@codyswann/lisa 3.51.7 → 3.53.0

package/dist/core/gate-declaration-drift.js

@@ -0,0 +1,300 @@
+/**
+ * Hold the gates declaration against the ruleset that enforces it.
+ *
+ * Three surfaces answer "what must pass before this merges" — the project's
+ * `gates` declarations, the shipped ruleset template, and the live GitHub
+ * ruleset — and until this module existed no comparator joined the first to
+ * either of the others. `contextsFor()` derived contexts from declarations,
+ * `lisa health` compared template against live, and the two halves never met,
+ * so a declaration and the protection enforcing it could disagree indefinitely
+ * with every check green.
+ *
+ * Two properties are load-bearing, and both are structural rather than
+ * conventional:
+ *
+ * 1. **`off` and undeclared are different findings.** `off` is a decision that
+ *    a property is not proved here, so protection requiring it is a live
+ *    contradiction. Undeclared is silence — the registry still has gates whose
+ *    jobs run with no declaration at all, so silence must never be read as
+ *    "not required", and must never justify removing live protection.
+ * 2. **Agreement is not proof.** A `matched` verdict means the declaration and
+ *    the ruleset name the same required context. It says nothing about whether
+ *    that context proves anything: one required context in this repository
+ *    ships a skip step printing "This job going green does NOT mean any
+ *    ast-grep rule has test coverage", and a required review context has gone
+ *    green carrying "Review skipped". A drift report that could not tell
+ *    "agreed and proved" from "agreed and unproved" would itself be a control
+ *    reporting more than it measured, so the word this module uses is
+ *    `matched` — the two surfaces agree — and never `enforced` or `proved`.
+ * 3. **No remedy in this module can say "remove the context".** Third-party
+ *    contexts are enforced by construction and declared by nobody; a
+ *    comparator whose vocabulary contained a removal would eventually propose
+ *    deleting one. The `DriftRemedy` union simply has no such member, so the
+ *    guarantee holds for every caller rather than for the careful ones.
+ * @module core/gate-declaration-drift
+ */
+/** The moment a branch ruleset guards. */
+export const MERGE_MOMENT = "pull-request";
+/** Every verdict, named once so no two mentions can drift apart. */
+const MATCHED = "matched";
+const DECLARED_NOT_ENFORCED = "declared-not-enforced";
+const ENFORCED_DECLARED_OPTIONAL = "enforced-declared-optional";
+const ENFORCED_DECLARED_OFF = "enforced-declared-off";
+const ENFORCED_UNDECLARED = "enforced-undeclared";
+const ENFORCED_NOT_LISA_OWNED = "enforced-not-lisa-owned";
+/** Verdicts where the two surfaces state opposite things. */
+const CONTRADICTIONS = new Set([
+    DECLARED_NOT_ENFORCED,
+    ENFORCED_DECLARED_OFF,
+]);
+/** Verdicts where one surface is silent rather than contrary. */
+const GAPS = new Set([
+    ENFORCED_DECLARED_OPTIONAL,
+    ENFORCED_UNDECLARED,
+]);
+/** The remedy each verdict calls for. */
+const REMEDIES = {
+    [MATCHED]: "none",
+    [DECLARED_NOT_ENFORCED]: "enforce-the-context",
+    [ENFORCED_DECLARED_OPTIONAL]: "decide-which-surface-wins",
+    [ENFORCED_DECLARED_OFF]: "resolve-the-contradiction",
+    [ENFORCED_UNDECLARED]: "declare-the-gate",
+    [ENFORCED_NOT_LISA_OWNED]: "none",
+};
+/** Every verdict, so a count of zero is still a stated zero. */
+const VERDICTS = Object.keys(REMEDIES);
+/** How the enforcing surface is named in a sentence. */
+const SURFACE_NAMES = {
+    "ruleset-templates": "the shipped ruleset template",
+    "live-ruleset": "the live branch-protection ruleset",
+};
+/**
+ * Sort strings the same way everywhere, so two runs emit the same bytes.
+ * @param values - Caller-owned strings
+ * @returns A sorted copy
+ */
+function sorted(values) {
+    return [...values].sort((left, right) => left.localeCompare(right));
+}
+/**
+ * The declaration state one resolved level names.
+ *
+ * Anything that is not one of the three levels is `not-declared`, because an
+ * unknown level is a typo rather than a claim.
+ * @param level - The resolved level
+ * @returns The declaration state
+ */
+function asDeclaration(level) {
+    return level === "required" || level === "optional" || level === "off"
+        ? level
+        : "not-declared";
+}
+/**
+ * Map every context a registry gate can produce to that gate.
+ *
+ * Built from the whole registry rather than from the declared gates, which is
+ * the difference between "protection requires a context whose gate nobody
+ * declared" and "protection requires a context Lisa knows nothing about". Those
+ * are different findings with different remedies, and a map built only from
+ * declarations could not tell them apart.
+ * @param options - Inputs
+ * @param options.registry - The shipped registry
+ * @param options.gates - The project's gates block
+ * @param options.workflowName - The workflow whose name prefixes a context
+ * @returns Context string to owning gate
+ */
+export function contextOwners(options) {
+    const { registry, gates, workflowName } = options;
+    const resolved = resolveMergeMoment(registry, gates);
+    const family = registry.momentFamily(MERGE_MOMENT);
+    const owners = Object.entries(registry.REGISTRY).map(([gateId, definition]) => {
+        const hit = resolved.get(gateId);
+        return [
+            `${workflowName} / ${definition.label}`,
+            {
+                gateId,
+                declaration: asDeclaration(hit?.level),
+                legalAtMerge: definition.moments.includes(family),
+            },
+        ];
+    });
+    const awaited = [...resolved.values()].flatMap(hit => hit.mode === "await" && hit.awaits !== null
+        ? [
+            [
+                hit.awaits,
+                {
+                    gateId: hit.id,
+                    declaration: asDeclaration(hit.level),
+                    legalAtMerge: registry.REGISTRY[hit.id]?.moments.includes(family) === true,
+                },
+            ],
+        ]
+        : []);
+    return new Map([...owners, ...awaited]);
+}
+/**
+ * Resolve the merge moment, treating a refusal as "nothing resolved".
+ *
+ * A refusal is never swallowed by the caller: `readTemplateEnforcement` and the
+ * health check both report the declaration problems separately. What must not
+ * happen here is a throw that turns a comparison into no comparison at all.
+ * @param registry - The shipped registry
+ * @param gates - The project's gates block
+ * @returns Resolved gates keyed by id
+ */
+function resolveMergeMoment(registry, gates) {
+    try {
+        return new Map(registry
+            .resolveMoment({ gates, moment: MERGE_MOMENT, includeOff: true })
+            .map(entry => [entry.id, { ...entry }]));
+    }
+    catch {
+        return new Map();
+    }
+}
+/**
+ * The contexts a `required` declaration promises protection will require.
+ * @param owners - Context to owning gate
+ * @returns The contexts, sorted
+ */
+export function declaredRequiredContexts(owners) {
+    return sorted([...owners.entries()]
+        .filter(([, owner]) => owner.declaration === "required")
+        .map(([context]) => context));
+}
+/**
+ * The verdict for one enforced context.
+ * @param owner - The gate producing it, when one does
+ * @returns The verdict
+ */
+function verdictForEnforced(owner) {
+    if (owner === undefined)
+        return ENFORCED_NOT_LISA_OWNED;
+    if (owner.declaration === "required")
+        return MATCHED;
+    if (owner.declaration === "optional")
+        return ENFORCED_DECLARED_OPTIONAL;
+    if (owner.declaration === "off")
+        return ENFORCED_DECLARED_OFF;
+    return ENFORCED_UNDECLARED;
+}
+/**
+ * The sentence one verdict is explained with.
+ * @param options - Inputs
+ * @param options.verdict - The verdict
+ * @param options.surface - The enforcing surface
+ * @param options.gateId - The owning gate, when there is one
+ * @param options.sources - Where the requirement was read from
+ * @returns One operator-readable sentence
+ */
+// eslint-disable-next-line sonarjs/cognitive-complexity -- one branch per verdict keeps the wording auditable
+function detailFor(options) {
+    const { verdict, gateId, sources } = options;
+    const surface = SURFACE_NAMES[options.surface];
+    const where = sources.length === 0 ? "" : ` (${sources.join(", ")})`;
+    if (verdict === MATCHED) {
+        return `Declared required, and ${surface} requires it${where}. The two surfaces agree; that is not evidence the check proves its property.`;
+    }
+    if (verdict === DECLARED_NOT_ENFORCED) {
+        return `The settings file declares "${String(gateId)}" required at ${MERGE_MOMENT}, but ${surface} does not require this context, so the declaration blocks nothing.`;
+    }
+    if (verdict === ENFORCED_DECLARED_OPTIONAL) {
+        return `${surface} requires this context${where}, while the settings file declares "${String(gateId)}" optional at ${MERGE_MOMENT}. Two surfaces, two answers — name which one wins.`;
+    }
+    if (verdict === ENFORCED_DECLARED_OFF) {
+        return `The settings file declares "${String(gateId)}" off at ${MERGE_MOMENT} — an explicit decision not to prove it here — yet ${surface} requires this context${where}. That is a contradiction, not a gap.`;
+    }
+    if (verdict === ENFORCED_UNDECLARED) {
+        return `${surface} requires this context${where}, and it is produced by the gate "${String(gateId)}", which the settings file never declares at any moment. Undeclared is silence, not permission to stop requiring it.`;
+    }
+    return `${surface} requires this context${where}, and no gate in Lisa's registry produces it — it comes from a third-party app or from a job this project's own CI defines. Matching is on the exact context string, never on a job name that merely resembles it: a third-party app status and a Lisa job with a similar name are different things, and treating them as one produces a false drift report, or worse a false clean one. Reported so it can be told apart from a Lisa gate that fell out of the settings file, never so it can be removed.`;
+}
+/**
+ * Group enforced contexts, keeping every ruleset and source that named one.
+ * @param enforced - Enforced contexts, possibly repeating a context
+ * @returns Context to its rulesets and sources
+ */
+function groupEnforced(enforced) {
+    return enforced.reduce((grouped, entry) => {
+        const existing = grouped.get(entry.context) ?? {
+            rulesets: [],
+            sources: [],
+        };
+        return new Map(grouped).set(entry.context, {
+            rulesets: [...existing.rulesets, entry.ruleset],
+            sources: [...existing.sources, entry.source],
+        });
+    }, new Map());
+}
+/**
+ * Compare a project's declarations with one enforcing surface.
+ *
+ * Total and pure — the same inputs always produce the same entries in the same
+ * order. Reaching the surface is the caller's job, and a caller that could not
+ * reach it must report an unknown rather than call this with an empty list: a
+ * comparison against nothing would report every declaration as unenforced,
+ * which is a different and false claim.
+ * @param options - Inputs
+ * @param options.surface - Which surface `enforced` was read from
+ * @param options.owners - Context to owning gate
+ * @param options.enforced - Contexts the surface requires
+ * @returns The comparison
+ */
+export function classifyDeclarationDrift(options) {
+    const { surface, owners, enforced } = options;
+    const grouped = groupEnforced(enforced);
+    const enforcedEntries = sorted(grouped.keys()).map((context) => {
+        const owner = owners.get(context);
+        const verdict = verdictForEnforced(owner);
+        const found = grouped.get(context);
+        const sources = sorted(new Set(found?.sources ?? []));
+        return {
+            context,
+            verdict,
+            remedy: REMEDIES[verdict],
+            gateId: owner?.gateId ?? null,
+            declaration: owner?.declaration ?? null,
+            rulesets: sorted(new Set(found?.rulesets ?? [])),
+            sources,
+            detail: detailFor({
+                verdict,
+                surface,
+                gateId: owner?.gateId ?? null,
+                sources,
+            }),
+        };
+    });
+    const unenforced = declaredRequiredContexts(owners)
+        .filter(context => !grouped.has(context))
+        .map((context) => {
+        const gateId = owners.get(context)?.gateId ?? null;
+        return {
+            context,
+            verdict: DECLARED_NOT_ENFORCED,
+            remedy: REMEDIES[DECLARED_NOT_ENFORCED],
+            gateId,
+            declaration: "required",
+            rulesets: [],
+            sources: [],
+            detail: detailFor({
+                verdict: DECLARED_NOT_ENFORCED,
+                surface,
+                gateId,
+                sources: [],
+            }),
+        };
+    });
+    const entries = [...enforcedEntries, ...unenforced].sort((left, right) => left.context.localeCompare(right.context));
+    return {
+        surface,
+        entries,
+        counts: Object.fromEntries(VERDICTS.map(verdict => [
+            verdict,
+            entries.filter(entry => entry.verdict === verdict).length,
+        ])),
+        contradictions: entries.filter(entry => CONTRADICTIONS.has(entry.verdict))
+            .length,
+        gaps: entries.filter(entry => GAPS.has(entry.verdict)).length,
+    };
+}
+//# sourceMappingURL=gate-declaration-drift.js.map

package/dist/core/gate-declaration-drift.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-declaration-drift.js","sourceRoot":"","sources":["../../src/core/gate-declaration-drift.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AA8HH,0CAA0C;AAC1C,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAE3C,oEAAoE;AACpE,MAAM,OAAO,GAAG,SAAS,CAAC;AAC1B,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AACtD,MAAM,0BAA0B,GAAG,4BAA4B,CAAC;AAChE,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AACtD,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAClD,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAE1D,6DAA6D;AAC7D,MAAM,cAAc,GAA8B,IAAI,GAAG,CAAe;IACtE,qBAAqB;IACrB,qBAAqB;CACtB,CAAC,CAAC;AAEH,iEAAiE;AACjE,MAAM,IAAI,GAA8B,IAAI,GAAG,CAAe;IAC5D,0BAA0B;IAC1B,mBAAmB;CACpB,CAAC,CAAC;AAEH,yCAAyC;AACzC,MAAM,QAAQ,GAAgD;IAC5D,CAAC,OAAO,CAAC,EAAE,MAAM;IACjB,CAAC,qBAAqB,CAAC,EAAE,qBAAqB;IAC9C,CAAC,0BAA0B,CAAC,EAAE,2BAA2B;IACzD,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;IACpD,CAAC,mBAAmB,CAAC,EAAE,kBAAkB;IACzC,CAAC,uBAAuB,CAAC,EAAE,MAAM;CAClC,CAAC;AAEF,gEAAgE;AAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAA4B,CAAC;AAElE,wDAAwD;AACxD,MAAM,aAAa,GAA2C;IAC5D,mBAAmB,EAAE,8BAA8B;IACnD,cAAc,EAAE,oCAAoC;CACrD,CAAC;AAEF;;;;GAIG;AACH,SAAS,MAAM,CAAC,MAAwB;IACtC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,KAAyB;IAC9C,OAAO,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,KAAK;QACpE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,cAAc,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAAC,OAI7B;IACC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CAClD,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,EAAmC,EAAE;QACxD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO;YACL,GAAG,YAAY,MAAM,UAAU,CAAC,KAAK,EAAE;YACvC;gBACE,MAAM;gBACN,WAAW,EAAE,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC;gBACtC,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;aAClD;SACO,CAAC;IACb,CAAC,CACF,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CACnD,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;QACzC,CAAC,CAAC;YACE;gBACE,GAAG,CAAC,MAAM;gBACV;oBACE,MAAM,EAAE,GAAG,CAAC,EAAE;oBACd,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;oBACrC,YAAY,EACV,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI;iBAC/D;aACO;SACX;QACH,CAAC,CAAC,EAAE,CACP,CAAC;IACF,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CACzB,QAA8B,EAC9B,KAA8B;IAK9B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CACZ,QAAQ;aACL,aAAa,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;aAChE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAyC;IAEzC,OAAO,MAAM,CACX,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,UAAU,CAAC;SACvD,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAA+B;IACzD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,uBAAuB,CAAC;IACxD,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU;QAAE,OAAO,0BAA0B,CAAC;IACxE,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK;QAAE,OAAO,qBAAqB,CAAC;IAC9D,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;;;;;;;GAQG;AACH,8GAA8G;AAC9G,SAAS,SAAS,CAAC,OAKlB;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACrE,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,0BAA0B,OAAO,eAAe,KAAK,+EAA+E,CAAC;IAC9I,CAAC;IACD,IAAI,OAAO,KAAK,qBAAqB,EAAE,CAAC;QACtC,OAAO,+BAA+B,MAAM,CAAC,MAAM,CAAC,iBAAiB,YAAY,SAAS,OAAO,oEAAoE,CAAC;IACxK,CAAC;IACD,IAAI,OAAO,KAAK,0BAA0B,EAAE,CAAC;QAC3C,OAAO,GAAG,OAAO,yBAAyB,KAAK,uCAAuC,MAAM,CAAC,MAAM,CAAC,iBAAiB,YAAY,oDAAoD,CAAC;IACxL,CAAC;IACD,IAAI,OAAO,KAAK,qBAAqB,EAAE,CAAC;QACtC,OAAO,+BAA+B,MAAM,CAAC,MAAM,CAAC,YAAY,YAAY,sDAAsD,OAAO,yBAAyB,KAAK,uCAAuC,CAAC;IACjN,CAAC;IACD,IAAI,OAAO,KAAK,mBAAmB,EAAE,CAAC;QACpC,OAAO,GAAG,OAAO,yBAAyB,KAAK,qCAAqC,MAAM,CAAC,MAAM,CAAC,sHAAsH,CAAC;IAC3N,CAAC;IACD,OAAO,GAAG,OAAO,yBAAyB,KAAK,4eAA4e,CAAC;AAC9hB,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CACpB,QAAoC;IAEpC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI;YAC7C,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,EAAE;SACZ,CAAC;QACF,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE;YACzC,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC;YAC/C,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC,EAAE,IAAI,GAAG,EAAqD,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAIxC;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC9C,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAChD,CAAC,OAAO,EAAyB,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,OAAO;YACL,OAAO;YACP,OAAO;YACP,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;YACzB,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,IAAI;YAC7B,WAAW,EAAE,KAAK,EAAE,WAAW,IAAI,IAAI;YACvC,QAAQ,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;YAChD,OAAO;YACP,MAAM,EAAE,SAAS,CAAC;gBAChB,OAAO;gBACP,OAAO;gBACP,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,IAAI;gBAC7B,OAAO;aACR,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IACF,MAAM,UAAU,GAAG,wBAAwB,CAAC,MAAM,CAAC;SAChD,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;SACxC,GAAG,CAAC,CAAC,OAAO,EAAyB,EAAE;QACtC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;QACnD,OAAO;YACL,OAAO;YACP,OAAO,EAAE,qBAAqB;YAC9B,MAAM,EAAE,QAAQ,CAAC,qBAAqB,CAAC;YACvC,MAAM;YACN,WAAW,EAAE,UAAU;YACvB,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,SAAS,CAAC;gBAChB,OAAO,EAAE,qBAAqB;gBAC9B,OAAO;gBACP,MAAM;gBACN,OAAO,EAAE,EAAE;aACZ,CAAC;SACH,CAAC;IACJ,CAAC,CAAC,CAAC;IACL,MAAM,OAAO,GAAG,CAAC,GAAG,eAAe,EAAE,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACvE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAC1C,CAAC;IACF,OAAO;QACL,OAAO;QACP,OAAO;QACP,MAAM,EAAE,MAAM,CAAC,WAAW,CACxB,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACtB,OAAO;YACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,MAAM;SAC1D,CAAC,CAC6B;QACjC,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;aACvE,MAAM;QACT,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;KAC9D,CAAC;AACJ,CAAC"}

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAg3EpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAg5OjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAg3EpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CA65OjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -145,7 +145,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "expo/github-rulesets/nightly-e2e-health.json": "af9556f52bbb04d303f557eb178d876d82348d15a991729b8a96fb1f06d5b03a",
     "expo/merge/.claude/settings.json": "e97b33d7ad86b71abba94ab957d725e34c3cafca455e92fba0b29ebabc3b73d1",
     "expo/merge/.oxlintrc.json": "95b3069256c0040be0ef1a5adae46d14687ad56fb18f473a653ba2de45d106bb",
-    "expo/package-lisa/package.lisa.json": "4b299aec0e1c3bdb0ea5b85f1ccc415747ee3a168ed962aea654634ad5efeb19",
+    "expo/package-lisa/package.lisa.json": "fe9b22bc59d9e95680f37f102dc353c4badb8266c31a765deab84e9b48ec437d",
     "harper-fabric/copy-contents/.prettierignore": "478c782f4c5611187e21584dfd5522e37fc636c5eb03394fea3db45321c6712c",
     "harper-fabric/copy-contents/gitignore": "d091c40fd0ea3068491f1be0d6510090ae872ca95d0d058ef4595d6492d13897",
     "harper-fabric/copy-overwrite/.github/workflows/ci.yml": "1fef0b72f890869e656dbe3b9463c83725ea8ca8e24e50b58d93c68502603fd0",
@@ -209,7 +209,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "nestjs/deletions.json": "037a64f96b76670326bc61921f4484e864e02c09786adabbd1cfdf886183cad5",
     "nestjs/merge/.claude/settings.json": "d0ce50361a1f3868d15728646e66b9e1cdb8373688eb22459adbdb176e342aca",
     "nestjs/merge/.oxlintrc.json": "1de29d135744df0258e8659ee0b684acf84e687bbefade51db0576813e6ff097",
-    "nestjs/package-lisa/package.lisa.json": "2649752534751c072ccae09000d36c575d713aeb41af6bc57626ab906045c89a",
+    "nestjs/package-lisa/package.lisa.json": "0988afbca21b2bbdfa2bd5ef9623e6b560cfdf0a5c18bf75385d4d21d7725441",
     "npm-package/create-only/.github/workflows/publish-to-npm.yml": "1d051007a328ba4f6c67a5e3123593921b823e0866c05343c4588a6156e9f593",
     "npm-package/package-lisa/package.lisa.json": "4a17f67b6ac09e239f4afb3cf71ecd42e1b6890164008aa8e654f3110b1d65fd",
     "oxlint/base.json": "8cbc563bdfbbaf455742cef24d33676f45b55baf1ea62b529018b2d112d70f8a",
@@ -521,7 +521,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-detect-tooling/SKILL.md": "6ea2b1404d5c27f8a5bec8c90ad35ed0124789b70c091869455f538a2a9debbe",
     "plugins/src/base/skills/lisa-detect-tooling/scripts/commands.mjs": "e28bd61fdde4a336b56ae3395423026943a5816015719d31d04f0d5a0ab50eec",
     "plugins/src/base/skills/lisa-detect-tooling/scripts/detect-tooling.mjs": "d9419814fc04c935bd7e320e85b1977c9bfc9275d9ea5fb557002ad438ee7925",
-    "plugins/src/base/skills/lisa-doctor/SKILL.md": "a16ded88a648852c02f7ee3e30ef97afb644384f2ea2e977c3e4a288600278de",
+    "plugins/src/base/skills/lisa-doctor/SKILL.md": "83fd779c341108729a926bc2680d54f0b69044137840b1d80d660243a7f74ba5",
     "plugins/src/base/skills/lisa-drive-pr-to-merge/SKILL.md": "e27849a2567081bce5ea3aa31f7cc5868f884a59c343c685b900ac7aa707666a",
     "plugins/src/base/skills/lisa-epic-triage/SKILL.md": "d02760411249bddbd396f283191fe3e82bb7b95bf9393a19a7025dc5a57c3ab7",
     "plugins/src/base/skills/lisa-evaluation-suite/SKILL.md": "96b5c2091ccd22a565935a7b0b917f67998881b81055ce3e4d518319472eac8b",
@@ -1205,7 +1205,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "typescript/github-rulesets/quality-checks.json": "bcc64e1d21bb7c1466c58b1726788ce33a22229c5be363bb39fa5ce60209af39",
     "typescript/merge/.claude/settings.json": "834e6456cae81f45073bbbb08bf731fef043efb30cae2658cb4a59f17e66d165",
     "typescript/merge/.oxlintrc.json": "9504c20db80470c242c4ffe8cccad6951ed8141dfb5bf6503053e0b2712ab276",
-    "typescript/package-lisa/package.lisa.json": "0da7069e5b7eb4e16e67201d047be1dd85b82c0e2bcf7cf0fa0ab0caff8a8b1a",
+    "typescript/package-lisa/package.lisa.json": "705debefdf6f88877e796436619509104c1368e376852ddb1eb451b0e63e5248",
     "ui/README.md": "ee05dac69cbba5f74a4ff945e78afdd54bd62d26087a255799dbbfc943f52b45",
     "ui/index.html": "259e62a02f99c7957cb5f83cc9f5678971df8c6c37495566f88b919ccddc1ade",
 });
@@ -7110,6 +7110,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/cli/cross-pollinate-nudge.ts": true,
     "src/cli/doctor-apply-failure.ts": true,
     "src/cli/doctor-apply-freshness.ts": true,
+    "src/cli/doctor-declared-contexts.ts": true,
     "src/cli/doctor-gate-recommendation.ts": true,
     "src/cli/doctor-hook-copy-parity.ts": true,
     "src/cli/doctor-kane.ts": true,
@@ -7174,6 +7175,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/cli/gate-report-cells.ts": true,
     "src/cli/gate-report-config.ts": true,
     "src/cli/gate-report-contexts.ts": true,
+    "src/cli/gate-report-drift-section.ts": true,
     "src/cli/gate-report-executors.ts": true,
     "src/cli/gate-report-facade.ts": true,
     "src/cli/gate-report-fragment.ts": true,
@@ -7188,6 +7190,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/cli/gate-report-skip-jobs.ts": true,
     "src/cli/gate-report-style.ts": true,
     "src/cli/gate-report-summary.ts": true,
+    "src/cli/gate-report-templates.ts": true,
     "src/cli/gate-report-types.ts": true,
     "src/cli/gate-report-upstream.ts": true,
     "src/cli/gate-report.ts": true,
@@ -7300,6 +7303,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/core/config.ts": true,
     "src/core/downstream-names.ts": true,
     "src/core/downstream-references.ts": true,
+    "src/core/gate-declaration-drift.ts": true,
     "src/core/git-service.ts": true,
     "src/core/guard-capabilities.ts": true,
     "src/core/hook-copy-parity.ts": true,
@@ -7361,6 +7365,8 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/health/consumer.ts": true,
     "src/health/contract.ts": true,
     "src/health/deadline.ts": true,
+    "src/health/declared-checks-inspection.ts": true,
+    "src/health/deterministic-inputs.ts": true,
     "src/health/deterministic.ts": true,
     "src/health/drift-tickets.ts": true,
     "src/health/evaluation-protocol.ts": true,
@@ -7573,6 +7579,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/helpers/safety-net-guard-fixtures.ts": true,
     "tests/helpers/safety-net-guard-harness.ts": true,
     "tests/helpers/safety-net-subst-fixtures.ts": true,
+    "tests/helpers/template-toolchain.ts": true,
     "tests/helpers/test-utils.ts": true,
     "tests/helpers/verification-gate-fixtures.ts": true,
     "tests/helpers/verification-gate-harness.ts": true,
@@ -7659,6 +7666,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/cli/check-learnings-budget-cmd.test.ts": true,
     "tests/unit/cli/doctor-apply-failure.test.ts": true,
     "tests/unit/cli/doctor-apply-freshness.test.ts": true,
+    "tests/unit/cli/doctor-declared-contexts.test.ts": true,
     "tests/unit/cli/doctor-gate-recommendation.test.ts": true,
     "tests/unit/cli/doctor-hook-copy-parity.test.ts": true,
     "tests/unit/cli/doctor-kane.test.ts": true,
@@ -7714,8 +7722,10 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/cli/file-upstream-contract.test.ts": true,
     "tests/unit/cli/gate-commands.test.ts": true,
     "tests/unit/cli/gate-report-attribution.test.ts": true,
+    "tests/unit/cli/gate-report-declaration-drift.test.ts": true,
     "tests/unit/cli/gate-report-executors.test.ts": true,
     "tests/unit/cli/gate-report-fixtures.ts": true,
+    "tests/unit/cli/gate-report-preview-escaping.test.ts": true,
     "tests/unit/cli/gate-report-preview.test.ts": true,
     "tests/unit/cli/gate-report-ruleset.test.ts": true,
     "tests/unit/cli/gate-report-states.test.ts": true,
@@ -7840,6 +7850,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/config/rails-template.test.ts": true,
     "tests/unit/config/release-push-retry.test.ts": true,
     "tests/unit/config/security-pin-floors.test.ts": true,
+    "tests/unit/config/template-script-toolchain.test.ts": true,
     "tests/unit/config/tsconfig-no-unused-flags.test.ts": true,
     "tests/unit/config/tsconfig-template-references.test.ts": true,
     "tests/unit/config/vitest-base.test.ts": true,
@@ -7854,6 +7865,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/core/bootstrap-environment.test.ts": true,
     "tests/unit/core/fs-extra-namespace-callsites.test.ts": true,
     "tests/unit/core/fs-extra-namespace-members.test.ts": true,
+    "tests/unit/core/gate-declaration-drift.test.ts": true,
     "tests/unit/core/hook-copy-parity.test.ts": true,
     "tests/unit/core/host-rules-parity.test.ts": true,
     "tests/unit/core/host-rules-pointer.test.ts": true,
@@ -7911,6 +7923,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/health/consumer.test.ts": true,
     "tests/unit/health/contract.test.ts": true,
     "tests/unit/health/deadline.test.ts": true,
+    "tests/unit/health/declared-checks.test.ts": true,
     "tests/unit/health/deterministic-regressions.test.ts": true,
     "tests/unit/health/deterministic.test.ts": true,
     "tests/unit/health/drift-tickets.test.ts": true,