@pm_zhousl/xinyun-ai-init 1.12.1 → 1.13.1

package/init/xinyun-ai-init/README.md

@@ -2,7 +2,7 @@
 
 本目录是“欣芸技术开发 Agent 流”的初始化包，负责把完整 AI 执行要求下发到目标项目。
 
-当前规则版本：`1.12.1`。
+当前规则版本：`1.13.1`。
 
 ## Codex 一句话入口
 
@@ -1137,7 +1137,7 @@ CodeGraph 唯一状态源为 `xinyun-ai/manifest.json` 的 `codeGraphRequired`
 
 `projectStatus` 固定为 `not-started/initializing/partial/blocked/ready`。只有全部 `requiredGates` 通过且无高风险阻塞时才允许 `executionEligible=true`。缺少真实角色会话时必须 `blocked + blockedReason=required-role-session-not-created`，不得伪造 `sessionId`。
 
-Git none、无测试框架和工具链未检测只登记 `not-available/not-detected`、证据和 `unverifiedScope`，不伪造通过且不自动安装依赖。数据库默认 `authorization=not-requested`、`executionStatus=needs-confirmation`、`redactionStatus=verified`；未明确授权不得连接数据库或执行 SQL，只输出 SQL 计划。所有敏感信息不得写入任务、日志、交接单、JSON、Markdown 或 stdout/stderr。
+Git none、无测试框架和工具链未检测只登记 `not-available/not-detected`、证据和 `unverifiedScope`，不伪造通过且不自动安装依赖。数据库默认 `authorization=not-requested`、`executionStatus=needs-confirmation`、`redactionStatus=verified`；普通初始化不扫描数据库文件。数据库相关任务只读项目内受限的 SQL/schema/migration/model 文本文件，不连接本地或线上数据库、不查询真实数据、不执行 SQL。所有敏感信息不得写入任务、日志、交接单、JSON、Markdown 或 stdout/stderr。
 
 ## v1.9 项目会话隔离、总工全景与数据库授权
 
@@ -1149,6 +1149,6 @@ Git none、无测试框架和工具链未检测只登记 `not-available/not-dete
 
 总工维护 `xinyun-ai/technical-landscape.json`，主会话维护 `xinyun-ai/packets/requirement-packet.json`，总工返回 `xinyun-ai/packets/technical-impact-packet.json`。技术全景只有 `coverageStatus=full`、`unverifiedScope=[]` 且核心对象都有有效证据时才可 `ready`；`partial/unknown` 不得写成 ready。两个 packet 必须关联同一 requirementId、taskId、projectRootHash 和 version，使用 RFC 8785 JCS-SHA-256；关联内容变化时写入 `blockedReason=packet-stale` 并重新确认。
 
-数据库默认 `databaseAccessMode=sql-only`。未明确授权连接时只输出 SQL，不连接、不读取真实数据、不执行 SQL、不安装驱动。连接、只读查询、结构变更和数据修改权限独立记录；四类授权状态固定为 `not-requested/requested/authorized/denied/expired/failed/unknown`，脱敏状态固定为 `verified/unverified/failed`。执行前校验规范化 SQL、参数、方言、targetEnvironment、授权范围和 `statementHash`。授权过期或输入变化时回到 `executionStatus=needs-confirmation`，受影响授权进入 `expired` 并追加 audit。
+数据库正式模式为 `databaseAccessMode=local-files-read-only`，`legacyDatabaseAccessMode=sql-only` 仅为兼容标识；`sqlExecutionMode=generate-only`。只有数据库相关任务才读取项目内 `*.sql`、`*.ddl`、`*.schema`、`*.migration` 以及 `database/`、`migrations/`、`schema/`、`models/` 下的文本文件。严禁连接本地或线上数据库、打开 SQLite/数据库服务、查询真实数据、执行 SQL、migration、seed 或修改数据，也不自动安装驱动。连接、只读查询、结构变更和数据修改权限仍独立记录；四类授权状态固定为 `not-requested/requested/authorized/denied/expired/failed/unknown`，脱敏状态固定为 `verified/unverified/failed`。SQL 只作为 review 计划输出，需校验规范化 SQL、参数、方言、targetEnvironment、授权范围和 `statementHash`；授权过期或输入变化时回到 `executionStatus=needs-confirmation`，受影响授权进入 `expired` 并追加 audit。
 
 v1.9 不自动复用其他项目会话、不自动连接或修改数据库、不扩大 HTML 迁移范围，不执行 Git 写操作或 npm publish。

package/init/xinyun-ai-init/rules/directory-self-completion.md

@@ -62,6 +62,7 @@ When takeover initialization is authorized, create `host-preflight.json`, `index
 - 绑定目录只保存 Codex 宿主返回的真实 `sessionId` 摘要、onboarding 状态、失败原因和 audit，不保存伪造 sessionId。
 - 宿主不支持创建子会话时，仍可补齐本地目录和降级记录，状态使用 `local-degraded-no-fake-session-id`。
 - v1.12.1 provider 绑定记录固定写入 `xinyun-ai/sessions/provider-session-bindings.json`，模板来源为 `xinyun-ai-init/templates/provider-session-binding.template.json`。只有宿主 canonical `providerSessionId`、身份/交互证据和独占占用均通过时才可绑定；未知或普通线程 ID 保持 blocked/pending。
+- v1.13.0 按需补齐 `provider-adapter.json`、`manual-session-recovery.json` 和 `index/initialization-change-report.json`；宿主预检失败时只生成恢复引导和阻断记录，不先执行大规模 CodeGraph 扫描。
 
 ## v1.8 按需目录
 

package/init/xinyun-ai-init/rules/init-rules.md

@@ -4,6 +4,10 @@
 
 Use the provider-specific binding contract before role-session work. `providerSessionId` must be a provider canonical session value, not a normal thread ID. Identity and interaction evidence are required for binding; missing evidence remains pending or blocked.
 
+v1.13.0 preflight is a hard early gate. Check all adapter operations before large CodeGraph analysis; on host failure preserve tasks, emit manual recovery prompts, and record `codeGraphDeferred=true`.
+
+After an automatic role-session failure, the user decision gate offers `manual-create`, `defer`, and `redetect` exactly once. No decision means blocked state with no fake binding and no repeated prompt. Manual recovery requires the explicit confirmation `已创建，继续绑定`; defer preserves all task, snapshot, CodeGraph and recovery IDs; redetect runs only host preflight. Ready requires all five real role bindings and onboarding.
+
 - 首次只创建最小 `xinyun-ai/` 骨架和极简 `AGENTS.md`。
 - 首次不创建大量规则、模板、脚本和业务沉淀目录。
 - 首次不执行语言级语法检查、lint、typecheck、测试或构建命令。
@@ -107,7 +111,7 @@ Run the seven-capability host preflight before role sessions. Materialize the ma
 - 接管基线记录业务文件哈希、控制文件哈希、未提交 Git、已有任务/会话和旧 AI 文档。旧沉淀必须分类为 adopted/pending-confirmation/not-adopted，敏感原文不得落盘。
 - 五个角色和主任务必须有父子任务、状态、下一步和真实 sessionId；缺失角色会话固定 `blockedReason=required-role-session-not-created`，不得伪造 sessionId。
 - `projectStatus` 只有在所有 requiredGates 通过、敏感扫描通过且无高风险阻塞时才可为 ready；executionEligible 必须同时为 true。
-- Git none、无测试框架、工具链未检测只记录 not-available/not-detected 和 unverifiedScope；数据库默认 `authorization=not-requested`、`executionStatus=needs-confirmation`、`redactionStatus=verified`，未经确认不得连接或执行 SQL。
+- Git none、无测试框架、工具链未检测只记录 not-available/not-detected 和 unverifiedScope；数据库默认 `authorization=not-requested`、`executionStatus=needs-confirmation`、`redactionStatus=verified`。普通初始化不扫描数据库文件；数据库相关任务仅只读项目内 SQL/schema/migration/model 文本，不连接本地或线上数据库、不查询真实数据、不执行 SQL。
 
 ## v1.9 初始化项目身份与联合门禁
 
@@ -115,7 +119,7 @@ Run the seven-capability host preflight before role sessions. Materialize the ma
 
 会话候选状态固定为 `reusable/renamed/duplicate-not-primary/other-project/unknown/not-reusable/requires-confirmation`，只有 reusable 或有完整改名 audit 的 renamed 才能绑定。其他项目会话不得展示或复用，中文展示名使用项目简称、角色中文名和职责名称。
 
-技术全景只有 full coverage、空 unverifiedScope 和核心证据完整时才可 ready；partial/unknown 不得 ready。requirementPacket 与 technicalImpactPacket 必须同项目、task、版本和 hash；失效时进入 `packet-stale` 并阻断执行。数据库默认 `sql-only`，连接、查询、结构变更和数据修改分别授权，每条 SQL 必须校验 statementHash 和目标环境。
-- v1.9 fields: `sessionMatchStatus`、`selectionEvidence`、`项目简称｜角色中文名｜职责名称`、`coverageStatus=full`、`databaseAccessMode=sql-only`、`targetEnvironment`。
+技术全景只有 full coverage、空 unverifiedScope 和核心证据完整时才可 ready；partial/unknown 不得 ready。requirementPacket 与 technicalImpactPacket 必须同项目、task、版本和 hash；失效时进入 `packet-stale` 并阻断执行。数据库正式为 `local-files-read-only`，`sql-only` 仅为兼容标识；只读本地数据库相关文本文件，SQL 仅生成供审阅，连接、查询、结构变更和数据修改均禁止，每条 SQL 必须校验 statementHash 和目标环境。
+- v1.9 fields: `sessionMatchStatus`、`selectionEvidence`、`项目简称｜角色中文名｜职责名称`、`coverageStatus=full`、`databaseAccessMode=local-files-read-only`、`legacyDatabaseAccessMode=sql-only`、`targetEnvironment`。
 
 共享事实和 Skill 文件使用临时文件、完整校验和原子重命名。前端审计默认只读；临时会话只有用户确认的代码任务才可创建。不得修改业务代码、数据库、API、依赖、Git 或发布配置。

package/init/xinyun-ai-init/rules/session-workbench.md

@@ -6,6 +6,12 @@ Read `v1.12.1-provider-session-binding.md` before role-session work. `providerSe
 
 Recovery reuses taskId and roleTaskId, increments attempt, and enters `recovery-required` after a writeback failure without creating duplicates. Unsupported hosts use `local-degraded` with `providerSessionId=null`; never fabricate a session ID.
 
+## v1.13.0 host adapter preflight
+
+Automatic session failure enters a one-time user decision gate: `manual-create`, `defer`, or `redetect`. Manual creation outputs all five role prompts and binds only after `已创建，继续绑定` plus canonical provider ID and identity/interaction evidence. Defer preserves task and snapshot IDs; redetect does host preflight only. Until all five role sessions complete onboarding, keep the project blocked.
+
+Run the provider adapter preflight for create/reuse/send/receive/query-status/recover/close/control-file access before broad CodeGraph work. Any required unknown, unavailable, permission-denied, failed, not-verified, or dependency-gated capability blocks the role-session stage and defers the expensive scan. Unsupported hosts emit the five-role manual recovery guide and preserve original task IDs.
+
 首次初始化不创建会话工作台。复杂任务中可按需创建：
 
 ```md
@@ -313,5 +319,5 @@ Record all seven host capabilities before role sessions. `available-with-depende
 
 总工交接必须引用 technical-landscape、requirementPacket 和 technicalImpactPacket 的 ID、版本、sourceRevision 和 RFC8785 JCS-SHA-256 hash；任一 hash 失效时状态为 blocked、原因 packet-stale。技术全景 partial/unknown 不得写为 ready。
 
-数据库交接必须记录 `databaseAccessMode=sql-only`、四类授权、授权状态 `not-requested/requested/authorized/denied/expired/failed/unknown`、`statementHash`、targetEnvironment、`executionStatus`、`redactionStatus=verified/unverified/failed` 和完整 audit；授权变化后不得继续执行旧 SQL，执行状态回到 `needs-confirmation`。
+数据库交接必须记录 `databaseAccessMode=local-files-read-only`、`legacyDatabaseAccessMode=sql-only`、`sqlExecutionMode=generate-only`、四类授权、授权状态 `not-requested/requested/authorized/denied/expired/failed/unknown`、`statementHash`、targetEnvironment、`executionStatus`、`redactionStatus=verified/unverified/failed` 和完整 audit。仅允许按需读取本地 SQL/schema/migration/model 文本文件，严禁连接数据库或执行 SQL；授权变化后不得继续执行旧 SQL，执行状态回到 `needs-confirmation`。
 - v1.9 fields: `lexical-fallback`、`duplicate-not-primary`、`项目简称｜角色中文名｜职责名称`、`coverageStatus=full`、`RFC 8785 JCS-SHA-256`。

package/init/xinyun-ai-init/rules/upgrade-rules.md

@@ -4,6 +4,10 @@
 
 Validate provider canonical session identity, project identity, role/task, title/cwd, interaction evidence, and exclusive occupancy before reuse. Unknown or missing evidence is blocked; ordinary thread IDs cannot be reused. Writeback recovery reuses the original task IDs, increments attempt, and cannot create duplicate sessions.
 
+v1.13.0 upgrades must compare initialization and pre-existing user changes by before/after hashes. Never replace an unverified old session or roll back pre-existing admin, supplier, uniapp, SQL, configuration, or business files.
+
+If automatic role-session creation fails, write `decisionStatus=awaiting-user` and offer `manual-create`, `defer`, or `redetect` once. `manual-create` waits for `已创建，继续绑定` before canonical provider binding; `defer` reuses the original task, snapshot, CodeGraph and recovery records; `redetect` performs host preflight only. Missing decisions and missing role bindings remain blocked and never become ready.
+
 如果项目已存在 `xinyun-ai/`，不要重复初始化，应进入升级检查模式。
 
 升级流程：
@@ -135,13 +139,13 @@ Before upgrade role-session work, read `xinyun-ai/index/initialization-recovery.
 - 升级时不得读取未注册的 `codegraph-status.json`；统一从 manifest 的 `codeGraphRequired` 恢复，并校验 project-index、preflight、onboarding、current-task、init-result 的 codeGraphRecordId 和摘要一致。
 - `available-with-dependency` 必须等待依赖授权；必要能力处于 unknown、unavailable、permission-denied、failed、not-checked、not-verified 或依赖未授权时保持 blocked/partial，不得 ready。
 - Git none、测试框架未发现和工具链未检测不单独阻塞，但必须写入 status、evidence 和 unverifiedScope；禁止自动安装依赖。
-- 数据库状态升级默认保持 `not-requested/needs-confirmation/verified`；没有新授权不得连接、执行 SQL、migration、seed 或修改真实数据。
+- 数据库状态升级默认保持 `not-requested/needs-confirmation/verified`；普通升级不扫描数据库文件，数据库相关任务只读本地 SQL/schema/migration/model 文本。没有新授权不得连接本地或线上数据库、查询真实数据、执行 SQL、migration、seed 或修改数据。
 
 ## v1.9 升级兼容与失效处理
 
 升级前按当前项目身份的 realpath/lexical-fallback 结果计算 projectRootHash，按排序 repository scope 计算 repositoryScopeHash。只有八字段身份/任务键、权限和 RFC8785 JCS-SHA-256 复用键一致时复用会话；其他项目、重复非主会话和身份未知会话不得复用。保留 v1.7.3 sessionId、旧创建索引、v1.8 共享事实和双会话文件契约。
 
-技术全景、requirementPacket 或 technicalImpactPacket 的 contentHash、版本、项目身份或 sourceRevision 变化时，相关任务进入 blocked + blockedReason=packet-stale，不得静默使用旧结果。数据库默认仍为 sql-only，授权、目标环境、参数、方言或 statementHash 变化时追加 audit 并回到 needs-confirmation。
-- v1.9 fields: `sessionMatchStatus`、`duplicate-not-primary`、`selectionEvidence`、`项目简称｜角色中文名｜职责名称`、`technical-landscape`、`coverageStatus=full`、`RFC 8785 JCS-SHA-256`、`databaseAccessMode=sql-only`、`targetEnvironment`。
+技术全景、requirementPacket 或 technicalImpactPacket 的 contentHash、版本、项目身份或 sourceRevision 变化时，相关任务进入 blocked + blockedReason=packet-stale，不得静默使用旧结果。数据库默认仍为 local-files-read-only（sql-only 仅为兼容标识），授权、目标环境、参数、方言或 statementHash 变化时追加 audit 并回到 needs-confirmation。
+- v1.9 fields: `sessionMatchStatus`、`duplicate-not-primary`、`selectionEvidence`、`项目简称｜角色中文名｜职责名称`、`technical-landscape`、`coverageStatus=full`、`RFC 8785 JCS-SHA-256`、`databaseAccessMode=local-files-read-only`、`legacyDatabaseAccessMode=sql-only`、`targetEnvironment`。
 
 同一 taskId + changeDomain 不得重复创建临时会话；容量不足进入 `queued`，unknown occupancy 保持占用，失败不得自动重试。升级不自动安装 Skill 依赖，不执行业务代码、数据库、API 或 Git 写操作。

package/init/xinyun-ai-init/rules/v1.10.2-contract.md

@@ -27,4 +27,4 @@ An illegal combination is `blocked`, stops further writes, and creates a recover
 
 The project cannot become `ready` until the orchestrator and all five required role sessions have valid identity evidence, authorization, onboarding, and execution eligibility. Missing host capability stays `blocked`; local degradation may document the task but cannot authorize business-code execution or invent a session ID.
 
-Database access remains `sql-only`. Without explicit user authorization, output SQL and a plan only; do not connect, install a driver, or execute a statement.
+Database access is `local-files-read-only`; `sql-only` is a legacy compatibility label. Read only database-related SQL/schema/migration/model text files for database-related tasks. Without explicit user authorization, output SQL and a plan only; never connect to a local or online database, open a database driver, install a driver, query real data, or execute a statement.

package/init/xinyun-ai-init/rules/v1.13.0-host-adapter.md

@@ -0,0 +1,43 @@
+# v1.13.0 host adapter and manual recovery
+
+## Session identity contract
+
+The host identity fields are not interchangeable. `hostThreadId` identifies a host UI thread, `hostSessionId` identifies a host-side session record, `providerSessionId` is the only canonical provider session identity, `projectSessionId` is the local project binding identity, `sessionId` is a compatibility alias, and `orchestratorSessionId` identifies the parent orchestrator session. A host thread, task ID, filename, title, history summary or user statement must never be copied into `providerSessionId`.
+
+For one role binding, `sessionId` and `projectSessionId` remain null until a provider canonical ID has been verified. They may then be written only according to the binding record's mapping rule, with `sessionId=providerSessionId`. The same `roleId`, `taskId`, project identity, provider ID, attempt and status must agree in role-session-binding, provider-session-binding, assignments, the role task, task-index and init-result. A project identity mismatch, a second verified binding for the same role/task, or an occupied provider session blocks the binding and records an audit entry.
+
+Binding requires independently recorded evidence for all six provider operations: create-or-reuse, send, receive, query-status, recover and close. Missing evidence keeps the binding pending/blocked and `executionEligible=false`.
+
+## Task-first session confirmation
+
+Initialization first creates the named main task and five role-execution tasks. It must not create, reuse, or complete a provider session before the user chooses `create-and-onboard`. The initial control files record `sessionCreationDecision.status=awaiting-confirmation`, keep every `sessionId` and `providerSessionId` null, and remain `projectStatus=blocked` with `executionEligible=false`.
+
+The user may choose `create-and-onboard` to enter provider create/reuse and read-only onboarding, or `defer` to preserve the task tree, snapshot, CodeGraph record and recovery record for later. A deferred run reuses the original task IDs and does not rescan or create duplicates. A missing decision does not auto-select either branch and does not repeatedly prompt.
+
+## Preflight first
+
+Before CodeGraph or broad project analysis, check the provider adapter for create, reuse, send, receive, query status, recover, close, and local control-file read/write. If a required host capability is unavailable, unknown, permission-denied, failed, not-verified, or dependency-gated, stop at preflight, keep project initialization blocked, and do not start a large CodeGraph scan.
+
+## Adapter identity
+
+The adapter must return the provider canonical `providerSessionId` through a supported provider API. Ordinary `threadId`, `taskId`, filename, title, history summary, or user statement cannot be used as a provider session ID. Automatic create/reuse validates projectRootHash, workspaceScope, roleId, taskId, title, cwd, identityEvidence, interactionEvidence, occupancy, and the original idempotency key.
+
+## Manual recovery
+
+When the host is unsupported, create only the local manual recovery guide for the five named roles. The guide contains the Chinese session title, responsibility, cwd and first read-only task prompt. After the user creates sessions, record the provider canonical ID and evidence; missing or unverifiable evidence remains pending/unknown/blocked. Recovery reuses taskId and roleTaskId, increments attempt, preserves the old binding, and never creates duplicate tasks or replaces an unverified session.
+
+## Change isolation
+
+Capture business, control-plane, Git and existing-task/session baselines before initialization. Classify every after-change path as initialization-created, initialization-updated, pre-existing-user-change, or control-plane-only. Never roll back or attribute pre-existing admin, supplier, uniapp, SQL, configuration or other business changes to initialization.
+
+No provider login/install, dependency install, database connection, SQL, Git write, business-code change, or npm publish is allowed.
+
+## Failure decision and manual recovery
+
+When automatic role-session creation fails, record one decision record and present exactly three choices: `manual-create`, `defer`, or `redetect`. Until the user chooses, keep `projectStatus=blocked`, `decisionStatus=awaiting-user`, `executionEligible=false`, and all missing provider IDs null. Do not silently skip, fabricate a binding, or repeat the prompt.
+
+`manual-create` emits the five standard role names, responsibilities, working directory and first read-only task prompts. Only the explicit phrase `已创建，继续绑定` starts binding. The host must return a real canonical `providerSessionId`; validate project identity, role, task, cwd, title, occupancy and send/receive evidence before binding. Reuse the original task IDs and increment `attempt`.
+
+`defer` preserves the main task, five role tasks, project snapshot, CodeGraph record and recovery record. A later run must reuse them and must not rescan or create duplicate tasks. `redetect` runs host preflight only and does not repeat project initialization. All five roles must be bound and complete read-only onboarding before `projectStatus=ready`.
+
+Each decision is one immutable record with `decisionId`, `userDecision`, `actor`, `source`, `decidedAt` and `decisionEvidence` containing `inputHash` and `evidenceHash`. The same decision fields must be equal in manual-session-recovery and init-result. Only one of `manual-create`, `defer`, or `redetect` may be selected; an absent choice remains blocked without a repeated prompt. Record `userDecision`, `requiredRoleCount`, `createdRoleCount`, `remainingRoleIds`, `decisionStatus`, `decidedAt`, `nextAction` and `decisionEvidence` in the recovery record and mirror them in `init-result.json`. Recovery reuses the original task IDs and increments `attempt`.

package/init/xinyun-ai-init/templates/AGENTS.template.md

@@ -196,6 +196,7 @@ CodeGraph 为必需能力时，只有 `initialized` 或 `healthy` 才能将结
 - 创建后的角色会话先进入只读 `onboarding`；只有职责理解、职责确认、成员 / 会话绑定、确认门禁和执行资格都满足后才允许 `sessionStatus=ready`。
 - 创建成功不等于业务代码修改授权；普通咨询不创建角色会话，不写绑定文件，不创建外部账号或第三个会话。
 - v1.12.1 起，角色会话必须另外记录 provider canonical `providerSessionId`；普通线程 ID、taskId、标题或历史摘要不得直接绑定。绑定前必须验证项目身份、roleId、taskId、title、cwd、独占占用、`identityEvidence` 和 `interactionEvidence`；证据不全时保持 pending/blocked。
+- v1.13.0 起先执行 provider adapter preflight；宿主必要能力失败或未知时快速 blocked，设置 `codeGraphDeferred=true`，只生成五角色人工恢复引导，不先做大规模 CodeGraph 扫描。初始化变更必须与项目原有 admin、supplier、uniapp、SQL 等改动分开归因，不回滚用户内容。
 
 AI 接手本项目时，请先读取：
 
@@ -220,7 +221,7 @@ AI 接手本项目时，请先读取：
 - `projectStatus` 固定为 `not-started/initializing/partial/blocked/ready`；只有身份、CodeGraph、基线、团队、任务、控制面、旧沉淀、宿主能力、敏感扫描和无高风险阻塞全部通过，才允许 `ready` 和 `executionEligible=true`。
 - 初始化冲突、旧任务、锁异常或用户修改控制文件时必须暂停/阻塞，不覆盖、不强制解锁；所有控制面写入使用临时文件、原子重命名、revision、幂等和恢复记录。
 - Git none、无测试框架和未检测到工具链只记录 `not-available/not-detected` 及未验证范围，不得伪造通过，也不得自动安装依赖。
-- 数据库初始化固定为 `authorization=not-requested`、`executionStatus=needs-confirmation`、`redactionStatus=verified`；未经明确授权不得连接数据库或执行 SQL，只输出 SQL 计划。
+- 数据库初始化固定为 `authorization=not-requested`、`executionStatus=needs-confirmation`、`redactionStatus=verified`；普通初始化不扫描数据库文件。数据库相关任务仅只读项目内 SQL/schema/migration/model 文本，未经明确授权不得连接本地或线上数据库、查询真实数据或执行 SQL，只输出 SQL 计划。
 
 ## v1.9 当前项目会话隔离与联合门禁
 
@@ -229,8 +230,8 @@ AI 接手本项目时，请先读取：
 - 其他项目会话不得展示完整路径、任务内容或 sessionId；重复会话保留历史，只选择一个主会话。中文标题使用 `项目简称｜角色中文名｜职责名称`。
 - 总工维护 `technical-landscape.json`，主会话维护 `requirement-packet.json`，总工输出 `technical-impact-packet.json`。技术全景只有 full coverage、空 unverifiedScope 和完整核心证据才可 ready；partial/unknown 不得 ready。
 - 两个 packet 必须同 requirementId、taskId、projectRootHash、version，并使用 RFC8785 JCS-SHA-256。关联内容变化后进入 `blockedReason=packet-stale`，程序员不得执行。
-- 数据库默认 `sql-only`；连接、查询、结构变更、数据修改分别授权，四类授权状态固定为 `not-requested/requested/authorized/denied/expired/failed/unknown`，`redactionStatus` 固定为 `verified/unverified/failed`。每条 SQL 执行前校验规范化 `statementHash`、targetEnvironment 和权限状态，过期或变化必须进入 `needs-confirmation` 并追加 audit。
-- v1.9 fields: `selectionEvidence`、`coverageStatus=full`、`RFC 8785 JCS-SHA-256`、`databaseAccessMode=sql-only`。
+- 数据库默认 `databaseAccessMode=local-files-read-only`，`sql-only` 仅为兼容标识，`sqlExecutionMode=generate-only`；连接、查询、结构变更、数据修改分别授权，四类授权状态固定为 `not-requested/requested/authorized/denied/expired/failed/unknown`，`redactionStatus` 固定为 `verified/unverified/failed`。数据库相关任务只读本地 SQL/schema/migration/model 文本，严禁连接数据库、查询真实数据或执行 SQL。每条 SQL 仅作为 review 计划，需校验规范化 `statementHash`、targetEnvironment 和权限状态，过期或变化必须进入 `needs-confirmation` 并追加 audit。
+- v1.9 fields: `selectionEvidence`、`coverageStatus=full`、`RFC 8785 JCS-SHA-256`、`databaseAccessMode=local-files-read-only`、`legacyDatabaseAccessMode=sql-only`。
 ## v1.7 machine-readable enum anchors
 
 - decision=direct-map/rewrite-required/backend-required/unsupported/pending/unknown

package/init/xinyun-ai-init/templates/README.template.md

@@ -6,6 +6,10 @@
 
 The canonical external identity of a role session is the provider-returned `providerSessionId`. A normal thread ID, taskId, title, or history summary cannot bind a role. Binding requires project identity, roleId, taskId, title, cwd, exclusive occupancy, and real send/receive evidence; incomplete evidence cannot become ready or executionEligible.
 
+## v1.13.0 host adapter and manual recovery
+
+Run host adapter preflight before large CodeGraph analysis. Unsupported or unverifiable host capability blocks role sessions and emits a five-role manual recovery guide. Initialization change reports must separate newly created control files from pre-existing user changes.
+
 ## v1.10 接管门禁
 
 当前项目必须先完成 `preflight-report.json` 和 `onboarding-report.json`，再进入业务代码开发。`project-status.json` 只有在项目身份、CodeGraph、基线、团队职责、五个真实角色会话、本地控制面、旧沉淀、宿主能力和敏感扫描全部通过时才可为 `ready`；缺失真实角色会话必须为 `blocked + required-role-session-not-created`。CLI 只创建 `xinyun-ai-init/`，AI 获得授权后才创建项目控制面。

package/init/xinyun-ai-init/templates/core-rules.template.md

@@ -610,7 +610,13 @@ Skill 分配使用 `assignmentStatus`，使用记录使用 `usageStatus`。固
 
 角色会话的外部身份只能是 provider 返回的 canonical `providerSessionId`。普通线程 ID、taskId、标题、历史摘要或用户口述不能直接绑定。绑定前必须验证项目身份、roleId、taskId、title、cwd、独占占用和真实发送/接收交互证据；证据不全保持 `bindingStatus=pending/blocked`，不得 ready 或 executionEligible。创建回写失败复用原 taskId/roleTaskId、递增 attempt，不创建重复会话；宿主不可用时 `providerSessionId=null`，不得伪造。
 
-数据库默认 databaseAccessMode=sql-only。连接、只读查询、结构变更、数据修改分别授权，四类授权状态固定为 not-requested/requested/authorized/denied/expired/failed/unknown，redactionStatus 固定为 verified/unverified/failed；SQL 执行前校验规范化 SQL、参数、方言、targetEnvironment、授权范围生成的 statementHash。授权或输入变化时回到 needs-confirmation，并追加包含 auditId、action、actorType、actorId、authorizationType、statementHash、targetEnvironment、resultStatus、redactionStatus、evidence、at 的 audit。
+## v1.13.0 host adapter and change isolation
+
+宿主 adapter 必须先检测 create/reuse/send/receive/query-status/recover/close/control-file 读写。任一必要能力为 unknown、unavailable、permission-denied、failed、not-verified 或依赖未授权时，先 blocked 并设置 `codeGraphDeferred=true`，不得先做大规模 CodeGraph 扫描。宿主不可用时只生成五角色人工恢复引导。
+
+初始化结果必须按 before/after hash 区分 `initialization-created`、`initialization-updated`、`pre-existing-user-change` 和 `control-plane-only`；不得回滚或归因用户已有业务改动。
+
+数据库正式 databaseAccessMode=local-files-read-only，legacyDatabaseAccessMode=sql-only 仅为兼容标识，sqlExecutionMode=generate-only。普通初始化不读取数据库文件；数据库相关任务仅可读取项目内受限的 SQL/schema/migration/model 文本文件。严禁连接本地或线上数据库、查询真实数据、执行 SQL、migration、seed 或数据修改。连接、只读查询、结构变更、数据修改分别授权，四类授权状态固定为 not-requested/requested/authorized/denied/expired/failed/unknown，redactionStatus 固定为 verified/unverified/failed；SQL 仅用于 review 计划，需校验规范化 SQL、参数、方言、targetEnvironment、授权范围生成的 statementHash。授权或输入变化时回到 needs-confirmation，并追加包含 auditId、action、actorType、actorId、authorizationType、statementHash、targetEnvironment、resultStatus、redactionStatus、evidence、at 的 audit。
 
 ## 自我学习
 

package/init/xinyun-ai-init/templates/current-task.template.md

@@ -311,5 +311,5 @@
 - requirementPacketId / technicalImpactPacketId / 两个 contentHash：待填写
 - packet 状态：captured / clarifying / proposed / confirmed / in-progress / blocked / completed / cancelled；技术影响：not-started / assessing / ready / partial / blocked
 - packet 失效原因：packet-stale / 待填写
-- databaseAccessMode：sql-only
+- databaseAccessMode：local-files-read-only（legacyDatabaseAccessMode=sql-only；sqlExecutionMode=generate-only）
 - 数据库连接、查询、结构变更、数据修改授权状态：待填写

package/init/xinyun-ai-init/templates/database-authorization.template.json

@@ -1,7 +1,21 @@
 {
   "schemaVersion": 1,
-  "databaseAccessMode": "sql-only",
+  "databaseAccessMode": "local-files-read-only",
+  "databaseAccessModeEnum": ["local-files-read-only", "sql-only"],
+  "legacyDatabaseAccessMode": "sql-only",
+  "databaseAccessModePolicy": "local database-related source files only; never connect to a local or online database",
+  "sqlExecutionMode": "generate-only",
+  "sqlExecutionModeEnum": ["generate-only", "forbidden"],
   "connectionStatus": "not-requested",
+  "connected": false,
+  "sqlExecuted": false,
+  "localFileReadStatus": "not-checked",
+  "localFileReadStatusEnum": ["not-checked", "not-needed", "read-only", "blocked", "failed"],
+  "localDatabaseFileScope": ["*.sql", "*.ddl", "*.schema", "*.migration", "database/", "migrations/", "schema/", "models/"],
+  "localFileReadPolicy": "database-related-task-only",
+  "localFilesRead": [],
+  "unverifiedScope": [],
+  "forbiddenOperations": ["database-connection", "database-query", "sql-execution", "migration-execution", "seed-execution", "data-mutation"],
   "connectionStatusEnum": ["not-requested", "requested", "authorized", "denied", "expired", "failed", "unknown"],
   "queryAuthorization": "not-requested",
   "queryAuthorizationEnum": ["not-requested", "requested", "authorized", "denied", "expired", "failed", "unknown"],

package/init/xinyun-ai-init/templates/host-preflight.template.json

@@ -8,6 +8,7 @@
     "reuseExistingSession",
     "sendTask",
     "receiveResult",
+    "querySessionStatus",
     "recoverSession",
     "closeSession",
     "controlFileReadWrite"
@@ -19,6 +20,7 @@
     "reuseExistingSession": {"capabilityId": "reuseExistingSession", "detectionMethod": "host-api", "status": "not-checked", "evidence": [], "dependencyStatus": "unknown", "fallbackPlan": "blocked; query existing binding only", "usedTools": [], "unusedTools": [], "unverifiedScope": [], "failureReason": null, "checkedAt": null},
     "sendTask": {"capabilityId": "sendTask", "detectionMethod": "host-api", "status": "not-checked", "evidence": [], "dependencyStatus": "unknown", "fallbackPlan": "blocked; preserve task for resume", "usedTools": [], "unusedTools": [], "unverifiedScope": [], "failureReason": null, "checkedAt": null},
     "receiveResult": {"capabilityId": "receiveResult", "detectionMethod": "host-api", "status": "not-checked", "evidence": [], "dependencyStatus": "unknown", "fallbackPlan": "blocked; preserve task for resume", "usedTools": [], "unusedTools": [], "unverifiedScope": [], "failureReason": null, "checkedAt": null},
+    "querySessionStatus": {"capabilityId": "querySessionStatus", "detectionMethod": "host-api", "status": "not-checked", "evidence": [], "dependencyStatus": "unknown", "fallbackPlan": "blocked; require manual provider verification", "usedTools": [], "unusedTools": [], "unverifiedScope": [], "failureReason": null, "checkedAt": null},
     "recoverSession": {"capabilityId": "recoverSession", "detectionMethod": "host-api", "status": "not-checked", "evidence": [], "dependencyStatus": "unknown", "fallbackPlan": "manual binding with evidence", "usedTools": [], "unusedTools": [], "unverifiedScope": [], "failureReason": null, "checkedAt": null},
     "closeSession": {"capabilityId": "closeSession", "detectionMethod": "host-api", "status": "not-checked", "evidence": [], "dependencyStatus": "unknown", "fallbackPlan": "manual host close", "usedTools": [], "unusedTools": [], "unverifiedScope": [], "failureReason": null, "checkedAt": null},
     "controlFileReadWrite": {"capabilityId": "controlFileReadWrite", "detectionMethod": "filesystem", "status": "not-checked", "evidence": [], "dependencyStatus": "not-required", "fallbackPlan": "blocked on control-file write failure", "usedTools": [], "unusedTools": [], "unverifiedScope": [], "failureReason": null, "checkedAt": null}

package/init/xinyun-ai-init/templates/init-result.template.json

@@ -9,7 +9,7 @@
   "statusEnum": ["pending", "initializing", "completed", "partial", "blocked", "unknown", "failed", "cancelled"],
   "statusSource": "xinyun-ai/current-task.md",
   "currentVersion": null,
-  "targetVersion": "1.12.1",
+  "targetVersion": "1.13.1",
   "idempotencyKey": null,
   "createdFiles": [],
   "updatedFiles": [],
@@ -49,11 +49,15 @@
     "identityMapping": {
       "hostThreadId": null,
       "hostSessionId": null,
+      "providerSessionId": null,
       "projectSessionId": null,
+      "sessionId": null,
       "orchestratorSessionId": null,
       "mappingStatus": "pending",
       "identityEvidence": [],
-      "creationEvidence": []
+      "creationEvidence": [],
+      "equivalenceRule": "sessionId equals providerSessionId only after canonical provider evidence is verified",
+      "requiredHostEvidence": ["create-or-reuse", "send", "receive", "query-status", "recover", "close"]
     },
     "realAiSessionVerified": false,
     "hostCapability": "unknown",
@@ -85,6 +89,41 @@
     "fakeProviderSessionIdProhibited": true,
     "unverifiedScope": ["provider-specific host session evidence"]
   },
+  "v113": {
+    "providerAdapterPath": "xinyun-ai/sessions/provider-adapter.json",
+    "manualSessionRecoveryPath": "xinyun-ai/sessions/manual-session-recovery.json",
+    "initializationChangeReportPath": "xinyun-ai/index/initialization-change-report.json",
+    "preflightStatus": "not-checked",
+    "codeGraphDeferred": false,
+    "changeOriginStatus": "not-checked",
+    "realProviderSessionRequired": true,
+    "userDecision": null,
+    "decisionId": null,
+    "actor": null,
+    "source": "user-confirmation",
+    "requiredRoleCount": 5,
+    "createdRoleCount": 0,
+    "remainingRoleIds": ["project-owner", "project-product", "chief-engineer", "programmer", "test-reviewer"],
+    "decisionStatus": "not-asked",
+    "decidedAt": null,
+    "nextAction": "present-choice-once",
+    "decisionEvidence": [],
+    "decisionEvidenceSchema": ["decisionId", "userDecision", "actor", "source", "decidedAt", "inputHash", "evidenceHash"],
+    "sessionCreationDecision": {
+      "decision": null,
+      "decisionId": null,
+      "status": "awaiting-confirmation",
+      "statusEnum": ["not-asked", "awaiting-confirmation", "approved", "deferred", "processing", "completed", "blocked"],
+      "actor": null,
+      "source": "user-confirmation",
+      "decidedAt": null,
+      "decisionEvidence": [],
+      "nextAction": "ask-create-or-defer",
+      "mainTaskCreatedBeforeSession": true,
+      "roleTasksCreatedBeforeSession": true,
+      "sessionIdsRemainNullUntilDecision": true
+    }
+  },
   "v19": {
     "projectIdentityPath": "xinyun-ai/project-identity.json",
     "technicalLandscapePath": "xinyun-ai/technical-landscape.json",
@@ -92,13 +131,25 @@
     "technicalImpactPacketPath": "xinyun-ai/packets/technical-impact-packet.json",
     "databaseAuthorizationPath": "xinyun-ai/database/authorization.json",
     "packetHashAlgorithm": "RFC8785-JCS-SHA-256",
-    "databaseAccessMode": "sql-only"
+    "databaseAccessMode": "local-files-read-only",
+    "legacyDatabaseAccessMode": "sql-only",
+    "sqlExecutionMode": "generate-only"
   },
   "databaseAuthorization": {
     "authorization": "not-requested",
     "executionStatus": "needs-confirmation",
     "redactionStatus": "verified",
+    "databaseAccessMode": "local-files-read-only",
+    "legacyDatabaseAccessMode": "sql-only",
+    "sqlExecutionMode": "generate-only",
     "connected": false,
+    "sqlExecuted": false,
+    "localFileReadStatus": "not-checked",
+    "localFileReadStatusEnum": ["not-checked", "not-needed", "read-only", "blocked", "failed"],
+    "localDatabaseFileScope": ["*.sql", "*.ddl", "*.schema", "*.migration", "database/", "migrations/", "schema/", "models/"],
+    "localFileReadPolicy": "database-related-task-only",
+    "localFilesRead": [],
+    "unverifiedScope": [],
     "evidence": []
   },
   "sensitiveScan": {

package/init/xinyun-ai-init/templates/initialization-change-report.template.json

@@ -0,0 +1,14 @@
+{
+  "schemaVersion": 1,
+  "reportId": "initialization-change-report-template",
+  "status": "not-checked",
+  "changeOriginEnum": ["initialization-created", "initialization-updated", "pre-existing-user-change", "control-plane-only"],
+  "baseline": {"businessFilesHash": null, "controlFilesHash": null, "gitStatusHash": null, "capturedAt": null},
+  "changes": [],
+  "classificationRule": "Compare before and after file hashes; never attribute pre-existing user changes to initialization and never roll them back.",
+  "requiredChangeFields": ["path", "origin", "beforeHash", "afterHash", "changedBy", "checkedAt", "evidence"],
+  "businessCodeChanged": {"value": "unknown", "evidence": []},
+  "sensitiveScan": {"status": "not-checked", "matches": []},
+  "createdAt": null,
+  "updatedAt": null
+}

package/init/xinyun-ai-init/templates/manifest.template.json

@@ -1,6 +1,6 @@
 {
   "projectName": "",
-  "xinyunAiVersion": "1.12.1",
+  "xinyunAiVersion": "1.13.1",
   "scriptVersion": "2026.07.23",
   "schemaVersion": "1",
   "initializationMode": "fast",
@@ -93,7 +93,10 @@
     "onboardingReport": "xinyun-ai/onboarding-report.json",
     "hostCapabilities": "xinyun-ai/host-capabilities.json",
     "takeoverBaseline": "xinyun-ai/index/takeover-baseline.json",
-    "controlPlaneIndex": "xinyun-ai/index/control-plane-index.json"
+    "controlPlaneIndex": "xinyun-ai/index/control-plane-index.json",
+    "providerAdapter": "xinyun-ai/sessions/provider-adapter.json",
+    "manualSessionRecovery": "xinyun-ai/sessions/manual-session-recovery.json",
+    "initializationChangeReport": "xinyun-ai/index/initialization-change-report.json"
   },
   "roleSessions": {
     "enabled": true,
@@ -104,7 +107,7 @@
     "providerSessionBindingTemplate": "xinyun-ai-init/templates/provider-session-binding.template.json",
     "providerSessionBindings": "xinyun-ai/sessions/provider-session-bindings.json",
     "parentSessionId": null,
-    "targetVersion": "1.12.1",
+    "targetVersion": "1.13.1",
     "requiredRoleCount": 5,
     "statusEnum": [
       "pending",
@@ -246,7 +249,16 @@
     "technicalImpactPacket": "xinyun-ai/packets/technical-impact-packet.json",
     "databaseAuthorization": "xinyun-ai/database/authorization.json",
     "packetHashAlgorithm": "RFC8785-JCS-SHA-256",
-    "databaseAccessModeDefault": "sql-only"
+    "databaseAccessModeDefault": "local-files-read-only",
+    "legacyDatabaseAccessMode": "sql-only",
+    "sqlExecutionMode": "generate-only",
+    "databaseLocalFilePolicy": {
+      "scope": ["*.sql", "*.ddl", "*.schema", "*.migration", "database/", "migrations/", "schema/", "models/"],
+      "readOnly": true,
+      "taskTriggeredOnly": true,
+      "connectionAllowed": false,
+      "sqlExecutionAllowed": false
+    }
   },
   "v110": {
     "projectStatus": "xinyun-ai/project-status.json",
@@ -269,7 +281,7 @@
     "sharedProjectSnapshot": "xinyun-ai/index/shared-project-snapshot.json",
     "initializationTiming": "xinyun-ai/index/initialization-timing.json",
     "hostCapabilityStatusEnum": ["available", "available-with-dependency", "unavailable", "permission-denied", "unknown", "not-checked", "not-verified", "failed"],
-    "preflightRequiredCapabilities": ["createRealSession", "reuseExistingSession", "sendTask", "receiveResult", "recoverSession", "closeSession", "controlFileReadWrite"],
+    "preflightRequiredCapabilities": ["createRealSession", "reuseExistingSession", "sendTask", "receiveResult", "querySessionStatus", "recoverSession", "closeSession", "controlFileReadWrite"],
     "resumeConfirmationPhrases": ["确认执行", "确认继续初始化"],
     "codeGraphReuseStatuses": ["healthy", "initialized"],
     "projectSnapshotReusePolicy": "reuse-until-business-or-codegraph-hash-changes",
@@ -285,9 +297,42 @@
     "bindingStatusEnum": ["pending", "validating", "bound", "blocked", "rejected", "released", "conflict", "recovery-required"],
     "identityEvidenceRequired": ["providerSessionId", "projectRootHash", "workspaceScope", "roleId", "taskId", "title", "cwd", "source", "verifiedAt", "evidenceHash"],
     "interactionEvidenceRequired": ["sendReceipt", "receiveReceipt", "transcriptHash", "messageCount", "recordedAt", "evidenceHash"],
+    "sessionIdentityFields": ["hostThreadId", "hostSessionId", "providerSessionId", "projectSessionId", "sessionId", "orchestratorSessionId"],
+    "canonicalSessionIdentity": "providerSessionId",
+    "sessionCompatibilityAlias": "sessionId",
+    "sessionIdentityMappingRule": "sessionId equals providerSessionId only after canonical provider evidence is verified; hostThreadId and hostSessionId are evidence only",
+    "requiredHostEvidence": ["create-or-reuse", "send", "receive", "query-status", "recover", "close"],
+    "crossFileSessionConsistency": "role-session-binding, provider-session-binding, assignments, task, task-index and init-result must agree on roleId, taskId, projectRootHash, providerSessionId, sessionId, attempt and status",
     "bindingGate": "provider canonical ID + identity evidence + interaction evidence + exclusive occupancy",
     "unsupportedHostPolicy": "blocked-without-fake-provider-session-id"
   },
+  "v113": {
+    "status": "implemented-in-package",
+    "capability": "hostAdapterAndManualRecovery",
+    "providerAdapter": "xinyun-ai/sessions/provider-adapter.json",
+    "manualSessionRecovery": "xinyun-ai/sessions/manual-session-recovery.json",
+    "initializationChangeReport": "xinyun-ai/index/initialization-change-report.json",
+    "preflightRequiredCapabilities": ["createRealSession", "reuseExistingSession", "sendTask", "receiveResult", "querySessionStatus", "recoverSession", "closeSession", "controlFileReadWrite"],
+    "fastBlockBeforeCodeGraph": true,
+    "sessionIdentityFields": ["hostThreadId", "hostSessionId", "providerSessionId", "projectSessionId", "sessionId", "orchestratorSessionId"],
+    "canonicalSessionIdentity": "providerSessionId",
+    "sessionCompatibilityAlias": "sessionId",
+    "sessionIdentityMappingRule": "sessionId equals providerSessionId only after canonical provider evidence is verified; hostThreadId and hostSessionId are evidence only",
+    "requiredHostEvidence": ["create-or-reuse", "send", "receive", "query-status", "recover", "close"],
+    "crossFileSessionConsistency": "role-session-binding, provider-session-binding, assignments, task, task-index and init-result must agree on roleId, taskId, projectRootHash, providerSessionId, sessionId, attempt and status",
+    "changeOriginEnum": ["initialization-created", "initialization-updated", "pre-existing-user-change", "control-plane-only"],
+    "manualRecoveryRoles": ["project-owner", "project-product", "chief-engineer", "programmer", "test-reviewer"],
+    "userDecisionEnum": ["manual-create", "defer", "redetect"],
+    "decisionStatusEnum": ["not-asked", "awaiting-user", "selected", "processing", "completed", "blocked"],
+    "decisionRequiredFields": ["decisionId", "userDecision", "actor", "source", "requiredRoleCount", "createdRoleCount", "remainingRoleIds", "decisionStatus", "decidedAt", "nextAction", "decisionEvidence"],
+    "decisionEvidenceFields": ["decisionId", "userDecision", "actor", "source", "decidedAt", "inputHash", "evidenceHash"],
+    "sessionCreationDecisionEnum": ["create-and-onboard", "defer"],
+    "sessionCreationStatusEnum": ["not-asked", "awaiting-confirmation", "approved", "deferred", "processing", "completed", "blocked"],
+    "sessionCreationDecisionRequiredFields": ["decision", "decisionId", "status", "actor", "source", "decidedAt", "decisionEvidence", "nextAction"],
+    "taskFirstSessionGate": "create main task and five role tasks first; ask user before creating or completing role sessions",
+    "manualBindingConfirmationPhrase": "已创建，继续绑定",
+    "noChoicePolicy": "remain-blocked-without-repeat-prompt"
+  },
   "v111": {
     "status": "implemented-in-package",
     "capability": "initializationAcceleration",

package/init/xinyun-ai-init/templates/manual-session-binding.template.json

@@ -10,17 +10,27 @@
   "workspaceScope": null,
   "title": null,
   "cwd": null,
-  "sessionIdType": "host-returned-real-session",
+  "sessionIdType": "legacy-project-compatibility-alias",
+  "sessionIdSemantics": "legacy compatibility field; it cannot be bound from hostThreadId, hostSessionId, ordinary threadId, taskId, title or history summary",
+  "canonicalSessionIdField": "providerSessionId",
+  "canonicalSessionIdSource": "provider-supported-session-api-response",
+  "hostIdentityFields": ["hostThreadId", "hostSessionId", "projectSessionId", "orchestratorSessionId"],
+  "hostThreadId": null,
+  "hostSessionId": null,
+  "projectSessionId": null,
+  "orchestratorSessionId": null,
   "provider": "codex",
   "bindingMode": "manual",
   "boundBy": null,
   "boundAt": null,
   "evidence": [],
   "evidenceRequiredFields": ["evidenceType", "source", "sessionId", "providerSessionId", "projectRootHash", "workspaceScope", "roleId", "taskId", "title", "cwd", "interactionHash", "beforeSnapshotHash", "afterSnapshotHash", "recordedAt"],
+  "requiredHostEvidence": ["create-or-reuse", "send", "receive", "query-status", "recover", "close"],
+  "identityMappingRule": "sessionId and projectSessionId remain null until providerSessionId and all requiredHostEvidence are verified; then sessionId=providerSessionId",
   "bindingStatus": "pending",
   "bindingStatusEnum": ["pending", "bound", "rejected", "blocked", "released"],
   "executionEligible": false,
-  "eligibilityRule": "bound + real sessionId + evidence verified + role onboarding ready",
+  "eligibilityRule": "bound + verified providerSessionId + all requiredHostEvidence + identity evidence + interaction evidence + role onboarding ready",
   "fakeSessionIdProhibited": true,
   "rejectionReason": null,
   "audit": [],

package/init/xinyun-ai-init/templates/manual-session-recovery.template.json

@@ -0,0 +1,49 @@
+{
+  "schemaVersion": 1,
+  "recoveryId": "manual-session-recovery-template",
+  "provider": "codex",
+  "status": "not-started",
+  "statusEnum": ["not-started", "guided", "awaiting-user", "validating", "recovered", "blocked", "failed"],
+  "userDecisionEnum": ["manual-create", "defer", "redetect"],
+  "decisionStatusEnum": ["not-asked", "awaiting-user", "selected", "processing", "completed", "blocked"],
+  "reuseContract": {"reuseTaskId": true, "reuseRoleTaskId": true, "incrementAttempt": true, "createDuplicateTasks": false, "replaceUnverifiedSession": false},
+  "taskFirstSessionGate": {
+    "mainTaskCreatedBeforeSession": true,
+    "roleTasksCreatedBeforeSession": true,
+    "sessionIdsRemainNullUntilDecision": true,
+    "sessionCreationDecisionEnum": ["create-and-onboard", "defer"],
+    "sessionCreationStatusEnum": ["not-asked", "awaiting-confirmation", "approved", "deferred", "processing", "completed", "blocked"],
+    "sessionCreationDecision": null,
+    "status": "awaiting-confirmation",
+    "decisionId": null,
+    "actor": null,
+    "source": "user-confirmation",
+    "decidedAt": null,
+    "decisionEvidence": [],
+    "nextAction": "ask-create-or-defer"
+  },
+  "roles": [
+    {"roleId":"project-owner","sessionTitle":"项目负责人｜项目接管｜项目范围与授权","responsibility":"项目范围、授权边界和最终项目确认","firstTaskPrompt":"请只读确认项目身份、接管范围、禁止操作和当前阻断，不修改业务代码。","providerSessionId":null,"bindingStatus":"pending"},
+    {"roleId":"project-product","sessionTitle":"产品负责人｜项目接管｜需求与验收","responsibility":"需求、验收标准和用户目标","firstTaskPrompt":"请只读整理项目目标、需求边界和验收条件，不修改业务代码。","providerSessionId":null,"bindingStatus":"pending"},
+    {"roleId":"chief-engineer","sessionTitle":"总工程师｜项目接管｜技术全景与影响","responsibility":"技术全景、架构影响和风险门禁","firstTaskPrompt":"请只读检查技术栈、架构、CodeGraph 状态和影响范围，不修改业务代码。","providerSessionId":null,"bindingStatus":"pending"},
+    {"roleId":"programmer","sessionTitle":"程序员｜项目接管｜实现准备","responsibility":"实现准备、文件责任和执行边界","firstTaskPrompt":"请只读确认实现范围、预计文件和禁止操作，不修改业务代码。","providerSessionId":null,"bindingStatus":"pending"},
+    {"roleId":"test-reviewer","sessionTitle":"测试审查员｜项目接管｜验证与发布门禁","responsibility":"测试证据、回归范围和发布门禁","firstTaskPrompt":"请只读确认验证命令、行为证据要求和发布阻断，不修改业务代码。","providerSessionId":null,"bindingStatus":"pending"}
+  ],
+  "userDecision": null,
+  "decisionId": null,
+  "actor": null,
+  "source": "user-confirmation",
+  "requiredRoleCount": 5,
+  "createdRoleCount": 0,
+  "remainingRoleIds": ["project-owner", "project-product", "chief-engineer", "programmer", "test-reviewer"],
+  "decisionStatus": "not-asked",
+  "decidedAt": null,
+  "nextAction": "present-choice-once",
+  "decisionEvidence": [],
+  "noChoicePolicy": "remain-blocked-without-repeat-prompt",
+  "bindingRequiredFields": ["provider", "providerSessionId", "projectRootHash", "workspaceScope", "roleId", "taskId", "title", "cwd", "boundBy", "boundAt", "identityEvidence", "interactionEvidence"],
+  "decisionEvidenceSchema": ["decisionId", "userDecision", "actor", "source", "decidedAt", "inputHash", "evidenceHash"],
+  "fakeProviderSessionIdProhibited": true,
+  "createdAt": null,
+  "updatedAt": null
+}