@nimiplatform/nimi-coding 0.3.0 → 0.4.0

package/spec/authority-evidence.yaml

@@ -0,0 +1,200 @@
+version: 1
+spec:
+  id: nimicoding.authority-evidence.v1
+  owner: nimi-coding
+  status: active
+product_claim: one_stable_current_worktree_and_one_closed_project_binding_produce_exact_package_script_locator_and_declared_target_reachability_evidence_without_claiming_implementation_conformance_or_test_execution
+command: nimicoding authority evidence <repository-path> --bindings <tracked-.nimi/config-path> [--probe-results <.nimi/local-path>] --max-units <positive-safe-integer> --max-bindings <positive-safe-integer> --max-locators <positive-safe-integer> --max-edges <positive-safe-integer> --max-input-bytes <positive-safe-integer> --max-bytes <positive-safe-integer> [--json]
+surface:
+  primary_machine_product: JSON
+  human_output: concise_projection_of_the_same_logical_product
+  repository_selection: exact_current_non_bare_Git_worktree_root
+  repository_HEAD: one_resolvable_committed_full_OID_captured_once_as_non-semantic_context_with_unborn_HEAD_refused
+  authority_root: .nimi/spec
+inputs:
+  authority: complete_stably_captured_current_.nimi/spec_admitted_by_compileAuthorityPath
+  binding:
+    format: nimicoding.authority-evidence-bindings/v1
+    authority: package://@nimiplatform/nimi-coding/contracts/authority-evidence-bindings.schema.yaml
+    source: one_stably_captured_regular_non_symlink_project_owned_.nimi/config_file_with_one_exact_stage-zero_regular_Git_index_entry
+    required_bindings: non_empty_so_an_accidentally_emptied_required_surface_is_refused
+    product_authority: false
+  external_results:
+    format: nimicoding.authority-evidence-probe-results/v1
+    authority: package://@nimiplatform/nimi-coding/contracts/authority-evidence-probe-results.schema.yaml
+    source: optional_stably_captured_regular_non_symlink_.nimi/local_supplied_observation_file
+    execution_or_truth_attestation: not_claimed
+complete_input_boundary:
+  included:
+    - complete_.nimi/spec_inventory_paths_types_and_bytes
+    - exact_binding_bytes
+    - each_configured_manifest_path_type_and_bytes
+    - each_configured_command_target_path_type_and_bytes
+    - each_configured_test_target_path_type_and_bytes
+    - optional_external_result_bytes
+  repository_evidence_universe: binding_declared_paths_only
+  unbound_repository_files_inspected_or_proved_absent: false
+  path_escape_symlink_following_or_any_case-folded_.git_path_segment_access: forbidden
+  capture:
+    first: retain_exact_directory_and_file_handles_for_all_present_inputs_and_parent_directories_for_missing_inputs
+    second: recapture_complete_authority_inventory_binding_and_all_declared_repository_paths
+    commit: revalidate_all_held_paths_types_metadata_and_bytes
+    race: any_binding_authority_path_type_inventory_or_byte_change_refuses_the_whole_product
+  materialization: captured_authority_uses_one_isolated_temporary_directory_with_readback_validation_and_cleanup_after_success_or_failure
+binding:
+  exact_fields: [id, authority, probe, manifest, command, tests, external_probe]
+  authority_fields: [unit, scope]
+  authority_resolution: exact_active_rule_and_exact_declared_scope_member
+  probe: package-script-target-reachability/v1
+  manifest: safe_repository_relative_regular_JSON_file
+  command_fields: [script, target]
+  tests_fields: [script, targets]
+  test_targets: non_empty_unique_repository_relative_paths
+  external_probe: null_or_exact_id_version_required_declaration
+  semantics: project_owned_integration_locator_only
+  exact_authority_ref_proves_probe_predicate_equivalence: false
+  project_product_defaults_statement_condition_failure_or_conformance: forbidden
+package_owned_probe:
+  id: package-script-target-reachability/v1
+  version: 1
+  execution: deterministic_static_parse_on_captured_bytes_without_running_any_command
+  manifest_read:
+    document: one_valid_UTF-8_JSON_object_with_one_scripts_object
+    duplicate_or_invalid_JSON_structure: refused
+  admitted_command_script: node --import tsx <target>
+  admitted_test_script: pnpm exec vitest run <targets...>
+  grammar:
+    token_separator: one_ASCII_space
+    target_token_charset: ASCII_letters_digits_dot_underscore_hyphen_and_slash
+    target_order: exact_binding_order
+    inferred_alias_flag_glob_quote_shell_or_environment_semantics: forbidden
+  locators:
+    - authority_unit_and_scope_independent_SourceMap_locations
+    - manifest_file_and_exact_script_value_locations
+    - command_target_regular_file
+    - each_test_target_regular_file
+  graph_edges:
+    - authority_to_project_binding
+    - binding_to_manifest
+    - manifest_to_command_script
+    - command_script_to_command_target
+    - manifest_to_test_script
+    - test_script_to_each_test_target
+  graph_product: every_budgeted_edge_is_returned_as_one_explicit_per-binding_edge_record
+  graph_edge_status: [bound, reachable, missing, mismatch, indeterminate]
+  reachability:
+    reachable: exact_script_grammar_matches_the_binding_and_every_required_target_locator_exists_as_one_supported_regular_file
+    missing: exact_manifest_script_or_declared_target_is_absent
+    unsupported: present_input_cannot_be_decided_by_the_closed_static_grammar_or_supported_entry_types
+    basis: project_binding_plus_package_computed_exact_locator_resolution
+    runtime_call_graph_execution_test_result_or_behavioral_conformance: not_claimed
+    declared_target_existence: evaluated_independently_from_script_grammar_so_a_missing_target_is_never_hidden_by_an_unsupported_script
+external_probe_results:
+  identities_required: [authority_content_identity, repository_input_identity, binding_identity]
+  result_match: exact_binding_external_probe_ID_version_and_unique_result_item
+  output_state_mapping:
+    no_item: not_provided
+    completed_passed: [reported_completed, reported_passed]
+    completed_failed: [reported_completed, reported_failed]
+    failed: [reported_execution_failed, null]
+    unsupported: [reported_unsupported, null]
+  output_source: external_supplied
+  packageAttestation: false
+  required_not_provided_failed_unsupported_or_reported_failed: required_evidence_gap
+  optional_state: observation_only
+  malformed_extra_duplicate_unknown_or_identity_mismatch: refused_with_null_evidence
+  reported_pass_effect: satisfies_only_the_declared_supplied_observation_requirement
+  reported_pass_does_not_prove: [probe_execution, test_success, implementation_conformance, authority_satisfaction]
+identity:
+  format: sha256_colon_lowercase_hex
+  authority_content_identity:
+    domain: nimicoding.authority-snapshot-content/v1
+    inputs: complete_sorted_.nimi/spec_regular_file_paths_types_lengths_and_exact_bytes
+  repository_input_identity:
+    domain: nimicoding.repository-evidence-input/v1
+    inputs: sorted_unique_binding_declared_repository_paths_entry_state_type_exact_byte_length_and_bytes
+    missing_or_unsupported: explicit_framed_state_marker_without_following_or_inference
+    excludes: [authority_bytes, binding_bytes, external_result_bytes]
+  binding_identity:
+    domain: nimicoding.authority-evidence-binding/v1
+    inputs: exact_captured_binding_byte_length_and_bytes
+  excluded_from_all_semantic_identities: [absolute_repository_path, branch_name, mtime, ctime, inode, permissions, traversal_order, temporary_path]
+  external_result: excluded_from_input_identities_and_required_to_exact_match_all_three
+product:
+  format: nimicoding.authority-evidence/v1
+  top_level_fields: [format, operationStatus, evidenceStatus, complete, partial, conformanceStatus, identities, bindings, observations, findings, gaps, counts, budgets]
+  operationStatus: completed
+  evidenceStatus:
+    unavailable: at_least_one_required_package_computed_script_or_target_reachability_finding
+    indeterminate: no_required_reachability_finding_and_at_least_one_required_gap
+    available: no_required_reachability_finding_or_gap
+  complete: false_only_when_at_least_one_required_gap_exists
+  partial: false
+  conformanceStatus: not_evaluated
+  binding_record:
+    authority: exact_unit_scope_unit_location_and_independent_scopeLocation
+    packageProbe: package_computed_ID_version_and_execution_status
+    manifest: exact_path_script_locations_and_entry_state
+    command: exact_script_target_locations_and_reachability_state
+    tests: exact_script_target_locations_and_reachability_state
+    externalProbe: declared_requirement_reported_state_and_packageAttestation_false
+    edges: complete_explicit_5_plus_test_target_count_graph_with_source_target_basis_status_and_locations
+    obligationKeys:
+      consumer: exact_rule_ID_consumer_scope_tuple
+      test: exact_rule_ID_test_rule_ID_tuple
+  observation: declaration_existence_exact_script_shape_and_reachability_facts_only
+  finding:
+    code: AUTH_EVIDENCE_REQUIRED_TARGET_UNREACHABLE
+    basis: governance_bound_package_computed_exact_locator_reachability
+    claim: required_bound_script_or_target_locator_is_missing_not_that_implementation_violates_authority
+  gaps:
+    - required_binding_missing
+    - supported_static_probe_capability_unavailable
+    - required_external_probe_not_provided
+    - required_external_probe_reported_execution_failure
+    - required_external_probe_reported_unsupported
+    - required_external_probe_reported_failure
+  locations: repository_relative_with_exact_range_for_authority_manifest_script_and_present_target_witnesses
+  fingerprints:
+    algorithm: SHA-256_with_sha256_colon_prefix
+    inputs: stable_item_code_probe_version_binding_ID_authority_ID_scope_and_logical_target_IDs
+    excluded: [absolute_path, relative_path, range, message, repository_input_identity, external_adapter, policy]
+  ordering:
+    bindings: binding_ID
+    locators: logical_locator_ID
+    edges: [source, target, edge_ID]
+    observations_findings_gaps: [binding_ID, code, logical_target_ID]
+budgets:
+  required: [maxUnits, maxBindings, maxLocators, maxEdges, maxInputBytes, maxBytes]
+  values: positive_safe_integers
+  maxUnits: complete_admitted_authority_corpus_unit_count
+  maxBindings: distinct_union_of_required_and_configured_binding_IDs
+  maxLocators: all_logical_authority_manifest_script_command_target_and_test_target_locators_required_for_complete_output
+  maxEdges: all_explicitly_returned_declared_evidence_graph_edges_before_status_filtering
+  maxInputBytes: sum_of_all_captured_regular_authority_binding_manifest_target_and_external_result_bytes
+  maxBytes: UTF-8_bytes_of_compact_JSON.stringify_complete_evidence
+  overflow: AUTH_EVIDENCE_BUDGET_with_evidence_null_partial_false
+outcomes:
+  completed_available: evidence_present_complete_true_evidenceStatus_available_exit_0_without_conformance_claim
+  completed_unavailable: evidence_present_with_required_package_computed_finding_exit_1
+  completed_indeterminate: evidence_present_complete_false_with_required_gap_exit_1
+  refused: invalid_repository_corpus_binding_authority_reference_scope_manifest_JSON_result_identity_capture_or_budget_returns_evidence_null_partial_false_exit_1
+  usage_error: missing_repeated_unknown_or_invalid_CLI_argument_exit_2_without_evidence_product
+  failed: uncaught_IO_resource_or_internal_failure_exit_2_without_evidence_product
+  partial_or_truncated_output: forbidden
+anti_overclaim:
+  file_or_target_exists_means_conformance: false
+  exact_package_script_shape_means_command_executed: false
+  test_target_exists_means_test_executed_or_passed: false
+  external_reported_pass_means_package_attestation: false
+  reachability_label: declared_package_script_target_reachability_only
+  clean_verified_conforms_or_test_passed_language: forbidden
+boundaries:
+  writes_authority_repository_Git_index_or_project_files: false
+  arbitrary_shell_plugin_script_or_test_execution: forbidden
+  source_code_AST_universal_ontology_call_graph_or_semantic_inference: forbidden
+  canonical_grammar_kind_field_or_relation_change: none
+  durable_cache_database_history_receipt_or_ledger: none
+  SARIF_review_diff_impact_or_audit_aggregation: none
+  model_embedding_AI_remediation_UI_IDE_Studio_Atlas_or_release_orchestration: not_owned
+  public_AuthorityIR_or_SourceMap_export: none

package/spec/authority-graph.yaml

@@ -0,0 +1,59 @@
+version: 1
+spec:
+  id: nimicoding.authority-graph.v1
+  owner: nimi-coding
+  status: active
+product_claim: complete_admitted_private_compiler_snapshot_supports_bounded_direct_refs_exact_path_and_local_subgraph
+source: one_complete_package_private_AuthorityIR_and_SourceMap_compile_per_command
+commands:
+  refs: nimicoding authority refs <path> <id> --direction <incoming|outgoing|both> --relations <closed-set> --max-units <positive-safe-integer> --max-edges <positive-safe-integer> --max-bytes <positive-safe-integer> [--json]
+  path: nimicoding authority path <path> <from-id> <to-id> --traversal <directed|incidence> --relations <closed-set> --max-hops <positive-safe-integer> --max-units <positive-safe-integer> --max-edges <positive-safe-integer> --max-bytes <positive-safe-integer> [--json]
+  subgraph: nimicoding authority subgraph <path> <id> --direction <incoming|outgoing|both> --relations <closed-set> --depth <positive-safe-integer> --max-units <positive-safe-integer> --max-edges <positive-safe-integer> --max-bytes <positive-safe-integer> [--json]
+relations:
+  admitted: [applies_to, supersedes]
+  request: explicit_non_empty_unique_closed_set
+  defaults_or_all_alias: forbidden
+product:
+  format: nimicoding.authority-graph/v1
+  shared_fields: [format, operation, query, complete, nodes, edges, policy, counts, budgets]
+  path_fields: [found, steps]
+  node_fields: [id, kind, owner, lifecycle, scope, location]
+  definition_or_removed_scope: []
+  edge_fields: [source, type, target, sourceLocation, relationLocation, targetLocation]
+  location_fields: [file, range, sourcePointer]
+  semantic_prose_or_raw_AuthorityIR: excluded
+ordering:
+  nodes: lexical_ID
+  edges: [source, type, target]
+  comparator: portable_lexical_comparator
+traversal:
+  refs: direct_only_with_each_authored_edge_once
+  path_directed: authored_source_to_target_only
+  path_incidence: forward_or_reverse_steps_while_edges_remain_canonical_authored_source_to_target
+  reverse_step_claim: topology_incidence_only_not_semantic_dependency
+  path_selection: minimum_hops_then_lexical_minimum_complete_step_tuple_sequence
+  path_step_tuple: [relation_type, traversal, authored_source, authored_target]
+  subgraph: deterministic_cycle_safe_BFS_returning_complete_selected_graph_within_depth
+budgets:
+  required_all: [max_units, max_edges, max_bytes]
+  path_also_requires: max_hops
+  subgraph_also_requires: depth
+  units_and_edges: constrain_complete_traversal_proof_not_only_returned_witness
+  bytes: UTF-8_bytes_of_compact_JSON.stringify_graph
+  overflow: AUTH_GRAPH_BUDGET_with_null_graph_and_partial_false
+outcomes:
+  completed: includes_complete_no_path_with_found_false
+  usage_error: invalid_or_missing_CLI_arguments_exit_2_without_graph_product
+  refused: parsed_invocation_with_invalid_corpus_unknown_ID_or_insufficient_budget
+  failed: IO_resource_or_internal_failure
+  unknown_ID: AUTH_QUERY_NOT_FOUND
+  partial_or_truncated_graph: forbidden
+locations:
+  paths: input_root_relative_portable_paths_when_inside_input_root
+  semantics: preserve_SourceMap_range_and_sourcePointer
+  relocation: equivalent_relocated_corpus_has_stable_logical_graph_and_relative_locations
+boundaries:
+  read_only: true
+  durable_graph_cache_or_database: none
+  public_JS_exports: none
+  new_grammar_relation_or_inferred_prose_relation: forbidden

package/spec/authority-impact.yaml

@@ -0,0 +1,84 @@
+version: 1
+spec:
+  id: nimicoding.authority-impact.v1
+  owner: nimi-coding
+  status: active
+product_claim: compare_admitted_compiler_outputs_and_report_declared_review_obligations_without_claiming_sync_or_completion
+commands:
+  diff: nimicoding authority diff <before-path> <after-path> --max-bytes <positive-integer> [--json]
+  impact: nimicoding authority impact <before-path> <after-path> --dispositions <file> --max-bytes <positive-integer> [--json]
+diff:
+  source: two_independently_admitted_compiler_outputs
+  format: nimicoding.authority-diff/v1
+  top_level_fields: [format, changes, summary]
+  summary_fields: [units, changes]
+  record:
+    required_fields: [unitId, operation, pointer, before, after]
+    optional_fields: [beforeSource, afterSource]
+    operation_enum:
+      unit_added: complete_after_unit
+      modified: scalar_field_before_and_after
+      added: scope_value_or_relation_added
+      removed: scope_value_or_relation_removed
+    source_record_fields: [file, range, sourcePointer]
+    range_fields: [start, end]
+    position_fields: [line, column]
+  unit_removed_operation: forbidden
+  physical_unit_deletion: AUTH_DIFF_TRANSITION_INVALID
+  retirement: active_unit_is_replaced_by_a_valid_same_ID_same_kind_removed_tombstone
+  tombstone_retention: removed_unit_remains_present_until_a_separately_admitted_reserved_ID_mechanism_exists
+  pure_profile_format_file_rename_unit_order_or_container_regroup_change: empty
+  ordering: [unit_ID, JSON_pointer, operation, values]
+  traceability: changed_values_reference_before_and_or_after_SourceMap
+  invalid_input_diagnostics:
+    path_identity: before_or_after_prefix_plus_input_root_relative_path
+    related_paths: same_side_prefix_and_relative_normalization
+    ordering: global_diagnostic_order_after_normalization
+    relocated_equivalent_inputs: byte_identical_JSON
+  byte_budget:
+    scope: semantic_diff_only_not_complete_CLI_report_or_compiler_diagnostics
+    measure: UTF-8_bytes_of_compact_JSON_stringify_diff
+    overflow: AUTH_DIFF_BUDGET
+    result: {diff: null, partial: false}
+impact:
+  format: nimicoding.authority-impact/v1
+  top_level_fields: [format, changedUnits, impactedUnits, obligations, complete]
+  impacted_unit_fields: [id, kind]
+  obligation_fields: [ruleId, type, target, disposition]
+  disposition_fields_when_addressed: [ruleId, type, target, status, evidence]
+  roots: normative_governance_definition_rule_graph_changes; non_normative_metadata_diff_is_reported_but_creates_no_obligation
+  direction: reverse_declared_relations_from_changed_units_to_dependents
+  relation_categories: [applies_to, supersedes]
+  unrelated_units: excluded
+  active_rule_obligations:
+    consumer: union_of_before_and_after_declared_scope
+    test: one_explicit_evidence_disposition_per_impacted_active_rule
+  missing_disposition: AUTH_IMPACT_UNDISPOSED
+  complete: every_required_declared_obligation_has_exact_addressed_evidence
+  proof_boundary: does_not_prove_implementation_consumer_or_test_synchronization
+  partial_success: false
+  failure_report: may_list_complete_impacted_units_and_unresolved_obligations_with_ok_false
+  byte_budget:
+    scope: semantic_diff_and_impact_only_not_complete_CLI_report_or_compiler_diagnostics
+    measure: UTF-8_bytes_of_compact_JSON_stringify_object_containing_diff_and_impact
+    overflow: AUTH_IMPACT_BUDGET
+    result: {diff: null, impact: null, partial: false}
+dispositions:
+  format: nimicoding.authority-impact-dispositions/v1
+  authority: package://@nimiplatform/nimi-coding/contracts/authority-impact-dispositions.schema.yaml
+  status: addressed
+  evidence: explicit_non_empty_text
+  inference: forbidden
+fail_closed:
+  invalid_before_or_after_authority: compiler_diagnostics
+  identity_reuse_kind_change_or_physical_deletion: AUTH_DIFF_TRANSITION_INVALID_or_compiler_identity_diagnostics
+  dangling_relation_or_illegal_lifecycle: compiler_diagnostics
+  malformed_or_extra_disposition: AUTH_IMPACT_DISPOSITION_INVALID
+  missing_or_invalid_max_bytes: CLI_usage_failure
+boundaries:
+  writes_authority: false
+  durable_artifacts: none
+  git_interpretation: none
+  natural_language_contradiction_detection: not_claimed
+  implementation_consumer_test_sync_proof: not_admitted
+  storage_search_embedding_visualization_AI_execution_Atlas: not_admitted

package/spec/authority-review.yaml

@@ -0,0 +1,89 @@
+version: 1
+spec:
+  id: nimicoding.authority-review.v1
+  owner: nimi-coding
+  status: active
+product_claim: one_explicit_Git_base_commit_and_one_stable_current_worktree_produce_an_exact_read_only_change_review_over_complete_canonical_snapshots
+command: nimicoding authority review <repository-path> --base <git-ref> --bindings <file> --dispositions <file> --max-units <positive-safe-integer> --max-edges <positive-safe-integer> --max-bytes <positive-safe-integer> [--json]
+capture:
+  repository: exact_non_bare_Git_worktree_root
+  base_ref:
+    resolution: once_at_capture_start_to_immutable_full_commit_OID
+    later_use: full_OID_only
+    option_injection: refused
+  base_authority:
+    source: Git_object_database
+    root: .nimi/spec_tree_required
+    inventory: all_nested_tree_and_leaf_entries_without_suffix_filtering
+    admitted_entry_types: [tree, regular_blob_100644_or_100755]
+    refused: [symlink_blob, gitlink, unknown_mode_or_type, invalid_UTF-8_path, path_escape, duplicate_path, missing_object]
+  worktree_authority:
+    source: complete_live_filesystem_inventory_under_.nimi/spec
+    includes: [tracked_unchanged, tracked_modification, tracked_deletion, untracked_or_ignored_file, unsupported_regular_file]
+    refused: [missing_root, symlink, non_regular_entry, invalid_UTF-8_path, path_escape]
+    stability: retain_exact_directory_and_file_handles_while_capturing_paths_types_bytes_and_metadata_then_recapture_complete_live_inventory_and_revalidate_all_held_handles_at_capture_commit
+    race: any_path_type_byte_or_stability_metadata_change_refuses_the_whole_capture
+  materialization:
+    location: independent_0700_temporary_directory
+    isolation: physical_temporary_root_must_be_outside_worktree_and_Git_administration_roots_before_any_directory_is_created_and_is_rechecked_after_creation
+    validation: readback_paths_types_and_bytes_must_match_capture
+    cleanup: required_after_success_or_failure
+  Git_mutation: [checkout, stash, reset, stage, commit, branch_update, worktree_update, index_update]
+  Git_mutation_posture: forbidden
+snapshot_identity:
+  format: sha256_colon_lowercase_hex
+  domain: nimicoding.authority-snapshot-content/v1
+  inputs: sorted_repository_relative_regular_file_paths_entry_type_exact_byte_length_and_bytes
+  excludes: [base_ref_name, commit_OID, executable_bit, permissions, mtime, ctime, inode, absolute_path, temporary_path, traversal_order]
+  result:
+    base: [commitOid, contentIdentity, file_count, unit_count, byte_count]
+    worktree: [contentIdentity, file_count, unit_count, byte_count]
+oracles:
+  admission_and_counts: compileAuthorityPath_on_each_materialized_snapshot
+  semantic_delta: diffAuthorityPaths
+  declared_impact: impactAuthorityPaths
+  current_governance: auditAuthorityPath_on_worktree_snapshot_only
+  copied_Git_parser_IR_graph_diff_or_detector: forbidden
+product:
+  format: nimicoding.authority-review/v1
+  top_level_fields: [format, operationStatus, policyStatus, complete, partial, snapshots, components, diff, impact, audit, budgets]
+  operationStatus: completed
+  policyStatus:
+    blocked: current_audit_has_a_blocking_finding
+    indeterminate: no_blocking_finding_and_impact_or_audit_coverage_is_incomplete
+    passed: review_is_complete_and_current_audit_policy_passed
+  complete: impact_complete_and_audit_complete_independent_of_blocking_policy
+  partial: false
+  components: [snapshots, diff, impact, audit]
+  component_fields: [operationStatus, complete]
+  logical_products:
+    diff: nimicoding.authority-diff/v1
+    impact: nimicoding.authority-impact/v1
+    audit: nimicoding.authority-audit/v1
+  audit_claim: current_snapshot_only_without_before_after_finding_attribution
+budgets:
+  required: [maxUnits, maxEdges, maxBytes]
+  values: positive_safe_integers
+  units_and_edges: existing_audit_proof_traversal_semantics
+  component_bytes: same_explicit_maxBytes_passed_to_diff_impact_and_audit
+  review_bytes: UTF-8_bytes_of_compact_JSON.stringify_complete_review
+  overflow: AUTH_REVIEW_BUDGET_or_existing_component_budget_with_review_null_and_partial_false
+outcomes:
+  completed_passed: review_present_complete_true_policy_passed_exit_0
+  completed_blocked: review_present_policy_blocked_exit_1
+  completed_incomplete: review_present_complete_false_exit_1
+  refused: invalid_Git_corpus_binding_disposition_capture_transition_or_budget_returns_review_null_partial_false_exit_1
+  usage_error: missing_repeated_or_invalid_CLI_argument_exit_2_without_review_product
+  failed: uncaught_IO_resource_or_internal_failure_exit_2_without_review_product
+  unresolved_impact: only_AUTH_IMPACT_UNDISPOSED_preserves_complete_logical_review_with_complete_false
+  invalid_disposition: any_AUTH_IMPACT_DISPOSITION_INVALID_refuses_whole_review
+  required_audit_gap: preserves_complete_logical_review_with_complete_false
+  blocking_finding: preserves_complete_logical_review_without_claiming_finding_was_introduced_by_change
+boundaries:
+  writes_authority_or_project_files: false
+  durable_cache_database_history_or_receipt: none
+  SARIF_review_aggregation: none
+  heuristic_rename_split_merge_semantics: forbidden
+  PR_branch_policy_approval_comment_commit_release_or_task_orchestration: not_owned
+  arbitrary_shell_plugin_test_model_embedding_or_semantic_search_execution: forbidden
+  public_AuthorityIR_or_SourceMap_export: none

package/spec/authority-terms.yaml

@@ -0,0 +1,59 @@
+version: 1
+spec:
+  id: nimicoding.authority-terms.v1
+  owner: nimi-coding
+  status: active
+product_claim: bounded_static_index_of_the_identifiers_the_active_authority_corpus_uses_and_optionally_where_one_exact_identifier_appears_in_tracked_text
+command: nimicoding authority terms <repository-path> --spec <corpus-path> [--term <t>] [--code] --max-units <positive-safe-integer> --max-terms <positive-safe-integer> --max-bytes <positive-safe-integer> [--json]
+surface:
+  report_format: nimicoding.authority-terms/v1
+  corpus_root: repository_authority_corpus_only
+  boolean_flags: [json, code]
+  value_flags: [spec, term]
+  integer_flags: [max-units, max-terms, max-bytes]
+  repeatable_flags: []
+  findings_change_exit_code: false
+inputs:
+  repository:
+    shape: exact_non_symlink_Git_worktree_root
+    tracked_files: one_complete_git_ls_files_cached_NUL_inventory
+    writes_or_execution: forbidden
+  corpus:
+    root: exact_repository_relative_.nimi/spec_resolved_realpath
+    units: active_only
+    fields: [title, meaning, statement, condition, failure]
+  term:
+    required_for_code: true
+    admission: must_be_one_exact_term_the_closed_lexical_grammar_admits
+lexical_grammar:
+  classes: [snake_case, camelCase, UPPER_SNAKE, PascalCase, dotted]
+  boundaries: ASCII_identifier_boundaries_required
+  excluded: terms_inside_longer_path_like_tokens_containing_a_slash
+  dotted_exclusion: final_segments_that_are_known_code_extensions
+code_inventory:
+  shape: tracked_text_inventory_v1
+  selection: by_decoded_content_never_by_an_extension_allowlist
+  rationale: a_fixed_extension_list_silently_dropped_whole_languages_while_the_report_claimed_complete
+  binary_detection: NUL_byte_or_undecodable_UTF_8_prefix_probe
+  probe_decoder: one_fresh_decoder_per_file_so_a_straddling_character_cannot_reject_the_next_file
+  exclusions:
+    every_excluded_file_reported: true
+    reasons: [authority-corpus, binary-content, not-utf8]
+    silent_exclusion: forbidden
+  accounting: tracked_files_equals_scanned_files_plus_excluded_files
+budgets:
+  max_units: complete_active_unit_set_must_fit
+  max_terms: complete_distinct_term_set_must_fit
+  max_bytes: inputBytes_complete_decoded_authority_and_optional_code_input_must_fit
+  exceeded: refuse_with_one_diagnostic_and_no_partial_index_or_cross_reference
+result:
+  trackedPathSetDigest: sha256_hex_of_nimicoding.repository-inventory/v1_canonical_tracked_path_set_preimage
+  complete: true_only_when_every_admitted_input_was_read_and_classified
+  byte_counts:
+    scannedBytes: selected_normative_authority_fields_plus_optional_decoded_code_inputs
+    inputBytes: complete_decoded_authority_corpus_plus_optional_decoded_code_inputs
+  partial: never
+  modes: [index, detail]
+  detail_fields: [term, classes, unitCount, units, code, codeReferences, codeInventory]
+  findings_change_exit_code: false
+  determinism: identical_inputs_produce_byte_identical_output

package/spec/product-scope.yaml

@@ -1,27 +1,40 @@
-version: 3
+version: 7
 product:
   package_name: "@nimiplatform/nimi-coding"
-  mission: methodology_spec_construction_and_deterministic_validation
+  mission: canonical_authority_methodology_formatter_compiler_primitives_and_deterministic_gates
 owned_surfaces:
-  - bootstrap_and_sync_of_managed_.nimi_projections
-  - methodology_principles
-  - spec_surface_taxonomy_and_placement_contracts
-  - spec_construction_inputs_and_generation_audit_contracts
-  - deterministic_spec_governance_and_ai_governance_checks
+  - compact_authority_authoring_methodology
+  - exact_authority_guide_projection_and_managed_instruction_blocks
+  - canonical_authority_format_and_complete_root_check
+  - private_compile_bounded_filtered_lexical_discovery_with_field_snippets_optional_direct_authored_relation_preview_exact_query_and_declared_outgoing_context
+  - semantic_diff_and_declared_review_impact
+  - bounded_direct_references_exact_relation_paths_and_local_subgraphs
+  - project_bound_deterministic_authority_audit_and_SARIF_projection
+  - git_aware_exact_read_only_authority_change_review
+  - stable_current_worktree_authority_to_package_script_target_evidence
+  - optional_L3_repository_governance_not_authority_admission
+canonical_boundary:
+  host_product_authority: .nimi/spec/**/*.authority.{yaml,md}
+  sole_conformance_gate: nimicoding_authority_check_complete_.nimi/spec
+  historical_format_inference: forbidden
+  product_semantic_generation: forbidden
+surface_separation:
+  public: [documented_CLI, package_documentation]
+  canonical_project_owned: .nimi/spec/**/*.authority.{yaml,md}
+  projected_AI_visible_package_owned: [.nimi/methodology/authority-authoring.yaml, AGENTS.md#managed-block, CLAUDE.md#managed-block]
+  local_non_authority: .nimi/local/**
+  package_internal: [authority_grammar_contracts, AuthorityIR, SourceMap, compiler_implementation]
 out_of_scope:
-  - planning_or_task_lifecycle
-  - agent_or_provider_orchestration
-  - implementation_execution
-  - review_approval_or_completion_state
-  - host_prompt_or_context_management
-  - scheduling_notifications_and_automation
-integration_contract:
-  host_owns_execution: true
-  nimi_coding_may_emit_non_mutating_analysis: true
-  nimi_coding_may_validate_declared_artifacts: true
-  nimi_coding_must_not_create_host_execution_state: true
-canonical_roots:
-  package_authority: package://@nimiplatform/nimi-coding
-  host_product_authority: .nimi/spec
-  managed_projection_roots: [.nimi/config, .nimi/contracts, .nimi/methodology]
-  local_non_authority_root: .nimi/local
+  - reconstruction_taxonomy_tables_guidance_registries_and_generation_audits
+  - profile_specific_authority_validation
+  - planning_task_lifecycle_delegation_execution_review_or_approval
+  - host_workflow_command_aggregation
+  - sqlite_cache_incremental_embedding_semantic_search_visualization_AI_execution_or_Atlas
+claims:
+  discovery: bounded_deterministic_exact_filtered_lexical_candidates_with_SourceMapped_field_snippets_and_optional_M1_direct_authored_relation_preview_not_semantic_search_selection_context_or_absence_proof
+  context: complete_declared_outgoing_interpretation_closure_not_complete_task_context
+  impact: declared_review_obligation_not_sync_or_completion_proof
+  graph: complete_bounded_explicit_relation_navigation_not_semantic_inference_or_raw_IR
+  audit: governance_bound_verifier_results_not_prose_predicate_inference_or_plugin_execution
+  review: immutable_base_OID_and_stable_worktree_exact_snapshots_composed_through_existing_compiler_diff_impact_and_current_audit_oracles
+  evidence: exact_identity_bound_package_script_target_reachability_and_external_supplied_observations_not_command_execution_test_success_runtime_reachability_or_conformance_attestation

package/cli/commands/blueprint-audit.mjs

@@ -1,91 +0,0 @@
-import {
-  buildBlueprintAuditPayload,
-  formatBlueprintAuditPayload,
-  writeBlueprintAuditArtifact,
-} from "../lib/shared.mjs";
-import { localize } from "../lib/ui.mjs";
-
-function parseBlueprintAuditOptions(args) {
-  const options = {
-    json: false,
-    writeLocal: false,
-    blueprintRoot: null,
-    canonicalRoot: null,
-  };
-
-  for (let index = 0; index < args.length; index += 1) {
-    const arg = args[index];
-
-    if (arg === "--json") {
-      options.json = true;
-      continue;
-    }
-
-    if (arg === "--write-local") {
-      options.writeLocal = true;
-      continue;
-    }
-
-    if (arg === "--blueprint-root" || arg === "--canonical-root") {
-      const next = args[index + 1];
-      if (!next || next.startsWith("--")) {
-        return {
-          ok: false,
-          error: `${localize(
-            `nimicoding blueprint-audit refused: ${arg} requires a value.`,
-            `nimicoding blueprint-audit 已拒绝：${arg} 需要一个值。`,
-          )}\n`,
-        };
-      }
-
-      if (arg === "--blueprint-root") {
-        options.blueprintRoot = next;
-      } else {
-        options.canonicalRoot = next;
-      }
-      index += 1;
-      continue;
-    }
-
-    return {
-      ok: false,
-      error: `${localize(
-        `nimicoding blueprint-audit refused: unknown option ${arg}.`,
-        `nimicoding blueprint-audit 已拒绝：未知选项 ${arg}。`,
-      )}\n`,
-    };
-  }
-
-  return {
-    ok: true,
-    options,
-  };
-}
-
-export async function runBlueprintAudit(args) {
-  const parsed = parseBlueprintAuditOptions(args);
-  if (!parsed.ok) {
-    process.stderr.write(parsed.error);
-    return 2;
-  }
-
-  const payload = await buildBlueprintAuditPayload(process.cwd(), parsed.options);
-  if (payload.inputError) {
-    process.stderr.write(payload.error);
-    return payload.exitCode;
-  }
-
-  if (parsed.options.writeLocal) {
-    await writeBlueprintAuditArtifact(process.cwd(), payload);
-  }
-
-  if (parsed.options.json) {
-    process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
-  } else {
-    process.stdout.write(formatBlueprintAuditPayload(payload));
-  }
-
-  return payload.exitCode;
-}
-
-export { parseBlueprintAuditOptions };

package/cli/commands/classify-spec-tree.mjs

@@ -1,5 +0,0 @@
-import { runSurfaceValidatorCommand } from "./surface-validator-command.mjs";
-
-export function runClassifySpecTree(args) {
-  return runSurfaceValidatorCommand(args, "classify-spec-tree");
-}