create-yss-spec 3.4.7 → 3.4.8

package/template/.codex/skills/yss-backend-spec-review/tests/routing.test.mjs

@@ -0,0 +1,19 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { compileDefaultImplementationContract } from '../../../../scripts/lib/implementation-contract-compiler.mjs';
+
+test('existing-project audit compiles without inventing a platform or loading an implementer as Reviewer', () => {
+  const result = compileDefaultImplementationContract({ recipeIds: ['backend.spec-conformance'] });
+  assert.equal(result.status, 'draft');
+  assert.deepEqual([...result.required_skills].sort(), ['alibaba-java-code-style', 'yss-backend-spec-review']);
+  assert.equal(result.architecture_identity, undefined);
+  assert.equal(result.component_bindings, undefined);
+  assert.ok(result.non_expanding_dependencies.some(row => row.skill === 'code-review' && row.type === 'review-only'));
+  assert.ok(result.non_expanding_dependencies.some(row => row.skill === 'yss-implementation-contract-compiler' && row.type === 'coordination-only'));
+});
+
+test('ordinary code-style capability does not silently start full-project remediation', () => {
+  const result = compileDefaultImplementationContract({ requiredCapabilities: ['quality.java-code-style'] });
+  assert.deepEqual(result.required_skills, ['alibaba-java-code-style']);
+  assert.equal(result.required_skills.includes('yss-backend-spec-review'), false);
+});

package/template/.codex/skills/yss-ddd-scaffold-generator/SKILL.md

@@ -41,7 +41,7 @@ description: 用于生成完整的 YSS DDD 多模块后端脚手架。当用户
 2. 优先运行 `node scripts/generate_and_verify_scaffold.mjs`，在同一个受控工作流中生成骨架并执行真实 Maven 验证。`generate_scaffold.mjs` 只是底层生成原语，单独返回 0 不代表脚手架完成。
 3. 检查生成的模块名、POM、机械启动入口、基础配置文件和包路径。
 4. 受控工作流必须在生成项目根目录实际执行 `./mvnw validate`、`./mvnw test` 和 `./mvnw package`；三条命令全部返回 0 后才能报告完成。
-5. 三条 Wrapper 命令通过只得到 `empty-scaffold-verified`。如需声称已满足下游技能的首切片就绪条件，必须使用 `node scripts/run_first_slice_verification.mjs` 校验批准且版本当前的 Slice Implementation Contract、完整分层产物、skill tree digest 与根 Wrapper；只有验证器成功更新 Manifest 后才得到 `first-slice-verified`。
+5. 三条 Wrapper 命令通过只得到 `empty-scaffold-verified`。如需声称已满足下游技能的首切片就绪条件，必须使用 `node scripts/run_first_slice_verification.mjs` 校验批准且版本当前的 Slice Implementation Contract、完整分层产物、当前合同 freshness 与根 Wrapper；只有验证器成功更新 Manifest 后才得到 `first-slice-verified`。
 
 受控验证命令由本 skill 的 `node scripts/run_scaffold_verification.mjs` 固定执行；验证器先检查 `.yss/scaffold-generation.json` 的合同元数据和 Wrapper、Java、项目级 Maven settings/profile、仓库凭据是否就绪，再在指定 evidence 目录写入每条命令的 stdout/stderr、`exit_code`、`failure_category`、耗时、执行时间和 `scaffold-verification.json`。仓库或凭据失败归为 `repository-access`，与 `project-model`、`compilation`、`bootstrap-entrypoint`、`test-failure`、`packaging` 分开；任何一条命令失败或未执行都必须阻断。
 
@@ -72,7 +72,9 @@ node scripts/generate_and_verify_scaffold.mjs \
 ```bash
 node scripts/run_first_slice_verification.mjs \
   --project-root /path/to/implementation-repo/my-service \
-  --slice-contract-file /path/to/approved-slice-contract.json \
+  --slice-contract-file /path/to/approved-slice-contract.yaml \
+  --contract-root /path/to/contract-repository \
+  --approval-ref docs/approved-checkpoint.yaml \
   --evidence-dir /path/to/evidence/first-slice
 ```
 
@@ -104,7 +106,7 @@ node scripts/run_first_slice_verification.mjs \
 - 新脚手架只接受统一 Project Scaffold Contract schema v4，并必须以原始字节摘要绑定批准且当前的 Technical Design、Data Architecture Decision v1、API Contract Decision v1 和真实工程合同批准记录。API `required` 必须闭包绑定同一 OpenAPI YAML 字节的 Validation、独立 Review、Freeze 与工程批准；`not-applicable` 必须绑定评估、明确原因和证据且禁止空占位资产。历史 schema v3/v2 仅用于 Manifest 只读验证和补齐 API 对账后的恢复审计，不用于新生成。
 - DDD 固定 `target-domain-model`、`mybatis-plus`、H2 验证、`web` DTO、`yss-internal`；平台与 Validation 命名空间由共享清单约束。普通 MyBatis、独立 client module、client-in-domain 和其他旧架构仍为 `unsupported`。
 - 运行生成器必须传入 `--contract-file`；生成器会校验合同 `status=approved`、`current_version`、`primary_skill`、`controlled-generation`、实际输出路径和固定三条验证命令，不接受仅凭任意字符串引用的放行。
-- 生成项目必须写入 Manifest v4 `.yss/scaffold-generation.json`，记录技术、数据与 API 设计门禁、架构选择及 digest、生成器、合同 digest、Target Profile、模块闭包、模板 digest、下游完整 skill tree digest、generator-owned 文件 hash、严格 `generation_policy` 和完成等级；清单缺失或不一致时不得交给后续 实现合同编译器。
+- 生成项目必须写入 Manifest v4 `.yss/scaffold-generation.json`，记录技术、数据与 API 设计门禁、架构选择及 digest、生成器、合同 digest、Target Profile、模块闭包、模板 digest、下游完整 当前合同 freshness、generator-owned 文件 hash、严格 `generation_policy` 和完成等级；清单缺失或不一致时不得交给后续 实现合同编译器。
 - `first-slice-verified` 只能由 `run_first_slice_verification.mjs` 写入。手工改 Manifest、只生成 Controller、只通过局部模块测试或仅有结构扫描都不能升级完成等级。
 - 严禁把领域规则、状态机、权限、事务、复杂查询、错误映射、业务字段或用户可见行为塞进脚手架生成步骤。`./mvnw validate`、输出目录存在或“生成成功”都不等于生命周期批准、架构放行或 `ready-for-agent`。
 - 生命周期脚手架生成必须关闭 `--with-example`，不得把 User CRUD 或业务字段当作样板。生成器严格 `initialize-only`：非空目标、`--force`、旧项目迁移和当前模板升级一律 `unsupported`。未来若支持同一 Target Profile 内的模板升级，必须另行设计和批准，当前不预留可执行承诺。

package/template/.codex/skills/yss-ddd-scaffold-generator/assets/templates/java/architecture-rules-test.java.template

@@ -1,36 +1,73 @@
 package {{base_package}};
 
+import com.tngtech.archunit.core.domain.JavaClass;
+import com.tngtech.archunit.core.domain.JavaClasses;
+import com.tngtech.archunit.core.domain.Dependency;
 import com.tngtech.archunit.core.importer.ImportOption;
 import com.tngtech.archunit.junit.AnalyzeClasses;
 import com.tngtech.archunit.junit.ArchTest;
-import com.tngtech.archunit.lang.ArchRule;
 
-import static com.tngtech.archunit.lang.syntax.ArchRuleDefinition.noClasses;
-
-/**
- * Target DDD 的最小可执行边界。规则允许空包，首个业务切片加入后立即生效。
- */
+/** 空骨架可无业务类型；首切片由批准合同传入职责包和必须加载的实际类型。 */
 @AnalyzeClasses(packages = "{{base_package}}", importOptions = ImportOption.DoNotIncludeTests.class)
 class ArchitectureRulesTest {
+    private static boolean inPackage(JavaClass type, String prefixes) {
+        for (String prefix : prefixes.split(",")) {
+            if (!prefix.isEmpty() && (type.getPackageName().equals(prefix)
+                    || type.getPackageName().startsWith(prefix + "."))) return true;
+        }
+        return false;
+    }
 
-    @ArchTest
-    static final ArchRule domain_is_technology_free = noClasses()
-            .that().resideInAPackage("..domain..")
-            .should().dependOnClassesThat().resideInAnyPackage(
-                    "..application..", "..infrastructure..", "..repository..", "..rest..")
-            .allowEmptyShould(true);
+    private static boolean role(JavaClass type, String name, String defaults) {
+        return inPackage(type, defaults) || inPackage(type, System.getProperty("yss.arch." + name, ""));
+    }
 
-    @ArchTest
-    static final ArchRule application_does_not_depend_on_adapters = noClasses()
-            .that().resideInAPackage("..application..")
-            .should().dependOnClassesThat().resideInAnyPackage(
-                    "..infrastructure..", "..repository..", "..rest..")
-            .allowEmptyShould(true);
+    private static boolean controller(JavaClass type) {
+        return type.isAnnotatedWith("org.springframework.web.bind.annotation.RestController")
+                || type.isAnnotatedWith("org.springframework.stereotype.Controller")
+                || type.isMetaAnnotatedWith("org.springframework.stereotype.Controller");
+    }
+
+    private static void reject(boolean forbidden, Dependency dependency) {
+        if (forbidden) throw new AssertionError(dependency.getDescription());
+    }
 
     @ArchTest
-    static final ArchRule web_does_not_reach_infrastructure = noClasses()
-            .that().resideInAPackage("..rest..")
-            .should().dependOnClassesThat().resideInAnyPackage(
-                    "..infrastructure..", "..repository..")
-            .allowEmptyShould(true);
+    static void boundaries(JavaClasses classes) {
+        for (JavaClass origin : classes) {
+            boolean domain = role(origin, "domain", "{{base_package}}.domain");
+            boolean application = role(origin, "application", "{{base_package}}.application");
+            boolean infrastructure = role(origin, "infrastructure", "{{base_package}}.infrastructure");
+            for (Dependency dependency : origin.getDirectDependenciesFromSelf()) {
+                JavaClass target = dependency.getTargetClass();
+                boolean targetWeb = controller(target) || role(target, "web",
+                        "{{base_package}}.rest,{{base_package}}.adapter.web");
+                boolean targetInfrastructure = role(target, "infrastructure", "{{base_package}}.infrastructure");
+                boolean targetDomain = role(target, "domain", "{{base_package}}.domain");
+                reject(domain && (targetWeb || targetInfrastructure
+                        || role(target, "application", "{{base_package}}.application")
+                        || inPackage(target, "org.springframework,org.mybatis,com.baomidou,org.apache.ibatis,"
+                            + "com.fasterxml.jackson,io.swagger,javax.persistence,jakarta.persistence,"
+                            + "javax.validation,jakarta.validation,javax.servlet,jakarta.servlet,com.yss.cloud.dto,com.yss.cloud.exception")), dependency);
+                reject(application && (targetWeb || targetInfrastructure), dependency);
+                reject(infrastructure && targetWeb, dependency);
+                // Exception translators may translate Domain errors. Controllers may not invoke Domain directly.
+                reject(controller(origin) && (targetInfrastructure || targetDomain), dependency);
+            }
+        }
+        if (Boolean.getBoolean("yss.firstSlice")) {
+            if (Boolean.getBoolean("yss.arch.requireController")) {
+                boolean foundController = false;
+                for (JavaClass type : classes) if (controller(type)) foundController = true;
+                if (!foundController) throw new AssertionError("Web slice did not load an actual Controller");
+            }
+            String required = System.getProperty("yss.arch.requiredTypes", "");
+            if (required.isEmpty()) throw new AssertionError("first slice requires contract-bound types");
+            for (String name : required.split(",")) {
+                boolean found = false;
+                for (JavaClass type : classes) if (type.getName().equals(name)) found = true;
+                if (!found) throw new AssertionError("architecture scope did not load " + name);
+            }
+        }
+    }
 }

package/template/.codex/skills/yss-ddd-scaffold-generator/assets/templates/pom/bootstrap-pom.xml.template

@@ -57,6 +57,12 @@
             <artifactId>h2</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.projectlombok</groupId>
+            <artifactId>lombok</artifactId>
+            <version>${lombok.version}</version>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 
     <profiles>

package/template/.codex/skills/yss-ddd-scaffold-generator/references/ARCHITECTURE.md

@@ -111,6 +111,6 @@ Domain Error -> Application propagation/translation -> Web Exception Translator
 
 - `generated`：文件已原子生成，尚未完成 Wrapper 验证。
 - `empty-scaffold-verified`：根目录 `./mvnw validate/test/package` 全部通过。
-- `first-slice-verified`：批准且版本当前的 golden first slice 已具备 Domain 模型/Gateway、Application Service 实现/事务/Query Port、Repository/Mapper/GatewayImpl/QueryAdapter、DTO/Web/Exception 与分层测试；下游完整 skill tree digest 无漂移，且根 Wrapper 全部通过。该状态只能由 `scripts/run_first_slice_verification.mjs` 写入。
+- `first-slice-verified`：批准且版本当前的 golden first slice 已具备合同声明的职责类型、适用分层与实际执行的行为测试（分页、事务、组件不适用时不生成空实现）；当前批准合同与技能依据无漂移，且根 Wrapper 全部通过。该状态只能由 `scripts/run_first_slice_verification.mjs` 写入。
 
 只有首切片验证器可以把 Manifest 从 `empty-scaffold-verified` 升级到最后一级；手工写值、局部测试或结构扫描均无效。只有最后一级可以声明已满足下游 YSS skills 的首切片就绪条件。

package/template/.codex/skills/yss-ddd-scaffold-generator/references/USAGE_EXAMPLES.md

@@ -118,11 +118,13 @@ metadata-service/
 ```bash
 node .agents/skills/yss-ddd-scaffold-generator/scripts/run_first_slice_verification.mjs \
   --project-root /path/to/implementation-repo/metadata-service \
-  --slice-contract-file /path/to/approved-slice-contract.json \
+  --slice-contract-file /path/to/approved-slice-contract.yaml \
+  --contract-root /path/to/contract-repository \
+  --approval-ref docs/approved-checkpoint.yaml \
   --evidence-dir /path/to/evidence/first-slice
 ```
 
-只有该验证器确认合同、全层产物、skill tree digest 与根 Wrapper 全部通过，并更新 Manifest 后，才能标记 `first-slice-verified`。
+只有该验证器确认合同、全层产物、当前合同 freshness 与根 Wrapper 全部通过，并更新 Manifest 后，才能标记 `first-slice-verified`。
 
 目标目录必须不存在。`--force`、旧项目迁移和当前模板升级均为 `unsupported`。旧项目继续按原工程维护；现代化改造必须单独立项、先评估再逐切片迁移。
 

package/template/.codex/skills/yss-ddd-scaffold-generator/references/engineering-baseline.md

@@ -40,7 +40,7 @@ infrastructure-+
 - Maven 内部仓库通过命名 profile `yss-internal` 与环境变量注入；共享模板不写内部 URL 或凭据。
 - Wrapper 必须带 checksum；DEBUG 和 MyBatis stdout SQL 只允许在 `application-local.yml`。
 - `./mvnw validate`、`./mvnw test`、`./mvnw package` 全部成功只得到 `empty-scaffold-verified`。
-- 只有批准且版本当前的 golden first slice 真实组合 Domain/Application/Infrastructure/Web、通过下游 skill tree drift 校验与根 Wrapper，才能由 `run_first_slice_verification.mjs` 写入 `first-slice-verified`。
+- 只有批准且版本当前的 golden first slice 真实组合 Domain/Application/Infrastructure/Web、通过当前批准合同的技能/编译依据 freshness 校验与根 Wrapper，才能由 `run_first_slice_verification.mjs` 写入 `first-slice-verified`。
 
 ## 下游权威技能
 
@@ -51,3 +51,9 @@ infrastructure-+
 - 横切实现约束：`yss-validation` + `mapstruct` + `lombok` + `alibaba-java-code-style`
 
 业务代码必须回到 `yss-implementation-contract-compiler`，消费批准且版本当前的 Slice Implementation Contract，并采用 `behavior-tdd`；脚手架只生成机械工程资产。
+
+## 生成来源与当前基线
+
+Manifest 的平台与文件摘要保留生成时来源；后续批准的平台迁移以当前工程基线、仓库登记和迁移证据重新绑定，不覆盖生成历史伪造当前性。历史 Manifest 与当前合同无法对账时停止晋级。
+
+空骨架允许未出现业务类型；首切片按批准 backend.first_slice.artifacts 的职责、具体源码类型和测试证据核验，不以固定目录或后缀作为合规证明。进入业务验证时启用 yss.firstSlice=true，必须实际发现 Controller（命中 Web 时）及声明的业务层。

package/template/.codex/skills/yss-ddd-scaffold-generator/scripts/first-slice-compatibility.test.mjs

@@ -228,16 +228,12 @@ test("golden first slice 组合 Domain/Application/Infrastructure/Web 且不发
   assert.match(queryAdapter, /implements QualityRuleQueryPort/);
 });
 
-test("golden first slice 通过真实 Wrapper 后才写入 first-slice-verified", { timeout: 300_000 }, async (t) => {
-  if (!["YSS_MAVEN_REPOSITORY_URL", "MAVEN_REPO_USERNAME", "MAVEN_REPO_PASSWORD"].every((name) => process.env[name])) {
-    t.skip("缺少受控 YSS Maven 仓库环境；不得声明 first-slice-verified");
-    return;
-  }
-  const { project, sliceContract, root } = await prepareGoldenProject(t);
-  await chmod(path.join(project, "mvnw"), 0o755);
-  const result = await runFirstSliceVerification(project, path.join(root, "first-slice-evidence"), sliceContract, process.env);
-  assert.equal(result.status, "passed", JSON.stringify(result, null, 2));
-  assert.equal(JSON.parse(await readFile(path.join(project, ".yss/scaffold-generation.json"), "utf8")).completion_level, "first-slice-verified");
+test("golden 布局与可用凭据不能替代完整批准的 Slice 合同", async (t) => {
+  const { root, project, sliceContract } = await prepareGoldenProject(t);
+  const result = await runFirstSliceVerification(project, path.join(root, "first-slice-evidence"), sliceContract, process.env, { contractRoot: root });
+  assert.equal(result.status, "failed");
+  assert.ok(result.contract_failures.includes("slice-execution-not-authorized"));
+  assert.equal(result.commands.length, 0);
 });
 
 test("真实 YSS exception starter 的自动配置、优先级、三类映射和序列化均受保护", { timeout: 300_000 }, async (t) => {

package/template/.codex/skills/yss-ddd-scaffold-generator/scripts/first-slice-verification.test.mjs

@@ -126,19 +126,18 @@ const environment = { ...process.env, JAVA_HOME: "/fixture/java", YSS_MAVEN_REPO
 
 test("refuses first-slice promotion when a required persistence seam is absent", async () => {
   const data = await fixture({ omitGatewayImpl: true });
-  const report = await runFirstSliceVerification(data.project, data.evidence, data.contractPath, environment);
+  const report = await runFirstSliceVerification(data.project, data.evidence, data.contractPath, environment, { contractRoot: data.root });
   assert.equal(report.status, "failed");
-  assert.ok(report.missing_artifacts.includes("infrastructure-gateway-implementation"));
+  assert.ok(report.missing_artifacts.includes("backend.first_slice.artifacts-required"));
   const manifest = JSON.parse(await readFile(data.manifestPath, "utf8"));
   assert.equal(manifest.completion_level, "empty-scaffold-verified");
 });
 
-test("refuses first-slice promotion when downstream skill or contract digests are absent", async () => {
+test("missing generation provenance does not substitute for current approved contract", async () => {
   const data = await fixture({ omitReadiness: true });
-  const report = await runFirstSliceVerification(data.project, data.evidence, data.contractPath, environment);
+  const report = await runFirstSliceVerification(data.project, data.evidence, data.contractPath, environment, { contractRoot: data.root });
   assert.equal(report.status, "failed");
-  assert.ok(report.downstream_skill_drift.includes("yss-domain:digest-missing"));
-  assert.ok(report.downstream_skill_drift.includes("compiler_contract:digest-missing"));
+  assert.ok(report.contract_failures.includes("slice-execution-not-authorized"));
   const manifest = JSON.parse(await readFile(data.manifestPath, "utf8"));
   assert.equal(manifest.completion_level, "empty-scaffold-verified");
 });
@@ -148,20 +147,17 @@ test("refuses first-slice promotion when a work unit references a stale contract
   const contract = JSON.parse(await readFile(data.contractPath, "utf8"));
   contract.work_units[0].contract_version = 0;
   await writeFile(data.contractPath, JSON.stringify(contract));
-  const report = await runFirstSliceVerification(data.project, data.evidence, data.contractPath, environment);
+  const report = await runFirstSliceVerification(data.project, data.evidence, data.contractPath, environment, { contractRoot: data.root });
   assert.equal(report.status, "failed");
   assert.ok(report.contract_failures.includes("work-unit-contract-version-mismatch:slice-backend"));
 });
 
-test("promotes a complete approved slice only after all root wrapper commands pass", async () => {
+test("fake wrapper success and an approved status cannot promote an incomplete v2 contract", async () => {
   const data = await fixture();
-  const report = await runFirstSliceVerification(data.project, data.evidence, data.contractPath, environment);
-  assert.equal(report.status, "passed");
-  assert.equal(report.completion_level, "first-slice-verified");
-  assert.deepEqual(report.commands.map((item) => item.exit_code), [0, 0, 0]);
+  const report = await runFirstSliceVerification(data.project, data.evidence, data.contractPath, environment, { contractRoot: data.root });
+  assert.equal(report.status, "failed");
+  assert.ok(report.contract_failures.includes("slice-execution-not-authorized"));
+  assert.deepEqual(report.commands, []);
   const manifest = JSON.parse(await readFile(data.manifestPath, "utf8"));
-  assert.equal(manifest.completion_level, "first-slice-verified");
-  assert.equal(manifest.first_slice_contract.contract_id, "slice-1");
-  assert.equal(manifest.first_slice_contract.slice_id, "quality-rule-first-slice");
-  assert.equal(JSON.parse(await readFile(path.join(data.evidence, "first-slice-verification.json"), "utf8")).status, "passed");
+  assert.equal(manifest.completion_level, "empty-scaffold-verified");
 });

package/template/.codex/skills/yss-ddd-scaffold-generator/scripts/run_first_slice_verification.mjs

@@ -8,33 +8,15 @@ import { fileURLToPath } from "node:url";
 
 import { run as runScaffoldVerification } from "./run_scaffold_verification.mjs";
 import { assertArchitectureAgreement } from "../../../../scripts/lib/backend-architecture.mjs";
-import { mvcFirstSliceProfile } from "../../../../scripts/lib/first-slice-architecture.mjs";
+import { inspectSliceContract } from "../../../../scripts/lib/slice-execution-preflight.mjs";
+import { selectSliceWorkUnit } from "../../../../scripts/lib/slice-contract.mjs";
+import { verifyFirstSliceTests } from "../../../../scripts/lib/first-slice-tests.mjs";
+import { inspectFirstSliceArtifacts } from "../../../../scripts/lib/first-slice-artifacts.mjs";
 
 const SCRIPT_DIR = path.dirname(fileURLToPath(import.meta.url));
 const REPOSITORY_ROOT = path.resolve(SCRIPT_DIR, "../../../..");
 const REQUIRED_SKILLS = ["yss-domain", "yss-application", "yss-repository", "yss-mybatis", "yss-web-controller", "yss-dto", "yss-exception", "yss-validation", "mapstruct", "lombok", "alibaba-java-code-style"];
 const REQUIRED_LAYERS = ["domain", "application", "infrastructure", "web"];
-const ARTIFACT_CHECKS = [
-  ["domain-model", /-domain\/src\/main\/java\/.+\/domain\/.+\/model\/.+\.java$/],
-  ["domain-gateway", /-domain\/src\/main\/java\/.+\/domain\/.+\/gateway\/.+Gateway\.java$/],
-  ["domain-behavior-test", /-domain\/src\/test\/java\/.+(?:Test|Tests)\.java$/],
-  ["application-command-or-query", /-application\/src\/main\/java\/.+\/application\/(?:command|query)\/.+\.java$/],
-  ["application-result", /-application\/src\/main\/java\/.+\/application\/result\/.+Result\.java$/],
-  ["application-service", /-application\/src\/main\/java\/.+\/application\/service\/.+Service\.java$/],
-  ["application-service-implementation", /-application\/src\/main\/java\/.+\/application\/service\/impl\/.+ServiceImpl\.java$/],
-  ["application-behavior-test", /-application\/src\/test\/java\/.+(?:Test|Tests)\.java$/],
-  ["infrastructure-po", /-infrastructure\/src\/main\/java\/.+\/infrastructure\/persistence\/po\/.+PO\.java$/],
-  ["infrastructure-repository", /-infrastructure\/src\/main\/java\/.+\/infrastructure\/persistence\/repository\/.+Repository\.java$/],
-  ["infrastructure-convertor", /-infrastructure\/src\/main\/java\/.+\/infrastructure\/persistence\/convertor\/.+Convertor\.java$/],
-  ["infrastructure-gateway-implementation", /-infrastructure\/src\/main\/java\/.+\/infrastructure\/persistence\/gateway\/.+GatewayImpl\.java$/],
-  ["infrastructure-query-adapter", /-infrastructure\/src\/main\/java\/.+\/infrastructure\/query\/adapter\/.+QueryAdapter\.java$/],
-  ["infrastructure-integration-test", /-infrastructure\/src\/test\/java\/.+(?:Test|Tests)\.java$/],
-  ["web-controller", /-adapter\/.+-web\/src\/main\/java\/.+\/rest\/.+Controller\.java$/],
-  ["web-convertor", /-adapter\/.+-web\/src\/main\/java\/.+\/rest\/convertor\/.+WebConvertor\.java$/],
-  ["web-request", /-adapter\/.+-web\/src\/main\/java\/.+\/rest\/dto\/request\/.+Request\.java$/],
-  ["web-response", /-adapter\/.+-web\/src\/main\/java\/.+\/rest\/dto\/response\/.+Response\.java$/],
-  ["web-contract-test", /-adapter\/.+-web\/src\/test\/java\/.+(?:Test|Tests)\.java$/]
-];
 
 const isoNow = () => new Date().toISOString();
 const sha256 = (content) => createHash("sha256").update(content).digest("hex");
@@ -62,59 +44,7 @@ async function writeJsonAtomic(target, value) {
   await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, "utf8");
   await rename(temporary, target);
 }
-function invalidContractReasons(contract, requiredSkills = REQUIRED_SKILLS, requiredLayers = REQUIRED_LAYERS) {
-  const reasons = [];
-  if (contract.schema_version !== 2) reasons.push("slice-contract-schema");
-  if (contract.status !== "approved") reasons.push("slice-contract-not-approved");
-  for (const field of ["contract_id", "contract_version", "slice_id"]) if (contract[field] === undefined || contract[field] === null || contract[field] === "") reasons.push(`slice-contract-${field}-missing`);
-  if (contract.readiness?.blockers?.length) reasons.push("slice-contract-has-blockers");
-  if (contract.readiness?.stale_inputs?.length) reasons.push("slice-contract-has-stale-inputs");
-  const actualSkills = new Set([...(contract.common?.required_skills ?? []), ...(contract.backend?.required_skills ?? [])]);
-  for (const skill of requiredSkills) if (!actualSkills.has(skill)) reasons.push(`required-skill-missing:${skill}`);
-  const actualLayers = new Set(contract.backend?.affected_layers ?? []);
-  for (const layer of requiredLayers) if (!actualLayers.has(layer)) reasons.push(`required-layer-missing:${layer}`);
-  if (!Array.isArray(contract.work_units) || !contract.work_units.length) reasons.push("slice-contract-work-units-missing");
-  else for (const [index, unit] of contract.work_units.entries()) {
-    const id = unit.id || `index-${index}`;
-    if (unit.contract_id !== contract.contract_id) reasons.push(`work-unit-contract-id-mismatch:${id}`);
-    if (unit.contract_version !== contract.contract_version) reasons.push(`work-unit-contract-version-mismatch:${id}`);
-    if (!unit.work_unit?.primary_skill) reasons.push(`work-unit-primary-skill-missing:${id}`);
-  }
-  return reasons;
-}
-async function downstreamDrift(manifest, requiredSkills = REQUIRED_SKILLS) {
-  const drift = [];
-  const recordedSkills = manifest.readiness?.downstream_skills ?? {};
-  for (const skill of requiredSkills) {
-    const expected = recordedSkills[skill];
-    if (typeof expected !== "string" || !/^[a-f0-9]{64}$/.test(expected)) {
-      drift.push(`${skill}:digest-missing`);
-      continue;
-    }
-    const root = path.join(REPOSITORY_ROOT, ".agents", "skills", skill);
-    if (!await isFile(path.join(root, "SKILL.md"))) drift.push(`${skill}:unavailable`);
-    else if (await treeDigest(root) !== expected) drift.push(`${skill}:digest-mismatch`);
-  }
-  const contracts = manifest.readiness?.contracts ?? {};
-  const contractFiles = {
-    compiler_contract: path.join(REPOSITORY_ROOT, ".agents", "skills", "yss-implementation-contract-compiler", "references", "compiler-contract.yaml")
-  };
-  if (manifest.architecture_family === "layered-mvc") {
-    contractFiles.architecture_profiles = path.join(REPOSITORY_ROOT, "docs/agents/backend-architecture-profiles.md");
-  } else contractFiles.engineering_baseline = path.join(REPOSITORY_ROOT, ".agents", "skills", "yss-ddd-scaffold-generator", "references", "engineering-baseline.md");
-  for (const [name, target] of Object.entries(contractFiles)) {
-    const expected = contracts[name];
-    if (typeof expected !== "string" || !/^[a-f0-9]{64}$/.test(expected)) {
-      drift.push(`${name}:digest-missing`);
-      continue;
-    }
-    if (!await isFile(target)) drift.push(`${name}:unavailable`);
-    else if (sha256(await readFile(target)) !== expected) drift.push(`${name}:digest-mismatch`);
-  }
-  return drift;
-}
-
-export async function runFirstSliceVerification(projectRoot, evidenceDir, sliceContractFile, environment = process.env) {
+export async function runFirstSliceVerification(projectRoot, evidenceDir, sliceContractFile, environment = process.env, options = {}) {
   projectRoot = path.resolve(projectRoot);
   evidenceDir = path.resolve(evidenceDir);
   sliceContractFile = path.resolve(sliceContractFile);
@@ -123,20 +53,33 @@ export async function runFirstSliceVerification(projectRoot, evidenceDir, sliceC
   if (!await isFile(manifestPath)) throw new Error(`missing scaffold manifest: ${manifestPath}`);
   if (!await isFile(sliceContractFile)) throw new Error(`missing Slice Implementation Contract: ${sliceContractFile}`);
   const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
-  const contract = JSON.parse(await readFile(sliceContractFile, "utf8"));
+  const contractRoot = path.resolve(options.contractRoot || projectRoot);
+  let contract, preflight;
+  try {
+    const loaded = inspectSliceContract(path.relative(contractRoot, sliceContractFile), {
+      root: contractRoot, approval_ref: options.approvalRef, work_unit_id: options.workUnit
+    });
+    preflight = loaded.report;
+    contract = selectSliceWorkUnit(loaded.contract, options.workUnit);
+  } catch (error) {
+    preflight = { execution_allowed: false, blockers: [error.message] };
+    contract = {};
+  }
   if (manifest.platform_verification === "candidate") throw new Error("backend-platform: candidate scaffold cannot become first-slice-verified");
-  const adapter = manifest.architecture_family === "layered-mvc" ? mvcFirstSliceProfile(manifest.architecture_identity ?? {}) : { skills: REQUIRED_SKILLS, layers: REQUIRED_LAYERS, artifacts: ARTIFACT_CHECKS };
-  const contractFailures = invalidContractReasons(contract, adapter.skills, adapter.layers);
+  const contractFailures = [...preflight.blockers];
+  if (!preflight.execution_allowed) contractFailures.push("slice-execution-not-authorized");
+  if (!(contract.common?.project_roots || []).some(ref => path.resolve(contractRoot, ref) === projectRoot)) contractFailures.push("slice-project-root-mismatch");
   try {
     const identity = contract.architecture_identity ?? contract.resolution?.architecture_identity;
-    assertArchitectureAgreement(identity, { manifest });
+    if (identity?.source_kind !== "existing-registration") assertArchitectureAgreement(identity, { manifest });
     for (const unit of contract.work_units ?? []) assertArchitectureAgreement(identity, { work_unit: unit.architecture_identity });
   } catch (error) { contractFailures.push(`architecture-identity:${error.message}`); }
   if (![2, 3, 4].includes(manifest.schema_version) || manifest.completion_level !== "empty-scaffold-verified") contractFailures.push("scaffold-not-empty-scaffold-verified");
   if (manifest.schema_version === 3 && manifest.legacy_reconciliation?.status !== "approved") contractFailures.push("legacy-scaffold-reconciliation-required");
-  const projectFiles = await files(projectRoot);
-  const missingArtifacts = adapter.artifacts.filter(([, pattern]) => !projectFiles.some((file) => pattern.test(file))).map(([name]) => name);
-  const skillDrift = await downstreamDrift(manifest, adapter.skills);
+  const artifacts = inspectFirstSliceArtifacts(contract, projectRoot);
+  const missingArtifacts = artifacts.failures;
+  // Generation-time Skill hashes are provenance. Current authority was checked by execution preflight.
+  const skillDrift = [];
   if (contractFailures.length || missingArtifacts.length || skillDrift.length) {
     const report = { verification_mode: "first-slice", project_root: projectRoot, slice_contract_ref: sliceContractFile, scaffold_manifest_ref: manifestPath, generated_at: isoNow(), status: "failed", completion_level: manifest.completion_level, contract_failures: contractFailures, missing_artifacts: missingArtifacts, downstream_skill_drift: skillDrift, commands: [] };
     await writeJsonAtomic(reportPath, report);
@@ -144,9 +87,15 @@ export async function runFirstSliceVerification(projectRoot, evidenceDir, sliceC
   }
 
   const mavenEvidence = path.join(evidenceDir, "maven");
-  const wrapper = await runScaffoldVerification(projectRoot, mavenEvidence, environment, { firstSlice: true });
-  const passed = wrapper.status === "passed";
-  const report = { verification_mode: "first-slice", project_root: projectRoot, slice_contract_ref: sliceContractFile, scaffold_manifest_ref: manifestPath, generated_at: isoNow(), status: passed ? "passed" : "failed", failure_category: wrapper.failure_category, completion_level: passed ? "first-slice-verified" : manifest.completion_level, contract_failures: [], missing_artifacts: [], downstream_skill_drift: [], commands: wrapper.commands };
+  const startedAt = Date.now();
+  const wrapper = await runScaffoldVerification(projectRoot, mavenEvidence, environment, { firstSlice: true, systemProperties: artifacts.properties });
+  const mvc = manifest.architecture_family === "layered-mvc";
+  const tests = wrapper.status === "passed" ? verifyFirstSliceTests(contract, projectRoot, startedAt, {
+    module: `${manifest.project_name}-${mvc ? "server" : "bootstrap"}`,
+    type: `${manifest.base_package}.${mvc ? "architecture.LayeredMvcArchitectureTest" : "ArchitectureRulesTest"}`
+  }) : { status: "not-executed", failures: [], evidence: [] };
+  const passed = wrapper.status === "passed" && tests.status === "passed";
+  const report = { verification_mode: "first-slice", project_root: projectRoot, slice_contract_ref: sliceContractFile, scaffold_manifest_ref: manifestPath, generated_at: isoNow(), status: passed ? "passed" : "failed", test_execution: tests, failure_category: wrapper.failure_category || (tests.status === "failed" ? "first-slice-tests" : null), completion_level: passed ? "first-slice-verified" : manifest.completion_level, contract_failures: [], missing_artifacts: [], downstream_skill_drift: [], commands: wrapper.commands };
   await writeJsonAtomic(reportPath, report);
   if (passed) {
     manifest.completion_level = "first-slice-verified";
@@ -162,7 +111,7 @@ function parseArgs(argv) {
   const result = {};
   for (let index = 0; index < argv.length; index += 2) {
     const flag = argv[index], value = argv[index + 1];
-    if (!["--project-root", "--evidence-dir", "--slice-contract-file"].includes(flag) || !value) throw new Error("usage: run_first_slice_verification.mjs --project-root DIR --evidence-dir DIR --slice-contract-file FILE");
+    if (!["--project-root", "--evidence-dir", "--slice-contract-file", "--contract-root", "--approval-ref", "--work-unit"].includes(flag) || !value) throw new Error("usage: run_first_slice_verification.mjs --project-root DIR --evidence-dir DIR --slice-contract-file FILE");
     result[flag.slice(2).replaceAll(/-([a-z])/g, (_, letter) => letter.toUpperCase())] = value;
   }
   if (!result.projectRoot || !result.evidenceDir || !result.sliceContractFile) throw new Error("project root, evidence dir, and slice contract file are required");
@@ -172,7 +121,7 @@ function parseArgs(argv) {
 async function main() {
   try {
     const args = parseArgs(process.argv.slice(2));
-    const report = await runFirstSliceVerification(args.projectRoot, args.evidenceDir, args.sliceContractFile);
+    const report = await runFirstSliceVerification(args.projectRoot, args.evidenceDir, args.sliceContractFile, process.env, args);
     process.stdout.write(`${report.status}: ${path.join(path.resolve(args.evidenceDir), "first-slice-verification.json")}\n`);
     return report.status === "passed" ? 0 : 1;
   } catch (error) {

package/template/.codex/skills/yss-ddd-scaffold-generator/scripts/run_scaffold_verification.mjs

@@ -62,7 +62,7 @@ function validateManifest(manifest) {
   if (manifest.schema_version === 4 ? manifest.current_version !== true : manifest.current_version !== manifest.contract_version) throw new Error("脚手架生成元数据清单不是当前合同版本");
   if (JSON.stringify(manifest.verification_commands) !== JSON.stringify(COMMANDS)) throw new Error("脚手架生成元数据清单验证命令不符合固定合同");
 }
-export async function run(projectRoot, evidenceDir, environment = process.env, { timeoutMs = 0, signal, platformOptions = {}, firstSlice = false } = {}) {
+export async function run(projectRoot, evidenceDir, environment = process.env, { timeoutMs = 0, signal, platformOptions = {}, firstSlice = false, systemProperties = {} } = {}) {
   const wrapper = path.join(projectRoot, "mvnw"), manifestPath = path.join(projectRoot, ".yss", "scaffold-generation.json");
   if (!await isFile(wrapper)) throw new Error(`项目根目录缺少 Maven wrapper: ${wrapper}`);
   if (!await isFile(manifestPath)) throw new Error(`项目根目录缺少脚手架生成元数据清单: ${manifestPath}`);
@@ -114,13 +114,14 @@ export async function run(projectRoot, evidenceDir, environment = process.env, {
     const stderrPath = path.join(evidenceDir, `mvnw-${phase}.stderr.log`);
     const startedAt = isoNow();
     const started = process.hrtime.bigint();
-    const execution = await runCommand(wrapper, [phase], { cwd: projectRoot, env: environment, timeoutMs, signal, stdoutFile: stdoutPath, stderrFile: stderrPath, secrets: [environment.MAVEN_REPO_USERNAME, environment.MAVEN_REPO_PASSWORD], progress: true });
+    const args = [phase, ...Object.entries(systemProperties).map(([key, value]) => `-D${key}=${value}`)];
+    const execution = await runCommand(wrapper, args, { cwd: projectRoot, env: environment, timeoutMs, signal, stdoutFile: stdoutPath, stderrFile: stderrPath, secrets: [environment.MAVEN_REPO_USERNAME, environment.MAVEN_REPO_PASSWORD], progress: true });
     const outcome = { ...execution, exitCode: execution.status };
     const durationMs = Number(process.hrtime.bigint() - started) / 1e6;
     await writeText(stdoutPath, redactSecrets(outcome.stdout, environment));
     await writeText(stderrPath, redactSecrets(outcome.stderr, environment));
     commands.push({
-      command: `./mvnw ${phase}`,
+      command: `./mvnw ${args.join(" ")}`,
       phase,
       exit_code: outcome.exitCode,
       failure_category: outcome.termination || classifyFailure(phase, outcome),

package/template/.codex/skills/yss-domain/references/domain-layer-guide.md

@@ -62,7 +62,7 @@ public interface QualityTemplateGateway {
 - `*VO`、`PageResult`、Repository PO。
 - MyBatis、Spring MVC、Jackson、Swagger 类型。
 
-分页、列表和投影查询由 Application Query Port 定义，Infrastructure 实现。
+展示分页、列表和投影查询由 Application Query Port 定义，Infrastructure 实现。
 
 ## 5. Domain Error
 
@@ -99,3 +99,10 @@ Web Exception Translator 再将它映射为批准的状态码、错误码和消
 - 返回 YSS Skill Execution Result，包含 Domain 文件、行为测试、ArchUnit 结果及实际 `./mvnw ...` 证据。
 - 新聚合、不变量、状态机或跨上下文影响进入 `new_impacts` 并暂停。
 - 检测到旧架构时返回 `unsupported`；如需现代化，退出 scaffold 工作流并单独立项评估。
+
+## 聚合创建与重建
+
+- 创建入口执行当前创建规则；持久化重建入口恢复已批准状态并校验结构不变量，不重复发送创建事件、生成身份或执行外部调用。两者不得通过公开任意 setter 混为一体。
+- 值对象按值相等；聚合按稳定身份相等。集合对外只读，修改经业务方法；Java 8 使用普通类与防御性复制，不从示例推导 record 等高版本语法。
+- 领域错误携带稳定标识与参数；公开消息和 HTTP 状态由 Web 翻译。测试通过公开行为覆盖非法状态、重复动作和重建后语义一致性。
+- 为业务决策加载一个或一组聚合仍可使用 Domain Gateway；展示列表、分页、排序、统计和投影走 Application Query Port。返回 List 本身不是违规，须按调用目的判定。

package/template/.codex/skills/yss-implementation-contract-compiler/references/boundaries.md

@@ -18,6 +18,7 @@
 
 | Capability | Primary skill | Task modes |
 | --- | --- | --- |
+| `governance.backend-spec-conformance` | `yss-backend-spec-review` | `guidance`, `troubleshooting`, `review-input` |
 | `writing.lifecycle-document` | `i-have-adhd` | `guidance` |
 | `architecture.technical-design` | `yss-technical-design` | `guidance`, `integration`, `review-input` |
 | `architecture.mvc-design` | `yss-technical-design` | `guidance`, `integration`, `review-input` |
@@ -57,6 +58,7 @@
 
 | Recipe | Capabilities |
 | --- | --- |
+| `backend.spec-conformance` | `governance.backend-spec-conformance`, `quality.java-code-style` |
 | `backend.ddd-domain-behavior` | `layer.domain`, `layer.application`, `quality.java-code-style` |
 | `backend.ddd-persistence-mybatis` | `layer.persistence`, `framework.mybatis`, `codegen.mapstruct`, `codegen.lombok`, `quality.java-code-style` |
 | `backend.ddd-http-api` | `layer.web-adapter`, `contract.dto-wire`, `contract.request-validation`, `contract.error-mapping`, `codegen.mapstruct`, `codegen.lombok`, `quality.java-code-style` |
@@ -106,6 +108,9 @@
 
 | Skill | Dependency | Type | Condition |
 | --- | --- | --- | --- |
+| `yss-backend-spec-review` | `alibaba-java-code-style` | `context-required` | — |
+| `yss-backend-spec-review` | `yss-implementation-contract-compiler` | `coordination-only` | — |
+| `yss-backend-spec-review` | `code-review` | `review-only` | — |
 | `prototype-review` | `i-have-adhd` | `context-conditional` | `lifecycle-document-output` |
 | `yss-implementation-contract-compiler` | `i-have-adhd` | `context-conditional` | `lifecycle-document-output` |
 | `yss-openapi-governance` | `i-have-adhd` | `context-conditional` | `lifecycle-document-output` |