create-yss-spec 3.5.2 → 3.5.3

package/template/scripts/lib/execution-evidence.mjs

@@ -0,0 +1,51 @@
+import {readFileSync,existsSync} from './validation-phase.mjs';
+import {safe, hash} from './strategic-handoff-io.mjs';
+
+/** Checks binding, not the truth of arbitrary prose. Owner tests/review remain mandatory. */
+export function executionEvidenceBlockers(result, contract, current) {
+  const blockers=[];
+  if(result.evidence_binding_version!==1)return ['legacy-evidence-binding-missing'];
+  const unit=contract.work_units.find(u=>u.id===result.work_unit_id);
+  if(!unit)return ['work-unit-mismatch'];
+  try {
+    const approved=current.approved_slice;
+    if(!approved || result.consumed_contract?.contract_digest!==approved.digest || hash(readFileSync(safe(current.root,approved.ref)))!==approved.digest)blockers.push('evidence-contract-digest-mismatch');
+    const evidence=result.evidence_files||[];
+    const checks=unit.work_unit.verification;
+    const evidenceRoot=contract.repositories?unit.project_root:current.root;
+    for(const check of checks) {
+      const rows=(result.verification_results||[]).filter(r=>r.verification_id===check.id);
+      if(rows.length!==1){blockers.push('verification-id-missing-or-duplicate');continue;}
+      const row=rows[0];
+      if(row.command!==check.command||row.cwd!==check.cwd||row.exit_code!==0||!Number.isFinite(Date.parse(row.executed_at)))blockers.push('verification-binding-mismatch');
+      if(!Array.isArray(row.acceptance_refs)||row.acceptance_refs.length!==new Set(row.acceptance_refs).size||JSON.stringify([...row.acceptance_refs].sort())!==JSON.stringify([...check.acceptance_refs].sort()))blockers.push('acceptance-evidence-coverage-missing');
+      if(!Array.isArray(row.evidence_refs)||!check.expected_evidence.every(ref=>row.evidence_refs.includes(ref)))blockers.push('verification-evidence-link-missing');
+      const covered=new Set();
+      for(const ref of row.evidence_refs||[]) {
+        const matches=evidence.filter(e=>typeof e==='object'&&e.path===ref&&(!contract.repositories||e.project_root===unit.project_root));
+        if(!matches.length)blockers.push('verification-evidence-link-missing');
+        for(const entry of matches) {
+          if(!check.acceptance_refs.includes(entry.behavior_ref))blockers.push('evidence-behavior-unrelated');
+          else covered.add(entry.behavior_ref);
+          if(hash(readFileSync(safe(evidenceRoot,ref)))!==entry.digest)blockers.push('evidence-digest-mismatch');
+        }
+      }
+      if(check.acceptance_refs.some(id=>!covered.has(id)))blockers.push('acceptance-evidence-coverage-missing');
+    }
+    // Bind declared execution inputs too: changed source bytes cannot reuse an earlier result.
+    if(!Array.isArray(result.source_bindings)||!result.source_bindings.length)blockers.push('execution-source-bindings-missing');
+    for(const entry of result.source_bindings||[]) {
+      const root=entry.project_root||unit.project_root;
+      const allowedRoots=new Set([unit.project_root,...checks.flatMap(check=>check.dependency_roots||[])]);
+      if(!allowedRoots.has(root)||(contract.repositories&&!contract.repositories[root])){blockers.push('execution-source-repository-mismatch');continue;}
+      if(entry.deleted===true) {
+        if(existsSync(safe(root,entry.path,{missing:true})) || entry.digest!==null)blockers.push('execution-source-drift');
+      } else if(hash(readFileSync(safe(root,entry.path)))!==entry.digest)blockers.push('execution-source-drift');
+    }
+    for(const changed of result.changed_files||[]) {
+      const ref=typeof changed==='string'?changed:changed.path;
+      if(!result.source_bindings?.some(b=>b.path===ref&&(b.project_root||unit.project_root)===(typeof changed==='object'&&changed.project_root||unit.project_root)))blockers.push('changed-source-binding-missing');
+    }
+  } catch(error) {blockers.push(`execution-evidence-unreadable: ${error.message}`);}
+  return [...new Set(blockers)];
+}

package/template/scripts/lib/harness-execution-scope.mjs

@@ -33,7 +33,7 @@ function activeProfile(root) {
 export function enforceHarnessTaskScope(task,{root=ROOT}={}) {
   const scope=loadExecutionScope(root);
   if(scope) {
-    assertScopeWorkUnit(task.contract?.kind==='slice-implementation'?'work-unit.slice-implementation':task.work_unit_id,{root});
+    assertScopeWorkUnit(task.contract?.kind==='slice-implementation'?'work-unit.slice-implementation':task.work_unit_id,{root,readOnly:task.contract?.kind==='read-only-intake'});
     ensure(task.role_id!=='role.frontend-engineer','后端职责不允许派发前端实现');
     ensure(task.allowed_write_paths.every(ref=>!/^apps\/frontend(?:\/|$)/.test(ref)),'禁止写入前端工程');
   }

package/template/scripts/lib/implementation-contract-compiler.mjs

@@ -1,4 +1,5 @@
 import { resolveBackendPlatform, resolveComponentCapabilities } from "./backend-platform.mjs";
+import { executionEvidenceBlockers } from './execution-evidence.mjs';
 import { safe } from './strategic-handoff-io.mjs';
 import { selectSliceWorkUnit, normalizeSliceContract, withinSlicePath } from './slice-contract.mjs';
 import { createApprovedExecutionContext, createApprovedRecompilationContext, assertApprovedExecutionContext } from './approved-execution-context.mjs';
@@ -349,6 +350,7 @@ export function validateExecutionResult(result, contract, current) {
     else if (item.exit_code !== 0) blockers.push("verification-failed");
   }
   if(contract.schema_version===3) {
+    blockers.push(...executionEvidenceBlockers(result, contract, {...current, root: current.root || ROOT}));
     const unit=contract.work_units.find(item=>item.id===result.work_unit_id);
     if(!unit)blockers.push('work-unit-mismatch');
     else {

package/template/scripts/lib/lifecycle-context-query.mjs

@@ -1,6 +1,6 @@
 import { loadExecutionScope, assertScopeWorkUnit, scopedNextRoutes } from './lifecycle-execution-scope.mjs';
 import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
+import { readFileSync, withValidationPhase, validationDependencies } from "./validation-phase.mjs";
 import path from "node:path";
 import { parseDocument } from "../vendor/yaml.mjs";
 import { ROOT, loadRegistry, semanticDigest, validateRegistry } from "./lifecycle-registry.mjs";
@@ -63,11 +63,19 @@ function selectedSkills(route, skillRegistry) {
   return skillRegistry.skills.filter((skill) => ids.has(skill.id));
 }
 
-export function queryLifecycleContext({ mode, stageId, workUnitId, include = [] } = {}) {
+export function queryLifecycleContext(options = {}) {
+  return withValidationPhase({ root: ROOT, purpose: "lifecycle-context-query", readOnly: true }, () => querySnapshot(options));
+}
+
+function querySnapshot({ mode, stageId, workUnitId, include = [] } = {}) {
   if (!mode && !stageId && !workUnitId && include.length === 0) {
     throw new TypeError("至少提供 --mode、--stage、--work-unit 或 --include 之一");
   }
 
+  const identity = loadYaml("yss-project.yaml", "仓库身份");
+  if (identity.schema_version !== 1 || !["template-source", "project-instance"].includes(identity.repository_mode)) {
+    throw new TypeError("仓库身份或版本无效");
+  }
   const scope = loadExecutionScope();
   if (workUnitId) assertScopeWorkUnit(workUnitId, { readOnly: true });
   const lifecycle = validateRegistry(loadRegistry());
@@ -114,9 +122,11 @@ export function queryLifecycleContext({ mode, stageId, workUnitId, include = []
       work_unit: workUnitId ?? null,
     },
     sources: {
+      repository_identity: { ref: "yss-project.yaml", sha256: sha256(read("yss-project.yaml")) },
       lifecycle_registry: {
         ref: LIFECYCLE_REGISTRY_REF,
         semantic_sha256: semanticDigest(lifecycle),
+        sha256: sha256(read(LIFECYCLE_REGISTRY_REF)),
         status: lifecycle.status,
       },
       orchestration_contract: {
@@ -152,5 +162,7 @@ export function queryLifecycleContext({ mode, stageId, workUnitId, include = []
   result.references = [...collectPathReferences(result), LIFECYCLE_REGISTRY_REF, ORCHESTRATION_CONTRACT_REF, SKILL_REGISTRY_REF]
     .filter((value, index, all) => all.indexOf(value) === index)
     .sort();
-  return canonicalize(result);
+  result.sources.read_set = validationDependencies().files.map(row=>({ref:path.relative(ROOT,row.file).split(path.sep).join("/"),sha256:row.digest})).sort((a,b)=>a.ref.localeCompare(b.ref,"en"));
+  const canonical = canonicalize(result);
+  return { ...canonical, context_sha256: sha256(JSON.stringify(canonical)) };
 }

package/template/scripts/lib/lifecycle-status.mjs

@@ -16,7 +16,7 @@ function source(root, ref) {
 }
 
 /** Read-only projection; checkpoint, registry and orchestration remain authoritative. */
-export function lifecycleStatus({ root, checkpointRef }) {
+export function lifecycleStatus({ root, checkpointRef, taskPackageRef }) {
   if (!root || !checkpointRef) throw new TypeError('root and checkpoint are required');
   root = path.resolve(root);
   const identity = source(root, 'yss-project.yaml').value;
@@ -76,10 +76,36 @@ export function lifecycleStatus({ root, checkpointRef }) {
     check('stage-tracking', 'not-checked', [checkpointRef], '未登记追踪；按实例既有兼容或显式迁移入口处理，不自动补建');
   }
   if (value.status === 'blocked' && !diagnostics.some(x => x.severity === 'error')) issue('reason-missing', 'checkpoint 已标 blocked，原因未登记', checkpointRef, '补齐真实阻塞原因');
+  let taskSource, task, contractSource;
+  const recovery = {sequence: ['read-status', 'inspect-actual-result', 'verify-current-inputs', 'continue-or-reroute'], task_package_ref: taskPackageRef ?? null, contract_view: null, result_refs: [], prechecks: [], verification_items: [], checks: 'read-only; execution and approval not evaluated'};
+  if(taskPackageRef) {
+    try {
+      taskSource=source(root,taskPackageRef);task=taskSource.value;
+      if(task.work_unit_id!==value.next_work_unit && task.convergence?.parent_work_unit!==value.next_work_unit)throw Error('任务包与 checkpoint 工作单元不一致');
+      if(!['not-started','active','paused','resolved','failed'].includes(task.workflow_status))throw Error('任务运行状态未知');
+      recovery.prechecks.push({status:'not-checked',cwd:root,command:['node','scripts/verify-digital-human-task-package',taskPackageRef]});
+      if(task.contract?.kind==='slice-implementation') {
+        contractSource=source(root,task.contract.slice_contract_ref);
+        const c=contractSource.value.slice_contract||contractSource.value;
+        if(c.contract_id!==task.contract.contract_id||c.contract_version!==task.contract.contract_version)throw Error('任务与当前合同版本不一致');
+        recovery.contract_view={cwd:root,command:['node','scripts/contract','view',task.contract.slice_contract_ref,'--kind','slice','--profile','task','--unit',task.work_unit_id]};
+        const approval=task.contract.gate_refs?.[0];
+        recovery.prechecks.push({status:'not-checked',cwd:root,command:['node','scripts/slice-contract','verify',task.contract.slice_contract_ref,'--unit',task.work_unit_id,...(approval?['--approval-ref',approval]:[])],approval_scope:approval?'current-approval-required':'not-checked: approval reference missing'});
+        if(c.schema_version===3){
+          const unit=c.work_units?.find(x=>x.id===task.work_unit_id);
+          if(!unit)throw Error('当前合同不存在该工作单元');
+          recovery.verification_items=Object.entries(c.verification||{}).filter(([id,check])=>unit.verification_refs?.includes(id)||check.required_for_all===true).map(([id,check])=>({id,...check,status:'not-checked'}));
+        }
+      }
+      recovery.result_refs=[...new Set([...(task.result?.evidence_refs||[]),...(task.verification_results||[]).map(x=>x.evidence_ref)].filter(Boolean))];
+      for(const ref of recovery.result_refs)readFileSync(safeTrackingPath(root,ref));
+      check('task-recovery','passed',[taskPackageRef,...recovery.result_refs],'仅读取任务身份、状态和结果引用；继续前仍须正式验收');
+    } catch(error) {issue('task-recovery-invalid',error.message,taskPackageRef,'核对任务身份与实际结果，再执行适用预检');}
+  }
   const blockers = [...new Set(diagnostics.filter(x => x.severity === 'error').map(x => x.message))];
   const next_step = {
     action_type: 'verify', work_unit: value.next_work_unit ?? null, cwd: root,
-    command: null, input_refs: [checkpointRef],
+    command: null, input_refs: [checkpointRef,...(taskPackageRef?[taskPackageRef]:[])],
     prerequisites: ['核验当前来源、Context、适用门禁与决定或延续', '核对当前范围、任务结果和允许写路径；输入变化时重验'],
   };
   let next_action;
@@ -89,10 +115,10 @@ export function lifecycleStatus({ root, checkpointRef }) {
   } else if (value.status === 'paused-human-gate') {
     next_step.action_type = 'wait';
     next_action = '核对当前会签责任方、资产与决定范围；满足已登记恢复条件后复验';
-  } else if (activeItems.some(item => item.progress === 'running')) {
+  } else if (activeItems.some(item => item.progress === 'running') || task?.workflow_status === 'active') {
     next_step.action_type = 'inspect';
     next_action = '核对运行中任务身份与实际结果；状态未知时不得重复派发';
-  } else if (activeItems.length && activeItems.every(item => item.progress === 'completed')) {
+  } else if ((activeItems.length && activeItems.every(item => item.progress === 'completed')) || task?.workflow_status === 'resolved') {
     next_step.action_type = 'inspect';
     next_action = '核验已有完成证据并重算下一工作单元，不直接重做';
   } else {
@@ -105,7 +131,7 @@ export function lifecycleStatus({ root, checkpointRef }) {
   return {
     schema_version: 1, read_only: true, stage: value.stage, checkpoint_status: value.status,
     work_unit: value.next_work_unit ?? null, owner, blockers, next_action,
-    execution_authorization: 'not-evaluated', verification_scope, diagnostics, next_step,
-    source_digests: { checkpoint: { ref: checkpointRef, digest: checkpoint.digest }, registry: { ref: registryRef, digest: registry.digest }, orchestration: { ref: contractRef, digest: contract.digest } },
+    execution_authorization: 'not-evaluated', verification_scope, diagnostics, next_step, recovery,
+    source_digests: { checkpoint: { ref: checkpointRef, digest: checkpoint.digest }, registry: { ref: registryRef, digest: registry.digest }, orchestration: { ref: contractRef, digest: contract.digest }, ...(taskSource?{task:{ref:taskPackageRef,digest:taskSource.digest}}:{}), ...(contractSource?{slice_contract:{ref:task.contract.slice_contract_ref,digest:contractSource.digest}}:{}) },
   };
 }

package/template/scripts/lib/lifecycle-transition.mjs

@@ -14,6 +14,8 @@ import { loadApprovalRecord, validateApprovalRecord } from "./approval-record.mj
 import { validateBackendReview } from "./backend-review.mjs";
 import { validateJsonSchema } from "./json-schema.mjs";
 import { ROOT } from "./lifecycle-registry.mjs";
+import { readRepositoryMode } from './repository-mode.mjs';
+import { validateResearchCompletion } from './maintenance-research.mjs';
 
 const IMPLEMENTATION_WORK_UNIT = "work-unit.slice-implementation";
 const TICKET_DECOMPOSITION_WORK_UNIT = "work-unit.ticket-decomposition";
@@ -28,6 +30,7 @@ function deepFreeze(value) {
 }
 
 const NEXT_ROUTES = deepFreeze({
+  "work-unit.maintenance-research": ["work-unit.ssot-update"],
   "work-unit.entry-triage": ["work-unit.plan-opportunity", "work-unit.plan-requirements"],
   "work-unit.ssot-update": ["work-unit.skill-projection-sync", "work-unit.intensity-aware-verification-v2"],
   "work-unit.skill-projection-sync": ["work-unit.template-snapshot-build", "work-unit.intensity-aware-verification-v2"],
@@ -303,6 +306,21 @@ function validateTicketReference(ref, trackerKind) {
  * by `validateWorkflowExecutionResult` before this function is called.
  */
 export function validateNextRoute(currentWorkUnit, nextRoute, decisionState, options = {}) {
+  let entryRoutes;
+  if (currentWorkUnit === 'work-unit.entry-triage' || currentWorkUnit === 'work-unit.maintenance-research' || nextRoute === 'work-unit.maintenance-research') {
+    try {
+      const mode = readRepositoryMode(options.root || ROOT);
+      if (currentWorkUnit === 'work-unit.entry-triage') entryRoutes = mode === 'template-source'
+        ? ['work-unit.maintenance-research', 'work-unit.ssot-update'] : NEXT_ROUTES[currentWorkUnit];
+      if ((currentWorkUnit === 'work-unit.maintenance-research' || nextRoute === 'work-unit.maintenance-research') && mode !== 'template-source') throw Error('template-research-requires-template-source');
+      if (currentWorkUnit === 'work-unit.maintenance-research') {
+        assertScopeTransition(currentWorkUnit, nextRoute, decisionState, options);
+        if (nextRoute !== null && nextRoute !== 'work-unit.ssot-update') return blockedResult([BLOCKING_SIGNALS.invalidRoute]);
+        validateResearchCompletion(decisionState, {root: options.root || ROOT, continuing: nextRoute !== null});
+        return allowedResult(decisionState.evidence_refs);
+      }
+    } catch (error) { return blockedResult(['maintenance-research-boundary'], [error.message]); }
+  }
   try { assertTrackingTransition(currentWorkUnit, nextRoute, decisionState, { root: options.root || ROOT }); }
   catch (error) { return blockedResult(['stage-tracking-blocked'], [error.message]); }
   try { assertScopeTransition(currentWorkUnit, nextRoute, decisionState, options); }
@@ -320,7 +338,7 @@ export function validateNextRoute(currentWorkUnit, nextRoute, decisionState, opt
     try { enforceFrontendDelivery(decisionState, { root: options.root, phase: nextRoute === IMPLEMENTATION_WORK_UNIT ? "implementation" : "inputs" }); }
     catch (error) { return blockedResult(["frontend-delivery-blocked"], [error.message]); }
   }
-  const routes = NEXT_ROUTES[currentWorkUnit] && scopedNextRoutes(currentWorkUnit, NEXT_ROUTES[currentWorkUnit], options);
+  const routes = NEXT_ROUTES[currentWorkUnit] && scopedNextRoutes(currentWorkUnit, entryRoutes || NEXT_ROUTES[currentWorkUnit], options);
   if (!routes) return blockedResult([BLOCKING_SIGNALS.invalidRoute], ["known_current_work_unit"]);
   if (nextRoute === REPOSITORY_PREPARATION_WORK_UNIT && !["work-unit.technical-analysis", SERVICE_INITIALIZATION_WORK_UNIT].includes(currentWorkUnit)) {
     return blockedResult([BLOCKING_SIGNALS.technicalAnalysisRequired], ["work-unit.technical-analysis predecessor"]);

package/template/scripts/lib/maintenance-research.mjs

@@ -0,0 +1,63 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import {spawnSync} from 'node:child_process';
+import {safe, hash, parse, ensure} from './strategic-handoff-io.mjs';
+import {assertUserDecisionRequirement} from './user-decision.mjs';
+
+export const RESEARCH_VALIDATOR = '.agents/skills/yss-research/scripts/validate-research-package.mjs';
+const binding = (root, ref) => ({ref, digest: hash(fs.readFileSync(safe(root, ref)))});
+function readBound(root, bound) {
+  ensure(bound && binding(root, bound.ref).digest === bound.digest, 'research-evidence-stale');
+  return fs.readFileSync(safe(root, bound.ref));
+}
+function execute(root, brief, evidence) {
+  return spawnSync(process.execPath, [safe(root, RESEARCH_VALIDATOR), safe(root, brief), safe(root, evidence)], {
+    cwd: root, encoding: 'utf8', timeout: 30000, maxBuffer: 2 * 1024 * 1024,
+    env: {...process.env, NODE_OPTIONS: '', NODE_PATH: ''},
+  });
+}
+
+/** Capture actual validator output; never overwrite a historical run. */
+export function recordResearchVerification(root, brief, evidence, output) {
+  const inputs = {brief: binding(root, brief), evidence: binding(root, evidence), validator: binding(root, RESEARCH_VALIDATOR)};
+  const dir = safe(root, output, {missing: true});
+  ensure(!fs.existsSync(dir), '研究验证输出目录必须不存在');
+  const started_at = new Date().toISOString(), result = execute(root, brief, evidence);
+  fs.mkdirSync(dir, {recursive: true});
+  fs.writeFileSync(path.join(dir, 'stdout.log'), result.stdout || '');
+  fs.writeFileSync(path.join(dir, 'stderr.log'), result.stderr || result.error?.message || '');
+  const record = {schema_version: 1, kind: 'maintenance-research-verification', inputs,
+    command: ['node', RESEARCH_VALIDATOR, brief, evidence], started_at, completed_at: new Date().toISOString(),
+    exit_code: result.status, stdout: binding(root, `${output}/stdout.log`), stderr: binding(root, `${output}/stderr.log`)};
+  for (const value of Object.values(inputs)) readBound(root, value);
+  fs.writeFileSync(path.join(dir, 'verification.json'), JSON.stringify(record, null, 2) + '\n');
+  return {binding: binding(root, `${output}/verification.json`), exit_code: result.status};
+}
+
+export function validateResearchCompletion(state, {root, continuing = false}) {
+  ensure(state?.context_reconciliation?.status === 'not-applicable' && state.context_reconciliation.reason?.trim(), 'research-context-reason-missing');
+  fs.readFileSync(safe(root, state.context_reconciliation.ref));
+  for (const key of ['blocking_signals', 'drift', 'violation', 'new_impacts', 'stale_candidates']) {
+    ensure(Array.isArray(state[key]) && state[key].length === 0, `research-${key}-unresolved`);
+  }
+  const record = parse(readBound(root, state.research_verification));
+  ensure(record.schema_version === 1 && record.kind === 'maintenance-research-verification', 'research-verification-invalid');
+  for (const key of ['brief', 'evidence', 'validator']) readBound(root, record.inputs?.[key]);
+  ensure(record.inputs.validator.ref === RESEARCH_VALIDATOR, 'research-validator-mismatch');
+  ensure(record.exit_code === 0 && Number.isFinite(Date.parse(record.started_at)) && Date.parse(record.completed_at) >= Date.parse(record.started_at), 'research-verification-not-passed');
+  ensure(JSON.stringify(record.command) === JSON.stringify(['node', RESEARCH_VALIDATOR, record.inputs.brief.ref, record.inputs.evidence.ref]), 'research-command-mismatch');
+  readBound(root, record.stdout); readBound(root, record.stderr);
+  for (const ref of [state.context_reconciliation.ref, state.research_verification.ref, record.inputs.brief.ref, record.inputs.evidence.ref]) {
+    ensure(state.evidence_refs?.includes(ref), `research-evidence-unreferenced: ${ref}`);
+  }
+  const current = execute(root, record.inputs.brief.ref, record.inputs.evidence.ref);
+  ensure(!current.error && current.status === 0, 'research-current-validation-failed');
+  readBound(root, state.research_verification);
+  for(const value of Object.values(record.inputs))readBound(root,value);
+  if (continuing) {
+    const authorization = parse(readBound(root, state.maintenance_authorization));
+    ensure(authorization.boundary === 'template-maintenance-scope' && authorization.scope?.includes('work-unit.ssot-update'), 'maintenance-authorization-required');
+    assertUserDecisionRequirement(authorization, {root});
+  }
+  return record;
+}

package/template/scripts/lib/read-only-intake.mjs

@@ -0,0 +1,132 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { parse } from '../vendor/yaml.mjs';
+import { runCommand } from './command-runner.mjs';
+
+const ensure = (ok, message) => { if (!ok) throw new TypeError(`read-only-intake: ${message}`); };
+export const digest = value => `sha256:${createHash('sha256').update(value).digest('hex')}`;
+const inside = (root, file) => { const rel = path.relative(root, file); return rel !== '..' && !rel.startsWith(`..${path.sep}`) && !path.isAbsolute(rel); };
+export function intakeEvidencePath(ref, { root, runDir }) {
+  const runtime = ref.startsWith('run:');
+  const base = runtime ? runDir : root;
+  ensure(base && path.isAbsolute(base), '运行证据必须显式提供绝对 run-dir');
+  const relative = runtime ? ref.slice(4) : ref;
+  ensure(relative && !path.isAbsolute(relative) && !relative.split(/[\\/]/).includes('..'), '证据路径越界');
+  const resolvedBase = fs.realpathSync(base), file = path.resolve(base, relative);
+  ensure(inside(path.resolve(base), file) && inside(resolvedBase, fs.realpathSync(file)), '证据符号链接越界');
+  ensure(fs.statSync(file).isFile(), '证据必须为文件');
+  return file;
+}
+// Stream large preserved evidence archives instead of allocating the whole file.
+export function fileDigest(file) {
+  const hash = createHash('sha256'), buffer = Buffer.allocUnsafe(1024 * 1024);
+  const fd = fs.openSync(file, 'r');
+  try {
+    let size;
+    while ((size = fs.readSync(fd, buffer, 0, buffer.length, null)) !== 0) hash.update(buffer.subarray(0, size));
+    return `sha256:${hash.digest('hex')}`;
+  } finally { fs.closeSync(fd); }
+}
+/** Final observable repository files, including ignored and untracked files; never follow links. */
+export function intakeSnapshot(root) {
+  const result = spawnSync('git', ['ls-files', '-z', '--cached', '--others'], { cwd: root, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+  ensure(result.status === 0, result.stderr || '无法观察仓库');
+  const rows = {};
+  for (const ref of [...new Set(result.stdout.split('\0').filter(Boolean))].sort()) {
+    const file = path.join(root, ref);
+    try {
+      const stat = fs.lstatSync(file);
+      if (stat.isDirectory()) {
+        const nested = spawnSync('git', ['rev-parse', '--show-toplevel'], { cwd: file, encoding: 'utf8' });
+        ensure(nested.status === 0 && fs.realpathSync(nested.stdout.trim()) === fs.realpathSync(file), `子仓未初始化: ${ref}`);
+        const head = spawnSync('git', ['rev-parse', 'HEAD'], { cwd: file, encoding: 'utf8' });
+        ensure(nested.status === 0 && head.status === 0, `子仓不可观测: ${ref}`);
+        rows[ref] = { kind: 'gitlink', head: head.stdout.trim(), files: intakeSnapshot(file) };
+      } else rows[ref] = { kind: stat.isSymbolicLink() ? 'link' : 'file', mode: stat.mode, digest: stat.isSymbolicLink() ? digest(fs.readlinkSync(file)) : fileDigest(file) };
+    } catch (error) { if (error.code === 'ENOENT') rows[ref] = null; else throw error; }
+  }
+  const head=spawnSync('git',['rev-parse','--verify','HEAD'],{cwd:root,encoding:'utf8'});
+  const index=spawnSync('git',['ls-files','--stage','-z'],{cwd:root,encoding:'utf8',maxBuffer:16*1024*1024});
+  ensure(index.status===0,'无法观察 Git index');
+  return {git:{head:head.status===0?head.stdout.trim():null,index_digest:digest(index.stdout)},files:rows};
+}
+export function validateReadOnlyIntake(value, { root, runDir, roles, lifecycle }) {
+  const identity = parse(fs.readFileSync(path.join(root, 'yss-project.yaml'), 'utf8'));
+  ensure(identity.schema_version === 1 && ['template-source', 'project-instance'].includes(identity.repository_mode), '仓库身份无效');
+  ensure(value.contract.kind === 'read-only-intake' && value.schema_version === 2 && value.execution_state === 'Explorer' && value.allowed_write_paths.length === 0, '只读合同不授予写权限');
+  ensure(lifecycle.work_units.some(x => x.id === value.work_unit_id) && ['work-unit.entry-triage', 'work-unit.harness-entry'].includes(value.work_unit_id), '只允许已登记分诊入口');
+  ensure(roles.runtimes.some(x => x.id === value.runtime_id), '未知运行时');
+  ensure(value.contract.status === 'issued' || value.workflow_status === 'paused', '过期合同必须暂停');
+  for (const ref of [value.contract.contract_ref, ...value.inputs, ...value.expected_evidence_files]) intakeEvidencePath(ref, { root, runDir });
+  if (value.result) {
+    ensure(value.result.work_unit===value.work_unit_id && value.result.workflow_reference===value.contract.contract_ref,'结果必须绑定原分诊工作单元和合同来源');
+    ensure(!value.result.changed_files?.length && !value.result.changed_artifacts?.length, '只读结果包含变更');
+    ensure(value.result.next_route == null && !value.result.checkpoint_ref, '只读结果不得流转或修改 checkpoint');
+    for (const ref of value.result.evidence_refs || []) intakeEvidencePath(ref, { root, runDir });
+  }
+  const commands = new Set(value.verification_commands);
+  ensure((value.verification_status === 'not-executed') === (value.verification_results.length === 0), '执行状态与实际结果不一致');
+  for (const row of value.verification_results) {
+    ensure(commands.has(row.command) && row.evidence_ref.startsWith('run:'), '运行结果必须绑定声明的命令及真实运行日志');
+    const evidence = fs.readFileSync(intakeEvidencePath(row.evidence_ref, { root, runDir }));
+    ensure(row.evidence_digest === digest(evidence), '运行证据摘要不一致');
+    const record = JSON.parse(evidence);
+    for (const key of ['command','exit_code','duration_ms','executed_at']) ensure(record[key] === row[key], `运行记录 ${key} 不一致`);
+    for (const stream of ['stdout','stderr']) {
+      const ref = row[`${stream}_ref`];
+      ensure(ref?.startsWith('run:'), '运行日志无效');
+      ensure(record[`${stream}_digest`] === digest(fs.readFileSync(intakeEvidencePath(ref, { root, runDir }))), '运行日志摘要不一致');
+    }
+  }
+  if (value.workflow_status === 'resolved' || value.result?.result === 'completed') {
+    ensure(value.workflow_status === 'resolved' && value.result?.result === 'completed', '完成状态不一致');
+    ensure(value.result.evidence_refs?.length && value.result.context_reconciliation?.status === 'not-applicable' && value.result.context_reconciliation?.reason, '只读结论缺少来源或不流转说明');
+    for (const key of ['drift','violation','new_impacts','stale_candidates','blocking_signals','deferred_seams']) ensure(Array.isArray(value.result[key]) && !value.result[key].length, `完成结果 ${key} 必须为空`);
+    ensure(value.verification_results.every(x => x.exit_code === 0) && [...commands].every(c => value.verification_results.some(x => x.command === c)), '实际验证缺失或失败');
+    ensure(value.observation_ref?.startsWith('run:'), '完成结果缺少执行器仓库观测');
+    const observation = JSON.parse(fs.readFileSync(intakeEvidencePath(value.observation_ref, { root, runDir }), 'utf8'));
+    const dispatchedBytes=fs.readFileSync(intakeEvidencePath(observation.task_ref,{root,runDir}));
+    ensure(observation.task_digest===digest(dispatchedBytes),'原派发任务摘要不一致');
+    const dispatched=JSON.parse(dispatchedBytes);
+    for(const key of ['task_id','work_unit_id','actor_id','role_id','runtime_id','contract','inputs','allowed_write_paths','objective','forbidden_actions','expected_outputs','expected_evidence_files','skill_source','downstream_consumers','convergence'])ensure(JSON.stringify(dispatched[key])===JSON.stringify(value[key]),`结果替换原任务 ${key}`);
+    ensure(!dispatched.verification_commands.length || JSON.stringify(dispatched.verification_commands)===JSON.stringify(value.verification_commands),'结果替换验证要求');
+    ensure(observation.kind === 'read-only-intake-observation' && observation.task_id === value.task_id && observation.root === fs.realpathSync(root), '观测身份不匹配');
+    ensure(JSON.stringify(observation.before) === JSON.stringify(observation.after) && JSON.stringify(observation.after) === JSON.stringify(intakeSnapshot(root)), '仓库实际差异与只读声明冲突');
+  }
+  return value;
+}
+/** Runner-owned evidence is outside the repository; the child receives no new repository permissions. */
+export async function observeReadOnlyIntake(task, { root, runDir, command, args = [], timeoutMs = 0 }) {
+  const label = command ? JSON.stringify([command,...args]) : null;
+  ensure(!command || !task.verification_commands.length || task.verification_commands.length===1 && task.verification_commands[0]===label,'执行命令与声明不一致，不得替换要求的验证');
+  root = fs.realpathSync(root);
+  ensure(path.isAbsolute(runDir) && !inside(root, path.resolve(runDir)), '运行目录必须位于仓库外');
+  ensure(!inside(root, fs.realpathSync(path.dirname(runDir))), '运行目录父路径符号链接进入仓库');
+  fs.mkdirSync(runDir, { recursive: false });
+  runDir = fs.realpathSync(runDir);
+  fs.writeFileSync(path.join(runDir,'task.json'),JSON.stringify(task,null,2)+'\n',{flag:'wx'});
+  const before = intakeSnapshot(root), started = new Date().toISOString();
+  const result = command ? await runCommand(command, args, { cwd: root, timeoutMs, stdoutFile: path.join(runDir, 'stdout.log'), stderrFile: path.join(runDir, 'stderr.log') }) : null;
+  const after = intakeSnapshot(root);
+  const observation = { schema_version: 1, kind: 'read-only-intake-observation', task_id: task.task_id, task_ref:'run:task.json', task_digest:digest(fs.readFileSync(path.join(runDir,'task.json'))), root, started_at: started, before, after };
+  fs.writeFileSync(path.join(runDir, 'observation.json'), JSON.stringify(observation, null, 2)+'\n');
+  const changed = JSON.stringify(before) !== JSON.stringify(after);
+  const completed = !changed && (!result || result.status === 0);
+  const output = structuredClone(task);
+  output.observation_ref = 'run:observation.json';
+  output.verification_status = result ? 'executed' : 'not-executed';
+  output.verification_results = [];
+  if (result) {
+    const label = JSON.stringify([command, ...args]);
+    const record = { command: label, exit_code: result.status ?? 1, duration_ms: Math.round(result.duration_ms), executed_at: started, termination: result.termination ?? null, stdout_digest: digest(fs.readFileSync(path.join(runDir,'stdout.log'))), stderr_digest: digest(fs.readFileSync(path.join(runDir,'stderr.log'))) };
+    const bytes = JSON.stringify(record, null, 2)+'\n'; fs.writeFileSync(path.join(runDir, 'execution.json'), bytes);
+    output.verification_commands = [label];
+    output.verification_results = [{command:label,exit_code:record.exit_code,duration_ms:record.duration_ms,executed_at:started,evidence_ref:'run:execution.json',evidence_digest:digest(bytes),stdout_ref:'run:stdout.log',stderr_ref:'run:stderr.log'}];
+  }
+  output.workflow_status = completed ? 'resolved' : 'failed';
+  output.result = { result_schema: 'workflow-execution-result-v1', work_unit: task.work_unit_id, workflow_reference: task.contract.contract_ref, result: completed ? 'completed' : 'failed', skill: 'yss-research', changed_files: [], changed_artifacts: [], evidence_refs: [...task.inputs, 'run:observation.json'], context_reconciliation: {status:'not-applicable',ref:'CONTEXT.md',reason:'只读分诊，不批准资产或流转阶段'}, deferred_seams: [], drift: [], violation: changed ? ['repository-changed'] : [], new_impacts: [], stale_candidates: [], next_route: null, blocking_signals: completed ? [] : ['read-only-intake-failed'] };
+  fs.writeFileSync(path.join(runDir, 'task-result.json'), JSON.stringify(output, null, 2)+'\n');
+  return output;
+}

package/template/scripts/lib/skill-registry.mjs

@@ -65,7 +65,8 @@ export function loadSkillRegistry(filePath = DEFAULT_REGISTRY) {
 export function resolveSkillForNewUse(registry, requestedId) {
   requireString(requestedId, "requested skill id");
   if (OBSOLETE.has(requestedId)) {
-    const replacementSkill = requestedId === "grill-me" ? "grilling" : null;
+    const lifecycleOwner = ["harness-orchestrator", "yss-strategic-design", "yss-product-lifecycle"].find(id => registry.skills?.some(skill => skill.id === id));
+    const replacementSkill = ({ "grill-me": "grilling", "wait-what": "i-have-adhd", "grill-with-docs": lifecycleOwner, "to-questionnaire": lifecycleOwner, "improve-codebase-architecture": "codebase-design" })[requestedId] ?? null;
     throw new SkillLifecycleError(
       SKILL_LIFECYCLE_FAILURE_CODES.retired,
       replacementSkill

package/template/scripts/lib/skill-supply-chain.mjs

@@ -12,6 +12,10 @@ const STRATEGIC_DESIGN_MANIFEST_PATH = path.join(SOURCE_ROOT, ".strategic-design
 export const PROJECTION_ROOTS = [".codex/skills", ".cursor/skills", ".pi/skills"];
 export const OBSOLETE = new Set(["yss-antd-design", "yss-antdv-next-design", "to-" + "prd", "to-" + "issues", "design-an-interface", "qa", "request-refactor-plan", "ubiquitous-language", "edit-article", "obsidian-vault", "writing-great-skills", "code-review-process", "yss-domain-modeling", "yss-dir", "yss-duckdb", "yss-file", "yss-filerunner", "yss-db2mybatis", "yss-mail", "yss-mapper-dynamic", "yss-quality", "yss-sql-condition", "yss-sql-tpl", "yss-valuation", "yss-variable", "yss-openapi", "web-design-engineer", "web-video-presentation", "wireframe-prototype", "wizard", "git-guardrails-claude-code", "claude-handoff", "batch-grill-me", "grill-me", "product-design-prototype", "research", "ask-matt", "dispatching-parallel-agents", "loop-me", "migrate-to-shoehorn", "prototype-page-acceptance", "scaffold-exercises", "setup-pre-commit", "setup-ts-deep-modules", "teach", "writing-beats", "writing-fragments", "writing-shape", "yss-microapp-commit", "yss-page-module-development", "yss-dictionary", "yss-jdbc", "yss-log", "yss-taskflow", "yss-backend-scaffold-application", "yss-backend-scaffold-domain", "yss-backend-scaffold-infrastructure", "yss-backend-scaffold-web", "yss-router", "yss-source-index"]);
 for (const id of ["component-selection-imports", "page-form-module", "page-list-module", "page-skeleton", "vue3-best-practices", "yss-use-table-height", "yss-use-tree-height", "yss-components", "yss-mvc-scaffold-generator", "yss-mvc-design", "yss-mvc-data-analysis-project-initializer", "yss-backend-scaffold-parent", "yss-backend-scaffold-adapter", "yss-application-layer-reference", "yss-domain-layer-reference", "yss-infrastructure-layer-reference", "yss-web-layer-reference"]) OBSOLETE.add(id);
+OBSOLETE.add("grill-with-docs");
+OBSOLETE.add("to-questionnaire");
+OBSOLETE.add("improve-codebase-architecture");
+OBSOLETE.add("wait-what");
 export function obsoleteCanonicalResidues(names, obsolete = OBSOLETE) {
   return names.filter((name) => obsolete.has(name)).sort();
 }

package/template/scripts/lib/slice-task-package.mjs

@@ -31,7 +31,7 @@ function compile(binding,{root=ROOT,work_unit_id,task_id,actor_id,runtime_id,exe
     task_id,work_unit_id,actor_id,runtime_id,execution_state,workflow_status:'not-started',stage_id:'stage.vertical-slice-implementation',
     contract:{kind:'slice-implementation',contract_id:contract.contract_id,contract_version:contract.contract_version,status:'issued',contract_ref:binding.ref,slice_contract_ref:binding.ref,gate_refs:[binding.approval_ref]},
     inputs:[binding.ref,...new Set(Object.values(contract.lifecycle_refs))],
-    objective:`${unit.behavior}（执行目录：${unit.project_root}；完整约束读取 ${binding.ref}）`,
+    objective:`${unit.behavior}（执行目录：${unit.project_root}；默认消费 ${binding.ref} 的 task 视图并指定 ${work_unit_id}，追溯时展开 full）`,
     allowed_write_paths:unit.allowed_write_paths,forbidden_actions:[...unit.work_unit.forbidden_patterns,'来源过期、越界、缺证据、验证失败或新增影响时停止并回交'],
     expected_outputs:[unit.behavior],expected_evidence_files:unit.work_unit.expected_evidence,verification_commands:unit.work_unit.verification_commands,verification_results:[],
     downstream_consumers:unit.downstream_consumers||['role.lifecycle-orchestrator'],convergence:{parent_work_unit:'work-unit.slice-implementation',convergence_ref:unit.convergence_ref||binding.approval_ref,conflict_escalation:'返回生命周期主控'},user_decisions:decisions

package/template/scripts/lib/task-package.mjs

@@ -1,3 +1,4 @@
+import { validateReadOnlyIntake } from './read-only-intake.mjs';
 import { assertTrackingEntry } from './stage-tracking.mjs';
 import { normalizeSliceContract } from './slice-contract.mjs';
 import { assertSliceV3TaskPackage } from './slice-task-package.mjs';
@@ -17,7 +18,7 @@ import { LEGACY_TASK_PACKAGE_SCHEMA, TASK_PACKAGE_SCHEMA, validateTaskPackageSch
 
 export { LEGACY_TASK_PACKAGE_SCHEMA, TASK_PACKAGE_SCHEMA, validateTaskPackageSchema };
 export const TASK_PACKAGE_REGISTRY_REF = ".template-spec/agents/digital-human-roles.yaml";
-export const CONTRACT_KINDS = new Set(["lifecycle-work-unit", "slice-implementation", "template-maintenance"]);
+export const CONTRACT_KINDS = new Set(["lifecycle-work-unit", "slice-implementation", "template-maintenance", "read-only-intake"]);
 export const EXECUTION_STATES = new Set(["Explorer", "Drafter", "Worker", "Reviewer", "Verifier"]);
 export const WORKFLOW_STATUSES = new Set(["not-started", "active", "paused", "resolved", "failed"]);
 
@@ -203,8 +204,14 @@ function validateContract(value, registry, lifecycle) {
   if (value.execution_state === "Worker") assertImplementationDecision({ slice_contract_ref: contract.slice_contract_ref, vertical_slice_ticket_ref: slice.lifecycle_refs.ticket, user_decisions: value.user_decisions });
 }
 
-export function validateTaskPackage(value, { rolesDoc, lifecycleDoc } = {}) {
+export function validateTaskPackage(value, { rolesDoc, lifecycleDoc, root = ROOT, runDir } = {}) {
   validateTaskPackageSchema(value);
+  if (value.schema_version === 2) {
+    enforceHarnessTaskScope(value, { root });
+    const registry = rolesDoc || loadDigitalHumanRoles();
+    validateSkillSource(value, registry);
+    return validateReadOnlyIntake(value, { root, runDir, roles: registry, lifecycle: lifecycleDoc || loadRegistry() });
+  }
   enforceHarnessTaskScope(value);
   const intake = value.execution_state === "Explorer" && value.allowed_write_paths.length === 0 && ["work-unit.entry-triage", "work-unit.harness-entry"].includes(value.work_unit_id);
   if (!intake) {

package/template/scripts/lifecycle-status

@@ -4,8 +4,8 @@ import path from 'node:path';
 import { lifecycleStatus } from './lib/lifecycle-status.mjs';
 
 try {
-  const { values } = parseArgs({ strict: true, options: { root: { type: 'string' }, checkpoint: { type: 'string' } } });
-  const result = lifecycleStatus({ root: path.resolve(values.root ?? '.'), checkpointRef: values.checkpoint });
+  const { values } = parseArgs({ strict: true, options: { root: { type: 'string' }, checkpoint: { type: 'string' }, task: {type: 'string'} } });
+  const result = lifecycleStatus({ root: path.resolve(values.root ?? '.'), checkpointRef: values.checkpoint, taskPackageRef: values.task });
   process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
   if (result.blockers.length) process.exitCode = 1;
 } catch (error) {

package/template/scripts/prepare-read-only-intake

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import {parseArgs} from 'node:util';
+import {ROOT} from './lib/lifecycle-registry.mjs';
+import {loadTaskPackage,generateTaskPackageDefaults,validateTaskPackage} from './lib/task-package.mjs';
+try {
+ const {values}=parseArgs({options:{input:{type:'string'},output:{type:'string'}}});
+ if(!values.input||!values.output)throw Error('用法: prepare-read-only-intake --input <来源选择.json|yaml> --output <仓库外/task.json>');
+ const {value:input}=loadTaskPackage(values.input);
+ const output=path.resolve(values.output),parent=fs.realpathSync(path.dirname(output)),root=fs.realpathSync(ROOT);
+ if(parent===root||parent.startsWith(root+path.sep))throw Error('任务包必须保存于仓库外运行目录');
+ const task=generateTaskPackageDefaults(input.role_id,{...input,schema_version:2,execution_state:'Explorer',workflow_status:'active',allowed_write_paths:[],expected_evidence_files:[],verification_commands:input.verification_commands||[],verification_results:[],verification_status:'not-executed',contract:{...input.contract,kind:'read-only-intake',status:'issued'}});
+ validateTaskPackage(task);
+ fs.writeFileSync(output,JSON.stringify(task,null,2)+'\n',{flag:'wx'});process.stdout.write(output+'\n');
+}catch(error){process.stderr.write(error.message+'\n');process.exitCode=1;}

package/template/scripts/run-read-only-intake

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+import { parseArgs } from 'node:util';
+import { ROOT } from './lib/lifecycle-registry.mjs';
+import { loadTaskPackage, validateTaskPackage } from './lib/task-package.mjs';
+import { observeReadOnlyIntake } from './lib/read-only-intake.mjs';
+try {
+  const {values,positionals} = parseArgs({options:{task:{type:'string'},'run-dir':{type:'string'},'timeout-ms':{type:'string',default:'0'}},allowPositionals:true});
+  if(!values.task||!values['run-dir'])throw Error('需要 --task 和仓库外新目录 --run-dir；命令放在 -- 之后');
+  const {value}=loadTaskPackage(values.task);validateTaskPackage(value);
+  if(value.schema_version!==2||value.workflow_status!=='active')throw Error('只接受 active 的只读 v2 任务');
+  const result=await observeReadOnlyIntake(value,{root:ROOT,runDir:values['run-dir'],command:positionals[0],args:positionals.slice(1),timeoutMs:Number(values['timeout-ms'])});
+  validateTaskPackage(result,{runDir:values['run-dir']});
+  process.stdout.write(JSON.stringify(result,null,2)+'\n');if(result.workflow_status!=='resolved')process.exitCode=1;
+}catch(error){process.stderr.write(error.message+'\n');process.exitCode=1;}

package/template/scripts/verify-digital-human-task-package

@@ -3,10 +3,10 @@ import { parseArgs } from "node:util";
 import { loadTaskPackage, validateTaskPackage } from "./lib/task-package.mjs";
 
 try {
-  const { positionals } = parseArgs({ allowPositionals: true, strict: true });
+  const { positionals, values } = parseArgs({ options: { "run-dir": { type: "string" } }, allowPositionals: true, strict: true });
   if (positionals.length !== 1) throw new TypeError("用法: scripts/verify-digital-human-task-package <task-package.yaml|task-package.json>");
   const { value } = loadTaskPackage(positionals[0]);
-  validateTaskPackage(value);
+  validateTaskPackage(value, { runDir: values["run-dir"] });
   process.stdout.write("数字人任务包验证通过\n");
 } catch (error) {
   process.stderr.write(`数字人任务包验证失败: ${error.message}\n`);