@nimiplatform/nimi-coding 0.4.0 → 0.6.0

package/cli/lib/code/response.mjs

@@ -0,0 +1,165 @@
+import { Buffer } from "node:buffer";
+
+export const CODE_CONTEXT_FORMAT = "nimicoding.code-context-response/v1";
+export const MIN_CODE_CONTEXT_BYTES = 512;
+
+const MAX_ERROR_MESSAGE_BYTES = 160;
+
+function serialized(value) {
+  return JSON.stringify(value);
+}
+
+function serializedBytes(value) {
+  return Buffer.byteLength(value, "utf8");
+}
+
+function prefixByteLengths(fragments) {
+  const totals = [0];
+  for (const fragment of fragments) {
+    totals.push(totals.at(-1) + serializedBytes(fragment));
+  }
+  return totals;
+}
+
+function arrayBytes(prefixTotals, count) {
+  return 2 + prefixTotals[count] + Math.max(0, count - 1);
+}
+
+function arrayText(fragments, count) {
+  return `[${fragments.slice(0, count).join(",")}]`;
+}
+
+export function refusedCodeResponse(code, message) {
+  if (Buffer.byteLength(message, "utf8") > MAX_ERROR_MESSAGE_BYTES) {
+    throw new Error("code response error message exceeds its fixed protocol bound");
+  }
+  return {
+    format: CODE_CONTEXT_FORMAT,
+    status: "refused",
+    scope: null,
+    coverage: null,
+    missing_frontier: null,
+    result: null,
+    error: { code, message },
+  };
+}
+
+export function serializeCodeResponse(response) {
+  return `${serialized(response)}\n`;
+}
+
+function targetCountsBySemanticPrefix(targets, semanticItems) {
+  const known = new Set();
+  const counts = [0];
+  for (const item of semanticItems) {
+    if (item.target_id !== undefined && item.target_id !== null) known.add(item.target_id);
+    counts.push(known.size);
+  }
+  if (known.size !== targets.length) throw new Error("semantic projection contains an unused target descriptor");
+  return counts;
+}
+
+function responseParts({ scopeText, rootText, targetFragments, semanticFragments, sourceFragments }, state) {
+  const coverage = {
+    semantic_items: state.semanticCount === semanticFragments.length ? "complete" : "truncated",
+    source_units: state.sourceCount === sourceFragments.length ? "complete" : "truncated",
+  };
+  const complete = state.semanticCount === semanticFragments.length && state.sourceCount === sourceFragments.length;
+  const frontier = complete ? null : {
+    next_semantic_site: state.nextSemanticSite,
+    next_source_target: state.nextSourceTarget,
+  };
+  if (!complete && frontier.next_semantic_site === null && frontier.next_source_target === null) {
+    throw new Error("partial code response has no missing frontier");
+  }
+  const head = [
+    `{"format":${serialized(CODE_CONTEXT_FORMAT)}`,
+    `,"status":${serialized(complete ? "completed" : "partial")}`,
+    `,"scope":${scopeText}`,
+    `,"coverage":${serialized(coverage)}`,
+    `,"missing_frontier":${serialized(frontier)}`,
+    `,"result":{"root":${rootText},"targets":`,
+  ].join("");
+  return {
+    head,
+    betweenTargetsAndSemantic: ",\"semantic_items\":",
+    betweenSemanticAndSources: ",\"source_units\":",
+    tail: "},\"error\":null}\n",
+  };
+}
+
+function codeResponseBytes(parts, targetBytes, semanticBytes, sourceBytes, state) {
+  return serializedBytes(parts.head)
+    + arrayBytes(targetBytes, state.targetCount)
+    + serializedBytes(parts.betweenTargetsAndSemantic)
+    + arrayBytes(semanticBytes, state.semanticCount)
+    + serializedBytes(parts.betweenSemanticAndSources)
+    + arrayBytes(sourceBytes, state.sourceCount)
+    + serializedBytes(parts.tail);
+}
+
+function stateForPrefix({ targets, semanticItems, sourceUnits, targetCounts }, prefix) {
+  const semanticCount = Math.min(prefix, semanticItems.length);
+  const sourceCount = prefix <= semanticItems.length ? 0 : prefix - semanticItems.length;
+  const targetCount = targetCounts[semanticCount];
+  const nextSemantic = semanticItems[semanticCount];
+  let nextSourceTarget = null;
+  if (semanticCount === semanticItems.length) {
+    nextSourceTarget = sourceUnits[sourceCount]?.target_id ?? null;
+  } else if (sourceUnits.length > 0) {
+    const targetIndex = targets.findIndex((target) => target.id === sourceUnits[0].target_id);
+    if (targetIndex >= 0 && targetIndex < targetCount) nextSourceTarget = sourceUnits[0].target_id;
+  }
+  return {
+    semanticCount,
+    sourceCount,
+    targetCount,
+    nextSemanticSite: nextSemantic === undefined ? null : {
+      line: nextSemantic.site.range.start_line,
+      column: nextSemantic.site.range.start_column,
+    },
+    nextSourceTarget,
+  };
+}
+
+export function renderContextResponse({ scope, projection, maxBytes }) {
+  const scopeText = serialized(scope);
+  const rootText = serialized(projection.root);
+  const targetFragments = projection.targets.map(serialized);
+  const semanticFragments = projection.semanticItems.map(serialized);
+  const sourceFragments = projection.sourceUnits.map(serialized);
+  const targetBytes = prefixByteLengths(targetFragments);
+  const semanticBytes = prefixByteLengths(semanticFragments);
+  const sourceBytes = prefixByteLengths(sourceFragments);
+  const targetCounts = targetCountsBySemanticPrefix(projection.targets, projection.semanticItems);
+  const totalItems = semanticFragments.length + sourceFragments.length;
+  let selected = null;
+
+  for (let prefix = 0; prefix <= totalItems; prefix += 1) {
+    const state = stateForPrefix({
+      targets: projection.targets,
+      semanticItems: projection.semanticItems,
+      sourceUnits: projection.sourceUnits,
+      targetCounts,
+    }, prefix);
+    const parts = responseParts({ scopeText, rootText, targetFragments, semanticFragments, sourceFragments }, state);
+    const bytes = codeResponseBytes(parts, targetBytes, semanticBytes, sourceBytes, state);
+    if (bytes <= maxBytes) selected = { state, parts, bytes };
+  }
+
+  if (selected === null) return null;
+  const { state, parts, bytes } = selected;
+  const text = [
+    parts.head,
+    arrayText(targetFragments, state.targetCount),
+    parts.betweenTargetsAndSemantic,
+    arrayText(semanticFragments, state.semanticCount),
+    parts.betweenSemanticAndSources,
+    arrayText(sourceFragments, state.sourceCount),
+    parts.tail,
+  ].join("");
+  if (serializedBytes(text) !== bytes || bytes > maxBytes) {
+    throw new Error("code response renderer byte accounting is inconsistent");
+  }
+  return { text, bytes, status: state.semanticCount === semanticFragments.length && state.sourceCount === sourceFragments.length ? "completed" : "partial" };
+}

package/cli/lib/doctor.mjs

@@ -1,6 +1,7 @@
 import { readdir } from "node:fs/promises";
 import path from "node:path";
 
+import { PROJECT_LOCAL_CLI_INVOCATION } from "../constants.mjs";
 import { getBootstrapSeedEntries } from "../seeds/bootstrap.mjs";
 import { pathExists, preflightManagedProjectPaths } from "./fs-helpers.mjs";
 import { runSeedSync, SYNC_MODE } from "./sync.mjs";
@@ -34,7 +35,7 @@ export async function inspectDoctorState(projectRoot) {
       true,
       "info",
       specPresent
-        ? "canonical authority is present; run nimicoding authority check .nimi/spec for admission"
+        ? `canonical authority is present; run ${PROJECT_LOCAL_CLI_INVOCATION} authority check .nimi/spec for admission`
         : "canonical authority has not been authored; the project owns all product semantics under .nimi/spec",
     ),
   ];
@@ -74,7 +75,7 @@ export function formatDoctorResult(result, options = {}) {
   if (visible.length === 0) lines.push(`  - ${localize("No blocking integration issues found.", "没有发现阻塞性的集成问题。")}`);
   else for (const entry of visible) lines.push(`  - [${entry.ok ? "info" : entry.severity}] ${entry.detail}`);
   if (!result.spec.present) {
-    lines.push("", styleLabel(localize("Next:", "下一步：")), "  - Author canonical authority under .nimi/spec, format changed files, then run nimicoding authority check .nimi/spec.");
+    lines.push("", styleLabel(localize("Next:", "下一步：")), `  - Author canonical authority under .nimi/spec, format changed files, then run ${PROJECT_LOCAL_CLI_INVOCATION} authority check .nimi/spec.`);
   }
   return `${lines.join("\n")}\n`;
 }

package/cli/lib/entrypoints.mjs

@@ -6,6 +6,7 @@ import {
   AGENTS_END,
   CLAUDE_BEGIN,
   CLAUDE_END,
+  PROJECT_LOCAL_CLI_INVOCATION,
 } from "../constants.mjs";
 import { pathExists, preflightManagedProjectPaths, readUtf8FileFatal } from "./fs-helpers.mjs";
 
@@ -18,14 +19,21 @@ export class ManagedBlockError extends Error {
 
 function authorityAuthoringLines() {
   return [
+    `- From the repository root, invoke the pinned project-local CLI as \`${PROJECT_LOCAL_CLI_INVOCATION}\`; do not probe or rely on a global \`nimicoding\` binary in \`PATH\`.`,
     "- Product authority lives under `.nimi/spec/**`.",
     "- For canonical authority authoring, read only `.nimi/methodology/authority-authoring.yaml`, the affected authority files or bounded task context, and CLI diagnostics.",
-    "- Use `nimicoding authority context <path> <id> --max-units <n> --max-bytes <n> --json` only for the complete declared outgoing interpretation closure; it is not complete task context, and failure never permits guessed or partial context.",
-    "- Use `nimicoding authority diff` and `authority impact` with explicit `--max-bytes`; impact reports declared review obligations and does not prove implementation, consumers, or tests are synchronized.",
+    `- Use \`${PROJECT_LOCAL_CLI_INVOCATION} authority context <path> <id> --max-units <n> --max-bytes <n> --json\` only for the complete declared outgoing interpretation closure; it is not complete task context, and failure never permits guessed or partial context.`,
+    `- Use \`${PROJECT_LOCAL_CLI_INVOCATION} authority diff\` and \`${PROJECT_LOCAL_CLI_INVOCATION} authority impact\` with explicit \`--max-bytes\`; impact reports declared review obligations and does not prove implementation, consumers, or tests are synchronized.`,
+    `- Use \`${PROJECT_LOCAL_CLI_INVOCATION} authority change-candidates\` only with explicit channels and budgets; its complete union is recall input, never conflict, retirement, absence, authority, or conformance judgment.`,
+    `- For implementation audits with an exact authority ID, use \`${PROJECT_LOCAL_CLI_INVOCATION} code authority --repo <root> --authority <id> --max-files <n> --max-bytes <n>\` to locate annotated code, and use \`--source <path>\` for code-to-authority lookup. Results cover only explicit markers and authority lifecycle; they do not prove implementation conformance or evaluate unannotated code.`,
+    `- For a new or changed authority-governed feature, add \`// nimi-authority: <exact-id>\` only at the small number of key semantic owner files or declarations. Multiple markers are allowed; do not blanket-annotate mechanical helpers or tests.`,
+    `- Use \`// nimi-deprecated: <exact-id>\` only after direct authority evidence or a real product failure confirms obsolete semantics; find it with \`${PROJECT_LOCAL_CLI_INVOCATION} code authority --repo <root> --audit --max-files <n> --max-bytes <n>\` and remove the marker with the hard cut.`,
+    `- After selecting an explicit TypeScript or TSX consumer, use \`${PROJECT_LOCAL_CLI_INVOCATION} code context <path> --repo <root> --symbol <identifier> --tsconfig <path> --max-bytes <n>\` for bounded root-direct static dependencies; it is not inbound impact, runtime dispatch, or complete task context.`,
+    `- Use \`${PROJECT_LOCAL_CLI_INVOCATION} sync --check\` to diagnose drift in package-owned managed projections, \`${PROJECT_LOCAL_CLI_INVOCATION} sync --apply\` to restore them, and \`${PROJECT_LOCAL_CLI_INVOCATION} doctor\` to diagnose package/managed compatibility. These commands do not validate product authority, implementation conformance, or task readiness.`,
     "- Under `.nimi/spec/**`, author only closed multi-unit `*.authority.yaml` containers or single-unit `*.authority.md`; historical document formats are unsupported and never inferred.",
-    "- Run `nimicoding authority fmt` on each changed file, then `nimicoding authority check` on the complete authority input set.",
-    "- Never bypass a failure with inferred or fallback semantics; choose repair values only from product/task authority.",
-    "- Keep derived and verification evidence under `.nimi/local/**`; it is never product authority.",
+    `- Run \`${PROJECT_LOCAL_CLI_INVOCATION} authority fmt\` on each changed file, then \`${PROJECT_LOCAL_CLI_INVOCATION} authority check\` on the complete authority input set.`,
+    `- A failed project-local \`${PROJECT_LOCAL_CLI_INVOCATION} ...\` invocation blocks only the requested CLI product and never permits guessed, partial, corpus-wide, or fallback context; choose repair values only from product/task authority.`,
+    "- Keep derived and local verification output under `.nimi/local/**`; it is never product authority.",
   ];
 }
 

package/cli/seeds/seed-policy.yaml

@@ -1,10 +1,10 @@
 policy_id: nimicoding.seed-projection.v3
-description: Exact downstream projection registry for canonical authority authoring.
+description: Exact downstream projection registry for authority authoring and bounded implementation navigation.
 projections:
   - source: methodology/authority-authoring.yaml
     output: .nimi/methodology/authority-authoring.yaml
     ownership: package_canonical
-    downstream_consumer: project AI reads the compact canonical authority authoring guide
+    downstream_consumer: project AI reads the compact authority and implementation-navigation guide
 deprecated_projections:
   - .nimi/config/spec-generation-inputs.yaml
   - .nimi/contracts/domain-admission.schema.yaml

package/contracts/authority-source.schema.yaml

@@ -4,11 +4,6 @@ contract:
   owner: nimi-coding
   visibility: package_internal
 format: nimicoding.authority/v2
-migration_inputs:
-  format: nimicoding.authority/v1
-  admitted_by: [fmt --upgrade, diff, compile, check, impact]
-  rationale: history_snapshots_and_migration_inputs_are_read_not_authored
-  compatibility_product_surface: none_v1_is_not_a_current_authoring_format
 file_suffixes: [.authority.yaml, .authority.md]
 yaml_document:
   allowed_fields: [format, owner, scope, units]
@@ -40,7 +35,6 @@ text_values:
   line_break_code_points: [U+000A, U+000B, U+000C, U+000D, U+0085, U+2028, U+2029]
 fields:
   yaml_document: [format, owner, scope, units]
-  yaml_document_migration_input: [format, units]
   unit_common: [id, kind, owner, lifecycle, title, relations]
   active_definition_required: [meaning]
   active_rule_required: [modality, scope, statement, condition, failure]

package/contracts/authority-verifier-bindings.schema.yaml

@@ -1,20 +1,31 @@
-version: 1
+version: 2
 contract:
-  id: nimicoding.authority-verifier-bindings.v1
+  id: nimicoding.authority-verifier-bindings.v2
   owner: nimi-coding
   visibility: package_internal
-format: nimicoding.authority-verifier-bindings/v1
-detector: minimum-independent-incoming-reference/v1
+format: nimicoding.authority-verifier-bindings/v2
+detectors:
+  - minimum-independent-incoming-reference/v1
+  - exact-lexical-invariant/v1
 identifier_pattern: '^[a-z](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z](?:[a-z0-9-]*[a-z0-9])?)+$'
+token_pattern: '^[\p{L}\p{N}](?:[\p{L}\p{N}_.-]*[\p{L}\p{N}])?$'
 policies: [advisory, blocking]
+lexical_matches: [token, phrase]
+lexical_expectations: [present, absent]
 fields:
-  top: [format, required_bindings, bindings]
-  binding: [id, detector, premise, targets, minimum, policy]
+  top: [format, bindings]
+  graph_binding: [id, detector, premise, targets, minimum, policy]
+  lexical_binding: [id, detector, term, match, expectation, policy]
 constraints:
-  required_bindings: non_empty_unique_exact_binding_IDs
+  bindings: non_empty_closed_detector_binding_list
   binding_ID: unique_exact_dotted_lowercase_identifier
-  premise: exact_active_rule_ID
-  targets: non_empty_unique_exact_active_definition_IDs
-  minimum: positive_safe_integer
+  graph_premise: exact_active_rule_ID
+  graph_targets: non_empty_unique_exact_active_definition_IDs
+  graph_minimum: positive_safe_integer
+  lexical_term: non_empty_trimmed_single_line_exact_text
+  lexical_token: token_pattern_when_match_is_token
+  lexical_phrase: exact_case_sensitive_code_point_substring
+  lexical_corpus: active_authority_only
+  lexical_fields: [meaning, statement, condition, failure]
   policy: advisory_or_blocking
   extra_fields: forbidden

package/methodology/authority-authoring.yaml

@@ -1,45 +1,62 @@
-version: 2
+version: 6
 id: nimicoding.authority-authoring
-purpose: Author explicit .nimi/spec authority without inference.
+purpose: Author explicit authority and navigate current implementation without inference.
 authority_boundary:
   canonical_root: .nimi/spec
   sources: ["*.authority.yaml", "*.authority.md"]
-  rule: The project owns product meaning; nimicoding formats, validates, and derives read-only results.
-  AI_inputs: [this_guide, task_authority, bounded_discovery, exact_query_or_bounded_context, diagnostics]
+  rule: The project owns meaning; nimicoding formats, validates, and derives read-only results.
+  AI_inputs: [this_guide, task_authority, bounded_authority_or_code_query, diagnostics]
   do_not_read: [complete_authority_corpus, contracts, package_internal_specs]
 
+cli_execution:
+  cwd: repository_root
+  command_prefix: pnpm exec nimicoding
+  rule: Resolve the pinned local package; never probe global PATH. Failure blocks only the requested CLI product.
+
 daily_workflow:
-  - If no exact ID is known, run nimicoding authority discover <path> <query> --max-candidates 10 --max-snippet-terms 24 --max-bytes 131072 --json. Filters are exact; pass --preview-direction, --relations, and --max-edges together. It neither selects nor proves absence.
-  - Select an ID only from task or product authority. Use nimicoding authority query <path> <id> --max-bytes <positive-integer> --json for one unit, or context <path> <id> --max-units <positive-integer> --max-bytes <positive-integer> --json for its declared outgoing applies_to/supersedes closure. Context is not complete task context.
-  - Modify only project-owned canonical authority. Choose every product value before writing; never infer an ID, owner, scope, condition, failure, or relation.
-  - Run nimicoding authority fmt <changed-file> for each changed file.
-  - Run nimicoding authority check <complete-path> [--scope-bindings <file>] --json; then compile. For repository anchors run nimicoding authority anchors <repository-path> --spec <corpus-path> [--scope-bindings <file>] --max-units <positive-safe-integer> --max-anchors <positive-safe-integer> --max-bytes <positive-safe-integer> --json.
-  - For semantic changes, run diff and impact with explicit budgets and complete inputs; address every obligation and rerun impact.
-  - Never continue from compiler diagnostics, unknown IDs, budget failures, or partial/guessed results.
+  - Without an exact ID, run pnpm exec nimicoding authority discover <path> <query> --max-candidates 10 --max-snippet-terms 24 --max-bytes 131072 --json. It returns candidates, never selection or absence proof.
+  - Select IDs only from task/product authority. pnpm exec nimicoding authority query <path> <id> --max-bytes <n> --json returns one unit; pnpm exec nimicoding authority context <path> <id> --max-units <n> --max-bytes <n> --json returns its outgoing applies_to/supersedes closure, not task context.
+  - Modify only project authority; never infer product values or relations.
+  - Run pnpm exec nimicoding authority fmt <changed-file> for each changed file.
+  - Run pnpm exec nimicoding authority check <complete-path> [--scope-bindings <file>] --json, then pnpm exec nimicoding authority compile <complete-path> --json. For anchors run pnpm exec nimicoding authority anchors <repo> --spec <corpus> [--scope-bindings <file>] --max-units <n> --max-anchors <n> --max-bytes <n> --json.
+  - For semantic changes, run complete-input diff and impact with budgets; obligations are host follow-up targets, not results.
+  - Never continue from diagnostics, unknown IDs, budget failures, or guessed/partial results.
+
+implementation_navigation:
+  authority_to_code: pnpm exec nimicoding code authority --repo <root> --authority <exact-id> --max-files <n> --max-bytes <n>
+  code_to_authority: pnpm exec nimicoding code authority --repo <root> --source <tracked-path> --max-files <n> --max-bytes <n>
+  context: pnpm exec nimicoding code context <ts-or-tsx-path> --repo <root> --symbol <top-level-identifier> --tsconfig <path> --max-bytes <n>
+  markers:
+    authority: "// nimi-authority: <exact-id>"
+    deprecated: "// nimi-deprecated: <same-exact-id>"
+  rule: Put optional markers near key semantic owners; add deprecated only from direct authority/product failure, then remove with the hard cut.
+  boundary: Markers return authored locations/lifecycle; TypeScript context is root-direct static outbound only. Neither evaluates unannotated code, conformance, inbound impact, runtime dispatch, or completion.
+
+managed_surfaces:
+  check: pnpm exec nimicoding sync --check
+  restore: pnpm exec nimicoding sync --apply
+  doctor: pnpm exec nimicoding doctor
+  boundary: Sync diagnoses exact package-owned projection/block drift and apply restores it; doctor diagnoses package/managed compatibility. Neither validates authority, code, or task readiness.
 
 source_profiles:
   yaml:
-    shape: "Closed mapping: format nimicoding.authority/v2; owner?; scope string?; units. Units/IDs/order unchanged."
-    defaults: owner/rule scope inherit; unit overrides; definitions lack scope.
-    omissions: lifecycle active and relations [] may be omitted; removed/reason stay explicit; missing owner/rule scope at both levels fails.
-    legacy: nimicoding.authority/v1 remains accepted unchanged; fmt --upgrade emits v2 and hoists uniform defaults.
+    shape: "Closed nimicoding.authority/v2 mapping with optional owner/scope defaults and units."
+    defaults: owner/rule scope inherit; unit values override; definitions have no scope.
+    omissions: active lifecycle and empty relations may be omitted; removed reason stays explicit.
+    format: nimicoding.authority/v2_only_without_legacy_migration_or_history_input
   markdown:
-    shape: One unit per file. Front matter carries format, id, kind, owner, lifecycle, rule modality/scope, and relations.
+    shape: One unit per file; front matter carries fields and relations.
     title: One plain H1.
     sections:
       active_definition: [Meaning]
       active_rule: [Statement, Condition, Failure]
       removed_unit: [Removal reason]
-    boundary: Each section is one plain-text line; no free prose or unknown structures.
-  shared_text_rule: Text fields are non-empty trimmed single-line Unicode.
+    boundary: One plain-text line per section; no free prose or unknown structures.
+  shared_text_rule: Text is non-empty trimmed single-line Unicode.
 
 common_fields:
-  id: Stable dot-separated lower-case identity; never reuse a removed ID.
-  kind: rule or definition.
-  owner: Accountable dotted lower-case unit or container value.
-  lifecycle: active or explicit removed.
-  title: Required display label.
-  relations: Type/target pairs; omitted means [].
+  id: Stable lower-case dot identity; never reuse a removed ID.
+  owner: Accountable lower-case dotted identity.
 
 unit_shapes:
   active_definition:
@@ -50,55 +67,37 @@ unit_shapes:
     required: [id, kind, title, modality, statement, condition, failure]
     fixed: {kind: rule, lifecycle: active}
     modality: must or must_not.
-    scope: Non-empty unique unit list or one inherited container value.
-    condition: Write the actual condition; use Always. only when unconditional.
-    failure: State observable failure; never pseudo-success or silent fallback.
+    scope: Unique non-empty unit list or inherited container value.
+    condition: Actual condition; use Always. only when unconditional.
+    failure: Observable failure, never pseudo-success or fallback.
     forbidden: [meaning, reason]
   removed_tombstone:
     required: [id, kind, lifecycle, title, reason]
     fixed: {lifecycle: removed}
-    boundary: Preserve the stable identity and kind. reason is lifecycle rationale, not normative replacement content.
+    boundary: Preserve identity/kind; reason is rationale, not replacement content.
     forbidden: [meaning, modality, scope, statement, condition, failure]
 
 relation_rules:
-  applies_to: Required one or more times from each active rule to active definitions only.
-  supersedes: Optional from active or removed to one removed unit of the same kind; at most one incoming/outgoing edge, acyclic linear lineage.
-  resolution: Targets resolve by exact ID in the complete input; invalid, dangling, mismatched, cyclic, duplicate, or inferred edges fail.
+  applies_to: Each active rule targets one or more active definitions only.
+  supersedes: Optional edge to one removed unit of the same kind; one incoming/outgoing maximum, acyclic.
+  resolution: Exact IDs in complete input; invalid, dangling, mismatched, cyclic, duplicate, or inferred edges fail.
 
 formatter_and_diagnostics:
-  - fmt canonicalizes; v2 strips redundant unit defaults but keeps container choices.
-  - fmt --upgrade emits v2, hoists uniform owner/single scope, and preserves compiled meaning.
-  - check/compile use the complete path and fail closed; no public or partial AuthorityIR is emitted.
-  - Diagnostics give locations, reasons, conflicts, and repair categories, never product values.
-  - Fix values only from task or product authority. Do not invent container defaults, fallback data, historical inference, internal contracts, or wildcard corpus reading.
+  - fmt canonicalizes v2 and strips redundant unit defaults.
+  - Non-v2 input fails fmt/check/compile/diff/impact/review.
+  - check/compile use complete paths and emit no public/partial AuthorityIR.
+  - Diagnostics give locations and repair categories, never product values.
 
 change_workflow:
-  diff: nimicoding authority diff <before-path> <after-path> --max-bytes <positive-integer> --json
-  impact: nimicoding authority impact <before-path> <after-path> --dispositions <file> --max-bytes <positive-integer> --json
+  diff: pnpm exec nimicoding authority diff <before-path> <after-path> --max-bytes <positive-integer> --json
+  candidates: pnpm exec nimicoding authority change-candidates <before-path> <after-path> --channels <comma-separated-closed-set> --max-candidates <positive-safe-integer> --max-reasons <positive-safe-integer> --max-bytes <positive-safe-integer> --json
+  impact: pnpm exec nimicoding authority impact <before-path> <after-path> --max-bytes <positive-integer> --json
   boundaries:
     - Diff compares complete canonical inputs; formatting, profile, file, and order-only changes are semantic zero.
-    - Impact follows declared reverse applies_to/supersedes only. Each impacted active rule needs evidence for every before/after scope consumer and one test obligation.
-    - Diff/impact budgets cover complete compact payloads; budget failure returns no partial result.
-    - Dispositions are local evidence under .nimi/local, never authority or proof that implementation, consumers, or tests are synchronized.
-
-disposition_authoring:
-  workflow:
-    - Write the empty skeleton and run impact to obtain exact obligations from the failed result.
-    - Add exactly one entry per impacted active rule using real project evidence, then rerun impact with the same budget. Missing or extra dispositions fail.
-  empty_skeleton: |
-    format: nimicoding.authority-impact-dispositions/v1
-    rules: []
-  complete_example: |
-    format: nimicoding.authority-impact-dispositions/v1
-    rules:
-      - id: rule.checkout-session
-        consumers:
-          - scope: api.checkout
-            status: addressed
-            evidence: src/checkout/session-handler.ts
-        test:
-          status: addressed
-          evidence: tests/checkout-session.test.ts
+    - Candidates cover only requested exact channels, never semantic judgment.
+    - Impact reports declared reverse-relation consumers and one test target per impacted active rule.
+    - Diff/impact budget failure returns no partial result.
+    - Impact accepts no disposition, receipt, external result, test outcome, or completion state; workflow stays host-owned.
 
 canonical_examples:
   complete_yaml_lifecycle: |
@@ -109,13 +108,13 @@ canonical_examples:
         kind: definition
         owner: team.identity
         lifecycle: removed
-        title: Legacy session
-        reason: Replaced by the current session definition.
+        title: Old session
+        reason: Replaced by definition.session.
       - id: definition.session
         kind: definition
         owner: team.identity
         title: Session
-        meaning: A server-issued identity context presented with a protected request.
+        meaning: A server-issued request identity.
         relations:
           - type: supersedes
             target: definition.session-v0
@@ -123,16 +122,16 @@ canonical_examples:
         kind: rule
         owner: team.checkout
         lifecycle: removed
-        title: Legacy anonymous checkout prohibition
-        reason: Replaced by the current checkout prohibition.
+        title: Old checkout rule
+        reason: Replaced by rule.checkout-no-anonymous.
       - id: rule.checkout-no-anonymous
         kind: rule
         owner: team.checkout
-        title: Anonymous checkout is prohibited
+        title: Require checkout session
         modality: must_not
-        statement: Checkout creates an order without a valid session.
+        statement: Checkout creates an order without a session.
         condition: Always.
-        failure: Reject the request before creating an order.
+        failure: Reject before creating the order.
         relations:
           - type: applies_to
             target: definition.session
@@ -140,5 +139,4 @@ canonical_examples:
             target: rule.checkout-no-anonymous-v0
 
 final_boundaries:
-  - Authority is only project-authored *.authority.yaml or *.authority.md under .nimi/spec; derived/local output is not authority.
-  - Derived reads are bounded and read-only; none selects authority, supplies complete task context, or proves completion.
+  - Only project-authored sources under .nimi/spec are authority; derived/local output is not.

package/methodology/core.yaml

@@ -1,7 +1,7 @@
-version: 5
+version: 7
 methodology:
   id: nimi-coding
-  mission: Preserve explicit project-authored canonical authority through deterministic formatting, compilation, and fail-closed gates.
+  mission: Preserve explicit project-authored canonical authority and derive bounded read-only code context or explicit authored code links from current implementation inputs.
   package_boundary:
     owns:
       - compact_canonical_authority_authoring_methodology
@@ -9,11 +9,13 @@ methodology:
       - canonical_authority_formatter_and_conformance_gate
       - bounded_deterministic_exact_filtered_lexical_candidate_discovery_with_SourceMapped_field_snippets_and_optional_direct_authored_relation_preview
       - private_compiler_filtered_lexical_discovery_and_exact_query
+      - immutable_per_invocation_compiler_snapshots_transient_exact_indexes_and_change_derived_candidate_recall
       - complete_declared_outgoing_interpretation_closure
       - bounded_explicit_relation_graph_navigation
       - project_bound_deterministic_authority_audit_and_SARIF_projection
       - semantic_diff_and_declared_review_obligations
-      - optional_L3_repository_governance_checks
+      - explicit_TypeScript_5_9_3_root_direct_bounded_code_context
+      - transient_exact_code_authority_marker_lookup_and_lifecycle_audit
     does_not_own:
       - project_product_semantics
       - historical_document_reconstruction_or_inference
@@ -23,16 +25,18 @@ methodology:
       - implementation_or_review_completion
       - host_workflow_commands
       - storage_semantic_search_visualization_or_Atlas
+      - code_location_inbound_impact_structural_advice_other_languages_or_task_completion
   authority_order:
     - host_canonical_authority_under_.nimi/spec
     - projected_compact_authoring_methodology
     - package_internal_compiler_contracts
-    - local_non_authority_evidence
+    - local_derived_output
   boundaries:
     discovery: bounded_exact_filtered_lexical_candidates_with_SourceMapped_field_snippets_and_optional_M1_direct_authored_relation_preview_not_semantic_search_selection_context_complete_recall_or_absence_proof
+    change_candidates: complete_union_for_explicit_requested_exact_channels_not_conflict_retirement_authority_or_conformance_judgment
     context: complete_declared_outgoing_interpretation_closure_not_complete_task_context
     graph: bounded_explicit_relation_navigation_not_semantic_inference_or_raw_IR
     audit: explicit_project_verifier_bindings_not_prose_inference_plugin_execution_or_product_authority
-    impact: declared_review_obligations_not_implementation_consumer_or_test_sync_proof
+    impact: declared_relation_impact_and_host_follow_up_targets_not_implementation_consumer_or_test_sync_proof
+    code_context: current_filesystem_complete_selected_TypeScript_Program_root_direct_static_outbound_projection_not_location_impact_runtime_dispatch_or_task_context
     authority_admission: nimicoding_authority_check_on_complete_canonical_root
-    optional_repository_governance: separate_L3_not_authority_admission

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@nimiplatform/nimi-coding",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "private": false,
-  "description": "Canonical authority methodology, formatter, compiler primitives, and deterministic gates.",
+  "description": "Canonical authority products and bounded read-only code context for AI coding systems.",
   "license": "MIT",
   "homepage": "https://docs.nimi.ai/nimicoding",
   "repository": {
@@ -33,12 +33,14 @@
   "keywords": [
     "ai",
     "coding",
-    "governance",
+    "authority",
+    "code-intelligence",
     "methodology",
     "spec",
     "nimicoding"
   ],
   "dependencies": {
+    "typescript": "5.9.3",
     "yaml": "^2.8.1"
   },
   "files": [