@nimiplatform/nimi-coding 0.1.0

package/contracts/audit-finding.schema.yaml

@@ -0,0 +1,61 @@
+version: 1
+schema:
+  id: nimi-coding.audit-finding.v1
+  kind: audit-finding
+required_fields:
+  - id
+  - sweep_id
+  - chunk_id
+  - fingerprint
+  - severity
+  - category
+  - actionability
+  - confidence
+  - impact
+  - location
+  - title
+  - description
+  - evidence
+  - disposition
+  - evidence_ref
+optional_fields:
+  - owner_domain
+  - root_cause
+  - cluster_id
+  - detected_at
+severity_enum:
+  - critical
+  - high
+  - medium
+  - low
+actionability_enum:
+  - auto-fix
+  - needs-decision
+  - deferred-backlog
+confidence_enum:
+  - high
+  - medium
+  - low
+disposition_enum:
+  - open
+  - remediated
+  - accepted-risk
+  - false-positive
+  - deferred-backlog
+location_required_fields:
+  - file
+evidence_required_fields:
+  - summary
+  - auditor_reasoning
+root_cause_optional_fields:
+  - key
+  - authority_ref
+  - evidence_root
+  - contract_seam
+  - repair_target
+hard_constraints:
+  - finding_location_file_must_belong_to_source_chunk_or_declared_spec_authority_evidence_roots
+  - finding_fingerprint_must_be_stable_over_semantically_identical_evidence
+  - non_open_disposition_requires_resolution_evidence
+  - duplicate_symptoms_may_cluster_only_when_root_cause_key_and_authority_context_match
+  - unique_critical_or_high_root_causes_must_remain_canonical_findings

package/contracts/audit-ledger.schema.yaml

@@ -0,0 +1,138 @@
+version: 1
+schema:
+  id: nimi-coding.audit-ledger.v1
+  kind: audit-ledger
+required_top_level_fields:
+  - version
+  - kind
+  - sweep_id
+  - snapshot_id
+  - immutable
+  - plan_ref
+  - chunk_refs
+  - findings_ref
+  - evidence_refs
+  - run_ledger_ref
+  - status
+  - coverage
+  - coverage_quality
+  - audit_validity
+  - finding_count
+  - finding_cluster_count
+  - clustered_symptom_count
+  - remediation_obligation_count
+  - unresolved_finding_count
+  - finding_posture
+  - created_at
+status_enum:
+  - candidate_ready
+  - partial
+  - partial_authority_only
+  - blocked_evidence_incomplete
+  - blocked
+coverage_required_fields:
+  - total_files
+  - included_files
+  - audited_files
+  - frozen_chunks
+  - failed_chunks
+  - skipped_chunks
+finding_posture_required_fields:
+  - open
+  - remediated
+  - accepted_risk
+  - false_positive
+  - deferred_backlog
+coverage_quality_required_fields:
+  - scope_label
+  - posture
+  - authority_chunk_count
+  - chunks_with_evidence_inventory
+  - chunks_without_evidence_inventory
+  - empty_evidence_chunk_ratio
+  - evidence_file_count
+  - max_evidence_files_per_chunk
+  - max_evidence_chunk_id
+  - evidence_concentration_ratio
+  - owner_domain_coverage
+  - warnings
+  - blockers
+coverage_quality_posture_enum:
+  - strong
+  - warning
+  - blocked
+audit_validity_required_fields:
+  - posture
+  - no_finding_posture
+  - audited_outcomes_with_implementation_evidence_refs
+  - audited_outcomes_without_implementation_evidence_refs
+  - zero_finding_chunk_count
+  - large_zero_finding_chunk_count
+  - negative_reasoning_present
+  - p0p1_recall_required_count
+  - p0p1_recall_invalid_count
+  - p0p1_rule_check_count
+  - auditor_provenance_present
+  - calibration_expected_defect_count
+  - calibration_missed_defect_count
+  - warnings
+  - blockers
+audit_validity_posture_enum:
+  - trusted
+  - warning
+  - invalid
+no_finding_posture_enum:
+  - not_applicable
+  - explained
+  - weak
+  - invalid
+run_event_type_enum:
+  - plan_created
+  - chunk_dispatched
+  - chunk_ingested
+  - chunk_reviewed
+  - chunk_frozen
+  - chunk_failed
+  - chunk_skipped
+  - chunk_codex_audit_prepared
+  - chunk_codex_audit_failed
+  - chunk_codex_auditor_output_rejected
+  - chunk_codex_auditor_output_accepted
+  - ledger_snapshot_created
+  - remediation_map_created
+  - remediation_map_admitted
+  - finding_resolved
+  - closeout_summary_projected
+coverage_quality_warning_ids:
+  - sparse_evidence_inventory
+  - owner_domain_authority_only
+  - evidence_fan_in_concentrated
+  - full_status_scope_is_declared_inventory
+coverage_quality_blocker_ids:
+  - declared_evidence_target_unresolved
+  - unmapped_evidence_files
+  - strict_required_owner_domain_missing_evidence
+audit_validity_warning_ids:
+  - zero_findings_on_large_evidence_inventory
+  - empty_inventory_no_finding_weak
+audit_validity_blocker_ids:
+  - no_finding_evidence_invalid
+  - audited_outcome_authority_only_evidence_refs
+  - no_finding_negative_reasoning_missing
+  - manager_freeze_invalid_no_finding
+  - calibration_known_defect_missed
+  - p0p1_negative_reasoning_missing
+  - p0p1_evidence_refs_out_of_scope
+  - p0p1_rule_checks_missing_or_invalid
+  - auditor_provenance_missing
+  - synthetic_no_finding_evidence
+hard_constraints:
+  - ledger_snapshots_are_immutable
+  - candidate_ready_requires_all_included_files_audited
+  - candidate_ready_requires_all_chunks_frozen
+  - failed_or_skipped_chunks_force_partial_or_blocked
+  - ledger_must_reference_append_only_run_ledger
+  - remediation_obligation_count_excludes_clustered_duplicate_symptoms
+  - coverage_quality_and_audit_validity_must_be_persisted_in_immutable_snapshots
+  - coverage_quality_and_audit_validity_must_be_nested_objects_not_flattened_root_fields
+  - partial_authority_only_and_blocked_evidence_incomplete_are_non_candidate_statuses

package/contracts/audit-plan.schema.yaml

@@ -0,0 +1,123 @@
+version: 1
+schema:
+  id: nimi-coding.audit-plan.v1
+  kind: audit-plan
+required_top_level_fields:
+  - version
+  - kind
+  - sweep_id
+  - target_root
+  - inventory_hash
+  - inventory
+  - chunks
+  - coverage
+  - created_at
+  - updated_at
+optional_top_level_fields:
+  - planning_basis
+  - audit_ignore_policy
+  - risk_budget_policy
+  - risk_budget_status
+  - audit_sweep_config_ref
+  - app_slice_admission_ref
+  - app_slice_admissions
+  - audit_evidence_root_refs
+  - package_authority_admission_refs
+  - package_authority_admissions
+  - evidence_inventory_hash
+  - evidence_inventory
+  - unmapped_evidence_files
+  - coverage_quality
+  - audit_validity
+inventory_entry_required_fields:
+  - file_ref
+  - sha256
+  - bytes
+  - extension
+  - owner_domain
+  - classification
+  - included
+  - exclusion_reason
+chunk_required_fields:
+  - chunk_id
+  - state
+  - owner_domain
+  - criteria
+  - files
+  - file_count
+chunk_optional_fields:
+  - planning_basis
+  - spec_surface
+  - authority_refs
+  - authority_kind
+  - app_id
+  - package_authority_id
+  - admission_ref
+  - authority_root
+  - evidence_root_admission_refs
+  - admitted_evidence_roots
+  - host_authority_projection_refs
+  - evidence_roots
+  - evidence_inventory
+  - coverage_contract
+  - evidence_inventory_status
+  - evidence_inventory_empty_reason
+  - calibration_expected_defects
+state_enum:
+  - planned
+  - dispatched
+  - ingested
+  - reviewed
+  - frozen
+  - failed
+  - skipped
+coverage_required_fields:
+  - total_files
+  - included_files
+  - excluded_files
+  - chunk_count
+spec_authority_coverage_fields:
+  - authority_files
+  - evidence_files
+  - unmapped_evidence_files
+audit_sweep_config_fields:
+  quality_mode_enum:
+    - default
+    - strict
+  coverage_quality_namespace: audit_sweep.coverage_quality
+  audit_validity_namespace: audit_sweep.audit_validity
+coverage_quality_summary_fields:
+  - scope_label
+  - posture
+  - warnings
+  - blockers
+audit_validity_summary_fields:
+  - posture
+  - warnings
+  - blockers
+  - no_finding_posture
+  - p0p1_recall_required_count
+  - p0p1_recall_invalid_count
+  - calibration_expected_defect_count
+  - calibration_missed_defect_count
+hard_constraints:
+  - inventory_hash_must_cover_all_inventory_entries
+  - every_included_file_must_belong_to_exactly_one_chunk
+  - excluded_files_must_have_explicit_exclusion_reason
+  - zero_included_files_cannot_be_candidate_ready
+  - spec_authority_plans_must_chunk_by_authority_refs_not_file_inventory
+  - spec_authority_chunk_files_are_authority_refs_and_evidence_roots_define_audit_evidence_scope
+  - explicit_audit_ignore_policy_must_record_reason_and_ignored_chunks
+  - ignored_chunks_must_be_skipped_not_counted_as_audited
+  - risk_budget_pause_must_not_mark_unresolved_findings_as_closed
+  - risk_budget_pause_blocks_further_dispatch_until_remediation_bundle_or_manager_action
+  - admitted_package_authority_projection_refs_must_be_explicitly_mapped
+  - spec_authority_plans_must_materialize_full_evidence_inventory
+  - spec_authority_chunks_must_assign_evidence_inventory_to_every_matching_authority_chunk
+  - spec_authority_evidence_inventory_files_may_be_reused_across_chunks_without_creating_parallel_truth
+  - spec_authority_chunks_with_empty_evidence_inventory_must_declare_explicit_empty_reason
+  - spec_authority_unmapped_evidence_files_fail_closed_without_explicit_skip_reason
+  - spec_authority_coverage_must_split_authority_files_from_evidence_files
+  - spec_authority_audit_evidence_must_report_one_authority_outcome_per_authority_ref
+  - spec_authority_audit_evidence_must_report_evidence_files_exactly_matching_chunk_inventory
+  - audit_sweep_quality_mode_must_be_default_unless_strict_is_explicit

package/contracts/audit-remediation-map.schema.yaml

@@ -0,0 +1,51 @@
+version: 1
+schema:
+  id: nimi-coding.audit-remediation-map.v1
+  kind: audit-remediation-map
+required_top_level_fields:
+  - version
+  - kind
+  - sweep_id
+  - source_ledger_ref
+  - source_findings_ref
+  - grouping_policy
+  - remediation_bundles
+  - waves
+  - unmapped_findings
+  - created_at
+  - updated_at
+wave_required_fields:
+  - wave_id
+  - status
+  - owner_domain
+  - priority
+  - actionability
+  - finding_ids
+  - cluster_ids
+  - clustered_symptom_count
+  - source_chunks
+  - files
+  - write_set
+  - depends_on
+  - remediation_bundle
+  - admission_checklist
+remediation_bundle_required_fields:
+  - bundle_id
+  - cluster_ids
+  - representative_finding_ids
+  - canonical_finding_ids
+  - duplicate_symptom_count
+  - source_chunks
+  - repair_targets
+status_enum:
+  - proposed
+  - admitted
+  - superseded
+  - empty
+hard_constraints:
+  - remediation_map_must_not_mutate_source_ledger
+  - every_open_finding_must_be_mapped_or_explicitly_unmapped
+  - duplicate_symptoms_must_remain_traceable_inside_remediation_bundles
+  - duplicate_symptoms_do_not_count_as_independent_remediation_obligations_by_default
+  - write_set_conflicts_must_be_visible
+  - needs_decision_findings_require_manager_decision_admission

package/contracts/audit-rerun.schema.yaml

@@ -0,0 +1,31 @@
+version: 1
+schema:
+  id: nimi-coding.audit-rerun.v1
+  kind: audit-rerun
+required_top_level_fields:
+  - finding_id
+  - source_fingerprint
+  - disposition
+  - rerun
+  - evidence_summary
+  - verified_at
+disposition_enum:
+  - remediated
+  - accepted-risk
+  - false-positive
+  - deferred-backlog
+rerun_required_fields:
+  - chunk_id
+  - covered_files
+  - verdict
+  - auditor
+verdict_enum:
+  - not_reproduced
+  - still_reproduced
+  - manager_accepted
+  - deferred
+hard_constraints:
+  - remediated_requires_not_reproduced_verdict
+  - rerun_covered_files_must_include_original_finding_file
+  - source_fingerprint_must_match_original_finding
+  - manager_dispositions_require_manager_acceptance_evidence

package/contracts/audit-sweep-result.yaml

@@ -0,0 +1,49 @@
+version: 1
+result_contract:
+  id: delegated_audit_sweep_result
+summary_required_fields:
+  - plan_ref
+  - chunk_refs
+  - ledger_ref
+  - report_ref
+  - remediation_map_ref
+  - audit_closeout_ref
+  - evidence_refs
+  - finding_count
+  - unresolved_finding_count
+  - status
+  - coverage_scope
+  - coverage_quality
+  - audit_validity
+  - summary
+  - verified_at
+summary_status_enum:
+  - candidate_ready
+  - partial
+  - partial_authority_only
+  - blocked_evidence_incomplete
+  - blocked
+coverage_quality_required_fields:
+  - scope_label
+  - posture
+  - warnings
+  - blockers
+audit_validity_required_fields:
+  - posture
+  - warnings
+  - blockers
+  - no_finding_posture
+  - p0p1_recall_required_count
+  - p0p1_recall_invalid_count
+  - p0p1_rule_check_count
+  - auditor_provenance_present
+  - calibration_expected_defect_count
+  - calibration_missed_defect_count
+locality: local_only
+semantic_constraints:
+  - do_not_promote_audit_sweep_summary_to_project_truth
+  - do_not_treat_external_audit_sweep_summary_as_remediation_or_closure_judgement
+  - candidate_ready_requires_full_authority_and_evidence_coverage
+  - full_coverage_status_requires_candidate_ready_ledger
+  - spec_authority_sweeps_must_report_authority_coverage_and_evidence_coverage_separately
+  - audit_validity_invalid_must_not_be_summarized_as_successful_no_finding_audit

package/contracts/authority-convergence-audit.schema.yaml

@@ -0,0 +1,19 @@
+id: nimicoding.authority-convergence-audit.v1
+kind: authority-convergence-audit
+required:
+  - verdict
+  - blocking_findings
+  - concerns
+  - deferred_non_blockers
+  - authority_refs
+  - ready_for_implementation
+verdict_enum:
+  - PASS
+  - NEEDS_REVISION
+  - FAIL
+rules:
+  - PASS requires blocking_findings to be empty and ready_for_implementation=true
+  - NEEDS_REVISION or FAIL requires ready_for_implementation=false
+  - deferred_non_blockers must not hide unresolved authority owner, parallel truth, or downstream vocabulary blockers
+  - auditor output is candidate evidence until recorded by the nimicoding manager as a topic audit result
+  - auditor must not edit implementation code, mutate spec truth, or decide semantic acceptance

package/contracts/closeout.schema.yaml

@@ -0,0 +1,25 @@
+id: nimicoding.topic-closeout.v1
+kind: topic-closeout
+required:
+  - closeout_id
+  - topic_id
+  - scope
+  - authority_closure
+  - semantic_closure
+  - consumer_closure
+  - drift_resistance_closure
+  - disposition
+scope_enum:
+  - wave
+  - topic
+closure_enum:
+  - open
+  - closed
+  - blocked
+disposition_enum:
+  - complete
+  - partial
+  - deferred
+rules:
+  - wave closeout requires all four closure dimensions to be explicit
+  - topic closeout must not imply true close unless true-close posture is separately explicit

package/contracts/decision-review.schema.yaml

@@ -0,0 +1,16 @@
+id: nimicoding.decision-review.v1
+kind: decision-review
+required:
+  - decision_review_id
+  - topic_id
+  - date
+  - decision
+  - replaced_scope
+  - active_replacement_scope
+disposition_enum:
+  - retired
+  - superseded
+  - unchanged
+rules:
+  - decision review must explicitly state whether prior scope is retired, superseded, or unchanged
+  - active replacement scope must be machine-identifiable

package/contracts/doc-spec-audit-result.yaml

@@ -0,0 +1,19 @@
+version: 1
+result_contract:
+  id: delegated_doc_spec_audit_result
+summary_required_fields:
+  - compared_paths
+  - finding_count
+  - status
+  - summary
+  - verified_at
+summary_status_enum:
+  - aligned
+  - drift_detected
+  - blocked
+default_compared_paths:
+  - README.md
+  - .nimi/spec
+locality: local_only
+semantic_constraints:
+  - do_not_promote_doc_spec_audit_summary_to_project_truth

package/contracts/execution-packet.schema.yaml

@@ -0,0 +1,49 @@
+id: nimi-coding.execution-packet.v1
+kind: execution-packet
+required:
+  - packet_id
+  - topic_id
+  - status
+  - owner
+  - created_at
+  - updated_at
+  - baseline_ref
+  - entry_phase_id
+  - phases
+  - escalation_policy
+  - notification_settings
+  - resume_policy
+status_enum:
+  - draft
+  - frozen
+  - superseded
+  - archived
+phase_required:
+  - phase_id
+  - goal
+  - authority_refs
+  - write_scope
+  - read_scope
+  - required_checks
+  - completion_criteria
+  - escalation_conditions
+  - next_on_success
+  - stop_on_failure
+phase_stop_on_failure_enum:
+  - pause
+  - stop
+escalation_policy_required:
+  - pause_conditions
+  - manager_decision_required
+notification_settings_required:
+  - on_block
+  - on_final_completion
+  - on_progress
+resume_policy_required:
+  - same_revision_resume_allowed_reasons
+  - new_packet_required_on
+rules:
+  - baseline_ref must resolve to a baseline artifact
+  - entry_phase_id must exist in phases[].phase_id
+  - next_on_success must be null or an existing phase_id
+  - packet must not encode transport secrets, runtime state, or semantic acceptance outcomes

package/contracts/external-host-compatibility.yaml

@@ -0,0 +1,22 @@
+version: 1
+compatibility_contract:
+  id: external_host_boundary_compatibility
+  completion_profile: boundary_complete
+supported_host_posture:
+  - host_agnostic_external_host
+supported_host_examples:
+  - oh_my_codex
+  - codex
+  - claude
+  - gemini
+required_behavior:
+  - consume_handoff_json_as_authoritative_contract
+  - treat_handoff_prompt_as_human_projection_only
+  - read_project_local_nimi_truth
+  - route_declared_external_skills
+  - fail_closed_on_missing_authority
+forbidden_behavior:
+  - assume_packaged_run_kernel
+  - assume_provider_or_scheduler_ownership
+  - promote_runtime_state_to_semantic_truth
+  - redefine_acceptance_disposition_or_finding_judgment

package/contracts/forbidden-shortcuts.catalog.yaml

@@ -0,0 +1,23 @@
+id: nimicoding.forbidden-shortcuts.v1
+kind: forbidden-shortcuts-catalog
+entries:
+  - key: mvp_subset_contract
+    meaning: do_not_cut_canonical_contract_truth_into_a_temporary_minimum_subset
+  - key: legacy_alias
+    meaning: do_not_keep_obsolete_semantics_alive_via_soft_aliases
+  - key: compat_shim
+    meaning: do_not_hide_owner_cut_gaps_behind_temporary_compatibility_code
+  - key: dual_read
+    meaning: do_not_keep_two_parallel_truth_read_paths_without_explicit_admission
+  - key: dual_write
+    meaning: do_not_keep_two_parallel_truth_write_paths_without_explicit_admission
+  - key: placeholder_success
+    meaning: do_not_fake_success_or_closure_when_required_truth_is_missing
+  - key: happy_path_only_closure
+    meaning: do_not_claim_closure_when_only_the_happy_path_is_closed
+  - key: time_phased_layering
+    meaning: do_not_replace_semantic_layering_with_time_sliced_core_contracts
+  - key: app_local_shadow_truth
+    meaning: do_not_let_app_local_convenience_state_become_hidden_canonical_truth
+  - key: silent_owner_cut_reopen
+    meaning: do_not_reopen_owner_domain_truth_inside_a_downstream_execution_wave

package/contracts/high-risk-admission.schema.yaml

@@ -0,0 +1,23 @@
+version: 1
+truth_contract:
+  id: canonical_high_risk_admissions_truth
+top_level_required_keys:
+  - admissions
+  - admission_rules
+  - semantic_constraints
+admission_required_fields:
+  - topic_id
+  - packet_id
+  - disposition
+  - admitted_at
+  - manager_review_owner
+  - summary
+  - source_decision_contract
+disposition_enum:
+  - complete
+  - partial
+  - deferred
+semantic_constraints:
+  - canonical_admission_records_must_not_promote_operational_runtime_state
+  - canonical_admission_records_must_use_one_record_per_topic_id
+  - canonical_admission_records_must_use_iso_8601_utc_admitted_at

package/contracts/high-risk-execution-result.yaml

@@ -0,0 +1,20 @@
+version: 1
+result_contract:
+  id: delegated_high_risk_execution_result
+summary_required_fields:
+  - packet_ref
+  - orchestration_state_ref
+  - prompt_ref
+  - worker_output_ref
+  - evidence_refs
+  - status
+  - summary
+  - verified_at
+summary_status_enum:
+  - candidate_ready
+  - blocked
+  - failed
+locality: local_only
+semantic_constraints:
+  - do_not_promote_high_risk_execution_summary_to_project_truth
+  - do_not_treat_external_execution_summary_as_acceptance_or_disposition