@empire-builder-kit/nx 1.0.0-rc.37 → 1.0.0-rc.39

package/src/developer-agent/operation-registry.d.ts

@@ -7,8 +7,12 @@ export interface DeveloperAgentTargetInput {
     targetName: string;
 }
 export interface DeveloperAgentOperationRegistryOptions {
+    /** Full graph Slice inventory; a bounded selection cannot authorize root `all`. */
+    allSliceProjectNames?: readonly string[];
     exposedProjectNames?: readonly string[];
     externalOwnedProjectNames: readonly string[];
+    /** Diagnostic only: incomplete history retains the same conservative authority. */
+    externalOwnershipHistoryComplete?: boolean;
     namedInputDefinitions: readonly unknown[];
     reviewedExternalVerification?: readonly DeveloperAgentReviewedExternalVerification[];
 }
@@ -39,6 +43,7 @@ export declare class DeveloperAgentOperationRegistryError extends Error {
 export declare function joinDeveloperAgentAuthorityClasses(left: DeveloperAgentAuthorityClass, right: DeveloperAgentAuthorityClass): DeveloperAgentAuthorityClass | undefined;
 export declare function createDeveloperAgentOperationRegistry(projects: readonly {
     context: DeveloperAgentProjectContext;
+    localDev?: unknown;
     targets: Readonly<Record<string, TargetConfiguration>>;
 }[], options: DeveloperAgentOperationRegistryOptions): DeveloperAgentOperationRegistry;
 export declare function requireDeveloperAgentOperation(registry: DeveloperAgentOperationRegistry, id: string): DeveloperAgentSupportedOperation;

package/src/developer-agent/operation-registry.js

@@ -6,6 +6,7 @@ exports.createDeveloperAgentOperationRegistry = createDeveloperAgentOperationReg
 exports.requireDeveloperAgentOperation = requireDeveloperAgentOperation;
 exports.operationLooksMutating = operationLooksMutating;
 const node_util_1 = require("node:util");
+const contracts_js_1 = require("../local-dev/contracts.js");
 const blueprint_trust_js_1 = require("../supply-chain/blueprint-trust.js");
 const model_js_1 = require("./model.js");
 const ordering_js_1 = require("./ordering.js");
@@ -41,7 +42,7 @@ function policyLifecycleActionForTarget(targetName) {
     if (exact('deploy', 'deploy-infrastructure', 'deploy-local', 'deployment-plan', 'foundation-ready')(targetName)) {
         return 'deploy';
     }
-    if (exact('dev', 'dev-cleanup', 'dev-setup')(targetName))
+    if (exact('dev', 'dev-cleanup', 'dev-task-cleanup', 'dev-setup')(targetName))
         return 'dev';
     if (exact('db-local-migrate', 'db-migrate')(targetName))
         return 'migrate';
@@ -102,20 +103,39 @@ function runScriptSignature(targetName, expectedScript, settings = {}) {
 function executorSignature(targetName, executor, options, dependsOn, settings = {}) {
     return {
         ...settings,
-        ...(dependsOn ? { dependsOn: () => dependsOn } : {}),
+        ...(dependsOn
+            ? {
+                dependsOn: (input) => typeof dependsOn === 'function' ? dependsOn(input) : dependsOn,
+            }
+            : {}),
         executor,
         optionsMatch: options,
         targetName,
     };
 }
-const sliceVerifyDependencies = [
+// Use the inspected target inventory, not the workspace-wide Foundation
+// capability: a SQL-free Slice may coexist with a relational Slice. Any SQL
+// target keeps the SQL prerequisites mandatory, including in a partial/tampered
+// graph where db-check alone was removed.
+function sliceDeclaresSql(input) {
+    return input.project.targets.some((name) => [
+        'db-check',
+        'db-generate',
+        'db-migrate',
+        'db-local-down',
+        'db-local-migrate',
+        'db-local-up',
+        'db-retirement-rehearsal',
+    ].includes(name));
+}
+const sliceVerifyDependencies = (input) => [
     'api-contract-check',
     'async-verify',
     'authorization-check',
     'build',
     'contract-dependencies-check',
     'data-policy-check',
-    'db-check',
+    ...(sliceDeclaresSql(input) ? ['db-check'] : []),
     'frontend-boundaries',
     'lint',
     'performance-budget',
@@ -146,6 +166,7 @@ function sliceReleaseArtifactDependencies(input) {
 // external Blueprint verification instead enters through the exact protected
 // target-closure review passed to the registry below.
 const TARGET_SIGNATURES = [
+    runCommandSignature('verify-local-browser', 'node scripts/verify-local-browser.mjs', { forwardAllArgs: false }),
     runCommandSignature('api-contract-baseline', 'node --experimental-strip-types scripts/api-contract.mjs baseline', { forwardAllArgs: true }),
     runCommandSignature('api-contract-check', 'node --experimental-strip-types scripts/api-contract.mjs check', { forwardAllArgs: false }),
     runCommandSignature('api-contract-generate', 'node --experimental-strip-types scripts/api-contract.mjs generate', { forwardAllArgs: false }),
@@ -187,7 +208,7 @@ const TARGET_SIGNATURES = [
     runCommandSignature('async-workflow-recovery-report', 'node --experimental-strip-types scripts/async-recovery.mjs report workflow-recovery', { forwardAllArgs: false }),
     runCommandSignature('async-workflow-recovery-status', 'node --experimental-strip-types scripts/async-recovery.mjs status workflow-recovery', { forwardAllArgs: false }),
     runCommandSignature('async-verify', 'node --experimental-strip-types scripts/async-contract.mjs', { forwardAllArgs: false }),
-    runCommandSignature('build', 'next build web', {
+    runCommandSignature('build', 'next build --webpack web', {
         dependsOn: ['secret-guardrails', 'typecheck'],
         env: { NODE_ENV: 'production' },
     }),
@@ -233,11 +254,22 @@ const TARGET_SIGNATURES = [
     runCommandSignature('data-restore-reconcile', 'node --experimental-strip-types scripts/data-restore-reconcile.mjs', { forwardAllArgs: true }),
     runCommandSignature('data-retention', 'node --experimental-strip-types scripts/data-retention.mjs', { forwardAllArgs: true }),
     runCommandSignature('deploy', 'node scripts/confirm-deploy.mjs', {
-        dependsOn: [{ params: 'forward', target: 'db-migrate' }],
+        dependsOn: (input) => [
+            {
+                params: 'forward',
+                target: sliceDeclaresSql(input)
+                    ? 'db-migrate'
+                    : 'deploy-infrastructure',
+            },
+        ],
         forwardAllArgs: true,
     }),
     runCommandSignature('dev-prerequisite', 'node scripts/verify-live-mode.mjs', {
-        dependsOn: ['db-check', 'secret-guardrails', 'typecheck'],
+        dependsOn: (input) => [
+            ...(sliceDeclaresSql(input) ? ['db-check'] : []),
+            'secret-guardrails',
+            'typecheck',
+        ],
     }),
     runCommandSignature('frontend-boundaries', 'node scripts/frontend-boundaries.mjs --output=.ebk/evidence/frontend/frontend-boundaries.json', { forwardAllArgs: false }),
     runCommandSignature('frontend-security-headers', 'node scripts/frontend-security-headers.mjs', {
@@ -412,7 +444,6 @@ const TARGET_SIGNATURES = [
     executorSignature('deploy-local', '@empire-builder-kit/nx:local-deploy', exactOptions(() => ({ stage: 'development' })), ['workspace-health'], { nonPlannableRationale: LOCAL_OWNER_ONLY_RATIONALE }),
     executorSignature('dev', '@empire-builder-kit/nx:fleet', exactOptions(() => ({})), undefined, {
         continuous: true,
-        nonPlannableRationale: LOCAL_OWNER_ONLY_RATIONALE,
     }),
     executorSignature('developer-context', '@empire-builder-kit/nx:developer-context', exactOptions(() => ({}))),
     executorSignature('dev-doctor', '@empire-builder-kit/nx:dev-doctor', exactOptions(() => ({}))),
@@ -425,13 +456,24 @@ const TARGET_SIGNATURES = [
         stage: 'production',
     }))),
     executorSignature('secret-metadata', '@empire-builder-kit/nx:secret-metadata', exactOptions(() => ({ stage: 'development' }))),
-    executorSignature('dev-cleanup', 'nx:noop', exactOptions(() => ({})), ['db-local-down', 'secret-personal-down']),
+    executorSignature('dev-cleanup', 'nx:run-commands', exactOptions((input) => ({
+        commands: [
+            ...(sliceDeclaresSql(input)
+                ? [`pnpm nx run ${input.project.name}:db-local-down`]
+                : []),
+            `pnpm nx run ${input.project.name}:secret-personal-down`,
+        ],
+        cwd: '.',
+        forwardAllArgs: false,
+        parallel: false,
+    })), ['dev-task-cleanup']),
+    executorSignature('dev-task-cleanup', '@empire-builder-kit/nx:dev-task-cleanup', exactOptions(() => ({}))),
     executorSignature('dev', '@empire-builder-kit/nx:dev', exactOptions((input) => ({
         cwd: input.project.root,
         stageMode: 'consumer',
-    })), [
+    })), (input) => [
         'dev-prerequisite',
-        'db-local-migrate',
+        ...(sliceDeclaresSql(input) ? ['db-local-migrate'] : []),
         { params: 'forward', target: 'foundation-preflight' },
     ]),
     executorSignature('deploy-infrastructure', '@empire-builder-kit/nx:deploy', exactOptions((input) => ({
@@ -557,7 +599,7 @@ const TARGET_RULES = [
         contractClasses: ['database'],
         documentationPaths: ['AGENTS.md', 'docs/developer-agent.md'],
         evidenceClasses: ['local-integration'],
-        matches: exact('test-integration'),
+        matches: exact('test-integration', 'verify-local-browser'),
         requiredVerification: ['local-integration'],
     },
     {
@@ -566,7 +608,7 @@ const TARGET_RULES = [
         contractClasses: ['database', 'infrastructure'],
         documentationPaths: ['AGENTS.md', 'docs/developer-agent.md'],
         evidenceClasses: ['local-integration'],
-        matches: exact('dev', 'dev-cleanup', 'dev-setup', 'db-local-down', 'db-local-migrate', 'db-local-up', 'secret-personal-down'),
+        matches: exact('dev', 'dev-cleanup', 'dev-task-cleanup', 'dev-setup', 'db-local-down', 'db-local-migrate', 'db-local-up', 'secret-personal-down'),
         requiredVerification: ['local-integration'],
     },
     {
@@ -610,7 +652,7 @@ const TARGET_RULES = [
  * owner. Value-blind generated-secret initialization is admitted only through
  * its exact report-first Nx target.
  */
-function localDevOperations(projects, externalOwnedProjectNames) {
+function localDevOperations(projects, externalOwnedProjectNames, developmentClosures, blockedDevelopment) {
     const sliceNames = projects
         .map(({ context }) => context)
         .filter(({ tags }) => tags.includes('type:slice'))
@@ -646,7 +688,7 @@ function localDevOperations(projects, externalOwnedProjectNames) {
         id: `ebk-dev:${command}:${slice}`,
         owner: 'ebk-reconciler',
         policyLifecycleAction: 'dev',
-        projects: [slice],
+        projects: developmentClosures.get(slice) ?? [slice],
         requiredVerification: ['ebk-dev:doctor'],
     });
     return [
@@ -661,7 +703,7 @@ function localDevOperations(projects, externalOwnedProjectNames) {
         readOnly('ebk-dev:status', ['dev', 'status', '--json']),
         ...sliceNames.flatMap((slice) => [
             readOnly(`ebk-dev:logs:${slice}`, ['dev', 'logs', slice, '--limit=200', '--json'], [slice]),
-            ...(externalOwnedProjectNames.has(slice)
+            ...(externalOwnedProjectNames.has(slice) || blockedDevelopment.has(slice)
                 ? []
                 : [
                     lifecycle('up', slice),
@@ -822,7 +864,17 @@ function reviewedExternalDependencies(input) {
 }
 function dependencyTargets(input, dependsOn, availableProjects, availableTargets) {
     const targets = [];
-    for (const dependency of dependsOn) {
+    // The exact generated sequential composite invokes these targets after its
+    // native prerequisite; include their authority even though they are not
+    // sibling Nx prerequisites (which would execute before native cleanup).
+    const executionDependencies = input.targetName === 'dev-cleanup'
+        ? [
+            ...dependsOn,
+            ...(sliceDeclaresSql(input) ? ['db-local-down'] : []),
+            'secret-personal-down',
+        ]
+        : dependsOn;
+    for (const dependency of executionDependencies) {
         if (typeof dependency === 'string') {
             if (dependency.startsWith('^')) {
                 const targetName = dependency.slice(1);
@@ -1105,10 +1157,38 @@ function createDeveloperAgentOperationRegistry(projects, options) {
     const namedInputRuntimeDetected = options.namedInputDefinitions.some(containsRuntimeInput);
     const exposedProjectNames = new Set(options.exposedProjectNames ?? projects.map(({ context }) => context.name));
     const externalOwnedProjectNames = new Set(options.externalOwnedProjectNames);
+    const missingFleetSlice = options.allSliceProjectNames?.find((name) => !projects.some(({ context }) => context.name === name));
+    const implicitFleetCrossesExternalOwnership = (input) => externalOwnedProjectNames.size > 0 &&
+        input.target.executor === '@empire-builder-kit/nx:fleet';
     const exposedProjects = projects.filter(({ context }) => exposedProjectNames.has(context.name));
-    const operations = [
-        ...localDevOperations(exposedProjects, externalOwnedProjectNames),
-    ];
+    const operations = [];
+    const adapters = new Map();
+    const developmentClosures = new Map();
+    const developmentReasons = new Map();
+    for (const project of projects) {
+        if (project.localDev === undefined)
+            continue;
+        try {
+            adapters.set(project.context.name, (0, contracts_js_1.validateLocalDevAdapter)(project.localDev));
+        }
+        catch {
+            developmentReasons.set(project.context.name, `Slice ${project.context.name} has invalid local-development metadata; repair its versioned adapter before planning development.`);
+        }
+    }
+    for (const name of adapters.keys()) {
+        try {
+            const closure = (0, contracts_js_1.resolveFleetSliceDependencies)(adapters, [name]);
+            developmentClosures.set(name, closure);
+            const external = closure.find((dependency) => externalOwnedProjectNames.has(dependency));
+            if (external)
+                developmentReasons.set(name, options.externalOwnershipHistoryComplete === false
+                    ? `Slice ${name} has history-unverified dependency ${external}; protected external-Blueprint history is incomplete. Retained-plan execution is unavailable until the configured protected history is available. Ordinary feature work may use the documented typed generator and inspected seeded/user-owned surfaces with focused Nx checks; do not invent external Blueprint trust.`
+                    : `Slice ${name} requires external-owned dependency ${external}; use its explicit Blueprint owner. External development contracts are not authenticated by this operation registry.`);
+        }
+        catch {
+            developmentReasons.set(name, `Slice ${name} has an unresolved, cyclic, or invalid dependency Slice; repair its declared dependencySlices before planning development.`);
+        }
+    }
     const nonPlannableTargets = [];
     const unsupportedTargets = [];
     const orderedProjects = [...projects].sort((left, right) => (0, ordering_js_1.compareDeveloperAgentStrings)(left.context.name, right.context.name));
@@ -1117,7 +1197,7 @@ function createDeveloperAgentOperationRegistry(projects, options) {
         for (const [targetName, target] of Object.entries(project.targets)) {
             targetInputs.set(`${project.context.name}:${targetName}`, {
                 namedInputRuntimeDetected,
-                project: project.context,
+                project: { ...project.context, targets: Object.keys(project.targets) },
                 target,
                 targetName,
             });
@@ -1168,7 +1248,10 @@ function createDeveloperAgentOperationRegistry(projects, options) {
             authentication.set(id, false);
             return false;
         }
-        if (input.namedInputRuntimeDetected) {
+        if (input.namedInputRuntimeDetected ||
+            (input.target.executor === '@empire-builder-kit/nx:fleet' &&
+                missingFleetSlice !== undefined) ||
+            implicitFleetCrossesExternalOwnership(input)) {
             authentication.set(id, false);
             return false;
         }
@@ -1202,6 +1285,35 @@ function createDeveloperAgentOperationRegistry(projects, options) {
         }
         const nextActive = new Set(active);
         nextActive.add(id);
+        if (input.target.executor === '@empire-builder-kit/nx:fleet') {
+            for (const project of projects.filter(({ context }) => context.tags.includes('type:slice'))) {
+                if (!authenticate(`${project.context.name}:${adapters.get(project.context.name)?.target ?? 'dev'}`, nextActive)) {
+                    authentication.set(id, false);
+                    return false;
+                }
+            }
+        }
+        if (input.targetName === (adapters.get(input.project.name)?.target ?? 'dev')) {
+            if (developmentReasons.has(input.project.name)) {
+                authentication.set(id, false);
+                return false;
+            }
+            for (const name of developmentClosures.get(input.project.name) ?? []) {
+                if (name === input.project.name)
+                    continue;
+                const dependencyAdapter = adapters.get(name);
+                if (!dependencyAdapter) {
+                    authentication.set(id, false);
+                    return false;
+                }
+                const dependencyId = `${name}:${dependencyAdapter.target}`;
+                if (!authenticate(dependencyId, nextActive)) {
+                    developmentReasons.set(input.project.name, `Slice ${input.project.name} requires non-plannable dependency ${dependencyId}; use that dependency's explicit owner before planning development.`);
+                    authentication.set(id, false);
+                    return false;
+                }
+            }
+        }
         const authenticated = dependencies.every((dependency) => authenticate(dependency.id, nextActive));
         authentication.set(id, authenticated);
         return authenticated;
@@ -1238,7 +1350,24 @@ function createDeveloperAgentOperationRegistry(projects, options) {
             composedInvocations.set(memoKey, null);
             return undefined;
         }
-        const dependencies = dependencyTargetsForOperation.map((dependency) => {
+        const allDependencyTargets = [...dependencyTargetsForOperation];
+        const developmentProjects = input.target.executor === '@empire-builder-kit/nx:fleet'
+            ? projects
+                .filter(({ context }) => context.tags.includes('type:slice'))
+                .map(({ context }) => context.name)
+            : input.targetName === adapters.get(input.project.name)?.target
+                ? (developmentClosures.get(input.project.name) ?? []).filter((name) => name !== input.project.name)
+                : [];
+        for (const name of developmentProjects) {
+            const dependencyId = `${name}:${adapters.get(name)?.target ?? 'dev'}`;
+            if (!allDependencyTargets.some(({ id }) => id === dependencyId)) {
+                allDependencyTargets.push({
+                    id: dependencyId,
+                    params: 'ignore',
+                });
+            }
+        }
+        const dependencies = allDependencyTargets.map((dependency) => {
             const composed = composeInvocation(dependency.id, dependency.params === 'forward' ? forwardedStage : undefined);
             if (!composed)
                 return undefined;
@@ -1299,6 +1428,12 @@ function createDeveloperAgentOperationRegistry(projects, options) {
         }
     }
     const authenticatedTargets = new Set([...targetInputs.keys()].filter((target) => compose(target) !== undefined));
+    const blockedDevelopment = new Set(developmentReasons.keys());
+    for (const [name, adapter] of adapters) {
+        if (!authenticatedTargets.has(`${name}:${adapter.target}`))
+            blockedDevelopment.add(name);
+    }
+    operations.push(...localDevOperations(exposedProjects, externalOwnedProjectNames, developmentClosures, blockedDevelopment));
     operations.push(...sourceEditOperations(exposedProjects, authenticatedTargets, workspaceVerification));
     for (const project of orderedProjects) {
         if (!exposedProjectNames.has(project.context.name))
@@ -1307,6 +1442,27 @@ function createDeveloperAgentOperationRegistry(projects, options) {
             const target = `${project.context.name}:${targetName}`;
             const input = targetInputs.get(target);
             const signature = input ? authenticatedTargetSignature(input) : undefined;
+            if (input?.target.executor === '@empire-builder-kit/nx:fleet' &&
+                missingFleetSlice !== undefined) {
+                nonPlannableTargets.push({
+                    target,
+                    rationale: `Root Fleet development implicitly selects Slice ${missingFleetSlice} outside this bounded context. Select an owned Slice ebk-dev operation or inspect the full development target inventory first.`,
+                });
+                continue;
+            }
+            const developmentReason = developmentReasons.get(project.context.name);
+            if (developmentReason &&
+                targetName === (adapters.get(project.context.name)?.target ?? 'dev')) {
+                nonPlannableTargets.push({ target, rationale: developmentReason });
+                continue;
+            }
+            if (input && signature && implicitFleetCrossesExternalOwnership(input)) {
+                nonPlannableTargets.push({
+                    target,
+                    rationale: 'This root Fleet target implicitly selects all Slices, including external-owned Blueprint targets outside the authenticated development execution boundary. Select an owned Slice ebk-dev operation or require an explicit external Blueprint development contract from its owner (Milestone 4).',
+                });
+                continue;
+            }
             if (signature?.nonPlannableRationale &&
                 !externalOwnedProjectNames.has(project.context.name)) {
                 nonPlannableTargets.push({

package/src/developer-agent/preview-changes.d.ts

@@ -21,6 +21,8 @@ export declare class DeferredDeveloperAgentTree implements Tree {
     isFile(path: string): boolean;
     children(path: string): string[];
     listChanges(): FileChange[];
+    /** Inspect pending configuration without adding parent edits to this transaction. */
+    hasPendingChange(path: string): boolean;
     changePermissions(path: string, mode: Mode): void;
     apply(): void;
 }

package/src/developer-agent/preview-changes.js

@@ -64,7 +64,9 @@ function developerAgentPreviewOwnershipModes(tree, target) {
         }
         add('', result.value);
     }
-    if (target === 'foundation') {
+    if (target === 'foundation' ||
+        (target !== 'workspace' &&
+            tree.exists('packages/foundation/.ebk/ownership.json'))) {
         const source = tree.read('packages/foundation/.ebk/ownership.json', 'utf8');
         const result = (0, index_js_1.validateFoundationOwnershipRecord)(JSON.parse(source ?? 'null'));
         if (!result.valid) {
@@ -72,7 +74,7 @@ function developerAgentPreviewOwnershipModes(tree, target) {
         }
         add('packages/foundation', result.value);
     }
-    else if (target !== 'workspace') {
+    if (target !== 'workspace' && target !== 'foundation') {
         const prefix = `packages/${target}`;
         const source = tree.read(`${prefix}/.ebk/ownership.json`, 'utf8');
         const result = (0, index_js_1.validateGeneratedOwnershipRecord)(JSON.parse(source ?? 'null'));
@@ -181,6 +183,16 @@ class DeferredDeveloperAgentTree {
         }))
             .sort((left, right) => (0, ordering_js_1.compareDeveloperAgentStrings)(left.path, right.path));
     }
+    /** Inspect pending configuration without adding parent edits to this transaction. */
+    hasPendingChange(path) {
+        const normalized = canonicalPath(path);
+        return (this.changes.has(normalized) ||
+            (this.source instanceof DeferredDeveloperAgentTree
+                ? this.source.hasPendingChange(normalized)
+                : this.source
+                    .listChanges()
+                    .some((change) => change.path === normalized)));
+    }
     changePermissions(path, mode) {
         const contents = this.current(path);
         if (contents === null) {

package/src/developer-agent/preview-source.js

@@ -2,6 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.developerAgentGeneratorPreviewSource = developerAgentGeneratorPreviewSource;
 function developerAgentGeneratorPreviewSource(context) {
+    if (context.git.commit === null) {
+        throw new Error('Commit-bound generator previews require an initial Git commit; local orientation and feature checks do not establish committed-source authority.');
+    }
     return {
         blueprintVersions: [...context.workspace.blueprintVersions],
         ...(context.workspace.candidateProvenance

package/src/developer-agent/validation.js

@@ -482,10 +482,20 @@ function validateGitContext(value, path, issues) {
         return false;
     requireInteger(record.ahead, `${path}.ahead`, issues, 0, 1_000_000);
     requireInteger(record.behind, `${path}.behind`, issues, 0, 1_000_000);
-    requireSafeString(record.commit, `${path}.commit`, issues, {
-        maximumLength: 64,
-        pattern: COMMIT_PATTERN,
-    });
+    if (record.commit !== null) {
+        requireSafeString(record.commit, `${path}.commit`, issues, {
+            maximumLength: 64,
+            pattern: COMMIT_PATTERN,
+        });
+    }
+    else if (typeof record.branch !== 'string' ||
+        record.ahead !== 0 ||
+        record.behind !== 0 ||
+        has(record, 'upstream') ||
+        has(record, 'baseCommit') ||
+        has(record, 'headCommit')) {
+        addIssue(issues, `${path}.commit`, 'uncommitted state requires a symbolic branch without upstream or comparison authority');
+    }
     requireBoolean(record.concurrentChangeInspectionComplete, `${path}.concurrentChangeInspectionComplete`, issues);
     const concurrentChanges = requireArray(record.concurrentChanges, `${path}.concurrentChanges`, issues, MAX_CONCURRENT_PATHS);
     const concurrentPaths = new Set();
@@ -520,10 +530,12 @@ function validateGitContext(value, path, issues) {
         }
         requireInteger(concurrent.worktreeCount, `${entryPath}.worktreeCount`, issues, 1, 64);
     });
-    requireSafeString(record.defaultBaseCommit, `${path}.defaultBaseCommit`, issues, {
-        maximumLength: 64,
-        pattern: COMMIT_PATTERN,
-    });
+    if (record.defaultBaseCommit !== null) {
+        requireSafeString(record.defaultBaseCommit, `${path}.defaultBaseCommit`, issues, {
+            maximumLength: 64,
+            pattern: COMMIT_PATTERN,
+        });
+    }
     requireSafeString(record.defaultBaseRef, `${path}.defaultBaseRef`, issues, {
         maximumLength: MAX_PATH_LENGTH,
     });

package/src/developer-agent/workspace-inspection.js

@@ -6,6 +6,7 @@ const node_util_1 = require("node:util");
 const semver_1 = require("semver");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
+const contracts_js_1 = require("../local-dev/contracts.js");
 const index_js_1 = require("../ownership/index.js");
 const index_js_2 = require("../repository-policy/index.js");
 const index_js_3 = require("../work-markers/index.js");
@@ -222,7 +223,22 @@ function selectedDependencyClosureNodes(graph, selected) {
         const node = pending.pop();
         if (!node)
             continue;
-        for (const { target } of graph.dependencies[node.name] ?? []) {
+        let localDependencies = [];
+        try {
+            const adapter = (0, contracts_js_1.validateLocalDevAdapter)(node.data.metadata?.['ebk']
+                ?.localDev);
+            if (adapter.adapterVersion === 3) {
+                localDependencies = adapter.dependencySlices;
+            }
+        }
+        catch {
+            // The operation registry rejects malformed metadata; do not traverse it.
+        }
+        const dependencyNames = new Set([
+            ...(graph.dependencies[node.name] ?? []).map(({ target }) => target),
+            ...localDependencies,
+        ]);
+        for (const target of dependencyNames) {
             const dependency = graph.nodes[target];
             if (!dependency || closure.has(target))
                 continue;
@@ -612,7 +628,7 @@ function protectedExternalBlueprintVerification(root, frameworkVersion, records,
                 git.defaultBaseRef === 'refs/remotes/origin/develop'
                 ? 'develop'
                 : undefined;
-        if (!protectedBranch)
+        if (!protectedBranch || !git.commit || !git.defaultBaseCommit)
             return unavailable();
         const configurationPaths = (0, blueprint_verification_authority_js_1.assertNoMutableBlueprintVerificationConfiguration)(root);
         (0, blueprint_verification_authority_js_1.assertBlueprintVerificationNxAuthority)(readBoundedWorkspaceFile(root, 'nx.json', 'Blueprint verification Nx authority', MAX_CONTROL_JSON_BYTES).bytes.toString('utf8'));
@@ -1083,12 +1099,17 @@ function inspectDeveloperAgentWorkspace(options) {
     const marker = markerContext(root);
     const projectTargets = registryNodes.map((node) => ({
         context: projectContext(options.graph, node),
+        localDev: node.data.metadata?.['ebk']?.localDev,
         targets: (node.data.targets ?? {}),
     }));
     const externalVerification = protectedExternalBlueprintVerification(root, versions.workspace.frameworkVersion, ownership.records, options.graph, new Set(registryNodes.map(({ name }) => name)), options.blueprintTrustNow ?? new Date().toISOString(), options.git);
     const operationRegistry = (0, operation_registry_js_1.createDeveloperAgentOperationRegistry)(projectTargets, {
+        allSliceProjectNames: Object.values(options.graph.nodes)
+            .filter((node) => node.data.tags?.includes('type:slice'))
+            .map(({ name }) => name),
         exposedProjectNames: nodes.map(({ name }) => name),
         externalOwnedProjectNames: externalOwnedProjectNames(root, registryNodes, externalOwnershipRoots, options.externalOwnershipHistory, foundationProjectName),
+        externalOwnershipHistoryComplete: options.externalOwnershipHistory.complete,
         namedInputDefinitions: [
             options.workspaceNamedInputs ?? { runtime: 'uninspected' },
             ...Object.values(options.graph.nodes).map((node) => node.data.namedInputs ?? {}),
@@ -1109,13 +1130,26 @@ function inspectDeveloperAgentWorkspace(options) {
         ...externalVerification.warnings,
         ...unsupportedWarnings,
     ]);
+    // The name "verify" alone is not a framework verification obligation.
+    // Adopter-owned authoring projects may run arbitrary recipe checks; they
+    // remain visible but cannot inject authority into an unrelated operation.
+    // Keep generated obligations even when their implementation is tampered
+    // with, so planning still refuses unauthenticated required verification.
+    const governedProjectNames = new Set([
+        identity.name,
+        ...(foundationProjectName ? [foundationProjectName] : []),
+        ...ownership.records.flatMap(({ slice }) => slice ? [slice.slice, ...slice.projects] : []),
+    ]);
+    const authenticatedTargets = new Set(operationRegistry.authenticatedTargets);
     const requiredVerification = [
         ...new Set([
             ...ownership.records.flatMap((record) => record.slice && selectedProjectNames.has(record.slice.slice)
                 ? record.slice.verification.map((target) => `${record.slice.slice}:${target}`)
                 : []),
             ...projects
-                .filter(({ targets }) => targets.includes('verify'))
+                .filter(({ name, targets }) => targets.includes('verify') &&
+                (governedProjectNames.has(name) ||
+                    authenticatedTargets.has(`${name}:verify`)))
                 .map(({ name }) => `${name}:verify`),
         ]),
     ].sort();

package/src/executors/deployment-plan/deployment-plan.d.ts

@@ -7,3 +7,5 @@ interface DeploymentPlanOptions {
 }
 declare const executor: PromiseExecutor<DeploymentPlanOptions>;
 export default executor;
+/** Derive protected OCI work from the committed inventory, not Slice existence. */
+export declare function hasContainerArtifacts(value: unknown): boolean;