create-yss-spec 3.4.8 → 3.4.10

package/template/scripts/complete-backend-delivery

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { parseArgs } from 'node:util';
+import { readFileSync } from 'node:fs';
+import { parse } from './lib/strategic-handoff-io.mjs';
+import { completeBackendDelivery, verifyBackendDeliveryTerminal } from './lib/backend-delivery-terminal.mjs';
+
+try {
+  const { values, positionals } = parseArgs({ allowPositionals: true, options: { root: { type: 'string' }, input: { type: 'string' } } });
+  if (positionals.length !== 1 || !values.root) throw new TypeError('用法: complete-backend-delivery complete --root <governance> --input <plan.json> | verify --root <governance>');
+  const root = path.resolve(values.root);
+  let result;
+  if (positionals[0] === 'verify' && !values.input) result = await verifyBackendDeliveryTerminal(root);
+  else if (positionals[0] === 'complete' && values.input) result = await completeBackendDelivery(root, parse(readFileSync(values.input)));
+  else throw new TypeError('需要 complete 或 verify 及匹配参数');
+  process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+} catch (error) { process.stderr.write(`${JSON.stringify({ result: 'blocked', error: error.message })}\n`); process.exitCode = 1; }

package/template/scripts/contract

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import {viewContract,diffContract} from './lib/contract-views.mjs';
+try{
+ const args=process.argv.slice(2),mode=args.shift(),options={},positional=[];
+ for(let i=0;i<args.length;i++){const arg=args[i];if(arg==='--json')options.json=true;else if(arg.startsWith('--')){const key=arg.slice(2);if(!['kind','profile','unit','root','before-root'].includes(key)||!args[i+1]||args[i+1].startsWith('--'))throw Error(`未知或缺值参数 ${arg}`);options[key]=args[++i];}else positional.push(arg);}
+ const config={kind:options.kind,root:path.resolve(options.root||process.cwd()),profile:options.profile||'review',unit_id:options.unit,beforeRoot:options['before-root']?path.resolve(options['before-root']):undefined};
+ if(!options.kind)throw Error('必须用 --kind 明确资产类型');
+ if(!['view','diff'].includes(mode)||positional.length!==(mode==='view'?1:2))throw Error('用法: contract view <资产> --kind <类型> [--profile review|task|full] [--unit <ID>] [--json] | diff <旧资产> <新资产> --kind <类型>');
+ const result=mode==='view'?viewContract(positional[0],config):diffContract(positional[0],positional[1],config);
+ process.stdout.write(options.json||!result.markdown?JSON.stringify(result,null,2)+'\n':result.markdown);
+ if(result.blockers?.length)process.exitCode=1;
+}catch(error){process.stderr.write(error.message+'\n');process.exitCode=1;}

package/template/scripts/dispatch-slice-task

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import { parseArgs } from 'node:util';
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { parseSliceYaml } from './lib/slice-contract.mjs';
+import { compileSliceTaskPackage } from './lib/slice-task-package.mjs';
+try {
+  const { values } = parseArgs({ options: { root: { type: 'string' }, input: { type: 'string' } } });
+  if (!values.root || !values.input) throw new TypeError('用法: dispatch-slice-task --root <project> --input <task-input.yaml>');
+  const input = parseSliceYaml(readFileSync(values.input));
+  const result = compileSliceTaskPackage(input.binding, { ...input, root: path.resolve(values.root) });
+  process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+} catch (error) { process.stderr.write(`${error.message}\n`); process.exitCode = 1; }

package/template/scripts/lib/api-contract-decision.mjs

@@ -1,4 +1,6 @@
-import { readFileSync } from "node:fs";
+import {readContractSource} from './contract-source.mjs';
+import { readFileSync, withValidationPhase } from "./validation-phase.mjs";
+import { parseSliceYaml } from "./slice-contract.mjs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseDocument } from "../vendor/yaml.mjs";
@@ -15,15 +17,18 @@ const readBound = (root, ref, label) => {
 };
 const requireDigest = (asset, expected) => { if (asset.digest !== expected) fail(`${asset.label}摘要漂移`); };
 
-export function validateApiContractDecision(binding, { root = TEMPLATE_ROOT } = {}) {
+export function validateApiContractDecision(binding, options = {}) {return withValidationPhase({root:options.root||TEMPLATE_ROOT,purpose:'api-decision',slice_id:binding?.ref,readOnly:true},()=>validate(binding,options));}
+function validate(binding, { root = TEMPLATE_ROOT } = {}) {
   if (!binding || !binding.ref || !binding.version || !binding.digest || !["required", "not-applicable"].includes(binding.impact)) fail("缺少 API Contract Decision 当前版本绑定");
   const projectRoot = path.resolve(root);
   const decisionAsset = readBound(projectRoot, binding.ref, "API Contract Decision");
   requireDigest(decisionAsset, binding.digest);
   const document = parseDocument(decisionAsset.bytes.toString("utf8"), { uniqueKeys: true, maxAliasCount: 0 });
   if (document.errors.length) fail(`API Contract Decision 无法解析: ${document.errors[0].message}`);
-  const decision = document.toJS({ maxAliasCount: 0 });
-  validateJsonSchema(decision, SCHEMA, { cwd: TEMPLATE_ROOT, label: "API Contract Decision v1" });
+  const original = parseSliceYaml(decisionAsset.bytes);
+  validateJsonSchema(original, original.schema_version===2?SCHEMA.replace(".schema", "-v2.schema"):SCHEMA, { cwd: TEMPLATE_ROOT, label: "API Contract Decision" });
+  if(original.status!=="approved")fail("API Contract Decision 必须经生命周期批准为 approved");
+  const decision={...structuredClone(original),current_version:true}; // Derived only after schema and current raw binding checks; never persisted.
   if (decision.decision_version !== binding.version || decision.impact !== binding.impact) fail("API Contract Decision 版本或影响结论与合同不一致");
   requireDigest(readBound(projectRoot, decision.assessment_ref, "API 影响评估"), decision.assessment_digest);
   for (const ref of decision.evidence_refs) readBound(projectRoot, ref, "API Decision 证据");
@@ -40,6 +45,12 @@ export function validateApiContractDecision(binding, { root = TEMPLATE_ROOT } =
   const reviewRecord = reviewDocument.toJS({ maxAliasCount: 0 });
   if (reviewRecord?.result !== "approved" || !Array.isArray(reviewRecord.blocking_findings) || reviewRecord.blocking_findings.length > 0) fail("OpenAPI Draft Review 实际记录未批准或仍有阻断项");
   if (reviewRecord.draft_ref !== decision.openapi.ref || reviewRecord.draft_digest !== decision.openapi.digest) fail("OpenAPI Draft Review 实际记录未绑定当前权威 YAML");
+  if (!Array.isArray(reviewRecord.evidence_refs) || !reviewRecord.evidence_refs.length) fail("OpenAPI Draft Review 缺少实际证据");
+  for (const ref of reviewRecord.evidence_refs) readBound(projectRoot, ref, "OpenAPI Draft Review 实际证据");
+  if(original.schema_version===2){
+    decision.draft_review={...decision.draft_review,result:reviewRecord.result,blocking_findings:reviewRecord.blocking_findings,draft_ref:reviewRecord.draft_ref,draft_digest:reviewRecord.draft_digest,evidence_refs:reviewRecord.evidence_refs};
+    decision.freeze={...decision.freeze,draft_ref:decision.openapi.ref,draft_digest:decision.openapi.digest};
+  }
   for (const ref of decision.draft_review.evidence_refs) readBound(projectRoot, ref, "OpenAPI Draft Review 证据");
   const validated = validateOpenApiDraftValidationRecord(validation.file, { root: projectRoot });
   if (validated.record.draft.ref !== decision.openapi.ref || validated.draftDigest !== decision.openapi.digest) fail("OpenAPI Validation 未绑定当前权威 YAML");
@@ -47,3 +58,33 @@ export function validateApiContractDecision(binding, { root = TEMPLATE_ROOT } =
   if (decision.freeze.version !== decision.openapi.version || decision.freeze.draft_ref !== decision.openapi.ref || decision.freeze.draft_digest !== decision.openapi.digest) fail("OpenAPI Freeze 未绑定当前权威 YAML 版本和摘要");
   return { decision, openapi: decision.openapi, binding: { ref: binding.ref, version: binding.version, digest: binding.digest, impact: decision.impact } };
 }
+
+/** Source selectors contain business choices; digests are always derived from original bytes. */
+export function prepareApiContractDecision(input,{root=TEMPLATE_ROOT}={}) {
+ return withValidationPhase({root,purpose:'api-prepare',slice_id:input.decision_id,readOnly:true},()=>{
+  if(input.schema_version!==undefined&&input.schema_version!==2)fail('旧 schema 必须通过显式 migrate 迁移');
+  if(input.kind!==undefined&&input.kind!=='api-contract-decision')fail('来源 kind 与 API 决定冲突');
+  const allowed=new Set(['schema_version','kind','decision_id','decision_version','status','impact','assessment_ref','assessment_digest','evidence_refs','reason','openapi','validation_record','draft_review','freeze']);
+  for(const key of Object.keys(input))if(!allowed.has(key))fail(`未分类约束需人工处理: ${key}`);
+  if(input.status&&input.status!=='draft')fail('准备器不能创建批准身份或更新已批准合同');
+  const result=structuredClone(input);Object.assign(result,{schema_version:2,kind:'api-contract-decision',status:'draft'});
+  const conflicts=[];
+  const bind=(value,label)=>{try{return {...value,...readContractSource(value,{root}).binding};}catch(error){conflicts.push({field:label,source_ref:value.ref,reason:error.message,conflicts:error.conflicts||[],recovery:'核对双方来源并补齐当前文件后重新准备'});return value;}};
+  result.assessment_digest=bind({ref:input.assessment_ref,...(input.assessment_digest?{digest:input.assessment_digest}:{})},'API 影响评估').digest;
+  for(const key of ['openapi','validation_record','draft_review'])if(result[key])result[key]=bind(result[key],key);
+  for(const ref of result.evidence_refs||[])try{readBound(root,ref,'API 决定证据');}catch(error){conflicts.push({field:'evidence_refs',source_ref:ref,reason:error.message,recovery:'补齐当前证据后重新准备'});}
+  if(conflicts.length)throw Object.assign(new TypeError(conflicts.map(item=>`${item.field}: ${item.reason}; 恢复: ${item.recovery}`).join('\n')),{code:'API_SOURCE_CONFLICT',conflicts});
+  validateJsonSchema(result,SCHEMA.replace('.schema','-v2.schema'),{label:'API Contract Decision v2 草案'});
+  return result;
+ });
+}
+export function migrateApiContractDecision(binding,{root=TEMPLATE_ROOT,version}={}) {
+ return withValidationPhase({root,purpose:'api-migrate',slice_id:binding?.ref,readOnly:true},()=>{
+  const validated=validateApiContractDecision(binding,{root}),old=validated.decision;
+  if(old.schema_version!==1)fail('显式迁移只接受 v1');
+  if(!/^v[1-9][0-9]*$/.test(version)||BigInt(version.slice(1))<=BigInt(old.decision_version.slice(1)))fail('迁移必须选择新的递增决定版本');
+  const result=structuredClone(old);result.schema_version=2;result.decision_version=version;result.status='draft';delete result.current_version;
+  if(result.draft_review){result.evidence_refs=[...new Set([...result.evidence_refs,...result.draft_review.evidence_refs])];result.draft_review={ref:result.draft_review.ref,digest:result.draft_review.digest};result.freeze={version:result.freeze.version,frozen_at:result.freeze.frozen_at};}
+  return prepareApiContractDecision(result,{root});
+ });
+}

package/template/scripts/lib/approval-record.mjs

@@ -1,5 +1,5 @@
 import { assertApprovalUserDecision } from './user-decision-reuse.mjs';
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync } from './validation-phase.mjs';
 import path from "node:path";
 import { parseDocument } from "../vendor/yaml.mjs";
 import {

package/template/scripts/lib/approved-execution-context.mjs

@@ -1,12 +1,15 @@
+import {validateJsonSchemas} from './json-schema.mjs';
+import { assertScopeSlice, assertScopeWorkUnit } from './lifecycle-execution-scope.mjs';
 import { selectSliceWorkUnit, normalizeSliceContract, sourceSliceContract, parseSliceYaml } from './slice-contract.mjs';
 import path from 'node:path';
-import { readFileSync } from 'node:fs';
+import { readFileSync, inValidationPhase, validationMemo, validationPhaseToken } from './validation-phase.mjs';
 import { ROOT, read, parse, safe, hash, digest, schema } from './strategic-handoff-io.mjs';
 import { countersignRuleForGate } from './digital-human-roles.mjs';
 import { validateApprovalRecord } from './approval-record.mjs';
 import { assertImplementationDecision } from './user-decision.mjs';
 import { loadSkillRegistry } from './skill-registry.mjs';
 
+const primeCache=Symbol('approval-schema-prime');
 const contexts=new WeakMap();
 const gateId='gate.slice-contract-approved';
 const check=(ok,code,message)=>{if(!ok){const error=new TypeError(`${code}: ${message}`);error.code=code;throw error;}};
@@ -68,27 +71,52 @@ function executionBasis(verified,{allowCompilerDrift=false}={}) {
   return verified;
 }
 
+function primeApprovalSchemas(binding,root){
+  if(!inValidationPhase())return;
+  validationMemo(primeCache,JSON.stringify([root,binding]),()=>{
+    const jobs=[];
+    const add=(value,ref,formatChecker,errorStyle)=>jobs.push({value,schemaPath:path.join(ROOT,ref),formatChecker,errorStyle});
+    // Speculative shape checks never decide approval or change the original error order.
+    // Original consumers still validate every semantic and authorization rule below.
+    try{
+      const source=parseSliceYaml(readFileSync(safe(root,binding.ref))),raw=source.slice_contract||source;
+      if(raw.schema_version===3)add(raw,'docs/process/schemas/slice-implementation-contract-v3.schema.json',false,'verbose');
+      const approval=read(safe(root,binding.approval_ref));
+      if(approval.gates&&approval.human_review&&!approval.gate_id){
+        add(approval,'docs/process/schemas/lifecycle-checkpoint.schema.json',false,'verbose');
+        for(const requirement of approval.human_review.user_decisions||[])if(requirement.user_decision_ref&&!requirement.continuation_ref){const ref=path.isAbsolute(requirement.user_decision_ref)?path.relative(root,requirement.user_decision_ref):requirement.user_decision_ref;add(read(safe(root,ref)),'docs/process/schemas/user-decision.schema.json',true,'compact');}
+      }
+    }catch{/* The original consumer reports missing or invalid input with its existing code. */}
+    if(jobs.length)validateJsonSchemas(jobs);return true;
+  });
+}
 export function createApprovedExecutionContext(binding,options={}) {
+  primeApprovalSchemas(binding,path.resolve(options.root||process.cwd()));
   const verified=executionBasis(verifySliceContractApproval(binding,options));
-  selectSliceWorkUnit(verified.contract,options.work_unit_id);
+  assertScopeSlice(selectSliceWorkUnit(verified.contract,options.work_unit_id),{root:verified.root});
+  if(!options.readOnly)assertScopeWorkUnit('work-unit.slice-implementation',{root:verified.root});
   const context=Object.freeze({kind:'approved-slice-execution-context'});
-  contexts.set(context,{binding:verified.binding,root:verified.root,work_unit_id:options.work_unit_id,allowCompilerDrift:false});
+  contexts.set(context,{phase:validationPhaseToken(),binding:verified.binding,root:verified.root,work_unit_id:options.work_unit_id,allowCompilerDrift:false,readOnly:options.readOnly===true});
   return context;
 }
 
 /** A prior approved scope may authenticate bounded output while current compiler facts are recomputed. */
 export function createApprovedRecompilationContext(binding,options={}) {
-  const verified=executionBasis(verifySliceContractApproval(binding,options),{allowCompilerDrift:true});
-  selectSliceWorkUnit(verified.contract,options.work_unit_id);
+  const verified=executionBasis(verifySliceContractApproval(binding,options),{allowCompilerDrift:true,readOnly:options.readOnly===true});
+  assertScopeSlice(selectSliceWorkUnit(verified.contract,options.work_unit_id),{root:verified.root});
+  if(!options.readOnly)assertScopeWorkUnit('work-unit.slice-implementation',{root:verified.root});
   const context=Object.freeze({kind:'approved-slice-recompilation-context'});
-  contexts.set(context,{binding:verified.binding,root:verified.root,work_unit_id:options.work_unit_id,allowCompilerDrift:true});
+  contexts.set(context,{phase:validationPhaseToken(),binding:verified.binding,root:verified.root,work_unit_id:options.work_unit_id,allowCompilerDrift:true,readOnly:options.readOnly===true});
   return context;
 }
 
 /** Revalidate original bytes on every boundary; a serialized/caller-invented context is rejected. */
-export function assertApprovedExecutionContext(context,{root=process.cwd(),contract,architectureIdentity,architectureEvidence,technicalDesign,sliceId}={}) {
+export function assertApprovedExecutionContext(context,{root=process.cwd(),contract,architectureIdentity,architectureEvidence,technicalDesign,sliceId,readOnly=false}={}) {
   const saved=contexts.get(context);
   check(saved&&saved.root===path.resolve(root),'EXECUTION_CONTEXT_UNTRUSTED','只允许从当前原始 Slice 与本地批准生成的执行上下文');
+  check(!saved.phase||saved.phase===validationPhaseToken(),'EXECUTION_CONTEXT_EXPIRED','不能跨验证阶段复用批准上下文');
+  check(!saved.readOnly||readOnly,'EXECUTION_CONTEXT_READ_ONLY','只读检查上下文不能执行实现');
+  if(!readOnly)assertScopeWorkUnit('work-unit.slice-implementation',{root});
   const verified=executionBasis(verifySliceContractApproval(saved.binding,{root,contract}),{allowCompilerDrift:saved.allowCompilerDrift});
   const current=selectSliceWorkUnit(verified.contract,saved.work_unit_id),resolution=current.resolution;
   if(sliceId)check(current.slice_id===sliceId,'EXECUTION_SCOPE_CONFLICT','执行上下文属于另一切片');

package/template/scripts/lib/backend-architecture.mjs

@@ -37,9 +37,9 @@ export function validateArchitectureIdentity(identity, registry = loadSkillRegis
 }
 
 // Existing projects must present original on-disk evidence, not three copies supplied by a caller.
-export function verifyArchitectureEvidence(identity, evidence, { root, registry = loadSkillRegistry(), execution } = {}) {
+export function verifyArchitectureEvidence(identity, evidence, { root, registry = loadSkillRegistry(), execution, readOnly=false } = {}) {
   validateArchitectureIdentity(identity, registry);
-  if (identity.schema_version === 2) return verifyExistingArchitecture(identity, evidence, { root, registry, execution });
+  if (identity.schema_version === 2) return verifyExistingArchitecture(identity, evidence, { root, registry, execution, readOnly });
   if (!evidence?.engineering_baseline || !evidence?.repository_registration || !evidence?.manifest) throw new TypeError("缺少工程基线、仓库登记或 Manifest 架构证据");
   assertArchitectureAgreement(identity, evidence, registry);
   return { source_kind: "scaffold", bindings: evidence };

package/template/scripts/lib/backend-delivery-terminal.mjs

@@ -0,0 +1,51 @@
+import { existsSync, readFileSync, rmSync } from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { inspectBackendDelivery, openBackendDelivery } from './backend-delivery.mjs';
+import { validateBackendReview } from './backend-review.mjs';
+import { read, safe, hash, json, write, ensure, project } from './strategic-handoff-io.mjs';
+import { loadExecutionScope, TERMINAL_REF } from './lifecycle-execution-scope.mjs';
+
+async function inspect(root, record) {
+  project(root);
+  ensure(loadExecutionScope(root)?.scope_id === 'plan-to-backend', '需要 plan-to-backend 职责范围');
+  ensure(record.schema_version === 1 && record.kind === 'backend-delivery-terminal'
+    && record.business_completed === false && record.release_authorized === false, '后端终点不是业务完成或发布批准');
+  for (const name of ['delivery', 'review_state']) {
+    ensure(hash(readFileSync(safe(root, record[name]?.ref))) === record[name].digest, `${name} 原始字节变化`);
+  }
+  const state = read(safe(root, record.review_state.ref));
+  const { delivery } = await inspectBackendDelivery(root, record.delivery.ref);
+  ensure(state.review_input?.scope_kind === 'change' && state.review_input.slice_contract_ref === delivery.slice_contract.ref, '独立审查未绑定交付的 Slice');
+  ensure(validateBackendReview(state, { root }).status === 'passed', '后端交付需要当前独立审查');
+  const commit = execFileSync('git', ['-C', path.resolve(root, state.review_input.project_root), 'rev-parse', 'HEAD'], { encoding: 'utf8' }).trim();
+  ensure(state.review_input.review_mode === 'committed' && delivery.build.source_commit === commit, '终点需要与当前已提交审查候选一致的真实构建源码提交');
+  ensure(record.downstream && ['owner', 'ticket_ref', 'verification_plan', 'target_version'].every(key => typeof record.downstream[key] === 'string' && record.downstream[key].trim()), '终点缺少下游接收责任和待办');
+  return openBackendDelivery(safe(root, record.bundle_ref), bundle => {
+    ensure(record.bundle_digest === bundle.manifest.bundle_digest && bundle.manifest.delivery_ref === record.delivery.ref, '终点绑定的交付包不一致');
+    // A different valid package must not be used to close the current source.
+    for (const file of bundle.manifest.files) if (file.original_ref) {
+      ensure(hash(readFileSync(safe(root, file.original_ref))) === file.sha256, `包与当前源不同: ${file.original_ref}`);
+    }
+    return { result: 'backend-delivered', delivery_id: delivery.delivery_id, version: delivery.version,
+      bundle_digest: bundle.manifest.bundle_digest, next_work_unit: null, business_completed: false,
+      release_authorized: false, live_service_checked: false, downstream: record.downstream };
+  });
+}
+
+export async function verifyBackendDeliveryTerminal(root) {
+  return inspect(root, read(safe(root, TERMINAL_REF)));
+}
+
+/** This closes only the backend responsibility after real package and review validation. */
+export async function completeBackendDelivery(root, input) {
+  root = path.resolve(root);
+  const record = { ...input, schema_version: 1, kind: 'backend-delivery-terminal', business_completed: false, release_authorized: false };
+  ensure(!existsSync(path.join(root, TERMINAL_REF)), '终点已存在；只能复验，不覆盖旧终点');
+  const result = await inspect(root, record);
+  const bytes = json(record);
+  write(root, TERMINAL_REF, bytes);
+  try { await verifyBackendDeliveryTerminal(root); }
+  catch (error) { if (readFileSync(safe(root, TERMINAL_REF), 'utf8') === bytes) rmSync(safe(root, TERMINAL_REF)); throw error; }
+  return result;
+}

package/template/scripts/lib/backend-platform-provenance.mjs

@@ -1,6 +1,6 @@
 /** Version qualification binds executable sources and generated bytes, not Skill prose. */
 import { createHash } from 'node:crypto';
-import { readFileSync, readdirSync, lstatSync } from 'node:fs';
+import { readFileSync, readdirSync, lstatSync } from './validation-phase.mjs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');

package/template/scripts/lib/backend-platform.mjs

@@ -1,7 +1,7 @@
 import { assertSourceFingerprint } from "./backend-platform-provenance.mjs";
 /** Shared, exact backend platform selection. Catalog entries are maintenance-owned. */
 import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
+import { readFileSync } from './validation-phase.mjs';
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 

package/template/scripts/lib/backend-review.mjs

@@ -3,8 +3,10 @@ import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { parseSliceYaml, selectSliceWorkUnit } from './slice-contract.mjs';
+import { validateApprovalRecord } from './approval-record.mjs';
 import { inspectSliceContract } from './slice-execution-preflight.mjs';
 import { inspectMaintenanceCandidate } from './maintenance-candidate.mjs';
+import { compileStandardsCoverage, coverageDigest, coverageFile, verifyCoverageRows } from './backend-standards-coverage.mjs';
 
 const ensure = (condition, message) => { if (!condition) throw new Error(`backend-review: ${message}`); };
 const text = value => typeof value === 'string' && value.trim();
@@ -22,12 +24,14 @@ function file(root, ref) {
 
 export function backendReviewSkills(contract, actualSkills = []) {
   return [...new Set([...(contract.resolution?.required_skills || []), ...(contract.common?.required_skills || []),
-    ...(contract.backend?.required_skills || []), ...actualSkills, 'alibaba-java-code-style', 'yss-repository', 'yss-mybatis'])].sort();
+    ...(contract.backend?.required_skills || []), ...actualSkills, 'alibaba-java-code-style'])].sort();
 }
 
 /** Validate existing code-review result and constraint_results; this is not an approval authority. */
 export function validateBackendReview(state, { root = process.cwd() } = {}) {
   const input = state?.review_input;
+  ensure(['baseline','change'].includes(input?.scope_kind), 'scope_kind required; historical records are read-only');
+  if (input.scope_kind === 'baseline') return validateBaselineReview(state, {root});
   ensure(input?.slice_contract_ref, 'review input must bind Slice contract');
   const loaded = inspectSliceContract(input.slice_contract_ref, { root, approval_ref: input.approval_ref, work_unit_id: input.work_unit_id });
   ensure(loaded.report.execution_allowed, `approved current contract required: ${loaded.report.blockers.join('; ')}`);
@@ -68,25 +72,9 @@ export function validateBackendReview(state, { root = process.cwd() } = {}) {
     ensure(tree === input.candidate_digest, 'committed candidate mismatch');
     ensure(git(projectRoot, ['rev-parse','HEAD^{tree}']).toString().trim() === tree && !git(projectRoot, ['status','--porcelain']).length, 'committed candidate is not current clean checkout');
   }
-  const layerSkills = { domain: 'yss-domain', application: 'yss-application', infrastructure: 'yss-repository', web: 'yss-web-controller' };
-  const actualSkills = [...input.actual_skill_impacts, ...(contract.backend.affected_layers || []).map(layer => layerSkills[layer]).filter(Boolean)];
-  const required = backendReviewSkills(contract, actualSkills);
-  const applicable = new Set([...(contract.resolution?.required_skills || []), ...(contract.common?.required_skills || []), ...(contract.backend?.required_skills || []), ...actualSkills, "alibaba-java-code-style"]);
-  ensure(Array.isArray(result.constraint_results), 'constraint_results required');
-  for (const skill of required) {
-    const rows = result.constraint_results.filter(row => row.skill === skill && row.axis === 'Standards');
-    ensure(rows.length, `skill not reviewed: ${skill}`);
-    for (const row of rows) {
-      ensure(text(row.constraint) && text(row.rule_ref) && text(row.code_ref) && text(row.evidence_ref), `${skill}: rule/code/evidence required`);
-      ensure(['passed','not-applicable'].includes(row.status), `${skill}: unresolved violation`);
-      ensure(row.status !== 'not-applicable' || (text(row.reason) && !applicable.has(skill)), `${skill}: applicable skill cannot be waived`);
-      ensure(row.rule_ref.startsWith(`.agents/skills/${skill}/`), `${skill}: rule must cite its canonical skill`);
-      const rule = fs.readFileSync(file(root, row.rule_ref.split('#')[0]));
-      ensure(digest(rule) === row.rule_digest, `${skill}: rule evidence stale`);
-      ensure(fs.existsSync(file(projectRoot, row.code_ref.split(':')[0])), `${skill}: missing code location`);
-      ensure(digest(fs.readFileSync(file(root, row.evidence_ref))) === row.evidence_digest, `${skill}: verification evidence stale`);
-    }
-  }
+  const coverage = currentStandardsCoverage(input, {root, projectRoot, contract});
+  verifyCoverageRows(coverage, result.constraint_results, {root, projectRoot});
+  const required = coverage.skills.map(row => row.skill);
   ensure(Array.isArray(result.verification_results) && result.verification_results.length > 0, 'machine verification required');
   for (const check of result.verification_results) {
     ensure(text(check.command) && Number.isFinite(Date.parse(check.executed_at)) && check.exit_code === 0 && check.candidate_digest === result.candidate_digest, 'machine check failed, absent or stale');
@@ -100,3 +88,53 @@ export function validateBackendReview(state, { root = process.cwd() } = {}) {
   }
   return { status: 'passed', candidate_digest: input.candidate_digest, reviewed_skills: required };
 }
+
+/** Recompute derived coverage, do not trust a submitted expected-rule list. */
+export function currentStandardsCoverage(input, {root, projectRoot, contract=null}={}) {
+  ensure(input.standards_coverage_ref && input.standards_coverage_digest, 'standards coverage binding required');
+  const bytes=fs.readFileSync(file(root,input.standards_coverage_ref));
+  ensure(digest(bytes)===input.standards_coverage_digest, 'standards coverage digest stale');
+  const recorded=parseSliceYaml(bytes.toString());
+  let comparison_ref=null;
+  if(input.scope_kind==='change') {
+    comparison_ref=input.review_mode==='worktree'
+      ? inspectMaintenanceCandidate({manifestPath:file(projectRoot,input.candidate_snapshot_ref)}).manifest.merge_base
+      : input.review_base_ref;
+  }
+  const current=compileStandardsCoverage({root,projectRoot,contract,scope_kind:input.scope_kind,
+    baseline_binding:input.baseline_binding,comparison_ref,actual_skills:input.actual_skill_impacts||[],responsibility_evidence:input.responsibility_evidence||[]});
+  ensure(coverageDigest(current)===coverageDigest(recorded),'standards coverage stale or incomplete');
+  return current;
+}
+
+function validateBaselineReview(state,{root}) {
+  const input=state.review_input,projectRoot=fs.realpathSync(path.resolve(root,input.project_root||'.'));
+  const coverage=currentStandardsCoverage(input,{root,projectRoot});
+  const result=parseSliceYaml(fs.readFileSync(file(root,state.review_result_ref),'utf8'));
+  ensure(result.skill==='code-review' && result.result==='completed','independent code-review baseline report required');
+  ensure(result.candidate_digest===coverageDigest(coverage.inventory) && input.candidate_digest===result.candidate_digest,'baseline candidate stale');
+  for(const key of ['actor_id','runtime_id','instance_id'])ensure(text(result.reviewer?.[key])&&text(result.implementer?.[key]),'baseline actor identity required');
+  ensure(result.reviewer.actor_id!==result.implementer.actor_id && result.reviewer.instance_id!==result.implementer.instance_id,'independent Reviewer required');
+  ensure(result.implementer.actor_id===input.implementation_actor_id && result.implementer.instance_id===input.implementation_instance_id,'baseline actor mismatch');
+  verifyCoverageRows(coverage,result.constraint_results,{root,projectRoot});
+  ensure(result.axes?.Standards==='passed','Standards must pass');
+  ensure(['passed','missing_evidence'].includes(result.axes?.Spec),'baseline Spec must be explicit');
+  if(result.axes.Spec==='passed') {
+    ensure(input.spec_binding?.ref && input.spec_binding?.digest,'approved Spec evidence binding required');
+    ensure(digest(fs.readFileSync(file(root,input.spec_binding.ref)))===input.spec_binding.digest.replace(/^sha256:/,''),'Spec evidence stale');
+    ensure(text(input.spec_binding.approval_ref),'Spec approval record required');
+    const approval=parseSliceYaml(fs.readFileSync(file(root,input.spec_binding.approval_ref),'utf8'));
+    validateApprovalRecord(approval,{root,requireApproved:true,rolesDoc:parseSliceYaml(fs.readFileSync(file(root,'docs/agents/digital-human-roles.yaml'),'utf8'))});
+    ensure(approval.gate_id==='gate.spec-baseline-approved' && approval.artifact_bindings?.some(b=>b.digest.replace(/^sha256:/,'')===input.spec_binding.digest.replace(/^sha256:/,'')),'Spec approval does not bind current baseline');
+    ensure(Array.isArray(result.constraint_results)&&result.constraint_results.some(r=>r.axis==='Spec'&&r.status==='passed'&&text(r.evidence_ref)),'Spec acceptance evidence required');
+    for(const row of result.constraint_results.filter(r=>r.axis==='Spec')) {
+      ensure(row.status==='passed'&&text(row.constraint)&&text(row.code_ref)&&text(row.evidence_ref),'Spec acceptance unresolved');
+      coverageFile(projectRoot,row.code_ref.split(':')[0]);
+      ensure(digest(fs.readFileSync(file(root,row.evidence_ref)))===row.evidence_digest,'Spec acceptance evidence stale');
+    }
+  }
+  ensure(Array.isArray(result.findings)&&result.findings.every(f=>f.disposition==='suggestion'||f.status==='resolved'||(f.disposition==='missing_evidence'&&f.axis==='Spec'&&result.axes.Spec==='missing_evidence')),'baseline blocking findings remain');
+  ensure(Array.isArray(result.verification_results)&&result.verification_results.length,'baseline verification required');
+  for(const check of result.verification_results)ensure(text(check.command)&&check.exit_code===0&&Number.isFinite(Date.parse(check.executed_at))&&check.candidate_digest===result.candidate_digest&&digest(fs.readFileSync(file(root,check.evidence_ref)))===check.evidence_digest,'baseline machine evidence missing or stale');
+  return {status:'audited',axes:result.axes,execution_allowed:false,scope_kind:'baseline',candidate_digest:result.candidate_digest,reviewed_skills:coverage.skills.map(s=>s.skill)};
+}

package/template/scripts/lib/backend-scaffold-prerequisites.mjs

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync } from './validation-phase.mjs';
 import path from "node:path";
 import { parseDocument } from "../vendor/yaml.mjs";
 import { loadApprovalRecord, validateApprovalRecord } from "./approval-record.mjs";