@codyswann/lisa 2.265.0 → 2.266.0

package/dist/health/deadline.d.ts

@@ -0,0 +1,25 @@
+/** Absolute monotonic deadline and cancellation signal. */
+export declare class HealthDeadline {
+    readonly signal: AbortSignal;
+    private readonly controller;
+    private readonly expired;
+    private readonly expiresAt;
+    private readonly timer;
+    /**
+     * Start a deadline immediately, before any project setup or detection.
+     * @param requestedMs - Requested total budget
+     */
+    constructor(requestedMs: number);
+    /** Remaining whole milliseconds available to a bounded command. */
+    remainingMs(): number;
+    /**
+     * Race one collaborator against the shared absolute deadline.
+     * @param work - Lazy collaborator so expired work never starts
+     * @param fallback - Value returned on timeout or collaborator failure
+     * @returns Work result or fallback
+     */
+    run<T>(work: () => Promise<T>, fallback: T): Promise<T>;
+    /** Release the deadline timer after collection finishes. */
+    close(): void;
+}
+//# sourceMappingURL=deadline.d.ts.map

package/dist/health/deadline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deadline.d.ts","sourceRoot":"","sources":["../../src/health/deadline.ts"],"names":[],"mappings":"AAMA,2DAA2D;AAC3D,qBAAa,cAAc;IACzB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAyB;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiB;IAEvC;;;OAGG;gBACS,WAAW,EAAE,MAAM;IAW/B,mEAAmE;IACnE,WAAW,IAAI,MAAM;IAIrB;;;;;OAKG;IACG,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAQ7D,4DAA4D;IAC5D,KAAK,IAAI,IAAI;CAGd"}

package/dist/health/deadline.js

@@ -0,0 +1,50 @@
+/** One absolute wall-clock deadline shared by every health collaborator. */
+/* eslint-disable jsdoc/require-returns -- typed deadline helpers are self-describing */
+import { performance } from "node:perf_hooks";
+const MAX_DEADLINE_MS = 119_000;
+/** Absolute monotonic deadline and cancellation signal. */
+export class HealthDeadline {
+    signal;
+    controller = new AbortController();
+    expired;
+    expiresAt;
+    timer;
+    /**
+     * Start a deadline immediately, before any project setup or detection.
+     * @param requestedMs - Requested total budget
+     */
+    constructor(requestedMs) {
+        const duration = Math.max(1, Math.min(requestedMs, MAX_DEADLINE_MS));
+        this.signal = this.controller.signal;
+        this.expiresAt = performance.now() + duration;
+        this.expired = new Promise(resolve => {
+            this.signal.addEventListener("abort", () => resolve(), { once: true });
+        });
+        this.timer = setTimeout(() => this.controller.abort(), duration);
+        this.timer.unref();
+    }
+    /** Remaining whole milliseconds available to a bounded command. */
+    remainingMs() {
+        return Math.max(0, Math.floor(this.expiresAt - performance.now()));
+    }
+    /**
+     * Race one collaborator against the shared absolute deadline.
+     * @param work - Lazy collaborator so expired work never starts
+     * @param fallback - Value returned on timeout or collaborator failure
+     * @returns Work result or fallback
+     */
+    async run(work, fallback) {
+        if (this.signal.aborted || this.remainingMs() === 0)
+            return fallback;
+        return Promise.race([
+            work().catch(() => fallback),
+            this.expired.then(() => fallback),
+        ]);
+    }
+    /** Release the deadline timer after collection finishes. */
+    close() {
+        clearTimeout(this.timer);
+    }
+}
+/* eslint-enable jsdoc/require-returns -- restore repository documentation defaults */
+//# sourceMappingURL=deadline.js.map

package/dist/health/deadline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deadline.js","sourceRoot":"","sources":["../../src/health/deadline.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,wFAAwF;AACxF,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,MAAM,eAAe,GAAG,OAAO,CAAC;AAEhC,2DAA2D;AAC3D,MAAM,OAAO,cAAc;IAChB,MAAM,CAAc;IACZ,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,OAAO,CAAgB;IACvB,SAAS,CAAS;IAClB,KAAK,CAAiB;IAEvC;;;OAGG;IACH,YAAY,WAAmB;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC;QAC9C,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;YACnC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,mEAAmE;IACnE,WAAW;QACT,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,GAAG,CAAI,IAAsB,EAAE,QAAW;QAC9C,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QACrE,OAAO,OAAO,CAAC,IAAI,CAAC;YAClB,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAED,4DAA4D;IAC5D,KAAK;QACH,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;CACF;AACD,sFAAsF"}

package/dist/health/deterministic.d.ts

@@ -0,0 +1,34 @@
+import { type HealthResult } from "./contract.js";
+import { type HooksPathReader } from "./hook-inspection.js";
+import { type InstalledPluginReader } from "./plugin-inspection.js";
+import { readGithubRulesets, type RulesetReader } from "./ruleset-inspection.js";
+/**
+ * Injectable deterministic-health collaborators. Reader overrides must honor
+ * their AbortSignal and release owned handles; the runner bounds its own return
+ * but cannot reclaim arbitrary handles created by caller-supplied JavaScript.
+ */
+export interface DeterministicHealthOptions {
+    /** Lisa package root containing stack templates. */
+    readonly lisaRoot?: string;
+    /** Total wall-clock deadline, including root/config/type setup. */
+    readonly deadlineMs?: number;
+    /** Injectable timestamp clock for contract tests. */
+    readonly now?: () => Date;
+    /** Injectable bounded detailed ruleset reader. */
+    readonly readRulesets?: RulesetReader;
+    /** Injectable bounded actual installed-plugin reader. */
+    readonly readInstalledPlugins?: InstalledPluginReader;
+    /** Injectable bounded repository hooks-path reader. */
+    readonly readHooksPath?: HooksPathReader;
+}
+/**
+ * Collect deterministic Health v1 without persistence, repair, installation,
+ * update checks, process-exit mutation, or model calls.
+ * @param projectPath - Host project root
+ * @param options - Injectable roots, deadline, clock, and bounded readers
+ * @returns Validated immutable deterministic HealthResult
+ */
+export declare function runDeterministicHealth(projectPath: string, options?: DeterministicHealthOptions): Promise<HealthResult>;
+export { readGithubRulesets };
+export type { RulesetReader };
+//# sourceMappingURL=deterministic.d.ts.map

package/dist/health/deterministic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deterministic.d.ts","sourceRoot":"","sources":["../../src/health/deterministic.ts"],"names":[],"mappings":"AAUA,OAAO,EAGL,KAAK,YAAY,EAGlB,MAAM,eAAe,CAAC;AAUvB,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,wBAAwB,CAAC;AAchC,OAAO,EACL,kBAAkB,EAElB,KAAK,aAAa,EACnB,MAAM,yBAAyB,CAAC;AAQjC;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IACtC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IACtD,uDAAuD;IACvD,QAAQ,CAAC,aAAa,CAAC,EAAE,eAAe,CAAC;CAC1C;AAqOD;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,YAAY,CAAC,CA4CvB;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAC9B,YAAY,EAAE,aAAa,EAAE,CAAC"}

package/dist/health/deterministic.js

@@ -0,0 +1,206 @@
+/** Side-effect-free deterministic Health v1 collection. */
+/* eslint-disable jsdoc/require-param-description, jsdoc/require-returns -- typed probe assembly helpers are self-describing */
+import { lstat, realpath } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { runConfigSync, } from "../sync/config-sync.js";
+import { summarizeHealthFindings, validateHealthResult, } from "./contract.js";
+import { HealthDeadline } from "./deadline.js";
+import { deterministicFinding } from "./finding-utils.js";
+import { hookFinding, managedTemplateFinding, packageFinding, pluginFinding, workflowFinding, } from "./governance-probes.js";
+import { readCoreHooksPath } from "./hook-inspection.js";
+import { readInstalledClaudePlugins, } from "./plugin-inspection.js";
+import { configFindings, instructionFinding, projectStateFinding, starterFinding, wikiFinding, } from "./project-probes.js";
+import { projectPathKind, readProjectJsonObject, readProjectText, } from "./read-only-fs.js";
+import { readGithubRulesets, rulesetFinding, } from "./ruleset-inspection.js";
+import { detectHealthProjectShape, } from "./template-inspection.js";
+const DEFAULT_DEADLINE_MS = 110_000;
+const CHECKS = [
+    { check: "project.state", unavailable: "fail" },
+    { check: "project.wiki", unavailable: "fail" },
+    { check: "starters.remote", unavailable: "warn" },
+    { check: "config.required", unavailable: "fail" },
+    { check: "config.sync", unavailable: "fail" },
+    { check: "templates.managed", unavailable: "fail" },
+    { check: "package.conformance", unavailable: "fail" },
+    { check: "instructions.canonical", unavailable: "fail" },
+    { check: "hooks.managed", unavailable: "fail" },
+    { check: "plugins.current", unavailable: "warn" },
+    { check: "ci.workflows", unavailable: "fail" },
+    { check: "github.rulesets", unavailable: "warn" },
+];
+/**
+ * Stable fallback when a check cannot complete inside the shared deadline.
+ * @param check
+ * @param status
+ */
+function unavailableFinding(check, status) {
+    return deterministicFinding(check, status, `${check} could not be safely observed within the deterministic deadline.`);
+}
+/**
+ * Read config while preserving missing vs malformed state.
+ * @param projectRoot
+ */
+async function loadConfigState(projectRoot) {
+    const kind = await projectPathKind(projectRoot, ".lisa.config.json");
+    if (kind === "missing") {
+        return { config: {}, present: false, readable: false };
+    }
+    if (kind !== "file") {
+        return { config: {}, present: true, readable: false };
+    }
+    try {
+        const config = await readProjectJsonObject(projectRoot, ".lisa.config.json");
+        return { config: config ?? {}, present: true, readable: true };
+    }
+    catch {
+        return { config: {}, present: true, readable: false };
+    }
+}
+/**
+ * Confined JSON/path readers for the shared sync planner.
+ * @param projectRoot
+ */
+function safeSyncReads(projectRoot) {
+    return {
+        readJson: async (relativePath) => {
+            const text = await readProjectText(projectRoot, relativePath);
+            if (text === undefined)
+                return null;
+            try {
+                return JSON.parse(text);
+            }
+            catch (error) {
+                if (error instanceof SyntaxError)
+                    return null;
+                throw error;
+            }
+        },
+        pathExists: async (relativePath) => (await projectPathKind(projectRoot, relativePath)) !== "missing",
+    };
+}
+/**
+ * Build a validated immutable HealthResult from ordered findings.
+ * @param started
+ * @param completed
+ * @param findings
+ */
+function result(started, completed, findings) {
+    const safeCompleted = completed < started ? started : completed;
+    return validateHealthResult({
+        schemaVersion: 1,
+        runId: `health-${crypto.randomUUID()}`,
+        mode: "deterministic",
+        startedAt: started.toISOString(),
+        completedAt: safeCompleted.toISOString(),
+        findings,
+        summary: summarizeHealthFindings(findings),
+    });
+}
+/**
+ * Resolve canonical project and Lisa roots inside the shared deadline.
+ * @param projectPath
+ * @param lisaPath
+ */
+async function resolveRoots(projectPath, lisaPath) {
+    const [projectRoot, lisaRoot] = await Promise.all([
+        realpath(path.resolve(projectPath)),
+        realpath(lisaPath),
+    ]);
+    if (!(await lstat(projectRoot)).isDirectory()) {
+        throw new Error("Health project root is not a directory");
+    }
+    return { projectRoot, lisaRoot };
+}
+/**
+ * Create the fixed-order probe registry from safely captured setup state.
+ * @param roots
+ * @param roots.projectRoot
+ * @param roots.lisaRoot
+ * @param configState
+ * @param shape
+ * @param deadline
+ * @param options
+ */
+// eslint-disable-next-line max-lines-per-function -- fixed-order registry keeps the complete contract auditable
+function probes(roots, configState, shape, deadline, options) {
+    const safeShape = shape ?? {
+        types: [],
+        packageJson: undefined,
+    };
+    const sync = runConfigSync(roots.projectRoot, {
+        dryRun: true,
+        reads: safeSyncReads(roots.projectRoot),
+    });
+    return [
+        {
+            ...CHECKS[0],
+            run: () => projectStateFinding(roots.projectRoot, configState, shape),
+        },
+        { ...CHECKS[1], run: () => wikiFinding(roots.projectRoot) },
+        { ...CHECKS[2], run: async () => starterFinding() },
+        { ...CHECKS[3], run: async () => (await configFindings(await sync))[0] },
+        { ...CHECKS[4], run: async () => (await configFindings(await sync))[1] },
+        {
+            ...CHECKS[5],
+            run: () => managedTemplateFinding(roots.lisaRoot, roots.projectRoot, safeShape, configState.config),
+        },
+        {
+            ...CHECKS[6],
+            run: () => packageFinding(roots.lisaRoot, roots.projectRoot, safeShape),
+        },
+        { ...CHECKS[7], run: () => instructionFinding(roots.projectRoot) },
+        {
+            ...CHECKS[8],
+            run: () => hookFinding(roots.lisaRoot, roots.projectRoot, safeShape.types, configState.config, options.readHooksPath ?? readCoreHooksPath, deadline.remainingMs(), deadline.signal),
+        },
+        {
+            ...CHECKS[9],
+            run: () => pluginFinding(roots.projectRoot, configState.config, safeShape.types, options.readInstalledPlugins ?? readInstalledClaudePlugins, deadline.remainingMs(), deadline.signal),
+        },
+        {
+            ...CHECKS[10],
+            run: () => workflowFinding(roots.lisaRoot, roots.projectRoot, safeShape.types, configState.config),
+        },
+        {
+            ...CHECKS[11],
+            run: () => rulesetFinding(roots.lisaRoot, roots.projectRoot, safeShape.types, configState.config, options.readRulesets ?? readGithubRulesets, deadline.remainingMs(), deadline.signal),
+        },
+    ];
+}
+/**
+ * Collect deterministic Health v1 without persistence, repair, installation,
+ * update checks, process-exit mutation, or model calls.
+ * @param projectPath - Host project root
+ * @param options - Injectable roots, deadline, clock, and bounded readers
+ * @returns Validated immutable deterministic HealthResult
+ */
+export async function runDeterministicHealth(projectPath, options = {}) {
+    const now = options.now ?? (() => new Date());
+    const started = now();
+    const deadline = new HealthDeadline(options.deadlineMs ?? DEFAULT_DEADLINE_MS);
+    try {
+        const lisaPath = options.lisaRoot ??
+            path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+        const roots = await deadline.run(() => resolveRoots(projectPath, lisaPath), undefined);
+        if (roots === undefined) {
+            return result(started, now(), CHECKS.map(spec => unavailableFinding(spec.check, spec.unavailable)));
+        }
+        const [configState, shape] = await Promise.all([
+            deadline.run(() => loadConfigState(roots.projectRoot), {
+                config: {},
+                present: false,
+                readable: false,
+            }),
+            deadline.run(() => detectHealthProjectShape(roots.projectRoot), undefined),
+        ]);
+        const findings = await Promise.all(probes(roots, configState, shape, deadline, options).map(probe => deadline.run(probe.run, unavailableFinding(probe.check, probe.unavailable))));
+        return result(started, now(), findings);
+    }
+    finally {
+        deadline.close();
+    }
+}
+export { readGithubRulesets };
+/* eslint-enable jsdoc/require-param-description, jsdoc/require-returns -- restore repository documentation defaults */
+//# sourceMappingURL=deterministic.js.map

package/dist/health/deterministic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deterministic.js","sourceRoot":"","sources":["../../src/health/deterministic.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,+HAA+H;AAC/H,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EACL,aAAa,GAEd,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EAIvB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,cAAc,EACd,aAAa,EACb,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAwB,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EACL,0BAA0B,GAE3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,WAAW,GAEZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,cAAc,GAEf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,wBAAwB,GAEzB,MAAM,0BAA0B,CAAC;AAElC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AA6BpC,MAAM,MAAM,GAAoD;IAC9D,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE;IAC/C,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE;IAC9C,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE;IACjD,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE;IACjD,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE;IAC7C,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,EAAE;IACnD,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,EAAE;IACrD,EAAE,KAAK,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,EAAE;IACxD,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE;IAC/C,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE;IACjD,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE;IAC9C,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE;CAClD,CAAC;AAEF;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,KAAa,EACb,MAAoB;IAEpB,OAAO,oBAAoB,CACzB,KAAK,EACL,MAAM,EACN,GAAG,KAAK,kEAAkE,CAC3E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC5B,WAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IACrE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CACxC,WAAW,EACX,mBAAmB,CACpB,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACxD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,WAAmB;IACxC,OAAO;QACL,QAAQ,EAAE,KAAK,EAAC,YAAY,EAAC,EAAE;YAC7B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAC9D,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACpC,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;YACrC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,WAAW;oBAAE,OAAO,IAAI,CAAC;gBAC9C,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,UAAU,EAAE,KAAK,EAAC,YAAY,EAAC,EAAE,CAC/B,CAAC,MAAM,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,KAAK,SAAS;KACnE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CACb,OAAa,EACb,SAAe,EACf,QAAkC;IAElC,MAAM,aAAa,GAAG,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,OAAO,oBAAoB,CAAC;QAC1B,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,UAAU,MAAM,CAAC,UAAU,EAAE,EAAE;QACtC,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,aAAa,CAAC,WAAW,EAAE;QACxC,QAAQ;QACR,OAAO,EAAE,uBAAuB,CAAC,QAAQ,CAAC;KAC3C,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,WAAmB,EACnB,QAAgB;IAEhB,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACnC,QAAQ,CAAC,QAAQ,CAAC;KACnB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;GASG;AACH,gHAAgH;AAChH,SAAS,MAAM,CACb,KAAkE,EAClE,WAA8B,EAC9B,KAAqC,EACrC,QAAwB,EACxB,OAAmC;IAEnC,MAAM,SAAS,GAAuB,KAAK,IAAI;QAC7C,KAAK,EAAE,EAAE;QACT,WAAW,EAAE,SAAS;KACvB,CAAC;IACF,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE;QAC5C,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC;KACxC,CAAC,CAAC;IACH,OAAO;QACL;YACE,GAAG,MAAM,CAAC,CAAC,CAAE;YACb,GAAG,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC;SACtE;QACD,EAAE,GAAG,MAAM,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;QAC5D,EAAE,GAAG,MAAM,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE;QACpD,EAAE,GAAG,MAAM,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,cAAc,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QACzE,EAAE,GAAG,MAAM,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,cAAc,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QACzE;YACE,GAAG,MAAM,CAAC,CAAC,CAAE;YACb,GAAG,EAAE,GAAG,EAAE,CACR,sBAAsB,CACpB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,WAAW,EACjB,SAAS,EACT,WAAW,CAAC,MAAM,CACnB;SACJ;QACD;YACE,GAAG,MAAM,CAAC,CAAC,CAAE;YACb,GAAG,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC;SACxE;QACD,EAAE,GAAG,MAAM,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;QACnE;YACE,GAAG,MAAM,CAAC,CAAC,CAAE;YACb,GAAG,EAAE,GAAG,EAAE,CACR,WAAW,CACT,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,WAAW,EACjB,SAAS,CAAC,KAAK,EACf,WAAW,CAAC,MAAM,EAClB,OAAO,CAAC,aAAa,IAAI,iBAAiB,EAC1C,QAAQ,CAAC,WAAW,EAAE,EACtB,QAAQ,CAAC,MAAM,CAChB;SACJ;QACD;YACE,GAAG,MAAM,CAAC,CAAC,CAAE;YACb,GAAG,EAAE,GAAG,EAAE,CACR,aAAa,CACX,KAAK,CAAC,WAAW,EACjB,WAAW,CAAC,MAAM,EAClB,SAAS,CAAC,KAAK,EACf,OAAO,CAAC,oBAAoB,IAAI,0BAA0B,EAC1D,QAAQ,CAAC,WAAW,EAAE,EACtB,QAAQ,CAAC,MAAM,CAChB;SACJ;QACD;YACE,GAAG,MAAM,CAAC,EAAE,CAAE;YACd,GAAG,EAAE,GAAG,EAAE,CACR,eAAe,CACb,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,WAAW,EACjB,SAAS,CAAC,KAAK,EACf,WAAW,CAAC,MAAM,CACnB;SACJ;QACD;YACE,GAAG,MAAM,CAAC,EAAE,CAAE;YACd,GAAG,EAAE,GAAG,EAAE,CACR,cAAc,CACZ,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,WAAW,EACjB,SAAS,CAAC,KAAK,EACf,WAAW,CAAC,MAAM,EAClB,OAAO,CAAC,YAAY,IAAI,kBAAkB,EAC1C,QAAQ,CAAC,WAAW,EAAE,EACtB,QAAQ,CAAC,MAAM,CAChB;SACJ;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,WAAmB,EACnB,UAAsC,EAAE;IAExC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;IACtB,MAAM,QAAQ,GAAG,IAAI,cAAc,CACjC,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAC1C,CAAC;IACF,IAAI,CAAC;QACH,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ;YAChB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,CAC9B,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,EACzC,SAAS,CACV,CAAC;QACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,MAAM,CACX,OAAO,EACP,GAAG,EAAE,EACL,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;gBACrD,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,KAAK;aAChB,CAAC;YACF,QAAQ,CAAC,GAAG,CACV,GAAG,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC,EACjD,SAAS,CACV;SACF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAC/D,QAAQ,CAAC,GAAG,CACV,KAAK,CAAC,GAAG,EACT,kBAAkB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CACnD,CACF,CACF,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC1C,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B,uHAAuH"}

package/dist/health/finding-utils.d.ts

@@ -0,0 +1,17 @@
+/** Stable, bounded deterministic health finding helpers. */
+import type { HealthFinding, HealthStatus } from "./contract.js";
+/**
+ * Create one deterministic finding.
+ * @param check
+ * @param status
+ * @param reason
+ */
+export declare function deterministicFinding(check: string, status: HealthStatus, reason: string): HealthFinding;
+/**
+ * Format a bounded sorted identifier list without exposing values.
+ * @param label - Stable human prefix
+ * @param names - Safe relative paths, keys, or public contract names
+ * @returns Bounded reason
+ */
+export declare function namedReason(label: string, names: readonly string[]): string;
+//# sourceMappingURL=finding-utils.d.ts.map

package/dist/health/finding-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding-utils.d.ts","sourceRoot":"","sources":["../../src/health/finding-utils.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAE5D,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAEjE;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,GACb,aAAa,CAEf;AAGD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAU3E"}

package/dist/health/finding-utils.js

@@ -0,0 +1,25 @@
+/**
+ * Create one deterministic finding.
+ * @param check
+ * @param status
+ * @param reason
+ */
+export function deterministicFinding(check, status, reason) {
+    return { check, layer: "deterministic", status, reason };
+}
+/* eslint-enable jsdoc/require-param-description, jsdoc/require-returns -- restore repository documentation defaults */
+/**
+ * Format a bounded sorted identifier list without exposing values.
+ * @param label - Stable human prefix
+ * @param names - Safe relative paths, keys, or public contract names
+ * @returns Bounded reason
+ */
+export function namedReason(label, names) {
+    const sorted = [...new Set(names)].sort((left, right) => left.localeCompare(right));
+    const shown = sorted.slice(0, 12);
+    const suffix = sorted.length > shown.length
+        ? ` (+${sorted.length - shown.length} more)`
+        : "";
+    return `${label}: ${shown.join(", ")}${suffix}`;
+}
+//# sourceMappingURL=finding-utils.js.map

package/dist/health/finding-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding-utils.js","sourceRoot":"","sources":["../../src/health/finding-utils.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAa,EACb,MAAoB,EACpB,MAAc;IAEd,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC3D,CAAC;AACD,uHAAuH;AAEvH;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,KAAwB;IACjE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACtD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAC1B,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClC,MAAM,MAAM,GACV,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;QAC1B,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,QAAQ;QAC5C,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,GAAG,KAAK,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC;AAClD,CAAC"}

package/dist/health/governance-probes.d.ts

@@ -0,0 +1,51 @@
+/** Template, package, hook, plugin, and CI deterministic health probes. */
+import type { ProjectType } from "../core/config.js";
+import type { HealthFinding } from "./contract.js";
+import { type HooksPathReader } from "./hook-inspection.js";
+import { type InstalledPluginReader } from "./plugin-inspection.js";
+import { type HealthProjectShape } from "./template-inspection.js";
+/**
+ * Managed template finding.
+ * @param lisaRoot
+ * @param projectRoot
+ * @param shape
+ * @param config
+ */
+export declare function managedTemplateFinding(lisaRoot: string, projectRoot: string, shape: HealthProjectShape, config: Readonly<Record<string, unknown>>): Promise<HealthFinding>;
+/**
+ * Package governance finding.
+ * @param lisaRoot
+ * @param projectRoot
+ * @param shape
+ */
+export declare function packageFinding(lisaRoot: string, projectRoot: string, shape: HealthProjectShape): Promise<HealthFinding>;
+/**
+ * Hook bytes, mode, and installed-state finding.
+ * @param lisaRoot
+ * @param projectRoot
+ * @param types
+ * @param config
+ * @param reader
+ * @param timeoutMs
+ * @param signal
+ */
+export declare function hookFinding(lisaRoot: string, projectRoot: string, types: readonly ProjectType[], config: Readonly<Record<string, unknown>>, reader: HooksPathReader, timeoutMs: number, signal: AbortSignal): Promise<HealthFinding>;
+/**
+ * Actual enabled and installed plugin finding.
+ * @param projectRoot
+ * @param config
+ * @param types
+ * @param reader
+ * @param timeoutMs
+ * @param signal
+ */
+export declare function pluginFinding(projectRoot: string, config: Readonly<Record<string, unknown>>, types: readonly ProjectType[], reader: InstalledPluginReader, timeoutMs: number, signal: AbortSignal): Promise<HealthFinding>;
+/**
+ * Workflow presence, managed bytes, and reusable-input contract finding.
+ * @param lisaRoot
+ * @param projectRoot
+ * @param types
+ * @param config
+ */
+export declare function workflowFinding(lisaRoot: string, projectRoot: string, types: readonly ProjectType[], config: Readonly<Record<string, unknown>>): Promise<HealthFinding>;
+//# sourceMappingURL=governance-probes.d.ts.map

package/dist/health/governance-probes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance-probes.d.ts","sourceRoot":"","sources":["../../src/health/governance-probes.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAE3E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAKL,KAAK,kBAAkB,EACxB,MAAM,0BAA0B,CAAC;AAMlC;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,kBAAkB,EACzB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxC,OAAO,CAAC,aAAa,CAAC,CAmBxB;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,aAAa,CAAC,CAkBxB;AACD;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,aAAa,CAAC,CAwBxB;AACD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,MAAM,EAAE,qBAAqB,EAC7B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,aAAa,CAAC,CAwBxB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxC,OAAO,CAAC,aAAa,CAAC,CAyBxB"}

package/dist/health/governance-probes.js

@@ -0,0 +1,94 @@
+import { deterministicFinding, namedReason } from "./finding-utils.js";
+import { inspectHookInstallation, } from "./hook-inspection.js";
+import { inspectPlugins, } from "./plugin-inspection.js";
+import { inspectCreateOnlyWorkflows, inspectManagedTemplates, inspectWorkflowInputs, packageJsonConforms, } from "./template-inspection.js";
+const HOOK_CHECK = "hooks.managed";
+const PLUGIN_CHECK = "plugins.current";
+const WORKFLOW_CHECK = "ci.workflows";
+/**
+ * Managed template finding.
+ * @param lisaRoot
+ * @param projectRoot
+ * @param shape
+ * @param config
+ */
+export async function managedTemplateFinding(lisaRoot, projectRoot, shape, config) {
+    const drift = await inspectManagedTemplates(lisaRoot, projectRoot, shape.types, "managed", config);
+    return drift.length === 0
+        ? deterministicFinding("templates.managed", "pass", "Managed files match their ownership-aware templates.")
+        : deterministicFinding("templates.managed", "fail", namedReason("Managed files do not match templates", drift));
+}
+/**
+ * Package governance finding.
+ * @param lisaRoot
+ * @param projectRoot
+ * @param shape
+ */
+export async function packageFinding(lisaRoot, projectRoot, shape) {
+    const conforms = await packageJsonConforms(lisaRoot, projectRoot, shape.types, shape.packageJson);
+    return conforms
+        ? deterministicFinding("package.conformance", "pass", "package.json conforms to Lisa governance.")
+        : deterministicFinding("package.conformance", "fail", "Package drift: package.json");
+}
+/**
+ * Hook bytes, mode, and installed-state finding.
+ * @param lisaRoot
+ * @param projectRoot
+ * @param types
+ * @param config
+ * @param reader
+ * @param timeoutMs
+ * @param signal
+ */
+export async function hookFinding(lisaRoot, projectRoot, types, config, reader, timeoutMs, signal) {
+    const [templateDrift, installed] = await Promise.all([
+        inspectManagedTemplates(lisaRoot, projectRoot, types, "hooks", config),
+        inspectHookInstallation(projectRoot, types, reader, timeoutMs, signal),
+    ]);
+    const drift = [...templateDrift, ...installed.drift];
+    if (templateDrift.length > 0 || installed.status === "fail") {
+        return deterministicFinding(HOOK_CHECK, "fail", namedReason("Git hook drift", drift));
+    }
+    return installed.status === "warn"
+        ? deterministicFinding(HOOK_CHECK, "warn", namedReason("Git hook state unavailable", installed.drift))
+        : deterministicFinding(HOOK_CHECK, "pass", "Git hook bytes, modes, and installation are current.");
+}
+/**
+ * Actual enabled and installed plugin finding.
+ * @param projectRoot
+ * @param config
+ * @param types
+ * @param reader
+ * @param timeoutMs
+ * @param signal
+ */
+export async function pluginFinding(projectRoot, config, types, reader, timeoutMs, signal) {
+    const inspected = await inspectPlugins(projectRoot, config, types, reader, timeoutMs, signal);
+    if (inspected.status === "pass") {
+        return deterministicFinding(PLUGIN_CHECK, "pass", "Lisa plugins are enabled, installed, and version-current.");
+    }
+    return deterministicFinding(PLUGIN_CHECK, inspected.status, namedReason(inspected.status === "warn" ? "Plugin state unavailable" : "Plugin drift", inspected.drift));
+}
+/**
+ * Workflow presence, managed bytes, and reusable-input contract finding.
+ * @param lisaRoot
+ * @param projectRoot
+ * @param types
+ * @param config
+ */
+export async function workflowFinding(lisaRoot, projectRoot, types, config) {
+    const [managed, missing, inputs] = await Promise.all([
+        inspectManagedTemplates(lisaRoot, projectRoot, types, "workflows", config),
+        inspectCreateOnlyWorkflows(lisaRoot, projectRoot, types, config),
+        inspectWorkflowInputs(lisaRoot, projectRoot, types, config),
+    ]);
+    const drift = [...managed, ...missing, ...inputs.stale];
+    if (drift.length > 0) {
+        return deterministicFinding(WORKFLOW_CHECK, "fail", namedReason("CI workflow drift", drift));
+    }
+    return inputs.unknown.length > 0
+        ? deterministicFinding(WORKFLOW_CHECK, "warn", namedReason("Reusable workflow contracts unavailable", inputs.unknown))
+        : deterministicFinding(WORKFLOW_CHECK, "pass", "CI workflows are present and caller inputs match shipped contracts.");
+}
+/* eslint-enable jsdoc/require-param-description, jsdoc/require-returns -- restore repository documentation defaults */
+//# sourceMappingURL=governance-probes.js.map

package/dist/health/governance-probes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance-probes.js","sourceRoot":"","sources":["../../src/health/governance-probes.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EACL,uBAAuB,GAExB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,cAAc,GAEf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,GAEpB,MAAM,0BAA0B,CAAC;AAElC,MAAM,UAAU,GAAG,eAAe,CAAC;AACnC,MAAM,YAAY,GAAG,iBAAiB,CAAC;AACvC,MAAM,cAAc,GAAG,cAAc,CAAC;AAEtC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAAgB,EAChB,WAAmB,EACnB,KAAyB,EACzB,MAAyC;IAEzC,MAAM,KAAK,GAAG,MAAM,uBAAuB,CACzC,QAAQ,EACR,WAAW,EACX,KAAK,CAAC,KAAK,EACX,SAAS,EACT,MAAM,CACP,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,oBAAoB,CAClB,mBAAmB,EACnB,MAAM,EACN,sDAAsD,CACvD;QACH,CAAC,CAAC,oBAAoB,CAClB,mBAAmB,EACnB,MAAM,EACN,WAAW,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAC3D,CAAC;AACR,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,WAAmB,EACnB,KAAyB;IAEzB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CACxC,QAAQ,EACR,WAAW,EACX,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,WAAW,CAClB,CAAC;IACF,OAAO,QAAQ;QACb,CAAC,CAAC,oBAAoB,CAClB,qBAAqB,EACrB,MAAM,EACN,2CAA2C,CAC5C;QACH,CAAC,CAAC,oBAAoB,CAClB,qBAAqB,EACrB,MAAM,EACN,6BAA6B,CAC9B,CAAC;AACR,CAAC;AACD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,EAChB,WAAmB,EACnB,KAA6B,EAC7B,MAAyC,EACzC,MAAuB,EACvB,SAAiB,EACjB,MAAmB;IAEnB,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,uBAAuB,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACtE,uBAAuB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC;KACvE,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,CAAC,GAAG,aAAa,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC5D,OAAO,oBAAoB,CACzB,UAAU,EACV,MAAM,EACN,WAAW,CAAC,gBAAgB,EAAE,KAAK,CAAC,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,KAAK,MAAM;QAChC,CAAC,CAAC,oBAAoB,CAClB,UAAU,EACV,MAAM,EACN,WAAW,CAAC,4BAA4B,EAAE,SAAS,CAAC,KAAK,CAAC,CAC3D;QACH,CAAC,CAAC,oBAAoB,CAClB,UAAU,EACV,MAAM,EACN,sDAAsD,CACvD,CAAC;AACR,CAAC;AACD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB,EACnB,MAAyC,EACzC,KAA6B,EAC7B,MAA6B,EAC7B,SAAiB,EACjB,MAAmB;IAEnB,MAAM,SAAS,GAAG,MAAM,cAAc,CACpC,WAAW,EACX,MAAM,EACN,KAAK,EACL,MAAM,EACN,SAAS,EACT,MAAM,CACP,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAChC,OAAO,oBAAoB,CACzB,YAAY,EACZ,MAAM,EACN,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,oBAAoB,CACzB,YAAY,EACZ,SAAS,CAAC,MAAM,EAChB,WAAW,CACT,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,cAAc,EACzE,SAAS,CAAC,KAAK,CAChB,CACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,WAAmB,EACnB,KAA6B,EAC7B,MAAyC;IAEzC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,uBAAuB,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC;QAC1E,0BAA0B,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC;QAChE,qBAAqB,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC;KAC5D,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,oBAAoB,CACzB,cAAc,EACd,MAAM,EACN,WAAW,CAAC,mBAAmB,EAAE,KAAK,CAAC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAC9B,CAAC,CAAC,oBAAoB,CAClB,cAAc,EACd,MAAM,EACN,WAAW,CAAC,yCAAyC,EAAE,MAAM,CAAC,OAAO,CAAC,CACvE;QACH,CAAC,CAAC,oBAAoB,CAClB,cAAc,EACd,MAAM,EACN,qEAAqE,CACtE,CAAC;AACR,CAAC;AACD,uHAAuH"}

package/dist/health/hook-inspection.d.ts

@@ -0,0 +1,35 @@
+import type { ProjectType } from "../core/config.js";
+/**
+ * Injectable reader for repository-local core.hooksPath. Implementations must
+ * honor `signal` and release any owned handles before settling.
+ */
+export type HooksPathReader = (projectRoot: string, timeoutMs: number, signal: AbortSignal) => Promise<string | undefined>;
+/** Hook installation outcome. */
+export type HookInstallationInspection = {
+    readonly status: "pass";
+    readonly drift: readonly string[];
+} | {
+    readonly status: "warn";
+    readonly drift: readonly string[];
+} | {
+    readonly status: "fail";
+    readonly drift: readonly string[];
+};
+/**
+ * Default fixed-argv local git-config reader.
+ * @param projectRoot
+ * @param timeoutMs
+ * @param signal
+ */
+export declare const readCoreHooksPath: HooksPathReader;
+/**
+ * Inspect actual installed hook state for applicable stacks.
+ * @param projectRoot - Canonical host root
+ * @param types - Safely detected project types
+ * @param reader - core.hooksPath reader
+ * @param timeoutMs - Remaining shared deadline
+ * @param signal - Shared cancellation signal
+ * @returns Hook installation status
+ */
+export declare function inspectHookInstallation(projectRoot: string, types: readonly ProjectType[], reader: HooksPathReader, timeoutMs: number, signal: AbortSignal): Promise<HookInstallationInspection>;
+//# sourceMappingURL=hook-inspection.d.ts.map

package/dist/health/hook-inspection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-inspection.d.ts","sourceRoot":"","sources":["../../src/health/hook-inspection.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAuBrD;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,CAC5B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,KAChB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;AAEjC,iCAAiC;AACjC,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,eA8B5B,CAAC;AA4DL;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,0BAA0B,CAAC,CAyBrC"}