@wairon/cli 5.0.2-dev.14 → 5.0.2-dev.16

package/dist/cli/index.js

@@ -65,7 +65,7 @@ var init_defaults = __esm({
       copilot: ".github/prompts",
       codex: ".codex/agents"
     };
-    WAIRON_VERSION = "5.0.2-dev.14";
+    WAIRON_VERSION = "5.0.2-dev.16";
     GITHUB_REPO = "SYW-Apps/Waffle-AIron";
     ARCHITECT_AGENT_ID = "agent-architect";
     ARCHITECT_TEMPLATE_ID = "architect";
@@ -458,7 +458,7 @@ var init_domain = __esm({
 });
 
 // src/models/project.ts
-var import_zod3, BuiltinTargetConfigSchema, CustomTargetConfigSchema, TargetConfigSchema, NamingRuleConfigSchema, DocumentationRuleConfigSchema, ComplexityRuleConfigSchema, DesignDepthSchema, RulesConfigSchema, PathsConfigSchema, ProjectConfigSchema;
+var import_zod3, BuiltinTargetConfigSchema, CustomTargetConfigSchema, TargetConfigSchema, NamingRuleConfigSchema, DocumentationRuleConfigSchema, ComplexityRuleConfigSchema, DesignDepthSchema, RulesConfigSchema, PathsConfigSchema, ProfileSelectionSubjectSchema, ProjectProfileSelectionSchema, ProjectConfigSchema;
 var init_project = __esm({
   "src/models/project.ts"() {
     "use strict";
@@ -582,6 +582,24 @@ var init_project = __esm({
       /** Base directory containing SDD specification files, relative to project root */
       specsDir: import_zod3.z.string().default(".wai/specs")
     });
+    ProfileSelectionSubjectSchema = import_zod3.z.object({
+      userId: import_zod3.z.string(),
+      kind: import_zod3.z.string(),
+      issuer: import_zod3.z.string(),
+      externalSubject: import_zod3.z.string().optional(),
+      displayName: import_zod3.z.string().optional(),
+      email: import_zod3.z.string().optional()
+    });
+    ProjectProfileSelectionSchema = import_zod3.z.object({
+      /** Selected architectural profile ids. The first resolvable one is applied as projectType. */
+      profileIds: import_zod3.z.array(import_zod3.z.string()).default([]),
+      /** Pack names the governing policy requires for this project. */
+      requiredPackNames: import_zod3.z.array(import_zod3.z.string()).default([]),
+      /** Pack names applied by default unless explicitly overridden. */
+      defaultPackNames: import_zod3.z.array(import_zod3.z.string()).optional(),
+      selectedBy: ProfileSelectionSubjectSchema.optional(),
+      selectedAt: import_zod3.z.string()
+    });
     ProjectConfigSchema = import_zod3.z.object({
       /**
        * Schema version — used to detect incompatible config formats in future
@@ -622,6 +640,13 @@ var init_project = __esm({
         useGlobalPacks: import_zod3.z.boolean().default(true)
       }).optional(),
       paths: PathsConfigSchema.default({}),
+      /**
+       * The profile/pack selection a hosted policy workflow applied to this project.
+       * The RECORD of what was chosen; `projectType` above is what actually governs
+       * validation. Modeled so the parse/write round trip preserves it (see
+       * ProjectProfileSelectionSchema).
+       */
+      profileSelection: ProjectProfileSelectionSchema.optional(),
       /**
        * Path to a directory containing org/user-level default templates.
        * Resolved before built-in templates but after project-local templates.
@@ -7313,7 +7338,7 @@ var init_extensions = __esm({
 });
 
 // src/core/rules/types.ts
-var BUILTIN_PROFILES;
+var BUILTIN_PROFILES, PROJECT_KINDS;
 var init_types = __esm({
   "src/core/rules/types.ts"() {
     "use strict";
@@ -7326,6 +7351,7 @@ var init_types = __esm({
       "realtime-embedded",
       "plc-cyclic"
     ];
+    PROJECT_KINDS = ["fullstack", "system-of-systems", "monorepo"];
   }
 });
 
@@ -7986,11 +8012,15 @@ function projectSubsystemSurface(subsystemId) {
   const interfaces = loadInterfaceSpecs();
   const types = loadTypeSpecs();
   const entries = [];
+  const unprojectable = [];
   for (const pub of target.publicInterfaces ?? []) {
     if (!pub.component) continue;
     const comp = components.find((c) => c.id === pub.component || c.id === `${subsystemId}::${pub.component}`);
     if (!comp) continue;
-    if (comp.componentType !== "Portal") continue;
+    if (!CROSS_BOUNDARY_TARGETS.has(comp.componentType)) {
+      unprojectable.push({ component: pub.component, componentType: comp.componentType });
+      continue;
+    }
     const compInterfaces = interfaces.filter((i) => i.component === comp.id && (!pub.interface || i.id === pub.interface || i.id === `${subsystemId}::${pub.interface}`));
     const methods = compInterfaces.flatMap((i) => i.methods);
     entries.push({
@@ -8004,13 +8034,18 @@ function projectSubsystemSurface(subsystemId) {
       component: localName(comp.id),
       methods,
       ...comp.dispatch && comp.dispatch.length ? { dispatch: comp.dispatch } : {},
-      // Project the backing Portal's auth + basePath so the codec can emit
+      // Project the backing component's auth + basePath so the codec can emit
       // OpenAPI security + per-portal servers self-contained from the snapshot.
       ...comp.auth && comp.auth.scheme !== "none" ? { auth: comp.auth } : {},
       ...comp.basePath ? { basePath: comp.basePath } : {},
       details: pub.details ?? ""
     });
   }
+  for (const skipped of unprojectable) {
+    console.error(
+      `[surfaces] skipped "${subsystemId}::${skipped.component}": a published ${skipped.componentType} can never serve a cross-boundary caller, so it stays out of every chained child's sibling surface \u2014 publish this surface through a Portal, a Gateway, or an Observer (for events).`
+    );
+  }
   return SurfaceSnapshotSchema.parse({
     projectName: `${system.name}::${subsystemId}`,
     origin: "generated",
@@ -8189,7 +8224,7 @@ function checkChildSurfaceFreshness(rootDir = getProjectRoot()) {
   }
   return issues;
 }
-var fs9, path10, SURFACES_DIRNAME;
+var fs9, path10, SURFACES_DIRNAME, CROSS_BOUNDARY_TARGETS;
 var init_surfaces = __esm({
   "src/core/surfaces.ts"() {
     "use strict";
@@ -8204,6 +8239,7 @@ var init_surfaces = __esm({
     init_type_analysis();
     init_openapi();
     SURFACES_DIRNAME = "surfaces";
+    CROSS_BOUNDARY_TARGETS = /* @__PURE__ */ new Set(["Portal", "Gateway", "Observer"]);
   }
 });
 
@@ -10509,14 +10545,14 @@ var init_declarative_assertions = __esm({
 });
 
 // src/core/rules/profiles.ts
-var BACKEND_LIKE, FRONTEND_LIKE, PROJECT_KINDS, profilesRule;
+var BACKEND_LIKE, FRONTEND_LIKE, PROJECT_KINDS2, profilesRule;
 var init_profiles = __esm({
   "src/core/rules/profiles.ts"() {
     "use strict";
     init_types();
     BACKEND_LIKE = /* @__PURE__ */ new Set(["backend", "lowlevel-os", "game-ecs", "realtime-embedded", "plc-cyclic"]);
     FRONTEND_LIKE = /* @__PURE__ */ new Set(["frontend-reactive", "frontend-controller"]);
-    PROJECT_KINDS = /* @__PURE__ */ new Set(["fullstack", "system-of-systems", "monorepo"]);
+    PROJECT_KINDS2 = new Set(PROJECT_KINDS);
     profilesRule = {
       name: "architectural-profiles",
       description: "Per-profile stereotype constraints: View/FeatureComponent/RouterComponent only in frontend profiles; Actor/Supervisor forbidden in plc-cyclic (single scan cycle); Actor/Supervisor in frontend profiles warned. Extension packs may register custom profiles (family + forbidden/discouraged stereotype lists); unknown profile names are flagged.",
@@ -10540,7 +10576,7 @@ var init_profiles = __esm({
             );
           }
         }
-        if (!registered.has(ctx.projectType) && !PROJECT_KINDS.has(ctx.projectType)) {
+        if (!registered.has(ctx.projectType) && !PROJECT_KINDS2.has(ctx.projectType)) {
           ctx.addIssue(
             "warning",
             "UNKNOWN_PROFILE",
@@ -27126,7 +27162,15 @@ var hostCore = {
   /** The ids of wairon's built-in architectural profiles, read from the core rules
    *  registry's built-in profile set (BUILTIN_PROFILES) — a pure, side-effect-free
    *  read of a bundled constant. */
-  builtinProfileIds: () => [...BUILTIN_PROFILES]
+  builtinProfileIds: () => [...BUILTIN_PROFILES],
+  /** The ids of wairon's built-in COMPOSITE PROJECT KINDS, read from the core
+   *  rules registry's bundled constant (PROJECT_KINDS) — a pure, side-effect-free
+   *  read. The counterpart of builtinProfileIds: legal projectType values that
+   *  are not architectural profiles and carry no profile doctrine of their own,
+   *  so the hosted profile-application path recognizes a project kind as
+   *  resolvable-as-is (no contributing pack to adopt) instead of refusing it as
+   *  an unknown profile. */
+  builtinProjectKinds: () => [...PROJECT_KINDS]
 };
 function resolveContainedProjectPath(projectRoot2, projectPath) {
   return assertContainedProjectPath(projectRoot2, projectPath);
@@ -27456,9 +27500,14 @@ function lockProject(cfg, credential, project2) {
   }
   return executeApprovedLock(cfg, project2);
 }
-function executeApprovedLock(cfg, projectId) {
+function boundLifecycleRoot(cfg, projectId, subproject) {
   const root = existingProjectRoot(cfg.dataDir, projectId);
   if (!root) throw new Error(`Unknown project "${projectId}".`);
+  if (!subproject) return root;
+  return resolveSubprojectMounts(projectId, root, subproject.split(SUBPROJECT_SEPARATOR));
+}
+function executeApprovedLock(cfg, projectId, subproject) {
+  const root = boundLifecycleRoot(cfg, projectId, subproject);
   return runWithProjectRoot(root, () => {
     hostGit.sync();
     const result = validateProjectAsComplete();
@@ -27630,9 +27679,8 @@ function promoteProject(cfg, credential, project2) {
   }
   return executeApprovedPromote(cfg, project2);
 }
-function executeApprovedPromote(cfg, projectId) {
-  const root = existingProjectRoot(cfg.dataDir, projectId);
-  if (!root) throw new Error(`Unknown project "${projectId}".`);
+function executeApprovedPromote(cfg, projectId, subproject) {
+  const root = boundLifecycleRoot(cfg, projectId, subproject);
   return runWithProjectRoot(root, () => {
     const lock = hostCore.readLockRecord();
     if (!lock) {
@@ -27747,6 +27795,35 @@ function storeListGlobalPacks() {
   );
   return [...instance, ...image];
 }
+function scanGlobalPackProfiles() {
+  const out = [];
+  for (const dir of [hostCore.globalPacksDir(), imagePacksDir()]) {
+    for (const full of hostCore.discoverPacks(dir)) {
+      try {
+        const loaded = hostCore.loadExtensionPacks([{ ref: full, scope: "global" }], path45.dirname(full));
+        if (loaded.errors.length) continue;
+        const source = loaded.packNames[0] ?? path45.basename(full);
+        for (const [id, def] of Object.entries(loaded.profiles)) out.push({ id, source, family: def.family });
+      } catch {
+      }
+    }
+  }
+  return out;
+}
+function scanProjectPackProfiles() {
+  const root = getProjectRoot();
+  const out = [];
+  for (const ref of loadProjectConfig().extensions?.packs ?? []) {
+    try {
+      const loaded = hostCore.loadExtensionPacks([{ ref, scope: "project" }], root);
+      if (loaded.errors.length) continue;
+      const source = loaded.packNames[0] ?? stem(ref);
+      for (const [id, def] of Object.entries(loaded.profiles)) out.push({ id, source, family: def.family });
+    } catch {
+    }
+  }
+  return out;
+}
 function storeListAvailableProfiles() {
   const out = [];
   const seen = /* @__PURE__ */ new Set();
@@ -27757,19 +27834,21 @@ function storeListAvailableProfiles() {
     out.push(family ? { id, source, family } : { id, source });
   };
   for (const id of hostCore.builtinProfileIds()) emit(id, "builtin");
-  const scanTier = (dir) => {
-    for (const full of hostCore.discoverPacks(dir)) {
-      try {
-        const loaded = hostCore.loadExtensionPacks([{ ref: full, scope: "global" }], path45.dirname(full));
-        if (loaded.errors.length) continue;
-        const source = loaded.packNames[0] ?? path45.basename(full);
-        for (const [id, def] of Object.entries(loaded.profiles)) emit(id, source, def.family);
-      } catch {
-      }
-    }
+  for (const c of scanGlobalPackProfiles()) emit(c.id, c.source, c.family);
+  return out;
+}
+function storeListProjectProfiles() {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const emit = (id, source, installed, family) => {
+    const key = JSON.stringify([id, source]);
+    if (seen.has(key)) return;
+    seen.add(key);
+    out.push({ id, source, ...family ? { family } : {}, installed });
   };
-  scanTier(hostCore.globalPacksDir());
-  scanTier(imagePacksDir());
+  for (const id of hostCore.builtinProfileIds()) emit(id, "builtin", true);
+  for (const c of scanProjectPackProfiles()) emit(c.id, c.source, true, c.family);
+  for (const c of scanGlobalPackProfiles()) emit(c.id, c.source, false, c.family);
   return out;
 }
 function readPackContent(full) {
@@ -27962,6 +28041,10 @@ function listAvailableProfiles(cfg, credential) {
   requirePrincipal2(cfg, credential);
   return storeListAvailableProfiles();
 }
+function listProjectProfiles(cfg, credential, project2) {
+  requireCap(cfg, credential, "project:read", "project", project2, "Forbidden \u2014 listing a project's selectable profiles requires project:read over the project");
+  return executeApprovedListProjectProfiles(cfg, project2);
+}
 function listAdoptableProjectPacks(cfg, credential, project2) {
   requireCap(cfg, credential, "project:read", "project", project2, "Forbidden \u2014 listing adoptable packs requires project:read over the project");
   return storeListGlobalPacks();
@@ -27984,6 +28067,26 @@ function executeApprovedInstallProjectPack(cfg, project2, name, content) {
 function executeApprovedResolveGlobalPacks(names) {
   return storeResolveGlobalPacks(names);
 }
+function executeApprovedListProjectProfiles(cfg, project2) {
+  return runWithProjectRoot(boundProject2(cfg, project2), () => storeListProjectProfiles());
+}
+function executeApprovedEnsureProfileInstalled(cfg, project2, profileId) {
+  if (hostCore.builtinProjectKinds().includes(profileId) || hostCore.builtinProfileIds().includes(profileId)) {
+    return { profileId, source: "builtin" };
+  }
+  const contributors = executeApprovedListProjectProfiles(cfg, project2).filter((p) => p.id === profileId);
+  const installed = contributors.find((p) => p.installed);
+  if (installed) return { profileId, source: installed.source };
+  const adoptable = contributors[0];
+  const resolved = adoptable ? executeApprovedResolveGlobalPacks([adoptable.source]).resolved[0] : void 0;
+  if (!resolved) {
+    throw new Error(
+      `Unknown profile "${profileId}" \u2014 no built-in profile or project kind carries it, no pack registered in project "${project2}" contributes it, and no server-global pack (mutable instance tier or immutable image tier) contributes it. Writing an unresolvable id as the projectType would silently disable the whole profile doctrine (UNKNOWN_PROFILE), so it is refused instead of applied.`
+    );
+  }
+  executeApprovedInstallProjectPack(cfg, project2, resolved.name, resolved.content);
+  return { profileId, source: resolved.name, adoptedPackName: resolved.name };
+}
 function removeProjectPack(cfg, credential, project2, name) {
   requireCap(cfg, credential, "project:admin", "project", project2, "Forbidden \u2014 removing a project pack requires project:admin over the project");
   runWithProjectRoot(boundProject2(cfg, project2), () => storeRemoveProjectPack(name));
@@ -28978,6 +29081,40 @@ function requestPackNames(request) {
   if (!sel) return [];
   return [.../* @__PURE__ */ new Set([...sel.requiredPackNames ?? [], ...sel.defaultPackNames ?? []])];
 }
+function classifyProfile(projectType, catalog) {
+  if (hostCore.builtinProfileIds().includes(projectType) || hostCore.builtinProjectKinds().includes(projectType)) {
+    return { source: "builtin", resolvable: true };
+  }
+  const installed = catalog.find((p) => p.id === projectType && p.installed);
+  if (installed) return { source: installed.source, resolvable: true };
+  return { resolvable: false };
+}
+function firstApplicableProfileId(candidates, catalog) {
+  const kinds = hostCore.builtinProjectKinds();
+  const catalogIds = new Set(catalog.map((p) => p.id));
+  return candidates.find((id) => kinds.includes(id) || catalogIds.has(id));
+}
+function unappliedIds(selectedProfileIds, governingProfileId) {
+  return selectedProfileIds.filter((id) => id !== governingProfileId);
+}
+function foldAppliedProfile(root, profileId, actor) {
+  const recorded = readProjectProfileSelection(root);
+  const folded = {
+    profileIds: [profileId, ...unappliedIds(recorded?.profileIds ?? [], profileId)],
+    requiredPackNames: recorded?.requiredPackNames ?? [],
+    selectedBy: actor,
+    selectedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  if (recorded?.defaultPackNames) folded.defaultPackNames = recorded.defaultPackNames;
+  recordProjectProfileSelection(root, folded);
+  return folded;
+}
+function overridingSubsystemIds(root) {
+  return runWithProjectRoot(
+    root,
+    () => hostCore.loadSubsystemSpecs().filter((s) => !!s.profile).map((s) => s.id)
+  );
+}
 function resolvedSelection(request, policy, selectedBy) {
   const sel = request.profileSelection;
   const selection = {
@@ -28996,7 +29133,8 @@ function buildEvaluation(input) {
     selectedProfileIds,
     hasSelection,
     countMissingPacksAsViolation,
-    requiredDefaultResolution
+    requiredDefaultResolution,
+    governingProfileId
   } = input;
   const present = new Set(presentPackNames);
   let missingPackNames;
@@ -29017,6 +29155,7 @@ function buildEvaluation(input) {
   const allowed = policy.allowedProfileIds;
   const disallowedProfileIds = allowed && allowed.length > 0 ? selectedProfileIds.filter((id) => !allowed.includes(id)) : [];
   const selectionRequiredUnmet = policy.requireProfileSelection && !hasSelection;
+  const unappliedProfileIds = governingProfileId ? unappliedIds(selectedProfileIds, governingProfileId) : [];
   const messages = [];
   if (selectionRequiredUnmet) {
     messages.push("Profile selection is required by policy but none was provided.");
@@ -29028,16 +29167,24 @@ function buildEvaluation(input) {
   for (const n of blockedPackNames) messages.push(`Pack "${n}" is blocked by policy.`);
   for (const id of missingProfileIds) messages.push(`Required profile "${id}" is not selected.`);
   for (const id of disallowedProfileIds) messages.push(`Profile "${id}" is not permitted by policy.`);
+  for (const id of unappliedProfileIds) {
+    messages.push(
+      `Selected profile "${id}" is recorded but does not govern the project (projectType is "${governingProfileId}") \u2014 a project has exactly one governing profile.`
+    );
+  }
   const violation = selectionRequiredUnmet || blockedPackNames.length > 0 || missingProfileIds.length > 0 || disallowedProfileIds.length > 0 || countMissingPacksAsViolation && (missingPackNames.length > 0 || unresolvedPacks.length > 0);
-  return {
+  const result = {
     compliant: !violation,
     mode: policy.enforcementMode,
     missingPackNames,
     blockedPackNames,
     missingProfileIds,
     unresolvedPacks,
+    unappliedProfileIds,
     messages
   };
+  if (governingProfileId) result.governingProfileId = governingProfileId;
+  return result;
 }
 function performInit(cfg, request, principal) {
   const policy = effectivePolicy(cfg.dataDir);
@@ -29057,17 +29204,24 @@ function performInit(cfg, request, principal) {
     request.ownerUnitId,
     principal ? principalSubject3(principal) : void 0
   );
-  installResolvedPacks(
-    cfg,
-    record2.id,
-    executeApprovedResolveGlobalPacks([
-      ...policy.requiredGlobalPacks,
-      ...policy.defaultProjectPacks,
-      ...requestPackNames(request)
-    ])
-  );
+  const packResolution = executeApprovedResolveGlobalPacks([
+    ...policy.requiredGlobalPacks,
+    ...policy.defaultProjectPacks,
+    ...requestPackNames(request)
+  ]);
+  installResolvedPacks(cfg, record2.id, packResolution);
   const selectedBy = principal ? principalSubject3(principal) : void 0;
-  recordProjectProfileSelection(record2.rootPath, resolvedSelection(request, policy, selectedBy));
+  const selection = resolvedSelection(request, policy, selectedBy);
+  recordProjectProfileSelection(record2.rootPath, selection);
+  const catalog = executeApprovedListProjectProfiles(cfg, record2.id);
+  const appliedProfileId = firstApplicableProfileId(selection.profileIds, catalog);
+  let appliedSource;
+  if (appliedProfileId) {
+    const application = executeApprovedEnsureProfileInstalled(cfg, record2.id, appliedProfileId);
+    writeProjectType(record2.rootPath, application.profileId);
+    appliedSource = application.source;
+  }
+  const unapplied = appliedProfileId ? unappliedIds(selection.profileIds, appliedProfileId) : [...selection.profileIds];
   const actor = principal ? principalSubject3(principal) : SYSTEM_SUBJECT;
   tryAppendAudit2(
     cfg,
@@ -29076,7 +29230,18 @@ function performInit(cfg, request, principal) {
       "project.init.policy",
       "info",
       "project",
-      { target: record2.id, projectId: record2.id },
+      {
+        target: record2.id,
+        projectId: record2.id,
+        metadata: JSON.stringify({
+          ...appliedProfileId ? { appliedProfileId, profileSource: appliedSource } : {
+            appliedProfileId: null,
+            profileNotApplied: selection.profileIds.length === 0 ? "no profile was selected \u2014 the default projectType stands" : "no selected profile is resolvable on this instance \u2014 the default projectType stands"
+          },
+          ...unapplied.length > 0 ? { unappliedProfileIds: unapplied } : {},
+          ...packResolution.unresolved.length > 0 ? { unresolvedPacks: packResolution.unresolved } : {}
+        })
+      },
       principal?.tokenId
     )
   );
@@ -29117,6 +29282,7 @@ function evaluateProjectPolicy(cfg, credential, projectId) {
   const root = resolveProjectRoot(cfg.dataDir, principal, projectId);
   if (!root) throw new Error(`Unknown project "${projectId}".`);
   const policy = effectivePolicy(cfg.dataDir);
+  const governingProfileId = readProjectType(root);
   const selection = readProjectProfileSelection(root);
   return buildEvaluation({
     policy,
@@ -29124,7 +29290,8 @@ function evaluateProjectPolicy(cfg, credential, projectId) {
     selectedProfileIds: selection?.profileIds ?? [],
     hasSelection: !!selection,
     countMissingPacksAsViolation: true,
-    requiredDefaultResolution: executeApprovedResolveGlobalPacks(requiredDefaultNames(policy))
+    requiredDefaultResolution: executeApprovedResolveGlobalPacks(requiredDefaultNames(policy)),
+    governingProfileId
   });
 }
 function reconcileProjectPolicy(cfg, credential, projectId) {
@@ -29139,20 +29306,41 @@ function reconcileProjectPolicy(cfg, credential, projectId) {
   const policy = effectivePolicy(cfg.dataDir);
   const selection = readProjectProfileSelection(root);
   const resolution = executeApprovedResolveGlobalPacks(requiredDefaultNames(policy));
-  let installed = installedPackNames(cfg, projectId);
-  const installedSet = new Set(installed);
+  const installedSet = new Set(installedPackNames(cfg, projectId));
   const toApply = resolution.resolved.filter((p) => !installedSet.has(p.name));
+  const appliedPackNames = toApply.map((p) => p.name);
   if (toApply.length > 0) {
     installResolvedPacks(cfg, projectId, { resolved: toApply, unresolved: [] });
-    installed = installedPackNames(cfg, projectId);
+  }
+  const catalog = executeApprovedListProjectProfiles(cfg, projectId);
+  const previousProfileId = readProjectType(root);
+  let governingProfileId = previousProfileId;
+  const requiredProfileIds = policy.requiredProfileIds ?? [];
+  const policyUnsatisfied = requiredProfileIds.length > 0 && !requiredProfileIds.includes(governingProfileId);
+  const governingUnresolvable = !classifyProfile(governingProfileId, catalog).resolvable;
+  let repairedProfileId;
+  let selectedProfileIds = selection?.profileIds ?? [];
+  if (policyUnsatisfied || governingUnresolvable) {
+    const target = firstApplicableProfileId(
+      [...requiredProfileIds, ...selection?.profileIds ?? []],
+      catalog
+    );
+    if (target) {
+      const application = executeApprovedEnsureProfileInstalled(cfg, projectId, target);
+      writeProjectType(root, application.profileId);
+      governingProfileId = application.profileId;
+      repairedProfileId = application.profileId;
+      selectedProfileIds = foldAppliedProfile(root, application.profileId, principalSubject3(principal)).profileIds;
+    }
   }
   const result = buildEvaluation({
     policy,
-    presentPackNames: installed,
-    selectedProfileIds: selection?.profileIds ?? [],
+    presentPackNames: installedPackNames(cfg, projectId),
+    selectedProfileIds,
     hasSelection: !!selection,
     countMissingPacksAsViolation: true,
-    requiredDefaultResolution: resolution
+    requiredDefaultResolution: resolution,
+    governingProfileId
   });
   tryAppendAudit2(
     cfg,
@@ -29161,7 +29349,15 @@ function reconcileProjectPolicy(cfg, credential, projectId) {
       "policy.reconcile",
       "info",
       "policy",
-      { target: projectId, projectId },
+      {
+        target: projectId,
+        projectId,
+        metadata: JSON.stringify({
+          ...appliedPackNames.length > 0 ? { appliedPackNames } : {},
+          ...repairedProfileId ? { repairedProfileId, previousProfileId } : {},
+          ...resolution.unresolved.length > 0 ? { unresolvedPacks: resolution.unresolved } : {}
+        })
+      },
       principal.tokenId
     )
   );
@@ -29177,8 +29373,19 @@ function getProjectConfig(cfg, credential, projectId) {
   const root = resolveProjectRoot(cfg.dataDir, principal, projectId);
   if (!root) throw new Error(`Unknown project "${projectId}".`);
   const projectType = readProjectType(root);
+  const selection = readProjectProfileSelection(root);
+  const classified = classifyProfile(projectType, executeApprovedListProjectProfiles(cfg, projectId));
   const locked = runWithProjectRoot(root, () => hostCore.readLockRecord() !== null);
-  return { projectType, locked };
+  const overriding = overridingSubsystemIds(root);
+  const view = {
+    projectType,
+    locked,
+    profileResolvable: classified.resolvable,
+    unappliedProfileIds: unappliedIds(selection?.profileIds ?? [], projectType),
+    overridingSubsystemIds: overriding
+  };
+  if (classified.source) view.profileSource = classified.source;
+  return view;
 }
 function setProjectType(cfg, credential, projectId, projectType) {
   const principal = requirePrincipal4(cfg, credential);
@@ -29189,9 +29396,23 @@ function setProjectType(cfg, credential, projectId, projectType) {
   }
   const root = resolveProjectRoot(cfg.dataDir, principal, projectId);
   if (!root) throw new Error(`Unknown project "${projectId}".`);
-  writeProjectType(root, projectType);
+  const application = executeApprovedEnsureProfileInstalled(cfg, projectId, projectType);
+  writeProjectType(root, application.profileId);
+  const folded = foldAppliedProfile(root, application.profileId, principalSubject3(principal));
+  const remainder = folded.profileIds.slice(1);
   const locked = runWithProjectRoot(root, () => hostCore.readLockRecord() !== null);
-  return { projectType, locked };
+  const overriding = overridingSubsystemIds(root);
+  const view = {
+    projectType: application.profileId,
+    locked,
+    profileSource: application.source,
+    // The write path guarantees resolvability — the ensure seam refused anything else.
+    profileResolvable: true,
+    unappliedProfileIds: remainder,
+    overridingSubsystemIds: overriding
+  };
+  if (application.adoptedPackName) view.adoptedPackName = application.adoptedPackName;
+  return view;
 }
 function getPackPolicy(cfg, credential) {
   requirePrincipal4(cfg, credential);
@@ -31344,38 +31565,58 @@ function initializeProject(cfg, credential, request) {
     }
   }
 }
-function lockProject2(cfg, credential, projectId) {
+function lockProject2(cfg, credential, projectId, subproject) {
   return lifecycleAction(cfg, credential, projectId, {
     action: "project:lock",
     verb: "Lock",
     noun: "lock",
+    subproject,
     execute: () => {
-      const lock = executeApprovedLock(cfg, projectId);
+      const lock = executeApprovedLock(cfg, projectId, subproject);
       return {
         status: "completed",
         action: "project:lock",
-        summary: `Locked project "${projectId}" (status: ${lock.status}).`,
+        summary: `Locked project "${projectId}"${subprojectSuffix(subproject)} (status: ${lock.status}).`,
         lock
       };
     }
   });
 }
-function promoteProject2(cfg, credential, projectId) {
+function promoteProject2(cfg, credential, projectId, subproject) {
   return lifecycleAction(cfg, credential, projectId, {
     action: "project:promote",
     verb: "Promote",
     noun: "promotion",
+    subproject,
     execute: () => {
-      const promo = executeApprovedPromote(cfg, projectId);
+      const promo = executeApprovedPromote(cfg, projectId, subproject);
       return {
         status: "completed",
         action: "project:promote",
-        summary: `Promotion of project "${projectId}": ${promo.status} \u2014 ${promo.message}`,
+        summary: `Promotion of project "${projectId}"${subprojectSuffix(subproject)}: ${promo.status} \u2014 ${promo.message}`,
         promote: promo
       };
     }
   });
 }
+function subprojectSuffix(subproject) {
+  return subproject ? ` subproject "${subproject}"` : "";
+}
+var SUBPROJECT_SCOPE_PAYLOAD = "SubprojectScope";
+function subprojectScopePayload(subproject) {
+  if (!subproject) return {};
+  return { payloadType: SUBPROJECT_SCOPE_PAYLOAD, payload: JSON.stringify({ subproject }) };
+}
+function readSubprojectScope(req) {
+  if (req.payloadType !== SUBPROJECT_SCOPE_PAYLOAD || !req.payload) return void 0;
+  const parsed = JSON.parse(req.payload);
+  if (typeof parsed.subproject !== "string" || !parsed.subproject) {
+    throw new Error(
+      `Approved ${req.kind} request "${req.id}" carries a ${SUBPROJECT_SCOPE_PAYLOAD} payload with no usable subproject qualifier \u2014 refusing to execute, because falling back to the whole project would widen the scope the requester was confined to.`
+    );
+  }
+  return parsed.subproject;
+}
 function lifecycleAction(cfg, credential, projectId, opts) {
   const principal = requirePrincipal7(cfg, credential);
   const effective = authorize(cfg.dataDir, principal, PROJECT_WRITE_CAPABILITY4, "project", projectId);
@@ -31401,8 +31642,9 @@ function lifecycleAction(cfg, credential, projectId, opts) {
       const pending = buildPendingRequest(
         principal,
         opts.action,
-        `${opts.verb} project ${projectId}`,
-        projectId
+        `${opts.verb} project ${projectId}${subprojectSuffix(opts.subproject)}`,
+        projectId,
+        subprojectScopePayload(opts.subproject)
       );
       return createPendingOutcome(cfg, principal, pending, opts.action);
     }
@@ -31476,12 +31718,14 @@ function executeApproved(cfg, req) {
       return `Initialized project "${rec.id}" under the active pack policy.`;
     }
     case "project:lock": {
-      const lock = executeApprovedLock(cfg, req.projectId ?? "");
-      return `Locked project "${req.projectId}" (status: ${lock.status}).`;
+      const scope = readSubprojectScope(req);
+      const lock = executeApprovedLock(cfg, req.projectId ?? "", scope);
+      return `Locked project "${req.projectId}"${subprojectSuffix(scope)} (status: ${lock.status}).`;
     }
     case "project:promote": {
-      const promo = executeApprovedPromote(cfg, req.projectId ?? "");
-      return `Promotion of project "${req.projectId}": ${promo.status} \u2014 ${promo.message}`;
+      const scope = readSubprojectScope(req);
+      const promo = executeApprovedPromote(cfg, req.projectId ?? "", scope);
+      return `Promotion of project "${req.projectId}"${subprojectSuffix(scope)}: ${promo.status} \u2014 ${promo.message}`;
     }
     default:
       throw new Error(`Unsupported approval kind "${req.kind}".`);
@@ -32185,6 +32429,9 @@ function getProjectConfig2(cfg, credential, projectId) {
 function setProjectType2(cfg, credential, projectId, projectType) {
   return setProjectType(cfg, credential, projectId, projectType);
 }
+function listProjectProfiles2(cfg, credential, project2) {
+  return listProjectProfiles(cfg, credential, project2);
+}
 function listProducers2(cfg, credential, project2) {
   return listProducers(cfg, credential, project2);
 }
@@ -35546,6 +35793,9 @@ function opsGetProjectConfig(cfg, sessionId, url, res) {
 function opsSetProjectConfig(cfg, sessionId, body, res) {
   sendJson(res, 200, setProjectType2(cfg, sessionId, String(body?.projectId ?? ""), String(body?.projectType ?? "")));
 }
+function opsListProjectProfiles(cfg, sessionId, url, res) {
+  sendJson(res, 200, { profiles: listProjectProfiles2(cfg, sessionId, q(url, "projectId") ?? "") });
+}
 function opsListProducers(cfg, sessionId, url, res) {
   sendJson(res, 200, { producers: listProducers2(cfg, sessionId, q(url, "projectId") ?? "") });
 }
@@ -35785,6 +36035,9 @@ async function handleWebRequest(cfg, req, res, body, url, ctx) {
       if (req.method === "POST" && parts.length === 3 && parts[2] === "config") {
         return opsSetProjectConfig(cfg, sessionId, body, res);
       }
+      if (req.method === "GET" && parts.length === 3 && parts[2] === "profiles") {
+        return opsListProjectProfiles(cfg, sessionId, url, res);
+      }
       if (req.method === "GET" && parts.length === 3 && parts[2] === "policy") {
         return opsPolicyEvaluate(cfg, sessionId, url, res);
       }
@@ -36205,6 +36458,12 @@ var PROJECT_OPS_TOOLS = /* @__PURE__ */ new Set([
   "sdd_host_produce",
   "sdd_host_commit_project"
 ]);
+var PROJECT_RECORD_TOOLS = /* @__PURE__ */ new Set([
+  "sdd_host_initialize_project",
+  "sdd_host_get_approval_status",
+  "sdd_host_await_approval",
+  ...PROJECT_OPS_TOOLS
+]);
 function jsonRpcRequests(body) {
   const arr = Array.isArray(body) ? body : [body];
   return arr.filter((m) => !!m && typeof m === "object" && "method" in m);
@@ -36270,7 +36529,27 @@ function dataPlanePermissionError(cfg, principal, projectId, body) {
     }
   };
 }
-async function dispatchProjectLifecycleTool(cfg, credential, projectId, body) {
+function subprojectConfinementError(projectId, subproject, body) {
+  if (!subproject) return void 0;
+  const msg = jsonRpcRequest(body);
+  if (!msg || msg.method !== "tools/call") return void 0;
+  const name = msg.params?.name;
+  if (typeof name !== "string" || !PROJECT_RECORD_TOOLS.has(name)) return void 0;
+  return {
+    jsonrpc: "2.0",
+    id: msg.id ?? null,
+    result: {
+      content: [
+        {
+          type: "text",
+          text: `Refused \u2014 ${name} acts on the whole project "${projectId}", but this credential is bound to subproject "${projectId}${SUBPROJECT_SEPARATOR}${subproject}". An unqualified credential for "${projectId}" is required to call ${name}.`
+        }
+      ],
+      isError: true
+    }
+  };
+}
+async function dispatchProjectLifecycleTool(cfg, credential, projectId, body, subproject) {
   const msg = jsonRpcRequest(body);
   if (!msg || msg.method !== "tools/call") return void 0;
   const name = msg.params?.name;
@@ -36287,10 +36566,10 @@ async function dispatchProjectLifecycleTool(cfg, credential, projectId, body) {
         value = initializeProject(cfg, credential, args);
         break;
       case "sdd_host_lock_project":
-        value = lockProject2(cfg, credential, projectId);
+        value = lockProject2(cfg, credential, projectId, subproject);
         break;
       case "sdd_host_promote_project":
-        value = promoteProject2(cfg, credential, projectId);
+        value = promoteProject2(cfg, credential, projectId, subproject);
         break;
       case "sdd_host_await_approval":
         value = await awaitApproval(
@@ -36397,7 +36676,13 @@ async function handleMcpRequest(cfg, req, res, body, credential) {
   await runWithProjectRoot(binding.rootPath, async () => {
     const projectId = binding.projectId;
     const subproject = binding.subproject;
-    const dispatchedResponse = await dispatchProjectLifecycleTool(cfg, cred, projectId, body);
+    const confinementError = subprojectConfinementError(projectId, subproject, body);
+    if (confinementError !== void 0) {
+      sendJson(res, 200, confinementError);
+      auditToolCall(cfg.dataDir, principal, projectId, body, deriveMcpOutcome(confinementError), subproject);
+      return;
+    }
+    const dispatchedResponse = await dispatchProjectLifecycleTool(cfg, cred, projectId, body, subproject);
     if (dispatchedResponse !== void 0) {
       sendJson(res, 200, dispatchedResponse);
       auditToolCall(cfg.dataDir, principal, projectId, body, deriveMcpOutcome(dispatchedResponse), subproject);