check-standards
Compare original and translation side by side
🇺🇸
Original
English🇨🇳
Translation
Chinese关键规范自动核对(Check Standards)
Automatic Critical Standard Verification (Check Standards)
Java 代码生成 / 修改完成后的兜底闸门:规范条目多、分散在多个规范 skill,AI 编码可能漏执行。本 skill 用 grep / ast-grep 实际扫描产出,逐项核对关键规范,禁止凭记忆答 ✅。
本 skill 独立可触发,不依赖 ai-dev-workflow 全流程:无论走了完整 spec 流程、还是直接"写个接口/改段代码",只要产出了 Java 代码,收尾都应加载本 skill 做兜底自检。
Bottom-up gate after Java code generation/modification: There are many standard items scattered across multiple standard skills, and AI coding may miss execution. This skill uses grep / ast-grep to actually scan and generate results, verifies key standards item by item, and is prohibited from answering ✅ based on memory.
This skill can be triggered independently and does not rely on the ai-dev-workflow full process: Whether you follow the complete spec process or directly "write an interface/modify a section of code", as long as Java code is produced, you should load this skill for bottom-up self-check at the end.
模式判定与核对依据(执行前必读,先判模式再核对)
Mode Judgment and Verification Basis (Must Read Before Execution, Judge Mode First Then Verify)
核对判定以项目约束为准,规范 skill 默认值仅兜底:
| 模式 | 判定依据(先读哪个文件) | 选型类核对项怎么判 |
|---|---|---|
| 标准模式(新项目 / 未走存量扫描) | | 按 2.1 人确认的选型判定(如 Log4j2 → 按 Log4j2 查,不强制 logback-spring.xml) |
| 存量适配模式(老项目) | | 按老项目约定判定(如老项目用 R<T> 返回体 → 不判 Response<T>;用 Apifox 不写注解 → 按老约定) |
| 判定不了 | 停止并向人确认项目模式(禁止按默认值猜) | — |
选型敏感核对项(接口文档 / 日志框架 / SQL 在 XML / 统一返回体,即下方 #6/#7/#8/#20):判定标准随项目模式变化,先读 2.1 约束 / 0.5 扫描再判;其余核对项(SQL 注释 / DDL 注释 / 事务 / 注入 / WHERE / 密码 / 分页 / 方法注释 / 方法日志等)为通用硬规则,任何模式都按规范判定。
Verification judgment is based on project constraints, and default values of standard skills are only for bottom-up purposes:
| Mode | Judgment Basis (Which File to Read First) | How to Judge Selection-Type Verification Items |
|---|---|---|
| Standard Mode (New project / No existing scan) | | Judge according to the selected items confirmed by 2.1 personnel (e.g., Log4j2 → check according to Log4j2, do not enforce logback-spring.xml) |
| Existing Adaptation Mode (Legacy project) | | Judge according to the agreements of legacy projects (e.g., if the legacy project uses R<T> return body → do not judge Response<T>; if Apifox is used without writing annotations → follow the old agreement) |
| Unjudgeable | Stop and confirm the project mode with personnel (prohibit guessing according to default values) | — |
Selection-sensitive verification items (Interface documentation / Log framework / SQL in XML / Unified return body, i.e., #6/#7/#8/#20 below): Judgment standards change with project modes, read 2.1 constraints / 0.5 scan first then judge; Other verification items (SQL comments / DDL comments / Transactions / Injection / WHERE / Password / Pagination / Method comments / Method logs, etc.) are general hard rules, and are judged according to standards in any mode.
第 0 步:中间产物命名与路径矫正(核对前必做,防核对扫不到/验收引用断裂)
Step 0: Correct Intermediate Product Naming and Paths (Must Do Before Verification, Prevent Missing Scans/Broken Acceptance References)
为什么:核对指令按规范命名扫描产物(如 、);若产物命名不规范(技术方案漏 、文件名带任务 ID 前缀 、5.2/5.3 报告漏功能序号)或路径不在模块版本目录下,核对扫不到、验收引用断裂。执行核对前先扫描矫正:
docs/*/3.*.1-技术方案*.md3.*.2-接口清单*.md.1T02-01Why: Verification commands scan products according to standard naming (e.g., , ); If product naming is non-standard (Technical Solution missing , file name with task ID prefix , 5.2/5.3 reports missing function serial numbers) or paths are not in the module version directory, verification will miss scans and acceptance references will break. Scan and correct before executing verification:
docs/*/3.*.1-Technical Solution*.md3.*.2-Interface List*.md.1T02-01目标命名规则(与 ai-dev-workflow「产物命名统一规则」一致,单一事实源)
Target Naming Rules (Consistent with ai-dev-workflow "Unified Product Naming Rules", Single Source of Truth)
| 产物 | 规范命名 | 常见错误 → 矫正 |
|---|---|---|
| 技术方案 | | |
| 接口清单 | | |
| 任务拆解 | | |
| 契约测试 | (测试代码产物,非 md) | 按项目测试目录结构,不参与 md 编号 |
| 规范核对报告(本 skill 产物) | | |
| 验收报告 | | |
功能项序号怎么推:从同一功能名的技术方案文件名()取序号;无技术方案 → 读3.<序号>.1-<功能名>-技术方案.md功能项 # 列;仍无法确定 → 停下问用户,禁止猜。1.1-功能清单.md
| Product | Standard Naming | Common Errors → Correction |
|---|---|---|
| Technical Solution | | |
| Interface List | | |
| Task Breakdown | | |
| Contract Test | (Test code product, non-md) | Follow the project test directory structure, no md numbering involved |
| Standard Verification Report (Product of this skill) | | |
| Acceptance Report | | |
How to derive function item serial number: Take the serial number from the technical solution file name of the same function name (); If there is no technical solution → Read the function item # column in3.<Serial Number>.1-<Function Name>-Technical Solution.md; If still unable to determine → Stop and ask the user, prohibit guessing.1.1-Function List.md
执行步骤
Execution Steps
- 扫描:(模块目录)+
ls docs/列出全部中间产物,逐个对照上表核对文件名与路径find docs -name "*.md" - 判不合规:① 技术方案漏 (
.1);② 文件名带任务 ID 前缀(3.1-…/T0\d+-等);③ 5.2/5.3 报告漏功能序号(T02-01/5.2-…);④ 路径不在5.3-…下(散落 docs 根目录 / 其他目录)docs/<模块名>V<版本号>-<YYYYMMDDHHMMSS>/ - 列出矫正清单(+ 原因)→ 先向用户确认(本 skill 不改文件的原则同样适用:确认后才动手)
旧路径 → 新路径 - 矫正:(或
mv,git 仓库时保留历史)移入正确目录 + 改文件名;改动引用:若其他 md(约束/方案/验收报告)引用了旧文件名 → 同步更新引用git mv - 矫正结果记入核对报告「产物矫正记录」小节(旧→新 + 原因),供 5.3 验收复核引用
[!NOTE] 矫正范围边界 只矫正中间产物 md 的文件名与目录(docs/ 下产物),不碰源码/测试代码(src/ 由核对项检查);无对应功能名 → 不强行改名(停下询问)。
- Scan: (module directory) +
ls docs/to list all intermediate products, and check file names and paths against the above table one by onefind docs -name "*.md" - Judge non-compliance: ① Technical Solution missing (
.1); ② File name with task ID prefix (3.1-…/T0\d+-, etc.); ③ 5.2/5.3 reports missing function serial numbers (T02-01/5.2-…); ④ Path not under5.3-…(scattered in docs root directory / other directories)docs/<Module Name>V<Version Number>-<YYYYMMDDHHMMSS>/ - List correction list (+ reason) → Confirm with the user first (The principle that this skill does not modify files also applies: only take action after confirmation)
Old Path → New Path - Correct: Use (or
mvto retain history in git repositories) to move to the correct directory + rename files; Update references: If other md files (constraints/solutions/acceptance reports) reference the old file name → Update references synchronouslygit mv - Record the correction result in the "Product Correction Record" section of the verification report (Old→New + reason) for reference in 5.3 acceptance review
[!NOTE] Correction Scope Boundary Only correct file names and directories of intermediate product md files (products under docs/), do not touch source code/test code (src/ is checked by verification items); If there is no corresponding function name → Do not force renaming (stop and ask)
执行方式(核心规则)
Execution Method (Core Rules)
- 先矫正产物命名与路径(执行规则见「第 0 步」章节):扫描 docs/ 中间产物,命名/路径不合规 → 列矫正清单 → 用户确认 → 矫正 → 再进入核对
- 先界定核对范围(见下「核对范围界定」章节,执行前先读):用户指定目录 → 按指定路径;用户说"某次需求/本轮改动" → git diff 界定文件 → 用该路径;无指定 → 全项目。把每条检查指令的默认路径 替换为界定后的范围
src/main/java - 先判模式(见上"模式判定与核对依据"),读对应约束文件,确定选型类核对项的判定口径
- 对下方每一项,实际执行「标准检查指令」(grep/ast-grep,路径用第 1 步界定的范围),把命令 + 命中行(文件:行号)粘贴为证据
- 无命中 → 记 ;命中违规 → 记
✅(附证据)❌ - 所有未执行到位项(全部核对项,无级别之分)→ 统一列进「待用户确认清单」,一起向用户确认是否执行补齐:把全部 ❌ 项证据汇总展示给人(一次确认,不是逐项反复问),问"以下 N 项未执行到位,是否按规范补齐?"——用户逐项确认(补齐 / 跳过)→ 确认"补齐"的项才执行补齐 → 重跑该项指令 + 新证据(已修复);补齐后仍无法满足 → 升级人工核对(标注"需人工核对")。禁止未经用户确认自动改代码、禁止把任何 ❌ 项当"不重要"默默跳过(补齐全过程有人的确认闸门)
- 输出《关键规范核对报告》(标注核对范围;逐项 ✅/❌ + 证据 + 待用户确认清单),结果汇总进验收报告"关键规范落地核对表"
[!WARNING] 证据强制 + 用户确认闸门(所有未执行到位项一体确认,无级别之分) 每项必须给出实际执行的 grep/ast-grep 命令与命中行。只写 ✅/❌ 无证据 = 未核对,打回重跑。禁止"没做就声称做了"。 所有未执行到位项(全部核对项,无级别之分)→ 必须停下来一起让用户确认是否执行补齐(人确认后才动手改代码),不自动默默补齐、不因"不阻塞/不重要/仅参考"而跳过确认。未执行项多少都要确认——发现 1 项 ❌ 也要停下确认,不得带 ❌ 进验收。
- Correct product naming and paths first (See "Step 0" section for execution rules): Scan intermediate products in docs/, if naming/paths are non-compliant → List correction list → User confirmation → Correction → Then enter verification
- Define verification scope first (See "Verification Scope Definition" section below, read before execution): User-specified directory → Use the specified path; User says "a certain requirement/this round of changes" → Use git diff to define files → Use this path; No specification → Whole project. Replace the default path in each check command with the defined scope
src/main/java - Judge mode first (See "Mode Judgment and Verification Basis" above), read the corresponding constraint file, determine the judgment caliber for selection-type verification items
- For each item below, actually execute the "standard check command" (grep/ast-grep, use the scope defined in Step 1 for paths), paste the command + hit lines (File:Line Number) as evidence
- No hits → Record ; Hit violations → Record
✅(attach evidence)❌ - All unimplemented items (all verification items, no level distinction) → Unifiedly list in the "Pending User Confirmation List" and confirm with the user whether to complete them together: Show all ❌ items' evidence to personnel (Confirm once, not item by item repeatedly), ask "The following N items are not implemented properly, whether to complete them according to standards?" → User confirms item by item (complete / skip) → Only execute completion for items confirmed as "complete" → Re-run the item's command + new evidence (fixed); If still unable to meet requirements after completion → Escalate to manual verification (mark "needs manual verification"). Prohibit modifying code automatically without user confirmation, prohibit silently skipping any ❌ items as "unimportant" (There is a personnel confirmation gate throughout the completion process)
- Output the 《Critical Standard Verification Report》 (mark verification scope; item-by-item ✅/❌ + evidence + pending user confirmation list), and summarize the results into the "Critical Standard Implementation Verification Table" in the acceptance report
[!WARNING] Mandatory Evidence + User Confirmation Gate (All unimplemented items are confirmed together, no level distinction) Each item must provide the actually executed grep/ast-grep command and hit lines. Only writing ✅/❌ without evidence = No verification, return for re-run. Prohibit "claiming to have done it without doing it". All unimplemented items (all verification items, no level distinction) → Must stop and let the user confirm whether to complete them together (Only modify code after personnel confirmation), do not automatically complete silently, do not skip confirmation due to "non-blocking/unimportant/for reference only". No matter how many unimplemented items there are, confirmation is required—even if 1 ❌ item is found, stop for confirmation, and do not bring ❌ items into acceptance.
核对范围界定(执行前必做——先确定"扫哪里",再跑指令)
Verification Scope Definition (Must Do Before Execution——Determine "Where to Scan" First, Then Run Commands)
所有标准检查指令写的是默认路径(示例值)。执行前先按下述规则确定实际扫描路径,把每条指令中的路径替换为界定后的范围——避免"只想扫这次改的代码却把全项目存量违规都扫出来"。src/main/java
三种情况(按用户意图二选一,默认走第 1 种):
The default pathis written in all standard check commands (sample value). Before execution, determine the actual scanning path according to the following rules, and replace the path in each command with the defined scope——Avoid "wanting to only scan the code modified this time but scanning all existing violations in the whole project".src/main/java
Three scenarios (Choose one according to user intent, default to Scenario 1):
情况 A:用户指定目录/模块/包(最常见——"对 xx 目录扫"/"检查 order 模块")
Scenario A: User-specified directory/module/package (Most common——"Scan xx directory"/"Verify order module")
- 用户给出路径 → 所有检查指令的路径 = 该路径(,如
grep ... <指定路径>),不是全项目src/main/java/com/xxx/order - 报告标注「核对范围:<指定路径>」;范围外的文件不扫、不计入 ❌
- 若指定的是模块名(如"order 模块")而非路径 → 先定位模块根目录(),确认后按该路径扫
src/main/java/**/order
- User provides path → Path of all check commands = This path (, e.g.,
grep ... <Specified Path>), not the whole projectsrc/main/java/com/xxx/order - Mark "Verification Scope: <Specified Path>" in the report; Files outside the scope are not scanned and not counted as ❌
- If the specified is a module name (e.g., "order module") instead of a path → Locate the module root directory first (), confirm then scan according to this path
src/main/java/**/order
情况 B:用户说"某次需求/这次改的代码/本轮改动"
Scenario B: User says "a certain requirement/code modified this time/this round of changes"
- 先界定"本次改了哪些文件"(按优先级):
- +
git status(未提交的改动)——工作区/暂存区新增修改的 Java 文件git diff --stat - 最近一次提交()——若刚提交完
git diff HEAD~1 --name-only - 用户口头给出文件清单
- 检查指令路径 = 这些文件所属目录(文件分散则逐个文件核对,或按其公共父目录核对)
- 报告区分两类 ❌:本次改动引入的(阻塞,进待确认清单)/ 存量历史违规(非本次引入——仅提示"存量问题:N 处(非本次引入,可另行 gen-comments/gen-logs 处理)",不阻塞本次)
- 无法确定改动范围(git 不可用/用户也说不清)→ 停下问用户,不猜
- First define "which files were modified this time" (by priority):
- +
git status(uncommitted changes)——Java files added/modified in working directory/staging areagit diff --stat - Last commit ()——If just committed
git diff HEAD~1 --name-only - User-provided file list verbally
- Check command path = Directory where these files belong (If files are scattered, check each file individually, or check according to their common parent directory)
- The report distinguishes two types of ❌: Introduced by this round of changes (blocking, enter pending confirmation list) / Existing historical violations (not introduced this time——Only prompt "Existing issues: N (not introduced this time, can be handled by gen-comments/gen-logs separately"), does not block this round)
- Unable to determine change scope (git unavailable/user cannot explain clearly) → Stop and ask the user, do not guess
情况 C:用户无指定、仅"跑一下 check-standards"(全项目体检)
Scenario C: User has no specification, only "run check-standards" (Whole project check-up)
- 扫整个项目(指令默认路径);报告将 本次改动 vs 存量 分列(有 git 时按 B 的 diff 区分;无 git 时标注"全量体检,未区分存量/新增")
[!NOTE] 范围界定与产物矫正的关系 第 0 步(产物矫正)针对 docs/ 中间产物;本界定针对 src/ 代码核对范围。两者独立:即使只扫某目录代码,docs/ 产物矫正仍按全量执行(防验收引用断裂)。
- Scan the whole project (default path of commands); The report separates this round of changes vs existing violations (Distinguish by diff in Scenario B if git is available; Mark "Full check-up, no distinction between existing/new" if git is not available)
[!NOTE] Relationship Between Scope Definition and Product Correction Step 0 (Product Correction) targets intermediate products in docs/; This definition targets the verification scope of src/ code. They are independent: Even if only scanning code in a certain directory, product correction in docs/ is still executed in full (to prevent broken acceptance references)
检查项清单
Verification Item List
所有核对项无级别之分:每项都是硬规则,未执行到位一律 ❌ 进待用户确认清单(与用户确认补齐/跳过),不存在"HIGH 必改 / INFO 可跳过"之分。选型敏感项 ⚠️ 按 2.1 约束/0.5 扫描口径判定(见"模式判定"),其余按规范。核对范围按上「核对范围界定」执行(指定目录 / 本轮改动 git diff / 全项目三种)——下方指令中的 等路径均为示例,实际执行时替换为界定后的范围。
src/main/javaAll verification items have no level distinction: Each item is a hard rule, and any unimplemented item will be marked as ❌ and entered into the pending user confirmation list (confirm with the user whether to complete/skip), there is no distinction between "HIGH must be modified / INFO can be skipped". Selection-sensitive items ⚠️ are judged according to 2.1 constraints/0.5 scan caliber (See "Mode Judgment"), others are judged according to standards. Verification scope is executed according to the above "Verification Scope Definition" (Three types: specified directory / this round of changes git diff / whole project)——Paths such as in the commands below are examples, replace with the defined scope during actual execution.
src/main/java一、方法与日志覆盖(新代码必核——注释/日志必须覆盖所有代码,含抽取的 private 方法)
1. Method and Log Coverage (Must Verify for New Code——Comments/Logs Must Cover All Code, Including Extracted Private Methods)
痛点根源:ServiceImpl 方法无日志、Controller 抽取的 private 方法大段无注释无日志,旧核对只扫 public 方法所以漏检。本组按"方法级"机械核对,public + private + 抽取方法全覆盖。
| # | 核对项 | 标准检查指令(实际执行) | 判定标准(全部满足才 ✅) |
|---|---|---|---|
| 1 | 方法级注释全覆盖 | ast-grep 列全部方法节点( | 所有方法(public + private + 抽取方法,含测试方法)有 Javadoc:功能 + @param/@return 写业务含义;Controller/ServiceImpl 抽取出来的私有辅助方法同样必须有类注释 + 方法 Javadoc(按 comment-standards 全量注释规则,无豁免) |
| 2 | 方法级日志全覆盖 | grep/ast-grep 逐个检查方法体内是否含 | Controller/Service/ServiceImpl/Job/Listener 的每个业务方法(public + private 抽取方法)方法体内 ≥1 条 INFO/WARN/ERROR 业务日志(入口入参摘要 / 关键分支 / 结果返回前);方法内无任何 INFO/WARN/ERROR(即使有 log.debug)→ ❌;大段逻辑(≥10 行)无 INFO/WARN/ERROR → ❌;方法含 ≥2 个业务阶段(查库/状态变更/循环组装等)但仅开头 1 条日志、中间关键逻辑无 INFO → ❌("半覆盖"漏网形态);纯 getter/setter/单行透传可豁免(注明豁免原因);异常处 ERROR 带堆栈 |
| 3 | 步骤注释 + WHY | | 方法体 ≥2 个逻辑步骤有编号注释( |
| 4 | 禁翻译式注释 | 抽查注释 | 无逐行翻译式注释;注释写业务含义非复述代码 |
| 5 | 全类 @Slf4j + 无 System.out | | Controller/Service/ServiceImpl/Job/Listener 全类 @Slf4j,无 System.out、无散落 Logger 混用 |
Root cause of pain points: No logs in ServiceImpl methods, large sections of private methods extracted from Controller have no comments or logs, and old verification only scans public methods so misses checks. This group verifies mechanically at the "method level", covering public + private + extracted methods.
| # | Verification Item | Standard Check Command (Actual Execution) | Judgment Standard (All Must Be Met to Get ✅) |
|---|---|---|---|
| 1 | Full Coverage of Method-Level Comments | Use ast-grep to list all method nodes ( | All methods (public + private + extracted methods, including test methods) have Javadoc: Function + @param/@return write business meaning; Private auxiliary methods extracted from Controller/ServiceImpl must also have class comments + method Javadoc (Follow the full comment rules in comment-standards, no exemptions) |
| 2 | Full Coverage of Method-Level Logs | Use grep/ast-grep to check one by one whether the method body contains | Each business method (public + private extracted methods) in Controller/Service/ServiceImpl/Job/Listener has ≥1 INFO/WARN/ERROR business log in the method body (Entry parameter summary / key branches / before result return); No INFO/WARN/ERROR in the method body (even if there is log.debug) → ❌; Large sections of logic (≥10 lines) without INFO/WARN/ERROR → ❌; Methods with ≥2 business stages (database query/status change/circulation assembly, etc.) but only 1 log at the beginning and no INFO in key intermediate logic → ❌ ("Partial coverage" missed form); Pure getter/setter/single-line pass-through can be exempted (note exemption reason); ERROR in exceptions with stack traces |
| 3 | Step Comments + WHY | | Method bodies with ≥2 logical steps have numbered comments ( |
| 4 | Prohibit Translation-Style Comments | Spot check comments | No line-by-line translation-style comments; Comments write business meaning instead of repeating code |
| 5 | Full Class @Slf4j + No System.out | | Controller/Service/ServiceImpl/Job/Listener have full class @Slf4j, no System.out, no scattered Logger mixed use |
二、框架与产物(选型敏感 ⚠️ 按项目模式判定)
2. Framework and Products (Selection-Sensitive ⚠️ Judged According to Project Mode)
| # | 核对项 | 标准检查指令(实际执行) | 判定标准(全部满足才 ✅) |
|---|---|---|---|
| 6 | 接口文档支持 ⚠️ | | 按 2.1 选型/老约定判定(springdoc → 依赖 + @Tag/@Operation + @Schema;老项目 Swagger2 → @Api 体系;纯 Apifox 按老约定) |
| 7 | 日志框架支持 ⚠️ | | 按 2.1 选型/老约定判定:Logback → logback-spring.xml 存在(控制台+滚动+环境级 level);Log4j2 → 配置存在且无 logback 并存 |
| 8 | SQL 在 XML ⚠️ | | 标准模式:无注解 SQL,手写 SQL 全在 XML,namespace 一致;老项目按 0.5 数据访问约定判定 |
| 9 | JSON 入参/出参产物 | | 每个 Controller 功能项的接口清单已生成,URL+方法+JSON 入参/出参(成功/失败)与方案一致 |
| # | Verification Item | Standard Check Command (Actual Execution) | Judgment Standard (All Must Be Met to Get ✅) |
|---|---|---|---|
| 6 | Interface Document Support ⚠️ | | Judge according to 2.1 selection/old agreement (springdoc → dependency + @Tag/@Operation + @Schema; legacy project Swagger2 → @Api system; pure Apifox follows old agreement) |
| 7 | Log Framework Support ⚠️ | | Judge according to 2.1 selection/old agreement: Logback → logback-spring.xml exists (console+rolling+environment-level level); Log4j2 → Configuration exists and no coexistence with logback |
| 8 | SQL in XML ⚠️ | | Standard mode: No annotation SQL, handwritten SQL all in XML, namespace consistent; Legacy project judged according to 0.5 data access agreement |
| 9 | JSON Input/Output Products | | Interface list has been generated for each Controller function item, URL+method+JSON input/output (success/failure) consistent with the solution |
三、SQL 与数据安全
3. SQL and Data Security
| # | 核对项 | 标准检查指令(实际执行) | 判定标准(全部满足才 ✅) |
|---|---|---|---|
| 10 | SQL 注释(方案内) | | 方案《数据模型与 SQL》所有 SQL 带注释:DDL 每字段 COMMENT;查询/DML 每条 |
| 11 | DDL 字段注释 | | CREATE TABLE 每个字段带 COMMENT + 表级 COMMENT;无裸字段 |
| 12 | SQL 注入 | | XML 无 |
| 13 | UPDATE/DELETE 带 WHERE | | 所有 UPDATE/DELETE 带 WHERE(无 WHERE → ❌) |
| # | Verification Item | Standard Check Command (Actual Execution) | Judgment Standard (All Must Be Met to Get ✅) |
|---|---|---|---|
| 10 | SQL Comments (In Solution) | | All SQL in the 《Data Model and SQL》 section of the solution has comments: DDL each field has COMMENT; Each query/DML has |
| 11 | DDL Field Comments | | Each field in CREATE TABLE has COMMENT + table-level COMMENT; No bare fields |
| 12 | SQL Injection | | No |
| 13 | UPDATE/DELETE with WHERE | | All UPDATE/DELETE have WHERE (No WHERE → ❌) |
四、事务与代码质量
4. Transactions and Code Quality
| # | 核对项 | 标准检查指令(实际执行) | 判定标准(全部满足才 ✅) |
|---|---|---|---|
| 14 | 事务 rollbackFor | | 每个 @Transactional 均带 rollbackFor = Exception.class |
| 15 | 构造器注入 | | 无字段注入;统一构造器注入(@RequiredArgsConstructor + final)(存量模式按老约定) |
| 16 | 分层边界 | | Controller 不注入 Mapper、不写业务逻辑/SQL/事务 |
| 17 | Entity 不暴露 | | 接口出入参用 DTO/VO,不暴露 Entity |
| 18 | 异常处理 | | 无裸 RuntimeException;无空 catch 吞异常 |
| 19 | 命名单字母/泛称 | | 无单字母类名、异常参数非 e、无泛称变量 |
| 20 | 统一返回体 ⚠️ | | 按 2.1/老约定:Controller 返回 Response<T>/PageResult<T>(存量按老返回体),无 Map 裸返回 |
| 21 | 密码加密 | | 无 MD5/SHA1 存密码(用 BCrypt 慢哈希) |
| 22 | 分页上限 | | 分页入参 pageSize 有 @Max/上限校验 |
| 23 | 校验 message 具体性 | | 校验注解 message 必须具体:含业务字段名 + 具体原因("手机号不能为空"/"数量必须大于0");禁止无字段语义笼统文案——message 值若仅由笼统词构成(前缀 |
| # | Verification Item | Standard Check Command (Actual Execution) | Judgment Standard (All Must Be Met to Get ✅) |
|---|---|---|---|
| 14 | Transaction rollbackFor | | Each @Transactional has rollbackFor = Exception.class |
| 15 | Constructor Injection | | No field injection; Unified constructor injection (@RequiredArgsConstructor + final) (Follow old agreement for existing mode) |
| 16 | Layered Boundaries | | Controller does not inject Mapper, does not write business logic/SQL/transactions |
| 17 | Entity Not Exposed | | Interface input/output use DTO/VO, do not expose Entity |
| 18 | Exception Handling | | No bare RuntimeException; No empty catch swallowing exceptions |
| 19 | Single-Letter/Generic Naming | | No single-letter class names, exception parameters not e, no generic variables |
| 20 | Unified Return Body ⚠️ | | Judge according to 2.1/old agreement: Controller returns Response<T>/PageResult<T> (Existing mode follows old return body), no bare Map return |
| 21 | Password Encryption | | No MD5/SHA1 storing passwords (Use BCrypt slow hashing) |
| 22 | Pagination Limit | | Pagination input parameter pageSize has @Max/limit verification |
| 23 | Specificity of Verification message | | Verification annotation message must be specific: Include business field name + specific reason ("Mobile number cannot be empty"/"Quantity must be greater than 0"); Prohibit generic copy without field semantics——If message value only consists of generic words (prefix |
五、场景化 + 其余项(对应类型文件存在时才核 / 人工项)
5. Scenario-Based + Other Items (Verify Only When Corresponding Type of File Exists / Manual Items)
| # | 核对项 | 触发条件 / 检查指令 | 判定标准 |
|---|---|---|---|
| 24 | Job 防重入 + 批处理 | | 有分布式锁/状态位防重入;批处理带 LIMIT;无长事务 |
| 25 | Listener 幂等 + 死信 | | 消费幂等;重试有上限 + 死信队列;无 catch 静默 |
| 26 | 文件上传安全 | | 扩展名+MIME 双白名单;UUID 重命名;大小限制 |
| 27 | 写接口幂等(HTTP) | Controller 存在 POST/PUT 写接口 | 写接口有幂等方案(唯一键/令牌/Redis SETNX),幂等键与业务同事务(自动 grep 难查 → 人工抽查标"需人工核对") |
| 28 | 敏感信息进日志 | | 日志/异常/响应不含密码/token 明文(命中核对是否脱敏) |
| 29 | 集合命名 | | 集合字段用 xxxList/xxxSet/xxxMap 后缀 |
| 30 | 魔法值/缓存 key | 抽查常量类 | 无裸魔法值;缓存 key 集中常量定义 |
| 31 | 公共组件复用 | 扫描 common/util、common/base 与业务重复方法体 | 无 ≥2 处相同方法体(发现 → 提示抽公共,需人工确认) |
| 32 | 日志参数 NPE(求值安全) | | 日志参数不得写可能 NPE 的调用:判空前的 |
| 33 | 同表重复映射 | | 全项目一张表只允许一个 Entity 映射(同表唯一映射,见 entity-standards §1): |
[!WARNING] #1/#2/#3 方法级核对必须逐方法通读(防"长代码丢焦点") grep/ast-grep 只能列出方法与"哪里有注释/日志",证明不了"哪个方法缺"。#1(方法 Javadoc)、#2(方法日志)、#3(步骤注释)必须对本轮生成/修改的每个 Java 文件逐方法通读:
- 抽取方法(private 辅助方法)是漏注释/漏日志高发区——Controller 里抽出的校验/转换方法、ServiceImpl 里抽出的组装/查询方法,逐个核对有方法 Javadoc、方法体内 ≥1 条 INFO/WARN/ERROR 日志
- #2 防"半覆盖"漏网:方法开头 1 条
(或 1 条 INFO)但中间 10+ 行查库/循环/组装逻辑无 INFO/WARN/ERROR → ❌(debug 不算日志,方法须关键阶段有 INFO)log.debug- 从方法第一行读到最后一行,重点盯方法后半段与深层嵌套分支;长方法(>20 行)逐段确认编号注释覆盖到最后一步、每段业务逻辑都有日志
- 禁止只数 grep 命中数判 ✅;未通读的方法按"未核对"处理,打回重核
| # | Verification Item | Trigger Condition / Check Command | Judgment Standard |
|---|---|---|---|
| 24 | Job Anti-Reentrancy + Batch Processing | | Distributed lock/status bit for anti-reentrancy; Batch processing with LIMIT; No long transactions |
| 25 | Listener Idempotency + Dead Letter | | Consumption idempotency; Retry has upper limit + dead letter queue; No silent catch |
| 26 | File Upload Security | | Double whitelist of extension+MIME; UUID renaming; Size limit |
| 27 | Idempotency of Write Interfaces (HTTP) | Controller has POST/PUT write interfaces | Write interfaces have idempotency solutions (unique key/token/Redis SETNX), idempotency key is in the same transaction as business (Difficult to check automatically via grep → Manual spot check marked "needs manual verification") |
| 28 | Sensitive Information in Logs | | Logs/exceptions/responses do not contain plaintext password/token (Check whether desensitized if hit) |
| 29 | Collection Naming | | Collection fields use xxxList/xxxSet/xxxMap suffix |
| 30 | Magic Values/Cache Keys | Spot check constant classes | No bare magic values; Cache keys are centrally defined as constants |
| 31 | Public Component Reuse | Scan common/util, common/base and business duplicate method bodies | No ≥2 identical method bodies (If found → Prompt to extract public components, need manual confirmation) |
| 32 | Log Parameter NPE (Evaluation Safety) | | Log parameters cannot write calls that may cause NPE: |
| 33 | Duplicate Mapping of Same Table | | Only one Entity mapping is allowed for one table in the whole project (Unique mapping for the same table, see entity-standards §1): If |
[!WARNING] #1/#2/#3 Method-Level Verification Must Read Each Method Through (Prevent "Long Code Focus Loss") grep/ast-grep can only list methods and "where comments/logs exist", but cannot prove "which method is missing". #1 (Method Javadoc), #2 (Method Logs), #3 (Step Comments) must read each method of each Java file generated/modified in this round through:
- Extracted methods (private auxiliary methods) are high-risk areas for missing comments/logs——Check one by one whether verification/conversion methods extracted from Controller, assembly/query methods extracted from ServiceImpl have method Javadoc and ≥1 INFO/WARN/ERROR log in the method body
- #2 Prevent "Partial Coverage" Missing: Method starts with 1
(or 1 INFO) but has 10+ lines of database query/circulation/assembly logic in the middle without INFO/WARN/ERROR → ❌ (debug does not count as logs, methods must have INFO in key stages)log.debug- Read from the first line to the last line of the method, focus on the second half of the method and deeply nested branches; For long methods (>20 lines), confirm section by section that numbered comments cover the last step and each business logic section has logs
- Prohibit judging ✅ only by grep hit count; Methods not read through are treated as "not verified" and returned for re-verification
输出格式
Output Format
text
=== 关键规范核对报告(5.2.<功能项序号>-<功能名>-规范核对报告)===
项目: <路径> 时间: <时间戳> 模式: 标准/存量适配 核对范围: 全项目 / <指定目录> / 本轮改动(git diff 界定)
产物矫正记录(第 0 步,如无 → "无,命名/路径已合规"):
docs/3.1-服务产品分类与BANNER-技术方案.md → docs/<模块>V<版本>-<时间戳>/3.1.1-服务产品分类与BANNER-技术方案.md(漏 .1)
docs/<模块>…/5.2-T02-01-前台商品列表与详情-规范核对报告.md → …/5.2.6-前台商品列表与详情-规范核对报告.md(补功能序号 + 去任务 ID)
[✅] 1 方法级注释全覆盖 证据: UserController.java:12 login 有 Javadoc;OrderServiceImpl.java:8 buildVO private 有 Javadoc(逐方法通读 12/12 方法全通过)
[❌] 2 方法级日志全覆盖 证据: OrderServiceImpl.java:33 getOrderList 方法体无 log 调用(零日志);:41 buildOrderVO private 无日志
[✅] 5 全类 @Slf4j 证据: 全类 @Slf4j、无 System.out
[❌] 14 事务 rollbackFor 证据: OrderServiceImpl.java:45 @Transactional(无 rollbackFor)
[❌] 27 敏感信息进日志 证据: AuthController.java:60 log.info 含明文 token
...
结论: 33 项核对项:通过 X / 未通过 Y
⚠️ 待用户确认清单(全部未执行到位项,一次确认,无级别之分):
#2 方法级日志全覆盖、#14 事务 rollbackFor、#27 敏感信息进日志 …
(逐项:补齐/跳过)- 报告落盘:(走 ai-dev-workflow 流程时,功能项序号与 3.x 技术方案一致,如功能项 6 →
docs/<模块名>V<版本号>-<YYYYMMDDHHMMSS>/5.2.<功能项序号>-<功能名>-规范核对报告.md,文件名禁止拼任务 ID;独立触发无 docs 目录时 → 直接在对话里输出报告 + 提示用户是否落盘);全部核对项结论(含 #1 方法注释 / #2 方法日志逐方法核对结果)汇总进验收报告「关键规范落地核对表」5.2.6-前台商品列表与详情-规范核对报告.md - 全部未执行到位项(无级别之分)→ 一次向用户确认是否补齐(展示证据 → 人逐项确认补齐/跳过 → 确认的才执行 → 重跑)
[!NOTE] 两个"人"的动作区分
- 用户确认闸门(执行前):发现未执行到位项 → 向用户确认"是否补齐"(补齐/跳过),确认后 AI 才动手——决定"要不要补"
- 升级人工核对(执行后):补齐后重跑仍 ❌、或用户选择跳过 → 该项标注"需人工核对",由人介入判断——决定"怎么办" 两者都需人在场,但时机不同:确认在动手前,人工核对在动手后仍失败时。
text
=== Critical Standard Verification Report (5.2.<Function Item Serial Number>-<Function Name>-Standard Verification Report) ===
Project: <Path> Time: <Timestamp> Mode: Standard/Existing Adaptation Verification Scope: Whole Project / <Specified Directory> / This Round of Changes (Defined by git diff)
Product Correction Record (Step 0, if none → "None, naming/paths are compliant"):
docs/3.1-Service Product Classification and BANNER-Technical Solution.md → docs/<Module>V<Version>-<Timestamp>/3.1.1-Service Product Classification and BANNER-Technical Solution.md (missing .1)
docs/<Module>…/5.2-T02-01-Frontend Product List and Details-Standard Verification Report.md → …/5.2.6-Frontend Product List and Details-Standard Verification Report.md (add function serial number + remove task ID)
[✅] 1 Full Coverage of Method-Level Comments Evidence: UserController.java:12 login has Javadoc; OrderServiceImpl.java:8 buildVO private has Javadoc (12/12 methods passed after reading through)
[❌] 2 Full Coverage of Method-Level Logs Evidence: OrderServiceImpl.java:33 getOrderList method body has no log calls (zero logs); :41 buildOrderVO private has no logs
[✅] 5 Full Class @Slf4j Evidence: Full class @Slf4j, no System.out
[❌] 14 Transaction rollbackFor Evidence: OrderServiceImpl.java:45 @Transactional (no rollbackFor)
[❌] 27 Sensitive Information in Logs Evidence: AuthController.java:60 log.info contains plaintext token
...
Conclusion: 33 verification items: X Passed / Y Failed
⚠️ Pending User Confirmation List (All unimplemented items, confirm once, no level distinction):
#2 Full Coverage of Method-Level Logs, #14 Transaction rollbackFor, #27 Sensitive Information in Logs …
(Item by item: Complete/Skip)- Save the report: (When following ai-dev-workflow process, function item serial number is consistent with 3.x technical solution, e.g., function item 6 →
docs/<Module Name>V<Version Number>-<YYYYMMDDHHMMSS>/5.2.<Function Item Serial Number>-<Function Name>-Standard Verification Report.md, task ID is prohibited in file name; When triggered independently without docs directory → Output the report directly in the dialogue + prompt the user whether to save it); Summarize all verification item conclusions (including #1 method comments / #2 method logs item-by-item verification results) into the Critical Standard Implementation Verification Table in the acceptance report5.2.6-Frontend Product List and Details-Standard Verification Report.md - All unimplemented items (no level distinction) → Confirm with the user whether to complete them together (Show evidence → Personnel confirm item by item complete/skip → Execute completion for confirmed items → Re-run)
[!NOTE] Distinction Between Two "Personnel" Actions
- User Confirmation Gate (Before execution): If unimplemented items are found → Confirm with the user "whether to complete" (complete/skip), AI takes action only after confirmation——Decide "whether to complete"
- Escalate to Manual Verification (After execution): If still ❌ after completion and re-run, or user chooses to skip → Mark the item as "needs manual verification", and personnel intervene to judge——Decide "what to do" Both require personnel presence, but at different times: Confirmation is before taking action, manual verification is when still failing after taking action.
完成标准
Completion Standards
- 产物命名与路径已矫正(第 0 步):docs/ 中间产物命名符合规范(技术方案 3.x.1 / 接口清单 3.x.2 / 核对报告 5.2.x / 验收报告 5.3.x,无任务 ID 前缀),路径在模块版本目录下;矫正清单已向用户确认,矫正记录写入报告
- 核对范围已界定(指定目录 / 本轮改动 git diff / 全项目三种之一),报告已标注核对范围;检查指令路径 = 界定后范围(非全项目默认)
- 模式已判定(标准/存量适配,读对应约束文件;无约束文件时已在报告中注明口径),选型敏感项(#6/#7/#8/#20)按项目约束/老项目约定判定,非规范默认值一刀切
- 全部 33 项核对项已实际执行检查指令并附证据(文件:行号)——含 #1 方法级注释(public + private + 抽取方法)、#2 方法级日志、#3 步骤注释、#23 校验 message 具体性、#32 日志参数 NPE、#33 同表重复映射
- #1/#2/#3 已逐方法通读核对(本轮生成/修改的每个 Java 文件从方法头读到方法尾,重点核过 private/抽取方法、方法后半段与深层嵌套分支的注释与日志覆盖,未只凭 grep 命中数判 ✅)
- 所有未执行到位项(无级别之分)已一起向用户确认是否补齐——确认"补齐"的项已补齐重跑通过;用户选择"跳过"或补齐后仍 ❌ → 已标注"需人工核对"(不静默吞掉)
- 核对报告已输出(走流程时落盘 )
docs/<模块名>V<版本号>-<YYYYMMDDHHMMSS>/5.2.<功能项序号>-<功能名>-规范核对报告.md - 全部核对项结果已汇总进验收报告核对表
- Product naming and paths have been corrected (Step 0): Intermediate product naming in docs/ complies with standards (Technical Solution 3.x.1 / Interface List 3.x.2 / Verification Report 5.2.x / Acceptance Report 5.3.x, no task ID prefix), paths are in the module version directory; Correction list has been confirmed with the user, correction records are written into the report
- Verification scope has been defined (One of the three types: specified directory / this round of changes git diff / whole project), verification scope has been marked in the report; Check command path = defined scope (not whole project default)
- Mode has been judged (Standard/Existing Adaptation, read corresponding constraint files; If no constraint files, caliber has been noted in the report), selection-sensitive items (#6/#7/#8/#20) are judged according to project constraints/legacy project agreements, not one-size-fits-all with standard default values
- All 33 verification items have actually executed check commands and attached evidence (File:Line Number)——Including #1 method-level comments (public + private + extracted methods), #2 method-level logs, #3 step comments, #23 verification message specificity, #32 log parameter NPE, #33 duplicate mapping of same table
- #1/#2/#3 have been verified by reading each method through (Read each Java file generated/modified in this round from method head to method tail, focus on verifying comment and log coverage of private/extracted methods, second half of methods and deeply nested branches, did not judge ✅ only by grep hit count)
- All unimplemented items (no level distinction) have been confirmed with the user whether to complete them together——Items confirmed as "complete" have been completed and re-run successfully; Items selected as "skip" by user or still ❌ after completion → Have been marked as "needs manual verification" (not swallowed silently)
- Verification report has been output (Saved to when following process)
docs/<Module Name>V<Version Number>-<YYYYMMDDHHMMSS>/5.2.<Function Item Serial Number>-<Function Name>-Standard Verification Report.md - All verification item results have been summarized into the acceptance report verification table
与其他 skill 的关系
Relationship with Other Skills
| skill | 关系 |
|---|---|
| ai-dev-workflow | 本 skill 承担其 5.2 规范核对节点(编码后的强制独立核对)的兜底自检;ai-dev-workflow 的 |
| java-code-standards | 核对项的规范出处(命名/分层/注入/异常/日志/事务/安全/性能) |
| comment-standards | 注释规范的规范出处(全量注释:所有类/字段/方法含 private/抽取方法/步骤注释/禁翻译式,见 |
| database-standards | SQL/DDL/索引/数据安全核对项的规范出处 |
| build-standards | 依赖(springdoc/knife4j、logback)核对项的规范出处 |
| Skill | Relationship |
|---|---|
| ai-dev-workflow | This skill undertakes the bottom-up self-check of its 5.2 standard verification node (mandatory independent verification after coding); The |
| java-code-standards | Source of standards for verification items (naming/layering/injection/exceptions/logs/transactions/security/performance) |
| comment-standards | Source of standards for comment standards (full comments: all classes/fields/methods including private/extracted methods/step comments/prohibit translation-style, see |
| database-standards | Source of standards for SQL/DDL/index/data security verification items |
| build-standards | Source of standards for dependency (springdoc/knife4j, logback) verification items |