@nimiplatform/nimi-coding 0.2.5 → 0.2.7

package/cli/lib/high-risk-admission.mjs

@@ -1,4 +1,4 @@
-import { realpath, writeFile } from "node:fs/promises";
+import { mkdir, realpath, writeFile } from "node:fs/promises";
 import path from "node:path";
 
 import YAML from "yaml";
@@ -24,7 +24,23 @@ import { validateExecutionPacket } from "./validators.mjs";
 import { isIsoUtcTimestamp, isPlainObject } from "./value-helpers.mjs";
 import { parseYamlText } from "./yaml-helpers.mjs";
 
-const ADMISSIONS_SPEC_REF = ".nimi/spec/high-risk-admissions.yaml";
+const ADMISSIONS_EVIDENCE_REF = ".nimi/local/high-risk-admissions.yaml";
+
+function emptyAdmissionsEvidence() {
+  return {
+    admissions: [],
+    admission_rules: [
+      "explicit_manager_owned_decision_required_before_high_risk_local_evidence",
+      "mechanically_valid_admission_identity_required_before_high_risk_local_evidence",
+      "product_authority_change_requires_explicit_domain_spec_update",
+    ],
+    semantic_constraints: [
+      "local_admission_records_must_not_promote_operational_runtime_state",
+      "local_admission_records_must_not_be_used_as_product_authority",
+      "local_admission_records_must_use_iso_8601_utc_admitted_at",
+    ],
+  };
+}
 
 async function resolveProjectContainedPath(projectRoot, inputPath, artifactLabel) {
   const absolutePath = path.resolve(projectRoot, inputPath);
@@ -66,8 +82,8 @@ function translateAdmissionReason(reason) {
     ["attached packet_ref failed mechanical validation", "附加的 packet_ref 未通过机械校验"],
     ["attached packet_ref is missing packet_id or topic_id", "附加的 packet_ref 缺少 packet_id 或 topic_id"],
     ["Bootstrap or handoff validation is failing; repair doctor errors before semantic admission", "bootstrap 或 handoff 校验失败；请先修复 doctor 报错，再进行语义准入"],
-    ["Canonical admission requires the canonical tree under `.nimi/spec`", "canonical admission 需要 `.nimi/spec` 下的 canonical tree"],
-    ["Manager-owned local decision is ready for explicit canonical admission", "manager 拥有的本地 decision 已准备好进行显式 canonical admission"],
+    ["Local admission evidence requires the canonical tree under `.nimi/spec`", "local admission evidence 需要 `.nimi/spec` 下的 canonical tree"],
+    ["Manager-owned local decision is ready for explicit local admission evidence", "manager 拥有的本地 decision 已准备好写入显式 local admission evidence"],
   ]);
   return translations.get(reason) ?? reason;
 }
@@ -206,15 +222,19 @@ function validateImportedDecisionPayload(payload) {
   return { ok: true };
 }
 
-async function loadAdmissionsSpec(projectRoot, contract) {
-  const absolutePath = path.join(projectRoot, ADMISSIONS_SPEC_REF);
+async function loadAdmissionsEvidence(projectRoot, contract) {
+  const absolutePath = path.join(projectRoot, ADMISSIONS_EVIDENCE_REF);
   const text = await readTextIfFile(absolutePath);
 
   if (text === null) {
+    const parsed = emptyAdmissionsEvidence();
+    const validation = validateHighRiskAdmissionsSpec(parsed, contract);
     return {
-      ok: false,
+      ok: validation.ok,
       path: absolutePath,
-      reason: `cannot read ${ADMISSIONS_SPEC_REF}`,
+      parsed,
+      reason: validation.ok ? null : validation.reason,
+      initialized: true,
     };
   }
 
@@ -226,6 +246,7 @@ async function loadAdmissionsSpec(projectRoot, contract) {
     path: absolutePath,
     parsed,
     reason: validation.ok ? null : validation.reason,
+    initialized: false,
   };
 }
 
@@ -279,7 +300,7 @@ function upsertAdmissionRecord(existingAdmissions, record) {
   };
 }
 
-function evaluateAdmissionReadiness(doctorResult, admissionsSpec, packetIdentity) {
+function evaluateAdmissionReadiness(doctorResult, admissionsEvidence, packetIdentity) {
   if (!doctorResult.ok || !doctorResult.handoffReadiness.ok) {
     return {
       ok: false,
@@ -294,14 +315,14 @@ function evaluateAdmissionReadiness(doctorResult, admissionsSpec, packetIdentity
   if (!v2Ready && !legacyReady) {
     return {
       ok: false,
-      reason: "Canonical admission requires canonical_tree_ready with declared canonical files present",
+      reason: "Local admission evidence requires canonical_tree_ready with declared canonical files present",
     };
   }
 
-  if (!admissionsSpec.ok) {
+  if (!admissionsEvidence.ok) {
     return {
       ok: false,
-      reason: admissionsSpec.reason,
+      reason: admissionsEvidence.reason,
     };
   }
 
@@ -314,7 +335,7 @@ function evaluateAdmissionReadiness(doctorResult, admissionsSpec, packetIdentity
 
   return {
     ok: true,
-    reason: "Manager-owned local decision is ready for explicit canonical admission",
+    reason: "Manager-owned local decision is ready for explicit local admission evidence",
   };
 }
 
@@ -362,12 +383,12 @@ export async function buildHighRiskAdmissionPayload(projectRoot, options) {
       exitCode: 1,
       projectRoot,
       sourceDecisionRef: imported.path,
-      semanticTargetRef: ADMISSIONS_SPEC_REF,
-      artifactPath: path.join(projectRoot, ADMISSIONS_SPEC_REF),
+      semanticTargetRef: ADMISSIONS_EVIDENCE_REF,
+      artifactPath: path.join(projectRoot, ADMISSIONS_EVIDENCE_REF),
       skill: {
         id: "high_risk_execution",
       },
-      localOnly: false,
+      localOnly: true,
       admittedAt: options.admittedAt,
       admissionAction: "blocked",
       admissionRecord: null,
@@ -380,15 +401,15 @@ export async function buildHighRiskAdmissionPayload(projectRoot, options) {
         handoffReadiness: { ok: false },
         delegatedContracts: {},
       },
-      nextSpecYaml: null,
-      nextAction: `${HIGH_RISK_ADMISSION_CONTRACT_REF} must satisfy the package-owned canonical admission contract.`,
+      nextEvidenceYaml: null,
+      nextAction: `${HIGH_RISK_ADMISSION_CONTRACT_REF} must satisfy the package-owned local admission evidence contract.`,
     };
   }
 
   const doctorResult = await inspectDoctorState(projectRoot);
-  const admissionsSpec = await loadAdmissionsSpec(projectRoot, admissionsContract);
+  const admissionsEvidence = await loadAdmissionsEvidence(projectRoot, admissionsContract);
   const packetIdentity = await loadPacketIdentity(projectRoot, imported.payload.attachmentRefs.packet_ref);
-  const readiness = evaluateAdmissionReadiness(doctorResult, admissionsSpec, packetIdentity);
+  const readiness = evaluateAdmissionReadiness(doctorResult, admissionsEvidence, packetIdentity);
 
   const admissionRecord = packetIdentity.ok ? {
     topic_id: packetIdentity.topicId,
@@ -403,35 +424,35 @@ export async function buildHighRiskAdmissionPayload(projectRoot, options) {
   } : null;
 
   const nextAdmissions = readiness.ok
-    ? upsertAdmissionRecord(admissionsSpec.parsed.admissions, admissionRecord)
-    : { admissions: admissionsSpec.parsed?.admissions ?? [], action: "blocked" };
+    ? upsertAdmissionRecord(admissionsEvidence.parsed.admissions, admissionRecord)
+    : { admissions: admissionsEvidence.parsed?.admissions ?? [], action: "blocked" };
 
-  const nextSpecObject = admissionsSpec.ok ? {
+  const nextEvidenceObject = admissionsEvidence.ok ? {
     admissions: nextAdmissions.admissions,
-    admission_rules: admissionsSpec.parsed.admission_rules,
-    semantic_constraints: admissionsSpec.parsed.semantic_constraints,
+    admission_rules: admissionsEvidence.parsed.admission_rules,
+    semantic_constraints: admissionsEvidence.parsed.semantic_constraints,
   } : null;
-  const nextSpecValidation = nextSpecObject ? validateHighRiskAdmissionsSpec(nextSpecObject, admissionsContract) : { ok: false };
+  const nextEvidenceValidation = nextEvidenceObject ? validateHighRiskAdmissionsSpec(nextEvidenceObject, admissionsContract) : { ok: false };
 
   return {
     contractVersion: HIGH_RISK_ADMISSION_PAYLOAD_CONTRACT_VERSION,
-    ok: readiness.ok && nextSpecValidation.ok,
-    exitCode: readiness.ok && nextSpecValidation.ok ? 0 : 1,
+    ok: readiness.ok && nextEvidenceValidation.ok,
+    exitCode: readiness.ok && nextEvidenceValidation.ok ? 0 : 1,
     projectRoot,
     sourceDecisionRef: imported.path,
-    semanticTargetRef: ADMISSIONS_SPEC_REF,
-    artifactPath: path.join(projectRoot, ADMISSIONS_SPEC_REF),
+    semanticTargetRef: ADMISSIONS_EVIDENCE_REF,
+    artifactPath: path.join(projectRoot, ADMISSIONS_EVIDENCE_REF),
     skill: {
       id: "high_risk_execution",
     },
-    localOnly: false,
+    localOnly: true,
     admittedAt: options.admittedAt,
     admissionAction: nextAdmissions.action,
     admissionRecord,
-    readiness: readiness.ok && !nextSpecValidation.ok
+    readiness: readiness.ok && !nextEvidenceValidation.ok
       ? {
         ok: false,
-        reason: nextSpecValidation.reason,
+        reason: nextEvidenceValidation.reason,
       }
       : readiness,
     doctor: {
@@ -439,37 +460,37 @@ export async function buildHighRiskAdmissionPayload(projectRoot, options) {
       handoffReadiness: doctorResult.handoffReadiness,
       delegatedContracts: doctorResult.delegatedContracts,
     },
-    nextSpecYaml: nextSpecObject ? YAML.stringify(nextSpecObject) : null,
-    nextAction: readiness.ok && nextSpecValidation.ok
-      ? options.writeSpec
-        ? `Write canonical admission to ${ADMISSIONS_SPEC_REF}.`
-        : `Review the canonical admission preview or write it with --write-spec.`
-      : readiness.ok && !nextSpecValidation.ok
-        ? nextSpecValidation.reason
+    nextEvidenceYaml: nextEvidenceObject ? YAML.stringify(nextEvidenceObject) : null,
+    nextAction: readiness.ok && nextEvidenceValidation.ok
+      ? options.writeLocal
+        ? `Write local admission evidence to ${ADMISSIONS_EVIDENCE_REF}.`
+        : `Review the local admission evidence preview or write it with --write-local.`
+      : readiness.ok && !nextEvidenceValidation.ok
+        ? nextEvidenceValidation.reason
         : readiness.reason,
   };
 }
 
 export async function writeHighRiskAdmission(projectRoot, payload) {
-  if (!payload.ok || typeof payload.nextSpecYaml !== "string") {
+  if (!payload.ok || typeof payload.nextEvidenceYaml !== "string") {
     return;
   }
 
-  await writeFile(path.join(projectRoot, ADMISSIONS_SPEC_REF), payload.nextSpecYaml, "utf8");
+  await mkdir(path.dirname(path.join(projectRoot, ADMISSIONS_EVIDENCE_REF)), { recursive: true });
+  await writeFile(path.join(projectRoot, ADMISSIONS_EVIDENCE_REF), payload.nextEvidenceYaml, "utf8");
 }
 
 export function formatHighRiskAdmissionPayload(payload) {
   const nextAction = payload.ok
-    ? payload.nextAction.startsWith("Write canonical admission to ")
-      ? localize(payload.nextAction, `将 canonical admission 写入 ${payload.semanticTargetRef}。`)
+    ? payload.nextAction.startsWith("Write local admission evidence to ")
+      ? localize(payload.nextAction, `将 local admission evidence 写入 ${payload.semanticTargetRef}。`)
       : localize(
         payload.nextAction,
-        `检查 canonical admission 预览，或使用 ${styleCommand("--write-spec")} 将其写入。`,
+        `检查 local admission evidence 预览，或使用 ${styleCommand("--write-local")} 将其写入。`,
       )
     : localize(payload.nextAction, translateAdmissionReason(payload.nextAction)
       .replace(`${HIGH_RISK_ADMISSION_CONTRACT_REF} is missing or malformed`, `${HIGH_RISK_ADMISSION_CONTRACT_REF} 缺失或格式错误`)
-      .replace(`${HIGH_RISK_ADMISSION_CONTRACT_REF} must satisfy the package-owned canonical admission contract.`, `${HIGH_RISK_ADMISSION_CONTRACT_REF} 必须满足包内 canonical admission 契约。`)
-      .replace("cannot read .nimi/spec/high-risk-admissions.yaml", "无法读取 .nimi/spec/high-risk-admissions.yaml"));
+      .replace(`${HIGH_RISK_ADMISSION_CONTRACT_REF} must satisfy the package-owned local admission evidence contract.`, `${HIGH_RISK_ADMISSION_CONTRACT_REF} 必须满足包内 local admission evidence 契约。`));
   const lines = [
     styleHeading(`nimicoding admit-high-risk-decision: ${payload.projectRoot}`),
     "",

package/cli/lib/internal/contracts-parse-high-risk.mjs

@@ -67,7 +67,7 @@ export function parseHighRiskAdmissionContract(text) {
   const dispositionEnum = toStringArray(parsed?.disposition_enum);
 
   return {
-    ok: String(parsed?.truth_contract?.id ?? "") === "canonical_high_risk_admissions_truth"
+    ok: String(parsed?.truth_contract?.id ?? "") === "local_high_risk_admission_evidence"
       && arraysEqual(topLevelRequiredKeys, HIGH_RISK_ADMISSION_REQUIRED_TOP_LEVEL_KEYS)
       && arraysEqual(admissionRequiredFields, HIGH_RISK_ADMISSION_RECORD_REQUIRED_FIELDS)
       && arraysEqual(dispositionEnum, HIGH_RISK_ADMISSION_DISPOSITION_ENUM),

package/cli/lib/internal/doctor-finalize.mjs

@@ -22,12 +22,10 @@ import {
   loadHighRiskExecutionContract,
   loadHighRiskSchemaContracts,
   loadSpecReconstructionContract,
-  validateHighRiskAdmissionsSpec,
 } from "../contracts.mjs";
 import { loadAuditExecutionArtifactsConfig } from "../audit-execution.mjs";
 import { loadExternalExecutionArtifactsConfig } from "../external-execution.mjs";
-import { pathExists, readTextIfFile } from "../fs-helpers.mjs";
-import { parseYamlText } from "../yaml-helpers.mjs";
+import { readTextIfFile } from "../fs-helpers.mjs";
 import { buildCheck } from "./doctor-state.mjs";
 import {
   buildHostCompatibilityReport,
@@ -150,30 +148,6 @@ export async function finalizeDoctorState(projectRoot, bootstrapSurface, delegat
     ),
   );
 
-  let highRiskAdmissionsTruthValid = true;
-  const admissionsTruthRef = ".nimi/spec/high-risk-admissions.yaml";
-  const admissionsInfo = await pathExists(path.join(projectRoot, admissionsTruthRef));
-  if (admissionsInfo && admissionsInfo.isFile()) {
-    const admissionsTruthText = await readTextIfFile(path.join(projectRoot, admissionsTruthRef));
-    const admissionsTruthParsed = admissionsTruthText ? parseYamlText(admissionsTruthText) : null;
-    const admissionsTruthValidation = highRiskAdmissionContract.ok
-      ? validateHighRiskAdmissionsSpec(admissionsTruthParsed, highRiskAdmissionContract)
-      : {
-        ok: false,
-        reason: `${HIGH_RISK_ADMISSION_CONTRACT_REF} is missing or malformed`,
-      };
-    highRiskAdmissionsTruthValid = admissionsTruthValidation.ok;
-    checks.push(
-      buildCheck(
-        "high_risk_admissions_truth",
-        admissionsTruthValidation.ok,
-        admissionsTruthValidation.ok
-          ? "Canonical high-risk admissions truth satisfies the packaged admission schema contract"
-          : `Canonical high-risk admissions truth drifted: ${admissionsTruthValidation.reason}`,
-      ),
-    );
-  }
-
   const adapterProfiles = await loadAdmittedAdapterProfiles(delegatedSurface.admittedAdapterIds);
   adapterProfiles.selected = selectAdapterProfile(adapterProfiles, delegatedSurface.selectedAdapterId);
   const adapterProfilesValid = adapterProfiles.invalid.length === 0;
@@ -312,7 +286,6 @@ export async function finalizeDoctorState(projectRoot, bootstrapSurface, delegat
       && externalHostCompatibilityContract.ok
       && highRiskExecutionContract.ok
       && highRiskAdmissionContract.ok
-      && highRiskAdmissionsTruthValid
       && externalExecutionArtifacts.ok
       && packageBoundaryTruthOk
       && (usesV2SurfaceModel || bootstrapSurface.specTreeModel.ok)

package/cli/lib/internal/doctor-format.mjs

@@ -48,7 +48,6 @@ const DOCTOR_DETAIL_TRANSLATIONS = new Map([
   ["Packaged high-risk admission schema contract is present and aligned", "包内 high-risk admission schema 契约存在且一致"],
   ["external execution artifact landing-path contract is present and structurally valid", "external execution artifact landing-path 契约存在且结构有效"],
   ["High-risk execution schema seeds are present and structurally valid", "high-risk execution schema seed 已存在且结构有效"],
-  ["Canonical high-risk admissions truth satisfies the packaged admission schema contract", "canonical high-risk admissions truth 满足包内 admission schema 契约"],
   ["No host adapter selected; vendor-neutral delegated host posture remains active", "未选择 host adapter；vendor-neutral 的 delegated host 姿态仍然生效"],
   ["Package-owned adapter profile overlays are present and valid: codex, oh_my_codex, claude", "包内 adapter profile overlay 已存在且有效：codex, oh_my_codex, claude"],
   ["Host adapter boundary keeps semantic review in nimicoding and limits handoff to prompt/output/evidence", "host adapter 边界保持 semantic review 在 nimicoding 内，并将 handoff 限制为 prompt/output/evidence"],

package/cli/lib/internal/surface-taxonomy-validators.mjs

@@ -241,9 +241,6 @@ function classifyRef(ref, text, parsedYaml) {
   if (ref === ".nimi/spec/bootstrap-state.yaml") {
     return "lifecycle_progress_state";
   }
-  if (ref === ".nimi/spec/high-risk-admissions.yaml") {
-    return "product_admission_registry";
-  }
   if (ref === ".nimi/spec/product-scope.yaml") {
     return "methodology_authority";
   }
@@ -404,7 +401,6 @@ function ambiguityFor(requiredConfirmation, surfaceClass) {
 
 function validationCommandsFor(entryClass) {
   const commands = {
-    product_admission_registry: ["pnpm exec nimicoding validate-placement --profile nimi --root .nimi/spec"],
     product_authority_table: ["pnpm exec nimicoding validate-table-family --profile nimi --root .nimi/spec"],
     support_registry: ["pnpm exec nimicoding validate-table-family --profile nimi --root .nimi/spec"],
     thin_guidance: ["pnpm exec nimicoding validate-guidance-bodies --profile nimi --root .nimi/spec"],
@@ -460,34 +456,6 @@ function validateRefPlacement(ref, surfaceClass, parsedYaml, text, contracts) {
   if (surfaceClass === "product_authority" && isMarkdownRef(ref) && GENERATED_REF_PATTERN.test(text)) {
     addError(errors, "derived_view_referenced_as_authority", ref);
   }
-  if (surfaceClass === "product_admission_registry") {
-    errors.push(...validateProductAdmissionRegistryRef(ref, parsedYaml, text, contracts));
-  }
-
-  return errors;
-}
-
-function validateProductAdmissionRegistryRef(ref, parsedYaml, text, contracts) {
-  const errors = [];
-  if (ref !== ".nimi/spec/high-risk-admissions.yaml") {
-    addError(errors, "product_admission_registry_outside_allowed_root", ref);
-    return errors;
-  }
-  if (!isPlainObject(parsedYaml)) {
-    addError(errors, "product_admission_registry_invalid_yaml", ref);
-    return errors;
-  }
-  const requiredKeys = Array.isArray(contracts.highRiskAdmission.data?.top_level_required_keys)
-    ? contracts.highRiskAdmission.data.top_level_required_keys
-    : [];
-  for (const key of requiredKeys) {
-    if (!(key in parsedYaml)) {
-      addError(errors, "product_admission_registry_missing_required_key", ref, key);
-    }
-  }
-  if (/package_name:\s*"?@nimiplatform\/nimi-coding"?|spec_tree_model:|canonical_spec_root:/i.test(text)) {
-    addError(errors, "product_admission_registry_contains_package_methodology_body", ref);
-  }
   return errors;
 }
 
@@ -738,7 +706,6 @@ export async function classifySpecSurface(projectRoot, options = {}) {
       target_class_enum: [
         "product_authority",
         "product_authority_table",
-        "product_admission_registry",
         "thin_guidance",
         "derived_view",
         "spec_generation_state",
@@ -779,7 +746,6 @@ export function isProductAuthoritySurfaceClass(surfaceClass) {
   return [
     "product_authority",
     "product_authority_table",
-    "product_admission_registry",
     "thin_guidance",
     "host_projection_anchor",
     "support_registry",

package/cli/lib/internal/validators-spec-helpers.mjs

@@ -80,7 +80,6 @@ function isAllowedTopLevelSupportFile(relativePath) {
     "INDEX.md",
     "bootstrap-state.yaml",
     "product-scope.yaml",
-    "high-risk-admissions.yaml",
   ].includes(relativePath);
 }
 

package/config/bootstrap.yaml

@@ -1,6 +1,6 @@
 version: 1
 initialized_by: "@nimiplatform/nimi-coding"
-cli_version: "0.2.5"
+cli_version: "0.2.7"
 bootstrap_contract: "nimicoding.bootstrap"
 bootstrap_contract_version: 1
 profile: default

package/config/spec-generation-inputs.yaml

@@ -7,7 +7,7 @@ spec_generation_inputs:
   docs_inputs:
     - root: .nimi/spec
       class_filter: product_authority_only
-      allowed_surface_classes: [product_authority, product_authority_table, product_admission_registry, thin_guidance, host_projection_anchor, support_registry]
+      allowed_surface_classes: [product_authority, product_authority_table, thin_guidance, host_projection_anchor, support_registry]
       forbidden_surface_classes: [derived_view, spec_generation_state, audit_evidence_state, operational_local_artifact, nimicoding_managed_projection, candidate_roadmap, lifecycle_progress_state, methodology_authority]
       owner: nimi_host
       use_as_authority: true

package/contracts/audit-chunk.schema.yaml

@@ -22,11 +22,20 @@ optional_top_level_fields:
   - authority_kind
   - app_id
   - package_authority_id
+  - delegated_projection_id
   - admission_ref
   - authority_root
+  - source_authority_root
   - evidence_root_admission_refs
   - admitted_evidence_roots
   - host_authority_projection_refs
+  - delegated_evidence_roots
+  - delegated_declared_evidence_prefixes
+  - delegated_declared_evidence_refs
+  - declared_evidence_delegation
+  - required_verification_commands
+  - declared_evidence_targets
+  - declared_evidence_unresolved
   - evidence_roots
   - evidence_inventory
   - evidence_inventory_status
@@ -60,6 +69,10 @@ hard_constraints:
   - spec_authority_chunks_must_declare_coverage_contract
   - spec_authority_chunk_files_remain_authority_refs_only
   - admitted_package_authority_projection_refs_must_be_explicitly_mapped
+  - delegated_projection_authority_must_be_explicitly_admitted
+  - delegated_declared_evidence_must_name_source_authority_boundary
+  - delegated_projection_is_audit_modeling_only_not_source_repo_execution
+  - delegated_projection_must_not_resolve_or_mutate_source_authority_refs
   - spec_authority_ingest_requires_one_authority_outcome_per_authority_ref
   - spec_authority_ingest_requires_evidence_files_exactly_matching_evidence_inventory
   - spec_authority_authority_outcome_evidence_refs_must_belong_to_authority_refs_or_evidence_inventory

package/contracts/audit-plan.schema.yaml

@@ -22,6 +22,8 @@ optional_top_level_fields:
   - app_slice_admission_ref
   - app_slice_admissions
   - audit_evidence_root_refs
+  - delegated_projection_admission_refs
+  - delegated_projection_admissions
   - package_authority_admission_refs
   - package_authority_admissions
   - evidence_inventory_hash
@@ -52,11 +54,20 @@ chunk_optional_fields:
   - authority_kind
   - app_id
   - package_authority_id
+  - delegated_projection_id
   - admission_ref
   - authority_root
+  - source_authority_root
   - evidence_root_admission_refs
   - admitted_evidence_roots
   - host_authority_projection_refs
+  - delegated_evidence_roots
+  - delegated_declared_evidence_prefixes
+  - delegated_declared_evidence_refs
+  - declared_evidence_delegation
+  - required_verification_commands
+  - declared_evidence_targets
+  - declared_evidence_unresolved
   - evidence_roots
   - evidence_inventory
   - coverage_contract
@@ -112,6 +123,10 @@ hard_constraints:
   - risk_budget_pause_must_not_mark_unresolved_findings_as_closed
   - risk_budget_pause_blocks_further_dispatch_until_remediation_bundle_or_manager_action
   - admitted_package_authority_projection_refs_must_be_explicitly_mapped
+  - delegated_projection_authority_must_be_explicitly_admitted
+  - delegated_declared_evidence_must_name_source_authority_boundary
+  - delegated_projection_is_audit_modeling_only_not_source_repo_execution
+  - delegated_projection_must_not_resolve_or_mutate_source_authority_refs
   - spec_authority_plans_must_materialize_full_evidence_inventory
   - spec_authority_chunks_must_assign_evidence_inventory_to_every_matching_authority_chunk
   - spec_authority_evidence_inventory_files_may_be_reused_across_chunks_without_creating_parallel_truth

package/contracts/high-risk-admission.schema.yaml

@@ -1,6 +1,6 @@
 version: 1
 truth_contract:
-  id: canonical_high_risk_admissions_truth
+  id: local_high_risk_admission_evidence
 top_level_required_keys:
   - admissions
   - admission_rules
@@ -18,6 +18,6 @@ disposition_enum:
   - partial
   - deferred
 semantic_constraints:
-  - canonical_admission_records_must_not_promote_operational_runtime_state
-  - canonical_admission_records_must_use_one_record_per_topic_id
-  - canonical_admission_records_must_use_iso_8601_utc_admitted_at
+  - local_admission_records_must_not_promote_operational_runtime_state
+  - local_admission_records_must_not_be_used_as_product_authority
+  - local_admission_records_must_use_iso_8601_utc_admitted_at

package/contracts/migration-inventory.schema.yaml

@@ -32,7 +32,6 @@ disposition_enum:
 target_class_enum:
   - product_authority
   - product_authority_table
-  - product_admission_registry
   - thin_guidance
   - derived_view
   - spec_generation_state
@@ -75,6 +74,5 @@ semantic_constraints:
   - block_entries_require_user_confirmation_before_migration
   - future_under_spec_must_not_have_keep_disposition
   - nimicoding_managed_projection_must_have_keep_disposition_and_must_not_be_promoted_to_product_authority
-  - product_admission_registry_must_not_be_moved_to_package
   - generated_views_default_to_delete_with_stdout_view
   - audit_state_defaults_to_move_local

package/contracts/placement-contract.schema.yaml

@@ -42,12 +42,6 @@ placement_rules:
     tracking_policy: tracked_required
     requires_admission: none
     validator_scope: thin_guidance
-  - root_pattern: .nimi/spec/high-risk-admissions.yaml
-    allowed_classes: [product_admission_registry]
-    owner: product_governance
-    tracking_policy: tracked_required
-    requires_admission: packaged_schema
-    validator_scope: product_admission_registry
   - root_pattern: .nimi/spec/_meta/<package>-admission-anchor.yaml
     allowed_classes: [host_projection_anchor]
     owner: host_projection
@@ -155,9 +149,8 @@ fail_closed_cases:
   - tracked_non_product_file_without_admission
   - nimicoding_managed_projection_promoted_to_product_authority
   - future_or_backlog_under_.nimi/spec
-  - product_admission_registry_contains_package_methodology_body
 semantic_constraints:
   - path_shape_is_never_sufficient_authority_proof
   - keep_move_package_move_local_split_rewrite_delete_block_must_be_explicit
   - product_semantic_forks_block_for_user_confirmation
-  - high_risk_admission_records_stay_product_governance_truth_while_schema_and_cli_stay_package_owned
+  - high_risk_admission_records_stay_local_evidence_while_domain_spec_holds_product_authority

package/contracts/shared-enums.yaml

@@ -5,7 +5,6 @@ contract:
 surface_class_enum:
   - product_authority
   - product_authority_table
-  - product_admission_registry
   - thin_guidance
   - derived_view
   - spec_generation_state

package/contracts/spec-generation-inputs.schema.yaml

@@ -23,7 +23,7 @@ document_instance:
   docs_inputs:
     - root: .nimi/spec
       class_filter: product_authority_only
-      allowed_surface_classes: [product_authority, product_authority_table, product_admission_registry, thin_guidance, host_projection_anchor, support_registry]
+      allowed_surface_classes: [product_authority, product_authority_table, thin_guidance, host_projection_anchor, support_registry]
       forbidden_surface_classes: [derived_view, spec_generation_state, audit_evidence_state, operational_local_artifact, nimicoding_managed_projection, candidate_roadmap, lifecycle_progress_state, methodology_authority]
       owner: nimi_host
       use_as_authority: true
@@ -93,7 +93,7 @@ baseline_inputs:
   docs_inputs:
     - root: .nimi/spec
       class_filter: product_authority_only
-      allowed_surface_classes: [product_authority, product_authority_table, product_admission_registry, thin_guidance, host_projection_anchor, support_registry]
+      allowed_surface_classes: [product_authority, product_authority_table, thin_guidance, host_projection_anchor, support_registry]
       forbidden_surface_classes: [derived_view, spec_generation_state, audit_evidence_state, operational_local_artifact, nimicoding_managed_projection, candidate_roadmap, lifecycle_progress_state, methodology_authority]
       owner: nimi_host
       use_as_authority: true

package/contracts/surface-taxonomy.schema.yaml

@@ -41,15 +41,6 @@ taxonomy:
     reference_rules: [must_declare_table_family, may_reference_product_authority]
     promotion_rules: [table_family_must_be_product_authority_family]
     fail_closed_cases: [missing_table_family, contains_status_or_coverage_fields, unknown_table_family]
-  - class_id: product_admission_registry
-    owner_kind: product_governance
-    authority_rank: support_only
-    allowed_roots: [".nimi/spec/high-risk-admissions.yaml"]
-    tracking_policy: tracked_required
-    mutability: human_admitted
-    reference_rules: [may_reference_topic_packets, must_use_packaged_schema, must_not_copy_package_mechanics]
-    promotion_rules: [only_explicit_manager_owned_decision_may_append_rows]
-    fail_closed_cases: [contains_package_methodology_body, contains_operational_runtime_state, missing_packaged_schema_ref]
   - class_id: thin_guidance
     owner_kind: product_domain
     authority_rank: guidance_only
@@ -152,7 +143,6 @@ taxonomy:
 class_enum:
   - product_authority
   - product_authority_table
-  - product_admission_registry
   - thin_guidance
   - derived_view
   - spec_generation_state
@@ -191,7 +181,6 @@ semantic_constraints:
   - every_candidate_file_gets_exactly_one_surface_class
   - unclassified_files_fail_closed
   - product_authority_classes_must_not_contain_lifecycle_state_or_audit_coverage
-  - product_admission_registry_may_store_compact_semantic_admissions_but_not_package_mechanics
   - generated_and_derived_classes_are_never_authority
   - package_methodology_and_package_spec_remain_package_owned
   - nimicoding_managed_projection_may_exist_in_host_project_but_is_not_product_authority

package/contracts/workflow-consumer.schema.yaml

@@ -51,7 +51,6 @@ workflow_consumers:
     required_surface_classes:
       - product_authority
       - product_authority_table
-      - product_admission_registry
       - support_registry
     forbidden_surface_classes:
       - derived_view
@@ -71,7 +70,6 @@ workflow_consumers:
     required_surface_classes:
       - product_authority
       - product_authority_table
-      - product_admission_registry
       - thin_guidance
       - methodology_authority
       - host_projection_anchor

package/methodology/spec-target-truth-profile.yaml

@@ -12,7 +12,6 @@ target_truth_profile:
     - .nimi/spec/boundaries.yaml
     - .nimi/spec/ownership.yaml
     - .nimi/spec/change-policy.yaml
-    - .nimi/spec/high-risk-admissions.yaml
   output_profiles:
     - path: .nimi/spec/authority-map.yaml
       purpose: map_project_authority_surfaces_and_declared_owners
@@ -38,12 +37,6 @@ target_truth_profile:
         - work_types
         - authority_gates
         - parallel_truth_policy
-    - path: .nimi/spec/high-risk-admissions.yaml
-      purpose: record_explicit_high_risk_semantic_admissions_as_canonical_truth
-      minimum_sections:
-        - admissions
-        - admission_rules
-        - semantic_constraints
   hard_constraints:
     - do_not_seed_empty_target_truth_files_during_bootstrap
     - do_not_treat_profile_as_canonical_tree_completion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nimiplatform/nimi-coding",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "private": false,
   "description": "AI-native coding governance toolkit for bootstrapping .nimi/** into arbitrary projects.",
   "license": "MIT",