@tiinex/core 0.18.0 → 0.20.0

package/src/tooling/portable/grounding/grounding.delegationReadiness.js

@@ -0,0 +1,241 @@
+const MAX_CAPABILITIES = 12;
+const MAX_FACTS = 12;
+
+export function projectGroundingDelegationReadiness({ authority = null, processApplicability = null, implementationSourceAuthority = null } = {}) {
+  const delegateCapabilityAuthority = projectDelegateCapabilityAuthority(authority?.delegateCapabilityAuthority || authority?.delegationContext?.delegateCapabilityAuthority || null);
+  const targetAuthority = projectDelegationTargetAuthority(authority?.delegationTargetAuthority || authority?.delegationContext?.targetAuthority || authority?.delegationContext?.delegationTargetAuthority || null);
+  const returnReconciliationExpectation = projectDelegationReturnReconciliationExpectation(authority?.delegationReturnReconciliationExpectation || authority?.delegationContext?.returnReconciliationExpectation || authority?.delegationContext?.delegationReturnReconciliationExpectation || null);
+  const process = processApplicability || Object.freeze({ state: 'not-established', unresolved: Object.freeze([]) });
+  const source = implementationSourceAuthority || Object.freeze({ state: 'unresolved', unresolved: Object.freeze([]) });
+  const blockers = [];
+
+  if (delegateCapabilityAuthority.state !== 'explicit-qualified-forward-selection') blockers.push(blocker(
+    'delegate-capability-authority-not-established',
+    delegateCapabilityAuthority.unresolved?.[0]?.detail || 'No explicit upstream-qualified forward-selected delegate/capability authority is established.',
+    'Provide an explicit upstream-qualified forward-selected delegate/capability projection with exact source-artifact identity. Cached Role presence, participant inventory, Handoff endpoint labels, filenames and chat position are not delegate selection authority.'
+  ));
+  const processReady = String(process.state || '') === 'explicit-qualified-authority' && Array.isArray(process.facts) && process.facts.length > 0 && Boolean(String(process.provenance?.source || process.provenance?.upstreamProvenance?.source || '').trim());
+  if (!processReady) blockers.push(blocker(
+    'delegation-process-applicability-not-established',
+    process.unresolved?.[0]?.detail || 'Delegation/process applicability is not explicitly established by upstream semantic authority.',
+    'Provide the explicit upstream-qualified process/delegation applicability projection. Do not infer applicability from Role/cache inventory or repository adjacency.'
+  ));
+  if (targetAuthority.state !== 'explicit-qualified-target-authority') blockers.push(blocker(
+    'delegation-target-authority-not-established',
+    targetAuthority.unresolved?.[0]?.detail || 'Target repository/workspace authority and repo-local Task/Handoff placement are not explicitly established.',
+    'Provide an explicit upstream-qualified delegation target projection naming repository, workspaceId, taskDirectory and handoffDirectory with exact source-artifact identity.'
+  ));
+  const sourceReady = String(source.state || '') === 'explicit-qualified-upstream-projection' && Array.isArray(source.facts) && source.facts.length > 0;
+  if (!sourceReady) blockers.push(blocker(
+    'delegation-source-authority-not-established',
+    source.unresolved?.[0]?.detail || 'Implementation/source authority is not explicitly established by upstream semantic authority.',
+    'Provide the exact upstream-qualified implementation-source authority projection. Workspace carriage, writability text, repository identity and executable Task presence remain descriptive only.'
+  ));
+  if (returnReconciliationExpectation.state !== 'explicit-qualified-return-reconciliation') blockers.push(blocker(
+    'delegation-return-reconciliation-expectation-not-established',
+    returnReconciliationExpectation.unresolved?.[0]?.detail || 'Return/reconciliation responsibility is not explicitly established.',
+    'Provide an explicit upstream-qualified return/reconciliation projection with Completion Expectation and an explicit reconciliation state/expectation.'
+  ));
+
+  const ready = blockers.length === 0;
+  return Object.freeze({
+    state: ready ? 'qualified-for-delegation-authoring' : 'not-established',
+    delegateCapabilityAuthority,
+    processApplicability: process,
+    targetAuthority,
+    sourceAuthority: source,
+    returnReconciliationExpectation,
+    blockers: Object.freeze(blockers),
+    plainChatFallbackPermitted: false,
+    repositoryScanningFallbackPermitted: false,
+    nextOperations: ready ? projectNextOperations({ delegateCapabilityAuthority, targetAuthority, returnReconciliationExpectation }) : Object.freeze([]),
+    boundary: 'Mechanical delegation qualification only. Core consumes already-explicit, already-qualified semantic projections and exposes the normal Task -> Handoff -> carrier Tooling path; it never selects a delegate, invents process applicability, generates a work plan, grants source authority, or treats cached Role presence as delegation authority.'
+  });
+}
+
+export function projectDelegateCapabilityAuthority(value = null) {
+  const base = qualifyExplicitProjection(value);
+  if (!base.qualified) return unresolvedProjection('delegate-capability-authority-not-established', 'No exact upstream-qualified explicit delegate/capability projection is present.');
+  const delegate = value?.delegate || value?.selectedDelegate || {};
+  const label = String(delegate.label || delegate.roleLabel || value?.delegateLabel || '').trim();
+  const kind = String(delegate.kind || value?.delegateKind || 'role').trim();
+  const capabilities = Array.isArray(value?.capabilities) ? value.capabilities : Array.isArray(delegate.capabilities) ? delegate.capabilities : [];
+  const selectionState = String(value?.selection?.state || value?.selectionState || '').trim().toLowerCase();
+  const forwardSelected = value?.selection?.forwardSelected === true || value?.forwardSelected === true || ['forward-selected', 'explicit-forward-selected'].includes(selectionState);
+  if (!label || !capabilities.length || !forwardSelected) return unresolvedProjection(
+    'delegate-capability-authority-incomplete',
+    'The upstream delegate/capability projection is marked qualified but does not expose one explicit forward-selected delegate label plus at least one capability.'
+  );
+  return Object.freeze({
+    state: 'explicit-qualified-forward-selection',
+    delegate: Object.freeze({ label, kind }),
+    capabilities: Object.freeze(capabilities.slice(0, MAX_CAPABILITIES).map((item) => freezeValue(item))),
+    sourceArtifact: Object.freeze(base.sourceArtifact),
+    facts: Object.freeze(projectFacts(value)),
+    provenance: Object.freeze({
+      basis: 'exact-upstream-qualified-forward-selected-delegate-capability-projection',
+      sourceArtifact: Object.freeze(base.sourceArtifact),
+      upstreamProvenance: value?.provenance ? Object.freeze({ ...(value.provenance || {}) }) : null,
+      boundary: 'Delegate relevance/capability is passed through from explicit upstream authority. Core does not select a Role from cache or participant inventory.'
+    }),
+    unresolved: Object.freeze([]),
+    boundary: 'Forward selection is semantic input, not a Role-discovery result.'
+  });
+}
+
+export function projectDelegationTargetAuthority(value = null) {
+  const base = qualifyExplicitProjection(value);
+  if (!base.qualified) return unresolvedProjection('delegation-target-authority-not-established', 'No exact upstream-qualified delegation target projection is present.');
+  const target = value?.target || value?.placement || {};
+  const workspaceId = String(target.workspaceId || value?.workspaceId || '').trim();
+  const repository = String(target.repository || value?.repository || '').trim();
+  const taskDirectory = normalizeDirectory(target.taskDirectory || value?.taskDirectory || '');
+  const handoffDirectory = normalizeDirectory(target.handoffDirectory || value?.handoffDirectory || '');
+  if (!workspaceId || !repository || !taskDirectory || !handoffDirectory) return unresolvedProjection(
+    'delegation-target-authority-incomplete',
+    'The upstream delegation target projection is marked qualified but does not expose repository, workspaceId, taskDirectory and handoffDirectory.'
+  );
+  return Object.freeze({
+    state: 'explicit-qualified-target-authority',
+    target: Object.freeze({ workspaceId, repository, taskDirectory, handoffDirectory, rootPath: String(target.rootPath || value?.rootPath || '').trim() }),
+    sourceArtifact: Object.freeze(base.sourceArtifact),
+    facts: Object.freeze(projectFacts(value)),
+    provenance: Object.freeze({
+      basis: 'exact-upstream-qualified-delegation-target-projection',
+      sourceArtifact: Object.freeze(base.sourceArtifact),
+      upstreamProvenance: value?.provenance ? Object.freeze({ ...(value.provenance || {}) }) : null,
+      boundary: 'Repository/Workspace identity and repo-local Task/Handoff placement are passed through from upstream authority; Core does not discover or choose a repository.'
+    }),
+    unresolved: Object.freeze([]),
+    boundary: 'Target placement is explicit authority input only; source mutation permission is separate.'
+  });
+}
+
+export function projectDelegationReturnReconciliationExpectation(value = null) {
+  const base = qualifyExplicitProjection(value);
+  if (!base.qualified) return unresolvedProjection('delegation-return-reconciliation-expectation-not-established', 'No exact upstream-qualified return/reconciliation projection is present.');
+  const completion = value?.completionExpectation || value?.returnExpectation || {};
+  const signalKind = String(completion.signalKind || '').trim();
+  const signalMeaning = String(completion.signalMeaning || '').trim();
+  const returnTo = String(completion.returnTo || '').trim();
+  const reconciliation = normalizeReconciliation(value?.reconciliation || value?.reconciliationExpectation || null);
+  if (!signalKind || !signalMeaning || !returnTo || !reconciliation.state) return unresolvedProjection(
+    'delegation-return-reconciliation-expectation-incomplete',
+    'The upstream return/reconciliation projection is marked qualified but does not expose a complete Completion Expectation and an explicit reconciliation state/expectation.'
+  );
+  return Object.freeze({
+    state: 'explicit-qualified-return-reconciliation',
+    completionExpectation: Object.freeze({ signalKind, signalMeaning, returnTo }),
+    reconciliation,
+    sourceArtifact: Object.freeze(base.sourceArtifact),
+    facts: Object.freeze(projectFacts(value)),
+    provenance: Object.freeze({
+      basis: 'exact-upstream-qualified-return-reconciliation-projection',
+      sourceArtifact: Object.freeze(base.sourceArtifact),
+      upstreamProvenance: value?.provenance ? Object.freeze({ ...(value.provenance || {}) }) : null,
+      boundary: 'Return and reconciliation responsibility are passed through exactly; Core does not invent acceptance, completion or merge semantics.'
+    }),
+    unresolved: Object.freeze([]),
+    boundary: 'Completion and reconciliation expectations are semantic-owner inputs; carrier manufacture remains a separate mechanical operation.'
+  });
+}
+
+function projectNextOperations({ delegateCapabilityAuthority, targetAuthority, returnReconciliationExpectation }) {
+  const target = targetAuthority.target;
+  const delegate = delegateCapabilityAuthority.delegate;
+  return Object.freeze([
+    Object.freeze({
+      kind: 'author-delegation-task',
+      command: 'author',
+      schemaId: 'tiinex.task.v1',
+      workspaceId: target.workspaceId,
+      repository: target.repository,
+      directory: target.taskDirectory,
+      bodyAuthority: 'caller/upstream-authored-work-semantics-required',
+      boundary: 'Mechanical authoring coordinate only. Core does not generate the Task objective, Done Criteria, scope or work plan.'
+    }),
+    Object.freeze({
+      kind: 'author-delegation-handoff',
+      command: 'author',
+      schemaId: 'tiinex.handoff.v1',
+      workspaceId: target.workspaceId,
+      repository: target.repository,
+      directory: target.handoffDirectory,
+      parent: 'newly-authored-qualified-task',
+      recipient: Object.freeze({ ...delegate }),
+      completionExpectation: Object.freeze({ ...(returnReconciliationExpectation.completionExpectation || {}) }),
+      boundary: 'Author the Handoff through normal Tooling with the qualified Task as Parent and the upstream-selected delegate/return semantics; Core does not synthesize transfer semantics.'
+    }),
+    Object.freeze({
+      kind: 'manufacture-delegation-carrier',
+      command: 'handoff',
+      workspaceId: target.workspaceId,
+      recipient: Object.freeze({ ...delegate }),
+      carrierAllocation: 'machine-derived-from-qualified-parent-pointer-topology',
+      reconciliation: returnReconciliationExpectation.reconciliation,
+      boundary: 'Manufacture only after the Task and Handoff qualify. Carrier topology is transport-only and does not create semantic delegation authority.'
+    })
+  ]);
+}
+
+function qualifyExplicitProjection(value = null) {
+  if (!value || typeof value !== 'object' || value.explicit !== true) return { qualified: false, sourceArtifact: emptySourceArtifact() };
+  if (String(value.qualification || value.state || '').trim().toLowerCase() !== 'qualified') return { qualified: false, sourceArtifact: emptySourceArtifact() };
+  const sourceArtifact = projectSourceArtifact(value);
+  if (!sourceArtifact.path || !/^[0-9a-f]{64}$/i.test(sourceArtifact.sha256)) return { qualified: false, sourceArtifact };
+  return { qualified: true, sourceArtifact };
+}
+
+function projectSourceArtifact(value = {}) {
+  const source = value.sourceArtifact || value.provenance?.sourceArtifact || {};
+  return Object.freeze({
+    workspaceId: String(source.workspaceId || source.workspace || '').trim(),
+    path: String(source.path || source.workspaceRelativePath || value.provenance?.sourceArtifactPath || '').trim(),
+    sha256: String(source.sha256 || value.provenance?.sourceArtifactSha256 || '').trim().toLowerCase(),
+    schemaId: String(source.schemaId || '').trim()
+  });
+}
+
+function unresolvedProjection(code, detail) {
+  return Object.freeze({
+    state: 'not-established',
+    facts: Object.freeze([]),
+    sourceArtifact: Object.freeze(emptySourceArtifact()),
+    unresolved: Object.freeze([Object.freeze({ code, detail })]),
+    boundary: 'No semantic meaning is inferred from Role/cache inventory, Handoff endpoints, filenames, repository adjacency or transport placement.'
+  });
+}
+
+function blocker(code, detail, request) {
+  return Object.freeze({
+    code,
+    detail: String(detail || ''),
+    request: `${String(request || '')} Do not fall back to plain-chat delegation, repository scanning, network discovery, or selecting a Role merely because it is carried.`
+  });
+}
+
+function projectFacts(value = {}) {
+  const facts = Array.isArray(value.facts) ? value.facts : Array.isArray(value.items) ? value.items : [];
+  return facts.slice(0, MAX_FACTS).map((item) => freezeValue(item));
+}
+
+function freezeValue(value) {
+  if (value && typeof value === 'object' && !Array.isArray(value)) return Object.freeze({ ...value });
+  if (Array.isArray(value)) return Object.freeze([...value]);
+  return value;
+}
+
+function normalizeDirectory(value = '') {
+  return String(value || '').replace(/\\/g, '/').replace(/^\/+/, '').replace(/\/+$/, '').trim();
+}
+
+function normalizeReconciliation(value = null) {
+  if (typeof value === 'string') return Object.freeze({ state: String(value || '').trim(), expectation: '' });
+  if (!value || typeof value !== 'object') return Object.freeze({ state: '', expectation: '' });
+  return Object.freeze({
+    state: String(value.state || value.disposition || '').trim(),
+    expectation: String(value.expectation || value.description || '').trim()
+  });
+}
+
+function emptySourceArtifact() { return { workspaceId: '', path: '', sha256: '', schemaId: '' }; }

package/src/tooling/portable/grounding/grounding.holderAssignmentModes.js

@@ -0,0 +1,125 @@
+import { deepFreeze, normalizeToken } from '../handoff/coldStartQualification.shared.js';
+
+export const HOLDER_ASSIGNMENT_MODE = deepFreeze({
+  EXPLICIT_SESSION: 'explicit-session',
+  EXPLICIT_USER_SESSION: 'explicit-user-session',
+  EXPLICIT_ROLE_INVOCATION: 'explicit-role-invocation',
+  HANDOFF: 'handoff',
+  EXPLICIT_PARTICIPATION: 'explicit-participation'
+});
+
+const KNOWN_MODES = new Set(Object.values(HOLDER_ASSIGNMENT_MODE));
+
+export function projectHolderAssignmentModeAuthority(role = {}) {
+  const endpointKind = normalizeToken(role?.endpoint?.kind || '');
+  if (endpointKind !== 'role') return deepFreeze({
+    state: 'not-applicable',
+    modes: deepFreeze([]),
+    holderState: '',
+    source: 'none',
+    reasonCode: 'recipient-not-role',
+    unknownModes: deepFreeze([]),
+    provenance: baseProvenance(role, { basis: 'recipient-not-role', field: 'Assignment Modes' }),
+    boundary: 'Holder assignment-mode authority applies only to a selected Role recipient.'
+  });
+
+  const material = role?.material?.artifact || null;
+  const relationship = role?.holderRelationshipLoaded || {};
+  const holderState = String(relationship.holderState || '').trim();
+  const qualifiedMaterial = String(role?.state || '') === 'qualified'
+    && String(role?.material?.state || '') === 'qualified'
+    && Boolean(material?.path)
+    && /^[0-9a-f]{64}$/i.test(String(material?.sha256 || ''));
+  if (!qualifiedMaterial) return unresolved(role, holderState, 'qualified-role-holder-authority-not-established', 'none', {
+    basis: 'exact-qualified-role-assignment-mode-authority-not-established', field: 'Assignment Modes'
+  });
+
+  const structured = parseStructuredModes(relationship.assignmentModes);
+  if (!structured.present) return unresolved(role, holderState, 'holder-assignment-mode-authority-missing', 'qualified-recipient-role-material', {
+    basis: 'canonical-assignment-modes-missing', field: 'Assignment Modes'
+  });
+  if (structured.unknown.length) return unresolved(role, holderState, 'holder-assignment-mode-authority-unknown-token', 'qualified-recipient-role-structured-modes', {
+    basis: 'exact-qualified-role-assignment-modes', field: 'Assignment Modes', exactValue: structured.raw, unknownModes: structured.unknown
+  });
+  if (!structured.modes.length) return unresolved(role, holderState, 'holder-assignment-mode-authority-empty', 'qualified-recipient-role-structured-modes', {
+    basis: 'exact-qualified-role-assignment-modes', field: 'Assignment Modes', exactValue: structured.raw
+  });
+  return deepFreeze({
+    state: 'qualified',
+    modes: deepFreeze(structured.modes),
+    holderState,
+    source: 'qualified-recipient-role-structured-modes',
+    reasonCode: 'holder-assignment-mode-authority-qualified',
+    unknownModes: deepFreeze([]),
+    provenance: baseProvenance(role, {
+      basis: 'exact-qualified-role-assignment-modes',
+      field: 'Assignment Modes',
+      exactValue: structured.raw,
+      boundary: 'Positive mode authority comes only from the exact structured Assignment Modes field on the qualified current Role. Holder State is diagnostic-only; historical compatibility material does not authorize current holder binding.'
+    }),
+    boundary: 'Exact structured canonical assignment modes authorize only their named bounded mechanisms; they do not establish a holder, durable identity, participation, delegation, process, source, or acceptance authority.'
+  });
+}
+
+export function isCanonicalHolderAssignmentMode(value = '') {
+  return KNOWN_MODES.has(String(value || '').trim());
+}
+
+function parseStructuredModes(value) {
+  if (Array.isArray(value)) {
+    const raw = value.map((item) => String(item || '').trim()).filter(Boolean);
+    const tokens = raw.map(stripCode).filter(Boolean);
+    return classifyStructured(tokens, raw.join(', '), true);
+  }
+  const raw = String(value || '').trim();
+  if (!raw) return { present: false, raw: '', modes: [], unknown: [] };
+  const tokens = raw.split(',').map((item) => stripCode(item.trim())).filter(Boolean);
+  return classifyStructured(tokens, raw, true);
+}
+
+function classifyStructured(tokens, raw, present) {
+  const modes = [];
+  const unknown = [];
+  for (const token of tokens) {
+    if (KNOWN_MODES.has(token)) {
+      if (!modes.includes(token)) modes.push(token);
+    } else if (!unknown.includes(token)) unknown.push(token);
+  }
+  return { present, raw, modes, unknown };
+}
+
+function stripCode(value) {
+  const text = String(value || '').trim();
+  return /^`[^`]+`$/.test(text) ? text.slice(1, -1).trim() : text;
+}
+
+function unresolved(role, holderState, reasonCode, source, details = {}) {
+  return deepFreeze({
+    state: 'unresolved',
+    modes: deepFreeze([]),
+    holderState,
+    source,
+    reasonCode,
+    unknownModes: deepFreeze([...(details.unknownModes || [])]),
+    provenance: baseProvenance(role, details),
+    boundary: 'Positive holder assignment-mode authorization is unresolved. Core does not infer canonical modes from Holder State prose, historical Role compatibility, endpoint labels, package placement, session assertions, filenames, or lexical similarity.'
+  });
+}
+
+function baseProvenance(role = {}, details = {}) {
+  const material = role?.material?.artifact || {};
+  return deepFreeze({
+    basis: String(details.basis || ''),
+    roleArtifactPath: String(material.path || ''),
+    roleArtifactSha256: String(material.sha256 || ''),
+    roleSchemaId: String(material.schemaId || ''),
+    roleLabel: String(material.roleLabel || role?.endpoint?.label || ''),
+    section: 'Holder Relationship',
+    field: String(details.field || 'Assignment Modes'),
+    exactValue: String(details.exactValue || ''),
+    exactRoleSourcePath: '',
+    exactRoleSha256: '',
+    decisionArtifact: null,
+    boundary: String(details.boundary || 'Only exact structured Assignment Modes on exact qualified current Role material may establish canonical assignment modes. Holder State and historical compatibility material remain non-authoritative for positive authorization.')
+  });
+}

package/src/tooling/portable/grounding/grounding.holderBindingAuthorization.js

@@ -0,0 +1,80 @@
+import { deepFreeze, normalizeToken } from '../handoff/coldStartQualification.shared.js';
+import {
+  HOLDER_ASSIGNMENT_MODE,
+  isCanonicalHolderAssignmentMode,
+  projectHolderAssignmentModeAuthority
+} from './grounding.holderAssignmentModes.js';
+
+export function projectHolderBindingAuthorization(role = {}, options = {}) {
+  const endpointKind = normalizeToken(role?.endpoint?.kind || '');
+  const requestedMode = String(options.assertionMode || options.assignmentMode || HOLDER_ASSIGNMENT_MODE.EXPLICIT_SESSION).trim();
+  if (endpointKind !== 'role') return deepFreeze({
+    state: 'not-applicable',
+    assignmentMode: '',
+    authorizedModes: deepFreeze([]),
+    holderState: '',
+    source: 'none',
+    reasonCode: 'recipient-not-role',
+    modeAuthority: projectHolderAssignmentModeAuthority(role),
+    provenance: {
+      basis: 'recipient-not-role', roleArtifactPath: '', roleArtifactSha256: '', section: 'Holder Relationship', field: 'Assignment Modes', exactValue: '', assertionMode: '', boundary: 'Holder-assignment authorization is only applicable when the selected Handoff recipient is a Role endpoint.'
+    },
+    boundary: 'No Role assignment authorization is required for a non-Role recipient.'
+  });
+
+  const modeAuthority = projectHolderAssignmentModeAuthority(role);
+  const holderState = String(modeAuthority.holderState || role?.holderRelationshipLoaded?.holderState || '').trim();
+  const provenance = deepFreeze({
+    ...(modeAuthority.provenance || {}),
+    assertionMode: requestedMode,
+    boundary: 'The bounded binding result compares one explicit assertion mechanism to exact qualified canonical assignment-mode authority. Holder State prose remains diagnostic-only.'
+  });
+
+  if (modeAuthority.state !== 'qualified') return deepFreeze({
+    state: 'unresolved',
+    assignmentMode: requestedMode,
+    authorizedModes: deepFreeze([]),
+    holderState,
+    source: modeAuthority.source || 'none',
+    reasonCode: modeAuthority.reasonCode || 'holder-assignment-mode-authority-unresolved',
+    modeAuthority,
+    provenance,
+    boundary: 'A matching Role assertion remains unauthorized until exact qualified canonical assignment-mode authority is established.'
+  });
+
+  if (!isCanonicalHolderAssignmentMode(requestedMode)) return deepFreeze({
+    state: 'unresolved',
+    assignmentMode: requestedMode,
+    authorizedModes: deepFreeze([...(modeAuthority.modes || [])]),
+    holderState,
+    source: modeAuthority.source,
+    reasonCode: 'holder-binding-assertion-mode-unqualified',
+    modeAuthority,
+    provenance,
+    boundary: 'The asserted binding mechanism is not a canonical mode established by semantic authority. Core does not reinterpret arbitrary assertion labels.'
+  });
+
+  if (!(modeAuthority.modes || []).includes(requestedMode)) return deepFreeze({
+    state: 'unresolved',
+    assignmentMode: requestedMode,
+    authorizedModes: deepFreeze([...(modeAuthority.modes || [])]),
+    holderState,
+    source: modeAuthority.source,
+    reasonCode: 'holder-assignment-mode-not-authorized',
+    modeAuthority,
+    provenance,
+    boundary: 'The exact qualified canonical mode set does not authorize the asserted bounded binding mechanism. No widening between session, user-session, invocation, Handoff, or participation modes is permitted.'
+  });
+
+  return deepFreeze({
+    state: 'qualified',
+    assignmentMode: requestedMode,
+    authorizedModes: deepFreeze([...(modeAuthority.modes || [])]),
+    holderState,
+    source: modeAuthority.source,
+    reasonCode: 'holder-assignment-mode-authorized',
+    modeAuthority,
+    provenance,
+    boundary: 'Exact qualified canonical assignment-mode authority authorizes only this bounded assertion mechanism; it does not establish durable holder identity or broader participant/process/delegation/source/acceptance authority.'
+  });
+}

package/src/tooling/portable/grounding/grounding.implementationSourceAuthority.js

@@ -0,0 +1,109 @@
+const MAX_FACTS = 12;
+const MAX_WORKSPACE_FACTS = 12;
+
+export function projectGroundingImplementationSourceAuthority({ authority = null, records = [], contextAudit = null, requiredContext = [] } = {}) {
+  const supplied = authority?.implementationSourceAuthority || null;
+  const exactUpstream = qualifiesExactUpstreamProjection(supplied);
+  const descriptiveFacts = projectDescriptiveWorkspaceFacts({ records, contextAudit, requiredContext });
+
+  if (!exactUpstream) return Object.freeze({
+    state: 'unresolved',
+    facts: Object.freeze([]),
+    descriptiveFacts,
+    provenance: Object.freeze({
+      basis: 'no-exact-upstream-qualified-implementation-source-authority-projection',
+      sourceArtifact: null,
+      boundary: 'Core does not derive implementation-source creation authority from Workspace carriage, completeness, boundedness, writability language, path adjacency, repository identity, or current Task wording.'
+    }),
+    unresolved: Object.freeze([Object.freeze({
+      code: 'implementation-source-authority-not-established',
+      detail: 'No exact upstream-qualified implementation-source authority projection is present. Workspace purpose/boundary facts remain descriptive only; do not infer permission to create or select implementation source from carriage, writability, repository identity, path adjacency, or executable Task presence.'
+    })]),
+    boundary: 'Semantics-neutral diagnostic only. Core exposes exact upstream authority projections when independently qualified, but does not define allow/deny meaning or manufacture source-creation permission.'
+  });
+
+  const facts = Array.isArray(supplied.facts) ? supplied.facts : Array.isArray(supplied.items) ? supplied.items : [];
+  return Object.freeze({
+    state: 'explicit-qualified-upstream-projection',
+    facts: Object.freeze(facts.slice(0, MAX_FACTS).map((item) => Object.freeze({ ...(item || {}) }))),
+    descriptiveFacts,
+    provenance: Object.freeze({
+      basis: 'exact-upstream-qualified-implementation-source-authority-projection',
+      sourceArtifact: Object.freeze(projectSourceArtifact(supplied)),
+      upstreamProvenance: supplied.provenance ? Object.freeze({ ...(supplied.provenance || {}) }) : null,
+      boundary: 'Core passes through the already-qualified upstream projection and exact source-artifact identity without interpreting its semantic allow/deny meaning.'
+    }),
+    unresolved: Object.freeze([]),
+    boundary: 'Semantics-neutral pass-through only. The upstream semantic owner defines the meaning of projected facts; Core neither broadens nor converts them into generic source authority.'
+  });
+}
+
+function qualifiesExactUpstreamProjection(value = null) {
+  if (!value || typeof value !== 'object' || value.explicit !== true) return false;
+  if (String(value.qualification || value.state || '').trim().toLowerCase() !== 'qualified') return false;
+  const source = projectSourceArtifact(value);
+  return Boolean(source.path && /^[0-9a-f]{64}$/i.test(source.sha256));
+}
+
+function projectSourceArtifact(value = {}) {
+  const source = value.sourceArtifact || value.provenance?.sourceArtifact || {};
+  return {
+    workspaceId: String(source.workspaceId || source.workspace || ''),
+    path: String(source.path || source.workspaceRelativePath || value.provenance?.sourceArtifactPath || ''),
+    sha256: String(source.sha256 || value.provenance?.sourceArtifactSha256 || '').trim().toLowerCase(),
+    schemaId: String(source.schemaId || '')
+  };
+}
+
+function projectDescriptiveWorkspaceFacts({ records = [], contextAudit = null, requiredContext = [] } = {}) {
+  const byPath = new Map((records || []).map((record) => [String(record.path || ''), record]));
+  const out = [];
+  for (const workspace of contextAudit?.workspaceMaterializations || []) {
+    if (out.length >= MAX_WORKSPACE_FACTS) break;
+    if (String(workspace.qualification || '') !== 'qualified') continue;
+    const workspaceId = String(workspace.workspaceId || '');
+    const innerPath = normalizePath(workspace.sourceWorkspaceTargetInnerPath || '');
+    const exactPath = workspaceId && innerPath ? `${workspaceId}/${innerPath}` : '';
+    const record = exactPath ? byPath.get(exactPath) : null;
+    if (!record || !record.hasContinuityContext || !record.hasIntegrity) continue;
+    const boundary = section(record.markdown || '', 'Workspace Boundary');
+    if (!boundary) continue;
+    out.push(Object.freeze({
+      kind: 'workspace-boundary',
+      workspace: workspaceId,
+      text: compact(boundary, 500),
+      authorityEffect: 'descriptive-only',
+      provenance: Object.freeze({
+        basis: 'exact-qualified-workspace-artifact-section',
+        sourceArtifactPath: exactPath,
+        sourceArtifactSha256: String(workspace.sourceWorkspaceTargetSha256 || ''),
+        section: 'Workspace Boundary',
+        boundary: 'Exact carried Workspace metadata is exposed as a fact only; Core does not reinterpret boundary prose as implementation-source creation permission.'
+      })
+    }));
+  }
+  for (const entry of requiredContext || []) {
+    if (out.length >= MAX_WORKSPACE_FACTS) break;
+    if (String(entry.state || '') !== 'qualified' || !String(entry.purpose || '').trim()) continue;
+    out.push(Object.freeze({
+      kind: 'required-context-purpose',
+      workspace: String(entry.workspaceId || ''),
+      text: compact(entry.purpose, 500),
+      authorityEffect: 'descriptive-only',
+      provenance: Object.freeze({
+        basis: String(entry.provenance?.basis || 'selected-handoff-required-context-declaration'),
+        declarationSource: entry.provenance?.declarationSource ? Object.freeze({ ...(entry.provenance.declarationSource || {}) }) : null,
+        requirementId: String(entry.requirementId || ''),
+        boundary: 'Selected-Handoff purpose text is exposed verbatim as route context; it is not converted into implementation-source creation authority.'
+      })
+    }));
+  }
+  return Object.freeze(out);
+}
+
+function section(markdown = '', heading = '') {
+  const escaped = String(heading || '').replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return String(markdown || '').match(new RegExp(`(?:^|\\n)##\\s+${escaped}\\s*\\r?\\n([\\s\\S]*?)(?=\\n##\\s+|\\n#\\s+Continuity Integrity|$)`, 'i'))?.[1]?.trim() || '';
+}
+function compact(value = '', limit = 500) { const text = String(value || '').replace(/\s+/g, ' ').trim(); return text.length > limit ? `${text.slice(0, limit - 1).trimEnd()}…` : text; }
+function normalizePath(value = '') { return String(value || '').replace(/\\/g, '/').replace(/^\/+/, ''); }

package/src/tooling/portable/grounding/grounding.participantAuthority.js

@@ -10,7 +10,7 @@ export function projectParticipantAuthority(authority = null) {
     recipientRole: String(role.endpoint?.label || authority?.handoff?.to || ''),
     roleMaterial: Object.freeze({ path: String(material.path || ''), schemaId: String(material.schemaId || ''), roleLabel: String(material.roleLabel || '') }),
     authorityBoundary: Object.freeze({ mayDo: compact(declared.mayDo), doesNotAuthorize: compact(declared.doesNotAuthorize), reviewBoundary: compact(declared.reviewBoundary) }),
-    holderBinding: Object.freeze({ state: String(holder.state || 'unresolved'), roleLabel: String(holder.roleLabel || ''), source: String(holder.source || 'none'), explicit: Boolean(holder.explicit), inferredFromTransport: Boolean(holder.inferredFromTransport) }),
+    holderBinding: Object.freeze({ state: String(holder.state || 'unresolved'), bindingPresent: String(holder.state || '') === 'qualified', declarationPresent: Boolean(holder.explicit), roleLabel: String(holder.roleLabel || ''), source: String(holder.source || 'none'), sourceDetail: holder.sourceDetail ? Object.freeze({ ...(holder.sourceDetail || {}) }) : null, authorization: holder.authorization ? Object.freeze({ ...holder.authorization, provenance: holder.authorization.provenance ? Object.freeze({ ...holder.authorization.provenance }) : null }) : null, durableIdentity: holder.durableIdentity ? Object.freeze({ ...holder.durableIdentity }) : Object.freeze({ state: 'not-established' }), semanticAuthorityState: String(holder.sourceDetail?.semanticAuthorityState || 'not-established'), explicit: Boolean(holder.explicit), inferredFromTransport: Boolean(holder.inferredFromTransport) }),
     participantIdentityCreatesAuthority: false,
     conversationPositionCreatesAuthority: false,
     universalHumanFeedbackRule: false,

package/src/tooling/portable/grounding/grounding.readiness.authority.js

@@ -38,16 +38,31 @@ export function projectGroundingAuthority(authority, mode) {
     role: authority.role ? Object.freeze({ state: authority.role.state || '', label: authority.role.endpoint?.label || '', kind: authority.role.endpoint?.kind || '' }) : null,
     holderBinding: authority.holderBinding ? Object.freeze({
       state: authority.holderBinding.state || '',
+      bindingPresent: String(authority.holderBinding.state || '') === 'qualified',
+      declarationPresent: Boolean(authority.holderBinding.explicit),
       holderId: authority.holderBinding.holderId || '',
       roleLabel: authority.holderBinding.roleLabel || '',
       recipientRoleLabel: authority.holderBinding.recipientRoleLabel || '',
       recipientCompatibility: authority.holderBinding.recipientCompatibility || '',
       source: authority.holderBinding.source || '',
+      sourceDetail: authority.holderBinding.sourceDetail ? Object.freeze({ ...(authority.holderBinding.sourceDetail || {}) }) : null,
+      authorization: authority.holderBinding.authorization ? Object.freeze({
+        ...(authority.holderBinding.authorization || {}),
+        provenance: authority.holderBinding.authorization.provenance ? Object.freeze({ ...(authority.holderBinding.authorization.provenance || {}) }) : null
+      }) : null,
+      durableIdentity: authority.holderBinding.durableIdentity ? Object.freeze({ ...(authority.holderBinding.durableIdentity || {}) }) : Object.freeze({ state: 'not-established' }),
+      semanticAuthorityState: authority.holderBinding.sourceDetail?.semanticAuthorityState || 'not-established',
       explicit: Boolean(authority.holderBinding.explicit),
       inferredFromTransport: Boolean(authority.holderBinding.inferredFromTransport),
       provenance: Object.freeze({
         basis: authority.holderBinding.explicit ? 'explicit-consuming-session-holder-binding' : 'unresolved-or-non-explicit-holder-binding',
         source: authority.holderBinding.source || '',
+        sourceKind: authority.holderBinding.sourceDetail?.kind || '',
+        sourceLocator: authority.holderBinding.sourceDetail?.locator || '',
+        semanticAuthorityState: authority.holderBinding.sourceDetail?.semanticAuthorityState || 'not-established',
+        qualifiedMaterialSource: Boolean(authority.holderBinding.sourceDetail?.qualifiedMaterialSource),
+        authorizationState: authority.holderBinding.authorization?.state || 'unresolved',
+        authorizationBasis: authority.holderBinding.authorization?.provenance?.basis || '',
         boundary: authority.holderBinding.boundary || 'Consuming-session holder identity is never inferred from route transport or recipient position.'
       }),
       boundary: authority.holderBinding.boundary || ''