create-yss-spec 3.5.6 → 3.5.9

package/template/scripts/lib/skill-registry.mjs

@@ -254,12 +254,12 @@ function validateFindingDisposition(disposition) {
   if (disposition.intensity["product-slice"] !== "slice-contract") fail("产品切片审查强度必须绑定 slice-contract");
   if (disposition.intensity["template-maintenance"] !== "L1-L2-L3") fail("模板维护审查强度必须绑定 L1-L2-L3");
   if (disposition.reviewer_write_implementation !== "forbidden") fail("审查者不得写实现");
-  const repair = disposition.repair_then_full_rereview;
-  requireObject(repair, "finding_disposition.repair_then_full_rereview");
-  requireStringSet(repair.kinds, ["violation", "machine_check_failure", "blank_applicable_row", "missing_evidence"], "finding_disposition.repair_then_full_rereview.kinds");
+  const repair = disposition.repair_then_targeted_rereview;
+  requireObject(repair, "finding_disposition.repair_then_targeted_rereview");
+  requireStringSet(repair.kinds, ["violation", "machine_check_failure", "blank_applicable_row", "missing_evidence"], "finding_disposition.repair_then_targeted_rereview.kinds");
   if (repair.actor !== "implementer") fail("violation 类 finding 必须由实现者修复");
   if (repair.on_original_contract !== true) fail("violation 类 finding 必须在原合同允许路径内修复");
-  if (repair.then !== "recapture_candidate_and_rerun_all_axes") fail("修复后必须重新捕获候选并全轴复审");
+  if (repair.then !== "compare_diff_map_affected_conclusions_behavior_dependencies_rereview_and_rebind") fail("修复后必须分析差异并定向复审受影响结论、行为及依赖，重绑当前候选");
   const stale = disposition.stale_and_reroute;
   requireObject(stale, "finding_disposition.stale_and_reroute");
   requireStringSet(stale.kinds, ["drift", "new_impacts", "required_skills_mismatch"], "finding_disposition.stale_and_reroute.kinds");

package/template/scripts/lib/strategic-handoff.mjs

@@ -8,6 +8,7 @@ import { ensure, canonical, digest, hash, json, parse, read, safe, relative, fil
 import { parseContextSource, parseContextContract, resolveContextTermRefs } from './context-contract.mjs';
 import { countersignRuleForGate } from './digital-human-roles.mjs';
 import { validateApprovalRecord } from './approval-record.mjs';
+import {approvalExpectationForBoundAsset} from './approval-consumption.mjs';
 import { treeDigest } from './strategic-handoff-io.mjs';
 import { uiBaselineKind, uiBaselineRef, uiBaselineCaseIds, hasConsumerRoutes, validateHandoffUiBaseline } from './ui-baseline.mjs';
 import { extractTraceability, compareIndexes } from './strategic-handoff-rules.mjs';
@@ -84,8 +85,18 @@ function validateConsumerRoutes(handoff, stage) {
   }
 }
 
-export async function sourceApproval(record, roles, root) {
-  const options={rolesDoc:roles,requireApproved:true,root,read:ref=>readFileSync(safe(root,path.relative(root,ref).split(path.sep).join('/')))};
+export async function sourceApproval(record, roles, root, currentAssetBinding) {
+  const sourceGateIds = [...(roles.gate_policy.biological_human || []), ...(roles.gate_policy.product_digital_human_with_biological_veto || []), ...['dual_digital_human','digital_human_review','check_reviews'].flatMap(key => (roles.gate_policy[key] || []).map(row => row.gate))];
+  const options={rolesDoc:roles,registry:{gates:sourceGateIds.map(id=>({id})),id_policy:{deprecated_ids:[]}},requireApproved:true,root,read:ref=>readFileSync(safe(root,path.relative(root,ref).split(path.sep).join('/')))};
+  if(record.schema_version===2) {
+    // v2 tasks consume the unchanged source policies, never receiver normalization.
+    options.rolesDoc=read(safe(root,'.template-spec/agents/digital-human-roles.yaml'));
+    options.registry=read(safe(root,'.template-spec/process/lifecycle-registry.yaml'));
+    options.skillRegistry=read(safe(root,'.template-spec/agents/yss-skill-registry.yaml'));
+    const task=read(safe(root,record.review_task_ref));
+    for(const ref of ['.template-spec/process/lifecycle-registry.yaml','.template-spec/agents/yss-skill-registry.yaml']) ensure(task.review_context?.basis?.some(row=>row.ref===ref && row.digest===hash(readFileSync(safe(root,ref))).slice(7)), '源正式审查任务未冻结实际注册表: '+ref);
+    roles=options.rolesDoc;
+  }
   if (roles.user_decision_policy.gates.includes(record.gate_id)) {
     ensure(existsSync(path.join(ROOT,'scripts/lib/user-decision.mjs')), '接收工具不支持源用户决定策略，请升级工具后验包');
     const { assertApprovalUserDecision } = await import('./user-decision-reuse.mjs');
@@ -93,7 +104,7 @@ export async function sourceApproval(record, roles, root) {
   }
   // Older dedicated receivers retain their own lifecycle policy. Normalize only
   // this already-verified source approval, without granting local capabilities.
-  if (record.continuation_ref) {
+  if (record.continuation_ref && record.schema_version===1) {
     ensure(roles.user_decision_policy.gates.includes(record.gate_id), '未登记的源延续批准边界');
     const reviewers = roles.gate_policy.continuation_reviews?.[record.gate_id];
     ensure(reviewers?.includes(record.role_id) && record.drafter_principal_ref && record.drafter_principal_ref !== record.principal_ref, '源授权延续缺少独立审查身份');
@@ -102,7 +113,8 @@ export async function sourceApproval(record, roles, root) {
     policy.dual_digital_human = (policy.dual_digital_human || []).filter(x => x.gate !== record.gate_id);
     policy.digital_human_review = [...(policy.digital_human_review || []).filter(x => x.gate !== record.gate_id), { gate: record.gate_id, countersigners: reviewers }];
   }
-  validateApprovalRecord(record,options);
+  if(!currentAssetBinding)throw new TypeError('APPROVAL_CONTEXT_REQUIRED: 源批准消费需要当前资产引用');
+  validateApprovalRecord(record,{...options,expected:approvalExpectationForBoundAsset(record.gate_id,currentAssetBinding,options)});
 }
 
 function snapshot(snapshot, source) {
@@ -188,7 +200,7 @@ export async function inspectSource(root, handoffRef) {
   const sourceRoles=read(safe(root,'.template-spec/agents/digital-human-roles.yaml'));
   const roles=sourceApprovalPolicy(sourceRoles);
   for (const [artifact, version, gateId] of [[strategy,strategy.domain_version,'check.domain-strategy-approved'],[stage,stage.package_version,'check.stage-decision-package-approved']]) {
-    if(artifact.approval) { const record=sourceApprovalRecord(read(safe(root,artifact.approval.approval_ref)),gateId);await sourceApproval(record,roles,root);ensure(artifact.approval.current_version===version,'资产内置批准版本过期'); }
+    if(artifact.approval) { const record=sourceApprovalRecord(read(safe(root,artifact.approval.approval_ref)),gateId);await sourceApproval(record,roles,root,{ref:artifact.approval.persisted_ref,approval_context:artifact.approval.approval_context});ensure(artifact.approval.current_version===version,'资产内置批准版本过期'); }
   }
   // Source packages retain their published approval vocabulary. Never promote old approvals into current checkpoint gates.
   const currentPlan = (roles.gate_policy.dual_digital_human || []).some(rule => rule.gate === 'gate.plan-approved');
@@ -207,7 +219,7 @@ export async function inspectSource(root, handoffRef) {
     ensure(business.spec.ref===specBinding.persisted_ref&&business.spec.version===specBinding.version&&business.spec.digest===hash(readFileSync(safe(root,specBinding.persisted_ref))),'业务集合未绑定当前交接 Spec');
   }
   expectedGates.existing_ui_baseline_ref=expectedGates.prototype_ref;
-  const bindings={...handoff.source,handoff:{id:handoff.handoff_id,version:handoff.handoff_version,persisted_ref:handoffRef,status:'approved'}};
+  const bindings={...handoff.source,handoff:{id:handoff.handoff_id,version:handoff.handoff_version,persisted_ref:handoffRef,status:'approved',approval_context:config.approvals.handoff?.approval_context}};
   const businessProofRefs=[];
   for(const [key,ref] of Object.entries(bindings)) {
     const approval=config.approvals[key];
@@ -224,8 +236,8 @@ export async function inspectSource(root, handoffRef) {
     } else actual=bytesDigest(readFileSync(safe(root,ref.persisted_ref)),approval.digest_kind);
     if(key!=='handoff')ensure(ref.digest===actual,`源资产摘要过期: ${key}`);
     const record=sourceApprovalRecord(read(safe(root,approval.record_ref)),approval.gate_id);
-    if(key==='existing_ui_baseline_ref')ensure(record.subject_ref===`${ref.persisted_ref}/${ref.manifest_ref}`,'既有 UI 用户决定必须以当前 manifest 为批准主体');
-    await sourceApproval(record,roles,root);
+    if(key==='existing_ui_baseline_ref')ensure(record.subject_ref===(ref.approval_context?.subject_ref || `${ref.persisted_ref}/${ref.manifest_ref}`),'既有 UI 用户决定必须绑定当前 manifest 的独立批准上下文');
+    await sourceApproval(record,roles,root,{ref:['visual_baseline_ref','existing_ui_baseline_ref'].includes(key)?`${ref.persisted_ref}/${ref.manifest_ref}`:ref.persisted_ref,approval_context:ref.approval_context});
     businessProofRefs.push(approval.record_ref,record.user_decision_ref,record.continuation_ref,record.decision_reuse_ref);
     ensure(record.gate_id===approval.gate_id,`批准门禁不匹配: ${key}`);
     ensure((record.artifact_bindings || []).some(x=>x.id===(ref.id||ref.baseline_id) && x.version===ref.version && x.digest===actual),`批准记录未绑定当前资产: ${key}`);
@@ -264,8 +276,9 @@ function collect(root, handoffRef, handoff, config) {
   const symbolic=config.reference_map || {};
   const enqueue=ref=> { if(symbolic[ref])queue.push(symbolic[ref]); else if(/^https?:\/\//i.test(ref))return; else if(ref.startsWith('evidence.'))throw new TypeError(`未解析 evidence ID: ${ref}`); else if(ref.includes('/') || /\.(?:md|yaml|json|html|png|txt|log)$/.test(ref))queue.push(ref); };
   function refs(value,key='') {
+    if(value?.schema_version===2 && value.review_task_ref) queue.push('.template-spec/process/lifecycle-registry.yaml','.template-spec/agents/yss-skill-registry.yaml');
     if(Array.isArray(value)) { if(key==='evidence_refs') value.forEach(enqueue); else value.forEach(v=>refs(v,key)); }
-    else if(value && typeof value==='object') for(const [k,v]of Object.entries(value)) { if(['approval_ref','persisted_ref','user_decision_ref','decision_reuse_ref','continuation_ref','plan_continuation_ref','scope_ref','subject_ref','delivery_ref','review_ref'].includes(k)&&typeof v==='string')enqueue(v); else if(k==='ref'&&typeof v==='string'&&!/^[a-z]+:\/\//i.test(v))enqueue(v); else refs(v,k); }
+    else if(value && typeof value==='object') for(const [k,v]of Object.entries(value)) { if(['review_task_ref','policy_ref','candidate_ref','registry_ref','approval_ref','persisted_ref','user_decision_ref','decision_reuse_ref','continuation_ref','plan_continuation_ref','scope_ref','subject_ref','delivery_ref','review_ref'].includes(k)&&typeof v==='string')enqueue(v); else if(k==='ref'&&typeof v==='string'&&!/^[a-z]+:\/\//i.test(v))enqueue(v); else refs(v,k); }
   }
   let totalBytes = 0;
   while(queue.length) {

package/template/scripts/lib/task-package.mjs

@@ -1,3 +1,4 @@
+import { compileWorkUnitReviewCapabilities, compileReviewCapabilities, validateReviewTaskBinding } from './review-capabilities.mjs';
 import { validateReadOnlyIntake } from './read-only-intake.mjs';
 import { parseAsset } from './structured-assets.mjs';
 import { assertAssetTransactionIdle } from './asset-transactions.mjs';
@@ -6,6 +7,7 @@ import { normalizeSliceContract } from './slice-contract.mjs';
 import { assertSliceV3TaskPackage } from './slice-task-package.mjs';
 export { compileSliceTaskPackage, assertSliceV3TaskPackage } from './slice-task-package.mjs';
 import { existsSync, readFileSync } from "node:fs";
+import { resolveMaintenanceOutput, resolveMaintenanceReference } from "./maintenance-storage.mjs";
 import path from "node:path";
 import { parseDocument } from "../vendor/yaml.mjs";
 import { loadDigitalHumanRoles, taskPackageDefaults } from "./digital-human-roles.mjs";
@@ -39,8 +41,12 @@ function parseYaml(source, label) {
   return document.toJS({ maxAliasCount: 0 });
 }
 
-function assertSafeRelativePath(value, field) {
+function assertSafeRelativePath(value, field, { maintenance = false } = {}) {
   requireString(value, field);
+  if (value.startsWith("maintenance:")) {
+    if (!maintenance) fail("maintenance 引用仅适用于 template-maintenance 合同");
+    return resolveMaintenanceOutput(value, { root: ROOT });
+  }
   if (path.isAbsolute(value)) fail(`${field} 必须是仓库相对路径`);
   const resolved = path.resolve(ROOT, value);
   const relative = path.relative(ROOT, resolved);
@@ -48,8 +54,13 @@ function assertSafeRelativePath(value, field) {
   return resolved;
 }
 
-function assertReadableEvidenceRef(value, field) {
+function assertReadableEvidenceRef(value, field, { maintenance = false, digest } = {}) {
   requireString(value, field);
+  if (value.startsWith("maintenance:")) {
+    if (!maintenance) fail("maintenance 引用仅适用于 template-maintenance 合同");
+    resolveMaintenanceReference(value, { root: ROOT, digest });
+    return;
+  }
   if (/^https?:\/\//.test(value)) return;
   const evidencePath = assertSafeRelativePath(value, field);
   if (!existsSync(evidencePath)) fail(`${field} 不可读: ${value}`);
@@ -69,9 +80,18 @@ function validateSkillSource(value, registry) {
   if (value.skill_source.defaults_ref !== `taskPackageDefaults(${value.role_id})`) fail(`skill_source.defaults_ref 必须为 taskPackageDefaults(${value.role_id})`);
   if (!equalArrays(value.skill_source.core_skills, defaults.core_skills)) fail("skill_source.core_skills 必须与角色注册表完全一致");
   if (!equalArrays(value.skill_source.forbidden_skills, defaults.forbidden_skills)) fail("skill_source.forbidden_skills 必须与角色注册表完全一致");
+  if (value.skill_source.review_skills !== undefined || value.review_context?.capability_ids) {
+    const compiled = value.review_context?.capability_ids
+      ? compileReviewCapabilities({ checkIds:value.review_context.check_ids,roleId:value.role_id,executionState:value.execution_state,rolesDoc:registry })
+      : compileWorkUnitReviewCapabilities({workUnitId:value.work_unit_id,roleId:value.role_id,executionState:value.execution_state,rolesDoc:registry});
+    if (!equalArrays(value.skill_source.review_skills, compiled.review_skills)) fail("skill_source.review_skills 必须由权威能力政策编译");
+  }
 }
 
 function validateCommon(value, registry, lifecycle) {
+  const maintenance = value.contract.kind === "template-maintenance";
+  const safe = (ref, field) => assertSafeRelativePath(ref, field, { maintenance });
+  const readable = (ref, field, digest) => assertReadableEvidenceRef(ref, field, { maintenance, digest });
   if (value.allowed_write_paths?.length && value.contract.kind === "lifecycle-work-unit") assertTrackingEntry(value.work_unit_id, value, { root: ROOT });
   if (value.work_unit_id === 'work-unit.spec-synthesis') assertPlanSpecEntry(value);
   const workUnit = lifecycle.work_units.find((item) => item.id === value.work_unit_id);
@@ -83,15 +103,20 @@ function validateCommon(value, registry, lifecycle) {
   if (!WORKFLOW_STATUSES.has(value.workflow_status)) fail(`workflow_status 无效: ${value.workflow_status}`);
   if (value.stage_id) {
     if (!lifecycle.stages.some((stage) => stage.id === value.stage_id)) fail(`未知 stage_id: ${value.stage_id}`);
-    if (!roleDefaults.stages.includes(value.stage_id)) fail(`role_id 未覆盖 stage_id: ${value.role_id} -> ${value.stage_id}`);
+    const reviewStages = value.review_context?.capability_ids
+      ? compileReviewCapabilities({ checkIds: value.review_context.check_ids, roleId: value.role_id, executionState: value.execution_state, rolesDoc: registry, registry: lifecycle }).review_stages
+      : roleDefaults.stages;
+    if (!reviewStages.includes(value.stage_id)) fail(`role_id 未覆盖 stage_id: ${value.role_id} -> ${value.stage_id}`);
   }
   validateSkillSource(value, registry);
-  for (const allowed of value.allowed_write_paths) assertSafeRelativePath(allowed, "allowed_write_paths 条目");
+  if (value.review_context?.capability_ids) validateReviewTaskBinding(value, { rolesDoc: registry, registry: lifecycle, root: ROOT });
+  for (const allowed of value.allowed_write_paths) safe(allowed, "allowed_write_paths 条目");
   if (value.execution_state === "Reviewer" && value.review_context.implementation_actor_id === value.actor_id) fail("Reviewer 必须与实现者使用不同 actor_id");
   const commands = new Set(value.verification_commands);
   for (const result of value.verification_results) {
     if (!commands.has(result.command)) fail(`verification_results 命令未声明: ${result.command}`);
-    assertReadableEvidenceRef(result.evidence_ref, "verification_results.evidence_ref");
+    if (result.evidence_ref.startsWith('maintenance:') && !result.evidence_digest) fail('仓外维护证据必须绑定 evidence_digest');
+    readable(result.evidence_ref, "verification_results.evidence_ref", result.evidence_digest);
   }
   const completed = value.workflow_status === "resolved" || value.result?.result === "completed";
   if (completed) {
@@ -105,12 +130,12 @@ function validateCommon(value, registry, lifecycle) {
     const reconciliation = value.result.context_reconciliation;
     const expectedReconciliationStatus = value.contract.kind === "template-maintenance" ? "not-applicable" : "reconciled";
     if (reconciliation?.status !== expectedReconciliationStatus) fail(`result=completed 时 context_reconciliation.status 必须为 ${expectedReconciliationStatus}`);
-    assertReadableEvidenceRef(reconciliation.ref, "context_reconciliation.ref");
+    readable(reconciliation.ref, "context_reconciliation.ref");
     if (!value.result.evidence_refs.includes(reconciliation.ref)) fail("context_reconciliation.ref 必须包含在 result.evidence_refs 中");
     if (expectedReconciliationStatus === "not-applicable" && !reconciliation.reason) fail("template-maintenance 的 context_reconciliation 必须说明 reason");
     const routeResult = validateNextRoute(value.result.work_unit, value.result.next_route, value.result);
     if (routeResult.result !== "allowed") fail(`Workflow Execution Result next_route 非法: ${routeResult.blocking_signals.join(", ")}`);
-    value.expected_evidence_files.forEach((ref) => assertReadableEvidenceRef(ref, "expected_evidence_files"));
+    value.expected_evidence_files.forEach((ref) => readable(ref, "expected_evidence_files"));
     if (value.verification_results.length === 0) fail("已完成任务必须包含 verification_results");
     if (value.verification_results.some((result) => result.exit_code !== 0)) fail("已完成任务的验证命令必须全部成功");
     const resultCommands = new Set(value.verification_results.map((result) => result.command));
@@ -122,13 +147,13 @@ function validateCommon(value, registry, lifecycle) {
     }
     if (value.result.result === "completed") {
       if (!Array.isArray(value.result.evidence_refs) || value.result.evidence_refs.length === 0) fail("result=completed 时 evidence_refs 不能为空");
-      value.result.evidence_refs.forEach((ref) => assertReadableEvidenceRef(ref, "result.evidence_refs"));
+      value.result.evidence_refs.forEach((ref) => readable(ref, "result.evidence_refs"));
     }
     if (Array.isArray(value.result.changed_files)) {
       for (const changed of value.result.changed_files) {
-        const changedPath = assertSafeRelativePath(changed, "changed_files 条目");
+        const changedPath = safe(changed, "changed_files 条目");
         if (!value.allowed_write_paths.some((allowed) => {
-          const allowedPath = assertSafeRelativePath(allowed, "allowed_write_paths 条目");
+          const allowedPath = safe(allowed, "allowed_write_paths 条目");
           const relative = path.relative(allowedPath, changedPath);
           return relative === "" || (relative !== ".." && !relative.startsWith(`..${path.sep}`));
         })) fail(`changed_files 超出 allowed_write_paths: ${changed}`);
@@ -145,7 +170,7 @@ function validateContract(value, registry, lifecycle, { history = false } = {})
   if (!CONTRACT_KINDS.has(contract.kind)) fail(`未知 contract.kind: ${contract.kind}`);
   if (!new Set(["issued", "stale", "blocked"]).has(contract.status)) fail(`contract.status 无效: ${contract.status}`);
   if (contract.status === "stale" && value.workflow_status !== "paused") fail("stale 任务包必须暂停，待主控重新路由");
-  assertReadableEvidenceRef(contract.contract_ref, "contract.contract_ref");
+  assertReadableEvidenceRef(contract.contract_ref, "contract.contract_ref", { maintenance: contract.kind === "template-maintenance" });
   if (contract.kind === "lifecycle-work-unit") {
     if (value.work_unit_id === implementationWorkUnit || value.convergence.parent_work_unit === implementationWorkUnit) {
       fail("lifecycle-work-unit 不得冒充垂直切片实现任务；实现任务必须使用 slice-implementation");
@@ -158,9 +183,9 @@ function validateContract(value, registry, lifecycle, { history = false } = {})
   if (contract.kind === "template-maintenance") {
     if (!maintenanceValidators) fail("project-instance 不支持 template-maintenance 任务包");
     if (contract.slice_contract_ref || contract.lifecycle_ref) fail("template-maintenance 不得携带其他合同引用");
-    const checkpointPath = assertSafeRelativePath(contract.maintenance_ref, "contract.maintenance_ref");
+    const checkpointPath = assertSafeRelativePath(contract.maintenance_ref, "contract.maintenance_ref", { maintenance: true });
     if (!existsSync(checkpointPath)) fail(`维护 checkpoint 不存在: ${contract.maintenance_ref}`);
-    const checkpoint = maintenanceValidators.loadMaintenanceCheckpoint(contract.maintenance_ref);
+    const checkpoint = maintenanceValidators.loadMaintenanceCheckpoint(checkpointPath);
     maintenanceValidators.validateMaintenanceCheckpoint(checkpoint, {
       history,
       allowPendingReview: value.execution_state === "Reviewer" && value.workflow_status !== "resolved"
@@ -174,7 +199,7 @@ function validateContract(value, registry, lifecycle, { history = false } = {})
       if (contract.candidate_digest !== checkpoint.candidate_digest) fail("Reviewer 任务包 candidate_digest 与 checkpoint 不一致");
       if (contract.review_round !== checkpoint.review_round) fail("Reviewer 任务包 review_round 与 checkpoint 不一致");
       if (!value.allowed_read_paths.includes(contract.maintenance_ref)) fail("allowed_read_paths 必须包含 maintenance_ref");
-      value.allowed_read_paths.forEach((ref) => assertReadableEvidenceRef(ref, "allowed_read_paths 条目"));
+      value.allowed_read_paths.forEach((ref) => assertReadableEvidenceRef(ref, "allowed_read_paths 条目", { maintenance: true }));
       contract.applicable_rule_refs.forEach((ref) => assertReadableEvidenceRef(ref, "applicable_rule_refs 条目"));
     }
     if (lifecycle.work_units.find((item) => item.id === value.work_unit_id)?.scope !== "template-source") fail("template-maintenance 必须绑定 template-source work unit");
@@ -239,7 +264,12 @@ export function validateHistoricalMaintenanceTaskPackage(value) {
 }
 
 export function generateTaskPackageDefaults(roleId, overrides = {}, { rolesDoc } = {}) {
-  const defaults = taskPackageDefaults(roleId, rolesDoc || loadDigitalHumanRoles());
+  const registry = rolesDoc || loadDigitalHumanRoles();
+  const defaults = taskPackageDefaults(roleId, registry);
+  const review = overrides.review_context?.capability_ids
+    ? compileReviewCapabilities({ checkIds: overrides.review_context.check_ids, roleId, executionState: overrides.execution_state, rolesDoc: registry })
+    : ["Reviewer","Verifier"].includes(overrides.execution_state) && registry.gate_policy.digital_human_review_work_units?.some(row=>row.work_unit===overrides.work_unit_id)
+      ? compileWorkUnitReviewCapabilities({workUnitId:overrides.work_unit_id,roleId,executionState:overrides.execution_state,rolesDoc:registry}) : null;
   return {
     schema_version: 1,
     role_id: defaults.role_id,
@@ -247,7 +277,8 @@ export function generateTaskPackageDefaults(roleId, overrides = {}, { rolesDoc }
       registry_ref: TASK_PACKAGE_REGISTRY_REF,
       defaults_ref: `taskPackageDefaults(${roleId})`,
       core_skills: defaults.core_skills,
-      forbidden_skills: defaults.forbidden_skills
+      forbidden_skills: defaults.forbidden_skills,
+      ...(review ? { review_skills: review.review_skills } : {})
     },
     ...overrides
   };

package/template/scripts/lifecycle-status

@@ -5,8 +5,10 @@ import { checkProjectGovernance } from './lib/project-governance.mjs';
 import { lifecycleStatus } from './lib/lifecycle-status.mjs';
 import { renderLifecycleStatus } from './lib/lifecycle-presentation.mjs';
 
+let parsedValues;
 try {
   const { values } = parseArgs({ strict: true, options: { root: { type: 'string' }, checkpoint: { type: 'string' }, task: {type: 'string'}, preflight: {type:'boolean'}, help:{type:'boolean'}, format: {type:'string', default:'json'} } });
+  parsedValues = values;
   if (!['json', 'text'].includes(values.format)) throw Error('--format 仅支持 json 或 text');
   if (values.preflight && values.format === 'text') throw Error('--preflight 使用 JSON 诊断；中文状态阅读请单独调用 --format text');
   if(values.help)process.stdout.write('用法: scripts/lifecycle-status --root <项目> [--checkpoint <根相对路径>] [--task <任务包>] [--preflight] [--format json|text]\n普通查询不执行预检；--preflight 复验当前证据，仅提供恢复动作，不批准或派发。普通查询退出码保持 0/1；预检 0=通过、1=失败、2=输入或能力异常。\n');
@@ -20,7 +22,30 @@ try {
   if (result.blockers.length) process.exitCode = 1;
   }
 } catch (error) {
-  process.stdout.write(`${JSON.stringify({ schema_version: 1, read_only: true, blockers: [error.message], owner: '未登记', next_action: `核查状态输入：${error.message}`, execution_authorization: 'not-evaluated', verification_scope: [{ id: 'status-input', status: 'failed', refs: [], reason: error.message }], diagnostics: [{ code: 'status-input-invalid', severity: 'error', message: error.message, source_ref: null, owner: '未登记', recovery: '修复输入后重新读取状态' }], next_step: { action_type: 'repair', command: null, input_refs: [], prerequisites: ['提供有效项目根和 checkpoint 引用'] } }, null, 2)}\n`);
+  const failure = { schema_version: 1, read_only: true, blockers: [error.message], owner: '未登记', next_action: `核查状态输入：${error.message}`, execution_authorization: 'not-evaluated', verification_scope: [{ id: 'status-input', status: 'failed', refs: [], reason: error.message }], diagnostics: [{ code: 'status-input-invalid', severity: 'error', message: error.message, source_ref: null, owner: '未登记', recovery: '修复输入后重新读取状态' }], next_step: { action_type: 'repair', command: null, input_refs: [], prerequisites: ['提供有效项目根和 checkpoint 引用'] } };
+  if (parsedValues?.format === 'text' && !parsedValues.preflight) {
+    const sourceRef = error.lifecycle_input_ref ?? parsedValues.checkpoint ?? null;
+    const templateSource = error.lifecycle_input_kind === 'template-source';
+    const manifestFailure = error.lifecycle_input_kind === 'manifest' || sourceRef === 'yss-project.yaml';
+    const missingInput = error.message === 'root and checkpoint are required';
+    const problem = templateSource ? '当前为 template-source 模板源仓库，产品生命周期状态查询不适用'
+      : manifestFailure ? `仓库身份输入无法核验：${error.message}`
+      : missingInput ? '缺少项目根或 checkpoint 引用，当前阶段无法核验'
+      : `状态输入无法核验：${error.message}`;
+    const recovery = templateSource ? '按 maintaining-skills 和维护强度合同走模板维护路由；不得更改真实仓库身份以绕过限制'
+      : manifestFailure ? '先核对 yss-project.yaml 的真实内容、schema 和 repository_mode；文件缺失、损坏或不支持时进入迁移检查，不猜测或伪造身份'
+      : missingInput ? '提供真实项目根及根相对 checkpoint 引用；核对来源后重新查询'
+      : '核对已标明的状态来源、路径和原始内容，恢复可读的真实输入并执行适用预检，再重新查询';
+    process.stdout.write(renderLifecycleStatus({presentation: {
+      stage: '待核验', checkpoint_status: '查询失败', next_stage: '待核验', next_stage_reason: '当前输入不可核验，不推断下一阶段、已完成或可进入',
+      blockers: [problem], owner: '未登记', work_unit: '待核验', expected_output: null, next_action: recovery, warnings: [],
+      issues: [{severity: 'error', message: problem, source_ref: sourceRef, owner: '未登记', owner_scope: 'not-recorded', recovery}],
+      pending_verification: [{reason: '仓库身份、当前阶段、来源和问题责任方尚未核验'}],
+      continue_conditions: ['真实身份与状态输入可读，并通过适用预检后，由主控重新核验范围与授权并决定路由'],
+    }}));
+  } else {
+    process.stdout.write(`${JSON.stringify(failure, null, 2)}\n`);
+  }
   process.exitCode = process.argv.includes('--preflight') ? 2 : 1;
 }
 

package/template/scripts/maintenance-path

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { resolveMaintenanceOutput } from './lib/maintenance-storage.mjs';
+import { ROOT } from './lib/template-verification.mjs';
+try {
+  const [relative] = process.argv.slice(2);
+  if (!relative) throw new TypeError('用法: scripts/maintenance-path <类别/运行ID/文件>');
+  process.stdout.write(resolveMaintenanceOutput(`maintenance:${relative}`, { root: ROOT }) + '\n');
+} catch (error) {
+  process.stderr.write(`维护路径错误: ${error.message}\n`);
+  process.exitCode = 1;
+}

package/template/scripts/prepare-review-package

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import { parseArgs } from 'node:util';
+import { prepareReviewPackage } from './lib/review-package.mjs';
+try {
+  const { values } = parseArgs({ options: { root: { type: 'string' }, checkpoint: { type: 'string' }, check: { type: 'string', multiple: true }, role: { type: 'string' }, runtime: { type: 'string', default: 'runtime.generic' }, actor: { type: 'string' }, 'reviewer-principal': { type: 'string' }, 'drafter-principal': { type: 'string' }, 'implementation-actor': { type: 'string' }, 'task-id': { type: 'string' }, 'review-session': { type: 'string' }, 'work-unit': { type: 'string' }, 'output-dir': { type: 'string' }, 'previous-subject': { type: 'string' } }, strict: true });
+  const result = prepareReviewPackage({ root: values.root, checkpointRef: values.checkpoint, checkIds: values.check, roleId: values.role, runtimeId: values.runtime, actorId: values.actor, reviewerPrincipalRef: values['reviewer-principal'], drafterPrincipalRef: values['drafter-principal'], implementationActorId: values['implementation-actor'], taskId: values['task-id'], reviewSessionId: values['review-session'], workUnitId: values['work-unit'], outputDir: values['output-dir'], previousSubjectRef: values['previous-subject'] });
+  process.stdout.write(JSON.stringify(result, null, 2) + '\n');
+} catch (error) { process.stderr.write(`审阅包草案生成失败: ${error.message}\n`); process.exitCode = 1; }

package/template/scripts/project-ci

@@ -4,16 +4,26 @@ import path from 'node:path';
 import { parseArgs } from 'node:util';
 import { planProjectCi, applyProjectCi } from './lib/project-ci-install.mjs';
 import { checkProjectGovernance } from './lib/project-governance.mjs';
+import { assertNodeVersion, beginRuntimeRun } from './lib/runtime-store.mjs';
 
 try {
-  const {values,positionals}=parseArgs({allowPositionals:true,options:{root:{type:'string',default:'.'},provider:{type:'string',default:'github'},branch:{type:'string'},plan:{type:'string'},'additional-path':{type:'string',multiple:true},base:{type:'string'},recover:{type:'boolean'},json:{type:'boolean'},help:{type:'boolean'}}});
-  if(values.help){process.stdout.write('用法: scripts/project-ci plan --provider github --root <项目> [--branch main] [--additional-path <根相对路径>]\n      scripts/project-ci apply --root <项目> --plan <plan.json>\n      scripts/project-ci apply --root <项目> --recover\n      scripts/project-ci check --root <项目> [--base <40位commit>] --json\nplan/check 只读，apply 仅显式管理自身工作流；不改远端或批准。退出码 0=通过/计划完成，1=检查失败/冲突，2=输入/能力/执行异常。\n');}
+  const {values,positionals}=parseArgs({allowPositionals:true,options:{root:{type:'string',default:'.'},provider:{type:'string',default:'github'},branch:{type:'string'},plan:{type:'string'},'additional-path':{type:'string',multiple:true},base:{type:'string'},recover:{type:'boolean'},json:{type:'boolean'},help:{type:'boolean'},'runtime-store':{type:'string',default:'off'}}});
+  if(values.help){process.stdout.write('用法: scripts/project-ci plan --provider github --root <项目> [--branch main] [--additional-path <根相对路径>]\n      scripts/project-ci apply --root <项目> --plan <plan.json>\n      scripts/project-ci apply --root <项目> --recover\n      scripts/project-ci check --root <项目> [--base <40位commit>] [--runtime-store sqlite|off] --json\nplan/check 只读，apply 仅显式管理自身工作流；不改远端或批准。退出码 0=通过/计划完成，1=检查失败/冲突，2=输入/能力/执行异常。\n');}
   else {
     if(positionals.length!==1||!['plan','apply','check'].includes(positionals[0]))throw new Error('需要 plan、apply 或 check；参见 --help');
+    assertNodeVersion();
+    if(!['sqlite','off'].includes(values['runtime-store']))throw new Error('runtime-store 必须为 sqlite 或 off');
     const root=path.resolve(values.root);let result;
     if(positionals[0]==='plan'){result=planProjectCi({root,provider:values.provider,branch:values.branch,additionalPaths:values['additional-path']});if(result.conflicts.length)process.exitCode=1;}
     if(positionals[0]==='apply'){if(!values.recover&&!values.plan)throw new Error('apply 需要 --plan');result=applyProjectCi({root,recover:values.recover,plan:values.plan?JSON.parse(fs.readFileSync(values.plan,'utf8')):undefined});}
-    if(positionals[0]==='check'){const check=checkProjectGovernance({root,base:values.base});result=check.report;process.exitCode=check.exitCode;}
+    if(positionals[0]==='check'){
+      const session=beginRuntimeRun({root,kind:'project-ci-check',mode:values['runtime-store'],input:{base:values.base||null}});
+      try {
+        const started=performance.now(),check=checkProjectGovernance({root,base:values.base});result=check.report;process.exitCode=check.exitCode;
+        if(session)try { session.recordCommand({command:'project-ci check',exit_code:check.exitCode,duration_ms:Math.round(performance.now()-started)});session.finish({status:check.exitCode===0?'passed':'failed',exitCode:check.exitCode,report:result}); }
+        catch(error){process.stderr.write(`运行存储异常，原检查退出码=${check.exitCode}: ${error.message}\n`);}
+      }finally{session?.close();}
+    }
     process.stdout.write(JSON.stringify(result,null,2)+'\n');
   }
 }catch(error){process.stdout.write(JSON.stringify({schema_version:1,status:'error',read_only:process.argv[2]!=='apply',error:error.message})+'\n');process.stderr.write(error.message+'\n');process.exitCode=error.exitCode||2;}

package/template/scripts/query-lifecycle-context

@@ -10,18 +10,25 @@ try {
       stage: { type: "string" },
       "work-unit": { type: "string" },
       include: { type: "string", multiple: true },
+      "check-skills": { type: "boolean" },
+      "agent-runtime": { type: "string" },
+      when: { type: "string", multiple: true },
     },
     strict: true,
   });
-  if(values.help)process.stdout.write('用法: scripts/query-lifecycle-context [--mode route] [--stage stage.plan] [--work-unit work-unit.plan-opportunity] [--include <资产>]\n只读查询，不证明批准；退出码 0=查询完成、1=输入或执行失败。\n');
+  if(values.help)process.stdout.write('用法: scripts/query-lifecycle-context [--mode route] [--stage stage.plan] [--work-unit work-unit.plan-opportunity] [--include <资产>] [--check-skills [--agent-runtime codex|cursor|pi] [--when <条件>]]\n只读查询，不证明批准；退出码 0=查询完成（启用技能预检时表示技能可用）、1=输入或执行失败、2=启用预检且技能未就绪。\n');
   else {
   const result = queryLifecycleContext({
     mode: values.mode,
     stageId: values.stage,
     workUnitId: values["work-unit"],
     include: values.include ?? [],
+    checkSkills: values["check-skills"] ?? false,
+    agentRuntime: values["agent-runtime"],
+    when: values.when ?? [],
   });
   process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+  if (result.skill_readiness && result.skill_readiness.status !== 'ready') process.exitCode = 2;
   }
 } catch (error) {
   process.stderr.write(`${error.message}\n`);

package/template/scripts/run-read-only-intake

@@ -4,11 +4,11 @@ import { ROOT } from './lib/lifecycle-registry.mjs';
 import { loadTaskPackage, validateTaskPackage } from './lib/task-package.mjs';
 import { observeReadOnlyIntake } from './lib/read-only-intake.mjs';
 try {
-  const {values,positionals} = parseArgs({options:{task:{type:'string'},'run-dir':{type:'string'},'timeout-ms':{type:'string',default:'0'}},allowPositionals:true});
+  const {values,positionals} = parseArgs({options:{task:{type:'string'},'run-dir':{type:'string'},'timeout-ms':{type:'string',default:'0'},'runtime-store':{type:'string',default:'off'}},allowPositionals:true});
   if(!values.task||!values['run-dir'])throw Error('需要 --task 和仓库外新目录 --run-dir；命令放在 -- 之后');
   const {value}=loadTaskPackage(values.task);validateTaskPackage(value);
   if(value.schema_version!==2||value.workflow_status!=='active')throw Error('只接受 active 的只读 v2 任务');
-  const result=await observeReadOnlyIntake(value,{root:ROOT,runDir:values['run-dir'],command:positionals[0],args:positionals.slice(1),timeoutMs:Number(values['timeout-ms'])});
+  const result=await observeReadOnlyIntake(value,{root:ROOT,runDir:values['run-dir'],command:positionals[0],args:positionals.slice(1),timeoutMs:Number(values['timeout-ms']),runtimeStore:values['runtime-store']});
   validateTaskPackage(result,{runDir:values['run-dir']});
   process.stdout.write(JSON.stringify(result,null,2)+'\n');if(result.workflow_status!=='resolved')process.exitCode=1;
 }catch(error){process.stderr.write(error.message+'\n');process.exitCode=1;}

package/template/scripts/runtime-store

@@ -0,0 +1,40 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { parseArgs } from 'node:util';
+import { RuntimeStore, assertNodeVersion, inspectRuntimeBundle } from './lib/runtime-store.mjs';
+
+let store;
+try {
+  const { values, positionals } = parseArgs({ allowPositionals: true, options: {
+    root: { type: 'string', default: '.' }, home: { type: 'string' }, run: { type: 'string' },
+    output: { type: 'string' }, source: { type: 'string' }, plan: { type: 'string' },
+    now: { type: 'string' }, json: { type: 'boolean' }, help: { type: 'boolean' },
+    'protected-root': { type: 'string', multiple: true },
+  } });
+  assertNodeVersion();
+  if (values.help) process.stdout.write('用法: scripts/runtime-store <inspect|inventory|export|plan-gc|apply-gc|backup|restore> --root <项目> [--home <仓外绝对目录>]\nexport --run <id> --output <新目录>\nplan-gc [--now <ISO时间>] > <仓外plan.json>\napply-gc --plan <plan.json>\nbackup --output <新目录>\nrestore --source <备份目录>\n查询只读；清理仅执行显式计划；正式文件仍为权威。\n');
+  else {
+    const action = positionals[0];
+    if (positionals.length !== 1 || !['inspect', 'inventory', 'export', 'plan-gc', 'apply-gc', 'backup', 'restore'].includes(action)) throw new Error('需要有效管理动作；参见--help');
+    const options = { root: path.resolve(values.root), home: values.home, protectedRoots: values['protected-root'] };
+    let result;
+    if (action === 'inspect' && values.source) result = inspectRuntimeBundle(values.source);
+    else if (action === 'restore') {
+      if (!values.source) throw new Error('restore需要--source');
+      result = RuntimeStore.restore({ ...options, source: path.resolve(values.source) });
+    } else {
+      store = new RuntimeStore({ ...options, readOnly: ['inspect', 'inventory', 'plan-gc', 'backup'].includes(action), existingOnly: ['export', 'apply-gc'].includes(action) });
+      const now = values.now === undefined ? Date.now() : Date.parse(values.now);
+      if (!Number.isFinite(now)) throw new Error('--now时间非法');
+      if (action === 'inspect') result = store.inspect({ now });
+      if (action === 'inventory') result = store.inventory();
+      if (action === 'plan-gc') result = store.planGc({ now });
+      if (action === 'apply-gc') { if (!values.plan) throw new Error('apply-gc需要--plan'); result = store.applyGc(JSON.parse(fs.readFileSync(values.plan, 'utf8'))); }
+      if (action === 'export') { if (!values.run || !values.output) throw new Error('export需要--run和--output'); result = store.exportRun(values.run, values.output); }
+      if (action === 'backup') { if (!values.output) throw new Error('backup需要--output'); result = store.backup(values.output); }
+    }
+    process.stdout.write(JSON.stringify(result, null, 2) + '\n');
+  }
+} catch (error) { process.stderr.write(error.message + '\n'); process.exitCode = 2; }
+finally { store?.close(); }

package/template/scripts/verify-approval-record

@@ -1,17 +1,25 @@
 #!/usr/bin/env node
-import { parseArgs } from "node:util";
-import { validateApprovalRecordFile } from "./lib/approval-record.mjs";
-
+import path from 'node:path';
+import {parseArgs} from 'node:util';
+import {ROOT} from './lib/lifecycle-registry.mjs';
+import {withValidationPhase} from './lib/validation-phase.mjs';
+import {approvalIO} from './lib/approval-record-io.mjs';
+import {validateAssetStructure} from './lib/structured-assets.mjs';
+import {validateApprovalRecordFile} from './lib/approval-record.mjs';
 try {
-  const { positionals, values } = parseArgs({ allowPositionals: true, strict: true, options: { help: {type:"boolean"}, "require-approved": { type: "boolean" }, history: { type: "boolean" } } });
-  if(values.help)process.stdout.write("用法: scripts/verify-approval-record [--require-approved | --history] <record.yaml>\n默认当前校验；--history 只读历史结构，不放行。0=相应检查通过，1=失败。\n");
+  const {positionals,values}=parseArgs({allowPositionals:true,strict:true,options:{help:{type:'boolean'},'require-approved':{type:'boolean'},history:{type:'boolean'},checkpoint:{type:'string'},root:{type:'string'}}});
+  if(values.help) process.stdout.write('用法: scripts/verify-approval-record [--require-approved] [--root <project>] [--checkpoint <current checkpoint>] <record.yaml|json>\n--history 仅检查历史结构，不放行；不能与当前上下文选项组合。v1当前批准须有checkpoint；v2可使用正式任务的独立当前绑定。0=相应检查通过，1=失败。\n');
   else {
-  if (positionals.length !== 1) throw new TypeError("用法: scripts/verify-approval-record [--require-approved | --history] <approval-record.yaml>");
-  if (values.history && values["require-approved"]) throw new TypeError("--history 不能用于当前批准校验");
-  validateApprovalRecordFile(positionals[0], { requireApproved: !values.history });
-  process.stdout.write(!values.history ? "会签及当前用户决定校验通过\n" : "会签记录结构校验通过（不构成放行）\n");
+    if(positionals.length!==1) throw new TypeError('需要一个批准记录路径');
+    if(values.history&&(values['require-approved']||values.checkpoint)) throw new TypeError('--history 不能用于当前批准校验');
+    const root=path.resolve(values.root || ROOT), file=path.resolve(positionals[0]);
+    const verify=()=>{
+      let checkpoint;
+      if(values.checkpoint) {checkpoint=approvalIO({root}).document(path.resolve(values.checkpoint));validateAssetStructure(checkpoint,'checkpoint');}
+      validateApprovalRecordFile(file,{root,checkpoint,history:values.history===true,requireApproved:!values.history});
+    };
+    if(values.history) verify();
+    else withValidationPhase({root,purpose:'approval-cli-current',readOnly:true},verify);
+    process.stdout.write(values.history?'历史兼容结构检查完成；execution_authorization=not-evaluated\n':'会签当前绑定及适用用户决定校验通过；不授予执行或发布\n');
   }
-} catch (error) {
-  process.stderr.write(`会签记录校验失败: ${error.message}\n`);
-  process.exitCode = 1;
-}
+} catch(error) {process.stderr.write(`会签记录校验失败: ${error.message}\n`);process.exitCode=1;}

package/template/scripts/verify-lifecycle-checkpoint

@@ -2,7 +2,7 @@
 import { assertBusinessApprovalBasis } from './lib/business-ticket-lifecycle.mjs';
 import { assertBusinessCheckpoint } from './lib/business-tickets.mjs';
 import { assertStageTracking } from './lib/stage-tracking.mjs';
-import { readFileSync } from "node:fs";
+import { readFileSync, withValidationPhase } from "./lib/validation-phase.mjs";
 import { spawnSync } from "node:child_process";
 import path from "node:path";
 import { parseArgs } from "node:util";
@@ -38,6 +38,7 @@ try {
   if(values.help){process.stdout.write('用法: scripts/verify-lifecycle-checkpoint [--history] <checkpoint.yaml|json>\n默认核验当前记录；--history 仅检查历史结构，不证明当前批准或流转。退出码 0=检查完成，1=失败。\n');}
   else {
   if (positionals.length !== 1) throw new TypeError("用法: scripts/verify-lifecycle-checkpoint <checkpoint.yaml|checkpoint.json>");
+  const verify = () => {
   const sourcePath = path.resolve(positionals[0]);
   if(!values.history)assertCurrentAssetReference(root,path.relative(root,sourcePath));
   const value = parseAsset(readFileSync(sourcePath), sourcePath);
@@ -58,9 +59,9 @@ try {
     else if(value.mode==='resume'||value.mode==='orchestrate') assertScopeWorkUnit('work-unit.entry-triage',{root});
   }
   assertStageTracking(value, { root, checkpointRef: path.relative(root, sourcePath), nextWorkUnit: value.next_work_unit, entering: value.mode === 'resume' || value.mode === 'orchestrate' });
-  assertCheckpointApprovals(value, sourcePath);
+  assertCheckpointApprovals(value, sourcePath, {root});
   assertPlanCheckpoint(value);
-  assertCheckpointUserDecisions(value);
+  assertCheckpointUserDecisions(value,{root});
   if (value.repository_mode === "project-instance" && ["paused-human-gate", "completed"].includes(value.status)) {
     if (value.context_reconciliation?.status !== "reconciled" || !value.context_reconciliation?.ref) throw new TypeError("project-instance 在会签或完成前必须具有 reconciled context_reconciliation");
     const reconciliation = path.resolve(root, value.context_reconciliation.ref);
@@ -70,6 +71,9 @@ try {
   if (value.repository_mode === "template-source" && value.context_reconciliation?.status !== "not-applicable") throw new TypeError("template-source context_reconciliation 必须为 not-applicable");
   process.stdout.write("生命周期 checkpoint 验证通过\n");
   }
+  };
+  if(values.history) verify();
+  else withValidationPhase({root,purpose:'lifecycle-checkpoint-current',readOnly:true},verify);
   }
 } catch (error) {
   process.stderr.write(`生命周期 checkpoint 验证失败: ${error.message}\n`);

package/template/scripts/verify-project-instance

@@ -7,6 +7,7 @@ import { parseDocument } from "./vendor/yaml.mjs";
 import { loadRegistry, validateRegistry } from "./lib/lifecycle-registry.mjs";
 import { syncSkills, updateSkillLock } from "./lib/skill-supply-chain.mjs";
 import { verifyGovernanceLayout } from "./lib/governance-layout.mjs";
+import { DRIFT_EXIT, buildDriftReport, driftReportExit, expectedFromDistribution, formatDriftReport } from "./lib/drift-report.mjs";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const identityPath = path.join(root, "yss-project.yaml");
@@ -33,4 +34,23 @@ if (result.status !== 0) {
 }
 validateRegistry(loadRegistry());
 verifyGovernanceLayout(root, "project-instance");
-process.stdout.write("项目实例校验通过\n");
+const metadataPath = path.join(root, ".yss-template.json");
+if (existsSync(metadataPath)) {
+  const metadata = JSON.parse(readFileSync(metadataPath, "utf8"));
+  const report = buildDriftReport({
+    scope: "project-instance",
+    root,
+    // skills-lock.json is a rendered asset with its own update-skill-lock --check;
+    // Permitted customizations remain required readable files. Managed/generated
+    // assets — including other rendered files — remain hash-gated.
+    managedFiles: Object.fromEntries(Object.entries(metadata.managedFiles ?? {}).filter(([ref, record]) => ref !== "skills-lock.json" && record.mergeStrategy !== "manual")),
+    allowCustomizations: true,
+    expected: expectedFromDistribution(metadata),
+  });
+  if (process.argv.includes("--json")) process.stdout.write(JSON.stringify(report, null, 2) + "\n");
+  else process.stdout.write(formatDriftReport(report) + "\n");
+  if (driftReportExit(report) !== DRIFT_EXIT.clean) {
+    throw new TypeError("实例受管资产漂移或缺失：先运行 create-yss-spec sync 或补装后再校验");
+  }
+}
+process[process.argv.includes("--json") ? "stderr" : "stdout"].write("项目实例校验通过\n");