mustflow 2.117.0 → 2.118.0

package/README.md

@@ -322,6 +322,7 @@ mf run mustflow_update_apply
 | `mf script-pack run core/text-budget check <path...> --max <count>` | Check exact text length budgets for files using grapheme counts by default. |
 | `mf script-pack run core/text-budget check package.json --json-pointer /description --max <count> --json` | Check a JSON string field and print the stable report schema. |
 | `mf run <intent>` | Run an allowed one-shot command. |
+| `mf run <intent> --repo <path>` | Run one delegated scoped workspace contract from the workspace root. |
 | `mf run <intent> --wait` | Wait for conflicting active run locks before executing the command. |
 | `mf run <intent> --dry-run --json` | Preview whether an intent is runnable and what command metadata would be used, without executing it. |
 | `mf index` | Build a SQLite index for mustflow docs, skill routes, command rules, command-effect locks, and file fingerprints. Use `--incremental` to reuse a compatible fresh index without rewriting it. |

package/dist/cli/commands/run/args.js

@@ -12,6 +12,7 @@ const RUN_OPTIONS = [
     { name: ALLOW_UNTRUSTED_ROOT_OPTION, kind: 'boolean' },
     { name: '--wait-timeout', kind: 'string' },
     { name: '--allow-approval', kind: 'string' },
+    { name: '--repo', kind: 'string' },
 ];
 export function hasRunHelpOption(args) {
     return hasCliOptionToken(args, '--help', ['-h']);
@@ -43,6 +44,7 @@ export function parseRunArguments(args) {
             allowApprovals,
             wait: hasParsedCliOption(parsed, '--wait'),
             waitTimeoutSeconds,
+            repository: getParsedCliStringOption(parsed, '--repo'),
             intentName: intentName ?? null,
             extra,
             invalidApprovalAction: null,
@@ -73,6 +75,7 @@ export function parseRunArguments(args) {
         allowApprovals,
         wait: hasParsedCliOption(parsed, '--wait'),
         waitTimeoutSeconds,
+        repository: getParsedCliStringOption(parsed, '--repo'),
         intentName: intentName ?? null,
         extra,
         invalidApprovalAction,
@@ -90,12 +93,14 @@ export function getRunHelp(lang = 'en') {
             { label: '--wait', description: t(lang, 'run.help.option.wait') },
             { label: '--wait-timeout <seconds>', description: t(lang, 'run.help.option.waitTimeout') },
             { label: '--allow-approval <action>', description: t(lang, 'run.help.option.allowApproval') },
+            { label: '--repo <path>', description: t(lang, 'run.help.option.repository') },
             { label: ALLOW_UNTRUSTED_ROOT_OPTION, description: t(lang, 'run.help.option.allowUntrustedRoot') },
             { label: '-h, --help', description: t(lang, 'cli.option.help') },
         ],
         examples: [
             'mf run test',
             'mf run lint --json',
+            'mf run test --repo projects/example --json',
             'mf run release_npm_publish --allow-approval release --allow-approval network_access --json',
         ],
         exitCodes: [

package/dist/cli/commands/run/execution.js

@@ -2,7 +2,6 @@ import { createHash } from 'node:crypto';
 import { performance } from 'node:perf_hooks';
 import { ACTIVE_RUN_LOCK_ID_ENV, acquireActiveRunLock } from '../../../core/active-run-locks.js';
 import { createCommandEnv } from '../../../core/command-env.js';
-import { readCommandContract, readMustflowConfigIfExists } from '../../../core/config-loading.js';
 import { createCorrelationId } from '../../../core/correlation-id.js';
 import { recordRunPerformanceHistory } from '../../../core/run-performance-history.js';
 import { RunProfiler } from '../../../core/run-profile.js';
@@ -11,8 +10,8 @@ import { finishRunWriteTracking, startRunWriteTracking } from '../../../core/run
 import { resolveRunReceiptRetentionPolicy } from '../../../core/retention-policy.js';
 import { renderCliError } from '../../lib/cli-output.js';
 import { t } from '../../lib/i18n.js';
-import { resolveMustflowRoot } from '../../lib/project-root.js';
 import { assessRunRootTrust } from '../../lib/run-root-trust.js';
+import { resolveRunCommandContext } from '../../lib/run-context.js';
 import { createRunPlan, createRunPreview, } from '../../lib/run-plan.js';
 import { getRunStatus, runArgvCommandStreaming, runShellCommandStreaming } from './executor.js';
 import { emitOutput, isOutputLimitExceededError } from './output.js';
@@ -185,8 +184,9 @@ function createRunProgressReporter(input) {
 export async function executeRunCommand(request, reporter, lang = 'en', options = {}) {
     const executorStartedAtMs = performance.now();
     const profiler = new RunProfiler();
-    const projectRoot = profiler.measure('root_detection', () => resolveMustflowRoot());
-    const rootTrust = profiler.measure('root_trust', () => assessRunRootTrust(projectRoot));
+    const runContext = profiler.measure('root_detection', () => resolveRunCommandContext({ repository: request.repository, intentName: request.intentName }));
+    const projectRoot = runContext.projectRoot;
+    const rootTrust = profiler.measure('root_trust', () => assessRunRootTrust(projectRoot, { requiredPaths: runContext.trustPaths }));
     const jsonLikeOutput = request.outputMode !== 'text';
     if (!request.allowUntrustedRoot && !rootTrust.trusted) {
         const message = rootTrust.reason === 'manifest_lock_invalid'
@@ -195,7 +195,7 @@ export async function executeRunCommand(request, reporter, lang = 'en', options
         reporter.stderr(renderCliError(message, 'mf run --help', lang));
         return { exitCode: 1, receipt: null };
     }
-    const contract = profiler.measure('command_contract', () => readCommandContract(projectRoot));
+    const contract = profiler.measure('command_contract', () => runContext.contract);
     const plan = profiler.measure('plan_creation', () => createRunPlan(projectRoot, contract, request.intentName, {
         testTargets: options.testTargets,
         approvedActions: request.allowApprovals,
@@ -235,7 +235,7 @@ export async function executeRunCommand(request, reporter, lang = 'en', options
         return { exitCode: 1, receipt: null };
     }
     try {
-        const runReceiptPolicy = profiler.measure('retention_policy', () => resolveRunReceiptRetentionPolicy(readMustflowConfigIfExists(projectRoot)));
+        const runReceiptPolicy = profiler.measure('retention_policy', () => resolveRunReceiptRetentionPolicy(runContext.mustflowConfig));
         const env = profiler.measure('environment', () => createCommandEnv(projectRoot, { policy: plan.envPolicy, allowlist: plan.envAllowlist }));
         env[ACTIVE_RUN_LOCK_ID_ENV] = activeRunLock.handle.record.run_id;
         const writeTracker = profiler.measure('write_drift_before', () => startRunWriteTracking(projectRoot, contract, request.intentName, {
@@ -299,6 +299,7 @@ export async function executeRunCommand(request, reporter, lang = 'en', options
             phaseTimings: profiler.getReceiptPhases(),
             stdoutTailBytes: runReceiptPolicy.stdoutTailBytes,
             stderrTailBytes: runReceiptPolicy.stderrTailBytes,
+            workspaceScope: runContext.workspaceScope,
         }));
         if (options.writeLatestReceipt !== false) {
             profiler.measure('receipt_write', () => writeRunReceipt(projectRoot, receipt, runReceiptPolicy));

package/dist/cli/commands/run/preview.js

@@ -1,6 +1,5 @@
-import { readCommandContract } from '../../../core/config-loading.js';
 import { RunProfiler } from '../../../core/run-profile.js';
-import { resolveMustflowRoot } from '../../lib/project-root.js';
+import { resolveRunCommandContext } from '../../lib/run-context.js';
 import { createRunPlan, createRunPreview, renderRunPreviewText, } from '../../lib/run-plan.js';
 import { writeLatestRunProfile } from './profile.js';
 export function getRunPreviewMode(input) {
@@ -8,15 +7,17 @@ export function getRunPreviewMode(input) {
 }
 export function executeRunPreviewCommand(input, reporter, lang, options) {
     const profiler = new RunProfiler();
-    const projectRoot = profiler.measure('root_detection', () => resolveMustflowRoot());
-    const contract = profiler.measure('command_contract', () => readCommandContract(projectRoot));
+    const runContext = profiler.measure('root_detection', () => resolveRunCommandContext({ repository: input.repository, intentName: input.intentName }));
+    const projectRoot = runContext.projectRoot;
+    const contract = profiler.measure('command_contract', () => runContext.contract);
     const plan = profiler.measure('plan_creation', () => createRunPlan(projectRoot, contract, input.intentName, {
         testTargets: options.testTargets,
         approvedActions: input.allowApprovals,
     }));
     profiler.measure('preview_render', () => {
         if (input.json) {
-            reporter.stdout(JSON.stringify(createRunPreview(plan, input.previewMode), null, 2));
+            const preview = createRunPreview(plan, input.previewMode);
+            reporter.stdout(JSON.stringify(runContext.workspaceScope ? { ...preview, workspace_scope: runContext.workspaceScope } : preview, null, 2));
         }
         else {
             reporter.stdout(renderRunPreviewText(plan, input.previewMode, lang));

package/dist/cli/commands/run/receipt.js

@@ -37,6 +37,7 @@ export function assembleRunReceipt(input) {
             selected_target_count: Math.max(1, input.plan.testTargets.length),
             fallback_used: false,
         },
+        workspaceScope: input.workspaceScope,
         stdoutTailBytes: input.stdoutTailBytes,
         stderrTailBytes: input.stderrTailBytes,
         receiptPath: createRunReceiptRelativePath(),

package/dist/cli/commands/run.js

@@ -69,8 +69,9 @@ export async function runRun(args, reporter, lang = 'en', options = {}) {
             allowApprovals: parsedArgs.allowApprovals,
             wait: parsedArgs.wait,
             waitTimeoutSeconds: parsedArgs.waitTimeoutSeconds,
+            repository: parsedArgs.repository,
         }, reporter, lang, options);
         return result.exitCode;
     }
-    return executeRunPreviewCommand({ intentName, json, previewMode, allowApprovals: parsedArgs.allowApprovals }, reporter, lang, options);
+    return executeRunPreviewCommand({ intentName, json, previewMode, allowApprovals: parsedArgs.allowApprovals, repository: parsedArgs.repository }, reporter, lang, options);
 }

package/dist/cli/commands/workspace.js

@@ -1,3 +1,4 @@
+import { existsSync } from 'node:fs';
 import path from 'node:path';
 import { createClassifyOutput } from './classify.js';
 import { createChangeVerificationReport, } from '../../core/change-verification.js';
@@ -8,7 +9,8 @@ import { formatCliOptionParseError, hasCliOptionToken, hasParsedCliOption, parse
 import { resolveMustflowRoot } from '../lib/project-root.js';
 import { getRepoMapConfig, discoverNestedRepositories } from '../lib/repo-map.js';
 import { createRunPlan } from '../lib/run-plan.js';
-import { readCommandContract, readString, readStringArray } from '../../core/config-loading.js';
+import { assertScopedCommandIntentIsolation } from '../lib/run-context.js';
+import { readCommandContract, readScopedCommandContract, readString, readStringArray, } from '../../core/config-loading.js';
 const DEFAULT_WORKSPACE_SCAN_ROOT = 'projects';
 const WORKSPACE_SCAN_SCHEMA_VERSION = '1';
 const WORKSPACE_STATUS_SCHEMA_VERSION = '1';
@@ -95,6 +97,9 @@ function createAdHocWorkspaceConfig(base, projectsDir) {
         ...base,
         enabled: true,
         roots: [projectsDir],
+        authorityMode: 'repository_local',
+        delegatedContracts: [],
+        delegatedContractCount: 0,
     };
 }
 function slugCommandFragmentSegment(segment) {
@@ -195,16 +200,19 @@ function commandFragmentNextActions(repositoryCount) {
 function getIntentNames(intents) {
     return Object.keys(intents).sort((left, right) => left.localeCompare(right));
 }
-function summarizeCommandSurface(repositoryRoot, repository) {
+function summarizeLocalCommand(repositoryRoot, repository) {
     if (!repository.commandContract) {
         return {
-            path: null,
-            exists: false,
-            parse_error: null,
-            total_intents: null,
-            runnable_count: null,
-            runnable_intents: [],
-            blocked_count: null,
+            surface: {
+                path: null,
+                exists: false,
+                parse_error: null,
+                total_intents: null,
+                runnable_count: null,
+                runnable_intents: [],
+                blocked_count: null,
+            },
+            contract: null,
         };
     }
     try {
@@ -212,45 +220,129 @@ function summarizeCommandSurface(repositoryRoot, repository) {
         const intentNames = getIntentNames(contract.intents);
         const runnableIntents = intentNames.filter((intentName) => createRunPlan(repositoryRoot, contract, intentName).ok);
         return {
-            path: repository.commandContract,
-            exists: true,
-            parse_error: null,
-            total_intents: intentNames.length,
-            runnable_count: runnableIntents.length,
-            runnable_intents: runnableIntents,
-            blocked_count: Math.max(0, intentNames.length - runnableIntents.length),
+            surface: {
+                path: repository.commandContract,
+                exists: true,
+                parse_error: null,
+                total_intents: intentNames.length,
+                runnable_count: runnableIntents.length,
+                runnable_intents: runnableIntents,
+                blocked_count: Math.max(0, intentNames.length - runnableIntents.length),
+            },
+            contract,
         };
     }
     catch (error) {
         return {
-            path: repository.commandContract,
-            exists: true,
-            parse_error: error instanceof Error ? error.message : String(error),
-            total_intents: null,
-            runnable_count: null,
-            runnable_intents: [],
-            blocked_count: null,
+            surface: {
+                path: repository.commandContract,
+                exists: true,
+                parse_error: error instanceof Error ? error.message : String(error),
+                total_intents: null,
+                runnable_count: null,
+                runnable_intents: [],
+                blocked_count: null,
+            },
+            contract: null,
         };
     }
 }
-function repositoryStatus(commandSurface) {
-    if (!commandSurface.exists) {
-        return 'contract_missing';
+function normalizeRepositoryPath(value) {
+    return value.replace(/\\/gu, '/').replace(/\/+$/gu, '');
+}
+function findDelegatedContract(workspace, repository) {
+    if (workspace.authorityMode !== 'delegated_scoped' || repository.commandContract) {
+        return undefined;
+    }
+    const repositoryPath = normalizeRepositoryPath(repository.relativePath);
+    return workspace.delegatedContracts.find((contract) => contract.repository === repositoryPath);
+}
+function delegatedIntentIsRunnable(projectRoot, contract, scope, intentName) {
+    try {
+        assertScopedCommandIntentIsolation(projectRoot, scope, contract, intentName);
+        return createRunPlan(projectRoot, contract, intentName).ok;
+    }
+    catch {
+        return false;
+    }
+}
+function summarizeDelegatedCommand(projectRoot, scope) {
+    const contractPath = `.mustflow/config/${scope.file}`;
+    const contractExists = existsSync(path.resolve(projectRoot, '.mustflow', 'config', ...scope.file.split('/')));
+    try {
+        const contract = readScopedCommandContract(projectRoot, scope.file, `workspace:${scope.repository}`, scope.repository);
+        const intentNames = getIntentNames(contract.intents);
+        const runnableIntents = intentNames.filter((intentName) => delegatedIntentIsRunnable(projectRoot, contract, scope, intentName));
+        return {
+            surface: {
+                path: contractPath,
+                exists: true,
+                parse_error: null,
+                total_intents: intentNames.length,
+                runnable_count: runnableIntents.length,
+                runnable_intents: runnableIntents,
+                blocked_count: Math.max(0, intentNames.length - runnableIntents.length),
+            },
+            contract,
+        };
+    }
+    catch (error) {
+        return {
+            surface: {
+                path: contractPath,
+                exists: contractExists,
+                parse_error: error instanceof Error ? error.message : String(error),
+                total_intents: null,
+                runnable_count: null,
+                runnable_intents: [],
+                blocked_count: null,
+            },
+            contract: null,
+        };
+    }
+}
+function summarizeCommandSelection(projectRoot, repositoryRoot, repository, workspace) {
+    const delegatedContract = findDelegatedContract(workspace, repository);
+    if (delegatedContract) {
+        const summary = summarizeDelegatedCommand(projectRoot, delegatedContract);
+        return {
+            authority: 'delegated_scoped',
+            ...summary,
+            scope: delegatedContract,
+            planningRoot: projectRoot,
+        };
     }
+    const summary = summarizeLocalCommand(repositoryRoot, repository);
+    return {
+        authority: repository.commandContract ? 'repository_local' : null,
+        ...summary,
+        scope: null,
+        planningRoot: repositoryRoot,
+    };
+}
+function repositoryStatus(commandSurface, authority) {
     if (commandSurface.parse_error) {
         return 'contract_invalid';
     }
+    if (!commandSurface.exists) {
+        return 'contract_missing';
+    }
+    if (authority === 'delegated_scoped') {
+        return 'delegated_ready';
+    }
     return 'mustflow_ready';
 }
-function summarizeRepository(projectRoot, repository) {
+function summarizeRepository(projectRoot, repository, workspace) {
     const repositoryRoot = path.resolve(projectRoot, repository.relativePath);
-    const commandSurface = summarizeCommandSurface(repositoryRoot, repository);
+    const commandSelection = summarizeCommandSelection(projectRoot, repositoryRoot, repository, workspace);
+    const commandSurface = commandSelection.surface;
     const issues = commandSurface.parse_error ? [commandSurface.parse_error] : [];
     return {
         relative_path: repository.relativePath,
-        status: repositoryStatus(commandSurface),
+        status: repositoryStatus(commandSurface, commandSelection.authority),
         git_repository: true,
         mustflow: repository.mustflow,
+        command_authority: commandSelection.authority,
         agent_rules: repository.agentRules ?? null,
         repo_map: repository.repoMap ?? null,
         mustflow_config: repository.mustflowConfig ?? null,
@@ -276,7 +368,7 @@ function createWorkspaceStatusOutput() {
     const projectRoot = resolveMustflowRoot();
     const config = getRepoMapConfig(projectRoot);
     const nestedRepositories = discoverNestedRepositories(projectRoot, { ...config.map, includeNested: true }, config.workspace);
-    const repositories = nestedRepositories.map((repository) => summarizeRepository(projectRoot, repository));
+    const repositories = nestedRepositories.map((repository) => summarizeRepository(projectRoot, repository, config.workspace));
     const issues = config.workspace.enabled && config.workspace.roots.length > 0 && repositories.length === 0
         ? ['No nested git repositories were discovered under configured workspace roots.']
         : [];
@@ -295,7 +387,7 @@ function createWorkspaceScanOutput(projectsDir) {
     const projectRoot = resolveMustflowRoot();
     const config = getRepoMapConfig(projectRoot);
     const workspace = createAdHocWorkspaceConfig(config.workspace, projectsDir);
-    const repositories = discoverNestedRepositories(projectRoot, { ...config.map, includeNested: true }, workspace).map((repository) => summarizeRepository(projectRoot, repository));
+    const repositories = discoverNestedRepositories(projectRoot, { ...config.map, includeNested: true }, workspace).map((repository) => summarizeRepository(projectRoot, repository, workspace));
     const issues = repositories.length === 0
         ? [t('en', 'workspace.scan.issue.noneDiscovered', { projectsDir })]
         : [];
@@ -326,6 +418,8 @@ function workspaceConfigOutput(config) {
     return {
         enabled: config.enabled,
         roots: config.roots,
+        authority_mode: config.authorityMode,
+        delegated_contract_count: config.delegatedContractCount,
         max_depth: config.maxDepth,
         max_repositories: config.maxRepositories,
         follow_symlinks: config.followSymlinks,
@@ -353,10 +447,13 @@ function readIntentString(rawIntent, key) {
 function safeRunCommand(intentName) {
     return /^[A-Za-z0-9_-]+$/u.test(intentName) ? `mf run ${intentName}` : null;
 }
-function createCatalogIntent(repositoryRoot, repositoryPath, contract, intentName) {
+function createCatalogIntent(planningRoot, scope, repositoryPath, contract, intentName) {
     const rawIntent = contract.intents[intentName];
     try {
-        const plan = createRunPlan(repositoryRoot, contract, intentName);
+        if (scope) {
+            assertScopedCommandIntentIsolation(planningRoot, scope, contract, intentName);
+        }
+        const plan = createRunPlan(planningRoot, contract, intentName);
         return {
             name: intentName,
             description: readIntentString(rawIntent, 'description'),
@@ -395,43 +492,31 @@ function createCatalogIntent(repositoryRoot, repositoryPath, contract, intentNam
         };
     }
 }
-function createCatalogRepository(projectRoot, repository) {
+function createCatalogRepository(projectRoot, repository, workspace) {
     const repositoryRoot = path.resolve(projectRoot, repository.relativePath);
-    const commandSurface = summarizeCommandSurface(repositoryRoot, repository);
-    if (!repository.commandContract) {
-        return {
-            relative_path: repository.relativePath,
-            status: 'contract_missing',
-            command_contract: commandSurface,
-            intent_count: 0,
-            runnable_count: 0,
-            blocked_count: 0,
-            intents: [],
-            issues: ['Command contract is missing.'],
-        };
-    }
-    let contract;
-    try {
-        contract = readCommandContract(repositoryRoot);
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
+    const commandSelection = summarizeCommandSelection(projectRoot, repositoryRoot, repository, workspace);
+    const commandSurface = commandSelection.surface;
+    if (!commandSelection.contract) {
+        const contractInvalid = commandSurface.parse_error !== null;
         return {
             relative_path: repository.relativePath,
-            status: 'contract_invalid',
+            status: contractInvalid ? 'contract_invalid' : 'contract_missing',
+            command_authority: commandSelection.authority,
             command_contract: commandSurface,
             intent_count: 0,
             runnable_count: 0,
             blocked_count: 0,
             intents: [],
-            issues: [message],
+            issues: [commandSurface.parse_error ?? 'Command contract is missing.'],
         };
     }
-    const intents = getIntentNames(contract.intents).map((intentName) => createCatalogIntent(repositoryRoot, repository.relativePath, contract, intentName));
+    const contract = commandSelection.contract;
+    const intents = getIntentNames(contract.intents).map((intentName) => createCatalogIntent(commandSelection.planningRoot, commandSelection.scope, repository.relativePath, contract, intentName));
     const runnableCount = intents.filter((intent) => intent.runnable).length;
     return {
         relative_path: repository.relativePath,
         status: 'available',
+        command_authority: commandSelection.authority,
         command_contract: commandSurface,
         intent_count: intents.length,
         runnable_count: runnableCount,
@@ -443,7 +528,7 @@ function createCatalogRepository(projectRoot, repository) {
 function createWorkspaceCommandCatalogOutput() {
     const projectRoot = resolveMustflowRoot();
     const { config, repositories: nestedRepositories } = readWorkspaceRepositories(projectRoot);
-    const repositories = nestedRepositories.map((repository) => createCatalogRepository(projectRoot, repository));
+    const repositories = nestedRepositories.map((repository) => createCatalogRepository(projectRoot, repository, config.workspace));
     return {
         schema_version: WORKSPACE_COMMAND_CATALOG_SCHEMA_VERSION,
         command: 'workspace command-catalog',
@@ -462,7 +547,13 @@ function createWorkspaceCommandFragmentsOutput(projectsDir) {
     const config = getRepoMapConfig(projectRoot);
     const workspace = projectsDir ? createAdHocWorkspaceConfig(config.workspace, projectsDir) : config.workspace;
     const nestedRepositories = discoverNestedRepositories(projectRoot, { ...config.map, includeNested: true }, workspace);
-    const repositories = nestedRepositories.map((repository) => summarizeRepository(projectRoot, repository));
+    const repositoryLocalWorkspace = {
+        ...workspace,
+        authorityMode: 'repository_local',
+        delegatedContracts: [],
+        delegatedContractCount: 0,
+    };
+    const repositories = nestedRepositories.map((repository) => summarizeRepository(projectRoot, repository, repositoryLocalWorkspace));
     const includePaths = createCommandFragmentPaths(repositories);
     const suggestions = repositories.map((repository) => createCommandFragmentSuggestion(repository, includePaths.get(repository.relative_path) ?? `${COMMAND_FRAGMENT_INCLUDE_PREFIX}/repository.toml`));
     const includeEntries = suggestions.map((suggestion) => suggestion.include_entry);
@@ -487,10 +578,11 @@ function createWorkspaceCommandFragmentsOutput(projectsDir) {
         next_actions: commandFragmentNextActions(repositories.length),
     };
 }
-function createUnavailableVerificationRepository(repository, commandSurface, status, classification, issue) {
+function createUnavailableVerificationRepository(repository, authority, commandSurface, status, classification, issue) {
     return {
         relative_path: repository.relativePath,
         status,
+        command_authority: authority,
         command_contract: commandSurface,
         changed_file_count: classification ? classification.summary.fileCount : null,
         changed_files: classification ? classification.files : [],
@@ -505,6 +597,40 @@ function createUnavailableVerificationRepository(repository, commandSurface, sta
         issues: [issue],
     };
 }
+function workspaceRelativeChangePath(repositoryPath, filePath) {
+    const repository = normalizeRepositoryPath(repositoryPath);
+    const file = filePath.replace(/\\/gu, '/').replace(/^\.\//u, '');
+    return `${repository}/${file}`;
+}
+function repositoryRelativeChangePath(repositoryPath, filePath) {
+    const prefix = `${normalizeRepositoryPath(repositoryPath)}/`;
+    return filePath.startsWith(prefix) ? filePath.slice(prefix.length) : filePath;
+}
+function rebaseClassificationForWorkspaceRoot(classification, repositoryPath) {
+    return {
+        source: classification.source,
+        files: classification.files.map((filePath) => workspaceRelativeChangePath(repositoryPath, filePath)),
+        classifications: classification.classifications.map((entry) => ({
+            ...entry,
+            path: workspaceRelativeChangePath(repositoryPath, entry.path),
+        })),
+        summary: classification.summary,
+    };
+}
+function scopedPlanningContract(projectRoot, contract, scope) {
+    return {
+        ...contract,
+        intents: Object.fromEntries(Object.entries(contract.intents).filter(([intentName]) => {
+            try {
+                assertScopedCommandIntentIsolation(projectRoot, scope, contract, intentName);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        })),
+    };
+}
 function selectedIntentsForVerificationReport(repositoryPath, report) {
     return report.schedule.entries.map((entry) => ({
         intent: entry.intent,
@@ -516,44 +642,45 @@ function selectedIntentsForVerificationReport(repositoryPath, report) {
 }
 /**
  * mf:anchor cli.workspace.verify-plan
- * purpose: Build per-repository verification plans from each child repository's own command contract.
- * search: workspace verify, changed files, plan only, command contract, child repository
- * invariant: Workspace verification output selects intents per repository and does not run raw commands from the parent root.
+ * purpose: Build per-repository verification plans from each repository's effective local or delegated scoped command contract.
+ * search: workspace verify, changed files, plan only, command contract, delegated repository
+ * invariant: Workspace verification output selects only repository-scoped intents and never runs their raw commands.
  * risk: config, state
  */
-function createVerificationRepository(projectRoot, repository) {
+function createVerificationRepository(projectRoot, repository, workspace) {
     const repositoryRoot = path.resolve(projectRoot, repository.relativePath);
-    const commandSurface = summarizeCommandSurface(repositoryRoot, repository);
+    const commandSelection = summarizeCommandSelection(projectRoot, repositoryRoot, repository, workspace);
+    const commandSurface = commandSelection.surface;
     let classification = null;
     try {
         classification = createClassifyOutput(repositoryRoot, 'changed', []);
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        return createUnavailableVerificationRepository(repository, commandSurface, 'git_unavailable', null, message);
-    }
-    if (!repository.commandContract) {
-        return createUnavailableVerificationRepository(repository, commandSurface, 'contract_missing', classification, 'Command contract is missing.');
-    }
-    let contract;
-    try {
-        contract = readCommandContract(repositoryRoot);
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        return createUnavailableVerificationRepository(repository, commandSurface, 'contract_invalid', classification, message);
-    }
+        return createUnavailableVerificationRepository(repository, commandSelection.authority, commandSurface, 'git_unavailable', null, message);
+    }
+    if (!commandSelection.contract) {
+        const contractInvalid = commandSurface.parse_error !== null;
+        return createUnavailableVerificationRepository(repository, commandSelection.authority, commandSurface, contractInvalid ? 'contract_invalid' : 'contract_missing', classification, commandSurface.parse_error ?? 'Command contract is missing.');
+    }
+    const contract = commandSelection.scope
+        ? scopedPlanningContract(projectRoot, commandSelection.contract, commandSelection.scope)
+        : commandSelection.contract;
+    const planningClassification = commandSelection.scope
+        ? rebaseClassificationForWorkspaceRoot(classification, repository.relativePath)
+        : classification;
     let report;
     try {
-        report = createChangeVerificationReport(classification, contract, repositoryRoot);
+        report = createChangeVerificationReport(planningClassification, contract, commandSelection.planningRoot);
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        return createUnavailableVerificationRepository(repository, commandSurface, 'plan_unavailable', classification, message);
+        return createUnavailableVerificationRepository(repository, commandSelection.authority, commandSurface, 'plan_unavailable', classification, message);
     }
     return {
         relative_path: repository.relativePath,
         status: 'available',
+        command_authority: commandSelection.authority,
         command_contract: commandSurface,
         changed_file_count: classification.summary.fileCount,
         changed_files: classification.files,
@@ -566,7 +693,9 @@ function createVerificationRepository(projectRoot, repository) {
         selected_intents: selectedIntentsForVerificationReport(repository.relativePath, report),
         gaps: report.gaps.map((gap) => ({
             reason: gap.reason,
-            files: gap.files,
+            files: commandSelection.scope
+                ? gap.files.map((filePath) => repositoryRelativeChangePath(repository.relativePath, filePath))
+                : gap.files,
             surfaces: gap.surfaces,
             detail: gap.detail,
         })),
@@ -576,7 +705,7 @@ function createVerificationRepository(projectRoot, repository) {
 function createWorkspaceVerificationPlanOutput() {
     const projectRoot = resolveMustflowRoot();
     const { config, repositories: nestedRepositories } = readWorkspaceRepositories(projectRoot);
-    const repositories = nestedRepositories.map((repository) => createVerificationRepository(projectRoot, repository));
+    const repositories = nestedRepositories.map((repository) => createVerificationRepository(projectRoot, repository, config.workspace));
     return {
         schema_version: WORKSPACE_VERIFICATION_PLAN_SCHEMA_VERSION,
         command: 'workspace verify',
@@ -607,6 +736,7 @@ function renderWorkspaceScan(output) {
     for (const repository of output.repositories) {
         lines.push(`- ${repository.relative_path} (${repository.status})`);
         lines.push(`  mustflow: ${repository.mustflow ? 'yes' : 'no'}`);
+        lines.push(`  command authority: ${repository.command_authority ?? 'none'}`);
         lines.push(`  command contract: ${repository.command_contract.path ?? 'missing'}`);
     }
     lines.push('', 'Next actions:');
@@ -631,6 +761,7 @@ function renderWorkspaceStatus(output) {
     for (const repository of output.repositories) {
         lines.push(`- ${repository.relative_path} (${repository.status})`);
         lines.push(`  mustflow: ${repository.mustflow ? 'yes' : 'no'}`);
+        lines.push(`  command authority: ${repository.command_authority ?? 'none'}`);
         lines.push(`  command contract: ${repository.command_contract.path ?? 'missing'}`);
         if (repository.command_contract.runnable_count !== null) {
             lines.push(`  runnable intents: ${repository.command_contract.runnable_count}`);
@@ -657,6 +788,8 @@ function renderWorkspaceCommandCatalog(output) {
     }
     for (const repository of output.repositories) {
         lines.push(`- ${repository.relative_path} (${repository.status})`);
+        lines.push(`  command authority: ${repository.command_authority ?? 'none'}`);
+        lines.push(`  command contract: ${repository.command_contract.path ?? 'missing'}`);
         if (repository.intents.length === 0) {
             lines.push(`  intents: none`);
         }
@@ -718,6 +851,8 @@ function renderWorkspaceVerificationPlan(output) {
     }
     for (const repository of output.repositories) {
         lines.push(`- ${repository.relative_path} (${repository.status})`);
+        lines.push(`  command authority: ${repository.command_authority ?? 'none'}`);
+        lines.push(`  command contract: ${repository.command_contract.path ?? 'missing'}`);
         lines.push(`  changed files: ${repository.changed_file_count ?? 'unknown'}`);
         lines.push(`  selected intents: ${repository.selected_intent_count}`);
         for (const selected of repository.selected_intents) {