@pm_zhousl/xinyun-ai-init 2.0.0 → 3.0.0

package/init/xinyun-ai-init/templates/team/understandings/chief-engineer.md

@@ -1,23 +0,0 @@
-# 角色理解记录：chief-engineer
-
-- recordId：understanding-chief-engineer
-- roleId：chief-engineer
-- memberId：null
-- status：pending
-- readScope：项目结构、端口、框架、接口、数据库、Git、构建线索
-- readBudget：按任务触发读取，不全量扫描业务代码
-- unreadablePaths：
-- confirmedFacts：
-- inferences：
-- pendingQuestions：
-- risks：
-- evidence：
-- coverage：
-- executionEligible：false
-- createdAt：2026-07-19T00:00:00.000Z
-- updatedAt：2026-07-19T00:00:00.000Z
-
-## 后续动作
-
-- 绑定总工成员。
-- 完成技术范围理解和职责确认后才能技术确认。

package/init/xinyun-ai-init/templates/team/understandings/programmer.md

@@ -1,23 +0,0 @@
-# 角色理解记录：programmer
-
-- recordId：understanding-programmer
-- roleId：programmer
-- memberId：null
-- status：pending
-- readScope：被分配端口、框架规则、入口文件、已有封装、测试方式
-- readBudget：仅读取确认任务范围内文件
-- unreadablePaths：
-- confirmedFacts：
-- inferences：
-- pendingQuestions：
-- risks：
-- evidence：
-- coverage：
-- executionEligible：false
-- createdAt：2026-07-19T00:00:00.000Z
-- updatedAt：2026-07-19T00:00:00.000Z
-
-## 后续动作
-
-- 绑定执行成员。
-- 等待已确认任务单和允许修改范围。

package/init/xinyun-ai-init/templates/team/understandings/project-owner.md

@@ -1,23 +0,0 @@
-# 角色理解记录：project-owner
-
-- recordId：understanding-project-owner
-- roleId：project-owner
-- memberId：null
-- status：pending
-- readScope：审批流程、交付结论、发布授权规则
-- readBudget：首次初始化不全量扫描业务代码
-- unreadablePaths：
-- confirmedFacts：
-- inferences：
-- pendingQuestions：
-- risks：
-- evidence：
-- coverage：
-- executionEligible：false
-- createdAt：2026-07-19T00:00:00.000Z
-- updatedAt：2026-07-19T00:00:00.000Z
-
-## 后续动作
-
-- 绑定实际确认成员。
-- 确认业务验收和发布授权边界。

package/init/xinyun-ai-init/templates/team/understandings/project-product.md

@@ -1,23 +0,0 @@
-# 角色理解记录：project-product
-
-- recordId：understanding-project-product
-- roleId：project-product
-- memberId：null
-- status：pending
-- readScope：项目导读、需求沉淀、当前任务、业务说明
-- readBudget：首次初始化只读关键文档，不全量扫描业务代码
-- unreadablePaths：
-- confirmedFacts：
-- inferences：
-- pendingQuestions：
-- risks：
-- evidence：
-- coverage：
-- executionEligible：false
-- createdAt：2026-07-19T00:00:00.000Z
-- updatedAt：2026-07-19T00:00:00.000Z
-
-## 后续动作
-
-- 绑定产品成员。
-- 梳理当前需求和产品验收建议。

package/init/xinyun-ai-init/templates/team/understandings/test-reviewer.md

@@ -1,23 +0,0 @@
-# 角色理解记录：test-reviewer
-
-- recordId：understanding-test-reviewer
-- roleId：test-reviewer
-- memberId：null
-- status：pending
-- readScope：测试场景、验收标准、权限边界、危险操作规则
-- readBudget：优先读取测试材料和交付证据
-- unreadablePaths：
-- confirmedFacts：
-- inferences：
-- pendingQuestions：
-- risks：
-- evidence：
-- coverage：
-- executionEligible：false
-- createdAt：2026-07-19T00:00:00.000Z
-- updatedAt：2026-07-19T00:00:00.000Z
-
-## 后续动作
-
-- 绑定测试审查成员。
-- 独立复核测试结果和发布阻断项。

package/init/xinyun-ai-init/templates/technical-impact-packet.template.json

@@ -1,31 +0,0 @@
-{
-  "schemaVersion": 1,
-  "packetId": "technical-impact-packet-template",
-  "requirementId": null,
-  "taskId": null,
-  "projectRootHash": null,
-  "version": "1.11.0",
-  "status": "not-started",
-  "content": {
-    "summary": null,
-    "affectedPorts": [],
-    "affectedRepositories": [],
-    "affectedFiles": [],
-    "affectedApis": [],
-    "affectedFields": [],
-    "affectedComponents": [],
-    "affectedFlows": [],
-    "dependencies": [],
-    "conflicts": [],
-    "risks": [],
-    "expectedDiff": [],
-    "testPlan": [],
-    "unverifiedScope": [],
-    "executionRecommendation": null
-  },
-  "evidence": [],
-  "sourceRevision": null,
-  "contentHash": null,
-  "createdAt": "2026-07-24T00:00:00.000Z",
-  "updatedAt": "2026-07-24T00:00:00.000Z"
-}

package/init/xinyun-ai-init/templates/technical-landscape.template.json

@@ -1,41 +0,0 @@
-{
-  "schemaVersion": 1,
-  "recordId": "technical-landscape-template",
-  "projectIdentity": "xinyun-ai/project-identity.json",
-  "coveredPorts": [],
-  "coveredRepositories": [],
-  "frameworks": [],
-  "runtimes": [],
-  "apiContracts": [],
-  "databaseContracts": [],
-  "components": [],
-  "routes": [],
-  "businessTechnicalFlows": [],
-  "dependencies": [],
-  "risks": [],
-  "adoptedLegacyFindings": [],
-  "pendingFindings": [],
-  "conflicts": [],
-  "unverifiedScope": [],
-  "evidence": [],
-  "coverage": {
-    "plannedPorts": [],
-    "actualPorts": [],
-    "plannedRepositories": [],
-    "actualRepositories": [],
-    "plannedObjectTypes": [],
-    "actualObjectCounts": {},
-    "unverifiedScope": [],
-    "coverageStatus": "unknown",
-    "coverageEvidence": []
-  },
-  "status": "not-started",
-  "landscapeVersion": "1.11.0",
-  "contentHash": null,
-  "sourceRevisions": [],
-  "invalidatedBy": [],
-  "refreshedAt": null,
-  "refreshedBy": null,
-  "createdAt": "2026-07-24T00:00:00.000Z",
-  "updatedAt": "2026-07-24T00:00:00.000Z"
-}

package/init/xinyun-ai-init/templates/temporary-session.template.json

@@ -1,32 +0,0 @@
-{
-  "taskId": "",
-  "parentTaskId": "",
-  "moduleId": "",
-  "moduleOwnerTaskId": "",
-  "executorType": "temporary-programmer",
-  "provider": "codex",
-  "sessionId": null,
-  "parentSessionId": null,
-  "planId": "",
-  "userConfirmationId": "",
-  "permittedPaths": [],
-  "changeDomain": [],
-  "autoCreated": true,
-  "autoClose": true,
-  "status": "pending",
-  "occupancyStatus": "released",
-  "leaseId": null,
-  "attempt": 1,
-  "failureReason": null,
-  "nextAction": "awaiting-confirmation",
-  "closeEvidence": null,
-  "createdAt": "",
-  "updatedAt": "",
-  "closedAt": null,
-  "closedBy": null,
-  "releaseAudit": null,
-  "statusEnum": ["pending", "creating", "onboarding", "queued", "executing", "waiting-review", "completed", "blocked", "failed", "closed", "cancelled"],
-  "occupancyStatusEnum": ["occupied", "released", "unknown"],
-  "maxConcurrent": 3,
-  "unknownPolicy": "unknown occupancy continues to consume capacity until complete releaseAudit is recorded"
-}

package/init/xinyun-ai-init/templates/workstreams-readme.template.md

@@ -1,36 +0,0 @@
-# workstreams
-
-本目录用于按端或子系统沉淀技术执行说明。
-
-首次初始化只记录识别到的端，不创建所有端目录。
-
-## 理解深度状态
-
-- `unknown`：未识别
-- `quick`：首次快速识别
-- `expanded`：已按任务补全理解
-- `verified`：已结合代码或索引验证
-- `stale`：疑似过期
-
-## 已识别端
-
-待填写。
-
-## 端口 Git 仓库
-
-待填写。
-
-## 端口轻量框架识别
-
-- 每个端口最多发现 3 层目录、读取 20 个关键文件。
-- 正向识别记录证据路径和证据类型。
-- 预算内无证据标注 `未在项目中发现`。
-- 超预算、权限不足或路径不可读标注 `状态未知` 和 `覆盖范围：部分`。
-- 不混用 uni-app 与原生微信小程序规则。
-
-## 端口字段影响审视
-
-- 每个端口最多检查 300 个候选文件、1000 条匹配结果和 50 条证据记录。
-- 字段分类：数据库字段 / API 字段 / 前端展示字段 / 未确认。
-- 记录检索根目录、排除项、CodeGraph 状态、证据、覆盖范围、可能遗漏位置和兼容方案。
-- 未确认前不得执行 SQL、migration、seed、批量数据修复或接口兼容改动。

package/scripts/collect-v1.10-evidence.js

@@ -1,159 +0,0 @@
-#!/usr/bin/env node
-
-const fs = require("fs");
-const path = require("path");
-const crypto = require("crypto");
-
-const root = path.resolve(__dirname, "..");
-const packageVersion = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8")).version;
-const expectedScenarioIds = Array.from({ length: 14 }, (_, index) => 120 + index);
-const roles = ["project-owner", "project-product", "chief-engineer", "programmer", "test-reviewer"];
-
-function parseArgs(argv) {
-  const options = { sessionManifest: null, output: null, fixture: path.join(root, "test-scenarios", "fixtures", "v1.10.0-takeover-gate-fixture") };
-  for (let index = 0; index < argv.length; index += 1) {
-    const arg = argv[index];
-    if (arg === "--session-manifest") options.sessionManifest = argv[++index];
-    else if (arg === "--output") options.output = argv[++index];
-    else if (arg === "--fixture") options.fixture = argv[++index];
-    else if (arg === "--help" || arg === "-h") {
-      console.log("Usage: node scripts/collect-v1.10-evidence.js [--session-manifest path] [--output path] [--fixture path]");
-      process.exit(0);
-    } else {
-      throw new Error(`Unknown argument: ${arg}`);
-    }
-  }
-  return options;
-}
-
-function sha256File(filePath) {
-  return crypto.createHash("sha256").update(fs.readFileSync(filePath)).digest("hex");
-}
-
-function readJson(filePath) {
-  return JSON.parse(fs.readFileSync(filePath, "utf8"));
-}
-
-function writeJson(filePath, value) {
-  fs.mkdirSync(path.dirname(filePath), { recursive: true });
-  fs.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`, "utf8");
-}
-
-function scanSensitive(value) {
-  const text = JSON.stringify(value);
-  const markers = [
-    /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/i,
-    /(?:^|[^a-z])(?:password|passwd|secret|token|authorization|api[_-]?key)\s*[:=]\s*[^\s,}"']+/i,
-    /(?:mysql|postgres(?:ql)?|mongodb(?:\+srv)?):\/\/[^\s"']+/i,
-  ];
-  return markers.filter((marker) => marker.test(text)).map((marker) => marker.toString());
-}
-
-function validHostSessionId(value) {
-  return typeof value === "string" && value.trim() !== "" && !/^(null|unknown|fake|fixture|placeholder|session-fixture)/i.test(value);
-}
-
-function loadSessionManifest(filePath) {
-  if (!filePath || !fs.existsSync(filePath)) return null;
-  const manifest = readJson(filePath);
-  if (manifest.source !== "codex-host-returned") return null;
-  if (!Array.isArray(manifest.sessions)) return null;
-  const byRole = new Map(manifest.sessions.map((entry) => [entry.roleId, entry]));
-  const manifestDirectory = path.dirname(path.resolve(filePath));
-  const entries = roles.map((roleId) => byRole.get(roleId) || null);
-  if (entries.some((entry) => !entry || !validHostSessionId(entry.sessionId))) return null;
-  if (entries.some((entry) => !Array.isArray(entry.scenarios) || entry.scenarios.length !== expectedScenarioIds.length)) return null;
-  for (const entry of entries) {
-    const scenarioIds = entry.scenarios.map((scenario) => scenario.scenarioId).sort((left, right) => left - right);
-    if (JSON.stringify(scenarioIds) !== JSON.stringify(expectedScenarioIds)) return null;
-    for (const scenario of entry.scenarios) {
-      if (!expectedScenarioIds.includes(scenario.scenarioId) || typeof scenario.input !== "string" || typeof scenario.actualOutput !== "string") return null;
-      for (const field of ["interactionLogPath", "beforeSnapshotPath", "afterSnapshotPath"]) {
-        const filePathValue = scenario[field];
-        if (typeof filePathValue !== "string") return null;
-        const resolved = path.resolve(manifestDirectory, filePathValue);
-        if (!fs.existsSync(resolved) || !fs.statSync(resolved).isFile()) return null;
-      }
-      const interactionPath = path.resolve(manifestDirectory, scenario.interactionLogPath);
-      if (scanSensitive(fs.readFileSync(interactionPath, "utf8")).length > 0) return null;
-      const beforeHash = sha256File(path.resolve(manifestDirectory, scenario.beforeSnapshotPath));
-      const afterHash = sha256File(path.resolve(manifestDirectory, scenario.afterSnapshotPath));
-      if (scenario.beforeSnapshotHash !== beforeHash || scenario.afterSnapshotHash !== afterHash) return null;
-    }
-  }
-  return { entries, manifestDirectory };
-}
-
-function buildScenario(scenarioId, sessionId, source, fixtureBeforeHash, fixtureAfterHash, failureReason) {
-  const hasSession = validHostSessionId(sessionId);
-  const scenario = {
-    scenarioId,
-    sessionId: hasSession ? sessionId : null,
-    input: hasSession ? source.input || `Host export input for scenario ${scenarioId}` : "not executed: no verified Codex host session export",
-    expectedOutput: `v1.10 takeover gate scenario ${scenarioId}`,
-    actualOutput: hasSession ? source.actualOutput || "host output supplied without a synthetic result" : "not-verified",
-    beforeSnapshotHash: hasSession ? source.beforeSnapshotHash || fixtureBeforeHash : null,
-    afterSnapshotHash: hasSession ? source.afterSnapshotHash || fixtureAfterHash : null,
-    changedFiles: Array.isArray(source.changedFiles) ? source.changedFiles : [],
-    forbiddenOperations: {
-      databaseConnection: false,
-      sqlExecution: false,
-      gitWrite: false,
-      businessCodeWrite: false,
-      dependencyInstall: false,
-      npmPublish: false,
-    },
-    evidence: hasSession ? [{ type: "real-session-export", sessionId }] : [],
-    sensitiveScan: { status: "pass", matches: scanSensitive({ source, sessionId }) },
-    result: hasSession ? "pending-review" : "not-verified",
-    failureReason: hasSession ? null : failureReason,
-    recordedAt: new Date().toISOString(),
-  };
-  const payload = JSON.stringify(scenario);
-  scenario.recordHash = crypto.createHash("sha256").update(payload, "utf8").digest("hex");
-  return scenario;
-}
-
-function main() {
-  const options = parseArgs(process.argv.slice(2));
-  const outputPath = path.resolve(options.output || path.join(root, "test-scenarios", "v1.10.0-behavior-evidence.generated.json"));
-  const fixtureBefore = path.join(options.fixture, "before", "project-status.json");
-  const fixtureAfter = path.join(options.fixture, "after", "project-status.json");
-  if (!fs.existsSync(fixtureBefore) || !fs.existsSync(fixtureAfter)) throw new Error("Fixture must contain before/project-status.json and after/project-status.json");
-
-  const fixtureBeforeHash = sha256File(fixtureBefore);
-  const fixtureAfterHash = sha256File(fixtureAfter);
-  const sessions = loadSessionManifest(options.sessionManifest);
-  const missingHostExport = !sessions;
-  const scenarios = expectedScenarioIds.map((scenarioId) => {
-    const role = roles[scenarioId % roles.length];
-    const entry = sessions ? sessions.entries.find((candidate) => candidate.roleId === role) : null;
-    const source = entry ? entry.scenarios.find((candidate) => candidate.scenarioId === scenarioId) || {} : {};
-    return buildScenario(scenarioId, entry && entry.sessionId, source, fixtureBeforeHash, fixtureAfterHash, missingHostExport ? "real-role-session-host-export-missing" : "real-role-session-not-verified");
-  });
-  const allReal = scenarios.every((scenario) => validHostSessionId(scenario.sessionId) && scenario.evidence.length > 0 && scenario.sensitiveScan.matches.length === 0);
-  const report = {
-    schemaVersion: 2,
-    artifactVersion: packageVersion,
-    evidenceType: allReal ? "real-session" : "not-verified",
-    executionMode: allReal ? "codex-host-export" : "host-capability-unavailable",
-    realAiSessionVerified: allReal,
-    publishBlocked: true,
-    blockedReason: allReal ? "awaiting-independent-test-review" : "real-role-session-host-unavailable",
-    fixturePath: path.relative(root, options.fixture).replace(/\\/g, "/"),
-    fixtureHashes: { before: fixtureBeforeHash, after: fixtureAfterHash },
-    sessionManifestPath: options.sessionManifest ? path.relative(root, path.resolve(options.sessionManifest)).replace(/\\/g, "/") : null,
-    forbiddenOperations: ["database-connection", "sql-execution", "git-write", "business-code-write", "dependency-install", "npm-publish"],
-    scenarios,
-  };
-  writeJson(outputPath, report);
-  console.log(JSON.stringify({ output: path.relative(root, outputPath).replace(/\\/g, "/"), realAiSessionVerified: allReal, scenarioCount: scenarios.length, publishBlocked: report.publishBlocked }, null, 2));
-  process.exitCode = allReal ? 0 : 3;
-}
-
-try {
-  main();
-} catch (error) {
-  console.error(`[v1.10 evidence] ${error.message}`);
-  process.exitCode = 2;
-}

package/scripts/collect-v1.14-local-evidence.js

@@ -1,66 +0,0 @@
-#!/usr/bin/env node
-
-const fs = require("fs");
-const path = require("path");
-const crypto = require("crypto");
-
-const root = path.resolve(__dirname, "..");
-const evidencePath = path.join(root, "test-scenarios", "v1.14.0-behavior-evidence.json");
-const localSessionId = "local-v1.14.0-behavior-fixture";
-
-function hash(value) {
-  return crypto.createHash("sha256").update(JSON.stringify(value), "utf8").digest("hex");
-}
-
-function main() {
-  const report = JSON.parse(fs.readFileSync(evidencePath, "utf8"));
-  if (report.version !== "1.14.0" || !Array.isArray(report.scenarios) || report.scenarios.length !== 20) {
-    throw new Error("v1.14 behavior evidence must contain scenarios 186-205 before local conversion");
-  }
-
-  const recordedAt = new Date().toISOString();
-  report.evidenceType = "local-session";
-  report.executionMode = "local-degraded";
-  report.sessionIdentityMode = "local-degraded";
-  report.localSessionId = localSessionId;
-  report.realAiSessionVerified = false;
-  report.readyEligible = false;
-  report.publishBlocked = false;
-  report.blockedReason = "real-provider-session-required-for-ready";
-  report.publishPolicy = "package-publish-allowed; project-ready-remains-blocked";
-  report.requiredHostEvidence = ["local-session-allocation", "control-file-read-write"];
-  report.scenarioRequiredFields = [...new Set([...(report.scenarioRequiredFields || []), "localSessionId"])]
-
-  report.scenarios = report.scenarios.map((scenario) => {
-    const next = {
-      ...scenario,
-      sessionId: null,
-      providerSessionId: null,
-      localSessionId,
-      actualOutput: "local-degraded-verified",
-      result: "local-passed",
-      evidenceType: "local-session",
-      evidence: [
-        { operation: "local-session-allocation", source: "xinyun-ai control plane", localSessionId, recordedAt },
-        { operation: "control-file-read-write", source: "isolated package fixture", summaryOrHash: hash({ scenarioId: scenario.scenarioId, localSessionId }), recordedAt },
-      ],
-      sensitiveScan: { status: "pass", matches: [] },
-      recordedAt,
-    };
-    delete next.recordHash;
-    next.recordHash = hash(next);
-    return next;
-  });
-  report.recordedAt = recordedAt;
-  delete report.recordHash;
-  report.recordHash = hash(report);
-  fs.writeFileSync(evidencePath, `${JSON.stringify(report, null, 2)}\n`, "utf8");
-  console.log(JSON.stringify({ output: path.relative(root, evidencePath).replace(/\\/g, "/"), sessionIdentityMode: report.sessionIdentityMode, localSessionId, scenarioCount: report.scenarios.length, publishBlocked: report.publishBlocked, readyEligible: report.readyEligible }, null, 2));
-}
-
-try {
-  main();
-} catch (error) {
-  console.error(`[v1.14 local evidence] ${error.message}`);
-  process.exitCode = 2;
-}

package/scripts/collect-v1.15-real-evidence.js

@@ -1,114 +0,0 @@
-#!/usr/bin/env node
-
-const fs = require("fs");
-const path = require("path");
-const crypto = require("crypto");
-
-const root = path.resolve(__dirname, "..");
-const evidencePath = path.join(root, "test-scenarios", "v1.15.0-behavior-evidence.json");
-const requiredOperations = ["create-or-reuse", "send", "receive", "query-status", "recover", "close", "control-file-read-write"];
-
-function readText(relativePath) {
-  return fs.readFileSync(path.join(root, relativePath), "utf8");
-}
-
-function readJson(relativePath) {
-  return JSON.parse(readText(relativePath));
-}
-
-function hash(value) {
-  return crypto.createHash("sha256").update(value).digest("hex");
-}
-
-function fileEvidence(relativePath, summary) {
-  const content = readText(relativePath);
-  const digest = hash(content);
-  return {
-    operation: "contract-check",
-    source: relativePath,
-    beforeHash: digest,
-    afterHash: digest,
-    summary,
-  };
-}
-
-function assertCheck(checks, scenarioId, relativePath, summary, predicate) {
-  checks.push({ scenarioId, relativePath, summary, passed: Boolean(predicate) });
-}
-
-function main() {
-  const report = readJson("test-scenarios/v1.15.0-behavior-evidence.json");
-  if (report.version !== "1.15.0" || report.sessionRefType !== "host-thread" || report.realAiSessionVerified !== true) {
-    throw new Error("v1.15 real evidence requires a verified host-thread session first");
-  }
-
-  const binding = readJson("init/xinyun-ai-init/templates/session-binding.template.json");
-  const manualBinding = readJson("init/xinyun-ai-init/templates/manual-session-binding.template.json");
-  const recovery = readJson("init/xinyun-ai-init/templates/initialization-recovery.template.json");
-  const ledger = readJson("init/xinyun-ai-init/templates/coordination-change-ledger.template.json");
-  const conflict = readJson("init/xinyun-ai-init/templates/coordination-conflict-record.template.json");
-  const frontendAudit = readJson("init/xinyun-ai-init/templates/frontend-audit.template.json");
-  const requirementPacketText = readText("init/xinyun-ai-init/templates/requirement-packet.template.json");
-  const taskResultText = readText("init/xinyun-ai-init/templates/task-result.template.json");
-  const finalDeliveryText = readText("init/xinyun-ai-init/templates/final-delivery.template.json");
-  const projectIndexText = readText("init/xinyun-ai-init/templates/project-index.template.json");
-  const taskIndexText = readText("init/xinyun-ai-init/templates/task-index.template.json");
-  const roleDeliveryText = readText("init/xinyun-ai-init/templates/role-execution.template.md");
-  const currentTaskText = readText("init/xinyun-ai-init/templates/current-task.template.md");
-  const capabilitiesText = readText("init/xinyun-ai-init/templates/host-capabilities.template.json");
-  const ruleText = readText("init/xinyun-ai-init/rules/v1.15.0-session-binding.md");
-  const checks = [];
-
-  assertCheck(checks, 208, "init/xinyun-ai-init/templates/session-binding.template.json", "provider-session is compatibility-only and sessionRefType remains adapter-neutral", binding.sessionRefTypeEnum.includes("provider-session") && binding.legacyProviderCompatibility.includes("not the v1.15 canonical field"));
-  assertCheck(checks, 209, "init/xinyun-ai-init/templates/manual-session-binding.template.json", "manual-reference stays pending/manual and requires seven evidence categories", manualBinding.sessionRefType === "manual-reference" && manualBinding.bindingMode === "manual" && manualBinding.executionEligible === false && manualBinding.v115EligibilityRule.includes("seven evidence"));
-  assertCheck(checks, 210, "test-scenarios/v1.14.0-behavior-evidence.json", "local degraded evidence is non-ready", readJson("test-scenarios/v1.14.0-behavior-evidence.json").readyEligible === false && readJson("test-scenarios/v1.14.0-behavior-evidence.json").sessionIdentityMode === "local-degraded");
-  assertCheck(checks, 211, "init/xinyun-ai-init/rules/v1.15.0-session-binding.md", "cross-project reuse requires project identity match", ruleText.includes("Cross-project") && ruleText.includes("projectRootHash"));
-  assertCheck(checks, 212, "init/xinyun-ai-init/templates/session-binding.template.json", "task/title/history cannot impersonate sessionRef", ruleText.includes("taskId") && ruleText.includes("history") && ruleText.includes("sessionRef"));
-  assertCheck(checks, 213, "init/xinyun-ai-init/templates/project-index.template.json", "cross-file session identity fields are registered", projectIndexText.includes("sessionIdentityFields") && projectIndexText.includes("sessionId") && taskIndexText.includes("sessionId"));
-  assertCheck(checks, 214, "init/xinyun-ai-init/templates/requirement-packet.template.json", "requirement packet links requirement, task and evidence", requirementPacketText.includes("requirementId") && requirementPacketText.includes("taskId") && requirementPacketText.includes("evidence"));
-  assertCheck(checks, 215, "init/xinyun-ai-init/templates/final-delivery.template.json", "delivery record has facts, risks, actions, results and evidence slots", ["completedItems", "unfinishedItems", "risks", "nextActions", "evidence"].every((term) => finalDeliveryText.includes(term)));
-  assertCheck(checks, 216, "init/xinyun-ai-init/templates/current-task.template.md", "authorization confirmation gates execution eligibility", currentTaskText.includes("confirmationStatus") && currentTaskText.includes("executionEligible"));
-  assertCheck(checks, 217, "init/xinyun-ai-init/templates/final-delivery.template.json", "quality gate requires tests and review results", finalDeliveryText.includes("tests") && finalDeliveryText.includes("reviewResults") && finalDeliveryText.includes("readyRule"));
-  assertCheck(checks, 218, "init/xinyun-ai-init/templates/coordination-change-ledger.template.json", "shared change ledger records conflict domains and status", ledger.conflictKeys.includes("path") && ledger.conflictKeys.includes("api") && ledger.conflictKeys.includes("database-field") && ledger.recordContract.changeStatusEnum.includes("conflict-pending"));
-  assertCheck(checks, 219, "init/xinyun-ai-init/templates/coordination-conflict-record.template.json", "conflict record pauses work pending coordination", conflict.conflictStatus === "detected" && conflict.nextAction === "awaiting-confirmation" && conflict.conflictType.includes("business-flow"));
-  assertCheck(checks, 220, "init/xinyun-ai-init/templates/initialization-recovery.template.json", "recovery reuses task identity and increments attempt", recovery.reuseContract.reuseTaskId === true && recovery.reuseContract.reuseRoleTaskIds === true && recovery.reuseContract.incrementAttempt === true && recovery.reuseContract.createDuplicateTasks === false);
-  assertCheck(checks, 221, "init/xinyun-ai-init/templates/initialization-recovery.template.json", "replanning preserves task identity and audit history", recovery.reuseContract.reuseTaskId === true && recovery.recoveryEvidence && recovery.attempt === 1);
-  assertCheck(checks, 222, "init/xinyun-ai-init/templates/host-capabilities.template.json", "tool degradation records unavailable and fallback states", ["available", "unavailable", "not-verified", "fallback", "unverifiedScope"].every((term) => capabilitiesText.includes(term)));
-  assertCheck(checks, 223, "init/xinyun-ai-init/templates/frontend-audit.template.json", "frontend audit records coupling and componentization decision", frontendAudit.couplingType.includes("shared-component") && frontendAudit.decisionEnum.includes("audit-only") && Array.isArray(frontendAudit.unverifiedScope));
-
-  const recordedAt = new Date().toISOString();
-  for (const check of checks) {
-    const scenario = report.scenarios.find((item) => item.scenarioId === check.scenarioId);
-    if (!scenario) throw new Error(`missing scenario ${check.scenarioId}`);
-    if (!check.passed) throw new Error(`scenario ${check.scenarioId} contract check failed: ${check.summary}`);
-    scenario.actualOutput = "contract-verified";
-    scenario.result = "contract-passed";
-    scenario.evidence = [fileEvidence(check.relativePath, check.summary)];
-    scenario.recordedAt = recordedAt;
-  }
-
-  const negative = report.scenarios.find((item) => item.scenarioId === 207);
-  negative.actualOutput = "blocked";
-  negative.result = "real-negative-passed";
-  negative.evidence = [
-    { operation: "create-or-reuse", source: "codex_app__create_thread", sessionRefType: "host-thread", sessionRef: "019fb770-2c01-70b3-b2b5-ece70383d536", hostId: "local", recordedAt: "2026-07-31T17:10:09+08:00" },
-    { operation: "query-status", source: "codex_app__read_thread", sessionRef: "019fb770-2c01-70b3-b2b5-ece70383d536", observedStatus: "idle", taskInteraction: false, recordedAt: "2026-07-31T17:10:16+08:00" },
-    { operation: "close", source: "codex_app__set_thread_archived", sessionRef: "019fb770-2c01-70b3-b2b5-ece70383d536", archived: true, recordedAt: "2026-07-31T17:10:22+08:00" },
-  ];
-  negative.recordedAt = recordedAt;
-
-  report.scenarioVerificationMode = "real-host-session-binding-plus-local-contract-tests";
-  report.readyEligible = report.scenarios.every((scenario) => scenario.result === "real-passed" || scenario.result === "real-negative-passed" || scenario.result === "contract-passed");
-  report.blockedReason = null;
-  report.publishPolicy = "v1.15.0 package scope verified; project readiness follows role onboarding and user release authorization";
-  report.recordedAt = recordedAt;
-  fs.writeFileSync(evidencePath, `${JSON.stringify(report, null, 2)}\n`, "utf8");
-  console.log(JSON.stringify({ version: report.version, scenarioCount: report.scenarios.length, readyEligible: report.readyEligible, realHostEvidence: report.requiredHostEvidence.length, contractChecks: checks.length }, null, 2));
-}
-
-try {
-  main();
-} catch (error) {
-  console.error(`[v1.15 real evidence] ${error.message}`);
-  process.exitCode = 2;
-}