create-yss-spec 3.4.1 → 3.4.3

package/template/scripts/lib/slice-task-package.mjs

@@ -0,0 +1,66 @@
+import {enforceHarnessTaskScope} from './harness-execution-scope.mjs';
+import { readFileSync } from 'node:fs';
+import { ROOT, hash, safe, digest } from './strategic-handoff-io.mjs';
+import { normalizeSliceContract, withinSlicePath, parseSliceYaml } from './slice-contract.mjs';
+import { createApprovedExecutionContext, assertApprovedExecutionContext } from './approved-execution-context.mjs';
+import { assertImplementationDecision } from './user-decision.mjs';
+import { taskPackageDefaults, loadDigitalHumanRoles } from './digital-human-roles.mjs';
+import { validateTaskPackageSchema } from './task-package-schema.mjs';
+const fail=message=>{throw new TypeError(message);};
+const equalArrays=(a,b)=>Array.isArray(a)&&a.length===b.length&&a.every((x,i)=>x===b[i]);
+function generateTaskPackageDefaults(roleId,overrides,{rolesDoc}={}) {
+  const defaults=taskPackageDefaults(roleId,rolesDoc||loadDigitalHumanRoles());
+  return {schema_version:1,role_id:roleId,skill_source:{registry_ref:'docs/agents/digital-human-roles.yaml',defaults_ref:`taskPackageDefaults(${roleId})`,core_skills:defaults.core_skills,forbidden_skills:defaults.forbidden_skills},...overrides};
+}
+
+/** Compile dispatch from the approved YAML. Only runtime identity and task ID come from the caller. */
+export function compileSliceTaskPackage(binding,{root=ROOT,work_unit_id,task_id,actor_id,runtime_id,execution_state='Worker',rolesDoc,user_decisions}={}) {
+  const actualRoles=parseSliceYaml(readFileSync(safe(root,'docs/agents/digital-human-roles.yaml')));
+  if(rolesDoc&&digest(rolesDoc)!==digest(actualRoles))fail('调用方不能替换接收端角色能力');
+  rolesDoc=actualRoles;
+  if(!actualRoles.runtimes.some(runtime=>runtime.id===runtime_id))fail('接收端不支持该 runtime_id');
+  const execution=createApprovedExecutionContext(binding,{root,work_unit_id});
+  const {contract}=assertApprovedExecutionContext(execution,{root});
+  if(contract.schema_version!==3)fail('v3 派发编译入口只接受 v3；v2 保留原派发路径');
+  const unit=contract.work_units.find(item=>item.id===work_unit_id);
+  if(!unit)fail('未找到指定 Slice 工作单元');
+  const checkpoint=readSliceDispatchApproval(root,binding.approval_ref);
+  const decisions=user_decisions||checkpoint.human_review?.user_decisions;
+  const output=generateTaskPackageDefaults(unit.role_id,{
+    task_id,work_unit_id,actor_id,runtime_id,execution_state,workflow_status:'not-started',stage_id:'stage.vertical-slice-implementation',
+    contract:{kind:'slice-implementation',contract_id:contract.contract_id,contract_version:contract.contract_version,status:'issued',contract_ref:binding.ref,slice_contract_ref:binding.ref,gate_refs:[binding.approval_ref]},
+    inputs:[binding.ref,...new Set(Object.values(contract.lifecycle_refs))],
+    objective:`${unit.behavior}（执行目录：${unit.project_root}；完整约束读取 ${binding.ref}）`,
+    allowed_write_paths:unit.allowed_write_paths,forbidden_actions:[...unit.work_unit.forbidden_patterns,'来源过期、越界、缺证据、验证失败或新增影响时停止并回交'],
+    expected_outputs:[unit.behavior],expected_evidence_files:unit.work_unit.expected_evidence,verification_commands:unit.work_unit.verification_commands,verification_results:[],
+    downstream_consumers:unit.downstream_consumers||['role.lifecycle-orchestrator'],convergence:{parent_work_unit:'work-unit.slice-implementation',convergence_ref:unit.convergence_ref||binding.approval_ref,conflict_escalation:'返回生命周期主控'},user_decisions:decisions
+  },{rolesDoc});
+  enforceHarnessTaskScope(output,{root});
+  validateTaskPackageSchema(output);
+  assertSliceV3TaskPackage(output,contract,{root});
+  return output;
+}
+function readSliceDispatchApproval(root,ref) {return parseSliceYaml(readFileSync(safe(root,ref)));}
+export function assertSliceV3TaskPackage(value,slice,{root=ROOT}={}) {
+  enforceHarnessTaskScope(value,{root});
+  const contract=value.contract;
+  const current=normalizeSliceContract(slice,{root});
+  const roles=parseSliceYaml(readFileSync(safe(root,'docs/agents/digital-human-roles.yaml'))),defaults=taskPackageDefaults(value.role_id,roles);
+  if(!roles.runtimes.some(runtime=>runtime.id===value.runtime_id)||!defaults.stages.includes(value.stage_id))fail('接收端角色或运行时不支持当前任务');
+  if(!equalArrays(value.skill_source.core_skills,defaults.core_skills)||!equalArrays(value.skill_source.forbidden_skills,defaults.forbidden_skills))fail('任务角色能力与接收端不一致');
+  const unit=current.work_units.find(item=>item.id===value.work_unit_id);
+  if(unit&&[unit.primary_skill,...(unit.supporting_skills||[])].some(skill=>defaults.forbidden_skills.includes(skill)))fail('工作单元使用接收角色禁用 Skill');
+  if(!unit||unit.role_id!==value.role_id||current.contract_id!==contract.contract_id||current.contract_version!==contract.contract_version)fail('任务身份与 Slice v3 不一致');
+  if(!Array.isArray(contract.gate_refs)||contract.gate_refs.length!==1)fail('Slice v3 派发需要唯一批准 checkpoint 引用');
+  const bytes=readFileSync(safe(root,contract.slice_contract_ref));
+  const execution=createApprovedExecutionContext({ref:contract.slice_contract_ref,digest:hash(bytes),id:current.contract_id,version:current.contract_version,approval_ref:contract.gate_refs[0]},{root,work_unit_id:value.work_unit_id});
+  assertApprovedExecutionContext(execution,{root,contract:current});
+  for(const allowed of value.allowed_write_paths)if(!unit.allowed_write_paths.some(parent=>withinSlicePath(allowed,parent)))fail('任务写范围超出 Slice v3');
+  for(const key of ['verification_commands','expected_evidence_files']) {
+    const required=key==='verification_commands'?unit.work_unit.verification_commands:unit.work_unit.expected_evidence;
+    if(!equalArrays(value[key],required))fail(`任务包遗漏或替换 Slice v3 ${key}`);
+  }
+  for(const item of unit.work_unit.forbidden_patterns)if(!value.forbidden_actions.includes(item))fail('任务包遗漏全局约束');
+  if(value.execution_state==='Worker')assertImplementationDecision({slice_contract_ref:contract.slice_contract_ref,vertical_slice_ticket_ref:current.lifecycle_refs.ticket,user_decisions:value.user_decisions},{root});
+  return value;
+}

package/template/scripts/lib/strategic-handoff.mjs

@@ -75,6 +75,17 @@ export async function sourceApproval(record, roles, root) {
     const { assertApprovalUserDecision } = await import('./user-decision-reuse.mjs');
     assertApprovalUserDecision(record, roles, options);
   }
+  // Older dedicated receivers retain their own lifecycle policy. Normalize only
+  // this already-verified source approval, without granting local capabilities.
+  if (record.continuation_ref) {
+    ensure(roles.user_decision_policy.gates.includes(record.gate_id), '未登记的源延续批准边界');
+    const reviewers = roles.gate_policy.continuation_reviews?.[record.gate_id];
+    ensure(reviewers?.includes(record.role_id) && record.drafter_principal_ref && record.drafter_principal_ref !== record.principal_ref, '源授权延续缺少独立审查身份');
+    options.rolesDoc = structuredClone(roles);
+    const policy = options.rolesDoc.gate_policy;
+    policy.dual_digital_human = (policy.dual_digital_human || []).filter(x => x.gate !== record.gate_id);
+    policy.digital_human_review = [...(policy.digital_human_review || []).filter(x => x.gate !== record.gate_id), { gate: record.gate_id, countersigners: reviewers }];
+  }
   validateApprovalRecord(record,options);
 }
 
@@ -217,7 +228,7 @@ function collect(root, handoffRef, handoff, config) {
   const enqueue=ref=> { if(symbolic[ref])queue.push(symbolic[ref]); else if(/^https?:\/\//i.test(ref))return; else if(ref.startsWith('evidence.'))throw new TypeError(`未解析 evidence ID: ${ref}`); else if(ref.includes('/') || /\.(?:md|yaml|json|html|png|txt|log)$/.test(ref))queue.push(ref); };
   function refs(value,key='') {
     if(Array.isArray(value)) { if(key==='evidence_refs') value.forEach(enqueue); else value.forEach(v=>refs(v,key)); }
-    else if(value && typeof value==='object') for(const [k,v]of Object.entries(value)) { if(['approval_ref','persisted_ref','user_decision_ref','decision_reuse_ref','scope_ref','subject_ref','delivery_ref'].includes(k)&&typeof v==='string')enqueue(v); else if(k==='ref'&&typeof v==='string'&&!/^[a-z]+:\/\//i.test(v))enqueue(v); else refs(v,k); }
+    else if(value && typeof value==='object') for(const [k,v]of Object.entries(value)) { if(['approval_ref','persisted_ref','user_decision_ref','decision_reuse_ref','continuation_ref','plan_continuation_ref','scope_ref','subject_ref','delivery_ref'].includes(k)&&typeof v==='string')enqueue(v); else if(k==='ref'&&typeof v==='string'&&!/^[a-z]+:\/\//i.test(v))enqueue(v); else refs(v,k); }
   }
   let totalBytes = 0;
   while(queue.length) {

package/template/scripts/lib/task-package.mjs

@@ -1,3 +1,6 @@
+import { normalizeSliceContract } from './slice-contract.mjs';
+import { assertSliceV3TaskPackage } from './slice-task-package.mjs';
+export { compileSliceTaskPackage, assertSliceV3TaskPackage } from './slice-task-package.mjs';
 import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { parseDocument } from "../vendor/yaml.mjs";
@@ -178,11 +181,12 @@ function validateContract(value, registry, lifecycle) {
   const contractPath = assertSafeRelativePath(contract.slice_contract_ref, "contract.slice_contract_ref");
   if (!existsSync(contractPath)) fail(`Slice Implementation Contract 不存在: ${contract.slice_contract_ref}`);
   const document = parseYaml(readFileSync(contractPath, "utf8"), "Slice Implementation Contract");
-  const slice = document.slice_contract || document;
-  if (slice.schema_version !== 2 || typeof slice.slice_id !== "string" || !slice.lifecycle_refs || !slice.readiness || !Array.isArray(slice.work_units)) fail("Slice Implementation Contract 需要 schema v2 及 slice_id/lifecycle_refs/readiness/work_units");
+  const slice = normalizeSliceContract(document,{root:ROOT});
+  if (![2,3].includes(slice.schema_version) || typeof slice.slice_id !== "string" || !slice.lifecycle_refs || !slice.readiness || !Array.isArray(slice.work_units)) fail("Slice Implementation Contract 需要 schema v2 及 slice_id/lifecycle_refs/readiness/work_units");
   if (slice.contract_id !== contract.contract_id || slice.contract_version !== contract.contract_version || slice.status !== "approved") fail("Slice Contract 必须是当前 approved 版本");
   const sliceUnit = slice.work_units.find((item) => item && item.id === value.work_unit_id);
   if (!sliceUnit) fail(`Slice Implementation Contract 缺少 work_unit_id: ${value.work_unit_id}`);
+  if(slice.schema_version===3)return assertSliceV3TaskPackage(value,slice,{root:ROOT});
   for (const field of ["role_id", "runtime_id", "task_package_ref", "contract_id", "contract_version", "allowed_write_paths"]) if (sliceUnit[field] === undefined) fail(`Slice Contract work_unit 缺少 ${field}`);
   if (sliceUnit.role_id !== value.role_id || sliceUnit.runtime_id !== value.runtime_id || sliceUnit.contract_id !== contract.contract_id || sliceUnit.contract_version !== contract.contract_version) fail("任务包与 Slice Contract work_unit 不一致");
   for (const allowed of value.allowed_write_paths) if (!sliceUnit.allowed_write_paths.includes(allowed)) fail(`allowed_write_paths 未获 Slice Contract 授权: ${allowed}`);

package/template/scripts/lib/technical-design-boundary.mjs

@@ -24,6 +24,7 @@ export function enforceTechnicalDesign(state = {}, { root = ROOT, execution, rea
   if(execution){
     assertApprovedExecutionContext(execution,{root,technicalDesign:data,architectureIdentity:state.architecture_identity,sliceId:state.slice_id});
     const approved=approvedExecutionBinding(execution);
+    if(approved.work_unit_id)args.push('--work-unit',approved.work_unit_id);
     args.push('--approved-slice',approved.ref,'--approved-slice-digest',approved.digest,'--approved-slice-approval',approved.approval_ref);
   }
   const verified = spawnSync(process.execPath, args, { cwd: root, encoding: 'utf8', timeout: 60000, maxBuffer: 2 * 1024 * 1024 });

package/template/scripts/lib/user-decision-reuse.mjs

@@ -8,6 +8,7 @@ const sameSet = (a,b) => Array.isArray(a) && Array.isArray(b) && a.length === ne
 export function assertApprovalUserDecision(record, roles, options = {}) {
   const policy = roles.user_decision_policy;
   const io = decisionIO(options);
+  if (record.continuation_ref) return assertUserDecisionRequirement({boundary:record.gate_id,subject_ref:record.subject_ref,scope:record.approval_scope,continuation_ref:record.continuation_ref}, {...options,rolesDoc:roles});
   if (policy.required_capabilities?.some(id => id !== DECISION_REUSE_CAPABILITY)) fail('接收工具不支持源用户决定策略，请升级');
   if (!record.decision_reuse_ref) return assertUserDecisionRequirement({boundary:record.gate_id,subject_ref:record.subject_ref,scope:record.approval_scope,user_decision_ref:record.user_decision_ref}, {...options,rolesDoc:roles});
   if (record.gate_id !== 'gate.strategic-design-handoff-approved' || !policy.required_capabilities?.includes(DECISION_REUSE_CAPABILITY)) fail('未登记的复用边界或能力');

package/template/scripts/lib/user-decision.mjs

@@ -1,3 +1,4 @@
+import { normalizeSliceContract } from './slice-contract.mjs';
 import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import path from "node:path";
@@ -5,6 +6,7 @@ import { parseDocument } from "../vendor/yaml.mjs";
 import { ROOT } from "./lifecycle-registry.mjs";
 import { loadDigitalHumanRoles } from "./digital-human-roles.mjs";
 import { validateJsonSchema } from "./json-schema.mjs";
+import { assertDecisionContinuation } from './decision-continuation.mjs';
 
 export function decisionError(code, detail) {
   const error = new TypeError(`${code}: ${detail}`);
@@ -161,6 +163,7 @@ export function verifyUserDecisionFile(ref, options = {}) {
 
 export function assertUserDecisionRequirement(requirement, options = {}) {
   if (!requirement) decisionError("user-decision-response-required", "缺少当前决定及其范围");
+  if (requirement.continuation_ref) return assertDecisionContinuation(requirement, options.rolesDoc || loadDigitalHumanRoles(), options);
   return verifyUserDecisionFile(requirement.user_decision_ref, { ...options, expected: [requirement] });
 }
 
@@ -191,7 +194,7 @@ export function assertImplementationDecision(state, options = {}) {
   if (state.slice_contract_ref !== slice.contract?.ref) decisionError("user-decision-subject-mismatch", "当前合同不在批准清单中");
   checkAsset(slice.contract, io);
   const content = io.document(slice.contract.ref);
-  const contract = content.slice_contract || content;
+  const contract = content.slice_contract?.schema_version === 3 || content.schema_version === 3 ? normalizeSliceContract(content, { root: options.root || ROOT }) : content.slice_contract || content;
   if (contract.lifecycle_refs?.ticket !== ticketRef) decisionError("user-decision-subject-mismatch", "持久化合同的切片引用不匹配");
   for (const [manifestKey, contractKey] of [["repositories", "project_roots"], ["allowed_write_paths", "allowed_write_paths"]]) {
     if (!Array.isArray(slice[manifestKey]) || slice[manifestKey].length === 0 || JSON.stringify([...slice[manifestKey]].sort()) !== JSON.stringify([...(contract.common?.[contractKey] || [])].sort())) decisionError("user-decision-scope-mismatch", manifestKey);

package/template/scripts/preflight-delivery

@@ -6,9 +6,9 @@ import { preflightDelivery, invalidPreflightInput } from './lib/delivery-preflig
 
 let result;
 try {
-  const {values}=parseArgs({options:{input:{type:'string'},stage:{type:'string'},json:{type:'boolean'}},strict:true});
+  const {values}=parseArgs({options:{input:{type:'string'},stage:{type:'string'},'work-unit':{type:'string'},json:{type:'boolean'}},strict:true});
   if(!values.input||!values.stage) throw new TypeError('必须提供 --input <file> 和 --stage prepare|build|export|accept');
-  result=await preflightDelivery(read(path.resolve(values.input)),{stage:values.stage,root:process.cwd()});
+  result=await preflightDelivery(read(path.resolve(values.input)),{stage:values.stage,root:process.cwd(),work_unit_id:values['work-unit']});
 } catch(error) { result=invalidPreflightInput(error.message); }
 process.stdout.write(`${JSON.stringify(result,null,2)}\n`);
 process.exitCode=result.exit_code;

package/template/scripts/slice-contract

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { prepareSliceImplementationContract, migrateSliceContractV2, persistSliceDraft } from './lib/slice-contract-preparation.mjs';
+import { renderSliceContractView, diffSliceContracts } from './lib/slice-contract-views.mjs';
+import { parseSliceYaml, readSliceContract } from './lib/slice-contract.mjs';
+
+try {
+  const args=process.argv.slice(2),mode=args.shift(),options={},positional=[];
+  for(let i=0;i<args.length;i++) {
+    if(args[i]==='--json'){options.json=true;continue;}
+    if(args[i].startsWith('--')) {
+      const key=args[i].slice(2);if(!['root','input','output','unit','before-root'].includes(key)||!args[i+1])throw new Error(`未知或缺值参数 ${args[i]}`);
+      options[key]=args[++i];
+    }else positional.push(args[i]);
+  }
+  const root=path.resolve(options.root||process.cwd());
+  let result;
+  if(mode==='prepare'||mode==='migrate') {
+    const input=options.input?parseSliceYaml(fs.readFileSync(path.resolve(root,options.input))):{};
+    if(mode==='prepare')result=prepareSliceImplementationContract({...input,root,ticket_ref:positional[0]});
+    else result=migrateSliceContractV2(readSliceContract(positional[0],{root}).raw,{...input,root});
+    if(options.output)persistSliceDraft(result,options.output,{root});
+    if(result.report.blockers.length)process.exitCode=1;
+  }else if(mode==='view')result=renderSliceContractView(positional[0],{root,unit_id:options.unit});
+  else if(mode==='diff')result=diffSliceContracts(positional[0],positional[1],{root,beforeRoot:options['before-root']?path.resolve(options['before-root']):root});
+  else if(mode==='verify')result={read_only:true,approval_validity:'not-checked',...readSliceContract(positional[0],{root}).binding};
+  else throw new Error('用法: scripts/slice-contract prepare <ticket> --input <补充.yaml> --output <新合同.yaml> | migrate <v2.yaml> --input <补充.yaml> --output <新合同.yaml> | view <合同.yaml> [--unit <id>] | diff <旧合同> <新合同> | verify <合同> [--root <项目根>]');
+  process.stdout.write(options.json||!result.markdown?`${JSON.stringify(result,null,2)}\n`:`${result.markdown}\n`);
+}catch(error){process.stderr.write(`${error.message}\n`);process.exitCode=1;}

package/template/scripts/verify-backend-platform-matrix

@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+// Maintenance-only candidate verification. Never updates the supported catalog or approvals.
+import { assertResumableCandidate } from "./lib/backend-platform-provenance.mjs";
+import { readFile, mkdir, writeFile } from "node:fs/promises";
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+import { parseArgs } from "node:util";
+import { loadBackendPlatforms, assertJavaPlatform, platformDigest } from "./lib/backend-platform.mjs";
+import { ScaffoldGenerator, parseArgs as dddArgs } from "../.agents/skills/yss-ddd-scaffold-generator/scripts/generate_scaffold.mjs";
+import { generate, validateContract as validateMvcContract, parseArgs as mvcArgs } from "../.agents/skills/yss-layered-mvc-scaffold-generator/scripts/generate_scaffold.mjs";
+import { run } from "../.agents/skills/yss-ddd-scaffold-generator/scripts/run_scaffold_verification.mjs";
+
+const { values } = parseArgs({ options: { "evidence-dir": { type: "string" }, inputs: { type: "string" }, resume: { type: "boolean", default: false } }, strict: true });
+if (!values["evidence-dir"]) throw new Error("--evidence-dir is required; optional --inputs points to real approved contracts and candidate catalog");
+const evidence = path.resolve(values["evidence-dir"]);
+await mkdir(evidence, { recursive: true });
+const input = values.inputs ? JSON.parse(await readFile(path.resolve(values.inputs), "utf8")) : {};
+const inputRoot = values.inputs ? path.dirname(path.resolve(values.inputs)) : process.cwd();
+const catalog = input.catalog_ref ? JSON.parse(await readFile(path.resolve(inputRoot, input.catalog_ref), "utf8")) : loadBackendPlatforms();
+if (catalog.schema_version !== 1 || catalog.kind !== "backend-platform-catalog" || !Array.isArray(catalog.compatibility) || platformDigest(catalog.profiles) !== platformDigest(loadBackendPlatforms().profiles)) throw new Error("candidate input must preserve the maintained platform profiles; only supply actual YSS combinations");
+const keys = new Set();
+for (const item of input.combinations ?? []) {
+  const key = `${item.profile_id}:${item.spring_boot_version}:${item.architecture_family}`;
+  if (keys.has(key) || !catalog.profiles.some(p => p.id === item.profile_id && p.spring_boot_version === item.spring_boot_version) || !["domain-driven", "layered-mvc"].includes(item.architecture_family)) throw new Error("duplicate or unknown exact matrix combination");
+  keys.add(key);
+}
+const rows = [];
+for (const profile of loadBackendPlatforms().profiles) for (const family of ["domain-driven", "layered-mvc"]) {
+  const row = { profile_id: profile.id, spring_boot_version: profile.spring_boot_version, java_version: profile.java_version, architecture_family: family, status: "blocked", blockers: [], commands: [], executed_at: new Date().toISOString() };
+  const configuration = input.combinations?.find(item => item.profile_id === profile.id && item.spring_boot_version === profile.spring_boot_version && item.architecture_family === family);
+  for (const key of ["YSS_MAVEN_REPOSITORY_URL", "MAVEN_REPO_USERNAME", "MAVEN_REPO_PASSWORD"]) if (!process.env[key]) row.blockers.push(`missing environment: ${key}`);
+  if (!configuration?.contract_ref) row.blockers.push("missing real approved scaffold contract/YSS compatibility coordinates");
+  const javaHome = input.java_homes?.[String(profile.java_version)];
+  if (!javaHome) row.blockers.push(`missing explicit java_homes.${profile.java_version}`);
+  else {
+    try { const result = spawnSync(path.join(javaHome, "bin/java"), ["-version"], { encoding: "utf8" }); if (result.status !== 0) throw new Error("java -version failed"); assertJavaPlatform(`${result.stdout}\n${result.stderr}`, { java_version: profile.java_version }); row.java_preflight = "passed"; }
+    catch (error) {
+      row.blockers.push(`JDK preflight: ${error.message}`);
+    }
+  }
+  if (!row.blockers.length) {
+    const dir = path.join(evidence, `${profile.id}-${profile.spring_boot_version}-${family}-${Date.now()}`); await mkdir(dir, { recursive: true });
+    try {
+      const contractFile = path.resolve(inputRoot, configuration.contract_ref);
+      const contractBytes = await readFile(contractFile);
+      const contract = JSON.parse(contractBytes);
+      if (contract.architecture_family !== family || contract.platform_configuration?.profile_id !== profile.id || contract.platform_configuration?.spring_boot_version !== profile.spring_boot_version) throw new Error("matrix/contract identity mismatch");
+      const c = contract.maven_coordinates;
+      const pairs = { "project-name": contract.project_name, "base-package": contract.base_package, "output-dir": contract.target_output_dir, "contract-file": contractFile, "contract-id": contract.contract_id, "contract-version": contract.contract_version, "approval-ref": contract.lifecycle_approval_ref, "compiler-draft-ref": contract.compiler_draft_ref, "persisted-ref": contract.persisted_ref, "group-id": c.group_id, "project-version": c.project_version, "parent-group-id": c.parent.group_id, "parent-artifact-id": c.parent.artifact_id, "parent-version": c.parent.version, "yss-components-version": c.yss_components_version };
+      const args = Object.entries(pairs).flatMap(([key, value]) => [`--${key}`, String(value)]);
+      const platformOptions = { catalog, root: inputRoot, candidate: true };
+      if (values.resume) {
+        // Revalidate current approval/design sources without invoking any generation writes.
+        if (family === "domain-driven") await new ScaffoldGenerator(dddArgs(args), platformOptions).validateContractMetadata();
+        else await validateMvcContract(mvcArgs(args), "yss-layered-mvc-scaffold-generator", "layered-mvc-service", platformOptions);
+        assertResumableCandidate(path.join(contract.target_output_dir, contract.project_name), contract, contractBytes);
+      } else if (family === "domain-driven") await new ScaffoldGenerator(dddArgs(args), platformOptions).generate();
+      else await generate(mvcArgs(args), { platformOptions });
+      const report = await run(path.join(contract.target_output_dir, contract.project_name), dir, { ...process.env, JAVA_HOME: javaHome }, { timeoutMs: 180000, platformOptions });
+      await writeFile(path.join(dir, "scaffold-verification.json"), JSON.stringify(report, null, 2));
+      Object.assign(row, report, { evidence_ref: path.join(dir, "scaffold-verification.json") });
+    } catch (error) { row.blockers.push(error.message); }
+  }
+  rows.push(row);
+}
+const report = { schema_version: 1, kind: "backend-platform-matrix", generated_at: new Date().toISOString(), status: rows.every(row => row.status === "passed") ? "passed" : "blocked", combinations: rows };
+await writeFile(path.join(evidence, "platform-matrix.json"), JSON.stringify(report, null, 2));
+process.stdout.write(`${report.status}: ${path.join(evidence, "platform-matrix.json")}\n`);
+if (report.status !== "passed") process.exitCode = 1;

package/template/scripts/verify-scaffold-architecture-decisions

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { platformProfile } from "./lib/backend-platform.mjs";
 import { readFileSync } from "node:fs";
 import path from "node:path";
 import { parseArgs } from "node:util";
@@ -35,6 +36,10 @@ try {
     if (ids.has(decision.decision_id) || projects.has(decision.project_id)) throw new TypeError("decision_id 与 project_id 必须唯一");
     ids.add(decision.decision_id);
     projects.set(decision.project_id, decision);
+    if (decision.platform_configuration) {
+      const profile = platformProfile(decision.platform_profile, undefined, decision.platform_configuration.spring_boot_version);
+      if (decision.platform_configuration.profile_id !== profile.id || decision.platform_configuration.spring_boot_version !== profile.spring_boot_version || decision.platform_configuration.java_version !== profile.java_version) throw new TypeError("platform_configuration 与平台选择不一致");
+    } else if (decision.platform_profile !== "spring-boot-2.7-jdk8") throw new TypeError("新平台缺少 platform_configuration");
     const confirmed = ["user-confirmed", "lifecycle-approved", "consumed"].includes(decision.status);
     const confirmation = decision.user_confirmation;
     if (confirmed && (!decision.confirmed_architecture || Object.values(confirmation).some((item) => item === null || item === ""))) throw new TypeError(`${decision.project_id} 已确认状态必须提供完整用户确认引用`);

package/template/scripts/verify-user-decision

@@ -1,16 +1,21 @@
 #!/usr/bin/env node
 import { parseArgs } from "node:util";
-import { decisionIO, verifyUserDecisionFile } from "./lib/user-decision.mjs";
+import { decisionIO, verifyUserDecisionFile, assertUserDecisionRequirement } from "./lib/user-decision.mjs";
 try {
-  const { positionals, values } = parseArgs({ allowPositionals: true, options: { root: { type: "string" }, requirements: { type: "string" } } });
+  const { positionals, values } = parseArgs({ allowPositionals: true, options: { root: { type: "string" }, requirements: { type: "string" }, continuation: { type: 'boolean' } } });
   if (positionals.length !== 1) throw new TypeError("用法: scripts/verify-user-decision [--root <repo>] [--requirements <当前事项.json>] <record.yaml>");
   const options = values.root ? { root: values.root } : {};
   const io = decisionIO(options);
   const record = io.document(positionals[0]);
+  if (values.continuation) {
+    assertUserDecisionRequirement(record, options);
+    process.stdout.write('已有授权与当前延续范围校验通过\n');
+  } else {
   // No requirements means verify every requested item for approval; partial approvals need explicit current requirements.
   options.expected = values.requirements ? io.document(values.requirements) : record.request.items.map((item) => ({ boundary: item.boundary, subject_ref: item.subject.ref, scope: item.scope }));
   verifyUserDecisionFile(positionals[0], options);
   process.stdout.write("用户决定及当前批准范围校验通过\n");
+  }
 } catch (error) {
   process.stderr.write(`用户决定校验失败: ${error.message}\n`);
   process.exitCode = 1;