@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.40

package/src/developer-agent/operation-registry.js

@@ -6,6 +6,7 @@ exports.createDeveloperAgentOperationRegistry = createDeveloperAgentOperationReg
 exports.requireDeveloperAgentOperation = requireDeveloperAgentOperation;
 exports.operationLooksMutating = operationLooksMutating;
 const node_util_1 = require("node:util");
+const contracts_js_1 = require("../local-dev/contracts.js");
 const blueprint_trust_js_1 = require("../supply-chain/blueprint-trust.js");
 const model_js_1 = require("./model.js");
 const ordering_js_1 = require("./ordering.js");
@@ -38,10 +39,10 @@ const PROTECTED_CANONICAL_STAGES = [
 const PROTECTED_WORKFLOW_ONLY_RATIONALE = 'This exact target is reserved for a protected workflow that supplies reviewed authority and retained evidence; Developer-Agent planning must use that owning workflow.';
 const LOCAL_OWNER_ONLY_RATIONALE = 'This exact target is intentionally unavailable to Developer-Agent planning; use its bounded framework owner instead.';
 function policyLifecycleActionForTarget(targetName) {
-    if (exact('deploy', 'deploy-infrastructure', 'deployment-plan', 'foundation-ready', 'infrastructure-plan')(targetName)) {
+    if (exact('deploy', 'deploy-infrastructure', 'deploy-local', 'deployment-plan', 'foundation-ready')(targetName)) {
         return 'deploy';
     }
-    if (exact('dev', 'dev-cleanup', 'dev-setup')(targetName))
+    if (exact('dev', 'dev-cleanup', 'dev-task-cleanup', 'dev-setup')(targetName))
         return 'dev';
     if (exact('db-local-migrate', 'db-migrate')(targetName))
         return 'migrate';
@@ -60,7 +61,11 @@ function runCommandSignature(targetName, command, settings = {}) {
     return {
         ...(settings.continuous ? { continuous: true } : {}),
         ...(settings.dependsOn
-            ? { dependsOn: () => settings.dependsOn }
+            ? {
+                dependsOn: (input) => typeof settings.dependsOn === 'function'
+                    ? settings.dependsOn(input)
+                    : settings.dependsOn,
+            }
             : {}),
         executor: 'nx:run-commands',
         ...(settings.nonPlannableRationale
@@ -98,20 +103,39 @@ function runScriptSignature(targetName, expectedScript, settings = {}) {
 function executorSignature(targetName, executor, options, dependsOn, settings = {}) {
     return {
         ...settings,
-        ...(dependsOn ? { dependsOn: () => dependsOn } : {}),
+        ...(dependsOn
+            ? {
+                dependsOn: (input) => typeof dependsOn === 'function' ? dependsOn(input) : dependsOn,
+            }
+            : {}),
         executor,
         optionsMatch: options,
         targetName,
     };
 }
-const sliceVerifyDependencies = [
+// Use the inspected target inventory, not the workspace-wide Foundation
+// capability: a SQL-free Slice may coexist with a relational Slice. Any SQL
+// target keeps the SQL prerequisites mandatory, including in a partial/tampered
+// graph where db-check alone was removed.
+function sliceDeclaresSql(input) {
+    return input.project.targets.some((name) => [
+        'db-check',
+        'db-generate',
+        'db-migrate',
+        'db-local-down',
+        'db-local-migrate',
+        'db-local-up',
+        'db-retirement-rehearsal',
+    ].includes(name));
+}
+const sliceVerifyDependencies = (input) => [
     'api-contract-check',
     'async-verify',
     'authorization-check',
     'build',
     'contract-dependencies-check',
     'data-policy-check',
-    'db-check',
+    ...(sliceDeclaresSql(input) ? ['db-check'] : []),
     'frontend-boundaries',
     'lint',
     'performance-budget',
@@ -123,11 +147,26 @@ const sliceVerifyDependencies = [
     'test-integration',
     'typecheck',
 ];
+function sliceReleaseArtifactDependencies(input) {
+    if (input.project.root !== `packages/${input.project.name}` ||
+        !input.project.tags.includes('type:slice')) {
+        return [];
+    }
+    return [
+        'build',
+        {
+            params: 'ignore',
+            projects: [`@${input.project.name}/job-data-retention`],
+            target: 'build',
+        },
+    ];
+}
 // These are execution signatures, not name heuristics. Generator changes that
 // alter executor options or dependency closure must update this reviewed list;
 // external Blueprint verification instead enters through the exact protected
 // target-closure review passed to the registry below.
 const TARGET_SIGNATURES = [
+    runCommandSignature('verify-local-browser', 'node scripts/verify-local-browser.mjs', { forwardAllArgs: false }),
     runCommandSignature('api-contract-baseline', 'node --experimental-strip-types scripts/api-contract.mjs baseline', { forwardAllArgs: true }),
     runCommandSignature('api-contract-check', 'node --experimental-strip-types scripts/api-contract.mjs check', { forwardAllArgs: false }),
     runCommandSignature('api-contract-generate', 'node --experimental-strip-types scripts/api-contract.mjs generate', { forwardAllArgs: false }),
@@ -140,6 +179,14 @@ const TARGET_SIGNATURES = [
         protectedBranch: 'develop',
         protectedRef: 'refs/remotes/origin/develop',
     }))),
+    executorSignature('blueprint-trust-check-main', '@empire-builder-kit/nx:blueprint-trust', exactOptions(() => ({
+        operation: 'adopt',
+        output: '.ebk/evidence/supply-chain/blueprint-trust.json',
+        protectedBranch: 'main',
+        protectedRef: 'refs/remotes/origin/main',
+    })), undefined, {
+        nonPlannableRationale: PROTECTED_WORKFLOW_ONLY_RATIONALE,
+    }),
     executorSignature('blueprint-trust-check-protected', '@empire-builder-kit/nx:blueprint-trust', exactOptions(() => ({
         operation: 'deploy',
         output: '.ebk/evidence/supply-chain/blueprint-trust.json',
@@ -161,7 +208,7 @@ const TARGET_SIGNATURES = [
     runCommandSignature('async-workflow-recovery-report', 'node --experimental-strip-types scripts/async-recovery.mjs report workflow-recovery', { forwardAllArgs: false }),
     runCommandSignature('async-workflow-recovery-status', 'node --experimental-strip-types scripts/async-recovery.mjs status workflow-recovery', { forwardAllArgs: false }),
     runCommandSignature('async-verify', 'node --experimental-strip-types scripts/async-contract.mjs', { forwardAllArgs: false }),
-    runCommandSignature('build', 'next build web', {
+    runCommandSignature('build', 'next build --webpack web', {
         dependsOn: ['secret-guardrails', 'typecheck'],
         env: { NODE_ENV: 'production' },
     }),
@@ -170,14 +217,17 @@ const TARGET_SIGNATURES = [
     runCommandSignature('contract-dependencies-check', 'node scripts/contract-dependencies.mjs check', { forwardAllArgs: false }),
     runCommandSignature('contract-dependencies-sync', 'node scripts/contract-dependencies.mjs sync', { forwardAllArgs: false }),
     runCommandSignature('container-release-amd64', 'node ../../tools/container-release.mjs platform linux/amd64', {
+        dependsOn: ['release-artifacts'],
         forwardAllArgs: false,
         nonPlannableRationale: PROTECTED_WORKFLOW_ONLY_RATIONALE,
     }),
     runCommandSignature('container-release-arm64', 'node ../../tools/container-release.mjs platform linux/arm64', {
+        dependsOn: ['release-artifacts'],
         forwardAllArgs: false,
         nonPlannableRationale: PROTECTED_WORKFLOW_ONLY_RATIONALE,
     }),
     runCommandSignature('container-release-assemble', 'node ../../tools/container-release.mjs assemble', {
+        dependsOn: ['release-artifacts'],
         forwardAllArgs: false,
         nonPlannableRationale: PROTECTED_WORKFLOW_ONLY_RATIONALE,
     }),
@@ -204,11 +254,22 @@ const TARGET_SIGNATURES = [
     runCommandSignature('data-restore-reconcile', 'node --experimental-strip-types scripts/data-restore-reconcile.mjs', { forwardAllArgs: true }),
     runCommandSignature('data-retention', 'node --experimental-strip-types scripts/data-retention.mjs', { forwardAllArgs: true }),
     runCommandSignature('deploy', 'node scripts/confirm-deploy.mjs', {
-        dependsOn: [{ params: 'forward', target: 'db-migrate' }],
+        dependsOn: (input) => [
+            {
+                params: 'forward',
+                target: sliceDeclaresSql(input)
+                    ? 'db-migrate'
+                    : 'deploy-infrastructure',
+            },
+        ],
         forwardAllArgs: true,
     }),
     runCommandSignature('dev-prerequisite', 'node scripts/verify-live-mode.mjs', {
-        dependsOn: ['db-check', 'secret-guardrails', 'typecheck'],
+        dependsOn: (input) => [
+            ...(sliceDeclaresSql(input) ? ['db-check'] : []),
+            'secret-guardrails',
+            'typecheck',
+        ],
     }),
     runCommandSignature('frontend-boundaries', 'node scripts/frontend-boundaries.mjs --output=.ebk/evidence/frontend/frontend-boundaries.json', { forwardAllArgs: false }),
     runCommandSignature('frontend-security-headers', 'node scripts/frontend-security-headers.mjs', {
@@ -251,8 +312,18 @@ const TARGET_SIGNATURES = [
     runCommandSignature('reliability-remediation', 'node scripts/incident-remediation.mjs', { forwardAllArgs: false }),
     runCommandSignature('reliability-report', 'node scripts/reliability-report.mjs', { forwardAllArgs: false }),
     runCommandSignature('reliability-verify', 'node scripts/verify-reliability.mjs', { forwardAllArgs: false }),
-    runCommandSignature('release-artifacts', 'node --experimental-strip-types scripts/release-artifacts.mjs', { forwardAllArgs: false }),
-    runCommandSignature('release-candidate', 'node --experimental-strip-types scripts/release-candidate.mjs', { dependsOn: ['release-artifacts'], forwardAllArgs: false }),
+    runCommandSignature('release-artifacts', 'node --experimental-strip-types scripts/release-artifacts.mjs', {
+        dependsOn: sliceReleaseArtifactDependencies,
+        forwardAllArgs: false,
+    }),
+    runCommandSignature('release-candidate', 'node --experimental-strip-types scripts/release-candidate.mjs', {
+        dependsOn: [
+            'api-contract-check',
+            'release-artifacts',
+            'test-integration',
+        ],
+        forwardAllArgs: false,
+    }),
     runCommandSignature('release-lifecycle', 'node --experimental-strip-types scripts/release-lifecycle.mjs', { forwardAllArgs: false }),
     runCommandSignature('release-manifest', 'node --experimental-strip-types scripts/release-manifest.mjs', { forwardAllArgs: false }),
     runCommandSignature('release-rollout', 'node --experimental-strip-types scripts/release-rollout.mjs', { forwardAllArgs: false }),
@@ -285,26 +356,49 @@ const TARGET_SIGNATURES = [
         nonPlannableRationale: PROTECTED_WORKFLOW_ONLY_RATIONALE,
         workspaceRoot: true,
     }),
+    runCommandSignature('stage-authority-render', 'node tools/stage-authority-render.mjs', {
+        forwardAllArgs: true,
+        workspaceRoot: true,
+    }),
     runCommandSignature('workload-role-candidate-report', 'node tools/workload-role-baseline/report-candidate-bundle.mjs', { forwardAllArgs: true, workspaceRoot: true }),
     runCommandSignature('workload-role-provisioner-build', 'node tools/workload-role-baseline/build.mjs', { workspaceRoot: true }),
     runCommandSignature('verify', 'node tools/workspace-health.mjs', {
         dependsOn: ['blueprint-trust-check', 'supply-chain-check'],
         workspaceRoot: true,
     }),
+    runCommandSignature('verify-proposed', 'node tools/workspace-health.mjs', {
+        dependsOn: ['supply-chain-check'],
+        workspaceRoot: true,
+    }),
     runCommandSignature('workspace-health', 'node tools/workspace-health.mjs', {
         workspaceRoot: true,
     }),
-    runScriptSignature('build', (input) => input.project.tags.includes('scope:workspace')
-        ? `nx run-many -t build --exclude=${input.project.name}`
-        : input.project.root.includes('/services/') ||
+    runScriptSignature('build', (input) => {
+        if (input.project.tags.includes('scope:workspace')) {
+            return `nx run-many -t build --exclude=${input.project.name}`;
+        }
+        const dataRetentionJob = /^packages\/([^/]+)\/jobs\/data-retention$/u.exec(input.project.root);
+        if (dataRetentionJob) {
+            return input.project.name ===
+                `@${dataRetentionJob[1]}/job-data-retention`
+                ? 'tsc -p tsconfig.build.json'
+                : undefined;
+        }
+        return input.project.root.includes('/services/') ||
             input.project.root.includes('/jobs/')
             ? 'tsc -p tsconfig.json'
-            : undefined, { dependsOn: ['^build'] }),
+            : undefined;
+    }, { dependsOn: ['^build'] }),
     runScriptSignature('docker-build', (input) => {
         const match = /^packages\/([^/]+)\/(services|jobs)\/([^/]+)$/u.exec(input.project.root);
         if (!match)
             return undefined;
         const [, slice, plural, workload] = match;
+        if (plural === 'jobs' && workload === 'data-retention') {
+            return input.project.name === `@${slice}/job-data-retention`
+                ? `docker build -f packages/${slice}/jobs/data-retention/Dockerfile -t ${slice}-data-retention:local ../../../..`
+                : undefined;
+        }
         const kind = plural === 'services' ? 'service' : 'job';
         return (`docker build -f packages/${slice}/${plural}/${workload}/Dockerfile ` +
             `-t ${slice}-${kind}-${workload}:local ../../../..`);
@@ -318,7 +412,7 @@ const TARGET_SIGNATURES = [
         ? 'nx format:write'
         : undefined, { nonPlannableRationale: LOCAL_OWNER_ONLY_RATIONALE }),
     runScriptSignature('format:check', (input) => input.project.tags.includes('scope:workspace')
-        ? 'nx format:check'
+        ? 'nx format:check --all'
         : undefined),
     runScriptSignature('graph', (input) => input.project.tags.includes('scope:workspace') ? 'nx graph' : undefined, { nonPlannableRationale: LOCAL_OWNER_ONLY_RATIONALE }),
     runScriptSignature('health', (input) => input.project.tags.includes('scope:workspace')
@@ -347,9 +441,9 @@ const TARGET_SIGNATURES = [
         ? 'pnpm run lint && pnpm run typecheck && pnpm test && pnpm run build'
         : undefined),
     executorSignature('deployment-plan', '@empire-builder-kit/nx:deployment-plan', exactOptions(() => ({ action: 'deploy', stage: 'staging' }))),
+    executorSignature('deploy-local', '@empire-builder-kit/nx:local-deploy', exactOptions(() => ({ stage: 'development' })), ['workspace-health'], { nonPlannableRationale: LOCAL_OWNER_ONLY_RATIONALE }),
     executorSignature('dev', '@empire-builder-kit/nx:fleet', exactOptions(() => ({})), undefined, {
         continuous: true,
-        nonPlannableRationale: LOCAL_OWNER_ONLY_RATIONALE,
     }),
     executorSignature('developer-context', '@empire-builder-kit/nx:developer-context', exactOptions(() => ({}))),
     executorSignature('dev-doctor', '@empire-builder-kit/nx:dev-doctor', exactOptions(() => ({}))),
@@ -357,14 +451,29 @@ const TARGET_SIGNATURES = [
     executorSignature('github-bootstrap', '@empire-builder-kit/nx:github-bootstrap', exactOptions(() => ({}))),
     executorSignature('work-markers', '@empire-builder-kit/nx:work-markers', exactOptions(() => ({}))),
     executorSignature('secret-guardrails', '@empire-builder-kit/nx:secret-guardrails', exactOptions(() => ({}))),
+    executorSignature('secret-initialize', '@empire-builder-kit/nx:secret-initialize', exactOptions(() => ({
+        logicalName: 'GeneratedPerformanceLoadHmacKeys',
+        stage: 'production',
+    }))),
     executorSignature('secret-metadata', '@empire-builder-kit/nx:secret-metadata', exactOptions(() => ({ stage: 'development' }))),
-    executorSignature('dev-cleanup', 'nx:noop', exactOptions(() => ({})), ['db-local-down', 'secret-personal-down']),
+    executorSignature('dev-cleanup', 'nx:run-commands', exactOptions((input) => ({
+        commands: [
+            ...(sliceDeclaresSql(input)
+                ? [`pnpm nx run ${input.project.name}:db-local-down`]
+                : []),
+            `pnpm nx run ${input.project.name}:secret-personal-down`,
+        ],
+        cwd: '.',
+        forwardAllArgs: false,
+        parallel: false,
+    })), ['dev-task-cleanup']),
+    executorSignature('dev-task-cleanup', '@empire-builder-kit/nx:dev-task-cleanup', exactOptions(() => ({}))),
     executorSignature('dev', '@empire-builder-kit/nx:dev', exactOptions((input) => ({
         cwd: input.project.root,
         stageMode: 'consumer',
-    })), [
+    })), (input) => [
         'dev-prerequisite',
-        'db-local-migrate',
+        ...(sliceDeclaresSql(input) ? ['db-local-migrate'] : []),
         { params: 'forward', target: 'foundation-preflight' },
     ]),
     executorSignature('deploy-infrastructure', '@empire-builder-kit/nx:deploy', exactOptions((input) => ({
@@ -378,13 +487,11 @@ const TARGET_SIGNATURES = [
         stageMode: 'foundation',
     })), ['verify', { params: 'forward', target: 'profile-preflight' }]),
     executorSignature('infrastructure-plan', '@empire-builder-kit/nx:infrastructure-plan', exactOptions((input) => ({
-        action: 'deploy',
         cwd: input.project.root,
         stage: 'development',
         stageMode: 'consumer',
     }))),
     executorSignature('infrastructure-plan', '@empire-builder-kit/nx:infrastructure-plan', exactOptions((input) => ({
-        action: 'deploy',
         cwd: input.project.root,
         stage: 'development',
         stageMode: 'foundation',
@@ -421,6 +528,7 @@ const TARGET_SIGNATURES = [
             'capabilities,contract,deployIfMissing,foundationProject,stage', [{ params: 'ignore', projects: ['foundation'], target: 'verify' }]),
     executorSignature('profile-preflight', '@empire-builder-kit/nx:foundation-profile-preflight', exactOptions(() => ({ stage: 'development' }))),
     executorSignature('remove-preflight', '@empire-builder-kit/nx:foundation-remove-preflight', exactOptions(() => ({ stage: 'development' }))),
+    executorSignature('router-waf-rehearsal', '@empire-builder-kit/nx:router-waf-rehearsal', exactOptions(() => ({})), undefined, { nonPlannableRationale: LOCAL_OWNER_ONLY_RATIONALE }),
 ];
 /**
  * Rules are deliberately ordered from highest/conservative authority to
@@ -481,7 +589,7 @@ const TARGET_RULES = [
             'docs/developer-agent.md',
         ],
         evidenceClasses: ['protected-promotion-proof'],
-        matches: (targetName) => exact('deployment-plan', 'github-bootstrap', 'infrastructure-plan', 'infrastructure-drift', 'ecr-inspector-collect', 'performance-cost-collect', 'reliability-deployed-verify', 'reliability-diagnostic', 'reliability-exercise-collect', 'secret-metadata', 'smoke-deployed')(targetName),
+        matches: (targetName) => exact('deployment-plan', 'github-bootstrap', 'infrastructure-plan', 'infrastructure-drift', 'ecr-inspector-collect', 'performance-cost-collect', 'reliability-deployed-verify', 'reliability-diagnostic', 'reliability-exercise-collect', 'secret-initialize', 'secret-metadata', 'smoke-deployed', 'stage-authority-render')(targetName),
         requiredVerification: ['source', 'protected-proof'],
     },
     {
@@ -491,7 +599,7 @@ const TARGET_RULES = [
         contractClasses: ['database'],
         documentationPaths: ['AGENTS.md', 'docs/developer-agent.md'],
         evidenceClasses: ['local-integration'],
-        matches: exact('test-integration'),
+        matches: exact('test-integration', 'verify-local-browser'),
         requiredVerification: ['local-integration'],
     },
     {
@@ -500,7 +608,7 @@ const TARGET_RULES = [
         contractClasses: ['database', 'infrastructure'],
         documentationPaths: ['AGENTS.md', 'docs/developer-agent.md'],
         evidenceClasses: ['local-integration'],
-        matches: exact('dev', 'dev-cleanup', 'dev-setup', 'db-local-down', 'db-local-migrate', 'db-local-up', 'secret-personal-down'),
+        matches: exact('dev', 'dev-cleanup', 'dev-task-cleanup', 'dev-setup', 'db-local-down', 'db-local-migrate', 'db-local-up', 'secret-personal-down'),
         requiredVerification: ['local-integration'],
     },
     {
@@ -515,7 +623,7 @@ const TARGET_RULES = [
         ],
         documentationPaths: ['AGENTS.md', 'docs/developer-agent.md'],
         evidenceClasses: ['source'],
-        matches: (targetName) => exact('api-contract-baseline', 'api-contract-generate', 'authorization-check', 'build', 'configuration-expected', 'contract-dependencies-sync', 'db-generate', 'ecr-scan-applicability', 'format:check', 'frontend-visual', 'frontend-visual-update', 'install-git-hooks', 'performance-tag-coverage', 'performance-unit-cost', 'release-artifacts', 'release-candidate', 'release-manifest', 'smoke-deployed-check', 'supply-chain-scan', 'test', 'typecheck', 'verify', 'workload-role-provisioner-build')(targetName),
+        matches: (targetName) => exact('api-contract-baseline', 'api-contract-generate', 'authorization-check', 'build', 'configuration-expected', 'contract-dependencies-sync', 'db-generate', 'ecr-scan-applicability', 'format:check', 'frontend-visual', 'frontend-visual-update', 'install-git-hooks', 'performance-tag-coverage', 'performance-unit-cost', 'release-artifacts', 'release-candidate', 'release-manifest', 'smoke-deployed-check', 'supply-chain-scan', 'test', 'typecheck', 'verify', 'verify-proposed', 'workload-role-provisioner-build')(targetName),
         requiredVerification: ['source'],
     },
     {
@@ -540,9 +648,11 @@ const TARGET_RULES = [
  * Static invocable operations contain complete argv only. Source edits use a
  * commandless, project-scoped identity. Stable generators use commandless
  * typed templates that planning binds to exact normalized argv. Mutable dev
- * configuration and human-only secret set/remove stay with their direct owner.
+ * configuration and human-supplied secret set/remove stay with their direct
+ * owner. Value-blind generated-secret initialization is admitted only through
+ * its exact report-first Nx target.
  */
-function localDevOperations(projects, externalOwnedProjectNames) {
+function localDevOperations(projects, externalOwnedProjectNames, developmentClosures, blockedDevelopment) {
     const sliceNames = projects
         .map(({ context }) => context)
         .filter(({ tags }) => tags.includes('type:slice'))
@@ -578,7 +688,7 @@ function localDevOperations(projects, externalOwnedProjectNames) {
         id: `ebk-dev:${command}:${slice}`,
         owner: 'ebk-reconciler',
         policyLifecycleAction: 'dev',
-        projects: [slice],
+        projects: developmentClosures.get(slice) ?? [slice],
         requiredVerification: ['ebk-dev:doctor'],
     });
     return [
@@ -593,7 +703,7 @@ function localDevOperations(projects, externalOwnedProjectNames) {
         readOnly('ebk-dev:status', ['dev', 'status', '--json']),
         ...sliceNames.flatMap((slice) => [
             readOnly(`ebk-dev:logs:${slice}`, ['dev', 'logs', slice, '--limit=200', '--json'], [slice]),
-            ...(externalOwnedProjectNames.has(slice)
+            ...(externalOwnedProjectNames.has(slice) || blockedDevelopment.has(slice)
                 ? []
                 : [
                     lifecycle('up', slice),
@@ -754,7 +864,17 @@ function reviewedExternalDependencies(input) {
 }
 function dependencyTargets(input, dependsOn, availableProjects, availableTargets) {
     const targets = [];
-    for (const dependency of dependsOn) {
+    // The exact generated sequential composite invokes these targets after its
+    // native prerequisite; include their authority even though they are not
+    // sibling Nx prerequisites (which would execute before native cleanup).
+    const executionDependencies = input.targetName === 'dev-cleanup'
+        ? [
+            ...dependsOn,
+            ...(sliceDeclaresSql(input) ? ['db-local-down'] : []),
+            'secret-personal-down',
+        ]
+        : dependsOn;
+    for (const dependency of executionDependencies) {
         if (typeof dependency === 'string') {
             if (dependency.startsWith('^')) {
                 const targetName = dependency.slice(1);
@@ -988,12 +1108,34 @@ function composeTargetOperation(operation, dependencies) {
 function sourceEditOperations(projects, authenticatedTargets, workspaceVerification) {
     return projects.flatMap(({ context }) => {
         const projectVerification = `${context.name}:verify`;
-        const requiredVerification = context.targets.includes('verify')
+        const fallbackVerification = context.targets.includes('verify')
             ? authenticatedTargets.has(projectVerification)
                 ? projectVerification
                 : undefined
             : workspaceVerification;
-        if (!requiredVerification)
+        const featureTargets = ['lint', 'secret-guardrails', 'test', 'typecheck']
+            .filter((target) => context.targets.includes(target))
+            .map((target) => `${context.name}:${target}`);
+        // Never substitute an unauthenticated check with a weaker fallback.
+        if (featureTargets.some((target) => !authenticatedTargets.has(target)))
+            return [];
+        const workspace = workspaceVerification?.slice(0, workspaceVerification.lastIndexOf(':'));
+        const ownershipChecks = workspace
+            ? ['work-markers', 'workspace-health']
+                .map((target) => `${workspace}:${target}`)
+                .filter((target) => authenticatedTargets.has(target))
+            : [];
+        const requiredVerification = [
+            ...new Set([
+                ...(featureTargets.length > 0
+                    ? featureTargets
+                    : fallbackVerification
+                        ? [fallbackVerification]
+                        : []),
+                ...ownershipChecks,
+            ]),
+        ].sort();
+        if (requiredVerification.length === 0)
             return [];
         return [
             {
@@ -1006,7 +1148,7 @@ function sourceEditOperations(projects, authenticatedTargets, workspaceVerificat
                 id: `source-edit:${context.name}`,
                 owner: 'source-edit',
                 projects: [context.name],
-                requiredVerification: [requiredVerification],
+                requiredVerification,
             },
         ];
     });
@@ -1015,10 +1157,38 @@ function createDeveloperAgentOperationRegistry(projects, options) {
     const namedInputRuntimeDetected = options.namedInputDefinitions.some(containsRuntimeInput);
     const exposedProjectNames = new Set(options.exposedProjectNames ?? projects.map(({ context }) => context.name));
     const externalOwnedProjectNames = new Set(options.externalOwnedProjectNames);
+    const missingFleetSlice = options.allSliceProjectNames?.find((name) => !projects.some(({ context }) => context.name === name));
+    const implicitFleetCrossesExternalOwnership = (input) => externalOwnedProjectNames.size > 0 &&
+        input.target.executor === '@empire-builder-kit/nx:fleet';
     const exposedProjects = projects.filter(({ context }) => exposedProjectNames.has(context.name));
-    const operations = [
-        ...localDevOperations(exposedProjects, externalOwnedProjectNames),
-    ];
+    const operations = [];
+    const adapters = new Map();
+    const developmentClosures = new Map();
+    const developmentReasons = new Map();
+    for (const project of projects) {
+        if (project.localDev === undefined)
+            continue;
+        try {
+            adapters.set(project.context.name, (0, contracts_js_1.validateLocalDevAdapter)(project.localDev));
+        }
+        catch {
+            developmentReasons.set(project.context.name, `Slice ${project.context.name} has invalid local-development metadata; repair its versioned adapter before planning development.`);
+        }
+    }
+    for (const name of adapters.keys()) {
+        try {
+            const closure = (0, contracts_js_1.resolveFleetSliceDependencies)(adapters, [name]);
+            developmentClosures.set(name, closure);
+            const external = closure.find((dependency) => externalOwnedProjectNames.has(dependency));
+            if (external)
+                developmentReasons.set(name, options.externalOwnershipHistoryComplete === false
+                    ? `Slice ${name} has history-unverified dependency ${external}; protected external-Blueprint history is incomplete. Retained-plan execution is unavailable until the configured protected history is available. Ordinary feature work may use the documented typed generator and inspected seeded/user-owned surfaces with focused Nx checks; do not invent external Blueprint trust.`
+                    : `Slice ${name} requires external-owned dependency ${external}; use its explicit Blueprint owner. External development contracts are not authenticated by this operation registry.`);
+        }
+        catch {
+            developmentReasons.set(name, `Slice ${name} has an unresolved, cyclic, or invalid dependency Slice; repair its declared dependencySlices before planning development.`);
+        }
+    }
     const nonPlannableTargets = [];
     const unsupportedTargets = [];
     const orderedProjects = [...projects].sort((left, right) => (0, ordering_js_1.compareDeveloperAgentStrings)(left.context.name, right.context.name));
@@ -1027,7 +1197,7 @@ function createDeveloperAgentOperationRegistry(projects, options) {
         for (const [targetName, target] of Object.entries(project.targets)) {
             targetInputs.set(`${project.context.name}:${targetName}`, {
                 namedInputRuntimeDetected,
-                project: project.context,
+                project: { ...project.context, targets: Object.keys(project.targets) },
                 target,
                 targetName,
             });
@@ -1078,7 +1248,10 @@ function createDeveloperAgentOperationRegistry(projects, options) {
             authentication.set(id, false);
             return false;
         }
-        if (input.namedInputRuntimeDetected) {
+        if (input.namedInputRuntimeDetected ||
+            (input.target.executor === '@empire-builder-kit/nx:fleet' &&
+                missingFleetSlice !== undefined) ||
+            implicitFleetCrossesExternalOwnership(input)) {
             authentication.set(id, false);
             return false;
         }
@@ -1112,6 +1285,35 @@ function createDeveloperAgentOperationRegistry(projects, options) {
         }
         const nextActive = new Set(active);
         nextActive.add(id);
+        if (input.target.executor === '@empire-builder-kit/nx:fleet') {
+            for (const project of projects.filter(({ context }) => context.tags.includes('type:slice'))) {
+                if (!authenticate(`${project.context.name}:${adapters.get(project.context.name)?.target ?? 'dev'}`, nextActive)) {
+                    authentication.set(id, false);
+                    return false;
+                }
+            }
+        }
+        if (input.targetName === (adapters.get(input.project.name)?.target ?? 'dev')) {
+            if (developmentReasons.has(input.project.name)) {
+                authentication.set(id, false);
+                return false;
+            }
+            for (const name of developmentClosures.get(input.project.name) ?? []) {
+                if (name === input.project.name)
+                    continue;
+                const dependencyAdapter = adapters.get(name);
+                if (!dependencyAdapter) {
+                    authentication.set(id, false);
+                    return false;
+                }
+                const dependencyId = `${name}:${dependencyAdapter.target}`;
+                if (!authenticate(dependencyId, nextActive)) {
+                    developmentReasons.set(input.project.name, `Slice ${input.project.name} requires non-plannable dependency ${dependencyId}; use that dependency's explicit owner before planning development.`);
+                    authentication.set(id, false);
+                    return false;
+                }
+            }
+        }
         const authenticated = dependencies.every((dependency) => authenticate(dependency.id, nextActive));
         authentication.set(id, authenticated);
         return authenticated;
@@ -1148,7 +1350,24 @@ function createDeveloperAgentOperationRegistry(projects, options) {
             composedInvocations.set(memoKey, null);
             return undefined;
         }
-        const dependencies = dependencyTargetsForOperation.map((dependency) => {
+        const allDependencyTargets = [...dependencyTargetsForOperation];
+        const developmentProjects = input.target.executor === '@empire-builder-kit/nx:fleet'
+            ? projects
+                .filter(({ context }) => context.tags.includes('type:slice'))
+                .map(({ context }) => context.name)
+            : input.targetName === adapters.get(input.project.name)?.target
+                ? (developmentClosures.get(input.project.name) ?? []).filter((name) => name !== input.project.name)
+                : [];
+        for (const name of developmentProjects) {
+            const dependencyId = `${name}:${adapters.get(name)?.target ?? 'dev'}`;
+            if (!allDependencyTargets.some(({ id }) => id === dependencyId)) {
+                allDependencyTargets.push({
+                    id: dependencyId,
+                    params: 'ignore',
+                });
+            }
+        }
+        const dependencies = allDependencyTargets.map((dependency) => {
             const composed = composeInvocation(dependency.id, dependency.params === 'forward' ? forwardedStage : undefined);
             if (!composed)
                 return undefined;
@@ -1209,6 +1428,12 @@ function createDeveloperAgentOperationRegistry(projects, options) {
         }
     }
     const authenticatedTargets = new Set([...targetInputs.keys()].filter((target) => compose(target) !== undefined));
+    const blockedDevelopment = new Set(developmentReasons.keys());
+    for (const [name, adapter] of adapters) {
+        if (!authenticatedTargets.has(`${name}:${adapter.target}`))
+            blockedDevelopment.add(name);
+    }
+    operations.push(...localDevOperations(exposedProjects, externalOwnedProjectNames, developmentClosures, blockedDevelopment));
     operations.push(...sourceEditOperations(exposedProjects, authenticatedTargets, workspaceVerification));
     for (const project of orderedProjects) {
         if (!exposedProjectNames.has(project.context.name))
@@ -1217,6 +1442,27 @@ function createDeveloperAgentOperationRegistry(projects, options) {
             const target = `${project.context.name}:${targetName}`;
             const input = targetInputs.get(target);
             const signature = input ? authenticatedTargetSignature(input) : undefined;
+            if (input?.target.executor === '@empire-builder-kit/nx:fleet' &&
+                missingFleetSlice !== undefined) {
+                nonPlannableTargets.push({
+                    target,
+                    rationale: `Root Fleet development implicitly selects Slice ${missingFleetSlice} outside this bounded context. Select an owned Slice ebk-dev operation or inspect the full development target inventory first.`,
+                });
+                continue;
+            }
+            const developmentReason = developmentReasons.get(project.context.name);
+            if (developmentReason &&
+                targetName === (adapters.get(project.context.name)?.target ?? 'dev')) {
+                nonPlannableTargets.push({ target, rationale: developmentReason });
+                continue;
+            }
+            if (input && signature && implicitFleetCrossesExternalOwnership(input)) {
+                nonPlannableTargets.push({
+                    target,
+                    rationale: 'This root Fleet target implicitly selects all Slices, including external-owned Blueprint targets outside the authenticated development execution boundary. Select an owned Slice ebk-dev operation or require an explicit external Blueprint development contract from its owner (Milestone 4).',
+                });
+                continue;
+            }
             if (signature?.nonPlannableRationale &&
                 !externalOwnedProjectNames.has(project.context.name)) {
                 nonPlannableTargets.push({