await run('architecture.profile',()=>{ensure(architecture.validateArchitectureIdentity(input.architecture_identity).maturity==='supported','不支持未达到 supported 的 architecture_profile');},{source:'architecture_profile'});
-  if(['build','export','accept'].includes(stage)&&assets.slice_contract)await run('slice_contract.execution',()=>{requireBackendCapability('slice_contract');execution=createApprovedExecutionContext(assets.slice_contract,{root});},{from:'build',source:assets.slice_contract.approval_ref||'slice_contract',evidence:[assets.slice_contract.ref,...(assets.slice_contract.approval_ref?[assets.slice_contract.approval_ref]:[])]});
+  if(['build','export','accept'].includes(stage)&&assets.slice_contract)await run('slice_contract.execution',()=>{requireBackendCapability('slice_contract');execution=createApprovedExecutionContext(assets.slice_contract,{root,work_unit_id});},{from:'build',source:assets.slice_contract.approval_ref||'slice_contract',evidence:[assets.slice_contract.ref,...(assets.slice_contract.approval_ref?[assets.slice_contract.approval_ref]:[])]});
   const archDeps=['architecture.identity',...['repository_registration','engineering_baseline','manifest'].map(x=>`architecture.${x}`)];
   if(archDeps.every(x=>valid.has(x)))await run('architecture',()=>{
     ensure(typeof architecture.verifyArchitectureEvidence==='function','不支持既有工程原始证据验证，请同步支持该身份版本的模板运行时');
@@ -143,12 +144,12 @@ async function verifyAsset(key,data,binding,{root,input,documents,assets,executi
     await validateTechnicalDesign(data,{root,sliceRef:input.scope.slice_id,readOnly:true,execution});
     await approved(root,binding,['gate.engineering-contract-approved','gate.technical-design-approved']);
   } else if(key==='slice_contract') {
-    const contract=data.slice_contract||data;
+    const contract=normalizeSliceContract(data,{root});
     assertExistingSliceStructure(contract);
-    ensure(contract.schema_version===2&&contract.status==='approved'&&contract.slice_id===input.scope.slice_id,'Slice 合同版本、批准状态或切片不匹配');
+    ensure([2,3].includes(contract.schema_version)&&contract.status==='approved'&&contract.slice_id===input.scope.slice_id,'Slice 合同版本、批准状态或切片不匹配');
     ensure(binding.id===contract.contract_id&&binding.version===contract.contract_version,'Slice 合同身份与引用不一致');
     const compiler=read(safe(ROOT,'.agents/skills/yss-implementation-contract-compiler/references/compiler-contract.yaml'));
-    for(const [section,fields]of Object.entries(compiler.slice_contract_required))for(const field of fields)ensure(Object.hasOwn(section==='root'?contract:contract[section]||{},field),`合同缺少 ${section}.${field}`);
+    if(contract.schema_version===2)for(const [section,fields]of Object.entries(compiler.slice_contract_required))for(const field of fields)ensure(Object.hasOwn(section==='root'?contract:contract[section]||{},field),`合同缺少 ${section}.${field}`);
     ensure(contract.readiness.blockers.length===0&&contract.readiness.stale_inputs.length===0,'Slice 合同仍有 blocker 或 stale input');
     const resolution=contract.resolution;
     ensure(resolution.freshness==='current','Slice resolution 非 current');

package/template/scripts/lib/digital-human-roles.mjs

@@ -388,6 +388,16 @@ export function validateDigitalHumanRoles(doc, { skillIds, stageIds, gateIds, ar
   }
 
   const decisions = doc.user_decision_policy;
+  if (decisions?.continuation) {
+    const continuation = decisions.continuation;
+    if (continuation.capability !== 'approved-scope-continuation-v1' || continuation.source_boundary !== 'delivery-scope' || continuation.unknown_change !== 'blocked' || continuation.external_policy_unconfirmed !== 'no-automatic-continuation') fail('授权延续策略不能省略未知变化或外部制度保护');
+    requireStringArray(continuation.boundaries, 'continuation.boundaries');
+    for (const boundary of continuation.boundaries) {
+      if (!gateIds.has(boundary) && boundary !== 'implementation-scope') fail(`未支持的延续边界: ${boundary}`);
+      requireStringArray(policy.continuation_reviews?.[boundary], `${boundary}.continuation_reviews`);
+      for (const role of policy.continuation_reviews[boundary]) if (!actors.has(role)) fail(`未知延续审查角色: ${role}`);
+    }
+  }
   if (decisions?.schema_version !== 1 || decisions.default_responder !== "requester" || decisions.delegate_requires_requester_evidence !== true) fail("缺少统一用户决定策略");
   requireStringArray(decisions.gates, "user_decision_policy.gates");
   for (const gate of decisions.gates) if (!gateIds.has(gate)) fail(`用户决定引用未知门禁: ${gate}`);

package/template/scripts/lib/frontend-delivery-boundary.mjs

@@ -1,3 +1,4 @@
+import { normalizeSliceContract, sourceSliceContract, parseSliceYaml } from './slice-contract.mjs';
 import { loadDeliveryProfile } from './harness-execution-scope.mjs';
 import { existsSync } from 'node:fs';
 import path from 'node:path';
@@ -8,6 +9,7 @@ import { ROOT, read, safe, ensure, digest } from './strategic-handoff-io.mjs';
 // Always re-executes the verifier; a caller-supplied "verified" flag is never evidence.
 export function enforceFrontendDelivery(state={}, {root=ROOT,phase='inputs'}={}) {
   ensure(['preflight','design','contract','inputs','implementation','verification'].includes(phase),`未知前端交付阶段: ${phase}`);
+  if(state.schema_version===3)state=normalizeSliceContract(state,{root});
   const profile=loadDeliveryProfile(root);
   let contract;
   const contractRef=state.slice_contract_ref||state.contract?.slice_contract_ref;
@@ -35,6 +37,7 @@ export function enforceFrontendDelivery(state={}, {root=ROOT,phase='inputs'}={})
     const file=path.resolve(root,contractRef);
     if(existsSync(file)) {
       const document=read(file);contract=document.slice_contract||document;
+      if(contract.schema_version===3)contract=normalizeSliceContract(contract,{root});
       const direct=contract.frontend?.delivery, resolved=contract.resolution?.frontend_delivery;
       ensure(!direct||!resolved||digest(direct)===digest(resolved),'Slice Contract 前端交付绑定冲突');
       binding=direct||resolved||binding;

package/template/scripts/lib/implementation-contract-compiler.mjs

@@ -1,3 +1,6 @@
+import { resolveBackendPlatform } from "./backend-platform.mjs";
+import { safe } from './strategic-handoff-io.mjs';
+import { selectSliceWorkUnit, normalizeSliceContract, withinSlicePath } from './slice-contract.mjs';
 import { createApprovedExecutionContext, createApprovedRecompilationContext, assertApprovedExecutionContext } from './approved-execution-context.mjs';
 import { enforceTechnicalDesign } from './technical-design-boundary.mjs';
 import { enforceHarnessSkillScope } from "./harness-execution-scope.mjs";
@@ -67,13 +70,15 @@ export function compileImplementationContract({
   architecture_identity,
   architecture_evidence,
   approved_slice,
+  work_unit_id,
   root = ROOT,
   slice_id,
   frontend_delivery,
-  technical_design
+  technical_design,
+  readOnly = false
 }) {
   assertV2(registry, compilerContract);
-  const recompilationExecution=approved_slice?createApprovedRecompilationContext(approved_slice,{root}):undefined;
+  const recompilationExecution=approved_slice?createApprovedRecompilationContext(approved_slice,{root,work_unit_id}):undefined;
   const deliveryInput = enforceFrontendDelivery({ slice_id, frontend_delivery }, { root });
   if (!Array.isArray(recipeIds) || !Array.isArray(requiredCapabilities) || !Array.isArray(conditions)) {
     fail("recipeIds、requiredCapabilities 与 conditions 必须是数组");
@@ -96,7 +101,8 @@ export function compileImplementationContract({
     for (const recipe of orderedRecipes) if (recipe.architecture_family && recipe.architecture_family !== architecture_identity.architecture_family) fail(`Recipe ${recipe.id} 与架构族不匹配`);
   }
 
-  enforceTechnicalDesign({ technical_design, conditions, architecture_identity, slice_id }, { root, execution:recompilationExecution });
+  if (architecture_identity?.platform_configuration) resolveBackendPlatform(architecture_identity.platform_configuration);
+  enforceTechnicalDesign({ technical_design, conditions, architecture_identity, slice_id }, { root, execution:recompilationExecution, readOnly });
 
   const capabilitySources = new Map();
   const orderedCapabilities = [];
@@ -206,14 +212,17 @@ export function compileDefaultImplementationContract(input = {}) {
   });
 }
 
-export function evaluateContractFreshness(contract, { registry, compilerContract, root = ROOT, approved_slice, readOnly = false }, execution) {
+export function evaluateContractFreshness(contract, { registry, compilerContract, root = ROOT, approved_slice, readOnly = false, work_unit_id }, execution) {
   assertV2(registry, compilerContract);
-  if (contract?.schema_version !== 2) fail("Slice Implementation Contract schema v1 已停止支持；必须重新编译 v2 合同");
+  try { contract=normalizeSliceContract(contract,{root}); } catch(error) { return {freshness:'stale',reasons:[error.message]}; }
+  if (![2,3].includes(contract?.schema_version)) fail("Slice Implementation Contract schema v1 已停止支持；必须重新编译 v2 合同");
+  const all=contract;
+  try {contract=selectSliceWorkUnit(contract,work_unit_id);} catch(error){return {freshness:'stale',reasons:[error.message]};}
   const resolution = contract.resolution ?? contract;
   const reasons = [];
   let trustedExecution;
   try {
-    trustedExecution=approved_slice?createApprovedExecutionContext(approved_slice,{root,contract}):execution;
+    trustedExecution=approved_slice?createApprovedExecutionContext(approved_slice,{root,contract:all,work_unit_id}):execution;
     if(trustedExecution)assertApprovedExecutionContext(trustedExecution,{root,contract});
   } catch(error) { reasons.push(error.code||'EXECUTION_APPROVAL_INVALID');trustedExecution=undefined; }
   try { enforceTechnicalDesign({ ...resolution, slice_id: contract.slice_id ?? resolution.slice_id }, { root,execution:trustedExecution,readOnly }); }
@@ -236,11 +245,13 @@ export function evaluateContractFreshness(contract, { registry, compilerContract
 
 export function validateExecutionResult(result, contract, current) {
   if (result?.schema_version !== 2) fail("YSS Skill Execution Result schema v1 已停止支持；请迁移到 v2");
-  if (contract?.schema_version !== 2) fail("Slice Implementation Contract schema v1 已停止支持；必须重新编译 v2 合同");
+  contract=normalizeSliceContract(contract,{root:current?.root || ROOT});
+  if (![2,3].includes(contract?.schema_version)) fail("Slice Implementation Contract schema v1 已停止支持；必须重新编译 v2 合同");
   if (!EXECUTION_STATUSES.has(result.status)) fail(`未知 execution result status: ${result.status}`);
-  if(contract.resolution?.architecture_identity?.schema_version===2&&!current?.approved_slice)return {status:'stale',blockers:['EXECUTION_APPROVAL_REQUIRED']};
-  const freshness = evaluateContractFreshness(contract, current);
+  if((contract.schema_version===3||contract.resolution?.architecture_identity?.schema_version===2)&&!current?.approved_slice)return {status:'stale',blockers:['EXECUTION_APPROVAL_REQUIRED']};
+  const freshness = evaluateContractFreshness(contract, {...current,work_unit_id:result.work_unit_id});
   if (freshness.freshness === "stale") return { status: "stale", blockers: freshness.reasons };
+  contract=selectSliceWorkUnit(contract,result.work_unit_id);
   const consumed = result.consumed_contract ?? {};
   const resolution = contract.resolution ?? contract;
   const blockers = [];
@@ -253,6 +264,28 @@ export function validateExecutionResult(result, contract, current) {
     if (!item?.command || item.exit_code === undefined || !item.executed_at) blockers.push("verification-result-incomplete");
     else if (item.exit_code !== 0) blockers.push("verification-failed");
   }
+  if(contract.schema_version===3) {
+    const unit=contract.work_units.find(item=>item.id===result.work_unit_id);
+    if(!unit)blockers.push('work-unit-mismatch');
+    else {
+      const checks=unit.work_unit.verification;
+      for(const check of checks)if(!result.verification_results?.some(item=>item.command===check.command&&item.exit_code===0&&item.cwd===check.cwd&&(!check.dependency_roots||JSON.stringify(item.dependency_roots)===JSON.stringify(check.dependency_roots))))blockers.push('verification-coverage-or-cwd-missing');
+      if(!Array.isArray(result.changed_files))blockers.push('changed-files-missing');
+      else for(const item of result.changed_files) {
+        const changed=typeof item==='string'?item:item.path;
+        if(contract.repositories&&(typeof item==='string'||item.project_root!==unit.project_root))blockers.push('changed-file-repository-mismatch');
+        if(!unit.allowed_write_paths.some(parent=>withinSlicePath(changed,parent)))blockers.push('write-scope-violation');
+      }
+      const evidence=result.evidence_files||[];
+      for(const ref of unit.work_unit.expected_evidence) {
+        if(!evidence.some(item=>(typeof item==='string'?item:item.path)===ref&&(!contract.repositories||item.project_root===unit.project_root)))blockers.push('expected-evidence-missing');
+        else {try {readFileSync(safe(contract.repositories?unit.project_root:(current.root||ROOT),ref));}catch {blockers.push('expected-evidence-unreadable');}}
+      }
+    }
+    if(['drift','violation'].includes(result.status))blockers.push(result.status);
+    if(result.status==='not-applicable'&&!result.not_applicable_reason?.trim())blockers.push('not-applicable-reason-missing');
+    if(result.status==='seam-deferred'&&(!result.seam_deferred?.length||result.seam_deferred.some(item=>['risk','owner','follow_up_ticket','verification_plan','target_version_or_release_date'].some(key=>!item[key]))))blockers.push('seam-deferred-incomplete');
+  }
   if (Array.isArray(result.new_impacts) && result.new_impacts.length) blockers.push("new-impacts");
   return { status: blockers.length ? "blocked" : "accepted", blockers: [...new Set(blockers)] };
 }

package/template/scripts/lib/legacy-backend-scaffold-audit.mjs

@@ -0,0 +1,87 @@
+import { createHash } from "node:crypto";
+import { lstat, readFile, readdir } from "node:fs/promises";
+import path from "node:path";
+
+const sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const normalizedDigest = (value) => String(value ?? "").replace(/^sha256:/, "");
+
+async function collectFiles(root) {
+  const files = [];
+  async function visit(directory) {
+    for (const entry of (await readdir(directory, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
+      if ([".git", "target", "node_modules"].includes(entry.name)) continue;
+      const target = path.join(directory, entry.name);
+      const relative = path.relative(root, target).split(path.sep).join("/");
+      if (entry.isDirectory()) await visit(target);
+      else files.push({ relative, target, symlink: entry.isSymbolicLink() });
+    }
+  }
+  await visit(root);
+  return files;
+}
+
+function isBusinessFile(relative, manifest) {
+  if (relative === manifest.bootstrap_main_source || /(^|\/)package-info\.java$/.test(relative)) return false;
+  return /(^|\/)src\/(main|test)\/java\/.+\.java$/.test(relative)
+    || /(^|\/)src\/main\/resources\/.+\.(sql|xml|ya?ml|properties)$/.test(relative)
+    || /(^|\/)(db|mapper|repository|controller|domain)(\/|$)/i.test(relative)
+    || /(^|\/)(Controller|Repository|Mapper|Aggregate|Entity)\.java$/i.test(relative);
+}
+
+export async function auditLegacyBackendScaffold(projectRoot, { manifestRef = ".yss/scaffold-generation.json" } = {}) {
+  const root = path.resolve(projectRoot);
+  const manifestFile = path.resolve(root, manifestRef);
+  const relativeManifest = path.relative(root, manifestFile);
+  if (relativeManifest.startsWith("..") || path.isAbsolute(relativeManifest)) throw new TypeError("Manifest 必须位于项目根内");
+  const manifestBytes = await readFile(manifestFile).catch(() => { throw new TypeError(`Manifest 不可读取: ${manifestRef}`); });
+  let manifest;
+  try { manifest = JSON.parse(manifestBytes); } catch { throw new TypeError("Manifest 必须是 JSON 对象"); }
+  if (manifest?.schema_version !== 3) throw new TypeError("恢复审计只接受历史 v3 Manifest");
+  if (!Array.isArray(manifest?.ownership?.generated_files)) throw new TypeError("历史 v3 Manifest 缺少 ownership.generated_files");
+
+  const generated = new Map(manifest.ownership.generated_files.map((entry) => [entry.path, entry]));
+  const generatedFileDrift = [];
+  for (const [relative, entry] of generated) {
+    const target = path.resolve(root, relative);
+    const inside = path.relative(root, target);
+    if (inside.startsWith("..") || path.isAbsolute(inside)) {
+      generatedFileDrift.push({ path: relative, reason: "path-outside-project" });
+      continue;
+    }
+    try {
+      const info = await lstat(target);
+      if (!info.isFile()) generatedFileDrift.push({ path: relative, reason: "not-a-regular-file" });
+      else {
+        const actual = sha256(await readFile(target));
+        if (actual !== normalizedDigest(entry.sha256)) generatedFileDrift.push({ path: relative, reason: "digest-drift", expected: normalizedDigest(entry.sha256), actual });
+      }
+    } catch (error) {
+      if (error.code === "ENOENT") generatedFileDrift.push({ path: relative, reason: "missing" });
+      else throw error;
+    }
+  }
+
+  const files = await collectFiles(root);
+  const unownedFiles = files.map((entry) => entry.relative).filter((relative) => relative !== manifestRef && !generated.has(relative));
+  const businessFiles = files
+    .filter((entry) => entry.symlink || (unownedFiles.includes(entry.relative) && isBusinessFile(entry.relative, manifest)))
+    .map((entry) => entry.relative);
+  const premature = businessFiles.length > 0;
+  const state = premature ? "premature-implementation-detected" : generatedFileDrift.length > 0 ? "generated-file-drift" : "unchanged-mechanical-scaffold";
+  return {
+    schema_version: 1,
+    kind: "legacy-backend-scaffold-ownership-audit",
+    status: state === "unchanged-mechanical-scaffold" ? "reconcilable" : "blocked",
+    manifest_ref: manifestRef,
+    manifest_digest: `sha256:${sha256(manifestBytes)}`,
+    manifest_schema_version: 3,
+    ownership_state: state,
+    premature_implementation: premature,
+    generated_file_drift: generatedFileDrift,
+    business_files: businessFiles,
+    unowned_files: unownedFiles,
+    recovery_requirements: state === "unchanged-mechanical-scaffold"
+      ? ["approved-current-technical-design", "data-architecture-decision", "gate.engineering-contract-approved", "recovery-approval"]
+      : ["preserve-all-files", "design-reconciliation", "difference-review", "current-user-approval"],
+  };
+}

package/template/scripts/lib/legacy-backend-scaffold-audit.test.mjs

@@ -0,0 +1,64 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { auditLegacyBackendScaffold } from "./legacy-backend-scaffold-audit.mjs";
+
+const rawDigest = (value) => createHash("sha256").update(value).digest("hex");
+
+async function fixture(t) {
+  const root = await mkdtemp(path.join(os.tmpdir(), "legacy-scaffold-audit-"));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  const generated = "package com.yss.demo;\n";
+  const source = "demo-service-server/src/main/java/com/yss/demo/package-info.java";
+  await mkdir(path.join(root, path.dirname(source)), { recursive: true });
+  await writeFile(path.join(root, source), generated);
+  const manifest = {
+    schema_version: 3,
+    kind: "backend-scaffold",
+    completion_level: "empty-scaffold-verified",
+    ownership: { generated_files: [{ path: source, owner: "generator", sha256: rawDigest(generated) }] },
+  };
+  await mkdir(path.join(root, ".yss"));
+  await writeFile(path.join(root, ".yss/scaffold-generation.json"), `${JSON.stringify(manifest, null, 2)}\n`);
+  return { root, source };
+}
+
+test("未修改的历史 v3 机械骨架可进入恢复对账但不会自动批准", async (t) => {
+  const data = await fixture(t);
+  const result = await auditLegacyBackendScaffold(data.root);
+  assert.equal(result.status, "reconcilable");
+  assert.equal(result.ownership_state, "unchanged-mechanical-scaffold");
+  assert.equal(result.premature_implementation, false);
+  assert.deepEqual(result.generated_file_drift, []);
+});
+
+test("额外业务代码保留并标记 premature-implementation-detected", async (t) => {
+  const data = await fixture(t);
+  const controller = "demo-service-server/src/main/java/com/yss/demo/controller/DemoController.java";
+  await mkdir(path.join(data.root, path.dirname(controller)), { recursive: true });
+  await writeFile(path.join(data.root, controller), "class DemoController {}\n");
+  const result = await auditLegacyBackendScaffold(data.root);
+  assert.equal(result.status, "blocked");
+  assert.equal(result.ownership_state, "premature-implementation-detected");
+  assert.equal(result.premature_implementation, true);
+  assert.deepEqual(result.business_files, [controller]);
+});
+
+test("历史生成文件摘要漂移时保持 blocked", async (t) => {
+  const data = await fixture(t);
+  await writeFile(path.join(data.root, data.source), "changed\n");
+  const result = await auditLegacyBackendScaffold(data.root);
+  assert.equal(result.status, "blocked");
+  assert.equal(result.ownership_state, "generated-file-drift");
+  assert.equal(result.generated_file_drift[0].path, data.source);
+});
+
+test("审计器拒绝将 v4 当作历史恢复输入", async (t) => {
+  const data = await fixture(t);
+  const manifestFile = path.join(data.root, ".yss/scaffold-generation.json");
+  await writeFile(manifestFile, JSON.stringify({ schema_version: 4, ownership: { generated_files: [] } }));
+  await assert.rejects(() => auditLegacyBackendScaffold(data.root), /历史 v3/);
+});

package/template/scripts/lib/lifecycle-controls.mjs

@@ -46,7 +46,7 @@ export function assertGateChecks(gateId, state, { root = ROOT, registry = loadRe
     const rule = countersignRuleForGate(rolesDoc.gate_policy, id);
     if (rule) {
       if (!refs.has(item.approval_ref) || !refs.has(item.subject_ref)) fail(`${id} 未绑定审查与资产`);
-      const record = loadApprovalRecord(path.resolve(root, item.approval_ref));
+      const record = loadApprovalRecord(path.resolve(root, item.approval_ref), id);
       if (record.gate_id !== id || record.subject_ref !== item.subject_ref) fail(`${id} 审查对象不匹配`);
       if (!item.approval_scope?.length || JSON.stringify([...item.approval_scope].sort()) !== JSON.stringify([...(record.approval_scope || [])].sort())) fail(`${id} 审查范围不匹配`);
       const subjectDigest = createHash('sha256').update(readFileSync(path.resolve(root, item.subject_ref))).digest('hex');
@@ -65,7 +65,7 @@ export function assertGateChecks(gateId, state, { root = ROOT, registry = loadRe
   const approvalRequired = countersignRuleForGate(rolesDoc.gate_policy, gateId);
   if (approvalRequired) {
     if (!refs.has(item.approval_ref) || !refs.has(item.subject_ref)) fail(`${gateId} 缺少已绑定批准记录和审阅包`);
-    const record = loadApprovalRecord(path.resolve(root, item.approval_ref));
+    const record = loadApprovalRecord(path.resolve(root, item.approval_ref), gateId);
     if (!record.drafter_principal_ref || record.drafter_principal_ref === record.principal_ref) fail(`${gateId} 缺少独立审查身份或起草者自签`);
     const bytes = readFileSync(path.resolve(root, item.subject_ref));
     if (record.subject_ref !== item.subject_ref || record.subject_digest !== createHash('sha256').update(bytes).digest('hex')) fail(`${gateId} 批准依据过期`);