create-yss-spec 3.4.5 → 3.4.6

package/template/.cursor/skills/yss-excel-mvc/references/source-index.md

@@ -1,74 +1,10 @@
-# yss-excel-mvc Source Index
+# yss-excel-mvc Source Index Router
 
-Generated: 2026-08-17T12:03:37.436Z
-Source commit: `38b556a5081e6c66c0c538cbc1ef839b19996ed3`
-Source worktree: `dirty`
-Indexed source root: resolved at refresh time; set `YSS_SOURCE_ROOT` to reproduce or refresh.
+Index schema: `backend-component-source-index-router-v1`
 
-This file is generated by `yss-skill-source-index-refresh/scripts/refresh-yss-skill-index.mjs`. Do not hand-edit generated sections.
+Select the source index from the approved `platform_configuration.component_platform_line`; do not infer a line from imports, a branch name or a requested upgrade.
 
-Paths below are source path hints captured at refresh time. If they do not exist in the current workspace, locate sources using `YSS_SOURCE_ROOT`, CodeGraph, package/class names, Maven artifact names, or repository search before assuming the source is unavailable.
+- `boot2-java8` — [Spring Boot 2.7 / Java 8 maintenance line](source-index.boot2-java8.md)
+- `boot3-java17` — [Spring Boot 3.5 / Java 17 mainline](source-index.boot3-java17.md)
 
-## Component Path Hints
-
-- `yss-microservice-components/yss-component-excel-mvc` (existed when indexed)
-- `yss-microservice-components/yss-component-excel-starter` (existed when indexed)
-
-## Documentation Files
-
-- `yss-microservice-components/yss-component-excel-mvc/README.md`
-
-## Maven Modules
-
-- `yss-microservice-components/yss-component-excel-mvc`
-- `yss-microservice-components/yss-component-excel-starter`
-
-## Key Java Entry Points
-
-- `yss-microservice-components/yss-component-excel-mvc/src/main/java/com/yss/excel/mvc/annotation/EnableExcelMvc.java`
-- `yss-microservice-components/yss-component-excel-mvc/src/main/java/com/yss/excel/mvc/annotation/RequestExcel.java`
-- `yss-microservice-components/yss-component-excel-mvc/src/main/java/com/yss/excel/mvc/annotation/ResponseExcel.java`
-- `yss-microservice-components/yss-component-excel-mvc/src/main/java/com/yss/excel/mvc/config/FastExcelAutoConfiguration.java`
-- `yss-microservice-components/yss-component-excel-mvc/src/main/java/com/yss/excel/mvc/exception/ExcelDataValidationData.java`
-- `yss-microservice-components/yss-component-excel-mvc/src/main/java/com/yss/excel/mvc/exception/ExcelDataValidationException.java`
-- `yss-microservice-components/yss-component-excel-mvc/src/main/java/com/yss/excel/mvc/exception/ExcelMvcExceptionHandler.java`
-- `yss-microservice-components/yss-component-excel-mvc/src/main/java/com/yss/excel/mvc/handler/RequestFastExcelArgumentResolver.java`
-- `yss-microservice-components/yss-component-excel-mvc/src/main/java/com/yss/excel/mvc/handler/ResponseFastExcelReturnValueHandler.java`
-- `yss-microservice-components/yss-component-excel-mvc/src/main/java/com/yss/excel/mvc/model/ExcelDynamicData.java`
-- `yss-microservice-components/yss-component-excel-mvc/src/main/java/com/yss/excel/mvc/util/ExcelUtils.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/ExcelAutoConfiguration.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/ExcelControlProperties.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/ExcelDataRequest.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/ExcelResolverConfiguration.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/annotation/EnableExcelControl.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/annotation/ExcelDynamicSelect.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/annotation/ExcelMeta.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/annotation/ExcelNotation.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/annotation/ExcelSelected.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/annotation/RequestExcel.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/annotation/ResponseExcel.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/aop/DynamicExcelAspect.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/handler/DynamicEasyHandler.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/handler/ExcelCellWidthStyleStrategy.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/handler/RequestExcelArgumentResolver.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/handler/ResponseExcelReturnHandler.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/handler/SelectedSheetWriteHandler.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/handler/TitleHandler.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/handler/WorkbookExcelWriteBuilder.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/model/ExcelComment.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/model/ExcelGeneralData.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/model/ExcelMetaData.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/model/ExcelSelectedResolve.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/model/RowValidationInfo.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/model/excel/CellType.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/model/excel/ExcelCellStyle.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/model/excel/ExcelColHeader.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/model/excel/ExcelDisabled.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/processor/DynamicEasyExcelProcessor.java`
-- `yss-microservice-components/yss-component-excel-starter/src/main/java/com/yss/cloud/excel/processor/ExcelStyleParseProcessor.java`
-
-## Recommended Next Reads
-
-- Start with the documentation files above when learning component usage.
-- Search the key Java entry points for annotations, auto configuration, properties, aspects, interceptors, handlers, and result objects before changing application code.
-- Prefer existing component extension points over rewriting framework logic in business modules.
+Run the freshness checker with the same explicit `--platform-line` and its matching clean source root before exact integration guidance.

package/template/.cursor/skills/yss-exception/SKILL.md

@@ -27,12 +27,14 @@ Read `references/source-index.md` as a path-hint index whenever the task depends
 6. In the `target-domain-model` profile, Domain owns stable error meaning and parameters but does not depend directly on YSS `BizException` or HTTP. Translate at the Web boundary after verifying the component handler precedence.
 7. MVC Profile 的稳定业务错误归 service/core；Repository 保留 cause；server 持有 HTTP 映射与脱敏。不要为了复用错误码引入 Domain 层或让 core 依赖 client。分层依据 `docs/agents/backend-architecture-profiles.md`。
 
-## Current Source Behavior
+## Boot 3 Current Source Behavior
 
-- `GlobalExceptionAdvice` currently maps BizException, unknown Exception, and RuntimeException to HTTP 400; the OpenAPI error contract must reflect or deliberately override that behavior.
-- The current RuntimeException handler returns `exception.getLocalizedMessage()` for many runtime failures; treat that as a response-information-leak risk and do not copy it into new APIs without an approved, sanitized error mapping.
-- `yss.exception.level` only controls a direct `printStackTrace()` branch when its value is exactly `debug`; it is not a general response-format switch.
-- Validation binding failures currently become `SysException(PARAM_VALIDATION_ERROR)`. Coordinate changes with `yss-validation` and contract tests.
+- 以下当前行为针对 `boot3-java17`；Boot 2 旧工程必须读取其独立索引，旧行为只用于迁移识别。
+- `GlobalExceptionAdvice` maps `BizException` to HTTP 400. Unknown `Exception`, `RuntimeException`, and `NullPointerException` map to HTTP 500 and return a sanitized `SysException` with `ResultErrorCode.INTERNAL_ERROR` instead of raw exception text.
+- `MaxUploadSizeExceededException` maps to HTTP 413 (`PAYLOAD_TOO_LARGE`) with `ResultErrorCode.MAX_UPLOAD_SIZE_EXCEEDED`.
+- System and unknown failures are recorded with the SLF4J logger. `yss.exception.level=debug` adds a logger-backed debug stack trace; it never calls `Throwable#printStackTrace()`.
+- Every handled response attaches or reuses a trace id in MDC and exposes it through the `X-Trace-Id` response header. The public body does not contain the raw localized exception or stack trace.
+- Validation binding failures become `SysException(PARAM_VALIDATION_ERROR)`. Coordinate changes with `yss-validation` and contract tests.
 
 ## Source-Backed Exception Semantics
 
@@ -45,11 +47,12 @@ Read `references/source-index.md` as a path-hint index whenever the task depends
 - Required dependency or starter module is present.
 - Error code/message are meaningful to API consumers.
 - Response messages are sanitized and do not expose raw RuntimeException or localized exception details.
+- HTTP assertions cover business 4xx, unknown/runtime 5xx, upload 413, and `X-Trace-Id`.
 - Business validation failures are not reported as unknown system errors.
-- Stack traces are preserved for unknown/system failures.
+- Stack traces are preserved in structured logger output for unknown/system failures, never printed directly to stderr or serialized to clients.
 - Retry guidance matches exception type.
 - Known system failures use `ExceptionFactory.sysException(..., cause)`; Application code does not replace them with ad-hoc `RuntimeException`.
-- Endpoint contract tests cover business, known-system, and unknown/runtime failures; unknown public messages never expose `getLocalizedMessage()`.
+- Endpoint contract tests cover business, known-system, unknown/runtime, and upload-limit failures; unknown public messages never expose `getLocalizedMessage()`.
 
 ## Do Not
 
@@ -57,6 +60,6 @@ Read `references/source-index.md` as a path-hint index whenever the task depends
 - Do not replace component extension points with business-local framework code.
 - Do not broaden the task into unrelated YSS components unless the user asks.
 
-## 新脚手架平台约束
+## 平台与源码门禁
 
-消费批准切片架构身份中的 `platform_configuration`，与工程 Manifest 核对后使用对应 YSS 组件。Boot 2.7 使用 `javax` Web/Validation API；Boot 3.5/4.1 使用 `jakarta`。Boot 4 按 Jackson 3、对应自动配置和 starter 适配；不替换 `javax.sql` 等 Java SE 包。平台不一致、兼容条目缺失或候选未验证时回合同编译器阻断，不在业务实现中升级或替换组件。详见 仓库共享合同 `docs/engineering/backend-platforms.md`。
+接入、修改、代码生成或给出精确类名/配置前，读取 [后端组件平台与源码门禁](../yss-skill-source-index-refresh/references/backend-component-platform-compatibility.md)，从批准的 `platform_configuration.component_platform_line` 选择 `source-index.boot2-java8.md` 或 `source-index.boot3-java17.md`，并以 `--skill yss-exception --platform-line <line> --source-root <matching-root>` 运行统一 freshness 校验。平台线与源码根不匹配、组件 tree 不一致、组件子树 dirty、索引缺少平台信号，或 Manifest / 组件 GAV 缺少 verified 兼容证据时返回 `blocked`；不得回退另一代索引，也不在业务实现中升级、降级或替换 YSS 组件。既有工程只读分诊可继续，但不得据此宣称跨 Boot/JDK 兼容。

package/template/.cursor/skills/yss-exception/references/source-index.boot2-java8.md

@@ -0,0 +1,50 @@
+# yss-exception Source Index
+
+Index schema: `backend-component-source-index-v2`
+Platform line: `boot2-java8`
+Generated: 2026-09-18T18:40:26.031Z
+Source commit: `a3be2b2e33dca4545782e2b31894aaa00d0305cd`
+Component worktree: `clean`
+Component tree `yss-microservice-components/yss-component-exception`: `e5d71e213f26cd7e52d419ded1c2f5e7b7fbf40b`
+Indexed source root: resolved at refresh time; set `YSS_SOURCE_ROOT_BOOT2_JAVA8` to reproduce or refresh.
+
+This file is generated by `yss-skill-source-index-refresh/scripts/refresh-yss-skill-index.mjs`. Do not hand-edit generated sections.
+
+Paths are relocatable source hints. Exact guidance requires a matching component tree and a clean indexed component subtree; the repository commit is trace metadata and may differ when unrelated components change.
+
+## Component Path Hints
+
+- `yss-microservice-components/yss-component-exception` (existed when indexed)
+
+## Documentation Files
+
+- `yss-microservice-components/yss-component-exception/readme.md`
+
+Component documentation is a discovery aid. For API signatures, conditions and defaults, prefer the indexed source facts below when documentation differs.
+
+## Maven Modules
+
+- `yss-microservice-components/yss-component-exception/pom.xml` — GAV `com.yss.cloud:yss-component-exception:2.0.0-SNAPSHOT`; parent `com.yss.cloud:yss-microservice-components:2.0.0-SNAPSHOT`
+
+## Platform Signals
+
+- Inherited Java signals: `1.8`.
+- Inherited Spring Boot signals: `2.7.18`.
+- Namespace source signals: `javax.*` in 1 main Java files; `jakarta.*` in 0 main Java files.
+- Auto-configuration metadata: 1 `spring.factories`; 0 `AutoConfiguration.imports` files.
+- These are source observations, not compatibility certification. Use the approved `platform_configuration` and verified compatibility evidence before integration or generation.
+
+## Key Java Entry Points
+
+- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/ExceptionFactory.java` — `sha256:871070981022984dc5e991bcc6a250fb9fdda31efe94a6e151bd86dfebc7162b`
+- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/ResultErrorCode.java` — `sha256:cfc1ce146b99ba5d938bdc6bfb80758582e0c80cf1e37472967d5fdc334b8f81`
+- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/YssGlobalExceptionProperties.java` — `sha256:706136214248b90965feadced7940fde2f649e9d5f19a3953d55756a7f56ea84`
+- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/advice/GlobalExceptionAdvice.java` — `sha256:c4233e0fdfccb63330fc82d26e4defd8fb8985ba04cc23d8fa3d0e2cbc0183b5`
+
+## Freshness and Use
+
+- Locate the current source root using `YSS_SOURCE_ROOT_BOOT2_JAVA8`, CodeGraph, Maven artifact names or repository search.
+- Compare each indexed `Component tree` with `git rev-parse HEAD:<component-path>` and require the current component subtree to be clean before exact guidance.
+- Run `node ../yss-skill-source-index-refresh/scripts/check-backend-skill-source-index.mjs --skill <skill-id> --platform-line boot2-java8 --source-root <root>` from the canonical skill root before exact integration guidance.
+- A repository commit difference alone is not stale when the component tree is unchanged; a component tree mismatch or component-local dirty state is stale.
+- Read only the source entries needed for the current decision or troubleshooting path.

package/template/.cursor/skills/yss-exception/references/source-index.boot3-java17.md

@@ -0,0 +1,50 @@
+# yss-exception Source Index
+
+Index schema: `backend-component-source-index-v2`
+Platform line: `boot3-java17`
+Generated: 2026-09-18T18:40:26.031Z
+Source commit: `5041c41fbe96c25821bbc15f688c0521b8c97a3d`
+Component worktree: `clean`
+Component tree `yss-microservice-components/yss-component-exception`: `4d83019be2ede902b69eb5fe9fdad8739f0f9933`
+Indexed source root: resolved at refresh time; set `YSS_SOURCE_ROOT_BOOT3_JAVA17` to reproduce or refresh.
+
+This file is generated by `yss-skill-source-index-refresh/scripts/refresh-yss-skill-index.mjs`. Do not hand-edit generated sections.
+
+Paths are relocatable source hints. Exact guidance requires a matching component tree and a clean indexed component subtree; the repository commit is trace metadata and may differ when unrelated components change.
+
+## Component Path Hints
+
+- `yss-microservice-components/yss-component-exception` (existed when indexed)
+
+## Documentation Files
+
+- `yss-microservice-components/yss-component-exception/readme.md`
+
+Component documentation is a discovery aid. For API signatures, conditions and defaults, prefer the indexed source facts below when documentation differs.
+
+## Maven Modules
+
+- `yss-microservice-components/yss-component-exception/pom.xml` — GAV `com.yss.cloud:yss-component-exception:3.0.0-SNAPSHOT`; parent `com.yss.cloud:yss-microservice-components:3.0.0-SNAPSHOT`
+
+## Platform Signals
+
+- Inherited Java signals: `17`.
+- Inherited Spring Boot signals: `3.5.16`.
+- Namespace source signals: `javax.*` in 0 main Java files; `jakarta.*` in 1 main Java files.
+- Auto-configuration metadata: 0 `spring.factories`; 1 `AutoConfiguration.imports` files.
+- These are source observations, not compatibility certification. Use the approved `platform_configuration` and verified compatibility evidence before integration or generation.
+
+## Key Java Entry Points
+
+- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/ExceptionFactory.java` — `sha256:871070981022984dc5e991bcc6a250fb9fdda31efe94a6e151bd86dfebc7162b`
+- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/ResultErrorCode.java` — `sha256:cfc1ce146b99ba5d938bdc6bfb80758582e0c80cf1e37472967d5fdc334b8f81`
+- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/YssGlobalExceptionProperties.java` — `sha256:706136214248b90965feadced7940fde2f649e9d5f19a3953d55756a7f56ea84`
+- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/advice/GlobalExceptionAdvice.java` — `sha256:56c2025e65b314c30ba2f6c51bead345fe8d81da892c10f5d5c20663e7f38949`
+
+## Freshness and Use
+
+- Locate the current source root using `YSS_SOURCE_ROOT_BOOT3_JAVA17`, CodeGraph, Maven artifact names or repository search.
+- Compare each indexed `Component tree` with `git rev-parse HEAD:<component-path>` and require the current component subtree to be clean before exact guidance.
+- Run `node ../yss-skill-source-index-refresh/scripts/check-backend-skill-source-index.mjs --skill <skill-id> --platform-line boot3-java17 --source-root <root>` from the canonical skill root before exact integration guidance.
+- A repository commit difference alone is not stale when the component tree is unchanged; a component tree mismatch or component-local dirty state is stale.
+- Read only the source entries needed for the current decision or troubleshooting path.

package/template/.cursor/skills/yss-exception/references/source-index.md

@@ -1,35 +1,10 @@
-# yss-exception Source Index
+# yss-exception Source Index Router
 
-Generated: 2026-08-17T12:03:37.436Z
-Source commit: `38b556a5081e6c66c0c538cbc1ef839b19996ed3`
-Source worktree: `dirty`
-Indexed source root: resolved at refresh time; set `YSS_SOURCE_ROOT` to reproduce or refresh.
+Index schema: `backend-component-source-index-router-v1`
 
-This file is generated by `yss-skill-source-index-refresh/scripts/refresh-yss-skill-index.mjs`. Do not hand-edit generated sections.
+Select the source index from the approved `platform_configuration.component_platform_line`; do not infer a line from imports, a branch name or a requested upgrade.
 
-Paths below are source path hints captured at refresh time. If they do not exist in the current workspace, locate sources using `YSS_SOURCE_ROOT`, CodeGraph, package/class names, Maven artifact names, or repository search before assuming the source is unavailable.
+- `boot2-java8` — [Spring Boot 2.7 / Java 8 maintenance line](source-index.boot2-java8.md)
+- `boot3-java17` — [Spring Boot 3.5 / Java 17 mainline](source-index.boot3-java17.md)
 
-## Component Path Hints
-
-- `yss-microservice-components/yss-component-exception` (existed when indexed)
-
-## Documentation Files
-
-- `yss-microservice-components/yss-component-exception/readme.md`
-
-## Maven Modules
-
-- `yss-microservice-components/yss-component-exception`
-
-## Key Java Entry Points
-
-- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/ExceptionFactory.java`
-- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/ResultErrorCode.java`
-- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/YssGlobalExceptionProperties.java`
-- `yss-microservice-components/yss-component-exception/src/main/java/com/yss/cloud/exception/advice/GlobalExceptionAdvice.java`
-
-## Recommended Next Reads
-
-- Start with the documentation files above when learning component usage.
-- Search the key Java entry points for annotations, auto configuration, properties, aspects, interceptors, handlers, and result objects before changing application code.
-- Prefer existing component extension points over rewriting framework logic in business modules.
+Run the freshness checker with the same explicit `--platform-line` and its matching clean source root before exact integration guidance.

package/template/.cursor/skills/yss-implementation-contract-compiler/SKILL.md

@@ -75,3 +75,5 @@ Slice v3 的任务进度、缺口和实时就绪结果不回写合同。源事
 ## 后端脚手架平台承接
 
 消费生命周期已确认的架构与 `platform_configuration` v2；不得自行选择、批准或静默升级 Boot/Java。平台清单执行 `scripts/backend-platforms` 查询；只允许已验证 YSS 组合，新生成缺少配置或证据即阻断。决定、合同、Manifest 与下游架构身份须绑定同一平台及兼容摘要。详见 仓库共享合同 `docs/engineering/backend-platforms.md`。
+
+后端 Slice 解析出 `component_binding: required` 的 capability 或其主 Skill 时，必须在同一平台兼容条目中逐项解析 `component_capabilities`。编译结果保存 `component_bindings` 与 `component_bindings_digest`；未登记、未验证、架构证据缺失、构件坐标冲突或摘要漂移均阻断。旧合同含组件 Skill 但没有组件绑定时直接 `stale`，重新编译并交生命周期批准，禁止自动补字段后沿用原批准。

package/template/.cursor/skills/yss-implementation-contract-compiler/references/boundaries.md

@@ -20,7 +20,7 @@
 | --- | --- | --- |
 | `writing.lifecycle-document` | `i-have-adhd` | `guidance` |
 | `architecture.technical-design` | `yss-technical-design` | `guidance`, `integration`, `review-input` |
-| `architecture.mvc-design` | `yss-mvc-design` | `guidance`, `integration`, `review-input` |
+| `architecture.mvc-design` | `yss-technical-design` | `guidance`, `integration`, `review-input` |
 | `layer.mvc-service` | `yss-application` | `guidance`, `integration`, `slice-implementation`, `troubleshooting`, `review-input` |
 | `layer.mvc-persistence` | `yss-repository` | `guidance`, `integration`, `slice-implementation`, `troubleshooting`, `review-input` |
 | `layer.mvc-web` | `yss-web-controller` | `guidance`, `integration`, `slice-implementation`, `troubleshooting`, `review-input` |
@@ -48,7 +48,7 @@
 | `scaffold.ddd` | `yss-ddd-scaffold-generator` | `integration`, `component-maintenance` |
 | `scaffold.layered-mvc` | `yss-layered-mvc-scaffold-generator` | `integration`, `component-maintenance` |
 | `scaffold.frontend-vue3` | `yss-frontend-scaffold-generator` | `integration`, `component-maintenance` |
-| `project-init.mvc-data-analysis` | `yss-mvc-data-analysis-project-initializer` | `component-maintenance` |
+| `project-init.mvc-data-analysis` | `yss-layered-mvc-scaffold-generator` | `component-maintenance` |
 | `migration.springboot3` | `yss-up-springboot3` | `guidance`, `integration`, `troubleshooting`, `component-maintenance`, `review-input` |
 
 ## Narrow Recipes
@@ -118,7 +118,6 @@
 | `yss-prototype-stage` | `i-have-adhd` | `context-conditional` | `lifecycle-document-output` |
 | `yss-prototype-stage` | `prototype-review` | `review-only` | — |
 | `yss-prototype-stage` | `yss-design-system` | `coordination-only` | — |
-| `yss-ddd-scaffold-generator` | `yss-backend-scaffold-parent` | `context-required` | — |
 | `yss-ddd-scaffold-generator` | `alibaba-java-code-style` | `context-required` | — |
 | `yss-layered-mvc-scaffold-generator` | `alibaba-java-code-style` | `context-required` | — |
 | `yss-domain` | `alibaba-java-code-style` | `context-required` | — |
@@ -127,8 +126,7 @@
 | `yss-domain` | `lombok` | `context-conditional` | `pojo` |
 | `yss-technical-design` | `i-have-adhd` | `context-conditional` | `lifecycle-document-output` |
 | `yss-technical-design` | `yss-tactical-design` | `coordination-only` | `domain-driven` |
-| `yss-technical-design` | `yss-mvc-design` | `coordination-only` | `layered-mvc` |
-| `yss-mvc-design` | `yss-openapi-draft-review` | `review-only` | `api-impact` |
+| `yss-technical-design` | `yss-openapi-draft-review` | `review-only` | `api-impact` |
 | `yss-tactical-design` | `domain-modeling` | `coordination-only` | — |
 | `yss-tactical-design` | `yss-openapi-draft-review` | `review-only` | `api-impact` |
 | `yss-tactical-design` | `yss-repository` | `component-dependency` | `data-impact` |

package/template/.cursor/skills/yss-implementation-contract-compiler/references/compiler-contract.yaml

@@ -143,6 +143,14 @@ resolution_contract:
   deterministic_order: [recipe-declaration, dependency-topology, skill-id]
   digest_change_status: stale
   stale_action: recompile-and-return-to-lifecycle-approval
+  component_bindings:
+    when: any-required-capability-provider-kind-is-yss-component
+    platform_configuration: required-v2
+    catalog_source: docs/engineering/backend-platforms.json
+    required_fields: [component_bindings, component_bindings_digest]
+    exact_artifact_binding: [group_id, artifact_id, declared_version, resolved_version, pom_sha256, jar_sha256, source_tree]
+    digest_change_status: stale
+    old_contract_without_binding: stale-and-recompile-no-auto-upgrade
 
 context_plan:
   required: [required_context_refs, on_demand_context_refs, context_stop_rule, missing_context_action]
@@ -157,7 +165,7 @@ project_scaffold_contract_schema:
   delivery_roles:
     backend:
       scaffold_kinds: [backend-ddd, backend-layered-mvc, backend-mvc-data-analysis]
-      generators: [yss-ddd-scaffold-generator, yss-layered-mvc-scaffold-generator, yss-mvc-data-analysis-project-initializer]
+      generators: [yss-ddd-scaffold-generator, yss-layered-mvc-scaffold-generator]
       requires: [scaffold_request_id, architecture_family, decision_ref, decision_id, decision_digest, project_name, base_package, maven_coordinates, profiles, module_profile, design_prerequisites]
       design_prerequisites:
         required: [technical_design, data_architecture_decision, api_contract_decision, engineering_contract_approval_ref]
@@ -253,7 +261,7 @@ scaffold_contract_schema:
     lifecycle_approves: [approved]
     generator_consumes: []
     after_generation:
-      domain-driven: [yss-backend-scaffold-parent, yss-implementation-contract-compiler]
+      domain-driven: [yss-implementation-contract-compiler]
       layered-mvc: [yss-implementation-contract-compiler]
   work_unit:
     required: [id, behavior, primary_skill, supporting_skills, tdd_mode, allowed_write_paths, expected_evidence, verification_commands, controlled_generation]
@@ -330,6 +338,7 @@ full_reroute_triggers:
   - scaffold-architecture-decision-changed
   - scaffold-profile-changed
   - scaffold-module-resolution-changed
+  - component-binding-drift
   - api-schema-impact
   - database-schema-impact
   - state-machine-impact
@@ -355,6 +364,7 @@ full_reroute_triggers:
 
 reroute_destinations:
   scaffold-baseline-drift: stage7-scaffold-revalidation
+  component-binding-drift: stage7-contract-recompile
   api-schema-impact: system-data-architecture-and-contract-review
   database-schema-impact: data-architecture-and-migration-review
   state-machine-impact: spec-system-data-and-contract-review
@@ -410,6 +420,10 @@ execution_result_required:
   - deviations
   - new_impacts
   - not_applicable_reason
+execution_result_component_binding:
+  when: resolution.component_bindings-present
+  required: consumed_contract.component_bindings_digest
+  mismatch: component-binding-mismatch
 seam_deferred_required: [risk, owner, follow_up_ticket, verification_plan, target_version_or_release_date]
 deviation_required: [rule, reason, approval_ref]
 not_applicable_required: [item, reason]
@@ -432,3 +446,14 @@ backend_platform_contract:
   new_generation_requires: [exact-boot-java, confirmed-decision, matching-yss-coordinates, verified-compatibility-entry]
   candidate_generation: maintenance-only
   candidate_downstream: blocked
+  component_capabilities:
+    registry_marker: provider-kind-yss-component
+    mapping_key: provider-binding-id
+    foundational_capabilities: [contract.dto-wire, contract.request-validation, contract.error-mapping, framework.mybatis]
+    specialized_capabilities: [component.cache, component.current-user-context, component.audit-log, component.excel-import-export, component.distributed-id, component.security-algorithm, component.gateway-resilience]
+    exact_artifact_evidence: [group_id, artifact_id, declared_version, resolved_version, pom_sha256, jar_sha256, source_tree]
+    verified_architecture_required: true
+    unlisted_or_blocked: component-unavailable-for-platform
+    missing_evidence: component-evidence-missing
+    coordinate_conflict: component-artifact-coordinate-conflict
+    drift: component-binding-drift

package/template/.cursor/skills/yss-implementation-contract-compiler/references/yss-skill-execution-result.md

@@ -17,6 +17,7 @@ execution_result:
     contract_version:
     registry_digest:
     compiler_contract_digest:
+    component_bindings_digest: # 合同含 component_bindings 时必填
     quality_baseline_ref:
     context_plan_ref:
   changed_files:
@@ -57,7 +58,7 @@ execution_result:
 
 实现合同编译器必须验证：
 
-1. `consumed_contract.contract_version` 与当前批准版本一致，两个 resolution digest 与批准合同一致且保持 current。
+1. `consumed_contract.contract_version` 与当前批准版本一致，Registry、编译器以及适用的 `component_bindings_digest` 与批准合同一致且保持 current。
 2. `changed_files` 全部位于工作单元和切片允许路径内。
 3. `expected_evidence_files` 全部存在并能回指行为。
 4. 验证命令包含实际结果和时间；计划命令不算证据。

package/template/.cursor/skills/yss-implementation-contract-compiler/tests/compiler-scenarios.test.mjs

@@ -1,5 +1,6 @@
 import assert from "node:assert/strict";
 import test from "node:test";
+import { readFileSync } from "node:fs";
 import {
   compileImplementationContract,
   digestDocument,
@@ -8,6 +9,7 @@ import {
   validateExecutionResult
 } from "../../../../scripts/lib/implementation-contract-compiler.mjs";
 import { loadSkillRegistry } from "../../../../scripts/lib/skill-registry.mjs";
+import { loadBackendPlatforms, platformBinding } from "../../../../scripts/lib/backend-platform.mjs";
 
 const registry = loadSkillRegistry();
 const compilerContract = loadCompilerContract();
@@ -15,17 +17,18 @@ const fixed = "2026-09-04T00:00:00.000Z";
 const identity = { architecture_family: "domain-driven", architecture_profile: "target-domain-model", generator_skill: "yss-ddd-scaffold-generator", requested_capabilities: [], resolved_modules: ["domain", "application", "infrastructure", "adapter", "bootstrap"], verification_database: "h2", production_database: "not-bound", contract_digest: "a".repeat(64) };
 const architecture = { architecture_identity: identity, architecture_evidence: { engineering_baseline: identity, repository_registration: identity, manifest: identity } };
 const compile = (input) => compileImplementationContract({ registry, compilerContract, compiledAt: fixed, ...architecture, ...input });
+const stableComponentError = code => error => error?.code === code && new RegExp(`^component-capability: ${code}:`).test(error.message);
 
 test("combines narrow recipes once and preserves deterministic output", () => {
   const input = {
-    recipeIds: ["backend.ddd-http-api", "backend.ddd-domain-behavior", "backend.ddd-persistence-mybatis"],
-    conditions: ["mybatis", "conversion", "pojo", "request-validation", "error-mapping"]
+    recipeIds: ["backend.ddd-domain-behavior"],
+    conditions: ["conversion", "pojo"]
   };
   const first = compile(input);
   const second = compile({ ...input, recipeIds: [...input.recipeIds].reverse(), conditions: [...input.conditions].reverse() });
   assert.deepEqual(first, second);
-  assert.deepEqual(first.recipe_ids, ["backend.ddd-domain-behavior", "backend.ddd-persistence-mybatis", "backend.ddd-http-api"]);
-  for (const skill of ["yss-domain", "yss-application", "yss-repository", "yss-mybatis", "yss-web-controller", "yss-dto", "yss-validation", "yss-exception", "mapstruct", "lombok", "alibaba-java-code-style"]) {
+  assert.deepEqual(first.recipe_ids, ["backend.ddd-domain-behavior"]);
+  for (const skill of ["yss-domain", "yss-application", "mapstruct", "lombok", "alibaba-java-code-style"]) {
     assert.equal(first.required_skills.filter((candidate) => candidate === skill).length, 1, `${skill} should appear once`);
   }
 });
@@ -37,17 +40,43 @@ test("does not promote conditional or component dependencies without explicit in
   assert.equal(persistence.required_skills.includes("mapstruct"), false);
   assert.equal(persistence.required_skills.includes("lombok"), false);
 
-  const validation = compile({ requiredCapabilities: ["contract.request-validation"] });
-  assert.deepEqual(validation.required_skills, ["yss-validation"]);
-  assert.equal(validation.required_skills.includes("yss-exception"), false);
-  assert.ok(validation.non_expanding_dependencies.some((edge) => edge.from === "yss-validation" && edge.skill === "yss-exception"));
+  assert.throws(
+    () => compile({ requiredCapabilities: ["contract.request-validation"], architecture_identity: undefined, architecture_evidence: undefined }),
+    /component-platform-binding-required/
+  );
 });
 
 test("loads only explicitly satisfied context-conditional dependencies", () => {
-  const persistence = compile({ requiredCapabilities: ["layer.persistence"], conditions: ["mybatis"] });
-  assert.equal(persistence.required_skills.includes("yss-mybatis"), true);
-  assert.equal(persistence.required_skills.includes("mapstruct"), false);
-  assert.equal(persistence.required_skills.includes("lombok"), false);
+  const application = compile({ requiredCapabilities: ["layer.application"], conditions: ["conversion"] });
+  assert.equal(application.required_skills.includes("mapstruct"), true);
+  assert.equal(application.required_skills.includes("lombok"), false);
+  assert.equal(application.required_skills.includes("yss-mybatis"), false);
+});
+
+test("requires a platform binding for every backend component capability", () => {
+  for (const capability of ["contract.dto-wire", "contract.request-validation", "contract.error-mapping", "framework.mybatis", "component.cache", "component.current-user-context", "component.audit-log", "component.excel-import-export", "component.distributed-id", "component.security-algorithm", "component.gateway-resilience"]) {
+    assert.throws(
+      () => compile({ requiredCapabilities: [capability], architecture_identity: undefined, architecture_evidence: undefined }),
+      stableComponentError("component-platform-binding-required"),
+      capability
+    );
+  }
+});
+
+test("public compiler entry preserves stable component error codes", () => {
+  const catalog = loadBackendPlatforms();
+  const boot2Profile = catalog.profiles.find(item => item.id === "spring-boot-2.7-jdk8");
+  const boot2Entry = catalog.compatibility.find(item => item.profile_id === boot2Profile.id);
+  const boot2 = platformBinding(boot2Profile, boot2Entry);
+  const withPlatform = platform_configuration => {
+    const architecture_identity = { ...identity, platform_configuration };
+    return { architecture_identity, architecture_evidence: { engineering_baseline: architecture_identity, repository_registration: architecture_identity, manifest: architecture_identity } };
+  };
+  assert.throws(() => compile({ requiredCapabilities: ["contract.dto-wire"], ...withPlatform(boot2) }), stableComponentError("component-evidence-missing"));
+  assert.throws(() => compile({ requiredCapabilities: ["component.cache"], ...withPlatform(boot2) }), stableComponentError("component-platform-generation-mismatch"));
+  const boot3Profile = catalog.profiles.find(item => item.id === "spring-boot-3.5-jdk17");
+  const boot3 = { ...boot2, profile_id: boot3Profile.id, spring_boot_version: boot3Profile.spring_boot_version, java_version: boot3Profile.java_version, compatibility_id: "unavailable-boot3-components" };
+  assert.throws(() => compile({ requiredCapabilities: ["contract.dto-wire"], ...withPlatform(boot3) }), stableComponentError("component-unavailable-for-platform"));
 });
 
 test("rejects recipes that reference skills and context-required cycles", () => {
@@ -62,12 +91,12 @@ test("rejects recipes that reference skills and context-required cycles", () =>
 
 test("rejects removed ids and schema v1 without compatibility", () => {
   assert.throws(() => compile({ recipeIds: ["yss-router"] }), /已移除 skill id/);
-  assert.throws(() => compileImplementationContract({ registry: { ...registry, schema_version: 1 }, compilerContract, requiredCapabilities: ["layer.domain"] }), /schema v1 已停止支持/);
+  assert.throws(() => compileImplementationContract({ registry: { ...registry, schema_version: 1 }, compilerContract, requiredCapabilities: ["layer.domain"] }), /schema v1\/v2 已停止支持/);
   assert.throws(() => compileImplementationContract({ registry, compilerContract: { ...compilerContract, schema_version: 1 }, requiredCapabilities: ["layer.domain"] }), /schema v1 已停止支持/);
 });
 
 test("marks digest drift stale and validates v2 execution evidence", () => {
-  const resolution = compile({ requiredCapabilities: ["contract.request-validation"], architecture_identity: undefined, architecture_evidence: undefined });
+  const resolution = compile({ requiredCapabilities: ["quality.java-code-style"], architecture_identity: undefined, architecture_evidence: undefined });
   const contract = { schema_version: 2, contract_id: "slice-1", contract_version: 1, resolution };
   assert.deepEqual(evaluateContractFreshness(contract, { registry, compilerContract }), { freshness: "current", reasons: [] });
   const changedRegistry = structuredClone(registry);
@@ -89,3 +118,20 @@ test("marks digest drift stale and validates v2 execution evidence", () => {
   assert.deepEqual(validateExecutionResult(result, contract, { registry, compilerContract }), { status: "accepted", blockers: [] });
   assert.deepEqual(validateExecutionResult({ ...result, new_impacts: [{ impact_type: "cache" }] }, contract, { registry, compilerContract }), { status: "blocked", blockers: ["new-impacts"] });
 });
+
+test("marks legacy component contracts without component bindings stale", () => {
+  const resolution = compile({ requiredCapabilities: ["quality.java-code-style"], architecture_identity: undefined, architecture_evidence: undefined });
+  resolution.required_capabilities = ["contract.dto-wire"];
+  resolution.required_skills = ["yss-dto"];
+  const contract = { schema_version: 2, contract_id: "legacy-component", contract_version: 1, resolution };
+  assert.ok(evaluateContractFreshness(contract, { registry, compilerContract }).reasons.includes("component-binding-drift"));
+});
+
+test("current lifecycle scaffold contract delegates platform facts to the catalog", () => {
+  const source = readFileSync(new URL("../../yss-product-lifecycle/references/orchestration-contract.yaml", import.meta.url), "utf8");
+  const current = source.slice(source.indexOf("backend_scaffold:"), source.indexOf("  required_inputs:", source.indexOf("backend_scaffold:")));
+  assert.match(current, /platform_binding: platform_configuration-v2/);
+  assert.doesNotMatch(current, /yss_components_version:\s*2\.0\.0-SNAPSHOT/);
+  assert.doesNotMatch(current, /spring-boot-3/);
+  assert.doesNotMatch(current, /validation_namespace:\s*javax/);
+});

package/template/.cursor/skills/yss-layered-mvc-scaffold-generator/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: yss-layered-mvc-scaffold-generator
-description: 用于在生命周期已批准的脚手架合同下生成按批准 Spring Boot / Java 平台生成通用 YSS 分层 MVC 后端工程；核心模块为 server、service、repository，并按能力确定性增加 adapter、client、feign-client。
+description: 在生命周期已批准的脚手架合同下生成通用 YSS 分层 MVC 后端，或按 mvc-data-analysis-v1 初始化六模块数据分析 project-instance。
 ---
 
 # YSS Layered MVC Scaffold Generator
 
-本 skill 只为已登记的全新 backend project 生成机械工程骨架，不创建 `project-instance`、不初始化 Git、不生成业务 Controller、DTO、查询、状态机或 Mock 数据。
+本 skill 只为已登记的全新 backend project 生成机械工程骨架，不生成业务 Controller、DTO、查询、状态机或 Mock 数据。普通 `layered-mvc-service` 不创建 `project-instance` 或初始化 Git；`mvc-data-analysis-v1` 按批准合同创建独立 project-instance、同级锁定 `skillUtils` 和未提交的 main Git。
 
 ## 进入条件
 
@@ -31,12 +31,13 @@ description: 用于在生命周期已批准的脚手架合同下生成按批准
 
 ## 架构与 Profile
 
-- 固定核心模块：`server`、`service`、`repository`。
+- `layered-mvc-service` 固定核心模块：`server`、`service`、`repository`。
 - `external-integration` 增加 `adapter`。
 - `published-client` 增加 `client`。
 - `feign-client` 增加 `client`、`feign-client`。
 - 平台来自批准的 `platform_configuration`；保留 YSS BOM、MyBatis-Plus，不固定单一 Boot/Java/Validation 命名空间。
-- 固定 architecture_profile=layered-mvc-service；verification_database=h2、production_database=not-bound。测试使用 H2，本地运行显式启用 scaffold-local；不引入外部驱动/数据源。
+- `mvc-data-analysis-v1` 固定 `server/core/client/repository/adapter/feign-client` 六模块，要求 `context_handoff_ref`、摘要和 `init_git=true`，复制批准的根 `CONTEXT.md`、治理资产和锁定工具包；不得从交接内容创造术语。该 Profile 仍绑定平台目录与构件证据，不再通过历史初始化器绕过平台门禁。
+- 两个 Profile 均固定 verification_database=h2、production_database=not-bound。测试使用 H2，本地运行显式启用 scaffold-local；不引入外部驱动/数据源。
 
 能力解析规则、模块职责和依赖方向见 [architecture.md](references/architecture.md)。生成器必须同时校验 `requested_capabilities` 与 `resolved_modules`，不得自行补猜模块。
 
@@ -69,7 +70,7 @@ node scripts/generate_and_verify_scaffold.mjs \
 ## 硬约束
 
 - 新生成只接受包含 API Contract Decision 的统一 schema v4；缺 API 字段的预发布 v4 不得静默接受。验证器可只读检查历史 Manifest v3，恢复必须另行完成所有权审计、技术/数据/API 设计补齐与当前批准。历史 v2/v3 均不用于新生成。
-- `architecture_family` 必须为 `layered-mvc`，`generator_skill` 必须为本 skill。
+- `architecture_family` 必须为 `layered-mvc`，`generator_skill` 必须为本 skill。历史 `yss-mvc-data-analysis-project-initializer` 合同必须返回 `skill-deprecated`、标记 `stale` 并重编译，不自动替换或继承批准。
 - 目标存在、`--force`、旧项目迁移、模板升级均为 `unsupported`。
 - Harness 内只允许以 `apps/backend/` 为输出父容器；外部实现仓库使用已登记真实路径。
 - 不生成业务示例。健康检查、上下文加载测试和架构测试只能验证机械工程能力，不定义用户可见 API。

package/template/.cursor/skills/yss-layered-mvc-scaffold-generator/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
   display_name: "YSS Layered MVC Scaffold Generator"
-  short_description: "Generate an approved YSS layered MVC backend skeleton."
-  default_prompt: "Use $yss-layered-mvc-scaffold-generator only after a user-confirmed architecture decision and a lifecycle-approved schema v4 scaffold contract with approved technical and data design prerequisites."
+  short_description: "Generate approved MVC service or data-analysis profiles."
+  default_prompt: "Use $yss-layered-mvc-scaffold-generator only after a user-confirmed architecture decision and a lifecycle-approved schema v4 contract; generate layered-mvc-service or the native mvc-data-analysis-v1 project profile exactly as bound."

package/template/.cursor/skills/yss-layered-mvc-scaffold-generator/references/architecture.md

@@ -11,6 +11,8 @@
 
 合同保存 `requested_capabilities`、`resolved_modules` 和 `resolution_version: 1`。模块按 `server`、`service`、`repository`、`adapter`、`client`、`feign-client` 的稳定顺序生成。
 
+`mvc-data-analysis-v1` 是本生成器的固定 Profile，不使用上述可选闭包：模块严格为 `server`、`core`、`client`、`repository`、`adapter`、`feign-client`。`core` 承载薄应用编排，不能依赖 `client`、Spring Web 或生产数据库驱动；CONTEXT handoff、project-instance 治理信封、同级 `skillUtils` 与独立 Git 必须在最终 rename 前完成。
+
 ## 职责和依赖
 
 | 模块 | 职责 | 允许依赖 |