create-yss-spec 3.5.5 → 3.5.8

package/template/scripts/lib/lifecycle-context-query.mjs

@@ -1,6 +1,8 @@
 import { loadExecutionScope, assertScopeWorkUnit, scopedNextRoutes } from './lifecycle-execution-scope.mjs';
 import { createHash } from "node:crypto";
-import { readFileSync, withValidationPhase, validationDependencies } from "./validation-phase.mjs";
+import { readFileSync, existsSync, lstatSync, readdirSync, withValidationPhase, validationDependencies } from "./validation-phase.mjs";
+import { realpathSync } from "node:fs";
+import { OBSOLETE } from "./skill-supply-chain.mjs";
 import path from "node:path";
 import { parseDocument } from "../vendor/yaml.mjs";
 import { ROOT, loadRegistry, semanticDigest, validateRegistry } from "./lifecycle-registry.mjs";
@@ -10,6 +12,8 @@ import { loadLifecyclePresenter } from './lifecycle-presentation.mjs';
 const LIFECYCLE_REGISTRY_REF = ".template-spec/process/lifecycle-registry.yaml";
 const ORCHESTRATION_CONTRACT_REF = ".agents/skills/yss-product-lifecycle/references/orchestration-contract.yaml";
 const SKILL_REGISTRY_REF = ".template-spec/agents/yss-skill-registry.yaml";
+// Governed projections retain the specialist query's existing output contract.
+const QUERY_PROFILE = 'lifecycle';
 
 function read(relativePath) {
   return readFileSync(path.join(ROOT, relativePath), "utf8");
@@ -68,7 +72,157 @@ export function queryLifecycleContext(options = {}) {
   return withValidationPhase({ root: ROOT, purpose: "lifecycle-context-query", readOnly: true }, () => querySnapshot(options));
 }
 
-function querySnapshot({ mode, stageId, workUnitId, include = [] } = {}) {
+// Availability is an observation, not permission to install, invoke or approve.
+export function inspectWorkUnitSkills({ root = ROOT, registry, route, agentRuntime, when = [] }) {
+  const issues = [], missing = [], required = new Set();
+  const report = (code, skill, ref, message) => issues.push({ code, skill: skill ?? null, ref, message });
+  const definitions = [...(registry.skills ?? []), ...(registry.external_skills ?? [])];
+  const externalIds = new Set((registry.external_skills ?? []).map(skill => skill.id));
+  const aliases = new Map(definitions.flatMap(skill => (skill.aliases ?? []).map(alias => [alias, skill.id])));
+  const roots = registry.agent_runtime_roots ?? registry.instance_distribution?.projection_roots ?? {};
+  const dependencies = registry.skill_dependencies ?? {};
+  function visit(requested) {
+    const id = aliases.get(requested) ?? requested;
+    if (required.has(id)) return;
+    required.add(id);
+    const definition = definitions.find(skill => skill.id === id);
+    if (OBSOLETE.has(id) || definition?.maturity === 'deprecated') {
+      report('skill-retired', id, '.template-spec/agents/skill-migrations.md',
+        definition?.replacement_skill ? '技能已停止新用法；请使用 ' + definition.replacement_skill : '技能已退役；按迁移说明重新路由');
+      return;
+    }
+    if (!definition || (!externalIds.has(id) && !/^[a-z][a-z0-9-]+$/.test(id))) {
+      report('skill-unknown', id, SKILL_REGISTRY_REF, '路由使用未登记的技能');
+      return;
+    }
+    if (externalIds.has(id)) {
+      report('external-skill-required', id, SKILL_REGISTRY_REF, '外部技能须核验实际运行时能力，不能通过共享技能补装代替');
+      return;
+    }
+    for (const dependency of dependencies[id] ?? []) {
+      if (dependency.type === 'context-required' ||
+          (dependency.type === 'context-conditional' && when.includes(dependency.when))) visit(dependency.skill);
+    }
+  }
+  [
+    route?.primary_skill,
+    route?.native?.invocation_mode === 'reference' ? null : route?.native?.skill,
+    ...(route?.supporting_skills ?? []), ...(route?.skills ?? []),
+  ].filter(Boolean).forEach(visit);
+  function readJson(ref) {
+    const file = path.join(root, ref);
+    if (!existsSync(file)) return null;
+    const value = JSON.parse(readFileSync(file, 'utf8'));
+    if (!value || typeof value !== 'object' || Array.isArray(value)) throw new TypeError(ref + ' 必须是 JSON 对象');
+    return value;
+  }
+  const lock = readJson('skills-lock.json');
+  const metadata = readJson('.yss-template.json');
+  const selected = metadata?.distribution?.mode === 'selected' ? metadata.distribution : null;
+  const registeredRuntimes = selected?.runtimes ??
+    Object.keys(roots).filter(runtime => lock?.projectionRoots?.includes(roots[runtime]));
+  if (!agentRuntime && registeredRuntimes.length === 1) agentRuntime = registeredRuntimes[0];
+  if (agentRuntime && !Object.hasOwn(roots, agentRuntime)) throw new TypeError('未知 Agent 运行时: ' + agentRuntime);
+  if (!agentRuntime) report('runtime-required', null, '.yss-template.json', '请用 --agent-runtime 明确指定运行时；只在登记了唯一运行时时自动选择');
+  else if (!registeredRuntimes.includes(agentRuntime)) report('runtime-not-installed', null, '.yss-template.json', '所选运行时未登记；先核对运行时安装范围');
+  if (!lock?.skills?.shared || !Array.isArray(lock.projectionRoots)) report('skill-lock-invalid', null, 'skills-lock.json', '技能锁缺失或结构不支持；先恢复锁文件或规划迁移');
+  if (selected && (!Array.isArray(selected.installedSkills) || !Array.isArray(selected.runtimes) ||
+      JSON.stringify([...selected.runtimes.map(runtime => roots[runtime])].sort()) !== JSON.stringify([...(lock?.projectionRoots ?? [])].sort()))) {
+    report('distribution-lock-drift', null, '.yss-template.json', '实例元数据与技能锁的运行时或安装清单不一致');
+  }
+  const inside = (file, directory) => file === directory || file.startsWith(directory + path.sep);
+  const realRoot = realpathSync(root);
+  function stat(file) {
+    // existsSync observes absence; lstat also identifies occupied dangling links.
+    existsSync(file);
+    return lstatSync(file, { throwIfNoEntry: false });
+  }
+  function checkedTreeHash(directory, canonical, projection = false) {
+    const info = stat(directory);
+    if (!info) return null;
+    const resolved = realpathSync(directory);
+    if (!inside(resolved, realRoot) || (projection && info.isSymbolicLink() && resolved !== realpathSync(canonical)) ||
+        (!projection && info.isSymbolicLink()) || (!info.isDirectory() && !info.isSymbolicLink())) {
+      throw new TypeError('技能目录或投影链接无效: ' + directory);
+    }
+    const files = [];
+    function walk(current, prefix = '') {
+      for (const entry of readdirSync(current, { withFileTypes: true })) {
+        if (entry.name === '.DS_Store' || entry.name === '__pycache__' || /\.(iml|pyc|pyo)$/.test(entry.name)) continue;
+        const file = path.join(current, entry.name), ref = prefix ? prefix + '/' + entry.name : entry.name;
+        const entryInfo = stat(file), real = realpathSync(file);
+        if (!inside(real, resolved)) throw new TypeError('技能文件链接越界: ' + ref);
+        if (entryInfo.isDirectory()) walk(file, ref);
+        else if (entryInfo.isFile() || entryInfo.isSymbolicLink()) files.push([ref, file]);
+        else throw new TypeError('技能包含不支持的文件类型: ' + ref);
+      }
+    }
+    walk(directory);
+    const digest = createHash('sha256');
+    for (const [ref, file] of files.sort(([left], [right]) => left.localeCompare(right))) {
+      const bytes = readFileSync(file);
+      const normalized = bytes.includes(0) ? bytes : Buffer.from(bytes.toString('utf8').replaceAll('\r\n', '\n'));
+      digest.update(ref).update('\0').update(normalized).update('\0');
+    }
+    return digest.digest('hex');
+  }
+  for (const id of [...required].sort()) {
+    if (issues.some(issue => issue.skill === id)) continue;
+    const canonicalRef = '.agents/skills/' + id;
+    const canonical = path.join(root, canonicalRef);
+    const record = lock?.skills?.shared?.[id];
+    const declared = selected?.installedSkills?.includes(id);
+    if (!stat(canonical)) {
+      const managed = Object.keys(metadata?.managedFiles ?? {}).some(ref => ref.startsWith(canonicalRef + '/'));
+      if (record || declared || managed) report('managed-skill-missing', id, canonicalRef, '已登记或受管技能文件丢失；先核对 sync 计划，不能当作未安装补装');
+      else {
+        const occupied = Object.entries(roots).find(([runtime, ref]) => registeredRuntimes.includes(runtime) && stat(path.join(root, ref, id)));
+        if (occupied) report('skill-path-conflict', id, occupied[1] + '/' + id, '同名投影路径已存在但未登记，拒绝覆盖');
+        else missing.push(id);
+      }
+      continue;
+    }
+    if (!record) {
+      report('skill-path-conflict', id, canonicalRef, '同名技能路径存在但未登记，拒绝覆盖');
+      continue;
+    }
+    if (selected && !declared) report('distribution-lock-drift', id, '.yss-template.json', '技能锁与实例安装清单不一致');
+    try {
+      const hash = checkedTreeHash(canonical, canonical);
+      if (!existsSync(path.join(canonical, 'SKILL.md'))) report('managed-skill-missing', id, canonicalRef + '/SKILL.md', '已登记技能缺少入口文件');
+      if (hash !== record.effectiveHash) report('skill-hash-drift', id, canonicalRef, 'canonical 技能内容与锁定有效哈希不一致');
+      const projectionRef = agentRuntime && roots[agentRuntime];
+      if (projectionRef) {
+        if (!lock.projectionRoots.includes(projectionRef) || !record.targets?.includes(projectionRef) || !record.targets?.includes('.agents/skills')) {
+          report('projection-lock-drift', id, 'skills-lock.json', '所选运行时投影目标与技能锁不一致');
+        }
+        const projection = path.join(root, projectionRef, id);
+        if (checkedTreeHash(projection, canonical, true) !== hash) report('projection-drift', id, projectionRef + '/' + id, '运行时投影缺失或与 canonical 内容不一致');
+      }
+    } catch (error) {
+      report('skill-path-invalid', id, canonicalRef, error.message);
+    }
+  }
+  const canEnsure = metadata?.metadataSchemaVersion === 3 && selected && metadata.templateName === 'create-yss-spec';
+  const commandArgs = ['create-yss-spec', 'skills', 'ensure', ...missing.sort(), ...when.flatMap(trigger => ['--when', trigger]), '--target-dir', root];
+  const quote = value => /^[a-zA-Z0-9_./:-]+$/.test(value) ? value : "'" + value.replaceAll("'", "'\\''") + "'";
+  const command = mode => [...commandArgs, mode].map(quote).join(' ');
+  return {
+    read_only: true, execution_allowed: false, agent_runtime: agentRuntime ?? null,
+    required_skills: [...required].sort(), missing_skills: missing,
+    status: issues.length ? 'blocked' : missing.length ? 'missing' : 'ready',
+    issues,
+    remediation: missing.length && !issues.length ? canEnsure
+      ? { plan_command: command('--plan'), apply_command: command('--apply'), authorization: 'existing-task-scope-required', recheck_required: true }
+      : { plan_command: null, apply_command: null, message: '此实例没有可用的 v3 按需补装元数据；按本家族 CLI 规划同步或迁移，保持现有分发模式' }
+      : null,
+  };
+}
+
+function querySnapshot({ mode, stageId, workUnitId, include = [], checkSkills = false, agentRuntime, when = [] } = {}) {
+  if (checkSkills && !workUnitId) throw new TypeError('--check-skills 必须指定 --work-unit');
+  if (!checkSkills && (agentRuntime !== undefined || when.length)) throw new TypeError('--agent-runtime 和 --when 必须与 --check-skills 一起使用');
+  if (!Array.isArray(when) || when.some(trigger => typeof trigger !== 'string' || !/^[a-z][a-z0-9-]+$/.test(trigger))) throw new TypeError('--when 必须是有效的条件触发项');
   if (!mode && !stageId && !workUnitId && include.length === 0) {
     throw new TypeError("至少提供 --mode、--stage、--work-unit 或 --include 之一");
   }
@@ -77,15 +231,15 @@ function querySnapshot({ mode, stageId, workUnitId, include = [] } = {}) {
   if (identity.schema_version !== 1 || !["template-source", "project-instance"].includes(identity.repository_mode)) {
     throw new TypeError("仓库身份或版本无效");
   }
-  const scope = loadExecutionScope();
-  if (workUnitId) assertScopeWorkUnit(workUnitId, { readOnly: true });
+  const scope = QUERY_PROFILE === 'lifecycle' ? loadExecutionScope() : null;
+  if (workUnitId && QUERY_PROFILE === 'lifecycle') assertScopeWorkUnit(workUnitId, { readOnly: true });
   const lifecycle = validateRegistry(loadRegistry());
   const orchestration = loadYaml(ORCHESTRATION_CONTRACT_REF, "生命周期编排合同");
   const skillRegistry = loadSkillRegistry();
   const planUnit = ['work-unit.plan-opportunity', 'work-unit.plan-requirements', 'work-unit.domain-strategy-design', 'work-unit.stage-decision', 'work-unit.spec-synthesis'].includes(workUnitId);
   const loadPlan = ['stage.plan', 'stage.spec-architecture'].includes(stageId) || planUnit;
   stageId ??= planUnit ? 'stage.plan' : undefined;
-  include = [...include, 'gate_consolidation'];
+  if (QUERY_PROFILE === 'lifecycle') include = [...include, 'gate_consolidation'];
   if (loadPlan) include = [...include, 'planning', 'grill_exit'];
   const stage = selectById(lifecycle.stages, stageId, "阶段");
   const workUnit = selectById(lifecycle.work_units, workUnitId, "工作单元");
@@ -97,19 +251,19 @@ function querySnapshot({ mode, stageId, workUnitId, include = [] } = {}) {
   }
 
   const route = workUnitId ? orchestration.work_unit_routes?.[workUnitId] ?? null : null;
-  if (workUnit?.scope === "project-instance" && workUnit.id !== "work-unit.entry-triage" && !route) {
+  if (QUERY_PROFILE === 'lifecycle' && workUnit?.scope === "project-instance" && workUnit.id !== "work-unit.entry-triage" && !route) {
     throw new TypeError(`项目工作单元缺少执行路由: ${workUnit.id}`);
   }
-  if (workUnit?.scope === "project-instance" && workUnit.id !== "work-unit.entry-triage" && !Object.hasOwn(orchestration.transition_graph?.routes ?? {}, workUnit.id)) {
+  if (QUERY_PROFILE === 'lifecycle' && workUnit?.scope === "project-instance" && workUnit.id !== "work-unit.entry-triage" && !Object.hasOwn(orchestration.transition_graph?.routes ?? {}, workUnit.id)) {
     throw new TypeError(`项目工作单元缺少流转路由: ${workUnit.id}`);
   }
   const gates = lifecycle.gates.filter((gate) => gate.stage === stageId || (loadPlan && gate.stage === 'stage.plan'));
-  const checks = lifecycle.checks.filter(check => check.stage === stageId || gates.some(gate => gate.requires_checks?.includes(check.id)));
+  const checks = QUERY_PROFILE === 'lifecycle' ? lifecycle.checks.filter(check => check.stage === stageId || gates.some(gate => gate.requires_checks?.includes(check.id))) : [];
   const artifacts = lifecycle.artifacts.filter((artifact) => artifact.stage === stageId || (loadPlan && artifact.stage === 'stage.plan'));
   const evidenceIds = new Set([...gates, ...checks].flatMap((gate) => gate.evidence ?? []));
   const selected = Object.fromEntries(normalizedIncludes.map((key) => [key, orchestration[key]]));
   const transition = workUnitId ? {
-    next: scopedNextRoutes(workUnitId, orchestration.transition_graph?.routes?.[workUnitId] ?? []),
+    next: QUERY_PROFILE === 'lifecycle' ? scopedNextRoutes(workUnitId, orchestration.transition_graph?.routes?.[workUnitId] ?? []) : orchestration.transition_graph?.routes?.[workUnitId] ?? [],
     forbidden_shortcuts: (orchestration.transition_graph?.forbidden_shortcuts ?? [])
       .filter((edge) => edge.from === workUnitId || edge.to === workUnitId),
   } : null;
@@ -143,10 +297,10 @@ function querySnapshot({ mode, stageId, workUnitId, include = [] } = {}) {
     lifecycle: {
       artifacts,
       evidence: lifecycle.evidence.filter((item) => evidenceIds.has(item.id)).map(({ public_description, ...item }) => ({
-        ...item, description: public_description ?? item.description
+        ...item, ...(QUERY_PROFILE === 'lifecycle' ? { description: public_description ?? item.description } : public_description ? { public_description } : {})
       })),
       gates,
-      checks,
+      ...(QUERY_PROFILE === 'lifecycle' ? { checks } : {}),
       stage,
       work_unit: workUnit,
     },
@@ -160,12 +314,19 @@ function querySnapshot({ mode, stageId, workUnitId, include = [] } = {}) {
     },
     skills: selectedSkills(route, skillRegistry),
   };
+  if (checkSkills) {
+    result.query.check_skills = true;
+    result.query.when = [...new Set(when)].sort();
+    result.skill_readiness = inspectWorkUnitSkills({ registry: skillRegistry, route, agentRuntime, when: result.query.when });
+  }
+  if (QUERY_PROFILE === 'lifecycle') {
   const presenter = loadLifecyclePresenter(ROOT);
   result.presentation = { read_only: true, execution_allowed: false, approval_validity: 'not-checked',
     names: presenter.catalog(result.lifecycle), sources: presenter.sources, warnings: presenter.warnings };
   // Include role and transition references from the requested contract subtrees as well.
   Object.assign(result.presentation.names, presenter.catalog(result.execution));
   Object.assign(result.presentation.names, presenter.catalog(presenter.roleIds));
+  }
   result.references = [...collectPathReferences(result), LIFECYCLE_REGISTRY_REF, ORCHESTRATION_CONTRACT_REF, SKILL_REGISTRY_REF]
     .filter((value, index, all) => all.indexOf(value) === index)
     .sort();

package/template/scripts/lib/lifecycle-controls.mjs

@@ -1,15 +1,19 @@
-import { readFileSync } from './validation-phase.mjs';
+import { readFileSync, withValidationPhase } from './validation-phase.mjs';
 import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { parseDocument } from '../vendor/yaml.mjs';
 import { loadRegistry, ROOT } from './lifecycle-registry.mjs';
 import { loadDigitalHumanRoles, countersignRuleForGate } from './digital-human-roles.mjs';
-import { validateApprovalRecord, loadApprovalRecord } from './approval-record.mjs';
+import {loadApprovalRecord} from './approval-record-io.mjs';
+import {assertCurrentApproval, approvalExpectationFromState} from './approval-current.mjs';
 
 const fail = message => { throw new TypeError(`lifecycle-control-blocked: ${message}`); };
 
 // Checks retain their own evidence and independent review; only the aggregate requests a user decision.
-export function assertGateChecks(gateId, state, { root = ROOT, registry = loadRegistry(), rolesDoc = loadDigitalHumanRoles() } = {}) {
+export function assertGateChecks(gateId, state, options = {}) {
+  return withValidationPhase({root:options.root || ROOT,purpose:'current-gate-checks',readOnly:true},()=>validateGateChecks(gateId,state,options));
+}
+function validateGateChecks(gateId, state, { root = ROOT, registry = loadRegistry(), rolesDoc = loadDigitalHumanRoles() } = {}) {
   const gate = registry.gates.find(item => item.id === gateId);
   if (!gate) fail(`未知或已退役门禁: ${gateId}`);
   const controls = new Map(registry.checks.map(item => [item.id, item]));
@@ -47,12 +51,7 @@ export function assertGateChecks(gateId, state, { root = ROOT, registry = loadRe
     if (rule) {
       if (!refs.has(item.approval_ref) || !refs.has(item.subject_ref)) fail(`${id} 未绑定审查与资产`);
       const record = loadApprovalRecord(path.resolve(root, item.approval_ref), id);
-      if (record.gate_id !== id || record.subject_ref !== item.subject_ref) fail(`${id} 审查对象不匹配`);
-      if (!item.approval_scope?.length || JSON.stringify([...item.approval_scope].sort()) !== JSON.stringify([...(record.approval_scope || [])].sort())) fail(`${id} 审查范围不匹配`);
-      const subjectDigest = createHash('sha256').update(readFileSync(path.resolve(root, item.subject_ref))).digest('hex');
-      if (record.subject_digest !== subjectDigest) fail(`${id} 审查资产摘要不匹配`);
-      validateApprovalRecord(record, { rolesDoc, root, requireApproved: true });
-      if (!record.drafter_principal_ref || record.drafter_principal_ref === record.principal_ref) fail(`${id} 缺少独立审查身份或起草者自签`);
+      assertCurrentApproval(record,approvalExpectationFromState(id,item,{root}),{rolesDoc,registry,root});
     }
   }
   for (const id of gate.requires_checks || []) check(id);
@@ -66,16 +65,7 @@ export function assertGateChecks(gateId, state, { root = ROOT, registry = loadRe
   if (approvalRequired) {
     if (!refs.has(item.approval_ref) || !refs.has(item.subject_ref)) fail(`${gateId} 缺少已绑定批准记录和审阅包`);
     const record = loadApprovalRecord(path.resolve(root, item.approval_ref), gateId);
-    if (!record.drafter_principal_ref || record.drafter_principal_ref === record.principal_ref) fail(`${gateId} 缺少独立审查身份或起草者自签`);
-    const bytes = readFileSync(path.resolve(root, item.subject_ref));
-    if (record.subject_ref !== item.subject_ref || record.subject_digest !== createHash('sha256').update(bytes).digest('hex')) fail(`${gateId} 批准依据过期`);
-    const document = parseDocument(bytes.toString(), { uniqueKeys: true, maxAliasCount: 0 });
-    if (document.errors.length) fail(`${gateId} 审阅包不可解析`);
-    const review = document.toJS({ maxAliasCount: 0 });
-    if (review?.gate_id !== gateId || !Array.isArray(review.basis)) fail(`${gateId} 审阅包身份或依据缺失`);
-    for (const asset of item.basis.filter(asset => ![item.approval_ref, item.subject_ref].includes(asset.ref))) {
-      if (!review.basis.some(bound => bound.ref === asset.ref && bound.digest === asset.digest)) fail(`${gateId} 批准范围未覆盖证据: ${asset.ref}`);
-    }
+    assertCurrentApproval(record,approvalExpectationFromState(gateId,item,{root}),{rolesDoc,registry,root});
   }
   // Bind the aggregate approval to the exact check evidence it covers.
   for (const id of seen) for (const asset of state.checks[id].basis) {

package/template/scripts/lib/lifecycle-presentation.mjs

@@ -64,13 +64,18 @@ export function loadLifecyclePresenter(root) {
 export function renderLifecycleStatus(result) {
   const view = result.presentation;
   if (!view) throw Error('缺少状态阅读信息');
+  const ownerNote = issue => ({'work-unit': '（工作单元负责人；问题责任方待确认）', 'checkpoint-pause': '（暂停记录责任方；问题责任方待确认）'}[issue.owner_scope] ?? '');
   return [
     `当前阶段：${view.stage}。登记状态：${view.checkpoint_status}。`,
+    `下一阶段（路由目标）：${view.next_stage ?? '待核验'}。${view.next_stage_reason ?? '阶段归属未核验；不代表已批准或可进入'}。`,
     `当前阻塞：${view.blockers.length ? view.blockers.join('；') : '未登记阻塞；完整就绪与批准仍待核验'}。`,
+    ...(view.issues ?? []).map((issue, index) => `${index + 1}. ${issue.severity === 'error' ? '阻塞' : '待核验问题'}：${issue.message}\n   负责人：${issue.owner}${ownerNote(issue)}；来源：${issue.source_ref ?? '未登记'}\n   处理：${issue.recovery}`),
     `负责人：${view.owner}。`,
     `下一项工作：${view.work_unit}。`,
     ...(view.expected_output ? [`预期产出：${view.expected_output}`] : []),
     `下一动作：${view.next_action}。`,
+    ...(view.pending_verification?.length ? [`待核验：${view.pending_verification.map(item => item.reason).join('；')}。`] : []),
+    ...(view.continue_conditions?.length ? [`继续条件：${view.continue_conditions.join('；')}。`] : []),
     ...view.warnings,
     '本次为只读查询，未核验完整批准或执行授权。',
   ].join('\n') + '\n';

package/template/scripts/lib/lifecycle-status.mjs

@@ -15,50 +15,97 @@ function parse(bytes) {
   return document.toJS({ maxAliasCount: 0 });
 }
 function source(root, ref) {
-  const bytes = readFileSync(safeTrackingPath(root, ref));
-  return { value: parse(bytes), digest: sha(bytes) };
+  try {
+    const bytes = readFileSync(safeTrackingPath(root, ref));
+    return { value: parse(bytes), digest: sha(bytes) };
+  } catch (error) {
+    error.lifecycle_input_ref ??= ref;
+    throw error;
+  }
 }
 
 /** Read-only projection; checkpoint, registry and orchestration remain authoritative. */
 export function lifecycleStatus({ root, checkpointRef, taskPackageRef }) {
   if (!root || !checkpointRef) throw new TypeError('root and checkpoint are required');
   root = path.resolve(root);
-  const identity = source(root, 'yss-project.yaml').value;
-  if (identity.schema_version !== 1 || identity.repository_mode !== 'project-instance') throw new TypeError('生命周期状态仅适用于 project-instance');
+  let identity;
+  try {
+    identity = source(root, 'yss-project.yaml').value;
+    if (identity.schema_version !== 1 || identity.repository_mode !== 'project-instance') throw new TypeError('生命周期状态仅适用于 project-instance');
+  } catch (error) {
+    error.lifecycle_input_ref ??= 'yss-project.yaml';
+    error.lifecycle_input_kind = identity?.schema_version === 1 && identity?.repository_mode === 'template-source' ? 'template-source' : 'manifest';
+    throw error;
+  }
   const registryRef = '.template-spec/process/lifecycle-registry.yaml';
   const contractRef = orchestrationRef(root);
   const checkpoint = source(root, checkpointRef), registry = source(root, registryRef), contract = source(root, contractRef);
   const value = checkpoint.value;
+  const registeredText = value => typeof value === 'string' && value.trim() ? value : null;
   if (value.schema_version !== 1 || value.repository_mode !== 'project-instance') throw new TypeError('checkpoint 身份或版本无效');
   const items = value.stage_tracking?.items ?? [];
   if (!Array.isArray(items)) throw new TypeError('阶段追踪 items 必须为数组');
   const activeItems = items.filter(item => item.work_unit === value.next_work_unit && item.progress !== 'cancelled');
-  const owner = value.pause?.owner_or_authority ?? activeItems.find(item => item.progress !== 'completed')?.owner ?? '未登记';
+  const pauseOwner = registeredText(value.pause?.owner_or_authority);
+  const workUnitOwner = registeredText(activeItems.find(item => item.progress !== 'completed')?.owner);
+  const owner = pauseOwner ?? workUnitOwner ?? '未登记';
+  const defaultOwnerScope = pauseOwner ? 'checkpoint-pause' : workUnitOwner ? 'work-unit' : 'not-recorded';
   const diagnostics = [], verification_scope = [];
   const check = (id, status, refs, reason) => verification_scope.push({ id, status, refs, reason });
-  const issue = (code, message, source_ref, recovery, severity = 'error') => diagnostics.push({ code, message, source_ref, owner, recovery, severity });
+  const issue = (code, message, source_ref, recovery, severity = 'error', issueOwner = owner, ownerScope = defaultOwnerScope) => diagnostics.push({ code, message, source_ref, owner: issueOwner, owner_scope: issueOwner === '未登记' ? 'not-recorded' : ownerScope, recovery, severity });
   if (!Object.hasOwn(value, 'blockers')) {
     issue('registered-blockers-missing', 'checkpoint 缺少 blockers；不能据此判定无已登记阻塞', checkpointRef, '核对原始状态并补齐真实阻塞记录后重验');
   } else if (!Array.isArray(value.blockers)) {
     issue('registered-blockers-invalid', 'checkpoint.blockers 必须为数组；当前登记不可核验', checkpointRef, '修复阻塞记录类型，保留原有阻塞内容后重验');
   } else {
     for (const item of value.blockers) {
-      issue('registered-blocker', typeof item === 'string' ? item : JSON.stringify(item), checkpointRef, '按原阻塞证据处理并复验');
+      const record = item && typeof item === 'object' && !Array.isArray(item) ? item : {};
+      issue('registered-blocker', registeredText(item) ?? registeredText(record.message) ?? registeredText(record.reason) ?? '已登记阻塞，具体问题尚未说明', registeredText(record.source_ref) ?? checkpointRef, registeredText(record.recovery) ?? '核对原阻塞记录、责任方和证据，明确处理动作后复验', 'error', registeredText(record.owner) ?? owner, registeredText(record.owner) ? 'issue' : defaultOwnerScope);
     }
   }
   check('registered-blockers', diagnostics.length ? 'failed' : 'passed', [checkpointRef], '仅读取已登记阻塞，不代表完整就绪');
   const stage = registry.value.stages?.find(item => item.id === value.stage);
   const workUnit = registry.value.work_units?.find(item => item.id === value.next_work_unit);
+  // Only explicit recorded associations identify a target stage. Stage order is not a route.
+  const stageAssociations = workUnit ? [
+    ...(registeredText(workUnit?.stage) ? [{stage: workUnit.stage, ref: registryRef}] : []),
+    ...activeItems.filter(item => registeredText(item.stage)).map(item => ({stage: item.stage, ref: checkpointRef})),
+  ] : [];
+  const stageIds = [...new Set(stageAssociations.map(item => item.stage))];
+  const nextStage = stageIds.length === 1 && registry.value.stages?.some(item => item.id === stageIds[0]) ? stageIds[0] : null;
+  const nextStageReason = !value.next_work_unit ? '未登记下一工作单元；需核验当前阶段验收与终点，不能据此判定完成'
+    : stageIds.length > 1 ? '下一工作单元的已登记阶段归属存在冲突；核对权威记录后重验'
+    : stageIds.length === 1 && !nextStage ? '下一工作单元的阶段归属未在注册表中识别；核对当前来源后重验'
+    : !nextStage ? '下一工作单元尚未登记阶段归属；核验当前路由与阶段追踪后确认'
+    : nextStage === value.stage ? '下一工作单元仍在当前阶段，先完成当前单元并验收，再核验后续流转；不代表已批准或可进入'
+    : '来自下一工作单元的已登记阶段归属，仅为路由目标，不代表已批准或可进入';
+  check('next-stage-association', nextStage ? 'passed' : 'not-checked', [...new Set(stageAssociations.map(item => item.ref))], nextStageReason);
+  if (stageIds.length > 1 || (stageIds.length === 1 && !nextStage)) issue('next-stage-unverifiable', nextStageReason, checkpointRef, '核对下一工作单元的已登记阶段归属并执行适用预检，不按阶段顺序猜目标', 'warning');
   if (!stage) issue('unknown-stage', `未知阶段: ${value.stage}`, registryRef, '按注册表核对当前阶段');
   if (value.next_work_unit && !workUnit) issue('unknown-work-unit', `未知下一工作单元: ${value.next_work_unit}`, registryRef, '按注册表核对下一工作单元');
   if (workUnit && workUnit.id !== 'work-unit.entry-triage' && !contract.value.work_unit_routes?.[workUnit.id]) issue('missing-route', `缺少执行路由: ${workUnit.id}`, contractRef, '修复当前合同路由后重验');
   check('stage-and-route', diagnostics.some(x => ['unknown-stage', 'unknown-work-unit', 'missing-route'].includes(x.code)) ? 'failed' : 'passed', [registryRef, contractRef], '仅检查身份与路由存在，不计算完整 frontier');
   if (value.context_reconciliation?.status === 'blocked') issue('context-blocked', '术语对账受阻', checkpointRef, '修复词汇对账并执行适用校验');
   check('context-reconciliation', value.context_reconciliation?.status === 'blocked' ? 'failed' : 'not-checked', [value.context_reconciliation?.ref].filter(Boolean), '读取登记状态；当前对账内容和摘要仍须由原验证器核验');
-  for (const [id, gate] of Object.entries(value.gates ?? {})) {
-    if (['blocked', 'stale'].includes(gate?.status)) issue('gate-blocked', `${id}: ${gate.status}`, checkpointRef, '核对受影响依据和当前批准');
+  const gateNames = {blocked: '受阻', stale: '依据已过期', pending: '等待处理', failed: '未通过', 'ready-for-human': '等待会签', 'not-evaluated': '尚未评估'};
+  const gates = value.gates && typeof value.gates === 'object' && !Array.isArray(value.gates) ? Object.entries(value.gates) : [];
+  if (!Object.hasOwn(value, 'gates') || !value.gates || typeof value.gates !== 'object' || Array.isArray(value.gates)) issue('gates-unverifiable', '门禁登记缺失或格式不可核验', checkpointRef, '核对原始门禁记录并执行正式预检', 'warning');
+  for (const [id, gate] of gates) {
+    const status = gateNames[gate?.status];
+    const hardBlocked = ['blocked', 'stale'].includes(gate?.status);
+    const failed = hardBlocked || (['pending', 'failed', 'ready-for-human', 'not-evaluated'].includes(gate?.status) && gate?.applicable === true);
+    if (status) {
+      const blocked = hardBlocked || (failed && gate?.applicable !== false);
+      const reason = registeredText(gate?.reason);
+      const applicability = hardBlocked && gate?.applicable === false ? '；登记状态与适用性标记冲突，需正式预检' : blocked ? '' : '；适用性与当前处理要求待核验';
+      const recovery = registeredText(gate?.recovery) ?? (['pending', 'ready-for-human'].includes(gate?.status) ? '核对适用范围、当前资产和已登记责任方；取得所需真实决定或有效延续后复验' : '核对适用范围、失败原因或过期依据，修复并重验受影响检查与批准');
+      issue(blocked ? 'gate-blocked' : 'gate-unverified', `${id}：${status}${reason ? `；${reason}` : ''}${applicability}`, checkpointRef, hardBlocked && gate?.applicable === false ? `${recovery}；保留阻断状态，核对冲突登记并执行正式预检` : recovery, blocked ? 'error' : 'warning', registeredText(gate?.owner) ?? owner, registeredText(gate?.owner) ? 'issue' : defaultOwnerScope);
+    } else if (!['approved', 'not-applicable'].includes(gate?.status)) {
+      issue('gate-unverified', `${id}：登记状态未识别，适用性与处理要求待核验`, checkpointRef, '保留原记录，核对门禁状态与适用性后执行正式预检', 'warning', registeredText(gate?.owner) ?? owner, registeredText(gate?.owner) ? 'issue' : defaultOwnerScope);
+    }
   }
-  check('registered-gates', diagnostics.some(x => x.code === 'gate-blocked') ? 'failed' : 'passed', [checkpointRef], '仅检查登记的 blocked/stale 标志');
+  const gateDiagnostics = diagnostics.filter(x => ['gate-blocked', 'gate-unverified', 'gates-unverifiable'].includes(x.code));
+  check('registered-gates', gateDiagnostics.some(x => x.severity === 'error') ? 'failed' : gateDiagnostics.length || !gates.length ? 'not-checked' : 'passed', [checkpointRef], '仅读取已登记状态；适用性未登记、待处理或记录缺失时不能判定门禁通过；不核验完整批准');
   const evidenceRefs = [value.context_reconciliation?.ref, ...Object.values(value.artifacts ?? {}).filter(item => item?.status === 'approved').map(item => item.ref)].filter(Boolean);
   for (const ref of evidenceRefs) {
     try { readFileSync(safeTrackingPath(root, ref)); }
@@ -149,17 +196,21 @@ export function lifecycleStatus({ root, checkpointRef, taskPackageRef }) {
   const presentation = {
     read_only: true, execution_allowed: false, approval_validity: 'not-checked',
     stage: value.stage ? presenter.label(value.stage, {trace: false}) : '未登记',
+    next_stage: nextStage ? presenter.label(nextStage, {trace: false}) : '待核验', next_stage_reason: readable(nextStageReason),
     checkpoint_status: Object.hasOwn(statusNames, value.status) ? statusNames[value.status] : `未识别状态（${value.status ?? '未登记'}）`,
     work_unit: value.next_work_unit ? presenter.label(value.next_work_unit, {trace: false}) : '未登记',
     owner: presenter.text(owner, {trace: false}), blockers: blockers.map(readable),
+    issues: diagnostics.map(item => ({code: item.code, severity: item.severity, message: readable(item.message), source_ref: item.source_ref, owner: presenter.text(item.owner, {trace: false}), owner_scope: item.owner_scope, recovery: readable(item.recovery)})),
+    pending_verification: verification_scope.filter(item => !['passed', 'failed'].includes(item.status)).map(item => ({id: item.id, reason: readable(item.reason), refs: item.refs})),
+    continue_conditions: [...(registeredText(value.pause?.resume_condition) ? [readable(value.pause.resume_condition)] : []), ...next_step.prerequisites.map(readable), ...(blockers.length ? ['逐项处理当前阻塞，并由适用验证器确认恢复条件满足'] : []), '由主控验收当前证据并核验授权后决定继续或重新路由'],
     expected_output: workUnit ? readable(workUnit.public_output ?? workUnit.output ?? '产出说明未登记') : null,
     next_action: readable(next_action), sources: presenter.sources, warnings: presenter.warnings,
-    names: presenter.catalog({stage: value.stage, work_unit: value.next_work_unit, owner, gates: value.gates, artifacts: value.artifacts}),
+    names: presenter.catalog({stage: value.stage, next_stage: nextStage, work_unit: value.next_work_unit, owner, gates: value.gates, artifacts: value.artifacts}),
   };
   return {
     presentation,
     decomposition: {business, implementation: {status:implementationArtifact?'recorded':'not-recorded',recorded_status:implementationArtifact?.status??null,ref:implementationArtifact?.ref??null,coverage:implementationCoverage}, readiness:{status:'not-evaluated',reason:'阶段工作完成不替代批准与实现就绪校验'}},
-    schema_version: 1, read_only: true, stage: value.stage, checkpoint_status: value.status,
+    schema_version: 1, read_only: true, stage: value.stage, next_stage: nextStage, next_stage_reason: nextStageReason, next_stage_source_refs: [...new Set(stageAssociations.map(item => item.ref))], checkpoint_status: value.status,
     work_unit: value.next_work_unit ?? null, owner, blockers, next_action,
     execution_authorization: 'not-evaluated', verification_scope, diagnostics, next_step, recovery,
     reading_views: checkReadingViews(root,checkpointRef),

package/template/scripts/lib/lifecycle-transition.mjs

@@ -1,3 +1,4 @@
+import {approvalExpectationForBoundAsset} from './approval-consumption.mjs';
 import { assertBusinessApprovalBasis } from './business-ticket-lifecycle.mjs';
 import { assertBusinessTicketTransition, assertImplementationTicket } from './business-tickets.mjs';
 import {assertReadingTransition} from './reading-view-bundle.mjs';
@@ -233,7 +234,7 @@ function backendDesignPrerequisitesReady(prerequisites, exists, root, projectId)
       ? prerequisites.engineering_contract_approval_ref
       : path.resolve(root, prerequisites.engineering_contract_approval_ref);
     const approval = loadApprovalRecord(approvalFile, 'gate.engineering-contract-approved');
-    validateApprovalRecord(approval, { requireApproved: true, root });
+    validateApprovalRecord(approval, { requireApproved: true, root, expected: approvalExpectationForBoundAsset('gate.engineering-contract-approved',prerequisites.technical_design,{root}) });
     if (approval.gate_id !== "gate.engineering-contract-approved" || !approval.approval_scope?.includes(projectId)) return false;
     if (!approvalHasBinding(approval, technical.expected) || !approvalHasBinding(approval, data.expected)) return false;
     if (!approvalHasBinding(approval, { id: api.decision.decision_id, version: api.decision.decision_version, digest: prerequisites.api_contract_decision.digest })) return false;

package/template/scripts/lib/maintenance-candidate.mjs

@@ -2,11 +2,11 @@ import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import path from "node:path";
+import { resolveMaintenanceOutput, resolveMaintenanceLocation, maintenanceReference, resolveMaintenanceReference, resolveMaintenanceBundleFile } from './maintenance-storage.mjs';
 import { parseDocument, stringify } from "../vendor/yaml.mjs";
 
 const MAGIC = Buffer.from("YSS-WORKTREE-CANDIDATE-V1\0", "ascii");
 const MAX_BUFFER = 512 * 1024 * 1024;
-const MAINTENANCE_EVIDENCE_ROOT = ".template-source/evidence/maintenance";
 const CANDIDATE_FILES = ["candidate-manifest.yaml", "candidate.bin", "tracked.diff"];
 
 function fail(message) { throw new TypeError(message); }
@@ -25,15 +25,6 @@ function splitNull(buffer) {
   if (start < buffer.length) result.push(buffer.subarray(start));
   return result;
 }
-function normalizeRelative(value, label) {
-  ensure(typeof value === "string" && value.trim(), `${label} 不能为空`);
-  const normalized = value.replaceAll("\\", "/").replace(/^\.\//, "").replace(/\/$/, "");
-  ensure(normalized && !path.posix.isAbsolute(normalized) && path.posix.normalize(normalized) === normalized && normalized !== ".." && !normalized.startsWith("../"), `${label} 必须是规范的仓库内相对路径`);
-  return normalized;
-}
-function isMaintenanceEvidencePath(value) {
-  return value === MAINTENANCE_EVIDENCE_ROOT || value.startsWith(`${MAINTENANCE_EVIDENCE_ROOT}/`);
-}
 function readLength(buffer, offset, bytes, label) {
   ensure(offset + bytes <= buffer.length, `packed candidate 缺少 ${label}`);
   const value = bytes === 8 ? buffer.readBigUInt64BE(offset) : BigInt(buffer.readUInt32BE(offset));
@@ -43,21 +34,14 @@ function readLength(buffer, offset, bytes, label) {
 
 export function captureMaintenanceCandidate({ root, outputDir, baseRef = "HEAD", excludePaths = [] }) {
   const repositoryRoot = path.resolve(root);
-  const outputPath = path.resolve(repositoryRoot, outputDir);
-  const outputRelative = normalizeRelative(path.relative(repositoryRoot, outputPath).replaceAll(path.sep, "/"), "outputDir");
-  ensure(isMaintenanceEvidencePath(outputRelative), `outputDir 必须位于 ${MAINTENANCE_EVIDENCE_ROOT}`);
+  const outputPath = resolveMaintenanceOutput(outputDir, { root: repositoryRoot });
+  const outputRelative = maintenanceReference(outputPath, { root: repositoryRoot });
   ensure(!existsSync(outputPath), "outputDir 必须不存在，禁止复用可能含残留文件的候选目录");
   ensure(Array.isArray(excludePaths), "excludePaths 必须是数组");
-  const explicitExclusions = excludePaths.map((value) => normalizeRelative(value, "excludePaths"));
-  for (const exclusion of explicitExclusions) ensure(isMaintenanceEvidencePath(exclusion), `excludePaths 只允许 ${MAINTENANCE_EVIDENCE_ROOT} 下的维护证据`);
-  const exclusions = [...new Set([outputRelative, ...explicitExclusions])];
+  ensure(excludePaths.length === 0, "excludePaths 已退役；新候选必须完整捕获，维护材料请保存到仓外");
   const mergeBase = git(["merge-base", baseRef, "HEAD"], repositoryRoot).trim();
   const trackedDiff = git(["diff", "--no-ext-diff", "--binary", "--full-index", mergeBase], repositoryRoot, null);
   const rawPaths = splitNull(git(["ls-files", "-z", "--others", "--exclude-standard"], repositoryRoot, null))
-    .filter((rawPath) => {
-      const value = rawPath.toString();
-      return !exclusions.some((exclusion) => value === exclusion || value.startsWith(`${exclusion}/`));
-    })
     .sort(Buffer.compare);
   ensure(trackedDiff.length > 0 || rawPaths.length > 0, "维护候选不能为空");
 
@@ -81,11 +65,13 @@ export function captureMaintenanceCandidate({ root, outputDir, baseRef = "HEAD",
   }
   const stream = Buffer.concat(parts);
   const digest = createHash("sha256").update(stream).digest("hex");
-  const streamRef = `${outputRelative}/candidate.bin`;
-  const diffRef = `${outputRelative}/tracked.diff`;
+  const streamRef = 'candidate.bin';
+  const diffRef = 'tracked.diff';
   const manifestRef = `${outputRelative}/candidate-manifest.yaml`;
   const manifest = {
-    schema_version: 1,
+    schema_version: 2,
+    reference_base: 'bundle',
+    workspace_id: resolveMaintenanceLocation({ root: repositoryRoot }).workspaceId,
     candidate_kind: "yss-worktree-candidate-v1",
     storage: "packed-stream",
     review_mode: "worktree",
@@ -99,7 +85,7 @@ export function captureMaintenanceCandidate({ root, outputDir, baseRef = "HEAD",
     untracked_diff_command: "packed in candidate.bin",
     untracked_files: untrackedFiles,
     untracked_path_bytes: untrackedPathBytes,
-    excluded_paths: exclusions,
+    excluded_paths: [],
     snapshot_stream_ref: streamRef,
     tracked_diff_ref: diffRef,
     commit_list_command: `git log ${baseRef}..HEAD --oneline`
@@ -115,10 +101,10 @@ export function captureMaintenanceCandidate({ root, outputDir, baseRef = "HEAD",
   } finally {
     if (existsSync(stagingPath)) rmSync(stagingPath, { recursive: true, force: true });
   }
-  return { candidate_digest: digest, manifest, manifest_ref: manifestRef, files: [manifestRef, streamRef, diffRef] };
+  return { candidate_digest: digest, manifest, manifest_ref: manifestRef, files: [manifestRef, `${outputRelative}/${streamRef}`, `${outputRelative}/${diffRef}`] };
 }
 
-export function inspectMaintenanceCandidate({ manifestPath }) {
+export function inspectMaintenanceCandidate({ manifestPath, root: repositoryRoot = process.cwd() }) {
   const absoluteManifest = path.resolve(manifestPath);
   const document = parseDocument(readFileSync(absoluteManifest, "utf8"), { uniqueKeys: true });
   ensure(document.errors.length === 0, document.errors[0]?.message || "candidate manifest 无法解析");
@@ -126,10 +112,18 @@ export function inspectMaintenanceCandidate({ manifestPath }) {
   ensure(manifest.storage === "packed-stream", "只支持 packed-stream candidate");
   const candidateDir = path.dirname(absoluteManifest);
   ensure(JSON.stringify(readdirSync(candidateDir).sort()) === JSON.stringify([...CANDIDATE_FILES].sort()), `packed candidate 目录必须恰好包含 ${CANDIDATE_FILES.join("、")}`);
-  const root = path.resolve(path.dirname(absoluteManifest), ...Array(manifest.candidate_snapshot_ref.split("/").length - 1).fill(".."));
-  ensure(path.resolve(root, manifest.candidate_snapshot_ref) === absoluteManifest, "candidate_snapshot_ref 未绑定当前 manifest");
-  const streamPath = path.resolve(root, manifest.snapshot_stream_ref);
-  const diffPath = path.resolve(root, manifest.tracked_diff_ref);
+  ensure([1, 2].includes(manifest.schema_version), 'candidate manifest schema 不支持');
+  const external = manifest.schema_version === 2;
+  if (external) {
+    ensure(Array.isArray(manifest.excluded_paths) && manifest.excluded_paths.length === 0, 'v2 候选不允许旧档案排除白名单');
+    ensure(manifest.reference_base === 'bundle', 'candidate reference_base 必须为 bundle');
+    ensure(manifest.workspace_id === resolveMaintenanceLocation({ root: repositoryRoot }).workspaceId, '候选不属于当前工作区');
+    ensure(resolveMaintenanceReference(manifest.candidate_snapshot_ref, { root: repositoryRoot }) === absoluteManifest, 'candidate_snapshot_ref 未绑定当前 manifest');
+  }
+  const root = external ? candidateDir : path.resolve(candidateDir, ...Array(manifest.candidate_snapshot_ref.split('/').length - 1).fill('..'));
+  if (!external) ensure(path.resolve(root, manifest.candidate_snapshot_ref) === absoluteManifest, 'candidate_snapshot_ref 未绑定当前 manifest');
+  const streamPath = external ? resolveMaintenanceBundleFile(candidateDir, manifest.snapshot_stream_ref) : path.resolve(root, manifest.snapshot_stream_ref);
+  const diffPath = external ? resolveMaintenanceBundleFile(candidateDir, manifest.tracked_diff_ref) : path.resolve(root, manifest.tracked_diff_ref);
   ensure(streamPath === path.join(candidateDir, "candidate.bin") && diffPath === path.join(candidateDir, "tracked.diff"), "packed candidate 引用必须绑定同目录规范文件");
   const stream = readFileSync(streamPath);
   ensure(createHash("sha256").update(stream).digest("hex") === manifest.candidate_digest.replace(/^sha256:/, ""), "candidate_digest 与 packed stream 不一致");