@pm_zhousl/xinyun-ai-init 1.13.0 → 1.14.0

package/README.md

@@ -55,6 +55,7 @@ npm run publish:token
 ```
 
 脚本会提示输入 npm token，临时写入 `.npmrc`，发布完成或失败后自动删除 `.npmrc`。
+发布脚本会先执行 `npm run verify:release`；当前 v1.14 支持明确的 `local-degraded` 证据模式，允许发布规则包但不会把项目标记为 `ready`。
 
 如果需要让 AI 代执行，可先在当前终端设置临时环境变量：
 
@@ -67,5 +68,6 @@ $env:NPM_TOKEN=$null
 发布前预演：
 
 ```powershell
+npm run verify:release
 npm run publish:token:dry
 ```

package/init/xinyun-ai-init/README.md

@@ -2,7 +2,7 @@
 
 本目录是“欣芸技术开发 Agent 流”的初始化包，负责把完整 AI 执行要求下发到目标项目。
 
-当前规则版本：`1.13.0`。
+当前规则版本：`1.14.0`。
 
 ## Codex 一句话入口
 
@@ -22,6 +22,8 @@ v1.7.2 fixed task contract keys: `taskKind=initialization-main`, `taskKind=initi
 v1.7.3 fixed Codex role session creation compatibility fields: `provider=codex`, `sessionStatus=pending/creating/created/onboarding/ready/blocked/failed/closed`, and legacy creation index `{taskId,roleId,provider,targetVersion}`. v1.10.x takeover gates are authoritative for project readiness.
 v1.7.3 Codex role session orchestration is host-level only; CLI still only creates `xinyun-ai-init/`.
 
+v1.14.0 adds the agent profile/capability declaration, aggregate takeover gate, orchestrator task graph, shared-fact handoffs, safe session naming/reuse, and final delivery gate. These controls are additive to v1.13.1; `providerSessionId` remains the only canonical provider identity in provider mode. When the host API is unavailable, `sessionIdentityMode=local-degraded` may use a control-plane `localSessionId` for local correlation only; it never makes the project `ready` or `executionEligible`.
+
 执行上面的命令后，会生成 `xinyun-ai-init/`。随后让 AI 读取 `xinyun-ai-init/README.md` 即可。
 
 ## AI 执行入口
@@ -56,6 +58,9 @@ AI 读取本文件后，必须按以下方式执行：
 26. 完成后用中文输出初始化或升级结果、项目导读、团队责任状态、任务状态、CodeGraph 状态、待确认问题和后续短指令。
 27. v1.10.2 必须区分宿主线程、宿主会话、项目会话和主调度会话；真实 sessionId 只能来自宿主返回值，无法验证时保持 blocked。
 28. v1.11.0 使用固定模板物化、阶段状态、项目快照、24 小时缓存和最多 3 个角色并发；缓存命中不能跳过必要会话、授权或最终门禁。
+29. v1.14.0 必须创建或补齐智能体档案、能力矩阵、接管门禁、主会话总控、任务图、交接记录和最终交付记录；任务状态使用 v1.13 机器状态并同步中文展示状态。
+30. v1.14.0 任务开始前读取公共快照、任务索引、近期变更、交接、契约和占用；任务结束后写回实际改动、跨任务影响、未完成事项和证据。
+31. v1.14.0 只有所有接管门禁、真实 provider 会话证据、共享事实一致性、冲突检查、敏感扫描、测试和审查通过后才允许 `ready`；没有宿主 API 时可使用 `local-degraded` 与 `localSessionId` 继续控制面工作，但状态必须保持 `partial`、`blocked` 或 `manual-required`。
 
 ## 初始化授权边界
 
@@ -1137,7 +1142,7 @@ CodeGraph 唯一状态源为 `xinyun-ai/manifest.json` 的 `codeGraphRequired`
 
 `projectStatus` 固定为 `not-started/initializing/partial/blocked/ready`。只有全部 `requiredGates` 通过且无高风险阻塞时才允许 `executionEligible=true`。缺少真实角色会话时必须 `blocked + blockedReason=required-role-session-not-created`，不得伪造 `sessionId`。
 
-Git none、无测试框架和工具链未检测只登记 `not-available/not-detected`、证据和 `unverifiedScope`，不伪造通过且不自动安装依赖。数据库默认 `authorization=not-requested`、`executionStatus=needs-confirmation`、`redactionStatus=verified`；未明确授权不得连接数据库或执行 SQL，只输出 SQL 计划。所有敏感信息不得写入任务、日志、交接单、JSON、Markdown 或 stdout/stderr。
+Git none、无测试框架和工具链未检测只登记 `not-available/not-detected`、证据和 `unverifiedScope`，不伪造通过且不自动安装依赖。数据库默认 `authorization=not-requested`、`executionStatus=needs-confirmation`、`redactionStatus=verified`；普通初始化不扫描数据库文件。数据库相关任务只读项目内受限的 SQL/schema/migration/model 文本文件，不连接本地或线上数据库、不查询真实数据、不执行 SQL。所有敏感信息不得写入任务、日志、交接单、JSON、Markdown 或 stdout/stderr。
 
 ## v1.9 项目会话隔离、总工全景与数据库授权
 
@@ -1149,6 +1154,6 @@ Git none、无测试框架和工具链未检测只登记 `not-available/not-dete
 
 总工维护 `xinyun-ai/technical-landscape.json`，主会话维护 `xinyun-ai/packets/requirement-packet.json`，总工返回 `xinyun-ai/packets/technical-impact-packet.json`。技术全景只有 `coverageStatus=full`、`unverifiedScope=[]` 且核心对象都有有效证据时才可 `ready`；`partial/unknown` 不得写成 ready。两个 packet 必须关联同一 requirementId、taskId、projectRootHash 和 version，使用 RFC 8785 JCS-SHA-256；关联内容变化时写入 `blockedReason=packet-stale` 并重新确认。
 
-数据库默认 `databaseAccessMode=sql-only`。未明确授权连接时只输出 SQL，不连接、不读取真实数据、不执行 SQL、不安装驱动。连接、只读查询、结构变更和数据修改权限独立记录；四类授权状态固定为 `not-requested/requested/authorized/denied/expired/failed/unknown`，脱敏状态固定为 `verified/unverified/failed`。执行前校验规范化 SQL、参数、方言、targetEnvironment、授权范围和 `statementHash`。授权过期或输入变化时回到 `executionStatus=needs-confirmation`，受影响授权进入 `expired` 并追加 audit。
+数据库正式模式为 `databaseAccessMode=local-files-read-only`，`legacyDatabaseAccessMode=sql-only` 仅为兼容标识；`sqlExecutionMode=generate-only`。只有数据库相关任务才读取项目内 `*.sql`、`*.ddl`、`*.schema`、`*.migration` 以及 `database/`、`migrations/`、`schema/`、`models/` 下的文本文件。严禁连接本地或线上数据库、打开 SQLite/数据库服务、查询真实数据、执行 SQL、migration、seed 或修改数据，也不自动安装驱动。连接、只读查询、结构变更和数据修改权限仍独立记录；四类授权状态固定为 `not-requested/requested/authorized/denied/expired/failed/unknown`，脱敏状态固定为 `verified/unverified/failed`。SQL 只作为 review 计划输出，需校验规范化 SQL、参数、方言、targetEnvironment、授权范围和 `statementHash`；授权过期或输入变化时回到 `executionStatus=needs-confirmation`，受影响授权进入 `expired` 并追加 audit。
 
 v1.9 不自动复用其他项目会话、不自动连接或修改数据库、不扩大 HTML 迁移范围，不执行 Git 写操作或 npm publish。

package/init/xinyun-ai-init/rules/init-rules.md

@@ -77,6 +77,16 @@ Run the seven-capability host preflight before role sessions. Materialize the ma
 - `businessCodeChanged.value=no` requires structured evidence; without evidence it must be `unknown`. Missing real behavior evidence cannot produce `ready`.
 - v1.11 stages are `preflight`, `fixed-materialization`, `control-plane`, `codegraph`, `bootstrap-snapshot`, `role-sessions`, `onboarding`, and `final-gate`. Fixed templates, a bounded project snapshot, a 24-hour cache, and at most three role sessions may reduce repeated work but cannot bypass the final gate.
 
+## v1.14.0 agent core
+
+- Create `agent-profile.json`, `agent-capabilities.json`, `takeover-gate.json`, `tasks/orchestrator.json`, `tasks/task-graph.json`, `handoffs/` and `final-delivery.json` as control-plane records.
+- Agent capability status is `ready/partial/blocked/manual-required`; missing provider evidence or unresolved required gates cannot be `ready`.
+- The orchestrator owns requirement understanding, task decomposition, assignment, dependencies, result aggregation, conflict routing, test review and final delivery. Task creation is not task completion.
+- Task records retain v1.13 machine statuses and add `statusCode`/`statusLabel`; the display labels are `待分析/待分配/执行中/待审查/待确认/已完成/阻塞/已取消`.
+- Before execution, read the shared snapshot, active task index, recent changes, handoffs, contract snapshots and occupancy. After execution, write actual files, API/field/component/process impacts, unfinished work and evidence.
+- Same-file, API, field, component or business-flow conflicts pause the affected task and require orchestrator/chief-engineer resolution.
+- Final delivery must list completed, unfinished, blocked, changed files, business-code change status, tests, review, risks and next actions. Only all gates and evidence may produce `ready`.
+
 ## v1.7.2 角色后续任务可见性
 
 - 初始化主任务使用 `taskKind=initialization-main`；角色登记使用 `taskKind=initialization-record`；后续执行任务使用 `taskKind=role-execution`。
@@ -111,7 +121,7 @@ Run the seven-capability host preflight before role sessions. Materialize the ma
 - 接管基线记录业务文件哈希、控制文件哈希、未提交 Git、已有任务/会话和旧 AI 文档。旧沉淀必须分类为 adopted/pending-confirmation/not-adopted，敏感原文不得落盘。
 - 五个角色和主任务必须有父子任务、状态、下一步和真实 sessionId；缺失角色会话固定 `blockedReason=required-role-session-not-created`，不得伪造 sessionId。
 - `projectStatus` 只有在所有 requiredGates 通过、敏感扫描通过且无高风险阻塞时才可为 ready；executionEligible 必须同时为 true。
-- Git none、无测试框架、工具链未检测只记录 not-available/not-detected 和 unverifiedScope；数据库默认 `authorization=not-requested`、`executionStatus=needs-confirmation`、`redactionStatus=verified`，未经确认不得连接或执行 SQL。
+- Git none、无测试框架、工具链未检测只记录 not-available/not-detected 和 unverifiedScope；数据库默认 `authorization=not-requested`、`executionStatus=needs-confirmation`、`redactionStatus=verified`。普通初始化不扫描数据库文件；数据库相关任务仅只读项目内 SQL/schema/migration/model 文本，不连接本地或线上数据库、不查询真实数据、不执行 SQL。
 
 ## v1.9 初始化项目身份与联合门禁
 
@@ -119,7 +129,7 @@ Run the seven-capability host preflight before role sessions. Materialize the ma
 
 会话候选状态固定为 `reusable/renamed/duplicate-not-primary/other-project/unknown/not-reusable/requires-confirmation`，只有 reusable 或有完整改名 audit 的 renamed 才能绑定。其他项目会话不得展示或复用，中文展示名使用项目简称、角色中文名和职责名称。
 
-技术全景只有 full coverage、空 unverifiedScope 和核心证据完整时才可 ready；partial/unknown 不得 ready。requirementPacket 与 technicalImpactPacket 必须同项目、task、版本和 hash；失效时进入 `packet-stale` 并阻断执行。数据库默认 `sql-only`，连接、查询、结构变更和数据修改分别授权，每条 SQL 必须校验 statementHash 和目标环境。
-- v1.9 fields: `sessionMatchStatus`、`selectionEvidence`、`项目简称｜角色中文名｜职责名称`、`coverageStatus=full`、`databaseAccessMode=sql-only`、`targetEnvironment`。
+技术全景只有 full coverage、空 unverifiedScope 和核心证据完整时才可 ready；partial/unknown 不得 ready。requirementPacket 与 technicalImpactPacket 必须同项目、task、版本和 hash；失效时进入 `packet-stale` 并阻断执行。数据库正式为 `local-files-read-only`，`sql-only` 仅为兼容标识；只读本地数据库相关文本文件，SQL 仅生成供审阅，连接、查询、结构变更和数据修改均禁止，每条 SQL 必须校验 statementHash 和目标环境。
+- v1.9 fields: `sessionMatchStatus`、`selectionEvidence`、`项目简称｜角色中文名｜职责名称`、`coverageStatus=full`、`databaseAccessMode=local-files-read-only`、`legacyDatabaseAccessMode=sql-only`、`targetEnvironment`。
 
 共享事实和 Skill 文件使用临时文件、完整校验和原子重命名。前端审计默认只读；临时会话只有用户确认的代码任务才可创建。不得修改业务代码、数据库、API、依赖、Git 或发布配置。

package/init/xinyun-ai-init/rules/session-workbench.md

@@ -319,5 +319,5 @@ Record all seven host capabilities before role sessions. `available-with-depende
 
 总工交接必须引用 technical-landscape、requirementPacket 和 technicalImpactPacket 的 ID、版本、sourceRevision 和 RFC8785 JCS-SHA-256 hash；任一 hash 失效时状态为 blocked、原因 packet-stale。技术全景 partial/unknown 不得写为 ready。
 
-数据库交接必须记录 `databaseAccessMode=sql-only`、四类授权、授权状态 `not-requested/requested/authorized/denied/expired/failed/unknown`、`statementHash`、targetEnvironment、`executionStatus`、`redactionStatus=verified/unverified/failed` 和完整 audit；授权变化后不得继续执行旧 SQL，执行状态回到 `needs-confirmation`。
+数据库交接必须记录 `databaseAccessMode=local-files-read-only`、`legacyDatabaseAccessMode=sql-only`、`sqlExecutionMode=generate-only`、四类授权、授权状态 `not-requested/requested/authorized/denied/expired/failed/unknown`、`statementHash`、targetEnvironment、`executionStatus`、`redactionStatus=verified/unverified/failed` 和完整 audit。仅允许按需读取本地 SQL/schema/migration/model 文本文件，严禁连接数据库或执行 SQL；授权变化后不得继续执行旧 SQL，执行状态回到 `needs-confirmation`。
 - v1.9 fields: `lexical-fallback`、`duplicate-not-primary`、`项目简称｜角色中文名｜职责名称`、`coverageStatus=full`、`RFC 8785 JCS-SHA-256`。

package/init/xinyun-ai-init/rules/upgrade-rules.md

@@ -139,13 +139,13 @@ Before upgrade role-session work, read `xinyun-ai/index/initialization-recovery.
 - 升级时不得读取未注册的 `codegraph-status.json`；统一从 manifest 的 `codeGraphRequired` 恢复，并校验 project-index、preflight、onboarding、current-task、init-result 的 codeGraphRecordId 和摘要一致。
 - `available-with-dependency` 必须等待依赖授权；必要能力处于 unknown、unavailable、permission-denied、failed、not-checked、not-verified 或依赖未授权时保持 blocked/partial，不得 ready。
 - Git none、测试框架未发现和工具链未检测不单独阻塞，但必须写入 status、evidence 和 unverifiedScope；禁止自动安装依赖。
-- 数据库状态升级默认保持 `not-requested/needs-confirmation/verified`；没有新授权不得连接、执行 SQL、migration、seed 或修改真实数据。
+- 数据库状态升级默认保持 `not-requested/needs-confirmation/verified`；普通升级不扫描数据库文件，数据库相关任务只读本地 SQL/schema/migration/model 文本。没有新授权不得连接本地或线上数据库、查询真实数据、执行 SQL、migration、seed 或修改数据。
 
 ## v1.9 升级兼容与失效处理
 
 升级前按当前项目身份的 realpath/lexical-fallback 结果计算 projectRootHash，按排序 repository scope 计算 repositoryScopeHash。只有八字段身份/任务键、权限和 RFC8785 JCS-SHA-256 复用键一致时复用会话；其他项目、重复非主会话和身份未知会话不得复用。保留 v1.7.3 sessionId、旧创建索引、v1.8 共享事实和双会话文件契约。
 
-技术全景、requirementPacket 或 technicalImpactPacket 的 contentHash、版本、项目身份或 sourceRevision 变化时，相关任务进入 blocked + blockedReason=packet-stale，不得静默使用旧结果。数据库默认仍为 sql-only，授权、目标环境、参数、方言或 statementHash 变化时追加 audit 并回到 needs-confirmation。
-- v1.9 fields: `sessionMatchStatus`、`duplicate-not-primary`、`selectionEvidence`、`项目简称｜角色中文名｜职责名称`、`technical-landscape`、`coverageStatus=full`、`RFC 8785 JCS-SHA-256`、`databaseAccessMode=sql-only`、`targetEnvironment`。
+技术全景、requirementPacket 或 technicalImpactPacket 的 contentHash、版本、项目身份或 sourceRevision 变化时，相关任务进入 blocked + blockedReason=packet-stale，不得静默使用旧结果。数据库默认仍为 local-files-read-only（sql-only 仅为兼容标识），授权、目标环境、参数、方言或 statementHash 变化时追加 audit 并回到 needs-confirmation。
+- v1.9 fields: `sessionMatchStatus`、`duplicate-not-primary`、`selectionEvidence`、`项目简称｜角色中文名｜职责名称`、`technical-landscape`、`coverageStatus=full`、`RFC 8785 JCS-SHA-256`、`databaseAccessMode=local-files-read-only`、`legacyDatabaseAccessMode=sql-only`、`targetEnvironment`。
 
 同一 taskId + changeDomain 不得重复创建临时会话；容量不足进入 `queued`，unknown occupancy 保持占用，失败不得自动重试。升级不自动安装 Skill 依赖，不执行业务代码、数据库、API 或 Git 写操作。

package/init/xinyun-ai-init/rules/v1.10.2-contract.md

@@ -27,4 +27,4 @@ An illegal combination is `blocked`, stops further writes, and creates a recover
 
 The project cannot become `ready` until the orchestrator and all five required role sessions have valid identity evidence, authorization, onboarding, and execution eligibility. Missing host capability stays `blocked`; local degradation may document the task but cannot authorize business-code execution or invent a session ID.
 
-Database access remains `sql-only`. Without explicit user authorization, output SQL and a plan only; do not connect, install a driver, or execute a statement.
+Database access is `local-files-read-only`; `sql-only` is a legacy compatibility label. Read only database-related SQL/schema/migration/model text files for database-related tasks. Without explicit user authorization, output SQL and a plan only; never connect to a local or online database, open a database driver, install a driver, query real data, or execute a statement.

package/init/xinyun-ai-init/rules/v1.14.0-agent-core.md

@@ -0,0 +1,31 @@
+# v1.14.0 agent core
+
+## Agent identity and capability declaration
+
+Every initialized control plane records one `agent-profile.json` and one `agent-capabilities.json`. The profile identifies the agent, package version, project identity, service goal, configured roles, supported stacks/tools, allowed operations, forbidden operations, and ready prerequisites. Capability records must include detection method, status, dependency status, evidence, fallback plan, and unverified scope.
+
+When the host does not expose a canonical provider API, the control plane may use `sessionIdentityMode=local-degraded` and a control-plane-generated `localSessionId` for local correlation. `localSessionId` is never a provider identity, never makes `sessionId` non-null, and never grants `ready` or `executionEligible`. Real provider mode continues to require `providerSessionId` and the v1.13 host evidence contract.
+
+Agent capability status is `ready`, `partial`, `blocked`, or `manual-required`. Missing canonical provider evidence, unknown required host capability, or an unresolved high-risk conflict cannot be `ready`.
+
+## Takeover gate
+
+`takeover-gate.json` is the aggregate decision for project control-plane readiness. It must verify the control plane, named main task, five role tasks, team responsibility records, CodeGraph status, provider session bindings, orchestrator registration, recovery records, indexes, shared facts, conflict checks, and sensitive scanning. Missing evidence produces `partial`, `blocked`, or `manual-required`; it never produces `ready`. Local-degraded operation may publish the package and continue read-only control-plane work, but the project remains non-ready until real provider evidence is bound.
+
+## Orchestrator and task graph
+
+The main session owns requirement understanding, task decomposition, role assignment, dependency management, result aggregation, conflict routing, test review, and final delivery. `orchestrator.json` stores its identity and evidence. `task-graph.json` stores nodes and dependency edges.
+
+Task records keep the v1.13 machine status and add `statusCode`/`statusLabel` for the unified workflow: `待分析`, `待分配`, `执行中`, `待审查`, `待确认`, `已完成`, `阻塞`, `已取消`. A task is complete only after its result, evidence, reviewer, and required write-backs pass validation.
+
+## Shared facts and handoff
+
+Before execution, read the public project snapshot, active task index, recent change ledger, other handoffs, API/database/component records, and file/workflow occupancy. After execution, write back actual files and impacts, unfinished work, confirmations, evidence, and the next action. Same-file, API, field, component, or business-flow conflicts pause the task and require orchestrator/chief-engineer resolution.
+
+## Session naming and reuse
+
+Display names follow `项目名｜角色｜职责或工作流`. Discovery and reuse require matching project identity, role, task scope, title, cwd, occupancy, idempotency key, and canonical `providerSessionId` evidence. Cross-project candidates are rejected and historical records are preserved. Host thread IDs, task IDs, filenames, titles, and history summaries remain evidence only and can never become a session ID.
+
+## Final delivery gate
+
+The final delivery record must list completed and unfinished work, blocked tasks, actual changed files, business-code change status, tests, review results, risks, next actions, and all gate/evidence references. `ready` requires every required gate, provider evidence, shared-fact consistency, conflict check, sensitive scan, and reviewer result to pass.

package/init/xinyun-ai-init/templates/AGENTS.template.md

@@ -221,7 +221,7 @@ AI 接手本项目时，请先读取：
 - `projectStatus` 固定为 `not-started/initializing/partial/blocked/ready`；只有身份、CodeGraph、基线、团队、任务、控制面、旧沉淀、宿主能力、敏感扫描和无高风险阻塞全部通过，才允许 `ready` 和 `executionEligible=true`。
 - 初始化冲突、旧任务、锁异常或用户修改控制文件时必须暂停/阻塞，不覆盖、不强制解锁；所有控制面写入使用临时文件、原子重命名、revision、幂等和恢复记录。
 - Git none、无测试框架和未检测到工具链只记录 `not-available/not-detected` 及未验证范围，不得伪造通过，也不得自动安装依赖。
-- 数据库初始化固定为 `authorization=not-requested`、`executionStatus=needs-confirmation`、`redactionStatus=verified`；未经明确授权不得连接数据库或执行 SQL，只输出 SQL 计划。
+- 数据库初始化固定为 `authorization=not-requested`、`executionStatus=needs-confirmation`、`redactionStatus=verified`；普通初始化不扫描数据库文件。数据库相关任务仅只读项目内 SQL/schema/migration/model 文本，未经明确授权不得连接本地或线上数据库、查询真实数据或执行 SQL，只输出 SQL 计划。
 
 ## v1.9 当前项目会话隔离与联合门禁
 
@@ -230,8 +230,8 @@ AI 接手本项目时，请先读取：
 - 其他项目会话不得展示完整路径、任务内容或 sessionId；重复会话保留历史，只选择一个主会话。中文标题使用 `项目简称｜角色中文名｜职责名称`。
 - 总工维护 `technical-landscape.json`，主会话维护 `requirement-packet.json`，总工输出 `technical-impact-packet.json`。技术全景只有 full coverage、空 unverifiedScope 和完整核心证据才可 ready；partial/unknown 不得 ready。
 - 两个 packet 必须同 requirementId、taskId、projectRootHash、version，并使用 RFC8785 JCS-SHA-256。关联内容变化后进入 `blockedReason=packet-stale`，程序员不得执行。
-- 数据库默认 `sql-only`；连接、查询、结构变更、数据修改分别授权，四类授权状态固定为 `not-requested/requested/authorized/denied/expired/failed/unknown`，`redactionStatus` 固定为 `verified/unverified/failed`。每条 SQL 执行前校验规范化 `statementHash`、targetEnvironment 和权限状态，过期或变化必须进入 `needs-confirmation` 并追加 audit。
-- v1.9 fields: `selectionEvidence`、`coverageStatus=full`、`RFC 8785 JCS-SHA-256`、`databaseAccessMode=sql-only`。
+- 数据库默认 `databaseAccessMode=local-files-read-only`，`sql-only` 仅为兼容标识，`sqlExecutionMode=generate-only`；连接、查询、结构变更、数据修改分别授权，四类授权状态固定为 `not-requested/requested/authorized/denied/expired/failed/unknown`，`redactionStatus` 固定为 `verified/unverified/failed`。数据库相关任务只读本地 SQL/schema/migration/model 文本，严禁连接数据库、查询真实数据或执行 SQL。每条 SQL 仅作为 review 计划，需校验规范化 `statementHash`、targetEnvironment 和权限状态，过期或变化必须进入 `needs-confirmation` 并追加 audit。
+- v1.9 fields: `selectionEvidence`、`coverageStatus=full`、`RFC 8785 JCS-SHA-256`、`databaseAccessMode=local-files-read-only`、`legacyDatabaseAccessMode=sql-only`。
 ## v1.7 machine-readable enum anchors
 
 - decision=direct-map/rewrite-required/backend-required/unsupported/pending/unknown

package/init/xinyun-ai-init/templates/agent-capabilities.template.json

@@ -0,0 +1,27 @@
+{
+  "schemaVersion": 1,
+  "agentId": "xinyun-ai-agent",
+  "capabilities": [
+    {
+      "capabilityId": "capability-template",
+      "name": "能力模板",
+      "category": "control-plane",
+      "required": true,
+      "detectionMethod": "not-checked",
+      "status": "unknown",
+      "statusEnum": ["ready", "partial", "blocked", "manual-required", "unknown"],
+      "dependencyStatus": "unknown",
+      "evidence": [],
+      "fallbackPlan": "blocked; preserve task IDs and emit next action",
+      "usedTools": [],
+      "unusedTools": [],
+      "unverifiedScope": [],
+      "failureReason": null,
+      "checkedAt": null
+    }
+  ],
+  "aggregateStatus": "manual-required",
+  "aggregateStatusEnum": ["ready", "partial", "blocked", "manual-required"],
+  "aggregateRule": "required capabilities and evidence must pass before ready; local-degraded may run with localSessionId but remains manual-required",
+  "updatedAt": null
+}

package/init/xinyun-ai-init/templates/agent-profile.template.json

@@ -0,0 +1,26 @@
+{
+  "schemaVersion": 1,
+  "agentId": "xinyun-ai-agent",
+  "name": "欣芸技术开发 Agent",
+  "version": "1.14.0",
+  "packageVersion": "1.14.0",
+  "projectIdentity": {
+    "projectRootHash": null,
+    "workspaceScope": "xinyun-ai-control",
+    "repositoryScopeHash": null,
+    "workstream": "project-control-plane"
+  },
+  "serviceGoal": "按用户确认的范围协作完成软件开发任务并提供可审计交付结论",
+  "configuredRoles": ["project-owner", "project-product", "chief-engineer", "programmer", "test-reviewer"],
+  "supportedStacks": [],
+  "supportedTools": [],
+  "allowedOperations": ["read-project-files", "write-control-plane", "run-approved-verification"],
+  "forbiddenOperations": ["fake-session-id", "database-connection", "sql-execution", "business-code-without-confirmation", "git-write", "dependency-install", "host-login", "npm-publish"],
+  "readyPrerequisites": ["control-plane", "task-tree", "team-responsibility", "codegraph", "provider-session-evidence", "orchestrator", "recovery-and-index-consistency", "sensitive-scan", "conflict-free"],
+  "capabilityStatus": "manual-required",
+  "capabilityStatusEnum": ["ready", "partial", "blocked", "manual-required"],
+  "evidence": [],
+  "unverifiedScope": ["real provider canonical session behavior"],
+  "createdAt": null,
+  "updatedAt": null
+}

package/init/xinyun-ai-init/templates/control-plane-index.template.json

@@ -6,6 +6,13 @@
   "sessionIndex": "xinyun-ai/sessions/role-session-bindings.json",
   "roleIndex": "xinyun-ai/team/assignments.json",
   "factIndex": "xinyun-ai/coordination/project-facts.json",
+  "agentProfile": "xinyun-ai/agent-profile.json",
+  "agentCapabilities": "xinyun-ai/agent-capabilities.json",
+  "takeoverGate": "xinyun-ai/takeover-gate.json",
+  "orchestrator": "xinyun-ai/tasks/orchestrator.json",
+  "taskGraph": "xinyun-ai/tasks/task-graph.json",
+  "handoffsDirectory": "xinyun-ai/handoffs/",
+  "finalDelivery": "xinyun-ai/final-delivery.json",
   "evidenceIndex": "xinyun-ai/index/evidence-index.json",
   "eventLog": "xinyun-ai/events/events.jsonl",
   "lockFile": "xinyun-ai/task-lock.json",

package/init/xinyun-ai-init/templates/coordination-change-ledger.template.json

@@ -1,6 +1,8 @@
 {
   "schemaVersion": 1,
   "changes": [],
+  "occupancy": [],
+  "conflictKeys": ["path", "api", "database-field", "component", "business-flow"],
   "recordContract": {
     "requiredFields": ["schemaVersion", "changeId", "taskId", "sessionId", "actor", "role", "changeDomain", "targetPaths", "baselineHash", "changeStatus", "evidence", "createdAt", "updatedAt"],
     "changeStatusEnum": ["proposed", "reserved", "in-progress", "completed", "conflict-pending", "blocked", "cancelled"],

package/init/xinyun-ai-init/templates/coordination-project-facts.template.json

@@ -1,6 +1,15 @@
 {
   "schemaVersion": 1,
   "facts": [],
+  "publicSnapshot": {
+    "snapshotId": null,
+    "snapshotHash": null,
+    "sourceRevision": null,
+    "refreshedAt": null,
+    "refreshTriggers": ["business-change", "control-plane-change", "codegraph-change", "source-revision-change"]
+  },
+  "executionReadContract": ["publicSnapshot", "taskIndex", "recentChanges", "handoffs", "contractSnapshots", "occupancy"],
+  "executionWriteContract": ["changedFiles", "apiChanges", "databaseFieldChanges", "componentChanges", "businessFlowChanges", "unfinishedWork", "pendingConfirmations", "evidence"],
   "recordContract": {
     "requiredFields": ["schemaVersion", "factId", "factType", "scope", "valueHash", "source", "taskId", "sessionId", "evidence", "confidence", "factStatus", "revision", "observedAt", "updatedAt"],
     "factStatusEnum": ["proposed", "confirmed", "superseded", "unknown", "blocked"]

package/init/xinyun-ai-init/templates/core-rules.template.md

@@ -616,7 +616,18 @@ Skill 分配使用 `assignmentStatus`，使用记录使用 `usageStatus`。固
 
 初始化结果必须按 before/after hash 区分 `initialization-created`、`initialization-updated`、`pre-existing-user-change` 和 `control-plane-only`；不得回滚或归因用户已有业务改动。
 
-数据库默认 databaseAccessMode=sql-only。连接、只读查询、结构变更、数据修改分别授权，四类授权状态固定为 not-requested/requested/authorized/denied/expired/failed/unknown，redactionStatus 固定为 verified/unverified/failed；SQL 执行前校验规范化 SQL、参数、方言、targetEnvironment、授权范围生成的 statementHash。授权或输入变化时回到 needs-confirmation，并追加包含 auditId、action、actorType、actorId、authorizationType、statementHash、targetEnvironment、resultStatus、redactionStatus、evidence、at 的 audit。
+数据库正式 databaseAccessMode=local-files-read-only，legacyDatabaseAccessMode=sql-only 仅为兼容标识，sqlExecutionMode=generate-only。普通初始化不读取数据库文件；数据库相关任务仅可读取项目内受限的 SQL/schema/migration/model 文本文件。严禁连接本地或线上数据库、查询真实数据、执行 SQL、migration、seed 或数据修改。连接、只读查询、结构变更、数据修改分别授权，四类授权状态固定为 not-requested/requested/authorized/denied/expired/failed/unknown，redactionStatus 固定为 verified/unverified/failed；SQL 仅用于 review 计划，需校验规范化 SQL、参数、方言、targetEnvironment、授权范围生成的 statementHash。授权或输入变化时回到 needs-confirmation，并追加包含 auditId、action、actorType、actorId、authorizationType、statementHash、targetEnvironment、resultStatus、redactionStatus、evidence、at 的 audit。
+
+## v1.14.0 智能体核心能力
+
+- 必须登记 `agent-profile.json` 和 `agent-capabilities.json`。智能体状态固定为 `ready/partial/blocked/manual-required`；宿主 canonical provider 证据缺失时不得 ready。宿主 API 不可用时允许显式 `sessionIdentityMode=local-degraded`，使用控制面生成的 `localSessionId` 做本地关联，但不得把它写入 `providerSessionId` 或把项目标记为 ready。
+- 必须登记 `takeover-gate.json`、`tasks/orchestrator.json`、`tasks/task-graph.json`、`handoffs/` 和 `final-delivery.json`，并在 manifest、project-index、init-result 和 control-plane-index 中引用。
+- 主会话负责需求理解、任务拆分、角色分配、依赖管理、结果汇总、冲突处理、测试审查和最终交付；任务创建不等于任务完成。
+- 任务保留既有机器状态，并同步 `statusCode/statusLabel`：`待分析/待分配/执行中/待审查/待确认/已完成/阻塞/已取消`。
+- 任务开始前必须读取公共快照、活动任务索引、近期变更、其他交接、契约快照和文件/工作流占用；完成后必须写回实际文件、API/字段/组件/流程影响、未完成事项、待确认项和证据。
+- 同文件、接口、字段、组件或业务流程冲突时，相关任务进入 `conflict-pending` 或 `blocked`，由主会话/总工处理，不得静默覆盖。
+- 会话展示名使用 `项目名｜角色｜职责或工作流`；provider 模式的发现和复用必须验证项目身份、职责、任务范围、cwd、占用、幂等键和 canonical `providerSessionId`。local-degraded 模式只能使用 `localSessionId` 做控制面关联，不能进行真实宿主复用，历史不得覆盖或删除。
+- 最终交付必须列出已完成、未完成、阻塞任务、实际修改文件、业务代码变更、测试、审查、风险和下一步；所有接管门禁、会话证据、共享事实、冲突检查和敏感扫描通过后才可 ready。
 
 ## 自我学习
 

package/init/xinyun-ai-init/templates/current-task.template.md

@@ -311,5 +311,5 @@
 - requirementPacketId / technicalImpactPacketId / 两个 contentHash：待填写
 - packet 状态：captured / clarifying / proposed / confirmed / in-progress / blocked / completed / cancelled；技术影响：not-started / assessing / ready / partial / blocked
 - packet 失效原因：packet-stale / 待填写
-- databaseAccessMode：sql-only
+- databaseAccessMode：local-files-read-only（legacyDatabaseAccessMode=sql-only；sqlExecutionMode=generate-only）
 - 数据库连接、查询、结构变更、数据修改授权状态：待填写

package/init/xinyun-ai-init/templates/database-authorization.template.json

@@ -1,7 +1,21 @@
 {
   "schemaVersion": 1,
-  "databaseAccessMode": "sql-only",
+  "databaseAccessMode": "local-files-read-only",
+  "databaseAccessModeEnum": ["local-files-read-only", "sql-only"],
+  "legacyDatabaseAccessMode": "sql-only",
+  "databaseAccessModePolicy": "local database-related source files only; never connect to a local or online database",
+  "sqlExecutionMode": "generate-only",
+  "sqlExecutionModeEnum": ["generate-only", "forbidden"],
   "connectionStatus": "not-requested",
+  "connected": false,
+  "sqlExecuted": false,
+  "localFileReadStatus": "not-checked",
+  "localFileReadStatusEnum": ["not-checked", "not-needed", "read-only", "blocked", "failed"],
+  "localDatabaseFileScope": ["*.sql", "*.ddl", "*.schema", "*.migration", "database/", "migrations/", "schema/", "models/"],
+  "localFileReadPolicy": "database-related-task-only",
+  "localFilesRead": [],
+  "unverifiedScope": [],
+  "forbiddenOperations": ["database-connection", "database-query", "sql-execution", "migration-execution", "seed-execution", "data-mutation"],
   "connectionStatusEnum": ["not-requested", "requested", "authorized", "denied", "expired", "failed", "unknown"],
   "queryAuthorization": "not-requested",
   "queryAuthorizationEnum": ["not-requested", "requested", "authorized", "denied", "expired", "failed", "unknown"],

package/init/xinyun-ai-init/templates/final-delivery.template.json

@@ -0,0 +1,22 @@
+{
+  "schemaVersion": 1,
+  "deliveryId": "delivery-template",
+  "taskId": null,
+  "orchestratorSessionId": null,
+  "status": "blocked",
+  "statusEnum": ["pending", "partial", "blocked", "ready"],
+  "completedItems": [],
+  "unfinishedItems": [],
+  "blockedTasks": [],
+  "changedFiles": [],
+  "businessCodeChanged": "unknown",
+  "tests": [],
+  "reviewResults": [],
+  "risks": [],
+  "nextActions": [],
+  "gateReferences": [],
+  "evidence": [],
+  "readyRule": "all required takeover gates, session evidence, shared facts, conflict checks, sensitive scan, tests and reviewer results must pass",
+  "createdAt": null,
+  "updatedAt": null
+}

package/init/xinyun-ai-init/templates/handoff.template.json

@@ -0,0 +1,32 @@
+{
+  "schemaVersion": 1,
+  "handoffId": "handoff-template",
+  "taskId": null,
+  "roleId": null,
+  "sessionId": null,
+  "fromActor": null,
+  "toActor": null,
+  "status": "pending",
+  "statusEnum": ["pending", "accepted", "blocked", "closed"],
+  "readBeforeExecution": {
+    "projectSnapshotHash": null,
+    "taskIndexRevision": null,
+    "recentChangeIds": [],
+    "otherHandoffIds": [],
+    "contractSnapshotIds": [],
+    "occupancyEvidence": []
+  },
+  "completedWork": [],
+  "changedFiles": [],
+  "apiChanges": [],
+  "databaseFieldChanges": [],
+  "componentChanges": [],
+  "businessFlowChanges": [],
+  "impactOnOtherTasks": [],
+  "unfinishedWork": [],
+  "pendingConfirmations": [],
+  "evidence": [],
+  "nextAction": null,
+  "createdAt": null,
+  "updatedAt": null
+}

package/init/xinyun-ai-init/templates/host-capabilities.template.json

@@ -7,6 +7,8 @@
   "statusEnum": ["available", "available-with-dependency", "unavailable", "permission-denied", "unknown", "not-checked", "not-verified", "failed"],
   "dependencyStatusEnum": ["not-required", "required", "authorized", "not-authorized", "unknown"],
   "capabilityRequiredFields": ["capabilityId", "detectionMethod", "status", "evidence", "dependencyStatus", "fallbackPlan", "usedTools", "unusedTools", "unverifiedScope", "failureReason", "checkedAt"],
+  "historicalCapabilityContract": { "version": "1.10", "requiredCount": 6, "status": "legacy-compatible" },
+  "currentProviderCapabilityContract": { "version": "1.13.1", "requiredCount": 8, "source": "host-preflight.template.json", "requiredCapabilities": ["createRealSession", "reuseExistingSession", "sendTask", "receiveResult", "querySessionStatus", "recoverSession", "closeSession", "controlFileReadWrite"] },
   "evidenceRequiredFields": ["evidenceType", "source", "summaryOrHash", "checkedAt"],
   "unknownPolicy": "unknown-means-no-verifiable-evidence; never report verified or unavailable without evidence",
   "checkedAt": null,

package/init/xinyun-ai-init/templates/init-result.template.json

@@ -9,7 +9,19 @@
   "statusEnum": ["pending", "initializing", "completed", "partial", "blocked", "unknown", "failed", "cancelled"],
   "statusSource": "xinyun-ai/current-task.md",
   "currentVersion": null,
-  "targetVersion": "1.13.0",
+  "targetVersion": "1.14.0",
+  "agentCore": {
+    "version": "1.14.0",
+    "profilePath": "xinyun-ai/agent-profile.json",
+    "capabilitiesPath": "xinyun-ai/agent-capabilities.json",
+    "takeoverGatePath": "xinyun-ai/takeover-gate.json",
+    "orchestratorPath": "xinyun-ai/tasks/orchestrator.json",
+    "taskGraphPath": "xinyun-ai/tasks/task-graph.json",
+    "finalDeliveryPath": "xinyun-ai/final-delivery.json",
+    "agentStatus": "manual-required",
+    "takeoverStatus": "blocked",
+    "taskStatusLabelMapVersion": "1.14.0"
+  },
   "idempotencyKey": null,
   "createdFiles": [],
   "updatedFiles": [],
@@ -124,6 +136,16 @@
       "sessionIdsRemainNullUntilDecision": true
     }
   },
+  "v114": {
+    "handoffsDirectory": "xinyun-ai/handoffs/",
+    "finalDeliveryPath": "xinyun-ai/final-delivery.json",
+    "requiredRoleCount": 5,
+    "orchestratorSessionId": null,
+    "taskGraphStatus": "blocked",
+    "takeoverGateStatus": "blocked",
+    "readyRequiresAllGates": true,
+    "realProviderEvidenceRequired": true
+  },
   "v19": {
     "projectIdentityPath": "xinyun-ai/project-identity.json",
     "technicalLandscapePath": "xinyun-ai/technical-landscape.json",
@@ -131,13 +153,25 @@
     "technicalImpactPacketPath": "xinyun-ai/packets/technical-impact-packet.json",
     "databaseAuthorizationPath": "xinyun-ai/database/authorization.json",
     "packetHashAlgorithm": "RFC8785-JCS-SHA-256",
-    "databaseAccessMode": "sql-only"
+    "databaseAccessMode": "local-files-read-only",
+    "legacyDatabaseAccessMode": "sql-only",
+    "sqlExecutionMode": "generate-only"
   },
   "databaseAuthorization": {
     "authorization": "not-requested",
     "executionStatus": "needs-confirmation",
     "redactionStatus": "verified",
+    "databaseAccessMode": "local-files-read-only",
+    "legacyDatabaseAccessMode": "sql-only",
+    "sqlExecutionMode": "generate-only",
     "connected": false,
+    "sqlExecuted": false,
+    "localFileReadStatus": "not-checked",
+    "localFileReadStatusEnum": ["not-checked", "not-needed", "read-only", "blocked", "failed"],
+    "localDatabaseFileScope": ["*.sql", "*.ddl", "*.schema", "*.migration", "database/", "migrations/", "schema/", "models/"],
+    "localFileReadPolicy": "database-related-task-only",
+    "localFilesRead": [],
+    "unverifiedScope": [],
     "evidence": []
   },
   "sensitiveScan": {

package/init/xinyun-ai-init/templates/manifest.template.json

@@ -1,6 +1,6 @@
 {
   "projectName": "",
-  "xinyunAiVersion": "1.13.0",
+  "xinyunAiVersion": "1.14.0",
   "scriptVersion": "2026.07.23",
   "schemaVersion": "1",
   "initializationMode": "fast",
@@ -14,6 +14,18 @@
     "git": "unknown"
   },
   "codegraph": { "enabled": false, "status": "unknown" },
+  "agentCore": {
+    "version": "1.14.0",
+    "profile": "xinyun-ai/agent-profile.json",
+    "capabilities": "xinyun-ai/agent-capabilities.json",
+    "takeoverGate": "xinyun-ai/takeover-gate.json",
+    "orchestrator": "xinyun-ai/tasks/orchestrator.json",
+    "taskGraph": "xinyun-ai/tasks/task-graph.json",
+    "handoffsDirectory": "xinyun-ai/handoffs/",
+    "finalDelivery": "xinyun-ai/final-delivery.json",
+    "statusEnum": ["ready", "partial", "blocked", "manual-required"],
+    "status": "manual-required"
+  },
   "index": { "primary": "json_markdown", "sqlite": "optional" },
   "capabilities": {
     "confirmationGate": true,
@@ -107,7 +119,7 @@
     "providerSessionBindingTemplate": "xinyun-ai-init/templates/provider-session-binding.template.json",
     "providerSessionBindings": "xinyun-ai/sessions/provider-session-bindings.json",
     "parentSessionId": null,
-    "targetVersion": "1.13.0",
+    "targetVersion": "1.14.0",
     "requiredRoleCount": 5,
     "statusEnum": [
       "pending",
@@ -249,7 +261,16 @@
     "technicalImpactPacket": "xinyun-ai/packets/technical-impact-packet.json",
     "databaseAuthorization": "xinyun-ai/database/authorization.json",
     "packetHashAlgorithm": "RFC8785-JCS-SHA-256",
-    "databaseAccessModeDefault": "sql-only"
+    "databaseAccessModeDefault": "local-files-read-only",
+    "legacyDatabaseAccessMode": "sql-only",
+    "sqlExecutionMode": "generate-only",
+    "databaseLocalFilePolicy": {
+      "scope": ["*.sql", "*.ddl", "*.schema", "*.migration", "database/", "migrations/", "schema/", "models/"],
+      "readOnly": true,
+      "taskTriggeredOnly": true,
+      "connectionAllowed": false,
+      "sqlExecutionAllowed": false
+    }
   },
   "v110": {
     "projectStatus": "xinyun-ai/project-status.json",
@@ -324,6 +345,22 @@
     "manualBindingConfirmationPhrase": "已创建，继续绑定",
     "noChoicePolicy": "remain-blocked-without-repeat-prompt"
   },
+  "v114": {
+    "status": "implemented-in-package",
+    "capability": "agentCoreAndTakeoverControl",
+    "agentProfile": "xinyun-ai/agent-profile.json",
+    "agentCapabilities": "xinyun-ai/agent-capabilities.json",
+    "takeoverGate": "xinyun-ai/takeover-gate.json",
+    "orchestrator": "xinyun-ai/tasks/orchestrator.json",
+    "taskGraph": "xinyun-ai/tasks/task-graph.json",
+    "handoffsDirectory": "xinyun-ai/handoffs/",
+    "finalDelivery": "xinyun-ai/final-delivery.json",
+    "agentStatusEnum": ["ready", "partial", "blocked", "manual-required"],
+    "takeoverStatusEnum": ["not-started", "assessing", "partial", "blocked", "manual-required", "ready"],
+    "taskStatusCodeEnum": ["captured", "pending", "executing", "waiting-review", "awaiting-confirmation", "completed", "blocked", "cancelled"],
+    "taskStatusLabelMap": {"captured": "待分析", "pending": "待分配", "executing": "执行中", "waiting-review": "待审查", "awaiting-confirmation": "待确认", "completed": "已完成", "blocked": "阻塞", "cancelled": "已取消"},
+    "readyRequires": ["controlPlane", "mainTask", "roleTasks", "teamResponsibility", "codeGraph", "roleSessions", "orchestrator", "recovery", "indexes", "sharedFacts", "conflicts", "sensitiveScan"]
+  },
   "v111": {
     "status": "implemented-in-package",
     "capability": "initializationAcceleration",

package/init/xinyun-ai-init/templates/orchestrator.template.json

@@ -0,0 +1,18 @@
+{
+  "schemaVersion": 1,
+  "orchestratorId": "orchestrator-template",
+  "orchestratorSessionId": null,
+  "provider": "codex",
+  "parentTaskId": null,
+  "projectRootHash": null,
+  "workspaceScope": "xinyun-ai-control",
+  "responsibilities": ["requirement-understanding", "task-decomposition", "role-assignment", "dependency-management", "result-aggregation", "conflict-routing", "test-review", "final-delivery"],
+  "status": "blocked",
+  "statusEnum": ["pending", "active", "blocked", "closed"],
+  "identityEvidence": [],
+  "dispatchEvidence": [],
+  "taskGraphPath": "xinyun-ai/tasks/task-graph.json",
+  "nextAction": "obtain canonical orchestrator session evidence",
+  "createdAt": null,
+  "updatedAt": null
+}