create-yss-spec 3.4.6 → 3.4.8

package/template/.codex/skills/yss-ddd-scaffold-generator/scripts/run_first_slice_verification.mjs

@@ -8,33 +8,15 @@ import { fileURLToPath } from "node:url";
 
 import { run as runScaffoldVerification } from "./run_scaffold_verification.mjs";
 import { assertArchitectureAgreement } from "../../../../scripts/lib/backend-architecture.mjs";
-import { mvcFirstSliceProfile } from "../../../../scripts/lib/first-slice-architecture.mjs";
+import { inspectSliceContract } from "../../../../scripts/lib/slice-execution-preflight.mjs";
+import { selectSliceWorkUnit } from "../../../../scripts/lib/slice-contract.mjs";
+import { verifyFirstSliceTests } from "../../../../scripts/lib/first-slice-tests.mjs";
+import { inspectFirstSliceArtifacts } from "../../../../scripts/lib/first-slice-artifacts.mjs";
 
 const SCRIPT_DIR = path.dirname(fileURLToPath(import.meta.url));
 const REPOSITORY_ROOT = path.resolve(SCRIPT_DIR, "../../../..");
 const REQUIRED_SKILLS = ["yss-domain", "yss-application", "yss-repository", "yss-mybatis", "yss-web-controller", "yss-dto", "yss-exception", "yss-validation", "mapstruct", "lombok", "alibaba-java-code-style"];
 const REQUIRED_LAYERS = ["domain", "application", "infrastructure", "web"];
-const ARTIFACT_CHECKS = [
-  ["domain-model", /-domain\/src\/main\/java\/.+\/domain\/.+\/model\/.+\.java$/],
-  ["domain-gateway", /-domain\/src\/main\/java\/.+\/domain\/.+\/gateway\/.+Gateway\.java$/],
-  ["domain-behavior-test", /-domain\/src\/test\/java\/.+(?:Test|Tests)\.java$/],
-  ["application-command-or-query", /-application\/src\/main\/java\/.+\/application\/(?:command|query)\/.+\.java$/],
-  ["application-result", /-application\/src\/main\/java\/.+\/application\/result\/.+Result\.java$/],
-  ["application-service", /-application\/src\/main\/java\/.+\/application\/service\/.+Service\.java$/],
-  ["application-service-implementation", /-application\/src\/main\/java\/.+\/application\/service\/impl\/.+ServiceImpl\.java$/],
-  ["application-behavior-test", /-application\/src\/test\/java\/.+(?:Test|Tests)\.java$/],
-  ["infrastructure-po", /-infrastructure\/src\/main\/java\/.+\/infrastructure\/persistence\/po\/.+PO\.java$/],
-  ["infrastructure-repository", /-infrastructure\/src\/main\/java\/.+\/infrastructure\/persistence\/repository\/.+Repository\.java$/],
-  ["infrastructure-convertor", /-infrastructure\/src\/main\/java\/.+\/infrastructure\/persistence\/convertor\/.+Convertor\.java$/],
-  ["infrastructure-gateway-implementation", /-infrastructure\/src\/main\/java\/.+\/infrastructure\/persistence\/gateway\/.+GatewayImpl\.java$/],
-  ["infrastructure-query-adapter", /-infrastructure\/src\/main\/java\/.+\/infrastructure\/query\/adapter\/.+QueryAdapter\.java$/],
-  ["infrastructure-integration-test", /-infrastructure\/src\/test\/java\/.+(?:Test|Tests)\.java$/],
-  ["web-controller", /-adapter\/.+-web\/src\/main\/java\/.+\/rest\/.+Controller\.java$/],
-  ["web-convertor", /-adapter\/.+-web\/src\/main\/java\/.+\/rest\/convertor\/.+WebConvertor\.java$/],
-  ["web-request", /-adapter\/.+-web\/src\/main\/java\/.+\/rest\/dto\/request\/.+Request\.java$/],
-  ["web-response", /-adapter\/.+-web\/src\/main\/java\/.+\/rest\/dto\/response\/.+Response\.java$/],
-  ["web-contract-test", /-adapter\/.+-web\/src\/test\/java\/.+(?:Test|Tests)\.java$/]
-];
 
 const isoNow = () => new Date().toISOString();
 const sha256 = (content) => createHash("sha256").update(content).digest("hex");
@@ -62,60 +44,7 @@ async function writeJsonAtomic(target, value) {
   await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, "utf8");
   await rename(temporary, target);
 }
-function invalidContractReasons(contract, requiredSkills = REQUIRED_SKILLS, requiredLayers = REQUIRED_LAYERS) {
-  const reasons = [];
-  if (contract.schema_version !== 2) reasons.push("slice-contract-schema");
-  if (contract.status !== "approved") reasons.push("slice-contract-not-approved");
-  for (const field of ["contract_id", "contract_version", "slice_id"]) if (contract[field] === undefined || contract[field] === null || contract[field] === "") reasons.push(`slice-contract-${field}-missing`);
-  if (contract.readiness?.blockers?.length) reasons.push("slice-contract-has-blockers");
-  if (contract.readiness?.stale_inputs?.length) reasons.push("slice-contract-has-stale-inputs");
-  const actualSkills = new Set([...(contract.common?.required_skills ?? []), ...(contract.backend?.required_skills ?? [])]);
-  for (const skill of requiredSkills) if (!actualSkills.has(skill)) reasons.push(`required-skill-missing:${skill}`);
-  const actualLayers = new Set(contract.backend?.affected_layers ?? []);
-  for (const layer of requiredLayers) if (!actualLayers.has(layer)) reasons.push(`required-layer-missing:${layer}`);
-  if (!Array.isArray(contract.work_units) || !contract.work_units.length) reasons.push("slice-contract-work-units-missing");
-  else for (const [index, unit] of contract.work_units.entries()) {
-    const id = unit.id || `index-${index}`;
-    if (unit.contract_id !== contract.contract_id) reasons.push(`work-unit-contract-id-mismatch:${id}`);
-    if (unit.contract_version !== contract.contract_version) reasons.push(`work-unit-contract-version-mismatch:${id}`);
-    if (!unit.work_unit?.primary_skill) reasons.push(`work-unit-primary-skill-missing:${id}`);
-  }
-  return reasons;
-}
-async function downstreamDrift(manifest, requiredSkills = REQUIRED_SKILLS) {
-  const drift = [];
-  const recordedSkills = manifest.readiness?.downstream_skills ?? {};
-  for (const skill of requiredSkills) {
-    const expected = recordedSkills[skill];
-    if (typeof expected !== "string" || !/^[a-f0-9]{64}$/.test(expected)) {
-      drift.push(`${skill}:digest-missing`);
-      continue;
-    }
-    const root = path.join(REPOSITORY_ROOT, ".agents", "skills", skill);
-    if (!await isFile(path.join(root, "SKILL.md"))) drift.push(`${skill}:unavailable`);
-    else if (await treeDigest(root) !== expected) drift.push(`${skill}:digest-mismatch`);
-  }
-  const contracts = manifest.readiness?.contracts ?? {};
-  const contractFiles = {
-    compiler_contract: path.join(REPOSITORY_ROOT, ".agents", "skills", "yss-implementation-contract-compiler", "references", "compiler-contract.yaml")
-  };
-  if (manifest.architecture_family === "layered-mvc") {
-    contractFiles.architecture_profiles = path.join(REPOSITORY_ROOT, "docs/agents/backend-architecture-profiles.md");
-  } else if (contracts.engineering_baseline) contractFiles.engineering_baseline = path.join(REPOSITORY_ROOT, ".agents", "skills", "yss-ddd-scaffold-generator", "references", "engineering-baseline.md");
-  else contractFiles.scaffold_parent = path.join(REPOSITORY_ROOT, ".agents", "skills", "yss-ddd-scaffold-generator", "references", "yss-backend-scaffold-parent", "SKILL.md");
-  for (const [name, target] of Object.entries(contractFiles)) {
-    const expected = contracts[name];
-    if (typeof expected !== "string" || !/^[a-f0-9]{64}$/.test(expected)) {
-      drift.push(`${name}:digest-missing`);
-      continue;
-    }
-    if (!await isFile(target)) drift.push(`${name}:unavailable`);
-    else if (sha256(await readFile(target)) !== expected) drift.push(`${name}:digest-mismatch`);
-  }
-  return drift;
-}
-
-export async function runFirstSliceVerification(projectRoot, evidenceDir, sliceContractFile, environment = process.env) {
+export async function runFirstSliceVerification(projectRoot, evidenceDir, sliceContractFile, environment = process.env, options = {}) {
   projectRoot = path.resolve(projectRoot);
   evidenceDir = path.resolve(evidenceDir);
   sliceContractFile = path.resolve(sliceContractFile);
@@ -124,20 +53,33 @@ export async function runFirstSliceVerification(projectRoot, evidenceDir, sliceC
   if (!await isFile(manifestPath)) throw new Error(`missing scaffold manifest: ${manifestPath}`);
   if (!await isFile(sliceContractFile)) throw new Error(`missing Slice Implementation Contract: ${sliceContractFile}`);
   const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
-  const contract = JSON.parse(await readFile(sliceContractFile, "utf8"));
+  const contractRoot = path.resolve(options.contractRoot || projectRoot);
+  let contract, preflight;
+  try {
+    const loaded = inspectSliceContract(path.relative(contractRoot, sliceContractFile), {
+      root: contractRoot, approval_ref: options.approvalRef, work_unit_id: options.workUnit
+    });
+    preflight = loaded.report;
+    contract = selectSliceWorkUnit(loaded.contract, options.workUnit);
+  } catch (error) {
+    preflight = { execution_allowed: false, blockers: [error.message] };
+    contract = {};
+  }
   if (manifest.platform_verification === "candidate") throw new Error("backend-platform: candidate scaffold cannot become first-slice-verified");
-  const adapter = manifest.architecture_family === "layered-mvc" ? mvcFirstSliceProfile(manifest.architecture_identity ?? {}) : { skills: REQUIRED_SKILLS, layers: REQUIRED_LAYERS, artifacts: ARTIFACT_CHECKS };
-  const contractFailures = invalidContractReasons(contract, adapter.skills, adapter.layers);
+  const contractFailures = [...preflight.blockers];
+  if (!preflight.execution_allowed) contractFailures.push("slice-execution-not-authorized");
+  if (!(contract.common?.project_roots || []).some(ref => path.resolve(contractRoot, ref) === projectRoot)) contractFailures.push("slice-project-root-mismatch");
   try {
     const identity = contract.architecture_identity ?? contract.resolution?.architecture_identity;
-    assertArchitectureAgreement(identity, { manifest });
+    if (identity?.source_kind !== "existing-registration") assertArchitectureAgreement(identity, { manifest });
     for (const unit of contract.work_units ?? []) assertArchitectureAgreement(identity, { work_unit: unit.architecture_identity });
   } catch (error) { contractFailures.push(`architecture-identity:${error.message}`); }
   if (![2, 3, 4].includes(manifest.schema_version) || manifest.completion_level !== "empty-scaffold-verified") contractFailures.push("scaffold-not-empty-scaffold-verified");
   if (manifest.schema_version === 3 && manifest.legacy_reconciliation?.status !== "approved") contractFailures.push("legacy-scaffold-reconciliation-required");
-  const projectFiles = await files(projectRoot);
-  const missingArtifacts = adapter.artifacts.filter(([, pattern]) => !projectFiles.some((file) => pattern.test(file))).map(([name]) => name);
-  const skillDrift = await downstreamDrift(manifest, adapter.skills);
+  const artifacts = inspectFirstSliceArtifacts(contract, projectRoot);
+  const missingArtifacts = artifacts.failures;
+  // Generation-time Skill hashes are provenance. Current authority was checked by execution preflight.
+  const skillDrift = [];
   if (contractFailures.length || missingArtifacts.length || skillDrift.length) {
     const report = { verification_mode: "first-slice", project_root: projectRoot, slice_contract_ref: sliceContractFile, scaffold_manifest_ref: manifestPath, generated_at: isoNow(), status: "failed", completion_level: manifest.completion_level, contract_failures: contractFailures, missing_artifacts: missingArtifacts, downstream_skill_drift: skillDrift, commands: [] };
     await writeJsonAtomic(reportPath, report);
@@ -145,9 +87,15 @@ export async function runFirstSliceVerification(projectRoot, evidenceDir, sliceC
   }
 
   const mavenEvidence = path.join(evidenceDir, "maven");
-  const wrapper = await runScaffoldVerification(projectRoot, mavenEvidence, environment, { firstSlice: true });
-  const passed = wrapper.status === "passed";
-  const report = { verification_mode: "first-slice", project_root: projectRoot, slice_contract_ref: sliceContractFile, scaffold_manifest_ref: manifestPath, generated_at: isoNow(), status: passed ? "passed" : "failed", failure_category: wrapper.failure_category, completion_level: passed ? "first-slice-verified" : manifest.completion_level, contract_failures: [], missing_artifacts: [], downstream_skill_drift: [], commands: wrapper.commands };
+  const startedAt = Date.now();
+  const wrapper = await runScaffoldVerification(projectRoot, mavenEvidence, environment, { firstSlice: true, systemProperties: artifacts.properties });
+  const mvc = manifest.architecture_family === "layered-mvc";
+  const tests = wrapper.status === "passed" ? verifyFirstSliceTests(contract, projectRoot, startedAt, {
+    module: `${manifest.project_name}-${mvc ? "server" : "bootstrap"}`,
+    type: `${manifest.base_package}.${mvc ? "architecture.LayeredMvcArchitectureTest" : "ArchitectureRulesTest"}`
+  }) : { status: "not-executed", failures: [], evidence: [] };
+  const passed = wrapper.status === "passed" && tests.status === "passed";
+  const report = { verification_mode: "first-slice", project_root: projectRoot, slice_contract_ref: sliceContractFile, scaffold_manifest_ref: manifestPath, generated_at: isoNow(), status: passed ? "passed" : "failed", test_execution: tests, failure_category: wrapper.failure_category || (tests.status === "failed" ? "first-slice-tests" : null), completion_level: passed ? "first-slice-verified" : manifest.completion_level, contract_failures: [], missing_artifacts: [], downstream_skill_drift: [], commands: wrapper.commands };
   await writeJsonAtomic(reportPath, report);
   if (passed) {
     manifest.completion_level = "first-slice-verified";
@@ -163,7 +111,7 @@ function parseArgs(argv) {
   const result = {};
   for (let index = 0; index < argv.length; index += 2) {
     const flag = argv[index], value = argv[index + 1];
-    if (!["--project-root", "--evidence-dir", "--slice-contract-file"].includes(flag) || !value) throw new Error("usage: run_first_slice_verification.mjs --project-root DIR --evidence-dir DIR --slice-contract-file FILE");
+    if (!["--project-root", "--evidence-dir", "--slice-contract-file", "--contract-root", "--approval-ref", "--work-unit"].includes(flag) || !value) throw new Error("usage: run_first_slice_verification.mjs --project-root DIR --evidence-dir DIR --slice-contract-file FILE");
     result[flag.slice(2).replaceAll(/-([a-z])/g, (_, letter) => letter.toUpperCase())] = value;
   }
   if (!result.projectRoot || !result.evidenceDir || !result.sliceContractFile) throw new Error("project root, evidence dir, and slice contract file are required");
@@ -173,7 +121,7 @@ function parseArgs(argv) {
 async function main() {
   try {
     const args = parseArgs(process.argv.slice(2));
-    const report = await runFirstSliceVerification(args.projectRoot, args.evidenceDir, args.sliceContractFile);
+    const report = await runFirstSliceVerification(args.projectRoot, args.evidenceDir, args.sliceContractFile, process.env, args);
     process.stdout.write(`${report.status}: ${path.join(path.resolve(args.evidenceDir), "first-slice-verification.json")}\n`);
     return report.status === "passed" ? 0 : 1;
   } catch (error) {

package/template/.codex/skills/yss-ddd-scaffold-generator/scripts/run_scaffold_verification.mjs

@@ -62,7 +62,7 @@ function validateManifest(manifest) {
   if (manifest.schema_version === 4 ? manifest.current_version !== true : manifest.current_version !== manifest.contract_version) throw new Error("脚手架生成元数据清单不是当前合同版本");
   if (JSON.stringify(manifest.verification_commands) !== JSON.stringify(COMMANDS)) throw new Error("脚手架生成元数据清单验证命令不符合固定合同");
 }
-export async function run(projectRoot, evidenceDir, environment = process.env, { timeoutMs = 0, signal, platformOptions = {}, firstSlice = false } = {}) {
+export async function run(projectRoot, evidenceDir, environment = process.env, { timeoutMs = 0, signal, platformOptions = {}, firstSlice = false, systemProperties = {} } = {}) {
   const wrapper = path.join(projectRoot, "mvnw"), manifestPath = path.join(projectRoot, ".yss", "scaffold-generation.json");
   if (!await isFile(wrapper)) throw new Error(`项目根目录缺少 Maven wrapper: ${wrapper}`);
   if (!await isFile(manifestPath)) throw new Error(`项目根目录缺少脚手架生成元数据清单: ${manifestPath}`);
@@ -114,13 +114,14 @@ export async function run(projectRoot, evidenceDir, environment = process.env, {
     const stderrPath = path.join(evidenceDir, `mvnw-${phase}.stderr.log`);
     const startedAt = isoNow();
     const started = process.hrtime.bigint();
-    const execution = await runCommand(wrapper, [phase], { cwd: projectRoot, env: environment, timeoutMs, signal, stdoutFile: stdoutPath, stderrFile: stderrPath, secrets: [environment.MAVEN_REPO_USERNAME, environment.MAVEN_REPO_PASSWORD], progress: true });
+    const args = [phase, ...Object.entries(systemProperties).map(([key, value]) => `-D${key}=${value}`)];
+    const execution = await runCommand(wrapper, args, { cwd: projectRoot, env: environment, timeoutMs, signal, stdoutFile: stdoutPath, stderrFile: stderrPath, secrets: [environment.MAVEN_REPO_USERNAME, environment.MAVEN_REPO_PASSWORD], progress: true });
     const outcome = { ...execution, exitCode: execution.status };
     const durationMs = Number(process.hrtime.bigint() - started) / 1e6;
     await writeText(stdoutPath, redactSecrets(outcome.stdout, environment));
     await writeText(stderrPath, redactSecrets(outcome.stderr, environment));
     commands.push({
-      command: `./mvnw ${phase}`,
+      command: `./mvnw ${args.join(" ")}`,
       phase,
       exit_code: outcome.exitCode,
       failure_category: outcome.termination || classifyFailure(phase, outcome),

package/template/.codex/skills/yss-design-system/SKILL.md

@@ -26,7 +26,7 @@ description: Use when YSS 产品设计系统与 Ant Design 企业级 UI 风格
 2. 读取已有资产：先读根 `DESIGN.md`，再读 `docs/design/design.md` 和 Token 派生快照，最后按任务读取相关 Spec、交互说明、状态矩阵、OpenAPI Draft、现有页面代码。
 3. 按设计系统基线约束输出或修改产物：颜色、排版、间距、圆角、动效、组件、状态、响应式。
 4. 若是产品设计阶段，先使用 `yss-prototype-stage`；规范直出由 YSS HTML adapter 执行；存在已选视觉稿时条件使用 `product-design:index`，其他 Agent 交付等价证据。
-5. 若是前端实现阶段，配合 `yss-ui`、`yss-ui-business-page-generation`、`component-selection-imports`、`yss-formily` 及实际命中的组件专项，但本技能负责风格与体验一致性门禁。
+5. 若是前端实现阶段，配合 `yss-ui`、`yss-ui-business-page-generation`、`yss-formily` 及实际命中的组件专项，但本技能负责风格与体验一致性门禁。
 6. 若发现视觉 Token 或组件变体不足，先更新根 `DESIGN.md` 并重新生成投影；只有治理、流程或验收说明不足时才更新 `docs/design/design.md`。
 
 ## 核心基线
@@ -89,7 +89,7 @@ description: Use when YSS 产品设计系统与 Ant Design 企业级 UI 风格
 | 低保真线框或流程图 | 语义草图或 HTML；设计工具按需使用 |
 | 前端页面实现 | `yss-ui` / `yss-ui-business-page-generation` |
 | 表单 schema | `yss-formily` |
-| YTable / YTree / 高度自适应 | `ytable-usage` / `ytree-usage` / `yss-use-table-height` / `yss-use-tree-height` |
+| YTable / YEditTable / YTree / 高度自适应 | `ytable-usage` / `yedit-table-usage` / `ytree-usage` |
 | 原型交接前的六轴 QA | 规范直出由 YSS adapter 按 design-contract 验收；独立视觉稿才条件使用 design-qa 比对，项目 Token 优先 |
 | 原型渲染适配 | `yss-prototype-stage/references/product-design-adapter.md`；H1/H2 统一 HTML 交付、分别验证视觉与可操作流程；不得调用 `yss-ui` |
 | API 契约 / 接入 | `yss-openapi-governance` / `yss-api-integration` |

package/template/.codex/skills/yss-domain/references/domain-layer-guide.md

@@ -62,7 +62,7 @@ public interface QualityTemplateGateway {
 - `*VO`、`PageResult`、Repository PO。
 - MyBatis、Spring MVC、Jackson、Swagger 类型。
 
-分页、列表和投影查询由 Application Query Port 定义，Infrastructure 实现。
+展示分页、列表和投影查询由 Application Query Port 定义，Infrastructure 实现。
 
 ## 5. Domain Error
 
@@ -99,3 +99,10 @@ Web Exception Translator 再将它映射为批准的状态码、错误码和消
 - 返回 YSS Skill Execution Result，包含 Domain 文件、行为测试、ArchUnit 结果及实际 `./mvnw ...` 证据。
 - 新聚合、不变量、状态机或跨上下文影响进入 `new_impacts` 并暂停。
 - 检测到旧架构时返回 `unsupported`；如需现代化，退出 scaffold 工作流并单独立项评估。
+
+## 聚合创建与重建
+
+- 创建入口执行当前创建规则；持久化重建入口恢复已批准状态并校验结构不变量，不重复发送创建事件、生成身份或执行外部调用。两者不得通过公开任意 setter 混为一体。
+- 值对象按值相等；聚合按稳定身份相等。集合对外只读，修改经业务方法；Java 8 使用普通类与防御性复制，不从示例推导 record 等高版本语法。
+- 领域错误携带稳定标识与参数；公开消息和 HTTP 状态由 Web 翻译。测试通过公开行为覆盖非法状态、重复动作和重建后语义一致性。
+- 为业务决策加载一个或一组聚合仍可使用 Domain Gateway；展示列表、分页、排序、统计和投影走 Application Query Port。返回 List 本身不是违规，须按调用目的判定。

package/template/.codex/skills/yss-formily/SKILL.md

@@ -18,10 +18,10 @@ description: 路由 YSS UI 业务页面中的 YFormily 场景；当查询、编
 | 字段显隐、值联动、异步 effects、跨字段副作用 | `formily-linkage-effects` |
 | 新增、编辑、查看模式，详情插槽或 disabled 规则 | `formily-mode-slot-detail` |
 | 分步录入、跨步骤校验、步骤状态 | `formily-step-flow` |
-| Modal / Drawer 的打开、回填、保存、关闭和回退 | `page-form-module` |
+| Modal / Drawer 的打开、回填、保存、关闭和回退 | `yss-ui-business-page-generation` 负责页面容器编排，并加载 `formily-foundation` 与实际命中的模式/联动专项 |
 | 从自然语言、截图或 Figma 生成 schema | `yss-formily-schema-generator` |
 
-一个任务可以同时加载多个专项 Skill。`page-form-module` 只在页面容器生命周期命中时加载，不作为本技能的固定依赖。
+一个任务可以同时加载多个专项 Skill。页面容器生命周期不是本技能的固定依赖；仅当任务是完整业务页面或弹层闭环时加载 `yss-ui-business-page-generation`。
 
 ## 边界
 

package/template/.codex/skills/yss-frontend-scaffold-generator/SKILL.md

@@ -71,7 +71,7 @@ packages/package.json
 - 不携带 Data Quality 业务页面、默认管理员、生产接口、私网 Postman 同步、部署凭证或残缺 JSP 命令；当前支持 Qiankun 与 standalone，JSP 不在可用基线内。
 - 不得把 `apps/frontend/` 容器根登记为项目根；Harness 内每个前端项目必须有独立的 `apps/frontend/<project>/` 路径。
 - 不把模板示例页面当作业务功能交付。
-- 生成后仍需使用 `yss-ui-business-page-generation`、`component-selection-imports`、`yss-api-integration` 以及实际命中的表格、树、Formily 等专项 skill 实现业务页面。
+- 生成后仍需使用 `yss-ui`、`yss-ui-business-page-generation`、`yss-api-integration` 以及实际命中的表格、树、Formily 等专项 skill 实现业务页面。
 
 ## Output
 

package/template/.codex/skills/yss-frontend-scaffold-generator/assets/data-quality-v1/README.md

@@ -2,7 +2,7 @@
 
 Data Quality v1 通用骨架：Vue 3 / Ant Design Vue 4 / YSS UI，默认浅色、14px 正文、32px 控件。`packages/` 是应用根。YSS 按需注册，新增页面再按实现合同引入表格或表单组件。骨架不含业务页面、用户权限、生产 API 地址或部署凭证。
 
-使用 Node >=22.12、pnpm 10.15、TypeScript5.9.3；在用户级 npm 配置中设置企业 @yss-ui registry 和认证，然后运行 `pnpm install --frozen-lockfile`。检查使用 `pnpm lint:check`、`pnpm type-check`、`pnpm build` 和 `pnpm build:standalone`。
+使用 Node >=22.12、pnpm 12.4.2、TypeScript5.9.3；在用户级 npm 配置中设置企业 @yss-ui registry 和认证，然后运行 `pnpm install --frozen-lockfile`。检查使用 `pnpm lint:check`、`pnpm type-check`、`pnpm build` 和 `pnpm build:standalone`。
 
 `pnpm dev` 独立预览；Qiankun 注册名为 `__MICROAPP_NAME__`、默认激活路由 `__BASE_ROUTE__`，门户传入 `container` / `routerBase` / `bridgeVersion: 1` / `themeConfig.mode`。资源部署路径由 `VITE_PUBLIC_BASE` 明确设置，不能从路由猜测。复制 `packages/.env.example` 到 `.env.local` 配置本地代理。
 

package/template/.codex/skills/yss-frontend-scaffold-generator/assets/data-quality-v1/package.json

@@ -2,10 +2,10 @@
   "name": "__APP_NAME__",
   "private": true,
   "type": "module",
-  "packageManager": "pnpm@10.15.0",
+  "packageManager": "pnpm@12.4.2",
   "engines": {
     "node": ">=22.12.0",
-    "pnpm": ">=10.15.0 <11"
+    "pnpm": ">=12.4.2 <13"
   },
   "scripts": {
     "dev": "pnpm -C packages dev",

package/template/.codex/skills/yss-frontend-scaffold-generator/assets/data-quality-v1/pnpm-lock.yaml

@@ -1,3 +1,161 @@
+---
+lockfileVersion: '9.0'
+
+importers:
+
+  .:
+    configDependencies: {}
+    packageManagerDependencies:
+      pnpm:
+        specifier: 12.4.2
+        version: 12.4.2
+
+packages:
+
+  '@pnpm/exe.android-arm64@12.4.2':
+    resolution: {integrity: sha512-E255MbcQ0V1577M2BV0ajWuP7KmTPYA0jqZnk3rK6Lq3kTvZWulMMb7iqRmnLsQbyWTkMEB2CfyM70loVDA8xg==}
+    cpu: [arm64]
+    os: [android]
+
+  '@pnpm/exe.android-x64@12.4.2':
+    resolution: {integrity: sha512-J1pSeCUwuKxMG70ZzpWn8JzElxiEa8NN/3N0SlZRtU2xbztChaJCKF3HaBNIj9yPfeofWzJo/lwNvDDjraQuZw==}
+    cpu: [x64]
+    os: [android]
+
+  '@pnpm/exe.darwin-arm64@12.4.2':
+    resolution: {integrity: sha512-A0WDo8iErfZBXgrLseQxw8i8Y9ctUpOEl/Uu+cubnTzpD8tT9ykIB548L8YTM2WD4OS+ZOHSxy8aGZcvKq8PaQ==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@pnpm/exe.darwin-x64@12.4.2':
+    resolution: {integrity: sha512-MSgJdovBWHcb5DEOvfPH9yNi/T5O1Xa4ess+E1ESGo/5yuty7S4JoiIjami+fsNXfnoQMlwsMUqYU4zAvBcNCw==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@pnpm/exe.freebsd-x64@12.4.2':
+    resolution: {integrity: sha512-h2YumlQSNvgbRPv+RXwABohX65f9bOBZn+jMIt7bFDISZPCzQ+Nvpt6Awbp4ip5PwQgYxbu5iREJ1fHE39Fm8A==}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@pnpm/exe.linux-arm64-musl@12.4.2':
+    resolution: {integrity: sha512-LwSEtSEDTv6S51YLs3YvSkPyun/QmfMic1UGICUkPWFu6ByP43RdMlkKvmVkfGhAYCpnxO057vrmyJqtfZrPCA==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@pnpm/exe.linux-arm64@12.4.2':
+    resolution: {integrity: sha512-2dSiDXyhx+RTHsewxex8f/jVjqQXWJ2oow4kCVHEWdZKeBpgMxvZ6fHkTAUBJXgqhbKIDHvuNlZBP7gJfUWL5A==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-ppc64@12.4.2':
+    resolution: {integrity: sha512-8Itc+jQk+MTz04LS9D1RcH+VctAWmzM4l1cJQ+Sx7pAJNo7EKHdRMbC0Tok1jyQ7eEHNJZD5EleYneZqWfZM+g==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-riscv64@12.4.2':
+    resolution: {integrity: sha512-hleOeqhTVpH+z9RVMGnxvU4ZnrkBUClWjCbHD9u6kwyqhGSpevoU1wTGish+CBRhmIgMAy9pAfFpqhbAKOKNfw==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-s390x@12.4.2':
+    resolution: {integrity: sha512-LAsQRRdP9aToENR6dtcIJ9l+e1zMYOX0tQcLGpRyLPVBQcYRLlvAPcmDshsiIHQjp05SDa9FI0czX1ZQ1a7a/A==}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-x64-musl@12.4.2':
+    resolution: {integrity: sha512-kzfzH2/0BWdTABK14Yj5a1xsdkTEQUp2eXEPNakaD9jKL025lq3hyaKHIz/gIZaPDMe/1bFFK/En4ztFlbBJxw==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@pnpm/exe.linux-x64@12.4.2':
+    resolution: {integrity: sha512-/pbt0UVTa8NMDhzOWLQRfZ6G9ROKXlJPZtx845BqyWfc7hCrWXhTLBd70yO2y8+E+IWN3oHM1s/JsIQNGk1yvg==}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.win32-arm64@12.4.2':
+    resolution: {integrity: sha512-PsW19e4dAUNpZ0cS9flaxFuAmpt2dKlH/Vvi8TZ4qyJjjQzue/CEsWm+6wKVP4CJ7IT8RdL4qh+soOPWIgF2Zw==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@pnpm/exe.win32-x64@12.4.2':
+    resolution: {integrity: sha512-+xGoeE0g55ztWvl8i5QqdmNfW3nIrTVcoQrNshEOwxthm9Ag48oXton3uxOA3/SANyz5AXexEjj2KO20NnOrEw==}
+    cpu: [x64]
+    os: [win32]
+
+  pnpm@12.4.2:
+    resolution: {integrity: sha512-CK3GYTGAJ1x8ntraOdzwjJxhrU5+rzMKTzRh8QKw+QdCNFTRF/mOctR/7wYWBwZE17/8lzpqV/UJCm18NosHyQ==}
+    engines: {node: '>=18.*'}
+    hasBin: true
+
+snapshots:
+
+  '@pnpm/exe.android-arm64@12.4.2':
+    optional: true
+
+  '@pnpm/exe.android-x64@12.4.2':
+    optional: true
+
+  '@pnpm/exe.darwin-arm64@12.4.2':
+    optional: true
+
+  '@pnpm/exe.darwin-x64@12.4.2':
+    optional: true
+
+  '@pnpm/exe.freebsd-x64@12.4.2':
+    optional: true
+
+  '@pnpm/exe.linux-arm64-musl@12.4.2':
+    optional: true
+
+  '@pnpm/exe.linux-arm64@12.4.2':
+    optional: true
+
+  '@pnpm/exe.linux-ppc64@12.4.2':
+    optional: true
+
+  '@pnpm/exe.linux-riscv64@12.4.2':
+    optional: true
+
+  '@pnpm/exe.linux-s390x@12.4.2':
+    optional: true
+
+  '@pnpm/exe.linux-x64-musl@12.4.2':
+    optional: true
+
+  '@pnpm/exe.linux-x64@12.4.2':
+    optional: true
+
+  '@pnpm/exe.win32-arm64@12.4.2':
+    optional: true
+
+  '@pnpm/exe.win32-x64@12.4.2':
+    optional: true
+
+  pnpm@12.4.2:
+    optionalDependencies:
+      '@pnpm/exe.android-arm64': 12.4.2
+      '@pnpm/exe.android-x64': 12.4.2
+      '@pnpm/exe.darwin-arm64': 12.4.2
+      '@pnpm/exe.darwin-x64': 12.4.2
+      '@pnpm/exe.freebsd-x64': 12.4.2
+      '@pnpm/exe.linux-arm64': 12.4.2
+      '@pnpm/exe.linux-arm64-musl': 12.4.2
+      '@pnpm/exe.linux-ppc64': 12.4.2
+      '@pnpm/exe.linux-riscv64': 12.4.2
+      '@pnpm/exe.linux-s390x': 12.4.2
+      '@pnpm/exe.linux-x64': 12.4.2
+      '@pnpm/exe.linux-x64-musl': 12.4.2
+      '@pnpm/exe.win32-arm64': 12.4.2
+      '@pnpm/exe.win32-x64': 12.4.2
+
+---
 lockfileVersion: '9.0'
 
 settings:

package/template/.codex/skills/yss-frontend-scaffold-generator/references/data-quality-v1.manifest.json

@@ -17,10 +17,10 @@
     ".gitignore": "sha256:fb8288522033f645a728dfb53cef24a11824bdbec858b93279d4809924b4539d",
     ".npmrc.example": "sha256:cee4433295152854b58babea9072215a2d84b8de086d218b15ffb7e84f1fe9e1",
     "DESIGN.md": "sha256:e84a6c175840efe9663a2d0aba37f5635c053f47452bb146d1025d65665b1bec",
-    "README.md": "sha256:6d8ed1aed45267f3c581733a7d12b0b891dc94c800d1416a0b172355031b4b96",
+    "README.md": "sha256:745bd31b3397876fc239bde12378bc265a1a8d1626159f188de76873951d471a",
     "micro-config.json": "sha256:8266b0eb806696d6bb2023a0d1e72113cdffc355bb0fafd8b2095d727f827711",
     "orval.config.ts": "sha256:d918458e4ee972ae94740899dd15701530bdc31fd758240fc00e96aba3ba9b3a",
-    "package.json": "sha256:29cd516ba688ae3a3625b4f3a3921c47825134cff27622732ef942c4129c7222",
+    "package.json": "sha256:51a73185fac255062e4f3eaa415017f9c9886d5e3aac4ff483694c49ae810ba7",
     "packages/.env.development": "sha256:e698b56d83ad282c221e2c8067bc4e3e90789c610fd31da2489bd3ac2d8efc5f",
     "packages/.env.example": "sha256:b8cf60af269af3f4dc3c167df88045af949683b302bd9b77e50fb77fa1adf81f",
     "packages/.env.production": "sha256:b0a96ab02559a99fc95c37b967f604675686c8de336731a1721d54f43b047249",
@@ -43,7 +43,7 @@
     "packages/src/views/Welcome.vue": "sha256:0498edee6e25b45644a2d12c6fded1e3c0fda830c9196d4fc5389b94fb1a0e0d",
     "packages/tsconfig.json": "sha256:40e27bb07cd4ae8c0c636b5d9581fe378d00e21acb28423cc2a08bfa1a67c11f",
     "packages/vite.config.ts": "sha256:d3c1775bdca54e1b0f2b267a7dae992cc61836891588e93e02caa49184cb2ab2",
-    "pnpm-lock.yaml": "sha256:dd05bbc9c948cb47de017fa215806d04f0f9f143d3c953b43076a62e5fd85d9b",
+    "pnpm-lock.yaml": "sha256:ddab6b19cb74c769ba1cd3854d3eb0649843e8136811b7cbf2800c3084f73949",
     "pnpm-workspace.yaml": "sha256:d5cdbd2e0a167297976d11695d1593a4e71694ed462120569e20e98fd9c63fbe"
   }
 }

package/template/.codex/skills/yss-frontend-scaffold-generator/scripts/scaffold-generator.test.mjs

@@ -66,6 +66,11 @@ const saveBundle = () => writeFileSync(contractFile, JSON.stringify(bundle));
 saveBundle();
 const bundled = generate({ contractFile, outputDir: bundle.target_output_dir });
 assert.equal(bundled.template.checkout, undefined);
+const bundledPackage = JSON.parse(readFileSync(path.join(bundle.target_output_dir, 'package.json')));
+assert.equal(bundledPackage.packageManager, 'pnpm@12.4.2');
+assert.equal(bundledPackage.engines.node, '>=22.12.0');
+assert.equal(bundledPackage.engines.pnpm, '>=12.4.2 <13');
+assert.match(readFileSync(path.join(bundle.target_output_dir, 'README.md'), 'utf8'), /pnpm 12\.4\.2/);
 assert.equal(JSON.parse(readFileSync(path.join(bundle.target_output_dir, 'packages/package.json'))).dependencies['ant-design-vue'], '4.2.6');
 assert.equal(JSON.parse(readFileSync(path.join(bundle.target_output_dir, 'packages/src/config/theme.json'))).algorithm, 'default');
 for (const forbidden of ['.npmrc', 'node_modules', '.git', 'packages/src/views/datasource/index.vue', 'scripts/sync-openapi.js']) assert.equal(existsSync(path.join(bundle.target_output_dir, forbidden)), false, forbidden);

package/template/.codex/skills/yss-hook/SKILL.md

@@ -13,7 +13,7 @@ description: Use when YSS Vue 页面涉及 vue-hooks-plus/useRequest、分页、
 - Vue Hooks Plus `useRequest`: `https://inhiblabcore.github.io/vue-hooks-plus/zh/hooks/useRequest/quick-start`
 - Local reference index: `references/frontend-docs.md`
 
-本技能负责请求执行、分页/筛选参数、选择状态、响应映射和页面级调度。接口导入与 Orval mutator 使用 `yss-api-integration`；页面布局和组件选型从 `yss-ui` 路由到 `page-skeleton`、`component-selection-imports` 及具体组件 Skill；高度计算分别使用 `yss-use-table-height` 或 `yss-use-tree-height`。
+本技能负责请求执行、分页/筛选参数、选择状态、响应映射、异步竞态和页面级调度。接口导入与 Orval mutator 使用 `yss-api-integration`；页面布局和组件选型从 `yss-ui` 路由到 `yss-ui-business-page-generation` 及具体组件 Skill；表格和树高度分别服从 `ytable-usage`、`yedit-table-usage`、`ytree-usage`。
 
 官方 `@yss-ui/hooks` 当前公开 `useFullscreen`、`useTreeHeight`、`useTableHeight`、`useLoading`、`usePollingTask` 与 `useUrlState`。`useRequest`、防抖、缓存或重试不属于这套公开 YSS Hooks 契约。仅当项目已批准 `vue-hooks-plus` 及其具体版本时，才可使用第 3 节的 `useRequest`；不得把它命名或包装成 YSS 官方 API。
 
@@ -34,6 +34,7 @@ description: Use when YSS Vue 页面涉及 vue-hooks-plus/useRequest、分页、
 - 将请求执行、参数合并、响应映射与数据竞争处理放在 `hooks/useXxx.ts`；页面只保留布局、事件绑定和渲染。
 - 以业务域划分 Hook，而不是为每个微小工具函数各建一个 Hook。
 - 每个对外动作都必须有明确的 loading、成功、失败和数据陈旧策略；不要把这些分支留给模板或页面组件。
+- 组件内不直接修改 `props`；双向绑定使用 `emit('update:xxx')`。模板不承载复杂业务表达式，优先下沉 `computed` 或业务 Hook；避免无边界的深层 `watch`，只观察明确依赖源。
 
 ## 2. 列表 / 分页 Hook
 
@@ -185,7 +186,7 @@ const polling = usePollingTask(async ({ isCurrent, signal }) => {
 
 - `useUrlState()`：返回扁平字符串 `state`、`setState`、`clearKeys`、`clearState`。`setState` 合并状态，`undefined`、`null`、空字符串删除键。默认 `mode: 'replace'`、`strategy: 'history'`；需要路由守卫或导航语义时用 `strategy: 'router'`。
 - `useFullscreen(target, options?)`：返回 `isFullscreen`、`enterFullscreen`、`exitFullscreen`、`toggleFullscreen`、`isEnabled`。浏览器真全屏需要用户手势；`pageFullscreen` 是 CSS 模拟全屏，可配置 `className`、`zIndex`，并可用 `escTip` 控制提示。
-- `useTreeHeight` 与 `useTableHeight` 通过 `ResizeObserver` 计算可用高度。树的 `extraOffset` 仅用于 YTree 内置 `filterable` 搜索区；表格可配置 `boundaryRef` 避免尺寸反馈循环，并可扣除分页、工具栏或新增按钮高度。具体布局约束交由 `yss-use-tree-height` / `yss-use-table-height`。
+- `useTreeHeight` 与 `useTableHeight` 通过 `ResizeObserver` 计算可用高度。树的 `extraOffset` 仅用于 YTree 内置 `filterable` 搜索区；表格可配置 `boundaryRef` 避免尺寸反馈循环，并可扣除分页、工具栏或新增按钮高度。具体布局约束交由 `ytree-usage` / `ytable-usage` / `yedit-table-usage`。
 
 ## 8. 返回契约与自检
 

package/template/.codex/skills/yss-implementation-contract-compiler/references/boundaries.md

@@ -18,6 +18,7 @@
 
 | Capability | Primary skill | Task modes |
 | --- | --- | --- |
+| `governance.backend-spec-conformance` | `yss-backend-spec-review` | `guidance`, `troubleshooting`, `review-input` |
 | `writing.lifecycle-document` | `i-have-adhd` | `guidance` |
 | `architecture.technical-design` | `yss-technical-design` | `guidance`, `integration`, `review-input` |
 | `architecture.mvc-design` | `yss-technical-design` | `guidance`, `integration`, `review-input` |
@@ -57,6 +58,7 @@
 
 | Recipe | Capabilities |
 | --- | --- |
+| `backend.spec-conformance` | `governance.backend-spec-conformance`, `quality.java-code-style` |
 | `backend.ddd-domain-behavior` | `layer.domain`, `layer.application`, `quality.java-code-style` |
 | `backend.ddd-persistence-mybatis` | `layer.persistence`, `framework.mybatis`, `codegen.mapstruct`, `codegen.lombok`, `quality.java-code-style` |
 | `backend.ddd-http-api` | `layer.web-adapter`, `contract.dto-wire`, `contract.request-validation`, `contract.error-mapping`, `codegen.mapstruct`, `codegen.lombok`, `quality.java-code-style` |
@@ -106,6 +108,9 @@
 
 | Skill | Dependency | Type | Condition |
 | --- | --- | --- | --- |
+| `yss-backend-spec-review` | `alibaba-java-code-style` | `context-required` | — |
+| `yss-backend-spec-review` | `yss-implementation-contract-compiler` | `coordination-only` | — |
+| `yss-backend-spec-review` | `code-review` | `review-only` | — |
 | `prototype-review` | `i-have-adhd` | `context-conditional` | `lifecycle-document-output` |
 | `yss-implementation-contract-compiler` | `i-have-adhd` | `context-conditional` | `lifecycle-document-output` |
 | `yss-openapi-governance` | `i-have-adhd` | `context-conditional` | `lifecycle-document-output` |
@@ -150,7 +155,7 @@
 | `yss-validation` | `yss-exception` | `component-dependency` | — |
 | `yss-security-algorithm` | `yss-exception` | `component-dependency` | — |
 | `yss-exception` | `yss-dto` | `context-required` | — |
-| `yss-ui-business-page-generation` | `component-selection-imports` | `context-conditional` | `components` |
+| `yss-ui-business-page-generation` | `yss-ui` | `context-required` | — |
 | `yss-ui-business-page-generation` | `yss-hook` | `context-conditional` | `hooks` |
 | `yss-ui-business-page-generation` | `yss-formily` | `context-conditional` | `form` |
 | `yss-ui-business-page-generation` | `yss-api-integration` | `context-conditional` | `api` |

package/template/.codex/skills/yss-layered-mvc-scaffold-generator/SKILL.md

@@ -70,7 +70,7 @@ node scripts/generate_and_verify_scaffold.mjs \
 ## 硬约束
 
 - 新生成只接受包含 API Contract Decision 的统一 schema v4；缺 API 字段的预发布 v4 不得静默接受。验证器可只读检查历史 Manifest v3，恢复必须另行完成所有权审计、技术/数据/API 设计补齐与当前批准。历史 v2/v3 均不用于新生成。
-- `architecture_family` 必须为 `layered-mvc`，`generator_skill` 必须为本 skill。历史 `yss-mvc-data-analysis-project-initializer` 合同必须返回 `skill-deprecated`、标记 `stale` 并重编译，不自动替换或继承批准。
+- `architecture_family` 必须为 `layered-mvc`，`generator_skill` 必须为本 skill。旧数据分析初始化合同必须标记 `stale` 并按 `mvc-data-analysis-v1` Profile 重编译，不自动替换或继承批准。
 - 目标存在、`--force`、旧项目迁移、模板升级均为 `unsupported`。
 - Harness 内只允许以 `apps/backend/` 为输出父容器；外部实现仓库使用已登记真实路径。
 - 不生成业务示例。健康检查、上下文加载测试和架构测试只能验证机械工程能力，不定义用户可见 API。