@nimiplatform/nimi-coding 0.2.6 → 0.2.7

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to `@nimiplatform/nimi-coding` are tracked here.
 
 This project follows semantic versioning for published npm releases.
 
+## 0.2.7
+
+- Added delegated projection admissions for spec-authority sweeps so a host
+  `.nimi/spec/**` subtree projected from a parent or external source authority
+  can audit host-local projection evidence while delegating source-owned
+  implementation refs through an explicit boundary.
+- Kept delegated projections as audit modeling only: the CLI records and
+  validates source-authority boundaries, but does not read, sync, rewrite, or
+  mutate parent/external source repositories.
+- Ignored npm package/import specifiers and explicit `./` relative refs when
+  deriving declared evidence targets, so package subpaths and YAML fragment refs
+  do not get promoted into project-local evidence paths.
+
 ## 0.2.6
 
 - Hard-cut high-risk admission records out of active `.nimi/spec/**`

package/README.md

@@ -314,7 +314,7 @@ repository itself keeps the package-owned source directly under
 
 ```bash
 pnpm install
-pnpm test           # runs the node:test suite (340 tests at 0.2.6)
+pnpm test           # runs the node:test suite
 pnpm check:pack     # npm pack --dry-run
 pnpm check:ci       # test + pack + CLI help/version smoke
 ```

package/README.zh-CN.md

@@ -256,7 +256,7 @@ Nimi Coding 坐在你已经用的 AI host *底下*。它是让 AI 做完的工
 
 ```bash
 pnpm install
-pnpm test           # 跑 node:test 套件（0.2.6 共 340 用例）
+pnpm test           # 跑 node:test 套件
 pnpm check:pack     # npm pack --dry-run
 pnpm check:ci       # test + pack + CLI help/version smoke
 ```

package/cli/constants.mjs

@@ -1,4 +1,4 @@
-export const VERSION = "0.2.6";
+export const VERSION = "0.2.7";
 export const PACKAGE_NAME = "@nimiplatform/nimi-coding";
 export const BOOTSTRAP_CONTRACT_ID = "nimicoding.bootstrap";
 export const BOOTSTRAP_CONTRACT_VERSION = 1;

package/cli/lib/audit-sweep-runtime/admissions.mjs

@@ -9,6 +9,7 @@ import { pathExists } from "../fs-helpers.mjs";
 export const AUDIT_SWEEP_PROJECT_CONFIG_REF = ".nimi/config/audit-sweep.yaml";
 export const APP_SLICE_ADMISSION_REF = ".nimi/spec/platform/kernel/tables/app-slice-admissions.yaml";
 const AUDIT_EVIDENCE_ROOT_TABLE_BASENAME = "audit-evidence-roots.yaml";
+const DELEGATED_PROJECTION_ADMISSION_BASENAME = "delegated-projection-admissions.yaml";
 const PACKAGE_AUTHORITY_ADMISSION_BASENAME = "package-authority-admissions.yaml";
 
 export function refInsideRoot(fileRef, rootRef) {
@@ -23,6 +24,32 @@ function safeProjectRef(value) {
     && !value.split("/").includes("..");
 }
 
+function normalizeProjectRef(value) {
+  const normalized = String(value ?? "").trim().replace(/\\/g, "/");
+  if (/^[a-z][a-z0-9+.-]*:\/\/$/iu.test(normalized)) {
+    return normalized;
+  }
+  return normalized.replace(/\/$/, "");
+}
+
+function activePosture(row) {
+  return String(row?.status ?? row?.admission_posture ?? "").trim();
+}
+
+function safeProjectionSourceRef(value) {
+  const normalized = normalizeProjectRef(value);
+  return normalized.startsWith("parent://")
+    || normalized.startsWith("package://")
+    || safeProjectRef(normalized);
+}
+
+function safeRelativePath(value) {
+  const normalized = normalizeProjectRef(value);
+  return normalized.length > 0
+    && !path.isAbsolute(normalized)
+    && !normalized.split("/").includes("..");
+}
+
 export async function loadAuditSweepProjectConfig(projectRoot) {
   const configPath = artifactPath(projectRoot, AUDIT_SWEEP_PROJECT_CONFIG_REF);
   const info = await pathExists(configPath);
@@ -241,6 +268,97 @@ export async function loadAuditEvidenceRootAdmissions(projectRoot, listGitFiles,
   return { ok: true, tableRefs, admissions };
 }
 
+export async function loadDelegatedProjectionAdmissions(projectRoot, listGitFiles, listFallbackFiles) {
+  const tableRefs = await listSpecTableRefs(projectRoot, DELEGATED_PROJECTION_ADMISSION_BASENAME, listGitFiles, listFallbackFiles);
+  if (!tableRefs) {
+    return { ok: true, tableRefs: [], admissions: [] };
+  }
+  const admissions = [];
+  const seenIds = new Set();
+
+  for (const tableRef of tableRefs) {
+    let parsed;
+    try {
+      parsed = YAML.parse(await readFile(artifactPath(projectRoot, tableRef), "utf8"));
+    } catch (error) {
+      return {
+        ok: false,
+        error: `nimicoding sweep audit refused: ${tableRef} must contain valid YAML (${error.message}).\n`,
+      };
+    }
+    const rows = Array.isArray(parsed?.admissions) ? parsed.admissions : null;
+    if (!rows) {
+      return { ok: false, error: `nimicoding sweep audit refused: ${tableRef} must declare admissions as an array.\n` };
+    }
+    for (const row of rows) {
+      const id = String(row?.id ?? "").trim();
+      const posture = activePosture(row);
+      const ownerDomain = String(row?.owner_domain ?? "").trim();
+      const authorityRoot = normalizeProjectRef(row?.authority_root);
+      const sourceAuthorityRoot = normalizeProjectRef(row?.source_authority_root);
+      const localProjectionEvidenceRoots = Array.isArray(row?.local_projection_evidence_roots)
+        ? row.local_projection_evidence_roots.map(normalizeProjectRef).filter(Boolean)
+        : null;
+      const delegatedEvidenceRoots = Array.isArray(row?.delegated_evidence_roots)
+        ? row.delegated_evidence_roots.map(normalizeProjectRef).filter(Boolean)
+        : null;
+      const delegatedDeclaredEvidencePrefixes = Array.isArray(row?.delegated_declared_evidence_prefixes)
+        ? row.delegated_declared_evidence_prefixes.map(normalizeProjectRef).filter(Boolean)
+        : [];
+      const hostOwnedRelativePaths = Array.isArray(row?.host_owned_relative_paths)
+        ? row.host_owned_relative_paths.map(normalizeProjectRef).filter(Boolean)
+        : [];
+      const requiredVerificationCommands = Array.isArray(row?.required_verification_commands)
+        ? row.required_verification_commands.map((entry) => String(entry ?? "").trim()).filter(Boolean)
+        : [];
+      const admissionKey = `${tableRef}#${id}`;
+      if (!id || seenIds.has(admissionKey)) {
+        return { ok: false, error: `nimicoding sweep audit refused: ${tableRef} has missing or duplicate delegated projection id.\n` };
+      }
+      seenIds.add(admissionKey);
+      if (posture !== "active") {
+        continue;
+      }
+      if (!ownerDomain || !safeProjectRef(authorityRoot) || !authorityRoot.startsWith(".nimi/spec/")) {
+        return { ok: false, error: `nimicoding sweep audit refused: ${tableRef} ${id} has invalid owner_domain or authority_root.\n` };
+      }
+      if (!safeProjectionSourceRef(sourceAuthorityRoot)) {
+        return { ok: false, error: `nimicoding sweep audit refused: ${tableRef} ${id} has invalid source_authority_root.\n` };
+      }
+      if (!localProjectionEvidenceRoots?.length || !localProjectionEvidenceRoots.every((rootRef) => safeProjectRef(rootRef) && !rootRef.startsWith(".nimi/spec/"))) {
+        return { ok: false, error: `nimicoding sweep audit refused: ${tableRef} ${id} has invalid local_projection_evidence_roots.\n` };
+      }
+      if (!delegatedEvidenceRoots?.length || !delegatedEvidenceRoots.every(safeProjectionSourceRef)) {
+        return { ok: false, error: `nimicoding sweep audit refused: ${tableRef} ${id} has invalid delegated_evidence_roots.\n` };
+      }
+      if (delegatedDeclaredEvidencePrefixes.length === 0 || !delegatedDeclaredEvidencePrefixes.every(safeRelativePath)) {
+        return { ok: false, error: `nimicoding sweep audit refused: ${tableRef} ${id} must declare delegated_declared_evidence_prefixes.\n` };
+      }
+      if (!hostOwnedRelativePaths.every(safeRelativePath)) {
+        return { ok: false, error: `nimicoding sweep audit refused: ${tableRef} ${id} has invalid host_owned_relative_paths.\n` };
+      }
+      if (!requiredVerificationCommands.every((command) => command.length > 0)) {
+        return { ok: false, error: `nimicoding sweep audit refused: ${tableRef} ${id} has invalid required_verification_commands.\n` };
+      }
+      admissions.push({
+        id,
+        owner_domain: ownerDomain,
+        status: posture,
+        authority_root: authorityRoot,
+        source_authority_root: sourceAuthorityRoot,
+        local_projection_evidence_roots: localProjectionEvidenceRoots,
+        delegated_evidence_roots: delegatedEvidenceRoots,
+        delegated_declared_evidence_prefixes: delegatedDeclaredEvidencePrefixes,
+        host_owned_relative_paths: hostOwnedRelativePaths,
+        required_verification_commands: requiredVerificationCommands,
+        admission_ref: admissionKey,
+      });
+    }
+  }
+
+  return { ok: true, tableRefs, admissions };
+}
+
 export async function loadPackageAuthorityAdmissions(projectRoot, listGitFiles, listFallbackFiles) {
   const tableRefs = await listSpecTableRefs(projectRoot, PACKAGE_AUTHORITY_ADMISSION_BASENAME, listGitFiles, listFallbackFiles);
   if (!tableRefs) {

package/cli/lib/audit-sweep-runtime/evidence-assignment.mjs

@@ -67,6 +67,9 @@ function chunkAcceptsEvidenceFile(chunk, fileRef) {
   if (surface === "spec-generation-audit" || surface === "high-risk-admissions" || surface === "package-meta" || surface === "package-root") {
     return true;
   }
+  if (surface === "delegated-projection") {
+    return true;
+  }
   return false;
 }
 

package/cli/lib/audit-sweep-runtime/inventory-spec-chunks.mjs

@@ -46,11 +46,17 @@ function looksLikeSpecAuthorityRelativeRef(normalized) {
 }
 
 function normalizeDeclaredEvidenceRef(value) {
-  const normalized = String(value ?? "")
+  const raw = String(value ?? "")
     .trim()
     .replace(/\\/g, "/")
-    .replace(/^\.\//, "")
     .replace(/[),.;:]+$/u, "");
+  if (!raw || raw.startsWith("../") || raw.includes("/../") || raw.startsWith("http:") || raw.startsWith("https:")) {
+    return null;
+  }
+  if (raw.startsWith("@") || raw.startsWith("./")) {
+    return null;
+  }
+  const normalized = raw.replace(/^\.\//, "");
   if (!normalized || normalized.startsWith("../") || normalized.includes("/../") || normalized.startsWith("http:") || normalized.startsWith("https:")) {
     return null;
   }
@@ -102,6 +108,37 @@ function candidateEvidenceRefsForDeclaredRef(declaredRef, evidenceRoots) {
   return [...new Set(candidates)].sort();
 }
 
+function normalizedRef(value) {
+  return String(value ?? "").replace(/\\/g, "/").replace(/\/$/, "");
+}
+
+function refInsideRoot(fileRef, rootRef) {
+  const root = normalizedRef(rootRef);
+  return Boolean(root) && (fileRef === root || fileRef.startsWith(`${root}/`));
+}
+
+function delegatedProjectionAdmissionForFile(fileRef, admissions = []) {
+  return admissions.find((admission) => {
+    if (!refInsideRoot(fileRef, admission.authority_root)) {
+      return false;
+    }
+    const relative = fileRef === admission.authority_root
+      ? ""
+      : fileRef.slice(admission.authority_root.length + 1);
+    return !(admission.host_owned_relative_paths ?? []).some((hostOwnedPath) => (
+      relative === hostOwnedPath || relative.startsWith(`${hostOwnedPath}/`)
+    ));
+  }) ?? null;
+}
+
+function declaredRefDelegated(ref, prefixes = []) {
+  const normalized = normalizedRef(ref);
+  return prefixes.some((prefix) => {
+    const normalizedPrefix = normalizedRef(prefix);
+    return normalizedPrefix && (normalized === normalizedPrefix || normalized.startsWith(`${normalizedPrefix}/`));
+  });
+}
+
 function extractDeclaredEvidenceRefs(text) {
   const refs = [];
   for (const match of String(text ?? "").matchAll(DECLARED_EVIDENCE_REF_PATTERN)) {
@@ -147,6 +184,74 @@ function extractModuleMapRefs(markdownText) {
   return [...new Set(refs)].sort();
 }
 
+function buildDelegatedProjectionChunk({
+  admission,
+  entries,
+  chunkIndex,
+  criteria,
+  authorityTextByRef,
+}) {
+  const authorityRefs = entries.map((entry) => entry.file_ref).sort();
+  const authorityText = authorityRefs
+    .map((authorityRef) => authorityTextByRef?.get(authorityRef) ?? "")
+    .join("\n");
+  const declaredEvidenceRefs = extractDeclaredEvidenceRefs(authorityText);
+  const delegatedDeclaredEvidenceRefs = declaredEvidenceRefs
+    .filter((ref) => declaredRefDelegated(ref, admission.delegated_declared_evidence_prefixes))
+    .sort();
+  const localDeclaredEvidenceRefs = declaredEvidenceRefs
+    .filter((ref) => !declaredRefDelegated(ref, admission.delegated_declared_evidence_prefixes))
+    .sort();
+  const evidenceRoots = [...new Set(admission.local_projection_evidence_roots ?? [])].sort();
+  const declaredEvidenceTargets = localDeclaredEvidenceRefs
+    .map((evidenceRef) => ({
+      source_path: evidenceRef,
+      candidates: candidateEvidenceRefsForDeclaredRef(evidenceRef, evidenceRoots),
+    }))
+    .filter((target) => target.candidates.length > 0);
+  return {
+    chunk_id: [
+      `chunk-${String(chunkIndex).padStart(3, "0")}`,
+      slugPart(admission.owner_domain),
+      "delegated-projection",
+      slugPart(admission.id),
+    ].join("-"),
+    state: "planned",
+    owner_domain: admission.owner_domain,
+    planning_basis: "spec_authority",
+    spec_surface: "delegated-projection",
+    criteria,
+    files: authorityRefs,
+    authority_refs: authorityRefs,
+    authority_kind: "delegated_projection",
+    delegated_projection_id: admission.id,
+    admission_ref: admission.admission_ref,
+    authority_root: admission.authority_root,
+    source_authority_root: admission.source_authority_root,
+    admitted_evidence_roots: evidenceRoots,
+    delegated_evidence_roots: admission.delegated_evidence_roots,
+    delegated_declared_evidence_prefixes: admission.delegated_declared_evidence_prefixes,
+    ...(delegatedDeclaredEvidenceRefs.length > 0 ? {
+      delegated_declared_evidence_refs: delegatedDeclaredEvidenceRefs,
+      declared_evidence_delegation: {
+        status: "delegated_to_source_authority",
+        delegated_ref_count: delegatedDeclaredEvidenceRefs.length,
+        source_authority_root: admission.source_authority_root,
+        delegated_evidence_roots: admission.delegated_evidence_roots,
+      },
+    } : {}),
+    ...(admission.required_verification_commands?.length > 0 ? {
+      required_verification_commands: admission.required_verification_commands,
+    } : {}),
+    ...(declaredEvidenceTargets.length > 0 ? {
+      declared_evidence_targets: declaredEvidenceTargets,
+    } : {}),
+    evidence_roots: evidenceRoots,
+    file_count: authorityRefs.length,
+    finding_count: 0,
+  };
+}
+
 function candidateEvidenceRefsForModuleMapPath(modulePath, evidenceRoots) {
   const normalized = String(modulePath ?? "").replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/$/, "");
   if (!normalized || normalized.startsWith("http:") || normalized.startsWith("https:")) {
@@ -181,6 +286,16 @@ function candidateEvidenceRefsForModuleMapPath(modulePath, evidenceRoots) {
 export function buildSpecChunks(includedInventory, options) {
   const sortedEntries = [...includedInventory].sort((left, right) => left.file_ref.localeCompare(right.file_ref));
   const includedRefs = new Set(sortedEntries.map((entry) => entry.file_ref));
+  const delegatedEntriesByAdmissionRef = new Map();
+  for (const entry of sortedEntries) {
+    const admission = delegatedProjectionAdmissionForFile(entry.file_ref, options.delegatedProjectionAdmissions);
+    if (!admission) {
+      continue;
+    }
+    const entries = delegatedEntriesByAdmissionRef.get(admission.admission_ref) ?? [];
+    entries.push(entry);
+    delegatedEntriesByAdmissionRef.set(admission.admission_ref, entries);
+  }
   const hostProjectionByHostRef = new Map();
   const hostProjectionsByPackageRef = new Map();
   for (const admission of options.packageAuthorityAdmissions ?? []) {
@@ -202,7 +317,24 @@ export function buildSpecChunks(includedInventory, options) {
   }
   let chunkIndex = 0;
   const chunks = [];
+  const emittedDelegatedAdmissions = new Set();
   for (const entry of sortedEntries) {
+    const delegatedAdmission = delegatedProjectionAdmissionForFile(entry.file_ref, options.delegatedProjectionAdmissions);
+    if (delegatedAdmission) {
+      if (emittedDelegatedAdmissions.has(delegatedAdmission.admission_ref)) {
+        continue;
+      }
+      emittedDelegatedAdmissions.add(delegatedAdmission.admission_ref);
+      chunkIndex += 1;
+      chunks.push(buildDelegatedProjectionChunk({
+        admission: delegatedAdmission,
+        entries: delegatedEntriesByAdmissionRef.get(delegatedAdmission.admission_ref) ?? [entry],
+        chunkIndex,
+        criteria: options.criteria,
+        authorityTextByRef: options.authorityTextByRef,
+      }));
+      continue;
+    }
     if (hostProjectionByHostRef.has(entry.file_ref)) {
       continue;
     }

package/cli/lib/audit-sweep-runtime/inventory.mjs

@@ -31,6 +31,7 @@ import {
   loadAppSliceAdmissions,
   loadAuditEvidenceRootAdmissions,
   loadAuditSweepProjectConfig,
+  loadDelegatedProjectionAdmissions,
   loadPackageAuthorityAdmissions,
 } from "./admissions.mjs";
 import { buildCoverageQuality } from "./coverage-quality.mjs";
@@ -441,6 +442,8 @@ export async function createAuditSweepPlan(projectRoot, options) {
   let appSliceAdmissions = [];
   let auditEvidenceRootAdmissions = [];
   let auditEvidenceRootAdmissionRefs = [];
+  let delegatedProjectionAdmissions = [];
+  let delegatedProjectionAdmissionRefs = [];
   let packageAuthorityAdmissions = [];
   let packageAuthorityAdmissionRefs = [];
   if (chunkBasis.basis === "spec") {
@@ -455,6 +458,12 @@ export async function createAuditSweepPlan(projectRoot, options) {
     }
     auditEvidenceRootAdmissions = loadedEvidenceRootAdmissions.admissions;
     auditEvidenceRootAdmissionRefs = loadedEvidenceRootAdmissions.tableRefs;
+    const loadedDelegatedProjectionAdmissions = await loadDelegatedProjectionAdmissions(projectRoot, listGitFiles, listFallbackFiles);
+    if (!loadedDelegatedProjectionAdmissions.ok) {
+      return inputError(loadedDelegatedProjectionAdmissions.error);
+    }
+    delegatedProjectionAdmissions = loadedDelegatedProjectionAdmissions.admissions;
+    delegatedProjectionAdmissionRefs = loadedDelegatedProjectionAdmissions.tableRefs;
     const loadedPackageAuthorityAdmissions = await loadPackageAuthorityAdmissions(projectRoot, listGitFiles, listFallbackFiles);
     if (!loadedPackageAuthorityAdmissions.ok) {
       return inputError(loadedPackageAuthorityAdmissions.error);
@@ -513,7 +522,7 @@ export async function createAuditSweepPlan(projectRoot, options) {
     }
   }
   let chunks = chunkBasis.basis === "spec"
-    ? buildSpecChunks(includedInventory, { criteria, targetRootRef, appSliceAdmissions, auditEvidenceRootAdmissions, packageAuthorityAdmissions, authorityTextByRef })
+    ? buildSpecChunks(includedInventory, { criteria, targetRootRef, appSliceAdmissions, auditEvidenceRootAdmissions, delegatedProjectionAdmissions, packageAuthorityAdmissions, authorityTextByRef })
     : buildFileChunks(includedInventory, { criteria, maxFilesPerChunk });
   let evidenceInventory = [];
   let unmappedEvidenceFiles = [];
@@ -589,6 +598,22 @@ export async function createAuditSweepPlan(projectRoot, options) {
     ...(chunkBasis.basis === "spec" && auditEvidenceRootAdmissionRefs.length > 0 ? {
       audit_evidence_root_refs: auditEvidenceRootAdmissionRefs,
     } : {}),
+    ...(chunkBasis.basis === "spec" && delegatedProjectionAdmissions.length > 0 ? {
+      delegated_projection_admission_refs: delegatedProjectionAdmissionRefs,
+      delegated_projection_admissions: delegatedProjectionAdmissions.map((admission) => ({
+        id: admission.id,
+        owner_domain: admission.owner_domain,
+        status: admission.status,
+        authority_root: admission.authority_root,
+        source_authority_root: admission.source_authority_root,
+        local_projection_evidence_roots: admission.local_projection_evidence_roots,
+        delegated_evidence_roots: admission.delegated_evidence_roots,
+        delegated_declared_evidence_prefixes: admission.delegated_declared_evidence_prefixes,
+        host_owned_relative_paths: admission.host_owned_relative_paths,
+        required_verification_commands: admission.required_verification_commands,
+        admission_ref: admission.admission_ref,
+      })),
+    } : {}),
     ...(chunkBasis.basis === "spec" && packageAuthorityAdmissions.length > 0 ? {
       package_authority_admission_refs: packageAuthorityAdmissionRefs,
       package_authority_admissions: packageAuthorityAdmissions.map((admission) => ({
@@ -669,11 +694,18 @@ export async function createAuditSweepPlan(projectRoot, options) {
       ...(chunk.authority_kind ? { authority_kind: chunk.authority_kind } : {}),
       ...(chunk.app_id ? { app_id: chunk.app_id } : {}),
       ...(chunk.package_authority_id ? { package_authority_id: chunk.package_authority_id } : {}),
+      ...(chunk.delegated_projection_id ? { delegated_projection_id: chunk.delegated_projection_id } : {}),
       ...(chunk.admission_ref ? { admission_ref: chunk.admission_ref } : {}),
       ...(chunk.authority_root ? { authority_root: chunk.authority_root } : {}),
+      ...(chunk.source_authority_root ? { source_authority_root: chunk.source_authority_root } : {}),
       ...(chunk.evidence_root_admission_refs ? { evidence_root_admission_refs: chunk.evidence_root_admission_refs } : {}),
       ...(chunk.admitted_evidence_roots ? { admitted_evidence_roots: chunk.admitted_evidence_roots } : {}),
       ...(chunk.host_authority_projection_refs ? { host_authority_projection_refs: chunk.host_authority_projection_refs } : {}),
+      ...(chunk.delegated_evidence_roots ? { delegated_evidence_roots: chunk.delegated_evidence_roots } : {}),
+      ...(chunk.delegated_declared_evidence_prefixes ? { delegated_declared_evidence_prefixes: chunk.delegated_declared_evidence_prefixes } : {}),
+      ...(chunk.delegated_declared_evidence_refs ? { delegated_declared_evidence_refs: chunk.delegated_declared_evidence_refs } : {}),
+      ...(chunk.declared_evidence_delegation ? { declared_evidence_delegation: chunk.declared_evidence_delegation } : {}),
+      ...(chunk.required_verification_commands ? { required_verification_commands: chunk.required_verification_commands } : {}),
       ...(chunk.declared_evidence_targets ? { declared_evidence_targets: chunk.declared_evidence_targets } : {}),
       ...(chunk.evidence_roots ? { evidence_roots: chunk.evidence_roots } : {}),
       ...(chunk.declared_evidence_unresolved ? { declared_evidence_unresolved: chunk.declared_evidence_unresolved } : {}),

package/cli/lib/audit-sweep-runtime/validators.mjs

@@ -259,6 +259,40 @@ function validatePlanShape(plan, sweepId, checks) {
         ));
     });
     check(checks, "plan_spec_package_authority_admitted", packageAuthorityChunksOk, "package-local authority chunks are admitted through .nimi/spec package authority admissions");
+    const delegatedProjectionAdmissions = Array.isArray(plan.delegated_projection_admissions) ? plan.delegated_projection_admissions : [];
+    const delegatedAdmissionByRef = new Map(delegatedProjectionAdmissions
+      .filter((entry) => isPlainObject(entry) && nonEmptyString(entry.admission_ref))
+      .map((entry) => [entry.admission_ref, entry]));
+    const delegatedProjectionChunks = plan.chunks.filter((chunk) => chunk.authority_kind === "delegated_projection");
+    const delegatedProjectionChunksOk = delegatedProjectionChunks.every((chunk) => {
+      const admission = delegatedAdmissionByRef.get(chunk.admission_ref);
+      const prefixes = Array.isArray(admission?.delegated_declared_evidence_prefixes)
+        ? admission.delegated_declared_evidence_prefixes
+        : [];
+      const delegatedRefs = Array.isArray(chunk.delegated_declared_evidence_refs)
+        ? chunk.delegated_declared_evidence_refs
+        : [];
+      const delegatedRefsOk = delegatedRefs.every((ref) => prefixes.some((prefix) => (
+        String(ref) === String(prefix).replace(/\/$/u, "")
+        || String(ref).startsWith(`${String(prefix).replace(/\/$/u, "")}/`)
+      )));
+      return nonEmptyString(chunk.delegated_projection_id)
+        && nonEmptyString(chunk.admission_ref)
+        && nonEmptyString(chunk.authority_root)
+        && nonEmptyString(chunk.source_authority_root)
+        && admission
+        && admission.id === chunk.delegated_projection_id
+        && admission.authority_root === chunk.authority_root
+        && admission.source_authority_root === chunk.source_authority_root
+        && Array.isArray(admission.local_projection_evidence_roots)
+        && sortedArrayEquals(chunk.evidence_roots, admission.local_projection_evidence_roots)
+        && sortedArrayEquals(chunk.admitted_evidence_roots, admission.local_projection_evidence_roots)
+        && sortedArrayEquals(chunk.delegated_evidence_roots, admission.delegated_evidence_roots)
+        && sortedArrayEquals(chunk.delegated_declared_evidence_prefixes, admission.delegated_declared_evidence_prefixes)
+        && delegatedRefsOk
+        && chunk.authority_refs.every((fileRef) => String(fileRef).startsWith(`${chunk.authority_root}/`));
+    });
+    check(checks, "plan_spec_delegated_projection_authority_admitted", delegatedProjectionChunksOk, "delegated projection chunks are admitted through .nimi/spec delegated projection admissions");
     const evidenceRootAdmissionsOk = plan.chunks.every((chunk) => (
       !Array.isArray(chunk.evidence_root_admission_refs)
       || chunk.evidence_root_admission_refs.every((ref) => (

package/config/bootstrap.yaml

@@ -1,6 +1,6 @@
 version: 1
 initialized_by: "@nimiplatform/nimi-coding"
-cli_version: "0.2.6"
+cli_version: "0.2.7"
 bootstrap_contract: "nimicoding.bootstrap"
 bootstrap_contract_version: 1
 profile: default

package/contracts/audit-chunk.schema.yaml

@@ -22,11 +22,20 @@ optional_top_level_fields:
   - authority_kind
   - app_id
   - package_authority_id
+  - delegated_projection_id
   - admission_ref
   - authority_root
+  - source_authority_root
   - evidence_root_admission_refs
   - admitted_evidence_roots
   - host_authority_projection_refs
+  - delegated_evidence_roots
+  - delegated_declared_evidence_prefixes
+  - delegated_declared_evidence_refs
+  - declared_evidence_delegation
+  - required_verification_commands
+  - declared_evidence_targets
+  - declared_evidence_unresolved
   - evidence_roots
   - evidence_inventory
   - evidence_inventory_status
@@ -60,6 +69,10 @@ hard_constraints:
   - spec_authority_chunks_must_declare_coverage_contract
   - spec_authority_chunk_files_remain_authority_refs_only
   - admitted_package_authority_projection_refs_must_be_explicitly_mapped
+  - delegated_projection_authority_must_be_explicitly_admitted
+  - delegated_declared_evidence_must_name_source_authority_boundary
+  - delegated_projection_is_audit_modeling_only_not_source_repo_execution
+  - delegated_projection_must_not_resolve_or_mutate_source_authority_refs
   - spec_authority_ingest_requires_one_authority_outcome_per_authority_ref
   - spec_authority_ingest_requires_evidence_files_exactly_matching_evidence_inventory
   - spec_authority_authority_outcome_evidence_refs_must_belong_to_authority_refs_or_evidence_inventory

package/contracts/audit-plan.schema.yaml

@@ -22,6 +22,8 @@ optional_top_level_fields:
   - app_slice_admission_ref
   - app_slice_admissions
   - audit_evidence_root_refs
+  - delegated_projection_admission_refs
+  - delegated_projection_admissions
   - package_authority_admission_refs
   - package_authority_admissions
   - evidence_inventory_hash
@@ -52,11 +54,20 @@ chunk_optional_fields:
   - authority_kind
   - app_id
   - package_authority_id
+  - delegated_projection_id
   - admission_ref
   - authority_root
+  - source_authority_root
   - evidence_root_admission_refs
   - admitted_evidence_roots
   - host_authority_projection_refs
+  - delegated_evidence_roots
+  - delegated_declared_evidence_prefixes
+  - delegated_declared_evidence_refs
+  - declared_evidence_delegation
+  - required_verification_commands
+  - declared_evidence_targets
+  - declared_evidence_unresolved
   - evidence_roots
   - evidence_inventory
   - coverage_contract
@@ -112,6 +123,10 @@ hard_constraints:
   - risk_budget_pause_must_not_mark_unresolved_findings_as_closed
   - risk_budget_pause_blocks_further_dispatch_until_remediation_bundle_or_manager_action
   - admitted_package_authority_projection_refs_must_be_explicitly_mapped
+  - delegated_projection_authority_must_be_explicitly_admitted
+  - delegated_declared_evidence_must_name_source_authority_boundary
+  - delegated_projection_is_audit_modeling_only_not_source_repo_execution
+  - delegated_projection_must_not_resolve_or_mutate_source_authority_refs
   - spec_authority_plans_must_materialize_full_evidence_inventory
   - spec_authority_chunks_must_assign_evidence_inventory_to_every_matching_authority_chunk
   - spec_authority_evidence_inventory_files_may_be_reused_across_chunks_without_creating_parallel_truth

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nimiplatform/nimi-coding",
-  "version": "0.2.6",
+  "version": "0.2.7",
   "private": false,
   "description": "AI-native coding governance toolkit for bootstrapping .nimi/** into arbitrary projects.",
   "license": "MIT",