@codyswann/lisa 2.281.0 → 2.283.0

package/dist/standards/git-state.js

@@ -0,0 +1,179 @@
+/** Bounded, no-shell Git observation for standards proof freshness. */
+import { execFile } from "node:child_process";
+import { realpath } from "node:fs/promises";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+const GIT_TIMEOUT_MS = 5_000;
+const MAX_GIT_OUTPUT_BYTES = 64 * 1024;
+/**
+ * Read canonical identity, commit/tree objects, and complete nonignored dirt.
+ * Git optional locks and fsmonitor are disabled because UI observation must be
+ * read-only and safe to repeat.
+ * @param projectRoot - Path within the repository
+ * @returns Bounded repository state
+ */
+export async function readStandardsGitState(projectRoot) {
+    const requested = await realpath(projectRoot);
+    const root = await realpath(await git(requested, ["rev-parse", "--show-toplevel"]));
+    const remoteNames = (await git(root, ["remote"], true))
+        .split("\n")
+        .map(value => value.trim())
+        .filter(Boolean);
+    const remoteUrls = remoteNames.includes("origin")
+        ? (await git(root, ["remote", "get-url", "--all", "origin"]))
+            .split("\n")
+            .map(value => value.trim())
+            .filter(Boolean)
+        : [];
+    if (remoteUrls.length !== 1) {
+        throw new Error(remoteUrls.length === 0
+            ? "Repository origin is missing."
+            : "Repository origin is ambiguous.");
+    }
+    const [head, tree, status] = await Promise.all([
+        git(root, ["rev-parse", "HEAD"]),
+        git(root, ["rev-parse", "HEAD^{tree}"]),
+        git(root, [
+            "status",
+            "--porcelain=v1",
+            "--untracked-files=all",
+            "--ignore-submodules=none",
+            "--",
+            ".",
+            ":(exclude).lisa/standards/latest.json",
+        ], true),
+    ]);
+    return Object.freeze({
+        root,
+        identity: normalizeGitRemoteIdentity(remoteUrls[0]),
+        head,
+        tree,
+        clean: status.length === 0,
+    });
+}
+/**
+ * Require a parent commit for the non-vacuous threshold-ratchet comparison.
+ * @param projectRoot - Canonical repository root
+ * @returns Parent commit object identifier
+ */
+export async function requireStandardsBaseCommit(projectRoot) {
+    try {
+        return await git(projectRoot, ["rev-parse", "HEAD^"]);
+    }
+    catch {
+        const isShallow = (await git(projectRoot, ["rev-parse", "--is-shallow-repository"])) ===
+            "true";
+        if (isShallow) {
+            throw new Error("Standards proof requires more Git history for threshold comparison in a shallow clone. Run `git fetch --deepen=1` and retry.");
+        }
+        throw new Error("Standards proof requires a parent commit for threshold comparison.");
+    }
+}
+/**
+ * Normalize HTTPS, SSH URL, and SCP-like remotes to host[:port]/owner/repo.
+ * Credentials are never retained and default transport ports are removed.
+ * @param remote - One configured origin URL
+ * @returns Stable lowercase repository identity
+ */
+export function normalizeGitRemoteIdentity(remote) {
+    const trimmed = remote.trim();
+    const scp = /^(?:[^@/:]+@)?([^/:]+):(.+)$/u.exec(trimmed);
+    if (scp && !trimmed.includes("://")) {
+        return finishIdentity(scp[1], scp[2]);
+    }
+    const parsed = parseRemoteUrl(trimmed);
+    if (!["https:", "http:", "ssh:", "git:"].includes(parsed.protocol)) {
+        throw new Error("Repository origin uses an unsupported protocol.");
+    }
+    const defaultPort = (parsed.protocol === "https:" && parsed.port === "443") ||
+        (parsed.protocol === "http:" && parsed.port === "80") ||
+        ((parsed.protocol === "ssh:" || parsed.protocol === "git:") &&
+            parsed.port === "22");
+    const authority = `${parsed.hostname}${parsed.port && !defaultPort ? `:${parsed.port}` : ""}`;
+    return finishIdentity(authority, parsed.pathname);
+}
+/**
+ * Complete and validate a normalized repository identity.
+ * @param authority - Lower-level remote host and optional non-default port
+ * @param pathname - Remote repository path
+ * @returns Normalized stable repository identity
+ */
+function finishIdentity(authority, pathname) {
+    const normalizedPath = pathname
+        .split("/")
+        .filter(Boolean)
+        .join("/")
+        .replace(/\.git$/iu, "")
+        .toLowerCase();
+    const normalizedAuthority = authority.toLowerCase();
+    if (normalizedAuthority.length === 0 ||
+        normalizedPath.length === 0 ||
+        normalizedPath.includes("..") ||
+        !normalizedPath.includes("/")) {
+        throw new Error("Repository origin does not identify an owner/repository.");
+    }
+    return `${normalizedAuthority}/${normalizedPath}`;
+}
+/**
+ * Parse one URL without retaining credentials in any result.
+ * @param remote - Remote URL candidate
+ * @returns Parsed URL object
+ */
+function parseRemoteUrl(remote) {
+    try {
+        return new URL(remote);
+    }
+    catch {
+        throw new Error("Repository origin is not a supported Git remote URL.");
+    }
+}
+/**
+ * Run one bounded read-only Git command without shell interpolation.
+ * @param cwd - Repository working directory
+ * @param args - Fixed Git arguments
+ * @param allowEmpty - Whether an empty stdout value is valid
+ * @returns Trimmed bounded stdout
+ */
+async function git(cwd, args, allowEmpty = false) {
+    try {
+        const { stdout } = await execFileAsync("git", [
+            "-c",
+            "core.fsmonitor=false",
+            "-c",
+            "core.untrackedCache=false",
+            ...args,
+        ], {
+            cwd,
+            timeout: GIT_TIMEOUT_MS,
+            maxBuffer: MAX_GIT_OUTPUT_BYTES,
+            encoding: "utf8",
+            env: {
+                ...getProcessEnvironment(),
+                GIT_OPTIONAL_LOCKS: "0",
+                GIT_DIR: undefined,
+                GIT_WORK_TREE: undefined,
+                GIT_INDEX_FILE: undefined,
+            },
+        });
+        const output = stdout.trim();
+        if (!allowEmpty && output.length === 0) {
+            throw new Error("Git returned no repository state.");
+        }
+        return output;
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith("Repository ")) {
+            throw error;
+        }
+        throw new Error("Git repository state could not be observed.");
+    }
+}
+/**
+ * Read the CLI environment at one reviewable process boundary.
+ * @returns Current process environment
+ */
+function getProcessEnvironment() {
+    // eslint-disable-next-line no-restricted-syntax -- Git must inherit the operator toolchain while clearing repository redirects
+    return process.env;
+}
+//# sourceMappingURL=git-state.js.map

package/dist/standards/git-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-state.js","sourceRoot":"","sources":["../../src/standards/git-state.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AAWvC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,WAAmB;IAEnB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CACvD,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;SACpD,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,UAAU,GAAG,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/C,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;aACxD,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC;QACpB,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,UAAU,CAAC,MAAM,KAAK,CAAC;YACrB,CAAC,CAAC,+BAA+B;YACjC,CAAC,CAAC,iCAAiC,CACtC,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7C,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAChC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACvC,GAAG,CACD,IAAI,EACJ;YACE,QAAQ;YACR,gBAAgB;YAChB,uBAAuB;YACvB,0BAA0B;YAC1B,IAAI;YACJ,GAAG;YACH,uCAAuC;SACxC,EACD,IAAI,CACL;KACF,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI;QACJ,QAAQ,EAAE,0BAA0B,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC;QACpD,IAAI;QACJ,IAAI;QACJ,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;KAC3B,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAAmB;IAEnB,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,SAAS,GACb,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAC;YAClE,MAAM,CAAC;QACT,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,8HAA8H,CAC/H,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAc;IACvD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,WAAW,GACf,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC;QACvD,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC;QACrD,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC;YACzD,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC1B,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,QAAQ,GAClC,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EACpD,EAAE,CAAC;IACH,OAAO,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,SAAiB,EAAE,QAAgB;IACzD,MAAM,cAAc,GAAG,QAAQ;SAC5B,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC;SACT,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,WAAW,EAAE,CAAC;IACjB,MAAM,mBAAmB,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IACpD,IACE,mBAAmB,CAAC,MAAM,KAAK,CAAC;QAChC,cAAc,CAAC,MAAM,KAAK,CAAC;QAC3B,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC7B,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAC7B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,GAAG,mBAAmB,IAAI,cAAc,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,GAAG,CAChB,GAAW,EACX,IAAuB,EACvB,UAAU,GAAG,KAAK;IAElB,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpC,KAAK,EACL;YACE,IAAI;YACJ,sBAAsB;YACtB,IAAI;YACJ,2BAA2B;YAC3B,GAAG,IAAI;SACR,EACD;YACE,GAAG;YACH,OAAO,EAAE,cAAc;YACvB,SAAS,EAAE,oBAAoB;YAC/B,QAAQ,EAAE,MAAM;YAChB,GAAG,EAAE;gBACH,GAAG,qBAAqB,EAAE;gBAC1B,kBAAkB,EAAE,GAAG;gBACvB,OAAO,EAAE,SAAS;gBAClB,aAAa,EAAE,SAAS;gBACxB,cAAc,EAAE,SAAS;aAC1B;SACF,CACF,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACtE,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB;IAC5B,+HAA+H;IAC/H,OAAO,OAAO,CAAC,GAAG,CAAC;AACrB,CAAC"}

package/dist/standards/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./capture.js";
+export * from "./contract.js";
+export * from "./git-state.js";
+export * from "./readiness.js";
+export * from "./registry.js";
+export * from "./storage.js";
+export * from "./test-evidence.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/standards/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/standards/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC"}

package/dist/standards/index.js

@@ -0,0 +1,8 @@
+export * from "./capture.js";
+export * from "./contract.js";
+export * from "./git-state.js";
+export * from "./readiness.js";
+export * from "./registry.js";
+export * from "./storage.js";
+export * from "./test-evidence.js";
+//# sourceMappingURL=index.js.map

package/dist/standards/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/standards/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC"}

package/dist/standards/readiness.d.ts

@@ -0,0 +1,11 @@
+import type { SetupReadinessFinding } from "../cli/ui-setup-readiness-contract.js";
+/**
+ * Validate the stored proof against current Git, stack, config, registry, and
+ * Lisa version without executing project commands or writing any state.
+ * Strict recomputation rejects casual tampering; defending against a malicious
+ * actor who can rewrite both repository inputs and local proof is out of scope.
+ * @param projectRoot - Canonical project root
+ * @returns setup.standards proof contribution
+ */
+export declare function standardsProofFinding(projectRoot: string): Promise<SetupReadinessFinding>;
+//# sourceMappingURL=readiness.d.ts.map

package/dist/standards/readiness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"readiness.d.ts","sourceRoot":"","sources":["../../src/standards/readiness.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAoBnF;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,qBAAqB,CAAC,CA8BhC"}

package/dist/standards/readiness.js

@@ -0,0 +1,170 @@
+/** Read-only setup.standards proof validation and freshness recomputation. */
+import { getPackageVersion } from "../cli/version.js";
+import { readConfinedDetectedStacks } from "../cli/ui-detected-stacks.js";
+import { readConfinedMergedConfig } from "../cli/ui-confined-project-read.js";
+import { setupFinding } from "../cli/ui-setup-readiness-contract.js";
+import { readStandardsGitState } from "./git-state.js";
+import { resolveStandardsCheckPlan, } from "./registry.js";
+import { readStandardsProof } from "./storage.js";
+const STANDARDS_FINDING_ID = "setup.standards";
+const PROOF_COMMAND_HINT = "Run lisa standards-proof.";
+const OBSERVATION_REASONS = Object.freeze({
+    git: "Git repository identity and state could not be observed",
+    stacks: "project stack detection could not be completed",
+    config: "local Lisa configuration is malformed or unreadable",
+    plan: "required standards check plan is incomplete or unavailable",
+    generic: "current standards proof inputs could not be observed",
+});
+/**
+ * Validate the stored proof against current Git, stack, config, registry, and
+ * Lisa version without executing project commands or writing any state.
+ * Strict recomputation rejects casual tampering; defending against a malicious
+ * actor who can rewrite both repository inputs and local proof is out of scope.
+ * @param projectRoot - Canonical project root
+ * @returns setup.standards proof contribution
+ */
+export async function standardsProofFinding(projectRoot) {
+    const stored = await readStandardsProof(projectRoot);
+    if (stored.status === "missing") {
+        return setupFinding(STANDARDS_FINDING_ID, "warn", `Standards proof is missing. ${PROOF_COMMAND_HINT}`);
+    }
+    if (stored.status === "unreadable") {
+        return setupFinding(STANDARDS_FINDING_ID, "fail", `Standards proof is unreadable: ${stored.reason}. ${PROOF_COMMAND_HINT}`);
+    }
+    const proof = stored.proof;
+    if (proof.lisaVersion !== getPackageVersion()) {
+        return stale("Lisa version changed");
+    }
+    const gitObservation = await observeCurrentInput(async () => await readStandardsGitState(projectRoot), OBSERVATION_REASONS.git);
+    if (gitObservation.status === "unavailable")
+        return gitObservation.finding;
+    const repositoryCause = repositoryStaleCause(proof, gitObservation.value);
+    if (repositoryCause !== undefined)
+        return stale(repositoryCause);
+    const observation = await observeCurrentPlanInputs(gitObservation.value);
+    if (observation.status === "unavailable")
+        return observation.finding;
+    return evaluateProofFreshness(proof, observation.value);
+}
+/**
+ * Observe current project and plan inputs without running quality commands.
+ * @param git - Previously validated repository state
+ * @returns Available plan inputs or the first fail-closed finding
+ */
+async function observeCurrentPlanInputs(git) {
+    const stackObservation = await observeCurrentInput(async () => await readConfinedDetectedStacks(git.root), OBSERVATION_REASONS.stacks);
+    if (stackObservation.status === "unavailable")
+        return stackObservation;
+    const projectTypes = stackObservation.value;
+    const configObservation = await observeCurrentInput(async () => await readConfinedMergedConfig(git.root), OBSERVATION_REASONS.config);
+    if (configObservation.status === "unavailable")
+        return configObservation;
+    const config = configObservation.value;
+    const planObservation = await observeCurrentInput(async () => await resolveStandardsCheckPlan(git.root, projectTypes, config), OBSERVATION_REASONS.plan);
+    if (planObservation.status === "unavailable")
+        return planObservation;
+    return {
+        status: "available",
+        value: {
+            projectTypes,
+            plan: planObservation.value,
+        },
+    };
+}
+/**
+ * Compare a stored proof with freshly observed inputs.
+ * @param proof - Strict stored standards proof
+ * @param current - Fresh repository and plan inputs
+ * @returns Current pass or stale/unavailable finding
+ */
+function evaluateProofFreshness(proof, current) {
+    try {
+        const cause = planStaleCause(proof, current);
+        if (cause !== undefined)
+            return stale(cause);
+        return setupFinding(STANDARDS_FINDING_ID, "pass", "Managed standards and automated lint, analysis, test, guardrail, and threshold conformance are current for this Git artifact.");
+    }
+    catch {
+        return observationFailed(OBSERVATION_REASONS.generic);
+    }
+}
+/**
+ * Find the first repository-state mismatch.
+ * @param proof - Stored proof
+ * @param git - Current repository state
+ * @returns Operator-readable stale cause, when present
+ */
+function repositoryStaleCause(proof, git) {
+    if (!git.clean)
+        return "tracked or nonignored worktree state changed";
+    if (git.identity !== proof.repository.identity)
+        return "repository identity changed";
+    if (git.head !== proof.repository.head)
+        return "HEAD changed";
+    if (git.tree !== proof.repository.tree)
+        return "Git tree changed";
+    return undefined;
+}
+/**
+ * Find the first project-plan or result mismatch.
+ * @param proof - Stored proof
+ * @param current - Current project types and standards plan
+ * @returns Operator-readable stale cause, when present
+ */
+function planStaleCause(proof, current) {
+    const { plan, projectTypes } = current;
+    if (JSON.stringify(projectTypes) !== JSON.stringify(proof.projectTypes))
+        return "detected project types changed";
+    if (plan.configDigest !== proof.configDigest)
+        return "Lisa configuration changed";
+    if (plan.registryDigest !== proof.registryDigest)
+        return "standards registry changed";
+    const expected = plan.checks.map(check => check.id);
+    if (JSON.stringify(expected) !== JSON.stringify(proof.applicableChecks))
+        return "required check membership changed";
+    if (hasIncompleteResults(proof, plan))
+        return "required check results are incomplete";
+    return undefined;
+}
+/**
+ * Determine whether any stored result differs from its required check.
+ * @param proof - Stored proof
+ * @param plan - Current standards check plan
+ * @returns Whether required result evidence is incomplete
+ */
+function hasIncompleteResults(proof, plan) {
+    return proof.results.some((result, index) => result.check !== plan.checks[index]?.id ||
+        result.category !== plan.checks[index]?.category ||
+        result.status !== "pass");
+}
+/**
+ * Create a stale-proof warning with the remediation command.
+ * @param cause - Operator-readable stale cause
+ * @returns Stale standards finding
+ */
+function stale(cause) {
+    return setupFinding(STANDARDS_FINDING_ID, "warn", `Standards proof is stale: ${cause}. ${PROOF_COMMAND_HINT}`);
+}
+/**
+ * Create a fail-closed observation warning with the remediation command.
+ * @param reason - Sanitized observation failure reason
+ * @returns Fail-closed standards finding
+ */
+function observationFailed(reason) {
+    return setupFinding(STANDARDS_FINDING_ID, "warn", `Standards proof freshness could not be established: ${reason}. ${PROOF_COMMAND_HINT}`);
+}
+/**
+ * Convert one throwing observation into a fail-closed result.
+ * @param operation - Read-only operation to execute
+ * @param reason - Sanitized reason to expose if observation fails
+ * @returns Available value or sanitized unavailable finding
+ */
+async function observeCurrentInput(operation, reason) {
+    try {
+        return { status: "available", value: await operation() };
+    }
+    catch {
+        return { status: "unavailable", finding: observationFailed(reason) };
+    }
+}
+//# sourceMappingURL=readiness.js.map

package/dist/standards/readiness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readiness.js","sourceRoot":"","sources":["../../src/standards/readiness.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAE9E,OAAO,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAErE,OAAO,EAAE,qBAAqB,EAA0B,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EACL,yBAAyB,GAE1B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AAC/C,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AACvD,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,yDAAyD;IAC9D,MAAM,EAAE,gDAAgD;IACxD,MAAM,EAAE,qDAAqD;IAC7D,IAAI,EAAE,4DAA4D;IAClE,OAAO,EAAE,sDAAsD;CAChE,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,WAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,YAAY,CACjB,oBAAoB,EACpB,MAAM,EACN,+BAA+B,kBAAkB,EAAE,CACpD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QACnC,OAAO,YAAY,CACjB,oBAAoB,EACpB,MAAM,EACN,kCAAkC,MAAM,CAAC,MAAM,KAAK,kBAAkB,EAAE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,KAAK,CAAC,WAAW,KAAK,iBAAiB,EAAE,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,mBAAmB,CAC9C,KAAK,IAAI,EAAE,CAAC,MAAM,qBAAqB,CAAC,WAAW,CAAC,EACpD,mBAAmB,CAAC,GAAG,CACxB,CAAC;IACF,IAAI,cAAc,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,cAAc,CAAC,OAAO,CAAC;IAC3E,MAAM,eAAe,GAAG,oBAAoB,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;IAC1E,IAAI,eAAe,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,eAAe,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,MAAM,wBAAwB,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACzE,IAAI,WAAW,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,WAAW,CAAC,OAAO,CAAC;IACrE,OAAO,sBAAsB,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAQD;;;;GAIG;AACH,KAAK,UAAU,wBAAwB,CACrC,GAAsB;IAEtB,MAAM,gBAAgB,GAAG,MAAM,mBAAmB,CAChD,KAAK,IAAI,EAAE,CAAC,MAAM,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,EACtD,mBAAmB,CAAC,MAAM,CAC3B,CAAC;IACF,IAAI,gBAAgB,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,gBAAgB,CAAC;IACvE,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,CAAC;IAC5C,MAAM,iBAAiB,GAAG,MAAM,mBAAmB,CACjD,KAAK,IAAI,EAAE,CAAC,MAAM,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,EACpD,mBAAmB,CAAC,MAAM,CAC3B,CAAC;IACF,IAAI,iBAAiB,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,iBAAiB,CAAC;IACzE,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC;IACvC,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAC/C,KAAK,IAAI,EAAE,CAAC,MAAM,yBAAyB,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,EAC3E,mBAAmB,CAAC,IAAI,CACzB,CAAC;IACF,IAAI,eAAe,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,eAAe,CAAC;IACrE,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE;YACL,YAAY;YACZ,IAAI,EAAE,eAAe,CAAC,KAAK;SAC5B;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAC7B,KAAqB,EACrB,OAA0B;IAE1B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC7C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,YAAY,CACjB,oBAAoB,EACpB,MAAM,EACN,+HAA+H,CAChI,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,KAAqB,EACrB,GAAsB;IAEtB,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO,8CAA8C,CAAC;IACtE,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,UAAU,CAAC,QAAQ;QAC5C,OAAO,6BAA6B,CAAC;IACvC,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU,CAAC,IAAI;QAAE,OAAO,cAAc,CAAC;IAC9D,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU,CAAC,IAAI;QAAE,OAAO,kBAAkB,CAAC;IAClE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CACrB,KAAqB,EACrB,OAA0B;IAE1B,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IACvC,IAAI,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC;QACrE,OAAO,gCAAgC,CAAC;IAC1C,IAAI,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;QAC1C,OAAO,4BAA4B,CAAC;IACtC,IAAI,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC9C,OAAO,4BAA4B,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACrE,OAAO,mCAAmC,CAAC;IAC7C,IAAI,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC;QACnC,OAAO,uCAAuC,CAAC;IACjD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,KAAqB,EACrB,IAAwB;IAExB,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CACvB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAChB,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE;QACvC,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ;QAChD,MAAM,CAAC,MAAM,KAAK,MAAM,CAC3B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,YAAY,CACjB,oBAAoB,EACpB,MAAM,EACN,6BAA6B,KAAK,KAAK,kBAAkB,EAAE,CAC5D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,YAAY,CACjB,oBAAoB,EACpB,MAAM,EACN,uDAAuD,MAAM,KAAK,kBAAkB,EAAE,CACvF,CAAC;AACJ,CAAC;AAOD;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAChC,SAA2B,EAC3B,MAAc;IAEd,IAAI,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,SAAS,EAAE,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;IACvE,CAAC;AACH,CAAC"}

package/dist/standards/registry.d.ts

@@ -0,0 +1,42 @@
+import type { ProjectType } from "../core/config.js";
+import { type JsonObject } from "../sync/json-path.js";
+import type { StandardsCheckCategory } from "./contract.js";
+import { type TestEvidenceFormat } from "./test-evidence.js";
+/** One fixed, no-shell command in the current standards registry. */
+export interface StandardsCheckSpec {
+    readonly id: string;
+    readonly category: StandardsCheckCategory;
+    readonly argv: readonly [string, ...string[]];
+    readonly timeoutMs: number;
+    readonly testEvidence?: TestEvidenceFormat;
+    readonly environment?: Readonly<Record<string, string>>;
+}
+/** Fully resolved current check plan and its tamper-evident registry digest. */
+export interface StandardsCheckPlan {
+    readonly checks: readonly StandardsCheckSpec[];
+    readonly registryDigest: string;
+    readonly configDigest: string;
+}
+/**
+ * Resolve the exact ordered union of checks for current detected stacks.
+ * Missing managed scripts and threshold tooling fail before any command runs.
+ * @param projectRoot - Canonical project root
+ * @param projectTypes - Expanded, canonical detected types
+ * @param config - Current bounded merged Lisa config
+ * @returns Closed current check plan
+ */
+export declare function resolveStandardsCheckPlan(// eslint-disable-line max-lines-per-function -- the closed multi-stack registry is one auditable ordered plan
+projectRoot: string, projectTypes: readonly ProjectType[], config: JsonObject): Promise<StandardsCheckPlan>;
+/**
+ * Digest only configuration that changes standards applicability or policy.
+ * @param config - Current merged Lisa config
+ * @returns Canonical standards configuration digest
+ */
+export declare function digestStandardsConfig(config: JsonObject): string;
+/**
+ * Return a canonical SHA-256 digest without retaining config values.
+ * @param value - JSON-like value to digest
+ * @returns Canonical SHA-256 digest
+ */
+export declare function digestStandardsValue(value: unknown): string;
+//# sourceMappingURL=registry.d.ts.map

package/dist/standards/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/standards/registry.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,oBAAoB,CAAC;AAE5B,qEAAqE;AACrE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACzD;AAED,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC/C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAyKD;;;;;;;GAOG;AAEH,wBAAsB,yBAAyB,CAAE,8GAA8G;AAC7J,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,SAAS,WAAW,EAAE,EACpC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,kBAAkB,CAAC,CA8G7B;AAqBD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAKhE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE3D"}