@pm_zhousl/xinyun-ai-init 1.7.3 → 1.8.0

package/README.md

@@ -24,7 +24,7 @@ npx --yes @pm_zhousl/xinyun-ai-init@latest --force
 npm run verify:init
 npm run verify:rules
 npm run verify:rules -- --json
-npm run verify:rules -- --tarball ./pm_zhousl-xinyun-ai-init-1.7.3.tgz
+npm run verify:rules -- --tarball ./pm_zhousl-xinyun-ai-init-1.8.0.tgz
 ```
 
 `verify:rules` 为只读规则包一致性检查，不自动修复、不安装依赖、不修改 Git 或业务代码。

package/init/xinyun-ai-init/README.md

@@ -2,7 +2,7 @@
 
 本目录是“欣芸技术开发 Agent 流”的初始化包，负责把完整 AI 执行要求下发到目标项目。
 
-当前规则版本：`1.7.3`。
+当前规则版本：`1.8.0`。
 
 ## Codex 一句话入口
 
@@ -1102,3 +1102,15 @@ npx --yes @pm_zhousl/xinyun-ai-init@latest --force
 每个角色的幂等键是对 `{sourceTaskId, roleId, taskKind, targetVersion}` 使用 v1.6 JCS 规范化 JSON 后计算的 SHA-256，规范化算法为 `JCS-SHA-256`。同一幂等键只对应一个 `role-execution` 任务；重复升级复用已有任务并补齐索引，不覆盖用户控制文件或业务文件。
 
 补建使用逐角色临时文件、完整校验、原子重命名和任务索引原子更新。单角色写入失败记录 `status=blocked`、`blockedReason=write-failed`；部分成功为 `partial`，全失败为 `blocked`。索引更新中断时不得清空 `activeTaskIds` 或伪造 `idle`，下次按幂等键恢复。
+
+## v1.8 多会话协作控制面
+
+v1.8 按 A-D 分阶段启用：A 共享事实和冲突协调，B Skill 注册与技术栈路由，C 前端耦合审计和单页面试点，D 临时程序员会话。A 的状态和事务契约未通过前，不得进入 D 的真实并行写入。
+
+共享控制文件位于 `xinyun-ai/coordination/`：`project-facts.json` 使用 `factStatus`，`change-ledger.json` 使用 `changeStatus`，`conflict-records/<conflictId>.json` 使用 `conflictStatus`。任务索引使用 `taskStatus`，受影响任务使用 `refreshStatus`。状态字段按对象分域，禁止用 `status` 跨对象互相覆盖；临时会话的 `queued` 只属于会话状态域。
+
+Skill 位于 `xinyun-ai/skills/`。分配文件必须使用 `assignmentStatus`，使用记录必须使用 `usageStatus`，固定映射以 `xinyun-ai-init/rules/skills.md` 为准。缺依赖、权限不足、未审核或未知框架只能降级或阻塞，不自动安装、不伪造执行。
+
+前端审计位于 `xinyun-ai/frontend-audits/`。`audit-only` 不产生代码 diff；`refactor-now` 必须有计划、用户确认、允许路径、前后哈希、diff 和测试证据。预算或权限不足只能记录 `partial/unknown` 和 `unverifiedScope`。
+
+临时程序员会话必须有已确认的 `planId`、`userConfirmationId`、单一 `taskId`、规范化 `changeDomain`、允许路径和真实 `sessionId`。最多同时占用 3 个运行额度；`occupancyStatus=unknown` 不得自动释放，人工释放必须有完整 `releaseAudit`。跨文件控制面必须使用 `coordinationTransactionId`。详情见 `rules/coordination.md`、`rules/skills.md`、`rules/frontend-audit.md` 和 `rules/temporary-sessions.md`。

package/init/xinyun-ai-init/rules/coordination.md

@@ -0,0 +1,33 @@
+# v1.8-A 共享事实与跨会话协调
+
+`xinyun-ai/coordination/` 是多会话共享控制面，不是业务代码目录。初始化或按需升级时创建最小目录，不扫描或写入业务文件。
+
+## 文件与状态源
+
+- `project-facts.json` 记录可追溯项目事实，字段必须包含 `factId`、`factType`、`scope`、`valueHash`、`source`、`taskId`、`sessionId`、`evidence`、`confidence`、`factStatus`、`revision`、`observedAt`、`updatedAt`。
+- `change-ledger.json` 记录改动台账，字段必须包含 `changeId`、`taskId`、`sessionId`、`actor`、`role`、`changeDomain`、`targetPaths`、`baselineHash`、`changeStatus`、`evidence`、`createdAt`、`updatedAt`。
+- `contract-snapshots/<contractId>.json` 记录 API、字段、组件、路由、消息和业务流程快照。
+- `conflict-records/<conflictId>.json` 记录冲突，必须使用 `conflictStatus`，不能使用通用 `status` 裁决冲突。
+- `task-index.json` 裁决 `taskStatus`；`change-ledger.json` 裁决 `changeStatus`；冲突文件裁决 `conflictStatus`；受影响任务记录裁决 `refreshStatus`。
+
+状态字段严格分域：`taskStatus=pending/assigned/accepted/executing/paused/blocked/completed/cancelled`；`changeStatus=proposed/reserved/in-progress/completed/conflict-pending/blocked/cancelled`；`conflictStatus=detected/awaiting-confirmation/resolved/rejected/blocked`；`refreshStatus=not-required/refresh-required/refreshed/blocked`。临时会话的 `queued` 不属于 `changeStatus`。
+
+取消只允许 `changeStatus=proposed/reserved -> cancelled`。同一事实、台账、冲突记录的状态源缺失、非法或 `revision` 不一致时，关联任务统一进入 `taskStatus=blocked`，并写 `blockedReason=status-inconsistent`，不得用最近写入内容覆盖。
+
+## 三道门禁
+
+1. 领取前：声明 `changeDomain`、目标路径、API、数据库字段、组件、路由和业务流程影响，读取当前共享事实和冲突记录。
+2. 写入前：重新校验基线、契约快照、同域活动任务和冲突状态；冲突时进入 `changeStatus=conflict-pending` 与 `conflictStatus=awaiting-confirmation`。
+3. 完成后：写入证据、更新共享事实和台账；受影响任务设置 `refreshStatus=refresh-required`，在刷新完成前保持 `taskStatus=paused` 或 `blocked`。
+
+冲突不得由单个会话自行裁决，不自动覆盖或合并。解决后由总工或业务确认人写入 `resolvedBy`、`resolvedAt`、`resolutionEvidence`，重新验证基线后才可继续。
+
+## changeDomain 与事务
+
+规范化格式至少包括 `file:<normalized-path>`、`api:<METHOD> <normalized-route>`、`db:<table>.<field>`、`component:<normalized-path>`、`flow:<business-flow-id>`。路径优先 realpath，统一 `/` 和 Unicode NFC；无法规范化写 `unknown`。
+
+跨文件写入必须使用 `coordinationTransactionId`，记录在 `.transactions/<coordinationTransactionId>.json`。事务阶段为 `prepared/validated/renamed/revision-updated/committed/recovery-required/blocked`；每个 `targetFiles` 条目必须有 `path`、`tempPath`、`beforeHash`、`afterHash`、`targetRevision`。按“临时文件、完整校验、原子重命名、更新 revision、提交事务”执行，重复请求复用同一事务。崩溃、部分重命名、权限失败或哈希不一致时保留记录并进入 `recovery-required` 或 `blocked`，不能只更新索引、删除历史或覆盖新版本。
+
+## 安全边界
+
+只读冲突审计不产生业务 diff。数据库、API、业务流程和跨端冲突未确认前不得 SQL、migration、seed、批量修复、接口兼容改动或自动合并。

package/init/xinyun-ai-init/rules/directory-self-completion.md

@@ -57,3 +57,10 @@
 - `manifest.json`、`project-index.json` 和 `task-index.json` 必须登记 `roleSessions`、`roleSessionBindingIds`、`roleSessionBindings`、`provider=codex` 和 `sessionStatus` 枚举。
 - 绑定目录只保存 Codex 宿主返回的真实 `sessionId` 摘要、onboarding 状态、失败原因和 audit，不保存伪造 sessionId。
 - 宿主不支持创建子会话时，仍可补齐本地目录和降级记录，状态使用 `local-degraded-no-fake-session-id`。
+
+## v1.8 按需目录
+
+- 多会话协调任务按需补齐 `xinyun-ai/coordination/`、`contract-snapshots/`、`conflict-records/` 和 `.transactions/`。
+- Skill 路由任务按需补齐 `xinyun-ai/skills/registry.json`、`assignments.json` 和 `usage-records/`；分配字段必须是 `assignmentStatus`。
+- 前端审计按需补齐 `xinyun-ai/frontend-audits/`；临时程序员任务按需补齐 `xinyun-ai/sessions/temporary/`。
+- 普通咨询、首次极速初始化和不涉及这些能力的任务不创建空目录。目录补齐只修改 AI 控制面，不修改业务代码。

package/init/xinyun-ai-init/rules/frontend-audit.md

@@ -0,0 +1,9 @@
+# v1.8-C 前端耦合审计与渐进式组件化
+
+适用微信小程序、uni-app 和 HTML。先审计，再决定是否改造；不整站重写，不默认更换 UI 框架，不自动把 HTML 转成小程序或 uni-app。
+
+审计记录必须包含页面/组件路径、平台、框架、`couplingType`、props、events、slots、状态、API、路由、业务流程依赖、`baselineHash`、`decision`、`status`、`coverage`、`evidence` 和 `unverifiedScope`。`couplingType` 使用 `template-style/state-view/api-page/route-page/business-page/cross-platform/shared-component/unknown`。
+
+审计状态使用 `not-started/assessing/partial/completed/blocked/unknown`；处理决定使用 `audit-only/refactor-now/defer/requires-confirmation/out-of-scope`；覆盖使用 `full/partial/unknown`。这些是审计记录的字段，不得与 `taskStatus`、`changeStatus` 或 `conflictStatus` 混用。
+
+`audit-only` 必须零代码 diff。`refactor-now` 必须先有 `planId`、`userConfirmationId`、`permittedPaths`，并保留前后哈希、diff 证据和测试证据；单页面或单组件试点也必须遵守确认门禁。预算超限、权限失败或依赖未知只能输出 `partial/unknown` 和未验证范围，不能宣称完整审计。

package/init/xinyun-ai-init/rules/init-rules.md

@@ -74,3 +74,9 @@
 - 幂等键固定为 `taskId + roleId + provider + targetVersion` 的 JCS-SHA-256。
 - 真实 `sessionId` 必须来自 Codex 宿主返回值；不得伪造 sessionId。宿主不支持时记录 `local-degraded-no-fake-session-id`，`sessionId=null`。
 - 创建成功后先进入只读 `onboarding`；`sessionStatus=ready` 必须等待职责理解、职责确认、成员 / 会话绑定和执行资格全部满足。
+
+## v1.8 控制面按需初始化
+
+需要多会话协作时，按 A-D 顺序补齐 `xinyun-ai/coordination/`、`xinyun-ai/skills/`、`xinyun-ai/frontend-audits/` 和 `xinyun-ai/sessions/temporary/` 的最小模板。普通咨询和首次极速初始化不强制创建这些业务记录目录。
+
+共享事实和 Skill 文件使用临时文件、完整校验和原子重命名。前端审计默认只读；临时会话只有用户确认的代码任务才可创建。不得修改业务代码、数据库、API、依赖、Git 或发布配置。

package/init/xinyun-ai-init/rules/session-workbench.md

@@ -276,3 +276,11 @@ HTML 迁移只允许评估和单页面 / 区块试点计划；实际代码迁移
 - `created-but-writeback-failed` 恢复线索
 
 会话创建成功只代表可进入只读 onboarding；不得把 `created` 直接写成 `ready`，不得因此获得业务代码修改授权。普通咨询不创建角色会话，也不写 `role-session-bindings.json`。
+
+## v1.8 任务单补充
+
+涉及共享事实时记录 `factStatus`、`changeStatus`、`conflictStatus`、`refreshStatus`、`coordinationTransactionId`、`changeDomain`、目标文件和 revision。涉及 Skill 时记录 `skillId`、`assignmentStatus`、`usageStatus`、匹配证据、依赖、降级原因、`failureReason`、`nextAction` 和 `unverifiedScope`。
+
+涉及前端审计时记录 `couplingType`、`decision`、审计 `status`、`coverage`、props/events/slots、状态/API/路由/业务流依赖、前后哈希、diff 和测试证据。涉及临时程序员会话时记录 `taskId`、`changeDomain`、`sessionId`、会话 `status`、`occupancyStatus`、并发额度、`releaseAudit` 和 `closeEvidence`。
+
+任何跨会话冲突、状态源缺失、预算超限、权限失败或敏感信息无法确认时暂停或阻塞，不自动重试、合并、覆盖或释放。

package/init/xinyun-ai-init/rules/skills.md

@@ -0,0 +1,15 @@
+# v1.8-B Skill 注册与技术栈路由
+
+Skill 只能从 `xinyun-ai/skills/registry.json` 的已登记记录中选择。未登记、未审查、过期或被阻断的外部 Skill 不得执行，不自动安装 Python、Node 驱动、CLI 或第三方依赖。
+
+## 注册与选择
+
+每个 Skill 记录 `skillId`、`name`、`version`、`source`、`digest`、`priority`、`availabilityStatus`、`trustStatus`、`reviewedAt`、`allowedRoles`、`frameworks`、`platforms`、`dependencies`、`permissions`、`evidence`、`fallbackPlan`、`createdAt`、`updatedAt`。`availabilityStatus` 与 `trustStatus` 独立：前者为 `available/unavailable/disabled/unknown`，后者为 `unreviewed/reviewed/blocked/expired`，不得用 registry `status` 代替。
+
+按“项目明确绑定 > 框架专用 > 通用 Skill > fallback”选择；同级按稳定 `priority` 和 `skillId` 排序，不按扫描顺序随机选择。ThinkPHP、uni-app、微信小程序和 HTML 只在对应技术栈已确认时路由专用 Skill；未识别框架使用通用 Skill 并标记不确定性。
+
+## 分配与使用状态
+
+`assignments.json` 使用 `assignmentStatus`，`usage-records/<usageRecordId>.json` 使用 `usageStatus`。固定映射为：`pending + selected`、`selected + selected/running`、`running + running`、`completed + completed`、`fallback + fallback`、`blocked + failed/blocked`、`cancelled + skipped`。`usageStatus=failed` 必须映射 `assignmentStatus=blocked`，并记录 `failureReason` 和 `nextAction`；非法组合统一 `assignmentStatus=blocked`。
+
+调用前记录匹配证据、使用工具、未使用工具、降级方案和 `unverifiedScope`。依赖缺失、权限不足、宿主不可用或未知框架只能 `usageStatus=fallback/blocked`，不得伪造已执行结果。使用记录不得保存 Token、密码、私钥、完整 `.env`、连接串或未经脱敏的项目内容。

package/init/xinyun-ai-init/rules/temporary-sessions.md

@@ -0,0 +1,9 @@
+# v1.8-D 临时程序员执行会话
+
+仅对已完成需求整理、技术影响审查、计划和用户确认的代码任务创建临时程序员会话。必须绑定单一 `taskId`、单一规范化 `changeDomain`、真实 `sessionId`、`planId`、`userConfirmationId` 和 `permittedPaths`；不加入永久成员名单。
+
+会话状态固定为 `pending/creating/onboarding/queued/executing/waiting-review/completed/blocked/failed/closed/cancelled`，合法主流程为 `pending -> creating -> onboarding -> executing -> waiting-review -> completed -> closed`。容量不足或同域冲突允许 `onboarding -> queued -> creating`；容量可用时不得强制排队。`changeStatus` 不使用 `queued`。
+
+并发上限为 3，最多同时占用 3 个运行额度，只统计 `creating/onboarding/executing/waiting-review`。`occupancyStatus` 独立使用 `occupied/released/unknown`；`pending/queued` 初始为 `released`，进入 `creating` 时原子占用。崩溃、锁损坏、超时或不可读时写 `occupancyStatus=unknown` 并继续占用，不得自动释放、自动重试或自动关闭。人工释放必须包含 `releaseAudit.auditId/releasedBy/releasedAt/reason/evidence`。
+
+同一变更域已有执行会话时排队或冲突待确认，不重复创建。队列按确认时间、优先级和 taskId 稳定排序。只有代码 diff、测试、共享事实和改动台账都同步，并写入 `closeEvidence`、`closedAt`、`closedBy` 后才能自动关闭；异常、冲突或测试失败保持阻塞。

package/init/xinyun-ai-init/rules/upgrade-rules.md

@@ -111,3 +111,9 @@
 - 单角色创建或回写失败不得影响其他角色；失败角色进入 `blocked` 或 `failed` 并记录 `blockedReason` / `failureReason` / `nextAction`。
 - Codex 宿主不支持创建子会话、权限不足或接口不可用时，使用本地降级 `local-degraded-no-fake-session-id`，保持 `sessionId=null`，不得伪造 sessionId。
 - 创建成功后的角色会话为只读 `onboarding`，不得直接获得业务代码、数据库、API、配置、依赖、Git 写操作或发布授权。
+
+## v1.8 升级顺序
+
+升级先校验共享事实、状态源和 coordination transaction；再校验 Skill registry、`assignmentStatus`/`usageStatus` 映射；然后处理前端 audit-only 或已确认的单页面试点；最后才创建临时程序员会话。已有用户修改的控制文件不得静默覆盖，冲突或哈希不一致进入 `blocked`/`recovery-required`。
+
+同一 taskId + changeDomain 不得重复创建临时会话；容量不足进入 `queued`，unknown occupancy 保持占用，失败不得自动重试。升级不自动安装 Skill 依赖，不执行业务代码、数据库、API 或 Git 写操作。

package/init/xinyun-ai-init/templates/AGENTS.template.md

@@ -210,3 +210,9 @@ AI 接手本项目时，请先读取：
 - decision=direct-map/rewrite-required/backend-required/unsupported/pending/unknown
 - status=planned/assessing/partial/blocked/paused/completed
 - coverage=full/partial/unknown
+
+## v1.8 多会话执行边界
+
+共享事实、改动台账和冲突记录必须使用 `factStatus`、`changeStatus`、`conflictStatus` 分域状态；Skill 分配必须使用 `assignmentStatus`，使用结果必须使用 `usageStatus`。不得把 `assignments.json.status` 当作正式字段，也不得把临时会话 `queued` 写进改动状态。
+
+前端 `audit-only` 只能审计，禁止产生 diff；`refactor-now` 必须有计划、确认、允许路径、前后哈希、diff 和测试证据。临时程序员只能执行已确认任务，单变更域不得并发写入，最多 3 个运行会话；`occupancyStatus=unknown` 时不得自动释放。

package/init/xinyun-ai-init/templates/coordination-change-ledger.template.json

@@ -0,0 +1,10 @@
+{
+  "schemaVersion": 1,
+  "changes": [],
+  "recordContract": {
+    "requiredFields": ["schemaVersion", "changeId", "taskId", "sessionId", "actor", "role", "changeDomain", "targetPaths", "baselineHash", "changeStatus", "evidence", "createdAt", "updatedAt"],
+    "changeStatusEnum": ["proposed", "reserved", "in-progress", "completed", "conflict-pending", "blocked", "cancelled"],
+    "cancelRule": "Only proposed or reserved may become cancelled; in-progress cannot be silently cancelled."
+  },
+  "sourceOfTruth": "xinyun-ai/coordination/change-ledger.json"
+}

package/init/xinyun-ai-init/templates/coordination-conflict-record.template.json

@@ -0,0 +1,13 @@
+{
+  "conflictId": "",
+  "conflictType": "file|api|field|message|route|business-flow",
+  "participants": [],
+  "evidence": [],
+  "severity": "low|medium|high|critical",
+  "conflictStatus": "detected",
+  "decision": null,
+  "resolvedBy": null,
+  "resolvedAt": null,
+  "resolutionEvidence": [],
+  "nextAction": "awaiting-confirmation"
+}

package/init/xinyun-ai-init/templates/coordination-contract-snapshot.template.json

@@ -0,0 +1,9 @@
+{
+  "contractId": "",
+  "contractType": "api|database-field|component|route|message|business-flow",
+  "scope": [],
+  "contentHash": "",
+  "sourceRevision": "",
+  "capturedAt": "",
+  "changeId": ""
+}

package/init/xinyun-ai-init/templates/coordination-project-facts.template.json

@@ -0,0 +1,9 @@
+{
+  "schemaVersion": 1,
+  "facts": [],
+  "recordContract": {
+    "requiredFields": ["schemaVersion", "factId", "factType", "scope", "valueHash", "source", "taskId", "sessionId", "evidence", "confidence", "factStatus", "revision", "observedAt", "updatedAt"],
+    "factStatusEnum": ["proposed", "confirmed", "superseded", "unknown", "blocked"]
+  },
+  "sourceOfTruth": "xinyun-ai/coordination/project-facts.json"
+}

package/init/xinyun-ai-init/templates/coordination-transaction.template.json

@@ -0,0 +1,16 @@
+{
+  "schemaVersion": 1,
+  "coordinationTransactionId": "",
+  "idempotencyKey": "",
+  "taskId": "",
+  "sessionId": "",
+  "targetFiles": [],
+  "phase": "prepared",
+  "attempt": 1,
+  "failureReason": null,
+  "recoveryOwner": null,
+  "createdAt": "",
+  "updatedAt": "",
+  "phaseEnum": ["prepared", "validated", "renamed", "revision-updated", "committed", "recovery-required", "blocked"],
+  "targetFileContract": ["path", "tempPath", "beforeHash", "afterHash", "targetRevision"]
+}

package/init/xinyun-ai-init/templates/core-rules.template.md

@@ -562,6 +562,20 @@ v1.7.3 fixed Codex role session contract keys: `provider=codex`, `sessionStatus=
 - 幂等键固定为 `{sourceTaskId, roleId, taskKind, targetVersion}` 的 JCS-SHA-256；同键复用同一任务。
 - 单角色写入失败为 `blocked/write-failed`，部分成功为 `partial`，全失败为 `blocked`；索引更新中断时保留活动任务并按幂等键恢复，不得伪造 `idle`。
 
+## v1.8 多会话协作规则
+
+按 v1.8-A/B/C/D 分阶段执行：先完成共享事实、状态源和事务恢复，再路由 Skill，再进行前端审计，最后才允许临时程序员并行写入。
+
+`project-facts.json` 的状态字段是 `factStatus`，`change-ledger.json` 是 `changeStatus`，冲突记录是 `conflictStatus`，任务索引是 `taskStatus`，受影响任务是 `refreshStatus`。`changeStatus` 仅允许 `proposed/reserved/in-progress/completed/conflict-pending/blocked/cancelled`，取消只允许 proposed/reserved；临时会话 `queued` 不能写入改动台账。来源缺失、枚举非法或 revision 不一致统一 `taskStatus=blocked`、`blockedReason=status-inconsistent`。
+
+跨文件控制面写入必须使用 `coordinationTransactionId` 和 `.transactions/<id>.json`，经过 `prepared/validated/renamed/revision-updated/committed/recovery-required/blocked` 阶段并逐项校验哈希。
+
+Skill 分配使用 `assignmentStatus`，使用记录使用 `usageStatus`。固定映射为 pending+selected、selected+selected/running、running+running、completed+completed、fallback+fallback、blocked+failed/blocked、cancelled+skipped；`usageStatus=failed` 必须转为 assignmentStatus=blocked，并记录 failureReason/nextAction。
+
+前端审计的 `status` 仅属于审计记录，值为 `not-started/assessing/partial/completed/blocked/unknown`；处理决定使用 `audit-only/refactor-now/defer/requires-confirmation/out-of-scope`。audit-only 零 diff，refactor-now 必须绑定计划、确认、允许路径、前后哈希和测试证据。
+
+临时程序员会话最多并行 3 个，状态与 `occupancyStatus` 分离。`occupancyStatus=unknown` 时继续占用额度。同一 changeDomain 不重复写入；unknown 占用不得自动释放，人工释放必须记录 releaseAudit。异常、超时、写回失败和测试失败不得自动重试或伪造完成。
+
 ## 自我学习
 
 发现可复用经验时，先记录为候选经验。候选经验必须标注来源、适用范围、可信度、状态和最后验证时间。用户确认后，才能合并进正式规则。

package/init/xinyun-ai-init/templates/current-task.template.md

@@ -277,3 +277,15 @@
 - status=planned/assessing/partial/blocked/paused/completed
 - coverage=full/partial/unknown
 - pauseReason=out-of-scope
+
+## v1.8 协作状态摘要
+
+- 共享事实状态源：factStatus / revision：
+- 改动台账状态：changeStatus：
+- 冲突状态：conflictStatus：
+- 受影响任务刷新状态：refreshStatus：
+- coordinationTransactionId / phase：
+- Skill assignmentStatus / usageStatus：
+- 前端审计 decision / audit status / coverage：
+- 临时会话 status / occupancyStatus / changeDomain：
+- 未验证范围与阻塞原因：

package/init/xinyun-ai-init/templates/frontend-audit.template.json

@@ -0,0 +1,27 @@
+{
+  "auditId": "",
+  "repoRoot": "",
+  "platform": "wechat-miniprogram|uni-app|html",
+  "framework": "",
+  "pagePath": "",
+  "componentPath": "",
+  "couplingType": "template-style|state-view|api-page|route-page|business-page|cross-platform|shared-component|unknown",
+  "props": [],
+  "events": [],
+  "slots": [],
+  "stateDependencies": [],
+  "apiDependencies": [],
+  "routeDependencies": [],
+  "businessFlowDependencies": [],
+  "baselineHash": "",
+  "decision": "audit-only",
+  "status": "not-started",
+  "coverage": "unknown",
+  "unverifiedScope": [],
+  "evidence": [],
+  "updatedAt": "",
+  "statusEnum": ["not-started", "assessing", "partial", "completed", "blocked", "unknown"],
+  "decisionEnum": ["audit-only", "refactor-now", "defer", "requires-confirmation", "out-of-scope"],
+  "coverageEnum": ["full", "partial", "unknown"],
+  "refactorNowRequired": ["planId", "userConfirmationId", "permittedPaths", "beforeHash", "afterHash", "diffEvidence", "testEvidence"]
+}

package/init/xinyun-ai-init/templates/init-result.template.json

@@ -7,7 +7,7 @@
   "mode": "initialization",
   "status": "pending",
   "currentVersion": null,
-  "targetVersion": "1.7.3",
+  "targetVersion": "1.8.0",
   "idempotencyKey": null,
   "createdFiles": [],
   "updatedFiles": [],

package/init/xinyun-ai-init/templates/managed-baseline.template.json

@@ -3,13 +3,13 @@
   "hashAlgorithm": "sha256",
   "contentEncoding": "utf8-normalized",
   "managedBy": "@pm_zhousl/xinyun-ai-init",
-  "lastAppliedVersion": "1.7.3",
+  "lastAppliedVersion": "1.8.0",
   "files": [
     {
       "path": "xinyun-ai/rules/core-rules.md",
       "baselineHash": null,
       "templateHash": null,
-      "lastAppliedVersion": "1.7.3",
+      "lastAppliedVersion": "1.8.0",
       "managedBy": "@pm_zhousl/xinyun-ai-init",
       "status": "unknown"
     }

package/init/xinyun-ai-init/templates/manifest.template.json

@@ -1,7 +1,7 @@
 {
   "projectName": "",
-  "xinyunAiVersion": "1.7.3",
-  "scriptVersion": "2026.07.22",
+  "xinyunAiVersion": "1.8.0",
+  "scriptVersion": "2026.07.23",
   "schemaVersion": "1",
   "initializationMode": "fast",
   "expansionMode": "triggered",
@@ -46,7 +46,11 @@
     "taskArchiveTransactions": true,
     "codeGraphRequiredInitialization": true,
     "roleExecutionVisibility": true,
-    "codexRoleSessionOrchestration": true
+    "codexRoleSessionOrchestration": true,
+    "sharedProjectFactsCoordination": true,
+    "skillRouting": true,
+    "frontendCouplingAudit": true,
+    "temporaryProgrammerSessions": true
   },
   "tasking": {
     "currentTask": "xinyun-ai/current-task.md",
@@ -76,7 +80,7 @@
     "bindings": "xinyun-ai/sessions/role-session-bindings.json",
     "bindingTemplate": "xinyun-ai-init/templates/role-session-binding.template.json",
     "parentSessionId": null,
-    "targetVersion": "1.7.3",
+    "targetVersion": "1.8.0",
     "requiredRoleCount": 5,
     "statusEnum": [
       "pending",
@@ -101,6 +105,45 @@
     "hostUnsupportedPolicy": "local-degraded-no-fake-session-id",
     "readyPolicy": "created session enters onboarding first; ready requires role understanding, responsibility confirmation, and execution eligibility gates."
   },
+  "coordination": {
+    "enabled": true,
+    "directory": "xinyun-ai/coordination/",
+    "projectFacts": "xinyun-ai/coordination/project-facts.json",
+    "changeLedger": "xinyun-ai/coordination/change-ledger.json",
+    "contractSnapshots": "xinyun-ai/coordination/contract-snapshots/",
+    "conflictRecords": "xinyun-ai/coordination/conflict-records/",
+    "transactions": "xinyun-ai/coordination/.transactions/",
+    "statusSources": {
+      "taskStatus": "xinyun-ai/tasks/task-index.json",
+      "changeStatus": "xinyun-ai/coordination/change-ledger.json",
+      "conflictStatus": "xinyun-ai/coordination/conflict-records/<conflictId>.json",
+      "refreshStatus": "affected task record"
+    },
+    "transactionPhaseEnum": ["prepared", "validated", "renamed", "revision-updated", "committed", "recovery-required", "blocked"]
+  },
+  "skills": {
+    "enabled": true,
+    "directory": "xinyun-ai/skills/",
+    "registry": "xinyun-ai/skills/registry.json",
+    "assignments": "xinyun-ai/skills/assignments.json",
+    "usageRecords": "xinyun-ai/skills/usage-records/",
+    "assignmentStatusField": "assignmentStatus",
+    "usageStatusField": "usageStatus"
+  },
+  "frontendAudit": {
+    "enabled": true,
+    "directory": "xinyun-ai/frontend-audits/",
+    "recordTemplate": "xinyun-ai-init/templates/frontend-audit.template.json",
+    "defaultDecision": "audit-only"
+  },
+  "temporarySessions": {
+    "enabled": true,
+    "directory": "xinyun-ai/sessions/temporary/",
+    "recordTemplate": "xinyun-ai-init/templates/temporary-session.template.json",
+    "maxConcurrent": 3,
+    "sessionStatusField": "status",
+    "occupancyStatusEnum": ["occupied", "released", "unknown"]
+  },
   "taskTree": {
     "enabled": true,
     "mainTaskTitlePattern": "项目初始化：<项目显示名>",

package/init/xinyun-ai-init/templates/project-check.template.md

@@ -146,3 +146,11 @@
 - decision=direct-map/rewrite-required/backend-required/unsupported/pending/unknown
 - status=planned/assessing/partial/blocked/paused/completed
 - coverage=full/partial/unknown
+
+## v1.8 检查
+
+- `xinyun-ai/coordination/` 的事实、台账、冲突和事务文件是否可追溯。
+- 是否统一使用 `assignmentStatus`，且与 `usageStatus` 合法映射。
+- 前端 audit-only 是否零 diff，refactor-now 是否有确认、哈希、diff 和测试证据。
+- 临时会话是否遵守单变更域、并发上限 3、unknown occupancy 和 releaseAudit。
+- 是否未执行自动安装依赖、业务代码修改、数据库/API改动或 Git 写操作。

package/init/xinyun-ai-init/templates/project-guide.template.md

@@ -228,3 +228,10 @@
 - decision=direct-map/rewrite-required/backend-required/unsupported/pending/unknown
 - status=planned/assessing/partial/blocked/paused/completed
 - coverage=full/partial/unknown
+
+## v1.8 协作能力
+
+- 共享事实与冲突协调：`xinyun-ai/coordination/`；状态字段按 fact/change/conflict/task/refresh 分域。
+- Skill 路由：`xinyun-ai/skills/`；正式字段为 `assignmentStatus` 与 `usageStatus`。
+- 前端耦合审计：`xinyun-ai/frontend-audits/`；audit-only 零 diff。
+- 临时程序员会话：最多 3 个并行运行额度；unknown occupancy 不自动释放。

package/init/xinyun-ai-init/templates/project-index.template.json

@@ -152,6 +152,45 @@
     ],
     "records": []
   },
+  "coordination": {
+    "enabled": true,
+    "directory": "xinyun-ai/coordination/",
+    "projectFacts": "xinyun-ai/coordination/project-facts.json",
+    "changeLedger": "xinyun-ai/coordination/change-ledger.json",
+    "contractSnapshots": "xinyun-ai/coordination/contract-snapshots/",
+    "conflictRecords": "xinyun-ai/coordination/conflict-records/",
+    "transactions": "xinyun-ai/coordination/.transactions/",
+    "statusSources": {
+      "taskStatus": "xinyun-ai/tasks/task-index.json",
+      "changeStatus": "xinyun-ai/coordination/change-ledger.json",
+      "conflictStatus": "xinyun-ai/coordination/conflict-records/<conflictId>.json",
+      "refreshStatus": "affected task record"
+    },
+    "transactionPhaseEnum": ["prepared", "validated", "renamed", "revision-updated", "committed", "recovery-required", "blocked"]
+  },
+  "skills": {
+    "enabled": true,
+    "directory": "xinyun-ai/skills/",
+    "registry": "xinyun-ai/skills/registry.json",
+    "assignments": "xinyun-ai/skills/assignments.json",
+    "usageRecords": "xinyun-ai/skills/usage-records/",
+    "assignmentStatusField": "assignmentStatus",
+    "usageStatusField": "usageStatus"
+  },
+  "frontendAudit": {
+    "enabled": true,
+    "directory": "xinyun-ai/frontend-audits/",
+    "recordTemplate": "xinyun-ai-init/templates/frontend-audit.template.json",
+    "defaultDecision": "audit-only"
+  },
+  "temporarySessions": {
+    "enabled": true,
+    "directory": "xinyun-ai/sessions/temporary/",
+    "recordTemplate": "xinyun-ai-init/templates/temporary-session.template.json",
+    "maxConcurrent": 3,
+    "sessionStatusField": "status",
+    "occupancyStatusEnum": ["occupied", "released", "unknown"]
+  },
   "codeGraphRequired": {
     "codeGraphRecordId": null,
     "required": true,

package/init/xinyun-ai-init/templates/role-session-binding.template.json

@@ -6,7 +6,7 @@
   "sessionId": null,
   "parentSessionId": null,
   "provider": "codex",
-  "targetVersion": "1.7.3",
+  "targetVersion": "1.8.0",
   "sessionStatus": "pending",
   "understandingStatus": "pending",
   "confirmationStatus": "pending",

package/init/xinyun-ai-init/templates/skills-assignments.template.json

@@ -0,0 +1,19 @@
+{
+  "schemaVersion": 1,
+  "assignments": [],
+  "recordContract": {
+    "requiredFields": ["assignmentId", "skillId", "roleId", "taskId", "workstream", "matchReason", "permittedPaths", "assignmentStatus", "usageRecordId", "createdAt", "updatedAt"],
+    "assignmentStatusEnum": ["pending", "selected", "running", "completed", "fallback", "blocked", "cancelled"],
+    "usageStatusEnum": ["selected", "running", "completed", "failed", "skipped", "fallback", "blocked"],
+    "statusMapping": {
+      "pending": ["selected"],
+      "selected": ["selected", "running"],
+      "running": ["running"],
+      "completed": ["completed"],
+      "fallback": ["fallback"],
+      "blocked": ["failed", "blocked"],
+      "cancelled": ["skipped"]
+    },
+    "failedRule": "usageStatus=failed requires assignmentStatus=blocked, failureReason and nextAction"
+  }
+}

package/init/xinyun-ai-init/templates/skills-registry.template.json

@@ -0,0 +1,10 @@
+{
+  "schemaVersion": 1,
+  "skills": [],
+  "recordContract": {
+    "requiredFields": ["skillId", "name", "version", "source", "digest", "description", "priority", "availabilityStatus", "trustStatus", "reviewedAt", "allowedRoles", "frameworks", "platforms", "dependencies", "permissions", "evidence", "fallbackPlan", "createdAt", "updatedAt"],
+    "availabilityStatusEnum": ["available", "unavailable", "disabled", "unknown"],
+    "trustStatusEnum": ["unreviewed", "reviewed", "blocked", "expired"]
+  },
+  "selectionOrder": ["project-binding", "framework-specific", "generic", "fallback"]
+}

package/init/xinyun-ai-init/templates/temporary-session.template.json

@@ -0,0 +1,32 @@
+{
+  "taskId": "",
+  "parentTaskId": "",
+  "moduleId": "",
+  "moduleOwnerTaskId": "",
+  "executorType": "temporary-programmer",
+  "provider": "codex",
+  "sessionId": null,
+  "parentSessionId": null,
+  "planId": "",
+  "userConfirmationId": "",
+  "permittedPaths": [],
+  "changeDomain": [],
+  "autoCreated": true,
+  "autoClose": true,
+  "status": "pending",
+  "occupancyStatus": "released",
+  "leaseId": null,
+  "attempt": 1,
+  "failureReason": null,
+  "nextAction": "awaiting-confirmation",
+  "closeEvidence": null,
+  "createdAt": "",
+  "updatedAt": "",
+  "closedAt": null,
+  "closedBy": null,
+  "releaseAudit": null,
+  "statusEnum": ["pending", "creating", "onboarding", "queued", "executing", "waiting-review", "completed", "blocked", "failed", "closed", "cancelled"],
+  "occupancyStatusEnum": ["occupied", "released", "unknown"],
+  "maxConcurrent": 3,
+  "unknownPolicy": "unknown occupancy continues to consume capacity until complete releaseAudit is recorded"
+}

package/init/xinyun-ai-init/version.json

@@ -1,8 +1,8 @@
 {
   "packageName": "xinyun-ai-init",
   "displayName": "欣芸技术开发 Agent 流初始化包",
-  "version": "1.7.3",
-  "scriptVersion": "2026.07.22",
+  "version": "1.8.0",
+  "scriptVersion": "2026.07.23",
   "schemaVersion": "1",
   "defaultMode": "fast-init",
   "targetWorkspace": "xinyun-ai",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pm_zhousl/xinyun-ai-init",
-  "version": "1.7.3",
+  "version": "1.8.0",
   "description": "欣芸技术开发 Agent 流初始化包",
   "bin": {
     "xinyun-ai-init": "bin/xinyun-ai-init.js"

package/scripts/verify-init-package.js

@@ -103,18 +103,18 @@ function verifyPackageFiles() {
   );
 
   addCheck(
-    "package.json 版本为 1.7.3",
-    packageJson.version === "1.7.3",
+    "package.json 版本为 1.8.0",
+    packageJson.version === "1.8.0",
     `当前版本为 ${packageJson.version}`
   );
   addCheck(
-    "version.json 版本为 1.7.3",
-    versionJson.version === "1.7.3",
+    "version.json 版本为 1.8.0",
+    versionJson.version === "1.8.0",
     `当前版本为 ${versionJson.version}`
   );
   addCheck(
-    "manifest.template.json 版本为 1.7.3",
-    manifestTemplate.xinyunAiVersion === "1.7.3",
+    "manifest.template.json 版本为 1.8.0",
+    manifestTemplate.xinyunAiVersion === "1.8.0",
     `当前版本为 ${manifestTemplate.xinyunAiVersion}`
   );
 }
@@ -469,8 +469,8 @@ function verifyInitRules() {
 
 function verifyTestScenarios() {
   requireIncludes("test-scenarios/scenarios.md", [
-    "1-96",
-    "97",
+    "1-105",
+    "106",
     "## 40. v1.6-A",
     "## 53. v1.6 tarball",
     "## 55. verify:rules",
@@ -485,7 +485,7 @@ function verifyTestScenarios() {
   ]);
 
   requireIncludes("test-scenarios/README.md", [
-    "pm_zhousl-xinyun-ai-init-1.7.3.tgz",
+    "pm_zhousl-xinyun-ai-init-1.8.0.tgz",
     "1-96",
     "97",
     "npm run verify:rules",
@@ -765,7 +765,7 @@ function verifyV16Contracts() {
   ]);
 
   requireIncludes("init/xinyun-ai-init/README.md", [
-    "当前规则版本：`1.7.3`",
+    "当前规则版本：`1.8.0`",
     "v1.6 初始化任务、幂等恢复与结果记录",
     "xinyun-ai/tasks/.idempotency/",
     "xinyun-ai/init-result.json",
@@ -965,7 +965,7 @@ function verifyV16Contracts() {
   }
 
   addCheck("init-result mode 为 initialization", initResult.mode === "initialization");
-  addCheck("init-result targetVersion=1.7.3", initResult.targetVersion === "1.7.3");
+  addCheck("init-result targetVersion=1.8.0", initResult.targetVersion === "1.8.0");
   addCheck("init-result businessCodeChanged 初始为 unknown", initResult.businessCodeChanged && initResult.businessCodeChanged.value === "unknown");
   addCheck("task-lock scope=xinyun-ai-control", taskLock.scope === "xinyun-ai-control");
   addCheck("task-lock audit 包含 released", Array.isArray(taskLock.audit) && taskLock.audit.some((item) => item.action === "released"));
@@ -1071,7 +1071,7 @@ function verifyV17Contracts() {
   addCheck("html migration pilot requires separate confirmation", htmlMigration.pilotPlan && htmlMigration.pilotPlan.requiresSeparateConfirmation === true);
 
   requireIncludes("init/xinyun-ai-init/README.md", [
-    "当前规则版本：`1.7.3`",
+    "当前规则版本：`1.8.0`",
     "v1.7 规则包一致性检查与 verify:rules",
     "frameworkStatus=confirmed/inferred/not-found/unknown/detected-unsupported",
     "v1.7 深化预算：5 层目录、80 个关键文件、100 条证据",
@@ -1090,15 +1090,15 @@ function verifyV17Contracts() {
   ]);
 
   requireIncludes("test-scenarios/scenarios.md", [
-    "当前必测场景为 1-96",
-    "当前观察场景为 97",
+    "当前必测场景为 1-105",
+    "当前观察场景为 106",
     "## 55. verify:rules 正常通过",
     "## 69. verify:rules JSON schema 和重复执行",
     "## 97. Skill 触发测试",
   ]);
 
   requireIncludes("test-scenarios/README.md", [
-    "pm_zhousl-xinyun-ai-init-1.7.3.tgz",
+    "pm_zhousl-xinyun-ai-init-1.8.0.tgz",
     "当前必测场景为 `scenarios.md` 的 1-96",
     "当前观察场景为 `scenarios.md` 的 97",
     "npm run verify:rules",
@@ -1166,7 +1166,7 @@ function verifyV171Contracts() {
   addCheck("init-result taskTree role count", initResult.taskTree && initResult.taskTree.roleTaskCount === 5, "init-result taskTree.roleTaskCount 应为 5");
 
   requireIncludes("init/xinyun-ai-init/README.md", [
-    "当前规则版本：`1.7.3`",
+    "当前规则版本：`1.8.0`",
     "项目初始化：<项目显示名>",
     "xinyun-ai/tasks/task-index.json",
     "xinyun-ai/tasks/.archive-transactions/<archiveTransactionId>.json",
@@ -1317,7 +1317,7 @@ function verifyV172Contracts() {
     addCheck(`role-execution template field ${field}`, roleExecution.includes(`- ${field}：`), `role-execution 模板缺少 ${field}`);
   }
   requireIncludes("init/xinyun-ai-init/README.md", [
-    "当前规则版本：`1.7.3`",
+    "当前规则版本：`1.8.0`",
     "xinyun-ai/tasks/role-execution/<roleTaskId>.md",
     "activeTaskIds",
     "executableTaskIds",
@@ -1362,9 +1362,9 @@ function verifyV173Contracts() {
     "manifest roleSessions.provider 必须为 codex"
   );
   addCheck(
-    "manifest roleSessions targetVersion=1.7.3",
-    manifestTemplate.roleSessions && manifestTemplate.roleSessions.targetVersion === "1.7.3",
-    "manifest roleSessions.targetVersion 必须为 1.7.3"
+    "manifest roleSessions targetVersion=1.8.0",
+    manifestTemplate.roleSessions && manifestTemplate.roleSessions.targetVersion === "1.8.0",
+    "manifest roleSessions.targetVersion 必须为 1.8.0"
   );
   addCheck(
     "manifest roleSessions bindings path",
@@ -1439,7 +1439,7 @@ function verifyV173Contracts() {
   addCheck("assignments session binding rule mentions real host value", assignments.recordContract && assignments.recordContract.sessionBindingRule.includes("real host-returned value"), "assignments sessionBindingRule 必须说明真实宿主返回值");
 
   addCheck("binding template provider codex", bindingTemplate.provider === "codex", "binding template provider 必须为 codex");
-  addCheck("binding template targetVersion=1.7.3", bindingTemplate.targetVersion === "1.7.3", "binding template targetVersion 必须为 1.7.3");
+  addCheck("binding template targetVersion=1.8.0", bindingTemplate.targetVersion === "1.8.0", "binding template targetVersion 必须为 1.8.0");
   addCheck("binding template fakeSessionId prohibited", bindingTemplate.degradation && bindingTemplate.degradation.fakeSessionIdProhibited === true, "binding template 必须禁止伪造 sessionId");
   addCheck("binding template onboarding readOnly", bindingTemplate.onboarding && bindingTemplate.onboarding.readOnly === true, "binding template onboarding.readOnly 必须为 true");
 
@@ -1468,8 +1468,72 @@ function verifyV173Contracts() {
   requireIncludes("init/xinyun-ai-init/rules/session-workbench.md", ["v1.7.3 角色会话交接字段", "roleSessionIdempotency", "不得伪造 sessionId"]);
   requireIncludes("init/xinyun-ai-init/templates/project-guide.template.md", ["v1.7.3 Codex role session anchors", "roleSessionIdempotency", "local-degraded-no-fake-session-id"]);
   requireIncludes("init/xinyun-ai-init/templates/project-check.template.md", ["v1.7.3 checks", "provider=codex", "不存在伪造 sessionId"]);
-  requireIncludes("test-scenarios/scenarios.md", ["当前必测场景为 1-96", "当前观察场景为 97", "## 89. v1.7.3 Codex 真实角色会话创建", "## 96. v1.7.3 普通咨询边界", "## 97. Skill"]);
-  requireIncludes("test-scenarios/review-template.md", ["1-96 必测", "89. v1.7.3 Codex 真实角色会话创建", "96. v1.7.3 普通咨询边界", "97. Skill"]);
+  requireIncludes("test-scenarios/scenarios.md", ["当前必测场景为 1-105", "当前观察场景为 106", "## 89. v1.7.3 Codex 真实角色会话创建", "## 96. v1.7.3 普通咨询边界", "## 97. Skill"]);
+  requireIncludes("test-scenarios/review-template.md", ["1-105 必测", "89. v1.7.3 Codex 真实角色会话创建", "96. v1.7.3 普通咨询边界", "97. Skill"]);
+}
+
+function verifyV18Contracts() {
+  const manifest = JSON.parse(readText("init/xinyun-ai-init/templates/manifest.template.json"));
+  const projectIndex = JSON.parse(readText("init/xinyun-ai-init/templates/project-index.template.json"));
+  const skillAssignments = JSON.parse(readText("init/xinyun-ai-init/templates/skills-assignments.template.json"));
+  const skillRegistry = JSON.parse(readText("init/xinyun-ai-init/templates/skills-registry.template.json"));
+  const frontendAudit = JSON.parse(readText("init/xinyun-ai-init/templates/frontend-audit.template.json"));
+  const temporarySession = JSON.parse(readText("init/xinyun-ai-init/templates/temporary-session.template.json"));
+  const transaction = JSON.parse(readText("init/xinyun-ai-init/templates/coordination-transaction.template.json"));
+  const requiredFiles = [
+    "init/xinyun-ai-init/rules/coordination.md",
+    "init/xinyun-ai-init/rules/skills.md",
+    "init/xinyun-ai-init/rules/frontend-audit.md",
+    "init/xinyun-ai-init/rules/temporary-sessions.md",
+    "init/xinyun-ai-init/templates/coordination-project-facts.template.json",
+    "init/xinyun-ai-init/templates/coordination-change-ledger.template.json",
+    "init/xinyun-ai-init/templates/coordination-contract-snapshot.template.json",
+    "init/xinyun-ai-init/templates/coordination-conflict-record.template.json",
+    "init/xinyun-ai-init/templates/coordination-transaction.template.json",
+    "init/xinyun-ai-init/templates/skills-registry.template.json",
+    "init/xinyun-ai-init/templates/skills-assignments.template.json",
+    "init/xinyun-ai-init/templates/frontend-audit.template.json",
+    "init/xinyun-ai-init/templates/temporary-session.template.json",
+    "test-scenarios/v1.8.0-scenarios.md",
+  ];
+  for (const file of requiredFiles) requireFile(file);
+
+  for (const capability of ["sharedProjectFactsCoordination", "skillRouting", "frontendCouplingAudit", "temporaryProgrammerSessions"]) {
+    addCheck(`manifest capability ${capability}`, manifest.capabilities && manifest.capabilities[capability] === true, `manifest.capabilities.${capability} 必须为 true`);
+  }
+  const pathChecks = [
+    [manifest.coordination, "directory", "xinyun-ai/coordination/"],
+    [manifest.skills, "directory", "xinyun-ai/skills/"],
+    [manifest.frontendAudit, "directory", "xinyun-ai/frontend-audits/"],
+    [manifest.temporarySessions, "directory", "xinyun-ai/sessions/temporary/"],
+    [projectIndex.coordination, "directory", "xinyun-ai/coordination/"],
+    [projectIndex.skills, "directory", "xinyun-ai/skills/"],
+    [projectIndex.frontendAudit, "directory", "xinyun-ai/frontend-audits/"],
+    [projectIndex.temporarySessions, "directory", "xinyun-ai/sessions/temporary/"],
+  ];
+  for (const [object, field, expected] of pathChecks) addCheck(`v1.8 path ${expected}`, object && object[field] === expected, `路径必须为 ${expected}`);
+
+  addCheck("coordination transaction phase enum", JSON.stringify(transaction.phaseEnum) === JSON.stringify(["prepared", "validated", "renamed", "revision-updated", "committed", "recovery-required", "blocked"]), "事务阶段不完整");
+  addCheck("Skill uses assignmentStatus", skillAssignments.recordContract && skillAssignments.recordContract.requiredFields.includes("assignmentStatus"), "Skill 分配必须使用 assignmentStatus");
+  addCheck("Skill does not use status alias", !JSON.stringify(skillAssignments).includes("assignments.json.status"), "不得使用 assignments.json.status");
+  addCheck("Skill usageStatus mapping exists", skillAssignments.recordContract && skillAssignments.recordContract.statusMapping && skillAssignments.recordContract.statusMapping.blocked.includes("failed"), "缺少失败到 blocked 的映射");
+  addCheck("Skill failed requires reason/action", skillAssignments.recordContract && skillAssignments.recordContract.failedRule.includes("failureReason") && skillAssignments.recordContract.failedRule.includes("nextAction"), "缺少失败证据契约");
+  addCheck("Skill registry separates availability/trust", skillRegistry.recordContract && skillRegistry.recordContract.requiredFields.includes("availabilityStatus") && skillRegistry.recordContract.requiredFields.includes("trustStatus"), "Skill 可用性和可信度必须独立");
+  addCheck("frontend audit-only decision", frontendAudit.decision === "audit-only", "默认必须为 audit-only");
+  addCheck("frontend audit status enum", frontendAudit.statusEnum && frontendAudit.statusEnum.includes("unknown"), "审计状态枚举不完整");
+  addCheck("frontend refactor evidence contract", frontendAudit.refactorNowRequired && frontendAudit.refactorNowRequired.includes("userConfirmationId") && frontendAudit.refactorNowRequired.includes("diffEvidence"), "refactor-now 证据契约不完整");
+  addCheck("temporary session maxConcurrent=3", temporarySession.maxConcurrent === 3, "临时会话并发上限必须为 3");
+  addCheck("temporary session has occupancyStatus", temporarySession.occupancyStatusEnum && temporarySession.occupancyStatusEnum.includes("unknown"), "缺少 occupancyStatus=unknown");
+
+  const v18Snippets = ["v1.8", "factStatus", "changeStatus", "conflictStatus", "assignmentStatus", "usageStatus", "audit-only", "refactor-now", "occupancyStatus=unknown", "coordinationTransactionId"];
+  requireIncludes("init/xinyun-ai-init/README.md", v18Snippets);
+  requireIncludes("init/xinyun-ai-init/templates/core-rules.template.md", v18Snippets);
+  requireIncludes("init/xinyun-ai-init/rules/coordination.md", ["三道门禁", "coordinationTransactionId", "status-inconsistent"]);
+  requireIncludes("init/xinyun-ai-init/rules/skills.md", ["assignmentStatus", "usageStatus", "failureReason", "nextAction"]);
+  requireIncludes("init/xinyun-ai-init/rules/frontend-audit.md", ["audit-only", "refactor-now", "unverifiedScope"]);
+  requireIncludes("init/xinyun-ai-init/rules/temporary-sessions.md", ["最多同时占用 3 个运行额度", "occupancyStatus=unknown", "releaseAudit"]);
+  requireIncludes("test-scenarios/scenarios.md", ["当前必测场景为 1-105", "当前观察场景为 106", "## 98. v1.8-A", "## 105. v1.8 敏感信息边界"]);
+  requireIncludes("test-scenarios/review-template.md", ["1-105 必测", "98. v1.8-A 状态域和来源一致性", "105. v1.8 敏感信息边界"]);
 }
 
 function main() {
@@ -1487,6 +1551,7 @@ function main() {
   verifyV171Contracts();
   verifyV172Contracts();
   verifyV173Contracts();
+  verifyV18Contracts();
   verifyTestScenarios();
   verifyJsonAndMarkdown();
 

package/scripts/verify-rules-package.js

@@ -5,7 +5,7 @@ const os = require("os");
 const path = require("path");
 const { spawnSync } = require("child_process");
 
-const VERSION = "1.7.3";
+const VERSION = "1.8.0";
 const checks = [];
 
 function parseArgs(argv) {
@@ -176,12 +176,26 @@ function validatePackageFiles(root, target, isTarball) {
     "init/xinyun-ai-init/templates/archive-transaction.template.json",
     "init/xinyun-ai-init/templates/role-execution.template.md",
     "init/xinyun-ai-init/templates/role-session-binding.template.json",
+    "init/xinyun-ai-init/templates/coordination-project-facts.template.json",
+    "init/xinyun-ai-init/templates/coordination-change-ledger.template.json",
+    "init/xinyun-ai-init/templates/coordination-contract-snapshot.template.json",
+    "init/xinyun-ai-init/templates/coordination-conflict-record.template.json",
+    "init/xinyun-ai-init/templates/coordination-transaction.template.json",
+    "init/xinyun-ai-init/templates/skills-registry.template.json",
+    "init/xinyun-ai-init/templates/skills-assignments.template.json",
+    "init/xinyun-ai-init/templates/frontend-audit.template.json",
+    "init/xinyun-ai-init/templates/temporary-session.template.json",
+    "init/xinyun-ai-init/rules/coordination.md",
+    "init/xinyun-ai-init/rules/skills.md",
+    "init/xinyun-ai-init/rules/frontend-audit.md",
+    "init/xinyun-ai-init/rules/temporary-sessions.md",
+    "test-scenarios/v1.8.0-scenarios.md",
   ];
 
   for (const file of requiredFiles) requireFile(root, target, file);
 
   if (isTarball) {
-    const sourceOnly = "version-plans/releases/v1.7.3.md";
+    const sourceOnly = "version-plans/releases/v1.8.0.md";
     addCheck(target, "package.source-only", "package", !existsPath(root, sourceOnly) ? "pass" : "warn", sourceOnly, null, "not required in tarball", existsPath(root, sourceOnly) ? "present" : "not present", "source-only version-plans is not required in tarball.", "No action required unless package policy changes.", "optional");
   }
 }
@@ -304,7 +318,7 @@ function validateV17Content(root, target) {
     "scope/unverifiedScope",
     "pauseReason=out-of-scope",
   ];
-  requireIncludes(root, target, "init/xinyun-ai-init/README.md", ["当前规则版本：`1.7.3`", ...common]);
+  requireIncludes(root, target, "init/xinyun-ai-init/README.md", ["当前规则版本：`1.8.0`", ...common]);
   requireIncludes(root, target, "init/xinyun-ai-init/templates/core-rules.template.md", common);
   requireIncludes(root, target, "init/xinyun-ai-init/templates/AGENTS.template.md", ["v1.7 规则包一致性、技术栈 profile 与 HTML 迁移准备", "`verify:rules` 只读", "ThinkPHP 不得误套其他项目", ...common.slice(5)]);
   requireIncludes(root, target, "init/xinyun-ai-init/templates/current-task.template.md", ["verify:rules.status", "language", "runtime", "platform", "framework", ...common.slice(5)]);
@@ -316,9 +330,51 @@ function validateV17Content(root, target) {
   requireIncludes(root, target, "init/xinyun-ai-init/rules/session-workbench.md", ["v1.7 任务单补充字段", "verifyRulesStatus", "migrationStatus", "HTML 迁移只允许评估和单页面 / 区块试点计划"]);
   requireIncludes(root, target, "init/xinyun-ai-init/rules/frameworks/README.md", ["v1.7 技术栈 profile", "coverage=partial", ...common.slice(5, 10)]);
   requireIncludes(root, target, "init/xinyun-ai-init/rules/frameworks/backend/php/thinkphp.md", ["v1.7 ThinkPHP 深化模块", "frameworkStatus=confirmed", "moduleStatus=loaded", "Controller", "Request/Validate", "Service", "Model/ORM", "Middleware", "队列"]);
-  requireIncludes(root, target, "test-scenarios/scenarios.md", ["当前必测场景为 1-96", "当前观察场景为 97", "## 55. verify:rules 正常通过", "## 69. verify:rules JSON schema 和重复执行"]);
+  requireIncludes(root, target, "test-scenarios/scenarios.md", ["当前必测场景为 1-105", "当前观察场景为 106", "## 55. verify:rules 正常通过", "## 69. verify:rules JSON schema 和重复执行"]);
   requireIncludes(root, target, "test-scenarios/review-template.md", ["55. verify:rules 正常通过", "69. verify:rules JSON schema 和重复执行", "97. Skill 触发测试"]);
-  requireIncludes(root, target, "test-scenarios/README.md", ["npm run verify:rules", "pm_zhousl-xinyun-ai-init-1.7.3.tgz", "v1.7.2-scenarios.md", "v1.7.3-scenarios.md", "当前必测场景为 `scenarios.md` 的 1-96", "当前观察场景为 `scenarios.md` 的 97"]);
+  requireIncludes(root, target, "test-scenarios/README.md", ["npm run verify:rules", "pm_zhousl-xinyun-ai-init-1.8.0.tgz", "v1.7.2-scenarios.md", "v1.7.3-scenarios.md", "当前版本必测场景为 `scenarios.md` 的 1-105", "106 为观察项"]);
+}
+
+function validateV18Content(root, target) {
+  const required = [
+    ["init/xinyun-ai-init/rules/coordination.md", ["factStatus", "changeStatus", "conflictStatus", "coordinationTransactionId", "status-inconsistent"]],
+    ["init/xinyun-ai-init/rules/skills.md", ["assignmentStatus", "usageStatus", "failureReason", "nextAction", "availabilityStatus", "trustStatus"]],
+    ["init/xinyun-ai-init/rules/frontend-audit.md", ["audit-only", "refactor-now", "unverifiedScope", "coverage"]],
+    ["init/xinyun-ai-init/rules/temporary-sessions.md", ["occupancyStatus=unknown", "releaseAudit", "最多同时占用 3 个运行额度"]],
+    ["test-scenarios/v1.8.0-scenarios.md", ["v1.8-01", "v1.8-08", "forbiddenOperations", "sensitiveScan"]],
+    ["init/xinyun-ai-init/README.md", ["v1.8", "assignmentStatus", "occupancyStatus=unknown", "coordinationTransactionId"]],
+    ["init/xinyun-ai-init/templates/core-rules.template.md", ["factStatus", "changeStatus", "conflictStatus", "assignmentStatus", "usageStatus"]],
+    ["init/xinyun-ai-init/templates/AGENTS.template.md", ["assignments.json.status", "assignmentStatus", "occupancyStatus"]],
+  ];
+  for (const [file, snippets] of required) requireIncludes(root, target, file, snippets, "v1.8.content");
+
+  const manifest = readJson(root, "init/xinyun-ai-init/templates/manifest.template.json");
+  const projectIndex = readJson(root, "init/xinyun-ai-init/templates/project-index.template.json");
+  const capabilities = manifest.capabilities || {};
+  for (const flag of ["sharedProjectFactsCoordination", "skillRouting", "frontendCouplingAudit", "temporaryProgrammerSessions"]) {
+    addCheck(target, "v1.8.capability", "manifest", capabilities[flag] === true ? "pass" : "fail", "init/xinyun-ai-init/templates/manifest.template.json", `capabilities.${flag}`, true, capabilities[flag], "v1.8 capability checked.", "Register the v1.8 capability.");
+  }
+  const pathPairs = [
+    [manifest.coordination, "directory", "xinyun-ai/coordination/"],
+    [manifest.skills, "directory", "xinyun-ai/skills/"],
+    [manifest.frontendAudit, "directory", "xinyun-ai/frontend-audits/"],
+    [manifest.temporarySessions, "directory", "xinyun-ai/sessions/temporary/"],
+    [projectIndex.coordination, "directory", "xinyun-ai/coordination/"],
+    [projectIndex.skills, "directory", "xinyun-ai/skills/"],
+    [projectIndex.frontendAudit, "directory", "xinyun-ai/frontend-audits/"],
+    [projectIndex.temporarySessions, "directory", "xinyun-ai/sessions/temporary/"],
+  ];
+  for (const [object, field, expected] of pathPairs) addCheck(target, "v1.8.path", "registry", object && object[field] === expected ? "pass" : "fail", "manifest/project-index templates", field, expected, object && object[field], "v1.8 path registration checked.", "Register the v1.8 control path.");
+
+  const assignments = readJson(root, "init/xinyun-ai-init/templates/skills-assignments.template.json");
+  const transaction = readJson(root, "init/xinyun-ai-init/templates/coordination-transaction.template.json");
+  const frontend = readJson(root, "init/xinyun-ai-init/templates/frontend-audit.template.json");
+  const temporary = readJson(root, "init/xinyun-ai-init/templates/temporary-session.template.json");
+  addCheck(target, "v1.8.assignment.field", "schema", assignments.recordContract.requiredFields.includes("assignmentStatus") ? "pass" : "fail", "skills-assignments.template.json", "assignmentStatus", true, assignments.recordContract.requiredFields.includes("assignmentStatus"), "assignmentStatus field checked.", "Use assignmentStatus.");
+  addCheck(target, "v1.8.assignment.no-status-alias", "schema", !JSON.stringify(assignments).includes("assignments.json.status") ? "pass" : "fail", "skills-assignments.template.json", null, "no stale status alias", JSON.stringify(assignments), "No stale assignment status alias checked.", "Remove assignments.json.status.");
+  addCheck(target, "v1.8.transaction.phase", "schema", transaction.phaseEnum.includes("recovery-required") && transaction.phaseEnum.includes("blocked") ? "pass" : "fail", "coordination-transaction.template.json", "phaseEnum", "recovery-required,blocked", transaction.phaseEnum, "Transaction phases checked.", "Restore transaction phase enum.");
+  addCheck(target, "v1.8.frontend.audit-only", "schema", frontend.decision === "audit-only" && frontend.coverage === "unknown" ? "pass" : "fail", "frontend-audit.template.json", "decision/coverage", "audit-only/unknown", `${frontend.decision}/${frontend.coverage}`, "Frontend audit default checked.", "Use read-only audit defaults.");
+  addCheck(target, "v1.8.temporary.capacity", "schema", temporary.maxConcurrent === 3 && temporary.occupancyStatusEnum.includes("unknown") ? "pass" : "fail", "temporary-session.template.json", "maxConcurrent/occupancyStatusEnum", "3/unknown", `${temporary.maxConcurrent}/${temporary.occupancyStatusEnum}`, "Temporary session capacity checked.", "Restore capacity and unknown occupancy.");
 }
 
 function validateV171Content(root, target) {
@@ -347,7 +403,7 @@ function validateV171Content(root, target) {
   requireIncludes(root, target, "init/xinyun-ai-init/rules/upgrade-rules.md", ["v1.7.1 升级补齐"]);
   requireIncludes(root, target, "init/xinyun-ai-init/rules/directory-self-completion.md", ["v1.7.1 任务树、归档与 CodeGraph 目录"]);
   requireIncludes(root, target, "init/xinyun-ai-init/rules/session-workbench.md", ["v1.7.1 任务单补充字段"]);
-  requireIncludes(root, target, "test-scenarios/scenarios.md", ["当前必测场景为 1-96", "当前观察场景为 97", "## 71. v1.7.1 主任务命名", "## 87. v1.7.1 普通咨询和版本回归"]);
+  requireIncludes(root, target, "test-scenarios/scenarios.md", ["当前必测场景为 1-105", "当前观察场景为 106", "## 71. v1.7.1 主任务命名", "## 87. v1.7.1 普通咨询和版本回归"]);
   requireIncludes(root, target, "test-scenarios/v1.7.1-scenarios.md", ["主任务命名", "CodeGraph记录与失败矩阵", "普通咨询边界"]);
 }
 
@@ -364,7 +420,7 @@ function validateV172Content(root, target) {
     "JCS-SHA-256",
     "blockedReason=write-failed",
   ];
-  requireIncludes(root, target, "init/xinyun-ai-init/README.md", ["当前规则版本：`1.7.3`", ...snippets]);
+  requireIncludes(root, target, "init/xinyun-ai-init/README.md", ["当前规则版本：`1.8.0`", ...snippets]);
   requireIncludes(root, target, "init/xinyun-ai-init/templates/core-rules.template.md", snippets);
   requireIncludes(root, target, "init/xinyun-ai-init/rules/init-rules.md", ["v1.7.2 角色后续任务可见性", "role-execution"]);
   requireIncludes(root, target, "init/xinyun-ai-init/rules/upgrade-rules.md", ["v1.7.2 升级补建角色后续任务", "write-failed"]);
@@ -408,7 +464,7 @@ function validateV173Content(root, target) {
     "created-but-writeback-failed",
     "创建成功不等于业务代码修改授权",
   ];
-  requireIncludes(root, target, "init/xinyun-ai-init/README.md", ["当前规则版本：`1.7.3`", ...snippets]);
+  requireIncludes(root, target, "init/xinyun-ai-init/README.md", ["当前规则版本：`1.8.0`", ...snippets]);
   requireIncludes(root, target, "init/xinyun-ai-init/templates/core-rules.template.md", snippets);
   requireIncludes(root, target, "init/xinyun-ai-init/templates/AGENTS.template.md", ["v1.7.3 Codex 角色会话自动创建与绑定", "provider=codex", "local-degraded-no-fake-session-id"]);
   requireIncludes(root, target, "init/xinyun-ai-init/rules/init-rules.md", ["v1.7.3 Codex 角色会话初始化", "provider=codex", "local-degraded-no-fake-session-id"]);
@@ -416,7 +472,7 @@ function validateV173Content(root, target) {
   requireIncludes(root, target, "init/xinyun-ai-init/rules/session-workbench.md", ["v1.7.3 角色会话交接字段", "roleSessionIdempotency", "不得伪造 sessionId"]);
   requireIncludes(root, target, "init/xinyun-ai-init/rules/directory-self-completion.md", ["v1.7.3 角色会话绑定目录", "xinyun-ai/sessions/role-session-bindings.json", "local-degraded-no-fake-session-id"]);
   requireIncludes(root, target, "test-scenarios/v1.7.3-scenarios.md", ["五个真实角色子会话创建", "会话绑定回写一致性", "onboarding 只读边界", "宿主不支持时本地降级"]);
-  requireIncludes(root, target, "test-scenarios/scenarios.md", ["当前必测场景为 1-96", "当前观察场景为 97", "## 89. v1.7.3 Codex 真实角色会话创建", "## 96. v1.7.3 普通咨询边界"]);
+  requireIncludes(root, target, "test-scenarios/scenarios.md", ["当前必测场景为 1-105", "当前观察场景为 106", "## 89. v1.7.3 Codex 真实角色会话创建", "## 96. v1.7.3 普通咨询边界"]);
 }
 
 function validateJsonFiles(root, target) {
@@ -458,6 +514,7 @@ function validateRoot(root, target, isTarball = false) {
   validateV171Content(root, target);
   validateV172Content(root, target);
   validateV173Content(root, target);
+  validateV18Content(root, target);
   validateJsonFiles(root, target);
 }
 

package/test-scenarios/README.md

@@ -2,6 +2,8 @@
 
 本目录用于让其他 AI 或人工审查员测试 `@pm_zhousl/xinyun-ai-init` 初始化包的真实使用效果。
 
+当前版本必测场景为 `scenarios.md` 的 1-105，106 为观察项。
+
 ## 使用方式
 
 ### 1. 本地待发布版本测试
@@ -37,7 +39,7 @@ npm pack
 随后在临时项目中使用 tarball 测试。注意不要直接执行 `npx <tarball> --force`，该形式可能不会正确调用 bin。推荐：
 
 ```powershell
-npx --yes --package E:\ai-fabu-xiangmu\AI开发初始化脚本\xinyun-ai-init-npm\pm_zhousl-xinyun-ai-init-1.7.3.tgz xinyun-ai-init --force --no-version-check
+npx --yes --package E:\ai-fabu-xiangmu\AI开发初始化脚本\xinyun-ai-init-npm\pm_zhousl-xinyun-ai-init-1.8.0.tgz xinyun-ai-init --force --no-version-check
 ```
 
 ### 3. 线上回归测试
@@ -70,7 +72,7 @@ npx --yes @pm_zhousl/xinyun-ai-init@latest --force
 ```powershell
 npm run verify:rules
 npm run verify:rules -- --json
-npm run verify:rules -- --tarball .\pm_zhousl-xinyun-ai-init-1.7.3.tgz
+npm run verify:rules -- --tarball .\pm_zhousl-xinyun-ai-init-1.8.0.tgz
 npm run verify:rules:security
 ```
 
@@ -95,6 +97,10 @@ npm run verify:init
 
 ## 审查原则
 
+## v1.8 多会话协作回归
+
+除 `scenarios.md` 外，发布前必须逐条执行 `v1.8.0-scenarios.md`。重点验证四个阶段分别通过：A 的共享事实/事务状态，B 的 Skill 路由和 `assignmentStatus` 映射，C 的前端 audit-only/refactor-now 边界，D 的临时会话并发/occupancy 恢复。真实 AI 行为报告必须保存 before/after、changedFiles、禁止操作和敏感扫描结果。
+
 - 重点看 AI 行为是否符合规则，不只看文件是否生成。
 - 初始化应轻量，不做全量扫描。
 - 改代码前必须先出方案并等待确认。

package/test-scenarios/review-template.md

@@ -1,5 +1,7 @@
 # 测试审查记录模板
 
+当前版本 1-105 必测，106 为观察项。
+
 ## 基本信息
 
 - 测试项目：
@@ -138,6 +140,16 @@
 | 96. v1.7.3 普通咨询边界 | 待填写 | 待填写 | 待填写 |
 | 97. Skill 触发测试（观察项，不阻断发布） | 待填写 | 待填写 | 待填写 |
 
+| 98. v1.8-A 状态域和来源一致性 | 待填写 | 待填写 | 待填写 |
+| 99. v1.8-A 协调事务恢复 | 待填写 | 待填写 | 待填写 |
+| 100. v1.8-B Skill 路由和状态映射 | 待填写 | 待填写 | 待填写 |
+| 101. v1.8-C 前端耦合审计 | 待填写 | 待填写 | 待填写 |
+| 102. v1.8-D 临时会话队列和并发 | 待填写 | 待填写 | 待填写 |
+| 103. v1.8-D occupancy 恢复 | 待填写 | 待填写 | 待填写 |
+| 104. v1.8 跨会话冲突追溯 | 待填写 | 待填写 | 待填写 |
+| 105. v1.8 敏感信息边界 | 待填写 | 待填写 | 待填写 |
+| 106. Skill 自动触发倾向（观察项，不阻断发布） | 待填写 | 待填写 | 待填写 |
+
 说明：Skill 触发测试是观察项。除非它影响 1-96 的必测场景，否则不作为当前版本不可发布的理由。
 
 

package/test-scenarios/scenarios.md

@@ -2,10 +2,10 @@
 
 ## 测试分级说明
 
-- 必测场景：1-96，用于判断当前版本是否可以发布。
-- 观察场景：97，用于收集后续优化建议，不作为当前版本发布阻断项。
+- 必测场景：1-105，用于判断当前版本是否可以发布。
+- 观察场景：106，用于收集后续优化建议，不作为当前版本发布阻断项。
 
-当前必测场景为 1-96；当前观察场景为 97。
+当前必测场景为 1-105；当前观察场景为 106。
 
 ## 1. 初始化可用性测试
 
@@ -1181,4 +1181,40 @@
 - 是否触发需求理解或产品 / UI 设计前置理解。
 - 是否没有默认全量启用所有 Skill。
 - 是否先输出理解结果和改动计划。
+
+## 98. v1.8-A 状态域和来源一致性
+
+验证 `factStatus`、`changeStatus`、`conflictStatus`、`taskStatus`、`refreshStatus` 分域，非法组合或 revision 不一致统一 blocked；`queued` 只能属于临时会话状态。
+
+## 99. v1.8-A 协调事务恢复
+
+验证 `coordinationTransactionId`、JCS-SHA-256 幂等、事务阶段、目标文件哈希、崩溃恢复、权限失败和重复提交不覆盖历史。
+
+## 100. v1.8-B Skill 路由和状态映射
+
+验证已确认/未识别框架、Skill 排序、依赖缺失、权限不足和未审核 Skill；确认 `assignmentStatus` 与 `usageStatus` 映射，失败必须 blocked 并记录原因和下一步。
+
+## 101. v1.8-C 前端耦合审计
+
+验证 audit-only 零 diff，refactor-now 的计划/确认/允许路径/哈希/diff/测试证据，以及预算超限的 partial/unknown。
+
+## 102. v1.8-D 临时会话队列和并发
+
+验证临时程序员会话合法流转、单变更域互斥、最多 3 个运行会话、队列稳定排序和 occupancy 初始状态。
+
+## 103. v1.8-D occupancy 恢复
+
+验证崩溃、锁损坏、不可读会话进入 `occupancyStatus=unknown` 并持续占用，人工释放必须有完整 `releaseAudit`。
+
+## 104. v1.8 跨会话冲突追溯
+
+验证共享事实、改动台账、冲突记录、刷新状态和三道协调门禁可相互追溯，单会话不得自动合并。
+
+## 105. v1.8 敏感信息边界
+
+验证 Skill、事务、审计和会话交接中的 Token、密码、私钥、`.env`、连接串和 Authorization 原文均被脱敏，禁止操作和业务基线证据完整。
+
+## 106. Skill 自动触发倾向（观察项）
+
+观察已登记 Skill 是否被合理选择，不要求实现完整自动调度，不作为 v1.8 发布阻断项。
 

package/test-scenarios/v1.8.0-scenarios.md

@@ -0,0 +1,39 @@
+# v1.8.0 专属行为场景
+
+以下场景必须在独立夹具中执行，逐项保存 `input`、`before`、`after`、`result`、`changedFiles`、`forbiddenOperations`、`evidence` 和 `sensitiveScan`。不能以文本断言替代真实 AI 行为。
+
+## v1.8-01 状态域和来源一致性
+
+构造任务、改动、冲突和刷新记录的合法/非法组合。验证 `factStatus`、`changeStatus`、`conflictStatus`、`taskStatus`、`refreshStatus` 各自裁决，非法枚举或 revision 不一致统一进入 `taskStatus=blocked`、`blockedReason=status-inconsistent`；`queued` 不出现在 changeStatus。
+
+## v1.8-02 协调事务恢复
+
+重复提交、崩溃、部分重命名、索引/事实不同步、哈希不一致和权限失败。验证 `coordinationTransactionId` 幂等复用、事务阶段、每个 targetFiles 的 path/tempPath/beforeHash/afterHash/targetRevision，以及最终 `committed` 或 `blocked`，不得只更新索引或删除历史。
+
+## v1.8-03 Skill 路由与降级
+
+准备 ThinkPHP、uni-app、微信小程序、HTML、未识别框架、多 Skill 同级、依赖缺失、权限不足和未审核外部 Skill 夹具。验证 availabilityStatus/trustStatus 独立，排序稳定，`assignmentStatus` 与 `usageStatus` 严格映射；失败映射 blocked 并有 failureReason/nextAction，不安装依赖、不伪造执行。
+
+## v1.8-04 前端审计边界
+
+执行微信小程序、uni-app、HTML 页面耦合审计。验证 audit-only 零 diff；refactor-now 只有在计划、用户确认、允许路径、前后哈希、diff 和测试证据齐全时才可执行；超预算/权限失败进入 partial/unknown 并填写 unverifiedScope。
+
+## v1.8-05 临时会话状态和队列
+
+验证 `pending -> creating -> onboarding -> executing`、容量不足 `onboarding -> queued -> creating`、容量可用时 onboarding 直达 executing。检查单变更域不重复创建、并发上限 3、确认时间/优先级/taskId 稳定排序及初始 occupancy。
+
+## v1.8-06 occupancy 恢复和人工释放
+
+模拟崩溃、锁损坏、会话不可读和人工释放。验证 `occupancyStatus=unknown` 持续占用，失败不自动重试或关闭；只有包含 auditId/releasedBy/releasedAt/reason/evidence 的 releaseAudit 才能释放额度。
+
+## v1.8-07 跨会话冲突
+
+前端任务修改服务端 API 或字段时，验证领取前、写入前、完成后三道门禁，project-facts、change-ledger、conflict-records 和 refreshStatus 可相互追溯；单会话不能自动合并或裁决。
+
+## v1.8-08 敏感信息边界
+
+将 Token、密码、私钥、`.env`、连接串和 Authorization 值放入 Skill 输入、事务错误、审计证据和会话交接。验证 JSON、Markdown、日志、stdout/stderr 和快照无敏感原文，只保留脱敏结果、路径类别或哈希。
+
+## v1.8 禁止操作
+
+所有场景必须证明未修改业务代码、数据库、API、依赖、系统环境或 Git，未执行 npm publish，未自动安装依赖，业务基线哈希不变。