@pm_zhousl/xinyun-ai-init 1.10.1 → 1.11.0

package/init/xinyun-ai-init/README.md

@@ -2,7 +2,7 @@
 
 本目录是“欣芸技术开发 Agent 流”的初始化包，负责把完整 AI 执行要求下发到目标项目。
 
-当前规则版本：`1.10.1`。
+当前规则版本：`1.11.0`。
 
 ## Codex 一句话入口
 
@@ -54,6 +54,8 @@ AI 读取本文件后，必须按以下方式执行：
 24. 初始化控制面完成后归档初始化登记任务，更新 `xinyun-ai/tasks/task-index.json`；没有可执行任务时 `current-task.md` 使用 `status=idle`、`taskId=null`、`title=暂无待执行任务`。
 25. 用户一句话初始化授权包含 `.codegraph/` 工具控制目录；首次缺失且命令可用时自动执行一次 `codegraph init -i`，不自动安装 CodeGraph 或修改系统环境。
 26. 完成后用中文输出初始化或升级结果、项目导读、团队责任状态、任务状态、CodeGraph 状态、待确认问题和后续短指令。
+27. v1.10.2 必须区分宿主线程、宿主会话、项目会话和主调度会话；真实 sessionId 只能来自宿主返回值，无法验证时保持 blocked。
+28. v1.11.0 使用固定模板物化、阶段状态、项目快照、24 小时缓存和最多 3 个角色并发；缓存命中不能跳过必要会话、授权或最终门禁。
 
 ## 初始化授权边界
 

package/init/xinyun-ai-init/rules/init-rules.md

@@ -56,6 +56,15 @@
 - CodeGraph 必需任务失败时进入 `blocked`；只有用户明确授权限定范围降级时才允许 `partial`。
 - 不自动安装 CodeGraph，不修改系统环境、业务代码、数据库、API、配置、依赖或 Git。
 
+## v1.10.2 and v1.11.0 gate
+
+- Keep `hostThreadId`, `hostSessionId`, `projectSessionId`, and `orchestratorSessionId` separate. Any value without host evidence remains `null`.
+- All five role sessions and the orchestrator must use unique, host-returned session IDs. A host thread, task ID, role ID, title, or random value is never a session ID.
+- Use the v1.9 eight-field RFC8785-JCS-SHA-256 project-isolated reuse key. The legacy four-field index is creation compatibility only.
+- `task.status` is the cross-file source of truth. Illegal task/result/lock combinations become `blocked` and stop further writes.
+- `businessCodeChanged.value=no` requires structured evidence; without evidence it must be `unknown`. Missing real behavior evidence cannot produce `ready`.
+- v1.11 stages are `preflight`, `fixed-materialization`, `control-plane`, `codegraph`, `bootstrap-snapshot`, `role-sessions`, `onboarding`, and `final-gate`. Fixed templates, a bounded project snapshot, a 24-hour cache, and at most three role sessions may reduce repeated work but cannot bypass the final gate.
+
 ## v1.7.2 角色后续任务可见性
 
 - 初始化主任务使用 `taskKind=initialization-main`；角色登记使用 `taskKind=initialization-record`；后续执行任务使用 `taskKind=role-execution`。

package/init/xinyun-ai-init/rules/v1.10.2-contract.md

@@ -0,0 +1,30 @@
+# v1.10.2 contract
+
+This contract is the implementation boundary for real role-session takeover.
+
+## Identity
+
+Keep these identities separate: `hostThreadId`, `hostSessionId`, `projectSessionId`, and `orchestratorSessionId`. A host thread, task ID, role ID, title, or random value is never a project session ID. A value without host evidence remains `null` and the mapping status remains `unbound`, `unknown`, or `failed`.
+
+Every role binding records `projectRootHash`, `workspaceScope`, `repositoryScopeHash`, `workstream`, `taskId`, `roleId`, `provider`, and `targetVersion`. The reuse key is `RFC8785-JCS-SHA-256` over these fields. The old four-field index is compatibility-only and never selects or reuses a candidate.
+
+## State source and legal combinations
+
+`task.status` is the cross-file source of truth. `current-task.md`, `tasks/<taskId>.md`, `init-result.json`, and `task-lock.json` must reference the same `taskId`, `executionId`, `attempt`, and status evidence.
+
+Legal combinations are:
+
+- `task/result=completed` with `lock=released`.
+- `task/result=partial` with `lock=released`.
+- `task/result=blocked` with `lock=blocked` or `lock=unknown`.
+- `task/result=cancelled` with `lock=released`.
+
+An illegal combination is `blocked`, stops further writes, and creates a recovery record. `partial` means a bounded non-blocking part completed; `blocked` means a required gate, identity, write, lock, or evidence condition prevents continuation.
+
+## Evidence and safety
+
+`businessCodeChanged.value=no` requires evidence objects with `evidenceType`, `path`, `beforeHash`, `afterHash`, and `checkedAt`. Without evidence the value is `unknown`. Real session creation, send, receive, status, and recovery evidence must include the real returned `sessionId`, request/response IDs or hashes, snapshots, changed files, forbidden operations, and sensitive-scan status.
+
+The project cannot become `ready` until the orchestrator and all five required role sessions have valid identity evidence, authorization, onboarding, and execution eligibility. Missing host capability stays `blocked`; local degradation may document the task but cannot authorize business-code execution or invent a session ID.
+
+Database access remains `sql-only`. Without explicit user authorization, output SQL and a plan only; do not connect, install a driver, or execute a statement.

package/init/xinyun-ai-init/rules/v1.11.0-acceleration.md

@@ -0,0 +1,27 @@
+# v1.11.0 initialization acceleration contract
+
+v1.11.0 accelerates control-plane initialization without weakening the v1.10.2 takeover gate.
+
+## Stages
+
+Run stages in this order: `preflight`, `fixed-materialization`, `control-plane`, `codegraph`, `bootstrap-snapshot`, `role-sessions`, `onboarding`, and `final-gate`. Each stage records `stageId`, `status`, `startedAt`, `finishedAt`, `durationMs`, `attempt`, `cacheHit`, `failureReason`, and `nextAction`.
+
+Stage states are `pending`, `running`, `completed`, `skipped`, `partial`, `blocked`, and `recovery-required`. Project states are `initializing`, `partial`, `blocked`, and `ready`. A failed required stage cannot be silently skipped or changed to `ready`.
+
+## Fixed materialization
+
+The package owns the fixed-file manifest and template hashes. Materialize only registered control files under `AGENTS.md`, `xinyun-ai/`, and `xinyun-ai-init/`. Compare baseline, current, and template hashes before writing. Missing files may be created; user-modified files become `conflict-pending`; unreadable or unverifiable files become `unknown`. Use a temporary file, complete write, and atomic rename.
+
+## Snapshot and cache
+
+Create one current-project bootstrap snapshot for the five roles to read. It must contain project identity, repository/workstream summary, detected framework evidence, CodeGraph status, scan budget, evidence, coverage, unverified scope, and a snapshot hash. It must never contain another project, raw secrets, tokens, passwords, private keys, or complete sensitive responses.
+
+Reuse requires a cache key over project identity, target version, fixed-template hash, CodeGraph index hash, snapshot hash, and role-binding summary. The default cache lifetime is 24 hours. Cache corruption, expiry, clock rollback, identity change, template change, CodeGraph change, snapshot change, or session evidence expiry exits the fast path and records `unknown` or revalidation.
+
+## Parallel role sessions
+
+Role-session creation may run with an effective concurrency of at most 3 by default. If the host cannot parallelize, fall back to serial execution and record `concurrencyFallback`. Each role remains independently bound and evidenced; a successful role never substitutes for a failed role. Same-domain tasks remain queued or blocked by the existing coordination rules.
+
+## Final gate
+
+Only a complete final gate may produce `projectStatus=ready`. The output must show completed stages, skipped stages, cache hits, parallelism, unverified scope, blockers, recovery actions, and forbidden operations. No business code, database, API, dependency, configuration, Git write, or npm publish operation is part of this acceleration feature.

package/init/xinyun-ai-init/templates/bootstrap-snapshot.template.json

@@ -0,0 +1,17 @@
+{
+  "schemaVersion": 1,
+  "snapshotId": "bootstrap-snapshot-template",
+  "projectRootHash": null,
+  "repositoryScopeHash": null,
+  "workstreams": [],
+  "detectedFrameworks": [],
+  "codeGraph": {"recordId": null, "status": "unknown", "indexHash": null, "checkedAt": null},
+  "scanBudget": {"maxDepth": 3, "maxFiles": 60, "maxMatches": 200},
+  "evidence": [],
+  "coverage": "unknown",
+  "unverifiedScope": [],
+  "snapshotHash": null,
+  "sensitiveScan": {"status": "not-run", "matches": []},
+  "createdAt": null,
+  "updatedAt": null
+}

package/init/xinyun-ai-init/templates/fixed-materialization.template.json

@@ -0,0 +1,12 @@
+{
+  "schemaVersion": 1,
+  "manifestId": "fixed-materialization-template",
+  "targetVersion": "1.11.0",
+  "sourcePackage": "@pm_zhousl/xinyun-ai-init",
+  "hashAlgorithm": "SHA-256",
+  "statusEnum": ["pending", "created", "updated", "skipped", "conflict-pending", "unknown", "failed"],
+  "files": [],
+  "atomicWrite": {"required": true, "tempFile": true, "completeWrite": true, "rename": true},
+  "createdAt": null,
+  "updatedAt": null
+}

package/init/xinyun-ai-init/templates/host-capabilities.template.json

@@ -7,6 +7,8 @@
   "statusEnum": ["available", "available-with-dependency", "unavailable", "permission-denied", "unknown", "not-checked", "not-verified", "failed"],
   "dependencyStatusEnum": ["not-required", "required", "authorized", "not-authorized", "unknown"],
   "capabilityRequiredFields": ["capabilityId", "detectionMethod", "status", "evidence", "dependencyStatus", "fallbackPlan", "usedTools", "unusedTools", "unverifiedScope", "failureReason", "checkedAt"],
+  "evidenceRequiredFields": ["evidenceType", "source", "summaryOrHash", "checkedAt"],
+  "unknownPolicy": "unknown-means-no-verifiable-evidence; never report verified or unavailable without evidence",
   "checkedAt": null,
   "capabilities": {
     "createRealSession": { "capabilityId": "createRealSession", "detectionMethod": "host-api", "status": "unknown", "evidence": [], "dependencyStatus": "unknown", "fallbackPlan": "local-degraded-no-fake-session-id", "usedTools": [], "unusedTools": [], "unverifiedScope": [], "failureReason": null, "checkedAt": null },

package/init/xinyun-ai-init/templates/init-result.template.json

@@ -6,8 +6,10 @@
   "attempt": 1,
   "mode": "initialization",
   "status": "pending",
+  "statusEnum": ["pending", "initializing", "completed", "partial", "blocked", "unknown", "failed", "cancelled"],
+  "statusSource": "xinyun-ai/current-task.md",
   "currentVersion": null,
-  "targetVersion": "1.10.1",
+  "targetVersion": "1.11.0",
   "idempotencyKey": null,
   "createdFiles": [],
   "updatedFiles": [],
@@ -16,7 +18,8 @@
   "blockedReason": null,
   "businessCodeChanged": {
     "value": "unknown",
-    "evidence": []
+    "evidence": [],
+    "evidenceSchema": ["evidenceType", "path", "beforeHash", "afterHash", "checkedAt"]
   },
   "upgradeStatus": "not-started",
   "lockStatus": "released",
@@ -33,6 +36,8 @@
   },
   "roleSessions": {
     "provider": "codex",
+    "orchestratorSessionId": null,
+    "orchestratorIdentityType": "orchestrator-session",
     "parentSessionId": null,
     "requiredRoleCount": 5,
     "createdCount": 0,
@@ -41,6 +46,16 @@
     "blockedCount": 0,
     "localDegradedCount": 0,
     "bindings": [],
+    "identityMapping": {
+      "hostThreadId": null,
+      "hostSessionId": null,
+      "projectSessionId": null,
+      "orchestratorSessionId": null,
+      "mappingStatus": "pending",
+      "identityEvidence": [],
+      "creationEvidence": []
+    },
+    "realAiSessionVerified": false,
     "hostCapability": "unknown",
     "degradationReason": null
   },
@@ -60,6 +75,11 @@
     "connected": false,
     "evidence": []
   },
+  "sensitiveScan": {
+    "status": "not-run",
+    "scannedOutputs": [],
+    "matches": []
+  },
   "codeGraph": {
     "codeGraphRecordId": null,
     "statusSource": "xinyun-ai/manifest.json",

package/init/xinyun-ai-init/templates/initialization-cache.template.json

@@ -0,0 +1,13 @@
+{
+  "schemaVersion": 1,
+  "cacheId": "initialization-cache-template",
+  "keyAlgorithm": "RFC8785-JCS-SHA-256",
+  "keyFields": ["projectRootHash", "targetVersion", "fixedTemplateHash", "codeGraphIndexHash", "snapshotHash", "roleBindingSummaryHash"],
+  "ttlHours": 24,
+  "statusEnum": ["valid", "expired", "corrupt", "unknown", "revalidate"],
+  "cacheKey": null,
+  "observedAt": null,
+  "expiresAt": null,
+  "invalidReason": null,
+  "sensitiveScan": {"status": "not-run", "matches": []}
+}

package/init/xinyun-ai-init/templates/initialization-stages.template.json

@@ -0,0 +1,18 @@
+{
+  "schemaVersion": 1,
+  "initializationId": "initialization-template",
+  "status": "initializing",
+  "statusEnum": ["initializing", "partial", "blocked", "ready"],
+  "stageStatusEnum": ["pending", "running", "completed", "skipped", "partial", "blocked", "recovery-required"],
+  "stages": [
+    {"stageId": "preflight", "status": "pending", "attempt": 0, "cacheHit": false, "startedAt": null, "finishedAt": null, "durationMs": null, "failureReason": null, "nextAction": null},
+    {"stageId": "fixed-materialization", "status": "pending", "attempt": 0, "cacheHit": false, "startedAt": null, "finishedAt": null, "durationMs": null, "failureReason": null, "nextAction": null},
+    {"stageId": "control-plane", "status": "pending", "attempt": 0, "cacheHit": false, "startedAt": null, "finishedAt": null, "durationMs": null, "failureReason": null, "nextAction": null},
+    {"stageId": "codegraph", "status": "pending", "attempt": 0, "cacheHit": false, "startedAt": null, "finishedAt": null, "durationMs": null, "failureReason": null, "nextAction": null},
+    {"stageId": "bootstrap-snapshot", "status": "pending", "attempt": 0, "cacheHit": false, "startedAt": null, "finishedAt": null, "durationMs": null, "failureReason": null, "nextAction": null},
+    {"stageId": "role-sessions", "status": "pending", "attempt": 0, "cacheHit": false, "startedAt": null, "finishedAt": null, "durationMs": null, "failureReason": null, "nextAction": null},
+    {"stageId": "onboarding", "status": "pending", "attempt": 0, "cacheHit": false, "startedAt": null, "finishedAt": null, "durationMs": null, "failureReason": null, "nextAction": null},
+    {"stageId": "final-gate", "status": "pending", "attempt": 0, "cacheHit": false, "startedAt": null, "finishedAt": null, "durationMs": null, "failureReason": null, "nextAction": null}
+  ],
+  "updatedAt": null
+}

package/init/xinyun-ai-init/templates/managed-baseline.template.json

@@ -3,13 +3,13 @@
   "hashAlgorithm": "sha256",
   "contentEncoding": "utf8-normalized",
   "managedBy": "@pm_zhousl/xinyun-ai-init",
-  "lastAppliedVersion": "1.10.1",
+  "lastAppliedVersion": "1.11.0",
   "files": [
     {
       "path": "xinyun-ai/rules/core-rules.md",
       "baselineHash": null,
       "templateHash": null,
-      "lastAppliedVersion": "1.10.1",
+      "lastAppliedVersion": "1.11.0",
       "managedBy": "@pm_zhousl/xinyun-ai-init",
       "status": "unknown"
     }

package/init/xinyun-ai-init/templates/manifest.template.json

@@ -1,6 +1,6 @@
 {
   "projectName": "",
-  "xinyunAiVersion": "1.10.1",
+  "xinyunAiVersion": "1.11.0",
   "scriptVersion": "2026.07.23",
   "schemaVersion": "1",
   "initializationMode": "fast",
@@ -94,7 +94,7 @@
     "bindings": "xinyun-ai/sessions/role-session-bindings.json",
     "bindingTemplate": "xinyun-ai-init/templates/role-session-binding.template.json",
     "parentSessionId": null,
-    "targetVersion": "1.10.1",
+    "targetVersion": "1.11.0",
     "requiredRoleCount": 5,
     "statusEnum": [
       "pending",
@@ -249,5 +249,19 @@
     "requiredRoleSessionBlockedReason": "required-role-session-not-created",
     "databaseDefault": { "authorization": "not-requested", "executionStatus": "needs-confirmation", "redactionStatus": "verified" },
     "readyRequires": ["projectIdentity", "codeGraph", "baseline", "teamResponsibility", "roleSessions", "taskTree", "localControlPlane", "legacyHandoff", "hostCapabilities", "sensitiveScan", "noHighRiskBlocker"]
+  },
+  "v111": {
+    "status": "implemented-in-package",
+    "capability": "initializationAcceleration",
+    "fixedMaterialization": "xinyun-ai/fixed-materialization.json",
+    "initializationStages": "xinyun-ai/initialization-stages.json",
+    "bootstrapSnapshot": "xinyun-ai/bootstrap-snapshot.json",
+    "initializationCache": "xinyun-ai/index/initialization-cache.json",
+    "parallelism": "xinyun-ai/sessions/parallelism.json",
+    "stageStatusEnum": ["pending", "running", "completed", "skipped", "partial", "blocked", "recovery-required"],
+    "projectStatusEnum": ["initializing", "partial", "blocked", "ready"],
+    "defaultRoleConcurrency": 3,
+    "cacheTtlHours": 24,
+    "cacheKeyAlgorithm": "RFC8785-JCS-SHA-256"
   }
 }

package/init/xinyun-ai-init/templates/parallelism.template.json

@@ -0,0 +1,13 @@
+{
+  "schemaVersion": 1,
+  "parallelismId": "parallelism-template",
+  "requestedConcurrency": 3,
+  "effectiveConcurrency": 0,
+  "maxConcurrency": 3,
+  "providerCapability": "unknown",
+  "concurrencyFallback": null,
+  "queueOrder": ["priority", "confirmedAt", "taskId"],
+  "roleRuns": [],
+  "startedAt": null,
+  "finishedAt": null
+}

package/init/xinyun-ai-init/templates/project-index.template.json

@@ -273,6 +273,20 @@
     "databaseDefault": { "authorization": "not-requested", "executionStatus": "needs-confirmation", "redactionStatus": "verified" },
     "readyRequires": ["projectIdentity", "codeGraph", "baseline", "teamResponsibility", "roleSessions", "taskTree", "localControlPlane", "legacyHandoff", "hostCapabilities", "sensitiveScan", "noHighRiskBlocker"]
   },
+  "v111": {
+    "status": "implemented-in-package",
+    "capability": "initializationAcceleration",
+    "fixedMaterialization": "xinyun-ai/fixed-materialization.json",
+    "initializationStages": "xinyun-ai/initialization-stages.json",
+    "bootstrapSnapshot": "xinyun-ai/bootstrap-snapshot.json",
+    "initializationCache": "xinyun-ai/index/initialization-cache.json",
+    "parallelism": "xinyun-ai/sessions/parallelism.json",
+    "stageStatusEnum": ["pending", "running", "completed", "skipped", "partial", "blocked", "recovery-required"],
+    "projectStatusEnum": ["initializing", "partial", "blocked", "ready"],
+    "defaultRoleConcurrency": 3,
+    "cacheTtlHours": 24,
+    "cacheKeyAlgorithm": "RFC8785-JCS-SHA-256"
+  },
   "requirementParsing": {
     "enabled": true,
     "trigger": "ambiguous_or_change_or_high_risk",

package/init/xinyun-ai-init/templates/requirement-packet.template.json

@@ -4,7 +4,7 @@
   "requirementId": null,
   "taskId": null,
   "projectRootHash": null,
-  "version": "1.10.1",
+  "version": "1.11.0",
   "status": "captured",
   "content": {
     "userQuote": null,

package/init/xinyun-ai-init/templates/role-session-binding.template.json

@@ -1,12 +1,22 @@
 {
   "schemaVersion": 1,
   "bindingId": "role-session-binding-template",
+  "identityType": "project-session",
   "taskId": "role-execution-task-template",
   "roleId": "project-owner",
   "sessionId": null,
   "parentSessionId": null,
   "provider": "codex",
-  "targetVersion": "1.10.1",
+  "identityMapping": {
+    "hostThreadId": null,
+    "hostSessionId": null,
+    "projectSessionId": null,
+    "orchestratorSessionId": null,
+    "mappingStatus": "pending",
+    "identityEvidence": [],
+    "creationEvidence": []
+  },
+  "targetVersion": "1.11.0",
   "projectRootHash": null,
   "workspaceScope": {"scopeType": "project-root", "scopePathHashes": [], "scopeRevision": null},
   "repositoryScopeHash": null,
@@ -49,11 +59,12 @@
     "fakeSessionIdProhibited": true
   },
   "audit": [],
+  "behaviorEvidence": [],
   "renameAudit": null,
   "displayName": null,
   "projectDisplayName": null,
   "roleDisplayName": null,
   "responsibilityLabel": null,
   "titleSource": "role-contract",
-  "titleVersion": "1.10.1"
+  "titleVersion": "1.11.0"
 }

package/init/xinyun-ai-init/templates/task-index.template.json

@@ -36,6 +36,18 @@
   },
   "tasks": [],
   "roleSessionBindings": [],
+  "orchestratorSessionId": null,
+  "statusSource": "xinyun-ai/current-task.md",
+  "statusConsistency": {
+    "sourceOfTruth": "task.status",
+    "legalCombinations": [
+      "task=completed,result=completed,lock=released",
+      "task=partial,result=partial,lock=released",
+      "task=blocked,result=blocked,lock=blocked|unknown",
+      "task=cancelled,result=cancelled,lock=released"
+    ],
+    "illegalCombinationAction": "blocked-and-stop-write"
+  },
   "archiveTransactions": [],
   "statusEnum": ["pending", "executing", "partial", "blocked", "completed", "cancelled"],
   "idleCurrentTask": {

package/init/xinyun-ai-init/templates/technical-impact-packet.template.json

@@ -4,7 +4,7 @@
   "requirementId": null,
   "taskId": null,
   "projectRootHash": null,
-  "version": "1.10.1",
+  "version": "1.11.0",
   "status": "not-started",
   "content": {
     "summary": null,

package/init/xinyun-ai-init/templates/technical-landscape.template.json

@@ -30,7 +30,7 @@
     "coverageEvidence": []
   },
   "status": "not-started",
-  "landscapeVersion": "1.10.1",
+  "landscapeVersion": "1.11.0",
   "contentHash": null,
   "sourceRevisions": [],
   "invalidatedBy": [],

package/init/xinyun-ai-init/version.json

@@ -1,7 +1,7 @@
 {
   "packageName": "xinyun-ai-init",
   "displayName": "欣芸技术开发 Agent 流初始化包",
-  "version": "1.10.1",
+  "version": "1.11.0",
   "scriptVersion": "2026.07.23",
   "schemaVersion": "1",
   "defaultMode": "fast-init",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pm_zhousl/xinyun-ai-init",
-  "version": "1.10.1",
+  "version": "1.11.0",
   "description": "欣芸技术开发 Agent 流初始化包",
   "bin": {
     "xinyun-ai-init": "bin/xinyun-ai-init.js"

package/scripts/verify-init-package.js

@@ -6,7 +6,7 @@ const crypto = require("crypto");
 
 const root = path.resolve(__dirname, "..");
 const initRoot = path.join(root, "init", "xinyun-ai-init");
-const CURRENT_VERSION = "1.10.1";
+const CURRENT_VERSION = "1.11.0";
 
 const checks = [];
 
@@ -1771,6 +1771,13 @@ function verifyV110Contracts() {
     "test-scenarios/fixtures/v1.10.0-takeover-gate-fixture/README.md",
     "test-scenarios/fixtures/v1.10.0-takeover-gate-fixture/before/project-status.json",
     "test-scenarios/fixtures/v1.10.0-takeover-gate-fixture/after/project-status.json",
+    "init/xinyun-ai-init/rules/v1.10.2-contract.md",
+    "init/xinyun-ai-init/rules/v1.11.0-acceleration.md",
+    "init/xinyun-ai-init/templates/fixed-materialization.template.json",
+    "init/xinyun-ai-init/templates/bootstrap-snapshot.template.json",
+    "init/xinyun-ai-init/templates/initialization-stages.template.json",
+    "init/xinyun-ai-init/templates/initialization-cache.template.json",
+    "init/xinyun-ai-init/templates/parallelism.template.json",
   ];
   for (const file of requiredFiles) requireFile(file);
 
@@ -1782,7 +1789,13 @@ function verifyV110Contracts() {
   const onboarding = JSON.parse(readText("init/xinyun-ai-init/templates/onboarding-report.template.json"));
   const baseline = JSON.parse(readText("init/xinyun-ai-init/templates/takeover-baseline.template.json"));
   const controlPlane = JSON.parse(readText("init/xinyun-ai-init/templates/control-plane-index.template.json"));
+  const taskIndex = JSON.parse(readText("init/xinyun-ai-init/templates/task-index.template.json"));
   const initResult = JSON.parse(readText("init/xinyun-ai-init/templates/init-result.template.json"));
+  const fixedMaterialization = JSON.parse(readText("init/xinyun-ai-init/templates/fixed-materialization.template.json"));
+  const bootstrapSnapshot = JSON.parse(readText("init/xinyun-ai-init/templates/bootstrap-snapshot.template.json"));
+  const initializationStages = JSON.parse(readText("init/xinyun-ai-init/templates/initialization-stages.template.json"));
+  const initializationCache = JSON.parse(readText("init/xinyun-ai-init/templates/initialization-cache.template.json"));
+  const parallelism = JSON.parse(readText("init/xinyun-ai-init/templates/parallelism.template.json"));
   const currentTask = readText("init/xinyun-ai-init/templates/current-task.template.md");
 
   const paths = {
@@ -1808,6 +1821,14 @@ function verifyV110Contracts() {
   addCheck("v1.10 baseline schema", baseline.hashAlgorithm === "SHA-256" && baseline.git.writePerformed === false && baseline.businessFiles && baseline.controlFiles, "baseline hashes and read-only Git");
   addCheck("v1.10 control-plane schema", controlPlane.atomicWriteContract && controlPlane.atomicWriteContract.tempFileRequired === true && controlPlane.atomicWriteContract.fsyncBeforeRename === true && controlPlane.idempotency && controlPlane.idempotency.duplicatePolicy === "reuse-and-audit", "atomic/idempotent control plane");
   addCheck("v1.10 init-result database default", initResult.databaseAuthorization && initResult.databaseAuthorization.authorization === "not-requested" && initResult.databaseAuthorization.executionStatus === "needs-confirmation" && initResult.databaseAuthorization.redactionStatus === "verified" && initResult.databaseAuthorization.connected === false, "init-result database default");
+  addCheck("v1.10.2 identity separation", initResult.roleSessions && initResult.roleSessions.orchestratorIdentityType === "orchestrator-session" && initResult.roleSessions.identityMapping && ["hostThreadId", "hostSessionId", "projectSessionId", "orchestratorSessionId", "mappingStatus", "identityEvidence", "creationEvidence"].every((field) => Object.prototype.hasOwnProperty.call(initResult.roleSessions.identityMapping, field)), "host/project/orchestrator identity map");
+  addCheck("v1.10.2 result evidence schema", initResult.businessCodeChanged && initResult.businessCodeChanged.value === "unknown" && JSON.stringify(initResult.businessCodeChanged.evidenceSchema) === JSON.stringify(["evidenceType", "path", "beforeHash", "afterHash", "checkedAt"]) && initResult.roleSessions.realAiSessionVerified === false, "business-change evidence and real session gate");
+  addCheck("v1.10.2 task status source", taskIndex && taskIndex.statusConsistency && taskIndex.statusConsistency.sourceOfTruth === "task.status" && taskIndex.statusConsistency.illegalCombinationAction === "blocked-and-stop-write", "cross-file status source");
+  addCheck("v1.11 fixed materialization schema", fixedMaterialization.targetVersion === "1.11.0" && fixedMaterialization.hashAlgorithm === "SHA-256" && fixedMaterialization.atomicWrite && fixedMaterialization.atomicWrite.rename === true && fixedMaterialization.statusEnum.includes("conflict-pending"), "fixed template conflict contract");
+  addCheck("v1.11 initialization stages schema", initializationStages.stageStatusEnum.includes("recovery-required") && JSON.stringify(initializationStages.stages.map((stage) => stage.stageId)) === JSON.stringify(["preflight", "fixed-materialization", "control-plane", "codegraph", "bootstrap-snapshot", "role-sessions", "onboarding", "final-gate"]), "ordered initialization stages");
+  addCheck("v1.11 snapshot and cache schema", bootstrapSnapshot.scanBudget.maxDepth === 3 && Array.isArray(bootstrapSnapshot.unverifiedScope) && initializationCache.ttlHours === 24 && initializationCache.keyAlgorithm === "RFC8785-JCS-SHA-256", "bounded snapshot and expiring cache");
+  addCheck("v1.11 parallelism schema", parallelism.maxConcurrency === 3 && parallelism.requestedConcurrency === 3 && parallelism.queueOrder.includes("taskId"), "parallel role-session limit");
+  addCheck("v1.11 registry paths", manifest.v111 && projectIndex.v111 && manifest.v111.fixedMaterialization === "xinyun-ai/fixed-materialization.json" && projectIndex.v111.initializationStages === "xinyun-ai/initialization-stages.json" && manifest.v111.defaultRoleConcurrency === 3 && manifest.v111.cacheTtlHours === 24, "v1.11 manifest/project-index paths");
   addCheck("v1.10 database defaults across control plane", manifest.v110 && projectIndex.v110 && JSON.stringify(manifest.v110.databaseDefault) === JSON.stringify(projectIndex.v110.databaseDefault) && JSON.stringify(manifest.v110.databaseDefault) === JSON.stringify({ authorization: "not-requested", executionStatus: "needs-confirmation", redactionStatus: "verified" }) && preflight.database && preflight.database.authorization === manifest.v110.databaseDefault.authorization && preflight.database.executionStatus === manifest.v110.databaseDefault.executionStatus && preflight.database.redactionStatus === manifest.v110.databaseDefault.redactionStatus && initResult.databaseAuthorization && initResult.databaseAuthorization.authorization === manifest.v110.databaseDefault.authorization && initResult.databaseAuthorization.executionStatus === manifest.v110.databaseDefault.executionStatus && initResult.databaseAuthorization.redactionStatus === manifest.v110.databaseDefault.redactionStatus, "database defaults agree across manifest/project-index/preflight/init-result");
   verifyV110CodeGraphContract(manifest, projectIndex, preflight, onboarding, initResult, currentTask);
   verifyV110HostCapabilityContract(host, projectStatus);

package/scripts/verify-rules-package.js

@@ -5,7 +5,7 @@ const os = require("os");
 const path = require("path");
 const { spawnSync } = require("child_process");
 
-const VERSION = "1.10.1";
+const VERSION = "1.11.0";
 const checks = [];
 
 function parseArgs(argv) {
@@ -405,7 +405,7 @@ function validateV17Content(root, target) {
   requireIncludes(root, target, "init/xinyun-ai-init/rules/frameworks/backend/php/thinkphp.md", ["v1.7 ThinkPHP 深化模块", "frameworkStatus=confirmed", "moduleStatus=loaded", "Controller", "Request/Validate", "Service", "Model/ORM", "Middleware", "队列"]);
   requireIncludes(root, target, "test-scenarios/scenarios.md", ["当前必测场景为 1-133", "当前观察场景为 106 和 119", "## 55. verify:rules 正常通过", "## 69. verify:rules JSON schema 和重复执行"]);
   requireIncludes(root, target, "test-scenarios/review-template.md", ["55. verify:rules 正常通过", "69. verify:rules JSON schema 和重复执行", "97. Skill 触发测试"]);
-  requireIncludes(root, target, "test-scenarios/README.md", ["npm run verify:rules", "pm_zhousl-xinyun-ai-init-1.10.1.tgz", "v1.7.2-scenarios.md", "v1.7.3-scenarios.md", "当前版本必测场景为 `scenarios.md` 的 1-133", "106 和 119 为观察项"]);
+  requireIncludes(root, target, "test-scenarios/README.md", ["npm run verify:rules", "v1.7.2-scenarios.md", "v1.7.3-scenarios.md", "v1.10.2-scenarios.md", "当前版本必测场景为 `scenarios.md` 的 1-133", "106 和 119 为观察项"]);
 }
 
 function validateV18Content(root, target) {
@@ -700,6 +700,36 @@ function validateV110HostCapabilityContract(target, host, projectStatus) {
   addCheck(target, "v1.10.project-ready-capability-gate", "schema", projectStatus.readyPolicy && blockedStatuses.every((status) => projectStatus.readyPolicy.requiredCapabilityBlockedStatuses.includes(status)) && projectStatus.readyPolicy.availableWithDependencyRequires.includes("dependencyStatus=authorized") ? "pass" : "fail", "project-status.template.json", "readyPolicy", "dependency and unknown statuses block ready", projectStatus.readyPolicy, "Project ready capability gate checked.", "Block ready for unavailable or unverified capabilities.");
 }
 
+function validateV111Content(root, target) {
+  const manifest = readJson(root, "init/xinyun-ai-init/templates/manifest.template.json");
+  const projectIndex = readJson(root, "init/xinyun-ai-init/templates/project-index.template.json");
+  const fixedMaterialization = readJson(root, "init/xinyun-ai-init/templates/fixed-materialization.template.json");
+  const bootstrapSnapshot = readJson(root, "init/xinyun-ai-init/templates/bootstrap-snapshot.template.json");
+  const stages = readJson(root, "init/xinyun-ai-init/templates/initialization-stages.template.json");
+  const cache = readJson(root, "init/xinyun-ai-init/templates/initialization-cache.template.json");
+  const parallelism = readJson(root, "init/xinyun-ai-init/templates/parallelism.template.json");
+  const stageIds = ["preflight", "fixed-materialization", "control-plane", "codegraph", "bootstrap-snapshot", "role-sessions", "onboarding", "final-gate"];
+  const stageStatuses = ["pending", "running", "completed", "skipped", "partial", "blocked", "recovery-required"];
+  const paths = {
+    fixedMaterialization: "xinyun-ai/fixed-materialization.json",
+    initializationStages: "xinyun-ai/initialization-stages.json",
+    bootstrapSnapshot: "xinyun-ai/bootstrap-snapshot.json",
+    initializationCache: "xinyun-ai/index/initialization-cache.json",
+    parallelism: "xinyun-ai/sessions/parallelism.json",
+  };
+  for (const [key, expected] of Object.entries(paths)) {
+    addCheck(target, "v1.11.registry." + key, "registry", manifest.v111 && projectIndex.v111 && manifest.v111[key] === expected && projectIndex.v111[key] === expected ? "pass" : "fail", "manifest/project-index.v111", key, expected, {manifest: manifest.v111 && manifest.v111[key], projectIndex: projectIndex.v111 && projectIndex.v111[key]}, "v1.11 path registration checked.", "Register the v1.11 control path.");
+  }
+  addCheck(target, "v1.11.stage-schema", "schema", JSON.stringify(stages.stages.map((stage) => stage.stageId)) === JSON.stringify(stageIds) && JSON.stringify(stages.stageStatusEnum) === JSON.stringify(stageStatuses), "initialization-stages.template.json", "stages/status", stageIds, stages, "Initialization stage order and states checked.", "Restore the fixed v1.11 stage contract.");
+  addCheck(target, "v1.11.fixed-materialization", "schema", fixedMaterialization.targetVersion === "1.11.0" && fixedMaterialization.statusEnum.includes("conflict-pending") && fixedMaterialization.atomicWrite && fixedMaterialization.atomicWrite.rename === true, "fixed-materialization.template.json", "conflict/atomic write", "conflict-pending and atomic rename", fixedMaterialization, "Fixed materialization contract checked.", "Block overwrite and use atomic writes.");
+  addCheck(target, "v1.11.snapshot-cache", "schema", bootstrapSnapshot.scanBudget.maxDepth === 3 && Array.isArray(bootstrapSnapshot.unverifiedScope) && cache.ttlHours === 24 && cache.keyAlgorithm === "RFC8785-JCS-SHA-256", "bootstrap-snapshot/initialization-cache", "budget/cache", "depth=3/ttl=24/JCS", {snapshot: bootstrapSnapshot, cache}, "Bounded snapshot and cache contract checked.", "Restore bounded cache behavior.");
+  addCheck(target, "v1.11.parallelism", "schema", parallelism.maxConcurrency === 3 && parallelism.requestedConcurrency === 3 && manifest.v111.defaultRoleConcurrency === 3, "parallelism.template.json", "maxConcurrency", 3, parallelism, "Parallel role-session limit checked.", "Keep the default concurrency at three.");
+  requireFile(root, target, "init/xinyun-ai-init/rules/v1.10.2-contract.md");
+  requireFile(root, target, "init/xinyun-ai-init/rules/v1.11.0-acceleration.md");
+  requireIncludes(root, target, "init/xinyun-ai-init/README.md", ["v1.10.2", "v1.11.0", "最多 3 个角色并发"]);
+  requireIncludes(root, target, "init/xinyun-ai-init/rules/init-rules.md", ["v1.10.2 and v1.11.0 gate", "fixed-materialization", "bootstrap-snapshot"]);
+}
+
 function validateJsonFiles(root, target) {
   const jsonFiles = [
     "package.json",
@@ -748,6 +778,7 @@ function validateRoot(root, target, isTarball = false) {
   validateV18Content(root, target);
   validateV19Content(root, target);
   validateV110Content(root, target);
+  validateV111Content(root, target);
   validateJsonFiles(root, target);
 }
 

package/test-scenarios/README.md

@@ -97,6 +97,14 @@ npm run verify:init
 
 除 `scenarios.md` 外，发布前必须逐条执行 `v1.7.3-scenarios.md`。重点验证 Codex 主会话在 5 个 `role-execution` 本地任务之后创建或明确降级 5 个真实角色子会话，真实 `sessionId` 回写一致，创建后先进入只读 onboarding，重复升级复用，宿主不支持时使用 `local-degraded-no-fake-session-id` 且不得伪造 sessionId。
 
+## v1.10.2 真实角色任务会话绑定回归
+
+除 `scenarios.md` 外，发布前必须逐条执行 `v1.10.2-scenarios.md`。重点验证独立主调度会话、5 个真实角色任务会话、`hostThreadId`/`hostSessionId`/项目 `sessionId` 映射、v1.9 八字段项目隔离幂等键、授权门禁、真实请求/响应证据和失败恢复。只有五个角色均有完整真实证据时才能进入 `ready`；不能把宿主线程 ID、任务 ID 或回放材料当作项目 `sessionId`。
+
+## v1.11.0 初始化加速回归
+
+除 `scenarios.md` 外，发布前必须逐条执行 `v1.11.0-scenarios.md`。重点验证固定基础文件预置、模板哈希冲突保护、分阶段初始化、公共项目快照、最多 3 个角色会话并行、缓存复用、断点恢复、状态域隔离和最终门禁。主项目 `xinyun-ai/`、主项目任务和主项目会话不得进入 npm tarball。
+
 ## 审查原则
 
 ## v1.8 多会话协作回归

package/test-scenarios/v1.10.2-scenarios.md

@@ -0,0 +1,38 @@
+# v1.10.2 测试场景
+
+本文件用于测试审查员和开发/回归负责人执行 v1.10.2 的真实行为验收。结构校验只能证明文件契约，不得替代真实会话创建、发送、接收和状态查询。
+
+## 通用证据要求
+
+每个场景必须保存：场景 ID、输入、授权记录、宿主调用摘要、requestId/responseId、身份映射记录、before/after 控制面快照哈希、changedFiles、禁止操作、结果状态、`realAiSessionVerified`、`sensitiveScan`、失败原因和检查时间。不得保存 Token、密码、私钥、`.env` 敏感值或完整敏感响应。
+
+## 场景清单
+
+| ID | 场景 | 预期结果 |
+|---|---|---|
+| 1102-01 | 新项目、完整授权、宿主支持创建/发送/接收/状态/恢复 | 创建主会话和 5 个角色会话；5 个绑定均 `verified`；项目可 `ready` |
+| 1102-02 | 宿主只返回 `hostThreadId` | `hostSessionId` 和项目 `sessionId` 为 `null`；绑定 `unbound`；项目 `blocked` |
+| 1102-03 | 宿主返回 `hostSessionId` 但缺少接收或恢复能力 | 记录能力状态和未验证范围；项目 `blocked`，不得伪造完整闭环 |
+| 1102-04 | 主会话创建或绑定失败 | 不伪造 `orchestratorSessionId`；任务保持阻断；失败可按幂等键恢复 |
+| 1102-05 | 单个角色创建/复用失败 | 其他角色绑定和证据保留；失败角色 `failed/blocked`；不写 `ready` |
+| 1102-06 | 发送或接收失败 | 保存请求/响应摘要哈希和失败原因；角色可重试；不写完成结果 |
+| 1102-07 | 同一角色连续重试达到上限 | `attempt`、`lastFailureReason`、`recoveryStatus=failed` 完整；等待人工决定 |
+| 1102-08 | 写回中途失败或控制文件半写 | 原子写入不产生可消费半写；恢复事务记录 before/after 哈希；不覆盖历史 |
+| 1102-09 | 同项目重复初始化 | 八字段项目隔离键相同；复用原 taskId/binding/sessionId；不创建重复会话 |
+| 1102-10 | 两个项目 task/role/provider/version 全相同 | `projectRootHash` 或其他项目身份字段不同；拒绝复用，分别创建/保持独立 |
+| 1102-11 | 五个角色错误共享一个 sessionId 或主会话冒充角色会话 | 唯一性校验失败；项目 `blocked`；主会话与角色会话关系可审计 |
+| 1102-12 | 未提供真实会话创建授权 | 不调用真实创建；记录 `userConfirmationId` 缺失和授权范围不足；项目 `blocked` |
+| 1102-13 | 真实证据缺 request/response、快照哈希或敏感扫描 | 证据 `unverified`/`failed`；项目 `blocked`；不得以文本说明补齐 |
+| 1102-14 | 已关闭但仍有有效历史绑定 | 仅按项目身份、角色和能力证据判断可复用；否则新建并保留历史 |
+| 1102-15 | 任务、绑定、索引、初始化结果 sessionId 不一致 | 一致性校验失败；统一进入 `blocked`，停止继续写入 |
+| 1102-16 | 普通咨询而非初始化/接管升级 | 不创建主会话和 5 个角色会话，不改变项目接管状态 |
+| 1102-17 | 全量回归边界 | CLI、规则包和证据流程不修改业务代码，不执行 SQL/Git 写操作，不安装依赖，不 npm publish |
+| 1102-18 | 单角色重试达到默认上限 | 第 3 次失败后保持 `blocked`，`attempt=3`；未获用户确认不得第 4 次自动尝试 |
+| 1102-19 | 关闭会话历史复用判定 | 项目状态保持 `pending`，另以 `reuseDecision=reusable` 表示复用判断；不把 `reusable` 当作未定义项目状态 |
+
+## 审查结论规则
+
+- 1102-01 只有在全部真实证据齐全时才可通过。
+- 1102-02 至 1102-15、1102-18、1102-19 任一门禁行为错误，均为发布阻断。
+- 1102-16 和 1102-17 用于确认范围没有扩张。
+- 任何出现伪造 `sessionId`、跨项目复用、未授权创建、敏感信息落盘或业务/Git/数据库写操作，直接判定不通过。

package/test-scenarios/v1.11.0-scenarios.md

@@ -0,0 +1,30 @@
+# v1.11.0 测试场景
+
+## 通用要求
+
+每个场景保存输入、授权范围、阶段状态、before/after 快照哈希、changedFiles、缓存命中、并发情况、禁止操作、结果状态和敏感扫描结果。测试材料不得包含主项目会话、Token、密码、私钥或完整敏感响应。
+
+| ID | 场景 | 预期结果 |
+|---|---|---|
+| 1110-01 | 全新项目固定文件预置 | 固定文件从包模板物化，AI 不重新生成规则正文；目标项目只产生授权范围内文件 |
+| 1110-02 | tarball 内容边界 | 包含固定模板、规则和测试材料；不包含主项目 `xinyun-ai/`、主项目任务或会话 |
+| 1110-03 | 用户修改固定文件后升级 | 识别模板哈希变化，进入 `conflict-pending`，不覆盖用户内容 |
+| 1110-04 | 固定文件缺失或不可读 | 缺失可补齐；不可读为 `unknown`，不强制覆盖 |
+| 1110-05 | 分阶段成功 | 7 个阶段按顺序记录状态、耗时、缓存命中和证据，最终通过门禁才 `ready` |
+| 1110-06 | CodeGraph 初始化失败 | 记录失败和下一步动作；项目为 `partial`/`blocked`，不得伪造完成 |
+| 1110-07 | 公共快照复用 | 5 个角色读取同一快照哈希，不重复全量扫描；快照证据来自当前项目 |
+| 1110-08 | 宿主支持 3 并发角色会话 | 不超过 3 个并发；5 个角色均独立绑定和记录真实证据 |
+| 1110-09 | 宿主不支持并发 | 串行降级并记录 `concurrencyFallback`，不重复创建和不伪造并发完成 |
+| 1110-10 | 第二次重复初始化 | 项目身份和快照未变时走健康检查/复用，不重复 onboarding 或创建会话 |
+| 1110-11 | 阶段中断后恢复 | 复用原 taskId、bindingId 和幂等键，从未完成阶段继续，不覆盖历史 |
+| 1110-12 | 最终门禁失败 | 角色、证据、授权或索引任一失败时保持 `partial`/`blocked`，不输出 `ready` |
+| 1110-13 | 边界回归 | 不修改业务代码、数据库、API、配置、依赖，不执行 Git 写操作或 npm publish |
+| 1110-14 | 固定文件清单字段/路径/哈希错误 | 缺字段、路径越界、模板哈希不匹配时拒绝物化并记录 `failed`/`unknown` |
+| 1110-15 | 阶段非法状态流转 | 非法状态组合或跨域覆盖被拒绝；恢复必须从 `recovery-required` 重新进入 `running` |
+| 1110-16 | 公共快照预算和证据不足 | 记录预算、覆盖范围和 `unverifiedScope`；缺证据为 `unknown`，不宣称完整理解 |
+| 1110-17 | 快速路径缓存失效 | 24 小时过期、项目/模板/CodeGraph/快照/会话变化时退出复用路径并重新校验 |
+| 1110-18 | 并发角色失败或写回冲突 | 不超过有效并发上限；失败角色独立阻断和恢复，不用其他角色结果替代 |
+
+## 发布阻断
+
+固定模板覆盖用户文件、主项目内容进入 tarball、状态域混用、快照无证据却声称完整、并发重复创建、断点恢复重复执行、伪造 `ready` 或任何禁止操作，均为发布阻断。