@nimiplatform/nimi-coding 0.2.5 → 0.2.7

package/CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to `@nimiplatform/nimi-coding` are tracked here.
 
 This project follows semantic versioning for published npm releases.
 
+## 0.2.7
+
+- Added delegated projection admissions for spec-authority sweeps so a host
+  `.nimi/spec/**` subtree projected from a parent or external source authority
+  can audit host-local projection evidence while delegating source-owned
+  implementation refs through an explicit boundary.
+- Kept delegated projections as audit modeling only: the CLI records and
+  validates source-authority boundaries, but does not read, sync, rewrite, or
+  mutate parent/external source repositories.
+- Ignored npm package/import specifiers and explicit `./` relative refs when
+  deriving declared evidence targets, so package subpaths and YAML fragment refs
+  do not get promoted into project-local evidence paths.
+
+## 0.2.6
+
+- Hard-cut high-risk admission records out of active `.nimi/spec/**`
+  authority. Admission records are now local-only evidence under
+  `.nimi/local/high-risk-admissions.yaml`; product authority must live in
+  domain spec files.
+- Removed the `product_admission_registry` surface class and changed
+  `admit-high-risk-decision` to write local evidence through `--write-local`
+  instead of writing canonical spec truth.
+
 ## 0.2.5
 
 - Fixed the `cli_version` field in `config/bootstrap.yaml` drifting away from

package/README.md

@@ -314,7 +314,7 @@ repository itself keeps the package-owned source directly under
 
 ```bash
 pnpm install
-pnpm test           # runs the node:test suite (341 tests at 0.2.5)
+pnpm test           # runs the node:test suite
 pnpm check:pack     # npm pack --dry-run
 pnpm check:ci       # test + pack + CLI help/version smoke
 ```

package/README.zh-CN.md

@@ -256,7 +256,7 @@ Nimi Coding 坐在你已经用的 AI host *底下*。它是让 AI 做完的工
 
 ```bash
 pnpm install
-pnpm test           # 跑 node:test 套件（0.2.5 共 341 用例）
+pnpm test           # 跑 node:test 套件
 pnpm check:pack     # npm pack --dry-run
 pnpm check:ci       # test + pack + CLI help/version smoke
 ```

package/adapters/oh-my-codex/README.md

@@ -69,7 +69,7 @@ named host-profile recognition, and explicit manager-owned admission, but
 final high-risk completion should still stay bounded by `nimicoding`
 validators, explicit local closeout/decision/ingest/review surfaces, and
 manual manager-side admission rather than automatic semantic promotion. The
-canonical admission target is now also shape-validated by a package-owned
+local admission evidence target is now also shape-validated by a package-owned
 admission schema contract before `nimicoding` accepts it as semantic truth.
 
 ## Recommended First-User Flow

package/cli/commands/admit-high-risk-decision.mjs

@@ -10,7 +10,7 @@ function parseAdmitHighRiskDecisionOptions(args) {
     fromPath: null,
     admittedAt: null,
     json: false,
-    writeSpec: false,
+    writeLocal: false,
   };
 
   for (let index = 0; index < args.length; index += 1) {
@@ -21,8 +21,8 @@ function parseAdmitHighRiskDecisionOptions(args) {
       continue;
     }
 
-    if (arg === "--write-spec") {
-      options.writeSpec = true;
+    if (arg === "--write-local") {
+      options.writeLocal = true;
       continue;
     }
 
@@ -92,7 +92,7 @@ export async function runAdmitHighRiskDecision(args) {
     return payload.exitCode;
   }
 
-  if (payload.ok && parsed.options.writeSpec) {
+  if (payload.ok && parsed.options.writeLocal) {
     await writeHighRiskAdmission(process.cwd(), payload);
   }
 

package/cli/constants.mjs

@@ -1,4 +1,4 @@
-export const VERSION = "0.2.5";
+export const VERSION = "0.2.7";
 export const PACKAGE_NAME = "@nimiplatform/nimi-coding";
 export const BOOTSTRAP_CONTRACT_ID = "nimicoding.bootstrap";
 export const BOOTSTRAP_CONTRACT_VERSION = 1;

package/cli/help.mjs

@@ -71,7 +71,7 @@ export function helpText() {
     `  ${styleCommand("nimicoding sweep design finalize --run-id <id> [--json]")}`,
     `  ${styleCommand("nimicoding sweep design wave-plan --run-id <id> --topic-id <id> [--json]")}`,
     `  ${styleCommand("nimicoding sweep design fix-topic --run-id <id> [--slug <slug>] [--title <title>] [--admit-first-wave|--admit-wave-id <id>] [--json]")}`,
-    `  ${styleCommand("nimicoding admit-high-risk-decision --from <json> --admitted-at <iso8601> [--json] [--write-spec]")}`,
+    `  ${styleCommand("nimicoding admit-high-risk-decision --from <json> --admitted-at <iso8601> [--json] [--write-local]")}`,
     `  ${styleCommand("nimicoding closeout --skill <skill-id> --outcome <completed|blocked|failed> --verified-at <iso8601>")}`,
     `  ${styleCommand("nimicoding closeout --skill <skill-id> --outcome <completed|blocked|failed> --verified-at <iso8601> --json")}`,
     `  ${styleCommand("nimicoding closeout --skill <skill-id> --outcome <completed|blocked|failed> --verified-at <iso8601> --write-local")}`,

package/cli/lib/audit-sweep-runtime/admissions.mjs

@@ -9,6 +9,7 @@ import { pathExists } from "../fs-helpers.mjs";
 export const AUDIT_SWEEP_PROJECT_CONFIG_REF = ".nimi/config/audit-sweep.yaml";
 export const APP_SLICE_ADMISSION_REF = ".nimi/spec/platform/kernel/tables/app-slice-admissions.yaml";
 const AUDIT_EVIDENCE_ROOT_TABLE_BASENAME = "audit-evidence-roots.yaml";
+const DELEGATED_PROJECTION_ADMISSION_BASENAME = "delegated-projection-admissions.yaml";
 const PACKAGE_AUTHORITY_ADMISSION_BASENAME = "package-authority-admissions.yaml";
 
 export function refInsideRoot(fileRef, rootRef) {
@@ -23,6 +24,32 @@ function safeProjectRef(value) {
     && !value.split("/").includes("..");
 }
 
+function normalizeProjectRef(value) {
+  const normalized = String(value ?? "").trim().replace(/\\/g, "/");
+  if (/^[a-z][a-z0-9+.-]*:\/\/$/iu.test(normalized)) {
+    return normalized;
+  }
+  return normalized.replace(/\/$/, "");
+}
+
+function activePosture(row) {
+  return String(row?.status ?? row?.admission_posture ?? "").trim();
+}
+
+function safeProjectionSourceRef(value) {
+  const normalized = normalizeProjectRef(value);
+  return normalized.startsWith("parent://")
+    || normalized.startsWith("package://")
+    || safeProjectRef(normalized);
+}
+
+function safeRelativePath(value) {
+  const normalized = normalizeProjectRef(value);
+  return normalized.length > 0
+    && !path.isAbsolute(normalized)
+    && !normalized.split("/").includes("..");
+}
+
 export async function loadAuditSweepProjectConfig(projectRoot) {
   const configPath = artifactPath(projectRoot, AUDIT_SWEEP_PROJECT_CONFIG_REF);
   const info = await pathExists(configPath);
@@ -241,6 +268,97 @@ export async function loadAuditEvidenceRootAdmissions(projectRoot, listGitFiles,
   return { ok: true, tableRefs, admissions };
 }
 
+export async function loadDelegatedProjectionAdmissions(projectRoot, listGitFiles, listFallbackFiles) {
+  const tableRefs = await listSpecTableRefs(projectRoot, DELEGATED_PROJECTION_ADMISSION_BASENAME, listGitFiles, listFallbackFiles);
+  if (!tableRefs) {
+    return { ok: true, tableRefs: [], admissions: [] };
+  }
+  const admissions = [];
+  const seenIds = new Set();
+
+  for (const tableRef of tableRefs) {
+    let parsed;
+    try {
+      parsed = YAML.parse(await readFile(artifactPath(projectRoot, tableRef), "utf8"));
+    } catch (error) {
+      return {
+        ok: false,
+        error: `nimicoding sweep audit refused: ${tableRef} must contain valid YAML (${error.message}).\n`,
+      };
+    }
+    const rows = Array.isArray(parsed?.admissions) ? parsed.admissions : null;
+    if (!rows) {
+      return { ok: false, error: `nimicoding sweep audit refused: ${tableRef} must declare admissions as an array.\n` };
+    }
+    for (const row of rows) {
+      const id = String(row?.id ?? "").trim();
+      const posture = activePosture(row);
+      const ownerDomain = String(row?.owner_domain ?? "").trim();
+      const authorityRoot = normalizeProjectRef(row?.authority_root);
+      const sourceAuthorityRoot = normalizeProjectRef(row?.source_authority_root);
+      const localProjectionEvidenceRoots = Array.isArray(row?.local_projection_evidence_roots)
+        ? row.local_projection_evidence_roots.map(normalizeProjectRef).filter(Boolean)
+        : null;
+      const delegatedEvidenceRoots = Array.isArray(row?.delegated_evidence_roots)
+        ? row.delegated_evidence_roots.map(normalizeProjectRef).filter(Boolean)
+        : null;
+      const delegatedDeclaredEvidencePrefixes = Array.isArray(row?.delegated_declared_evidence_prefixes)
+        ? row.delegated_declared_evidence_prefixes.map(normalizeProjectRef).filter(Boolean)
+        : [];
+      const hostOwnedRelativePaths = Array.isArray(row?.host_owned_relative_paths)
+        ? row.host_owned_relative_paths.map(normalizeProjectRef).filter(Boolean)
+        : [];
+      const requiredVerificationCommands = Array.isArray(row?.required_verification_commands)
+        ? row.required_verification_commands.map((entry) => String(entry ?? "").trim()).filter(Boolean)
+        : [];
+      const admissionKey = `${tableRef}#${id}`;
+      if (!id || seenIds.has(admissionKey)) {
+        return { ok: false, error: `nimicoding sweep audit refused: ${tableRef} has missing or duplicate delegated projection id.\n` };
+      }
+      seenIds.add(admissionKey);
+      if (posture !== "active") {
+        continue;
+      }
+      if (!ownerDomain || !safeProjectRef(authorityRoot) || !authorityRoot.startsWith(".nimi/spec/")) {
+        return { ok: false, error: `nimicoding sweep audit refused: ${tableRef} ${id} has invalid owner_domain or authority_root.\n` };
+      }
+      if (!safeProjectionSourceRef(sourceAuthorityRoot)) {
+        return { ok: false, error: `nimicoding sweep audit refused: ${tableRef} ${id} has invalid source_authority_root.\n` };
+      }
+      if (!localProjectionEvidenceRoots?.length || !localProjectionEvidenceRoots.every((rootRef) => safeProjectRef(rootRef) && !rootRef.startsWith(".nimi/spec/"))) {
+        return { ok: false, error: `nimicoding sweep audit refused: ${tableRef} ${id} has invalid local_projection_evidence_roots.\n` };
+      }
+      if (!delegatedEvidenceRoots?.length || !delegatedEvidenceRoots.every(safeProjectionSourceRef)) {
+        return { ok: false, error: `nimicoding sweep audit refused: ${tableRef} ${id} has invalid delegated_evidence_roots.\n` };
+      }
+      if (delegatedDeclaredEvidencePrefixes.length === 0 || !delegatedDeclaredEvidencePrefixes.every(safeRelativePath)) {
+        return { ok: false, error: `nimicoding sweep audit refused: ${tableRef} ${id} must declare delegated_declared_evidence_prefixes.\n` };
+      }
+      if (!hostOwnedRelativePaths.every(safeRelativePath)) {
+        return { ok: false, error: `nimicoding sweep audit refused: ${tableRef} ${id} has invalid host_owned_relative_paths.\n` };
+      }
+      if (!requiredVerificationCommands.every((command) => command.length > 0)) {
+        return { ok: false, error: `nimicoding sweep audit refused: ${tableRef} ${id} has invalid required_verification_commands.\n` };
+      }
+      admissions.push({
+        id,
+        owner_domain: ownerDomain,
+        status: posture,
+        authority_root: authorityRoot,
+        source_authority_root: sourceAuthorityRoot,
+        local_projection_evidence_roots: localProjectionEvidenceRoots,
+        delegated_evidence_roots: delegatedEvidenceRoots,
+        delegated_declared_evidence_prefixes: delegatedDeclaredEvidencePrefixes,
+        host_owned_relative_paths: hostOwnedRelativePaths,
+        required_verification_commands: requiredVerificationCommands,
+        admission_ref: admissionKey,
+      });
+    }
+  }
+
+  return { ok: true, tableRefs, admissions };
+}
+
 export async function loadPackageAuthorityAdmissions(projectRoot, listGitFiles, listFallbackFiles) {
   const tableRefs = await listSpecTableRefs(projectRoot, PACKAGE_AUTHORITY_ADMISSION_BASENAME, listGitFiles, listFallbackFiles);
   if (!tableRefs) {

package/cli/lib/audit-sweep-runtime/evidence-assignment.mjs

@@ -67,6 +67,9 @@ function chunkAcceptsEvidenceFile(chunk, fileRef) {
   if (surface === "spec-generation-audit" || surface === "high-risk-admissions" || surface === "package-meta" || surface === "package-root") {
     return true;
   }
+  if (surface === "delegated-projection") {
+    return true;
+  }
   return false;
 }
 

package/cli/lib/audit-sweep-runtime/inventory-spec-chunks.mjs

@@ -46,11 +46,17 @@ function looksLikeSpecAuthorityRelativeRef(normalized) {
 }
 
 function normalizeDeclaredEvidenceRef(value) {
-  const normalized = String(value ?? "")
+  const raw = String(value ?? "")
     .trim()
     .replace(/\\/g, "/")
-    .replace(/^\.\//, "")
     .replace(/[),.;:]+$/u, "");
+  if (!raw || raw.startsWith("../") || raw.includes("/../") || raw.startsWith("http:") || raw.startsWith("https:")) {
+    return null;
+  }
+  if (raw.startsWith("@") || raw.startsWith("./")) {
+    return null;
+  }
+  const normalized = raw.replace(/^\.\//, "");
   if (!normalized || normalized.startsWith("../") || normalized.includes("/../") || normalized.startsWith("http:") || normalized.startsWith("https:")) {
     return null;
   }
@@ -102,6 +108,37 @@ function candidateEvidenceRefsForDeclaredRef(declaredRef, evidenceRoots) {
   return [...new Set(candidates)].sort();
 }
 
+function normalizedRef(value) {
+  return String(value ?? "").replace(/\\/g, "/").replace(/\/$/, "");
+}
+
+function refInsideRoot(fileRef, rootRef) {
+  const root = normalizedRef(rootRef);
+  return Boolean(root) && (fileRef === root || fileRef.startsWith(`${root}/`));
+}
+
+function delegatedProjectionAdmissionForFile(fileRef, admissions = []) {
+  return admissions.find((admission) => {
+    if (!refInsideRoot(fileRef, admission.authority_root)) {
+      return false;
+    }
+    const relative = fileRef === admission.authority_root
+      ? ""
+      : fileRef.slice(admission.authority_root.length + 1);
+    return !(admission.host_owned_relative_paths ?? []).some((hostOwnedPath) => (
+      relative === hostOwnedPath || relative.startsWith(`${hostOwnedPath}/`)
+    ));
+  }) ?? null;
+}
+
+function declaredRefDelegated(ref, prefixes = []) {
+  const normalized = normalizedRef(ref);
+  return prefixes.some((prefix) => {
+    const normalizedPrefix = normalizedRef(prefix);
+    return normalizedPrefix && (normalized === normalizedPrefix || normalized.startsWith(`${normalizedPrefix}/`));
+  });
+}
+
 function extractDeclaredEvidenceRefs(text) {
   const refs = [];
   for (const match of String(text ?? "").matchAll(DECLARED_EVIDENCE_REF_PATTERN)) {
@@ -147,6 +184,74 @@ function extractModuleMapRefs(markdownText) {
   return [...new Set(refs)].sort();
 }
 
+function buildDelegatedProjectionChunk({
+  admission,
+  entries,
+  chunkIndex,
+  criteria,
+  authorityTextByRef,
+}) {
+  const authorityRefs = entries.map((entry) => entry.file_ref).sort();
+  const authorityText = authorityRefs
+    .map((authorityRef) => authorityTextByRef?.get(authorityRef) ?? "")
+    .join("\n");
+  const declaredEvidenceRefs = extractDeclaredEvidenceRefs(authorityText);
+  const delegatedDeclaredEvidenceRefs = declaredEvidenceRefs
+    .filter((ref) => declaredRefDelegated(ref, admission.delegated_declared_evidence_prefixes))
+    .sort();
+  const localDeclaredEvidenceRefs = declaredEvidenceRefs
+    .filter((ref) => !declaredRefDelegated(ref, admission.delegated_declared_evidence_prefixes))
+    .sort();
+  const evidenceRoots = [...new Set(admission.local_projection_evidence_roots ?? [])].sort();
+  const declaredEvidenceTargets = localDeclaredEvidenceRefs
+    .map((evidenceRef) => ({
+      source_path: evidenceRef,
+      candidates: candidateEvidenceRefsForDeclaredRef(evidenceRef, evidenceRoots),
+    }))
+    .filter((target) => target.candidates.length > 0);
+  return {
+    chunk_id: [
+      `chunk-${String(chunkIndex).padStart(3, "0")}`,
+      slugPart(admission.owner_domain),
+      "delegated-projection",
+      slugPart(admission.id),
+    ].join("-"),
+    state: "planned",
+    owner_domain: admission.owner_domain,
+    planning_basis: "spec_authority",
+    spec_surface: "delegated-projection",
+    criteria,
+    files: authorityRefs,
+    authority_refs: authorityRefs,
+    authority_kind: "delegated_projection",
+    delegated_projection_id: admission.id,
+    admission_ref: admission.admission_ref,
+    authority_root: admission.authority_root,
+    source_authority_root: admission.source_authority_root,
+    admitted_evidence_roots: evidenceRoots,
+    delegated_evidence_roots: admission.delegated_evidence_roots,
+    delegated_declared_evidence_prefixes: admission.delegated_declared_evidence_prefixes,
+    ...(delegatedDeclaredEvidenceRefs.length > 0 ? {
+      delegated_declared_evidence_refs: delegatedDeclaredEvidenceRefs,
+      declared_evidence_delegation: {
+        status: "delegated_to_source_authority",
+        delegated_ref_count: delegatedDeclaredEvidenceRefs.length,
+        source_authority_root: admission.source_authority_root,
+        delegated_evidence_roots: admission.delegated_evidence_roots,
+      },
+    } : {}),
+    ...(admission.required_verification_commands?.length > 0 ? {
+      required_verification_commands: admission.required_verification_commands,
+    } : {}),
+    ...(declaredEvidenceTargets.length > 0 ? {
+      declared_evidence_targets: declaredEvidenceTargets,
+    } : {}),
+    evidence_roots: evidenceRoots,
+    file_count: authorityRefs.length,
+    finding_count: 0,
+  };
+}
+
 function candidateEvidenceRefsForModuleMapPath(modulePath, evidenceRoots) {
   const normalized = String(modulePath ?? "").replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/$/, "");
   if (!normalized || normalized.startsWith("http:") || normalized.startsWith("https:")) {
@@ -181,6 +286,16 @@ function candidateEvidenceRefsForModuleMapPath(modulePath, evidenceRoots) {
 export function buildSpecChunks(includedInventory, options) {
   const sortedEntries = [...includedInventory].sort((left, right) => left.file_ref.localeCompare(right.file_ref));
   const includedRefs = new Set(sortedEntries.map((entry) => entry.file_ref));
+  const delegatedEntriesByAdmissionRef = new Map();
+  for (const entry of sortedEntries) {
+    const admission = delegatedProjectionAdmissionForFile(entry.file_ref, options.delegatedProjectionAdmissions);
+    if (!admission) {
+      continue;
+    }
+    const entries = delegatedEntriesByAdmissionRef.get(admission.admission_ref) ?? [];
+    entries.push(entry);
+    delegatedEntriesByAdmissionRef.set(admission.admission_ref, entries);
+  }
   const hostProjectionByHostRef = new Map();
   const hostProjectionsByPackageRef = new Map();
   for (const admission of options.packageAuthorityAdmissions ?? []) {
@@ -202,7 +317,24 @@ export function buildSpecChunks(includedInventory, options) {
   }
   let chunkIndex = 0;
   const chunks = [];
+  const emittedDelegatedAdmissions = new Set();
   for (const entry of sortedEntries) {
+    const delegatedAdmission = delegatedProjectionAdmissionForFile(entry.file_ref, options.delegatedProjectionAdmissions);
+    if (delegatedAdmission) {
+      if (emittedDelegatedAdmissions.has(delegatedAdmission.admission_ref)) {
+        continue;
+      }
+      emittedDelegatedAdmissions.add(delegatedAdmission.admission_ref);
+      chunkIndex += 1;
+      chunks.push(buildDelegatedProjectionChunk({
+        admission: delegatedAdmission,
+        entries: delegatedEntriesByAdmissionRef.get(delegatedAdmission.admission_ref) ?? [entry],
+        chunkIndex,
+        criteria: options.criteria,
+        authorityTextByRef: options.authorityTextByRef,
+      }));
+      continue;
+    }
     if (hostProjectionByHostRef.has(entry.file_ref)) {
       continue;
     }

package/cli/lib/audit-sweep-runtime/inventory.mjs

@@ -31,6 +31,7 @@ import {
   loadAppSliceAdmissions,
   loadAuditEvidenceRootAdmissions,
   loadAuditSweepProjectConfig,
+  loadDelegatedProjectionAdmissions,
   loadPackageAuthorityAdmissions,
 } from "./admissions.mjs";
 import { buildCoverageQuality } from "./coverage-quality.mjs";
@@ -441,6 +442,8 @@ export async function createAuditSweepPlan(projectRoot, options) {
   let appSliceAdmissions = [];
   let auditEvidenceRootAdmissions = [];
   let auditEvidenceRootAdmissionRefs = [];
+  let delegatedProjectionAdmissions = [];
+  let delegatedProjectionAdmissionRefs = [];
   let packageAuthorityAdmissions = [];
   let packageAuthorityAdmissionRefs = [];
   if (chunkBasis.basis === "spec") {
@@ -455,6 +458,12 @@ export async function createAuditSweepPlan(projectRoot, options) {
     }
     auditEvidenceRootAdmissions = loadedEvidenceRootAdmissions.admissions;
     auditEvidenceRootAdmissionRefs = loadedEvidenceRootAdmissions.tableRefs;
+    const loadedDelegatedProjectionAdmissions = await loadDelegatedProjectionAdmissions(projectRoot, listGitFiles, listFallbackFiles);
+    if (!loadedDelegatedProjectionAdmissions.ok) {
+      return inputError(loadedDelegatedProjectionAdmissions.error);
+    }
+    delegatedProjectionAdmissions = loadedDelegatedProjectionAdmissions.admissions;
+    delegatedProjectionAdmissionRefs = loadedDelegatedProjectionAdmissions.tableRefs;
     const loadedPackageAuthorityAdmissions = await loadPackageAuthorityAdmissions(projectRoot, listGitFiles, listFallbackFiles);
     if (!loadedPackageAuthorityAdmissions.ok) {
       return inputError(loadedPackageAuthorityAdmissions.error);
@@ -513,7 +522,7 @@ export async function createAuditSweepPlan(projectRoot, options) {
     }
   }
   let chunks = chunkBasis.basis === "spec"
-    ? buildSpecChunks(includedInventory, { criteria, targetRootRef, appSliceAdmissions, auditEvidenceRootAdmissions, packageAuthorityAdmissions, authorityTextByRef })
+    ? buildSpecChunks(includedInventory, { criteria, targetRootRef, appSliceAdmissions, auditEvidenceRootAdmissions, delegatedProjectionAdmissions, packageAuthorityAdmissions, authorityTextByRef })
     : buildFileChunks(includedInventory, { criteria, maxFilesPerChunk });
   let evidenceInventory = [];
   let unmappedEvidenceFiles = [];
@@ -589,6 +598,22 @@ export async function createAuditSweepPlan(projectRoot, options) {
     ...(chunkBasis.basis === "spec" && auditEvidenceRootAdmissionRefs.length > 0 ? {
       audit_evidence_root_refs: auditEvidenceRootAdmissionRefs,
     } : {}),
+    ...(chunkBasis.basis === "spec" && delegatedProjectionAdmissions.length > 0 ? {
+      delegated_projection_admission_refs: delegatedProjectionAdmissionRefs,
+      delegated_projection_admissions: delegatedProjectionAdmissions.map((admission) => ({
+        id: admission.id,
+        owner_domain: admission.owner_domain,
+        status: admission.status,
+        authority_root: admission.authority_root,
+        source_authority_root: admission.source_authority_root,
+        local_projection_evidence_roots: admission.local_projection_evidence_roots,
+        delegated_evidence_roots: admission.delegated_evidence_roots,
+        delegated_declared_evidence_prefixes: admission.delegated_declared_evidence_prefixes,
+        host_owned_relative_paths: admission.host_owned_relative_paths,
+        required_verification_commands: admission.required_verification_commands,
+        admission_ref: admission.admission_ref,
+      })),
+    } : {}),
     ...(chunkBasis.basis === "spec" && packageAuthorityAdmissions.length > 0 ? {
       package_authority_admission_refs: packageAuthorityAdmissionRefs,
       package_authority_admissions: packageAuthorityAdmissions.map((admission) => ({
@@ -669,11 +694,18 @@ export async function createAuditSweepPlan(projectRoot, options) {
       ...(chunk.authority_kind ? { authority_kind: chunk.authority_kind } : {}),
       ...(chunk.app_id ? { app_id: chunk.app_id } : {}),
       ...(chunk.package_authority_id ? { package_authority_id: chunk.package_authority_id } : {}),
+      ...(chunk.delegated_projection_id ? { delegated_projection_id: chunk.delegated_projection_id } : {}),
       ...(chunk.admission_ref ? { admission_ref: chunk.admission_ref } : {}),
       ...(chunk.authority_root ? { authority_root: chunk.authority_root } : {}),
+      ...(chunk.source_authority_root ? { source_authority_root: chunk.source_authority_root } : {}),
       ...(chunk.evidence_root_admission_refs ? { evidence_root_admission_refs: chunk.evidence_root_admission_refs } : {}),
       ...(chunk.admitted_evidence_roots ? { admitted_evidence_roots: chunk.admitted_evidence_roots } : {}),
       ...(chunk.host_authority_projection_refs ? { host_authority_projection_refs: chunk.host_authority_projection_refs } : {}),
+      ...(chunk.delegated_evidence_roots ? { delegated_evidence_roots: chunk.delegated_evidence_roots } : {}),
+      ...(chunk.delegated_declared_evidence_prefixes ? { delegated_declared_evidence_prefixes: chunk.delegated_declared_evidence_prefixes } : {}),
+      ...(chunk.delegated_declared_evidence_refs ? { delegated_declared_evidence_refs: chunk.delegated_declared_evidence_refs } : {}),
+      ...(chunk.declared_evidence_delegation ? { declared_evidence_delegation: chunk.declared_evidence_delegation } : {}),
+      ...(chunk.required_verification_commands ? { required_verification_commands: chunk.required_verification_commands } : {}),
       ...(chunk.declared_evidence_targets ? { declared_evidence_targets: chunk.declared_evidence_targets } : {}),
       ...(chunk.evidence_roots ? { evidence_roots: chunk.evidence_roots } : {}),
       ...(chunk.declared_evidence_unresolved ? { declared_evidence_unresolved: chunk.declared_evidence_unresolved } : {}),

package/cli/lib/audit-sweep-runtime/validators.mjs

@@ -259,6 +259,40 @@ function validatePlanShape(plan, sweepId, checks) {
         ));
     });
     check(checks, "plan_spec_package_authority_admitted", packageAuthorityChunksOk, "package-local authority chunks are admitted through .nimi/spec package authority admissions");
+    const delegatedProjectionAdmissions = Array.isArray(plan.delegated_projection_admissions) ? plan.delegated_projection_admissions : [];
+    const delegatedAdmissionByRef = new Map(delegatedProjectionAdmissions
+      .filter((entry) => isPlainObject(entry) && nonEmptyString(entry.admission_ref))
+      .map((entry) => [entry.admission_ref, entry]));
+    const delegatedProjectionChunks = plan.chunks.filter((chunk) => chunk.authority_kind === "delegated_projection");
+    const delegatedProjectionChunksOk = delegatedProjectionChunks.every((chunk) => {
+      const admission = delegatedAdmissionByRef.get(chunk.admission_ref);
+      const prefixes = Array.isArray(admission?.delegated_declared_evidence_prefixes)
+        ? admission.delegated_declared_evidence_prefixes
+        : [];
+      const delegatedRefs = Array.isArray(chunk.delegated_declared_evidence_refs)
+        ? chunk.delegated_declared_evidence_refs
+        : [];
+      const delegatedRefsOk = delegatedRefs.every((ref) => prefixes.some((prefix) => (
+        String(ref) === String(prefix).replace(/\/$/u, "")
+        || String(ref).startsWith(`${String(prefix).replace(/\/$/u, "")}/`)
+      )));
+      return nonEmptyString(chunk.delegated_projection_id)
+        && nonEmptyString(chunk.admission_ref)
+        && nonEmptyString(chunk.authority_root)
+        && nonEmptyString(chunk.source_authority_root)
+        && admission
+        && admission.id === chunk.delegated_projection_id
+        && admission.authority_root === chunk.authority_root
+        && admission.source_authority_root === chunk.source_authority_root
+        && Array.isArray(admission.local_projection_evidence_roots)
+        && sortedArrayEquals(chunk.evidence_roots, admission.local_projection_evidence_roots)
+        && sortedArrayEquals(chunk.admitted_evidence_roots, admission.local_projection_evidence_roots)
+        && sortedArrayEquals(chunk.delegated_evidence_roots, admission.delegated_evidence_roots)
+        && sortedArrayEquals(chunk.delegated_declared_evidence_prefixes, admission.delegated_declared_evidence_prefixes)
+        && delegatedRefsOk
+        && chunk.authority_refs.every((fileRef) => String(fileRef).startsWith(`${chunk.authority_root}/`));
+    });
+    check(checks, "plan_spec_delegated_projection_authority_admitted", delegatedProjectionChunksOk, "delegated projection chunks are admitted through .nimi/spec delegated projection admissions");
     const evidenceRootAdmissionsOk = plan.chunks.every((chunk) => (
       !Array.isArray(chunk.evidence_root_admission_refs)
       || chunk.evidence_root_admission_refs.every((ref) => (

package/cli/lib/closeout.mjs

@@ -44,7 +44,6 @@ function translateCloseoutReason(reason) {
     ["Completed closeout requires declared canonical tree files to be valid", "完成 closeout 需要声明的 canonical tree 文件有效"],
     ["Completed closeout requires a valid `.nimi/local/state/spec-generation/spec-generation-audit.yaml` artifact", "完成 closeout 需要一个有效的 `.nimi/local/state/spec-generation/spec-generation-audit.yaml` 产物"],
     ["Completed doc_spec_audit closeout must compare against `.nimi/spec`", "完成 doc_spec_audit closeout 时必须对 `.nimi/spec` 进行比较"],
-    ["Completed high_risk_execution closeout requires canonical admissions truth to remain `.nimi/spec/high-risk-admissions.yaml`", "完成 high_risk_execution closeout 需要 canonical admissions truth 继续落在 `.nimi/spec/high-risk-admissions.yaml`"],
     ["Completed closeout is consistent with the current canonical tree state", "completed closeout 与当前 canonical tree 状态一致"],
     ["Imported spec_reconstruction summary must match active spec-generation audit coverage", "导入的 spec_reconstruction 摘要必须与当前 spec-generation audit 覆盖情况一致"],
   ]);
@@ -395,19 +394,6 @@ function evaluateCloseoutReadiness(skillId, outcome, doctorResult, summary) {
     }
   }
 
-  if (rule.completedRequires.high_risk_admissions_truth_ref) {
-    const admissionsTruthPath = rule.completedRequires.high_risk_admissions_truth_ref;
-    const expectedAdmissionsPath = doctorResult.commandGating.entries.find(
-      (entry) => entry.command === "admit-high-risk-decision" && entry.requires?.canonical_admissions_truth,
-    )?.requires?.canonical_admissions_truth ?? ".nimi/spec/high-risk-admissions.yaml";
-    if (admissionsTruthPath !== expectedAdmissionsPath) {
-      return {
-        ok: false,
-        reason: "Completed high_risk_execution closeout requires canonical admissions truth to remain `.nimi/spec/high-risk-admissions.yaml`",
-      };
-    }
-  }
-
   if (!doctorResult.ok || !doctorResult.handoffReadiness.ok) {
     return {
       ok: false,

package/cli/lib/entrypoints.mjs

@@ -18,7 +18,7 @@ function managedAgentsBlock() {
 - Treat \`/.nimi/spec/**\` as the current repo-wide product authority for this project, and use Git history for retired pre-cutover authority evidence.
 - If .nimi/spec remains bootstrap-only, use .nimi/methodology/spec-reconstruction.yaml and .nimi/config/skills.yaml to drive AI-side truth reconstruction.
 - Treat .nimi/methodology/spec-target-truth-profile.yaml as repo-local support guidance for future governance slices, not as the canonical reconstruction completion target or a guaranteed fresh-bootstrap seed.
-- Treat .nimi/contracts/spec-reconstruction-result.yaml, .nimi/contracts/doc-spec-audit-result.yaml, .nimi/contracts/high-risk-execution-result.yaml, and .nimi/contracts/high-risk-admission.schema.yaml as machine contracts for reconstruction, audit, local-only high-risk closeout summaries, and canonical high-risk admission truth.
+- Treat .nimi/contracts/spec-reconstruction-result.yaml, .nimi/contracts/doc-spec-audit-result.yaml, .nimi/contracts/high-risk-execution-result.yaml, and .nimi/contracts/high-risk-admission.schema.yaml as machine contracts for reconstruction, audit, local-only high-risk closeout summaries, and local-only high-risk admission evidence.
 - Treat .nimi/config/skill-manifest.yaml, .nimi/config/host-profile.yaml, .nimi/config/host-adapter.yaml, .nimi/config/external-execution-artifacts.yaml, .nimi/config/skill-installer.yaml, .nimi/methodology/skill-runtime.yaml, .nimi/methodology/skill-installer-result.yaml, .nimi/methodology/skill-handoff.yaml, and admitted package-owned adapter profiles under adapters/**/profile.yaml as the canonical bridge to any external AI/skill execution.
 - Treat standalone nimicoding as boundary-complete for bootstrap, handoff, validation, projection, and explicit admission only; do not assume packaged run-kernel, provider, scheduler, notification, or automation ownership.
 - Treat .nimi/config/installer-evidence.yaml and .nimi/methodology/skill-installer-summary-projection.yaml as the operational-to-semantic installer projection boundary; do not promote concrete evidence artifacts into semantic truth.