create-yss-spec 3.4.8 → 3.4.10

package/template/scripts/lib/backend-standards-coverage.mjs

@@ -0,0 +1,237 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { parseSliceYaml } from './slice-contract.mjs';
+import { treeHash } from './skill-supply-chain.mjs';
+
+export const coverageDigest = value => createHash('sha256').update(typeof value === 'string' || Buffer.isBuffer(value) ? value : JSON.stringify(value)).digest('hex');
+const ensure = (ok, message) => { if (!ok) throw Error(`backend-review: ${message}`); };
+const beneath = (file, scope) => scope === '.' || file === scope || file.startsWith(`${scope}/`);
+export const CORE_SKILLS = ['yss-web-controller','yss-dto','yss-domain','yss-application','yss-repository','yss-mybatis'];
+const roleSkills = {web:'yss-web-controller',server:'yss-web-controller',domain:'yss-domain',application:'yss-application',service:'yss-application',core:'yss-application',infrastructure:'yss-repository',persistence:'yss-repository',repository:'yss-repository'};
+export function coverageFile(root, ref) {
+  ensure(typeof ref === 'string' && ref && !path.isAbsolute(ref) && !ref.split(/[\\/]/).includes('..'), 'safe relative coverage reference required');
+  const resolved = fs.realpathSync(path.resolve(root, ref));
+  ensure(resolved.startsWith(`${fs.realpathSync(root)}${path.sep}`), 'coverage reference escapes root');
+  return resolved;
+}
+function binding(root, item) {
+  ensure(item?.ref && item?.digest, 'coverage basis ref/digest required');
+  const bytes = fs.readFileSync(coverageFile(root,item.ref));
+  ensure(coverageDigest(bytes) === item.digest.replace(/^sha256:/,''), `coverage basis stale: ${item.ref}`);
+  return parseSliceYaml(bytes.toString());
+}
+function files(root, prefix = '') {
+  return fs.readdirSync(path.join(root,prefix),{withFileTypes:true}).sort((a,b)=>a.name.localeCompare(b.name,'en')).flatMap(entry => {
+    if (['.git','target','node_modules'].includes(entry.name) || (prefix==='.template-source' && entry.name==='evidence')) return [];
+    const ref = prefix ? `${prefix}/${entry.name}` : entry.name;
+    ensure(!entry.isSymbolicLink(), `unresolved source symlink: ${ref}`);
+    return entry.isDirectory() ? files(root,ref) : [ref];
+  });
+}
+function git(root,args) {
+  const r=spawnSync('git',args,{cwd:root,encoding:'utf8',maxBuffer:32*1024*1024});
+  ensure(r.status===0,`coverage git ${args[0]} failed`); return r.stdout;
+}
+function stripComments(source) {
+  // Exclude literals too: a diagnostic string containing "FooRepository" is not a dependency.
+  return source.replace(/"""[\s\S]*?"""|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\/\*[\s\S]*?\*\/|\/\/[^\n]*/g, value => value.replace(/[^\n]/g,' '));
+}
+function uses(from,to) {
+  return to.declared.some(name => from.tokens.has(name) && (from.pkg===to.pkg || from.code.includes(`${to.pkg}.${name}`) || from.code.includes(`import ${to.pkg}.*`)));
+}
+function javaType(ref,source) {
+  const code=stripComments(source), pkg=code.match(/\bpackage\s+([\w.]+)\s*;/)?.[1];
+  const declared=[...code.matchAll(/(?:@\s*interface|\bclass|\binterface|\benum|\brecord)\s+(\w+)/g)].map(m=>m[1]);
+  const annotations=[...code.matchAll(/@([\w.]+)/g)].map(m=>m[1].split('.').at(-1));
+  const parents=[...code.matchAll(/\b(?:extends|implements)\s+([\w.,<>\s]+?)(?=\{|\bpermits\b)/g)].flatMap(m=>m[1].match(/\b[A-Z]\w*/g)||[]);
+  const tokens=new Set(code.match(/\b[A-Z]\w*/g)||[]);
+  return {ref,code,pkg,declared,annotations,parents,tokens,http:false,roles:new Set()};
+}
+function readRules(root,skill) {
+  ensure(/^[a-z][a-z0-9-]*$/.test(skill),'invalid skill identifier');
+  const folder=`.agents/skills/${skill}`;
+  ensure(fs.existsSync(path.join(root,folder,'SKILL.md')), `missing applicable skill: ${skill}`);
+  const sources=files(path.join(root,folder)).filter(p=>p.endsWith('.md') && !p.includes('source-index'));
+  const rules=[],sourceDigests=[];
+  for (const name of sources) {
+    const ref=`${folder}/${name}`, source=fs.readFileSync(coverageFile(root,ref),'utf8');
+    sourceDigests.push({ref,digest:coverageDigest(source)});
+    for (const m of source.matchAll(/^<!-- yss-rule (\{[^\n]+\}) -->$/gm)) {
+      const rule=JSON.parse(m[1]);
+      ensure(/^[a-z][a-z0-9.-]+$/.test(rule.id) && rule.level==='mandatory' && ['always','change','web','wire','domain','application','persistence','mybatis','pagination','batch'].includes(rule.when), `invalid rule declaration: ${ref}`);
+      ensure(source.includes(`<a id="${rule.id}"></a>`),`rule anchor missing: ${rule.id}`);
+      rules.push({...rule,skill,rule_ref:`${ref}#${rule.id}`,rule_digest:coverageDigest(source)});
+    }
+  }
+  // Whole-text semantic review is always required, including unstructured auxiliary rules.
+  const ref=`${folder}/SKILL.md`;
+  rules.push({id:`${skill}.full-text`,when:'always',level:'mandatory',evidence:'semantic-review',skill,rule_ref:ref,rule_digest:coverageDigest(fs.readFileSync(coverageFile(root,ref)))});
+  return {rules,sourceDigests};
+}
+
+/** Read-only derivation: never approves a contract or executes project build commands. */
+export function compileStandardsCoverage({root,projectRoot,contract=null,scope_kind='baseline',baseline_binding=null,comparison_ref=null,actual_skills=[],responsibility_evidence=[]}={}) {
+  ensure(['baseline','change'].includes(scope_kind),'scope_kind required');
+  root=fs.realpathSync(root);projectRoot=fs.realpathSync(projectRoot);
+  const basis=contract?.resolution?.architecture_evidence?.engineering_baseline || baseline_binding;
+  const baseline=basis?binding(root,basis):null;
+  const identity=contract?.resolution?.architecture_identity || baseline?.architecture_identity;
+  const family=identity?.architecture_family;
+  const issues=[];
+  if (baseline && (baseline.kind!=='existing-engineering-baseline' || baseline.status!=='current') && identity?.source_kind==='existing-registration') issues.push({id:'baseline-not-current',reason:'既有工程基线未标记为当前观测，须先核对登记'});
+  if (!['domain-driven','layered-mvc'].includes(family)) issues.push({id:'architecture-unknown',reason:'需要登记架构；只读盘点不能猜测 DDD/MVC'});
+  const all=files(projectRoot);
+  const roots=baseline?.source?.roots || ['.'];
+  ensure(roots.every(r=>r==='.' || (!path.isAbsolute(r)&&!r.split('/').includes('..'))),'invalid registered source roots');
+  const selected=all.filter(ref=>roots.some(r=>beneath(ref,r)));
+  const outside=all.filter(ref=>!selected.includes(ref)&&ref.endsWith('.java'));
+  if (outside.length) issues.push({id:'unregistered-source',reason:outside.join(', ')});
+  const inventory=selected.map(ref=>({path:ref,mode:fs.statSync(coverageFile(projectRoot,ref)).mode,digest:coverageDigest(fs.readFileSync(coverageFile(projectRoot,ref)))}));
+  const types=selected.filter(ref=>ref.endsWith('.java')).map(ref=>javaType(ref,fs.readFileSync(coverageFile(projectRoot,ref),'utf8')));
+  for(const t of types) if(!t.declared.length || /\\u[0-9a-fA-F]{4}/.test(t.code)) issues.push({id:`unparsed:${t.ref}`,reason:'源码类型解析不足，须人工核实或编译态证据'});
+  if(!types.some(t=>!t.ref.includes('/test/'))) issues.push({id:'zero-business-types',reason:'未发现业务类型，不能证明存量工程合规'});
+  const httpNames=new Set(['RestController','Controller','RequestMapping','GetMapping','PostMapping','PutMapping','DeleteMapping','PatchMapping']);
+  let changed=true;
+  while(changed){changed=false;for(const t of types) if(!t.http&&(t.annotations.some(a=>httpNames.has(a))||t.parents.some(p=>httpNames.has(p)))){t.http=true;for(const name of t.declared)httpNames.add(name);changed=true;}}
+  const localNames=new Set(types.flatMap(t=>t.declared));
+  const familiar=new Set([...httpNames,'interface','Override','Deprecated','SuppressWarnings','FunctionalInterface','Serializable','Comparable','Exception','RuntimeException','Service','Repository','Mapper','Entity','TableName','Id','TableId','Autowired','Component','Configuration','Bean','Valid','Validated','NotNull','NotBlank','Size','Min','Max','Pattern','RequestBody','RequestParam','PathVariable','RequestHeader','CookieValue','ResponseBody','ResponseStatus','ExceptionHandler','ControllerAdvice','RestControllerAdvice','Transactional','Data','Getter','Setter','Builder','NoArgsConstructor','AllArgsConstructor','RequiredArgsConstructor','Slf4j','EqualsAndHashCode','ToString','JsonProperty','JsonIgnore','JsonCreator','Test']);
+  const resolutions=responsibility_evidence.map(item=>({...binding(root,item),binding:item}));
+  const units=baseline?.build_units || [];
+  for(const t of types) {
+    for(const u of units) for(const [role,refs] of Object.entries(u.role_paths||{})) if(refs.some(ref=>beneath(t.ref,ref))) t.roles.add(role);
+    for(const a of contract?.backend?.first_slice?.artifacts||[]) if(a.path===t.ref)t.roles.add(a.role);
+    if(t.http)t.roles.add('web');
+    if(t.annotations.includes('Service'))t.roles.add('application');
+    if(t.annotations.some(a=>['Repository','Entity','TableName'].includes(a))||(t.annotations.includes('Mapper')&&!/org\.mapstruct/.test(t.code))||/\b(?:JdbcTemplate|SqlSession|EntityManager|BaseMapper)\b/.test(t.code))t.roles.add('persistence');
+    const unresolved=[...t.annotations,...t.parents].filter(n=>!localNames.has(n)&&!familiar.has(n));
+    if((unresolved.length || (!t.roles.size && !/@\s*interface\b/.test(t.code))) && !t.ref.includes('/test/')) {
+      const resolution=resolutions.find(r=>r.source_ref===t.ref);
+      if(!resolution)t.uncertainty={id:`unresolved-responsibility:${t.ref}`,reason:unresolved.join(', ')||'type has no registered or observed responsibility'};
+      else {
+        ensure(resolution.source_digest===coverageDigest(fs.readFileSync(coverageFile(projectRoot,t.ref))) && typeof resolution.reason==='string' && resolution.reason.trim() && Array.isArray(resolution.roles) && resolution.roles.length && resolution.roles.every(r=>roleSkills[r]||r==='data'),'responsibility evidence stale or invalid');
+        ensure(resolution.evidence_ref && resolution.evidence_digest && coverageDigest(fs.readFileSync(coverageFile(root,resolution.evidence_ref)))===resolution.evidence_digest,'responsibility verification evidence stale');
+        resolution.roles.forEach(r=>t.roles.add(r));
+        if(resolution.roles.some(r=>['web','server'].includes(r)))t.http=true;
+      }
+    }
+
+  }
+  let active=types, changedPaths=[];
+  if(scope_kind==='change') {
+    ensure(contract && comparison_ref,'change coverage needs approved contract and comparison_ref');
+    ensure(/^[a-f0-9]{40}$/.test(comparison_ref),'comparison_ref must be an immutable commit');
+    changedPaths=[...new Set([...git(projectRoot,['diff','--name-only',comparison_ref]).trim().split('\n'),...git(projectRoot,['ls-files','--others','--exclude-standard']).trim().split('\n')].filter(Boolean))];
+    const affected=new Set(types.filter(t=>changedPaths.includes(t.ref)));
+    // Source inventory is broad; semantic work is restricted to changed types and bidirectional dependency closure.
+    let expanding=true;
+    while(expanding){expanding=false;for(const t of types)if(!affected.has(t)&&[...affected].some(a=>uses(t,a)||uses(a,t))){affected.add(t);expanding=true;}}
+    active=[...affected];
+    if(changedPaths.some(p=>selected.includes(p)&&!p.endsWith('.java')&&!p.startsWith('.template-source/'))) active=types; // config/build changes can affect all types
+  }
+  issues.push(...active.flatMap(t=>t.uncertainty?[t.uncertainty]:[]));
+  const tags=new Set(['always',...(scope_kind==='change'?['change']:[])]), reasons=new Map();
+  const add=(skill,reason)=>{if(!reasons.has(skill))reasons.set(skill,new Set());reasons.get(skill).add(reason);};
+  const declaredSkills=[...(contract?.resolution?.required_skills||[]),...(contract?.common?.required_skills||[]),...(contract?.backend?.required_skills||[])];
+  for(const s of [...declaredSkills,...actual_skills])add(s,'contract-or-declared-impact');
+  add('alibaba-java-code-style','backend-scope');
+  for(const t of active.filter(t=>!t.ref.includes('/test/'))) {
+    for(const role of t.roles)if(roleSkills[role])add(roleSkills[role],t.ref);
+    if(t.http){tags.add('web');tags.add('wire');add('yss-dto',t.ref);}
+    if(/\b(?:PageResult|PageQuery|CommandDTO|QueryDTO|SingleResult|MultiResult)\b/.test(t.code)){tags.add('wire');add('yss-dto',t.ref);}
+    if(t.roles.has('domain')&&family==='domain-driven')tags.add('domain');
+    if([...t.roles].some(r=>['application','service','core'].includes(r)))tags.add('application');
+    if([...t.roles].some(r=>['repository','persistence','infrastructure'].includes(r)))tags.add('persistence');
+    if(/\b(?:PageQuery|PageRequest|PageResult|IPage|PageHelper|pageIndex|pageSize)\b/.test(t.code))tags.add('pagination');
+    if(/\b(?:insertBatch|saveBatch|updateBatch|executeBatch)\b/.test(t.code))tags.add('batch');
+    for(const [regex,skill] of [[/\b(?:Valid|Validated|NotNull|NotBlank|Size)\b/,'yss-validation'],[/\b(?:ExceptionHandler|ControllerAdvice|RestControllerAdvice)\b/,'yss-exception'],[/\borg\.mapstruct\b/,'mapstruct'],[/\blombok\b/,'lombok']])if(regex.test(t.code))add(skill,t.ref);
+  }
+  for(const layer of contract?.backend?.affected_layers||[]) if(roleSkills[layer])add(roleSkills[layer],`affected-layer:${layer}`);
+  const configPaths=(scope_kind==='baseline'?selected:selected.filter(p=>changedPaths.includes(p))).filter(p=>/\.(?:xml|ya?ml|properties|sql|json)$/.test(p));
+  const runtimeText=[...active.map(t=>t.code),...configPaths.filter(p=>!p.endsWith('.java')).map(p=>fs.readFileSync(coverageFile(projectRoot,p),'utf8'))].join('\n');
+  // Derive component ownership from the existing registry and the locked platform index.
+  // These are discovery signals only; they never certify component compatibility.
+  const discovery_sources=[];
+  const registryRef='docs/agents/yss-skill-registry.yaml';
+  if(fs.existsSync(path.join(root,registryRef))) {
+    const registryBytes=fs.readFileSync(coverageFile(root,registryRef));
+    discovery_sources.push({ref:registryRef,digest:coverageDigest(registryBytes)});
+    const registry=parseSliceYaml(registryBytes.toString());
+    const line=identity?.platform_configuration?.component_platform_line;
+    if(!['boot2-java8','boot3-java17'].includes(line))issues.push({id:'component-discovery-platform-unknown',reason:'组件发现需要已登记的平台源码索引，不跨平台借证据'});
+    else for(const skill of [...new Set((registry.capabilities||[]).filter(c=>c.provider?.kind==='yss-component').map(c=>c.primary_skill))].sort()) {
+      ensure(/^[a-z][a-z0-9-]*$/.test(skill),'invalid registered component skill');
+      const ref=`.agents/skills/${skill}/references/source-index.${line}.md`;
+      if(!fs.existsSync(path.join(root,ref))){issues.push({id:`component-index-missing:${skill}`,reason:ref});continue;}
+      const source=fs.readFileSync(coverageFile(root,ref),'utf8');
+      discovery_sources.push({ref,digest:coverageDigest(source)});
+      const symbols=[...source.matchAll(/src\/main\/java\/([\w/$]+)\.java/g)].map(m=>m[1].replaceAll('/','.'));
+      const gavs=[...source.matchAll(/GAV `([^:`]+):([^:`]+):[^`]+`/g)];
+      const symbolHit=symbols.some(symbol=>runtimeText.includes(symbol) || runtimeText.includes(`import ${symbol.slice(0,symbol.lastIndexOf('.'))}.*`));
+      const artifactHit=gavs.some(([,group,artifact])=>runtimeText.includes(`<groupId>${group}</groupId>`) && runtimeText.includes(`<artifactId>${artifact}</artifactId>`));
+      if(symbolHit||artifactHit)add(skill,`registered-component-index:${ref}`);
+    }
+  }
+  if(/org\.apache\.ibatis|com\.baomidou|mybatis|<mapper\b/i.test(runtimeText)){tags.add('mybatis');tags.add('persistence');add('yss-mybatis','source-or-build-binding');add('yss-repository','source-or-build-binding');}
+  if(/\b(?:JdbcTemplate|EntityManager)\b|spring-boot-starter-data-jpa|<mapper\b/.test(runtimeText)){tags.add('persistence');add('yss-repository','source-or-build-binding');}
+  for(const [skill,tag] of [['yss-web-controller','web'],['yss-dto','wire'],['yss-domain','domain'],['yss-application','application'],['yss-repository','persistence'],['yss-mybatis','mybatis']])if(reasons.has(skill))tags.add(tag);
+  if(family==='layered-mvc'){tags.delete('domain');if(reasons.has('yss-domain'))issues.push({id:'mvc-domain-conflict',reason:'MVC 不应加载 DDD 专属技能，须回合同核对'});reasons.delete('yss-domain');}
+  const observedSkills=[...reasons.keys()].sort();
+  if(scope_kind==='change')for(const skill of observedSkills)if(skill!=='alibaba-java-code-style'&&!declaredSkills.includes(skill))issues.push({id:`undeclared-skill:${skill}`,reason:'actual impact exceeds contract; recompile before execution'});
+  const constraints=[],rulesSources=[];
+  const lock=path.join(root,'skills-lock.json');
+  const skillLock=fs.existsSync(lock)?JSON.parse(fs.readFileSync(lock,'utf8')):null;
+  if(!skillLock)issues.push({id:'skill-lock-missing',reason:'缺少锁定的 canonical Skill 来源；只读盘点不能声明规范已锁定'});
+  const skillTrees={};
+  for(const skill of observedSkills) {
+    ensure(/^[a-z][a-z0-9-]*$/.test(skill),'invalid skill identifier');
+    const skillRoot=path.join(root,'.agents/skills',skill);
+    if(fs.existsSync(skillRoot)) {
+      skillTrees[skill]=treeHash(skillRoot);
+      if(skillLock?.skills?.shared?.[skill]?.effectiveHash!==skillTrees[skill])issues.push({id:`skill-lock-drift:${skill}`,reason:'技能正文、引用或源码索引与锁不一致'});
+    }
+  }
+  for(const skill of observedSkills){const {rules,sourceDigests}=readRules(root,skill);rulesSources.push(...sourceDigests);for(const rule of rules){const applicability=tags.has(rule.when)?'required':(['pagination','batch'].includes(rule.when)?'conditional':'not-applicable');constraints.push({...rule,constraint_id:rule.id,applicability,applicability_basis:applicability==='required'?[...reasons.get(skill)].sort():[`no-observed-${rule.when}; reviewer must reconcile actual behavior`]});}}
+  ensure(new Set(constraints.map(r=>r.constraint_id)).size===constraints.length,'duplicate canonical constraint_id');
+  const platform=identity?.platform_configuration;
+  const catalogRef='docs/engineering/backend-platforms.json';
+  const catalogPath=path.join(root,catalogRef);
+  let platform_catalog_digest=null;
+  if(platform?.profile_id && fs.existsSync(catalogPath)) {
+    const bytes=fs.readFileSync(catalogPath);platform_catalog_digest=coverageDigest(bytes);
+    const profile=JSON.parse(bytes).profiles.find(p=>p.id===platform.profile_id);
+    if(!profile || profile.java_version!==platform.java_version || profile.spring_boot_version!==platform.spring_boot_version || profile.component_platform_line!==platform.component_platform_line)issues.push({id:'platform-identity-mismatch',reason:'登记精确平台与事实源不一致'});
+    else if(types.some(t=>new RegExp(`\\bimport\\s+${profile.validation_namespace==='javax'?'jakarta':'javax'}\\.(?:validation|servlet)\\.`).test(t.code)))issues.push({id:'platform-namespace-mismatch',reason:'源码使用了目标平台之外的 Validation/Servlet 命名空间'});
+  }
+  const findings=[];
+  for(const t of active) {
+    const dependencies=types.filter(other=>other!==t&&uses(t,other));
+    if([...t.roles].some(r=>['infrastructure','repository','persistence'].includes(r)) && dependencies.some(o=>[...o.roles].some(r=>['web','server'].includes(r))))findings.push({constraint_id:'repository.ownership',code_ref:t.ref,disposition:'violation',reason:'持久化层引用 Web 类型'});
+    if(t.http && !t.annotations.some(a=>['ControllerAdvice','RestControllerAdvice'].includes(a)) && (dependencies.some(o=>[...o.roles].some(r=>['domain','repository','infrastructure','persistence'].includes(r)))||/\b(?:[A-Z]\w*(?:Gateway|Repository|Mapper)|JdbcTemplate|EntityManager)\b/.test(t.code)))findings.push({constraint_id:'web.use-case',code_ref:t.ref,disposition:'violation',reason:'HTTP 入口直接引用领域/持久化能力'});
+    if(t.roles.has('domain')&&family==='domain-driven'&&/\bimport\s+(?:org\.springframework|org\.apache\.ibatis|com\.baomidou|jakarta\.persistence|javax\.persistence)\./.test(t.code))findings.push({constraint_id:'domain.dependencies',code_ref:t.ref,disposition:'violation',reason:'Domain 技术依赖泄漏'});
+  }
+  return {schema_version:1,scope_kind,architecture_identity:identity||null,basis: basis||null,comparison_ref,source_roots:roots,source_head:git(projectRoot,['rev-parse','HEAD']).trim(),changed_paths:changedPaths.sort(),inventory,reviewed_paths:active.map(t=>t.ref).sort(),skills:observedSkills.map(skill=>({skill,tree_digest:skillTrees[skill],reasons:[...reasons.get(skill)].sort()})),skill_assessments:CORE_SKILLS.map(skill=>({skill,status:observedSkills.includes(skill)?'applicable':'not-applicable',reason:observedSkills.includes(skill)?'observed-or-declared':'no matching registered responsibility or source signal'})),constraints:constraints.sort((a,b)=>a.constraint_id.localeCompare(b.constraint_id)),responsibility_evidence,discovery_sources,platform_catalog_digest,rule_sources:rulesSources.sort((a,b)=>a.ref.localeCompare(b.ref)),skill_lock_digest:fs.existsSync(lock)?coverageDigest(fs.readFileSync(lock)):null,issues,findings,limitations:['源码检查用于发现职责与明确反例，不替代编译态 ArchUnit、HTTP fixture 或 Reviewer 全文语义审查。']};
+}
+
+export function verifyCoverageRows(coverage, rows, {root,projectRoot}={}) {
+  ensure(!coverage.issues.length,`coverage unresolved: ${coverage.issues.map(i=>i.id).join(', ')}`);
+  ensure(!coverage.findings.length,`Standards violation: ${coverage.findings.map(i=>i.constraint_id).join(', ')}`);
+  ensure(Array.isArray(rows),'constraint_results required');
+  const standards=rows.filter(r=>r.axis==='Standards');
+  ensure(new Set(standards.map(r=>r.constraint_id)).size===standards.length,'duplicate constraint result');
+  for(const expected of coverage.constraints) {
+    const row=standards.find(r=>r.constraint_id===expected.constraint_id);
+    ensure(row,`constraint not reviewed: ${expected.constraint_id}`);
+    ensure(row.skill===expected.skill && row.rule_ref===expected.rule_ref && row.rule_digest===expected.rule_digest,'constraint owner/rule mismatch');
+    ensure(typeof row.constraint==='string'&&row.constraint.trim()&&Array.isArray(row.applicability_basis)&&coverageDigest(row.applicability_basis)===coverageDigest(expected.applicability_basis),'constraint applicability evidence required');
+    ensure(['passed','not-applicable'].includes(row.status),`${expected.constraint_id}: unresolved violation`);
+    if(row.status==='not-applicable')ensure(expected.applicability!=='required' && typeof row.reason==='string' && row.reason.trim(),`${expected.constraint_id}: applicable rule cannot be waived`);
+    ensure(row.code_ref && row.evidence_ref && row.evidence_digest,'rule/code/evidence required');
+    coverageFile(projectRoot,row.code_ref.split(':')[0]);
+    ensure(coverageDigest(fs.readFileSync(coverageFile(root,row.evidence_ref)))===row.evidence_digest,'verification evidence stale');
+    if(expected.evidence==='semantic-review')ensure(typeof row.review_notes==='string'&&row.review_notes.trim().length>=20,'full-text semantic review needs concrete reasoning');
+  }
+  const ids=new Set(coverage.constraints.map(r=>r.constraint_id));
+  ensure(standards.every(r=>ids.has(r.constraint_id)),'unknown constraint result; update canonical declaration before asserting coverage');
+}

package/template/scripts/lib/context-contract.mjs

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { existsSync, lstatSync, readFileSync, readdirSync } from "node:fs";
+import { existsSync, lstatSync, readFileSync, readdirSync } from './validation-phase.mjs';
 import path from "node:path";
 
 const CONTEXT_FILE = "CONTEXT.md";

package/template/scripts/lib/context-reconciliation.mjs

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync } from './validation-phase.mjs';
 import path from "node:path";
 import { parseDocument } from "../vendor/yaml.mjs";
 import { resolveContextTermRefs, verifyContextSnapshot } from "./context-contract.mjs";

package/template/scripts/lib/contract-source.mjs

@@ -0,0 +1,22 @@
+import {readFileSync} from './validation-phase.mjs';
+import {safe,hash} from './strategic-handoff-io.mjs';
+import {parseSliceYaml} from './slice-contract.mjs';
+export function contractSourceMetadata(bytes){
+ const text=String(bytes),front=/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(text);
+ if(front)return parseSliceYaml(front[1]);
+ return /^\s*[{[]/.test(text)||/^[A-Za-z_][\w-]*:\s/m.test(text)&&!/^#/m.test(text)?parseSliceYaml(text):{};
+}
+/** Reads original bytes; returns derivable facts only. It never selects or approves a source. */
+export function readContractSource(selection,{root=process.cwd(),read=ref=>readFileSync(safe(root,ref))}={}){
+ const selected=typeof selection==='string'?{ref:selection}:selection;
+ if(!selected?.ref)throw new TypeError('来源选择缺少 ref');
+ const bytes=read(selected.ref),digest=hash(bytes),data=contractSourceMetadata(bytes);
+ const observed=data.requirement_version??data.version??data.contract_version??data.decision_version;
+ const conflicts=[];
+ const conflict=(field,before,after)=>conflicts.push({field,source_ref:selected.ref,before,after});
+ if(selected.digest&&selected.digest!==digest)conflict('digest',selected.digest,digest);
+ if(selected.version!==undefined&&observed!==undefined&&String(selected.version)!==String(observed))conflict('version',selected.version,observed);
+ if(conflicts.length){const error=new TypeError(conflicts.map(({field,before,after})=>`${field==='version'?'来源版本冲突':'来源冲突'} ${selected.ref}.${field}: supplied=${before}; observed=${after}; 恢复: 核对双方来源并显式选择当前版本`).join('\n'));Object.assign(error,{code:'SLICE_SOURCE_CONFLICT',...conflicts[0],conflicts});throw error;}
+ const version=selected.version??observed;
+ return {bytes,data,binding:{ref:selected.ref,digest,...(version!==undefined?{version:String(version)}:{}),...(selected.approval_ref?{approval_ref:selected.approval_ref}:{})}};
+}

package/template/scripts/lib/contract-views.mjs

@@ -0,0 +1,109 @@
+import {readFileSync,withValidationPhase} from './validation-phase.mjs';
+import {safe,hash,schema} from './strategic-handoff-io.mjs';
+import {parseSliceYaml,readSliceContract} from './slice-contract.mjs';
+import {renderSliceContractView,diffSliceContracts} from './slice-contract-views.mjs';
+
+// This is a presentation adapter table, never a lifecycle or approval registry.
+export const contractKinds=Object.freeze({
+ slice:null,plan:null,spec:null,'product-design':null,'prototype-confirmation':null,'visual-baseline':null,
+ 'technical-design':'.agents/skills/yss-technical-design/references/technical-design.schema.json',
+ 'api-decision':'docs/process/schemas/api-contract-decision.schema.json',
+ 'data-decision':'docs/process/schemas/data-architecture-decision.schema.json',
+ scaffold:'docs/process/schemas/project-scaffold-contract.schema.json',
+ 'scaffold-decision':'docs/process/schemas/scaffold-architecture-decisions.schema.json',
+ handoff:null,'backend-delivery':'docs/process/schemas/backend-delivery.schema.json',
+ 'frontend-acceptance':'docs/process/schemas/frontend-delivery-acceptance.schema.json',approval:null,'user-decision':'docs/process/schemas/user-decision.schema.json',
+ 'context-reconciliation':'docs/process/schemas/context-reconciliation.schema.json'
+});
+const object=v=>v&&typeof v==='object'&&!Array.isArray(v);
+const stringify=v=>typeof v==='string'?v:JSON.stringify(v,null,2);
+const metadata=/^(schema_version|kind|digest|sha256|subject_digest|.*_digest|.*_sha256|resolution|basis|inputs|sources|artifact_bindings|current_version)$/;
+function display(value){
+ if(Array.isArray(value))return value.map(display);
+ if(!object(value))return value;
+ return Object.fromEntries(Object.entries(value).filter(([key])=>!metadata.test(key)).map(([k,v])=>[k,display(v)]));
+}
+function validateKind(kind){if(!Object.hasOwn(contractKinds,kind))throw new TypeError(`未知合同类型 ${kind}；可用：${Object.keys(contractKinds).join(', ')}`);}
+function load(ref,root){
+ const bytes=readFileSync(safe(root,ref));
+ if(/\.md$/i.test(ref)){
+  const text=bytes.toString('utf8'),front=/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(text);
+  return{bytes,raw:{...(front?parseSliceYaml(front[1]):{}),正文:front?text.slice(front[0].length):text}};
+ }
+ const raw=parseSliceYaml(bytes);if(!object(raw))throw new TypeError('合同必须是结构化对象或 Markdown 文档');return{bytes,raw};
+}
+function references(value,root,rows=[],seen=new Set()){
+ if(!value||typeof value!=='object')return rows;
+ if(object(value)&&typeof value.ref==='string'&&typeof value.digest==='string'){
+  const key=`${value.ref}\0${value.digest}`;
+  if(!seen.has(key)){seen.add(key);try{rows.push({ref:value.ref,current:hash(readFileSync(safe(root,value.ref)))===value.digest});}catch(error){rows.push({ref:value.ref,current:false,error:error.message});}}
+ }
+ if(object(value))for(const [key,ref]of Object.entries(value))if(key.endsWith('_ref')&&typeof ref==='string'&&typeof value[key.replace(/_ref$/,'_digest')]==='string')references({ref,digest:value[key.replace(/_ref$/,'_digest')]},root,rows,seen);
+ for(const child of Object.values(value))references(child,root,rows,seen);
+ return rows;
+}
+function declaredBlockers(value,prefix=''){
+ if(!value||typeof value!=='object')return[];
+ const rows=[];
+ for(const [key,child]of Object.entries(value)){
+  const field=prefix?`${prefix}.${key}`:key;
+  if(['blockers','blocking_findings','stale_inputs','readiness_blockers'].includes(key)&&Array.isArray(child))for(const item of child)rows.push(`${field}: ${stringify(item)}`);
+  else rows.push(...declaredBlockers(child,field));
+ }
+ return rows;
+}
+function markdown(view){
+ const lines=[`# ${view.kind} · ${view.binding.id||view.binding.ref}`,`版本：${view.binding.version||'源资产未声明'}；权威文件：${view.binding.ref}`,`摘要：${view.binding.digest}`,`检查：${view.checks.join('；')}。批准有效性未核验；本视图不授予执行权限。`];
+ for(const [name,value]of Object.entries(view.content))if(value!==undefined)lines.push(`## ${name}`,stringify(value));
+ if(view.blockers.length)lines.push('## 阻断与未决检查',...view.blockers.map(x=>`- ${x}`));
+ return lines.join('\n\n')+'\n';
+}
+export function viewContract(ref,options={}){return withValidationPhase({root:options.root,purpose:'contract-view',slice_id:ref,work_unit_id:options.unit_id,readOnly:true},()=>view(ref,options));}
+function view(ref,{root=process.cwd(),kind,profile='review',unit_id}={}){
+ validateKind(kind);if(!['review','task','full'].includes(profile))throw new TypeError(`未知阅读档位 ${profile}`);
+ let binding,content,checks=['可读取'],blockers=[],sourceChecks=[];
+ if(kind==='slice'){
+  const loaded=readSliceContract(ref,{root,diagnostic:true});binding=loaded.binding;blockers.push(...declaredBlockers(loaded.raw));
+  const legacy=renderSliceContractView(ref,{root,unit_id:profile==='task'?unit_id:undefined});
+  checks.push('Slice 结构及绑定来源');
+  if(legacy.diagnostic_only){content={诊断:legacy.blockers};blockers=legacy.blockers.map(b=>b.reason);}
+  else if(profile==='full')content={权威合同:loaded.raw,完整视图:legacy};
+  else if(profile==='review'){
+   content={...legacy.summary,验收:legacy.acceptance,实施范围:{工程:loaded.raw.scope?.project_roots||legacy.constraints.project_roots,允许写入:loaded.raw.scope?.allowed_write_paths||legacy.constraints.allowed_write_paths},关键约束:loaded.raw.scope?.forbidden_patterns||legacy.constraints.forbidden_patterns,停止条件:'来源或批准过期、越界、缺证据、验证失败、drift / violation / new_impacts 时停止并回交。'};
+   for(const key of ['risks','risk_acceptance','blockers','pending_decisions','constraints'])if(loaded.raw[key])content[key]=loaded.raw[key];
+   for(const [label,pattern]of [['风险',/风险/],['关键取舍',/取舍/],['待决定事项',/待|决定/],['变化',/变化|变更/]])if(!Object.keys(content).some(k=>pattern.test(k)))content[label]='来源未说明，审阅时核实。';
+   const extensions=loaded.raw.extensions||{};
+   for(const [name,extension]of Object.entries(extensions))for(const [key,value]of Object.entries(extension))if(/risk|constraint|decision|block|exception|unknown/.test(key))content[`${name}.${key}`]=value;
+  }else{
+   if(!unit_id)throw new TypeError('task 视图必须指定 --unit');
+   const units=loaded.contract.work_units.filter(u=>u.id===unit_id);if(units.length!==1)throw new TypeError(`工作单元缺失或不唯一: ${unit_id}`);
+   content={当前任务:units[0].work_unit||units[0],全局约束:legacy.constraints,专项约束:legacy.extensions,编译约束:loaded.raw.resolution,适用性:loaded.raw.applicability,验收:legacy.acceptance,上游引用:Object.fromEntries(Object.entries(loaded.sources).map(([k,v])=>[k,{ref:v.ref,version:v.version}])),停止条件:'来源或批准过期、越界、缺证据、验证失败、drift / violation / new_impacts 时停止并回交。'};
+   const known=new Set(['schema_version','contract_id','contract_version','slice_id','status','basis','scope','applicability','resolution','acceptance','verification','work_units','extensions','ticket_policy']);
+   content.其他约束=Object.fromEntries(Object.entries(loaded.raw).filter(([k])=>!known.has(k)));
+  }
+ }else{
+  const {bytes,raw}=load(ref,root);binding={ref,id:raw.contract_id||raw.technical_design_id||raw.decision_id||raw.request?.request_id||raw.handoff_id||raw.baseline_id||raw.spec_id||raw.plan_id||raw.id||null,version:raw.contract_version||raw.decision_version||raw.handoff_version||raw.version||null,digest:hash(bytes)};
+  blockers.push(...declaredBlockers(raw));
+  let schemaRef=contractKinds[kind];if(kind==='api-decision'&&raw.schema_version===2)schemaRef='docs/process/schemas/api-contract-decision-v2.schema.json';
+  if(kind==='frontend-acceptance'&&[1,3].includes(raw.schema_version))schemaRef=`docs/process/schemas/frontend-delivery-acceptance${raw.schema_version===1?'-v1':'-v3'}.schema.json`;
+  if(schemaRef)try{schema(raw,schemaRef);checks.push('结构校验');}catch(error){blockers.push(error.message);}
+  else checks.push('结构与批准未核验，按资产所有者规则继续');
+  sourceChecks=references(raw,root);if(sourceChecks.length)checks.push(`核对 ${sourceChecks.length} 项可识别来源摘要；其余语义由资产所有者核验`);for(const source of sourceChecks)if(!source.current)blockers.push(`来源不可读或过期：${source.ref}`);
+  // Unknown business fields remain visible. Only well-known machine metadata is hidden.
+  content=profile==='full'?{权威合同:raw,来源核对:sourceChecks}:display(raw);
+  if(kind==='api-decision'&&raw.schema_version===2&&raw.draft_review){try{const review=load(raw.draft_review.ref,root).raw;content.实际审查记录=profile==='full'?review:display(review);if(review.result!=='approved'||!Array.isArray(review.blocking_findings)||review.blocking_findings.length)blockers.push('OpenAPI Draft Review 实际记录未批准或有阻断');if(review.draft_ref!==raw.openapi?.ref||review.draft_digest!==raw.openapi?.digest)blockers.push('Draft Review 未绑定当前 OpenAPI');}catch(error){blockers.push(error.message);}}
+  if(profile==='task'){
+   if(raw.work_units){if(!unit_id)throw new TypeError('含工作单元的合同必须指定 --unit');const matches=raw.work_units.filter(x=>x.id===unit_id);if(matches.length!==1)throw new TypeError(`工作单元缺失或不唯一: ${unit_id}`);content.work_units=matches;}
+   content.机器绑定中的约束=Object.fromEntries(['resolution','basis','inputs','sources','artifact_bindings'].filter(k=>raw[k]!==undefined).map(k=>[k,raw[k]]));
+   content.约束分类='保留未分类字段；本视图只允许阅读，执行影响由资产所有者核验。';
+  }
+ }
+ const view={read_only:true,execution_allowed:false,kind,profile,binding,checks,approval_validity:'not-checked',content,blockers};view.markdown=markdown(view);return view;
+}
+export function diffContract(beforeRef,afterRef,{root=process.cwd(),beforeRoot=root,kind}={}){
+ validateKind(kind);if(kind==='slice')return diffSliceContracts(beforeRef,afterRef,{root,beforeRoot});
+ const before=load(beforeRef,beforeRoot),after=load(afterRef,root),changes=[];
+ const walk=(a,b,p)=>{if(JSON.stringify(a)===JSON.stringify(b))return;if(object(a)&&object(b)){for(const key of new Set([...Object.keys(a),...Object.keys(b)]))walk(a[key],b[key],p?`${p}.${key}`:key);}else changes.push({path:p,before:a??null,after:b??null,category:metadata.test(p.split('.').at(-1))?'binding-change':'requires-review'});};
+ walk(before.raw,after.raw,'');const source_checks=[...references(before.raw,beforeRoot).map(x=>({...x,side:'before'})),...references(after.raw,root).map(x=>({...x,side:'after'}))];
+ return{read_only:true,approval_reusable:false,execution_allowed:false,before:{ref:beforeRef,digest:hash(before.bytes)},after:{ref:afterRef,digest:hash(after.bytes)},bytes_changed:!before.bytes.equals(after.bytes),changes,source_checks,decision_impact:'必须按当前差异和授权延续协议核验；无法读取旧来源时影响未知。'};
+}

package/template/scripts/lib/delivery-preflight.mjs

@@ -1,7 +1,7 @@
 import { normalizeSliceContract, sourceSliceContract, parseSliceYaml } from './slice-contract.mjs';
 import { assertExistingSliceStructure, createApprovedExecutionContext, verifySliceContractApproval } from './approved-execution-context.mjs';
 import path from 'node:path';
-import { readFileSync, existsSync } from 'node:fs';
+import { readFileSync, existsSync, withValidationPhase } from './validation-phase.mjs';
 import { ROOT, read, parse, safe, hash, digest, ensure, schema, sourceApprovalPolicy } from './strategic-handoff-io.mjs';
 import { parseContextContract } from './context-contract.mjs';
 import { validateApprovalRecord } from './approval-record.mjs';
@@ -47,7 +47,8 @@ function requireBackendCapability(key) {
 }
 
 /** Read-only: never executes input commands, starts services, unpacks archives or writes receipts. */
-export async function preflightDelivery(input,{stage,root=process.cwd(),work_unit_id}={}) {
+export async function preflightDelivery(input,options={}) {return withValidationPhase({root:path.resolve(options.root||process.cwd(),typeof input?.governance_root==='string'?input.governance_root:'.'),purpose:`delivery-${options.stage}`,slice_id:input?.scope?.slice_id,work_unit_id:options.work_unit_id,readOnly:true,signal:options.signal},()=>preflight(input,options));}
+async function preflight(input,{stage,root=process.cwd(),work_unit_id}={}) {
   try { ensure(STAGES.includes(stage),'未知阶段；必须是 prepare|build|export|accept');schema(input,'docs/process/schemas/delivery-preflight-input.schema.json'); }
   catch(error) { return invalidPreflightInput(error.message); }
   root=path.resolve(root,input.governance_root||'.');

package/template/scripts/lib/digital-human-roles.mjs

@@ -1,4 +1,4 @@
-import { readFileSync } from "node:fs";
+import { readFileSync } from './validation-phase.mjs';
 import path from "node:path";
 import { parseDocument } from "../vendor/yaml.mjs";
 import { loadRegistry, ROOT } from "./lifecycle-registry.mjs";

package/template/scripts/lib/existing-backend-architecture.mjs

@@ -1,6 +1,7 @@
 import {assertApprovedExecutionContext} from './approved-execution-context.mjs';
 import {createHash} from 'node:crypto';
-import {readFileSync,realpathSync,lstatSync,readdirSync} from 'node:fs';
+import { realpathSync } from 'node:fs';
+import { readFileSync, lstatSync, readdirSync } from './validation-phase.mjs';
 import path from 'node:path';
 import {execFileSync} from 'node:child_process';
 import {parseDocument} from '../vendor/yaml.mjs';
@@ -35,7 +36,7 @@ function inspectMaven(root,units){
  const script=`import json,sys,xml.etree.ElementTree as ET\nout=[]\nfor p in json.load(sys.stdin):\n r=ET.parse(p).getroot(); ns={'m':'http://maven.apache.org/POM/4.0.0'}; q=lambda s:r.find(s,ns)\n aid=q('m:artifactId'); aid=aid if aid is not None else q('artifactId')\n deps=[e.text.strip() for e in r.findall('m:dependencies/m:dependency/m:artifactId',ns)+r.findall('m:profiles/m:profile/m:dependencies/m:dependency/m:artifactId',ns)+r.findall('dependencies/dependency/artifactId') if e.text]\n modules=[e.text.strip() for e in r.findall('.//m:modules/m:module',ns)+r.findall('.//modules/module') if e.text]\n out.append({'artifact_id':aid.text.strip() if aid is not None else '', 'dependencies':deps, 'modules':modules})\nprint(json.dumps(out))`;
  try{return JSON.parse(execFileSync('python3',['-c',script],{input:JSON.stringify(units.map(u=>file(root,u.pom_ref))),encoding:'utf8',timeout:15000,maxBuffer:2*1024*1024}));}catch(error){requireThat(false,'ARCH_BUILD_INVALID',`无法读取实际 Maven 构建单元: ${error.message}`);}
 }
-export function verifyExistingArchitecture(identity,bindings,{root,registry,execution}={}){
+export function verifyExistingArchitecture(identity,bindings,{root,registry,execution,readOnly=false}={}){
  const profile=validateExistingArchitecture(identity,registry);
  requireThat(text(root),'ARCH_EVIDENCE_REF','需要治理 root');
  const baseline=bound(root,bindings?.engineering_baseline),registration=bound(root,bindings?.repository_registration),manifest=bound(root,bindings?.manifest);
@@ -132,7 +133,7 @@ export function verifyExistingArchitecture(identity,bindings,{root,registry,exec
  }
  if(changes.length){
   requireThat(execution,'ARCH_SOURCE_STALE',`固定源码改变: ${changes.join(', ')}`);
-  const permission=assertApprovedExecutionContext(execution,{root,architectureIdentity:identity,architectureEvidence:bindings});
+  const permission=assertApprovedExecutionContext(execution,{root,architectureIdentity:identity,architectureEvidence:bindings,readOnly});
   const allowed=permission.allowed_write_paths.map(x=>{if(path.isAbsolute(x)){const rel=path.relative(projectRoot,x).split(path.sep).join('/');return rel==='.'||rel===''?'.':relative(rel);}return x==='.'?'.':relative(x);});
   requireThat(changes.every(ref=>allowed.some(scope=>beneath(ref,scope))&&registration.allowed_write_paths.some(scope=>beneath(ref,scope))),'ARCH_SOURCE_OUT_OF_SCOPE','输出增量超出批准写范围');
  }

package/template/scripts/lib/existing-ui-baseline.mjs

@@ -1,8 +1,10 @@
-import { readFileSync, statSync } from 'node:fs';
+import { statSync } from 'node:fs';
+import { readFileSync, withValidationPhase, inValidationPhase } from './validation-phase.mjs';
 import { ensure, hash, digest, read, safe, files, schema, treeDigest } from './strategic-handoff-io.mjs';
 
 // This is an observation bundle, not a prototype or an approval generator.
-export function validateExistingUiBaseline(data, { bundleRoot } = {}) {
+export function validateExistingUiBaseline(data,options={}) {return inValidationPhase()?validate(data,options):withValidationPhase({root:options.bundleRoot,purpose:'existing-ui-baseline',readOnly:true},()=>validate(data,options));}
+function validate(data, { bundleRoot } = {}) {
   const errors=[];
   try {
     schema(data,'docs/process/schemas/existing-ui-baseline.schema.json');

package/template/scripts/lib/first-slice-artifacts.mjs

@@ -33,7 +33,7 @@ export function inspectFirstSliceArtifacts(contract, projectRoot) {
       }
     } catch (error) { failures.push(`${label}:${error.message}`); }
   }
-  const aliases = { service: 'application', core: 'domain', repository: 'infrastructure', server: 'web' };
+  const aliases = { service: 'application', core: 'application', repository: 'infrastructure', server: 'web' };
   for (const layer of contract.backend.affected_layers || []) {
     const role = aliases[layer] || layer;
     if (['domain','application','infrastructure','web'].includes(role) && !roles.has(role)) failures.push(`affected-role-empty:${role}`);

package/template/scripts/lib/frontend-delivery-boundary.mjs

@@ -1,6 +1,6 @@
 import { normalizeSliceContract, sourceSliceContract, parseSliceYaml } from './slice-contract.mjs';
 import { loadDeliveryProfile } from './harness-execution-scope.mjs';
-import { existsSync } from 'node:fs';
+import { existsSync } from './validation-phase.mjs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { ROOT, read, safe, ensure, digest } from './strategic-handoff-io.mjs';

package/template/scripts/lib/frontend-delivery.mjs

@@ -1,5 +1,5 @@
 import { uiBaselineRef, uiBaselineCaseIds, uiBaselineKind, hasConsumerRoutes } from './ui-baseline.mjs';
-import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync } from './validation-phase.mjs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { openBackendDelivery } from './backend-delivery.mjs';

package/template/scripts/lib/harness-execution-scope.mjs

@@ -1,4 +1,5 @@
-import { existsSync } from 'node:fs';
+import { loadExecutionScope, assertScopeWorkUnit } from './lifecycle-execution-scope.mjs';
+import { existsSync } from './validation-phase.mjs';
 import path from 'node:path';
 import { ROOT, read, safe, ensure } from './strategic-handoff-io.mjs';
 
@@ -30,6 +31,12 @@ function activeProfile(root) {
 }
 
 export function enforceHarnessTaskScope(task,{root=ROOT}={}) {
+  const scope=loadExecutionScope(root);
+  if(scope) {
+    assertScopeWorkUnit(task.contract?.kind==='slice-implementation'?'work-unit.slice-implementation':task.work_unit_id,{root});
+    ensure(task.role_id!=='role.frontend-engineer','后端职责不允许派发前端实现');
+    ensure(task.allowed_write_paths.every(ref=>!/^apps\/frontend(?:\/|$)/.test(ref)),'禁止写入前端工程');
+  }
   const profile=activeProfile(root);
   if (!profile) return;
   ensure(task.contract?.kind!=='template-maintenance','专职产品项目不得派发模板维护任务');
@@ -41,6 +48,13 @@ export function enforceHarnessTaskScope(task,{root=ROOT}={}) {
 }
 
 export function enforceHarnessSkillScope(skills,registry,{root=ROOT}={}) {
+  if(loadExecutionScope(root)) {
+    assertScopeWorkUnit('work-unit.slice-implementation',{root});
+    for(const id of skills) {
+      const impacts=registry.skills.find(skill=>skill.id===id)?.impacts||[];
+      ensure(!impacts.includes('frontend')||impacts.includes('backend')||impacts.includes('lifecycle'),`后端职责禁止编译生产前端技能: ${id}`);
+    }
+  }
   const profile=activeProfile(root);
   if (!profile) return;
   const side=profile.profile_id==='harness.frontend-delivery'?'frontend':'backend';

package/template/scripts/lib/implementation-contract-compiler.mjs

@@ -5,7 +5,7 @@ import { createApprovedExecutionContext, createApprovedRecompilationContext, ass
 import { enforceTechnicalDesign } from './technical-design-boundary.mjs';
 import { enforceHarnessSkillScope } from "./harness-execution-scope.mjs";
 import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
+import { readFileSync } from './validation-phase.mjs';
 import path from "node:path";
 import { parseDocument } from "../vendor/yaml.mjs";
 import { DEFAULT_REGISTRY, loadSkillRegistry, resolveSkillForNewUse } from "./skill-registry.mjs";
@@ -276,8 +276,8 @@ export function evaluateContractFreshness(contract, { registry, compilerContract
   const reasons = [];
   let trustedExecution;
   try {
-    trustedExecution=approved_slice?createApprovedExecutionContext(approved_slice,{root,contract:all,work_unit_id}):execution;
-    if(trustedExecution)assertApprovedExecutionContext(trustedExecution,{root,contract});
+    trustedExecution=approved_slice?createApprovedExecutionContext(approved_slice,{root,contract:all,work_unit_id,readOnly}):execution;
+    if(trustedExecution)assertApprovedExecutionContext(trustedExecution,{root,contract,readOnly});
   } catch(error) { reasons.push(error.code||'EXECUTION_APPROVAL_INVALID');trustedExecution=undefined; }
   try { enforceTechnicalDesign({ ...resolution, slice_id: contract.slice_id ?? resolution.slice_id }, { root,execution:trustedExecution,readOnly }); }
   catch { reasons.push("technical-design-stale-or-unavailable"); }
@@ -289,7 +289,7 @@ export function evaluateContractFreshness(contract, { registry, compilerContract
     try { validateArchitectureIdentity(resolution.architecture_identity, registry); }
     catch { reasons.push("architecture-identity-invalid"); }
     if (resolution.architecture_identity.schema_version === 2) {
-      try { verifyArchitectureEvidence(resolution.architecture_identity, resolution.architecture_evidence, { root, registry, execution:trustedExecution }); }
+      try { verifyArchitectureEvidence(resolution.architecture_identity, resolution.architecture_evidence, { root, registry, execution:trustedExecution, readOnly }); }
       catch (error) { reasons.push(error.code ?? "architecture-evidence-stale-or-unavailable"); }
     }
     if (resolution.architecture_identity_digest !== architectureDigest(resolution.architecture_identity)) reasons.push("architecture-identity-digest-changed");