@codyswann/lisa 3.52.0 → 3.53.0

package/dist/health/declared-checks-inspection.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Hold the gates declaration against the live ruleset, on a path a machine
+ * takes on its own.
+ *
+ * The comparison itself was not the missing piece. A finished reconciler has
+ * existed for some time, unit- and mutation-covered, reporting MISSING, EXTRA,
+ * MATCHED and a distinct UNPROVEN — and nothing invoked it. Its only callers
+ * were copies of prose in a skill telling a human to type the command, which
+ * makes it indistinguishable from a control that was never written. This module
+ * is the same comparison sitting on a scheduled, machine-invoked path.
+ *
+ * Two rules it does not get to bend:
+ *
+ * - **A source this run could not read is `warn`, never `pass`.** A comparison
+ *   that silently passes when it could not reach the live ruleset is the exact
+ *   defect this check exists to catch, sited on the check itself.
+ * - **Nothing here proposes removing a live required context.** A context no
+ *   declaration asks for is reported so it can be told apart from a third-party
+ *   check, not so it can be pruned. The remedy vocabulary in
+ *   `core/gate-declaration-drift` structurally contains no removal.
+ * @module health/declared-checks-inspection
+ */
+import { type DeclarationDriftReport } from "../core/gate-declaration-drift.js";
+import type { HealthFinding } from "./contract.js";
+import { type RulesetReader } from "./ruleset-inspection.js";
+/**
+ * The finding one completed comparison produces.
+ *
+ * A contradiction fails: the two surfaces state opposite things, and one of
+ * them is wrong. A gap warns: the declaration is silent, and silence is not
+ * permission to stop requiring the context — the registry still carries gates
+ * whose jobs run with no declaration anywhere, so reading silence as a defect
+ * of the ruleset would point the operator at the wrong file.
+ * @param report - The completed comparison
+ * @returns The finding
+ */
+export declare function declaredChecksFinding(report: DeclarationDriftReport): HealthFinding;
+/**
+ * Compare the gates declaration with the live ruleset.
+ * @param projectRoot - Canonical host root
+ * @param config - Safe project config
+ * @param reader - Structured remote ruleset reader
+ * @param timeoutMs - Remaining shared deadline
+ * @param signal - Shared cancellation signal
+ * @returns The finding, never a pass on an unread source
+ */
+export declare function declaredChecksDriftFinding(projectRoot: string, config: Readonly<Record<string, unknown>>, reader: RulesetReader, timeoutMs: number, signal: AbortSignal): Promise<HealthFinding>;
+//# sourceMappingURL=declared-checks-inspection.d.ts.map

package/dist/health/declared-checks-inspection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"declared-checks-inspection.d.ts","sourceRoot":"","sources":["../../src/health/declared-checks-inspection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,yBAAyB,CAAC;AAiCjC;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,sBAAsB,GAC7B,aAAa,CAmCf;AAED;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,MAAM,EAAE,aAAa,EACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,aAAa,CAAC,CAkDxB"}

package/dist/health/declared-checks-inspection.js

@@ -0,0 +1,154 @@
+/**
+ * Hold the gates declaration against the live ruleset, on a path a machine
+ * takes on its own.
+ *
+ * The comparison itself was not the missing piece. A finished reconciler has
+ * existed for some time, unit- and mutation-covered, reporting MISSING, EXTRA,
+ * MATCHED and a distinct UNPROVEN — and nothing invoked it. Its only callers
+ * were copies of prose in a skill telling a human to type the command, which
+ * makes it indistinguishable from a control that was never written. This module
+ * is the same comparison sitting on a scheduled, machine-invoked path.
+ *
+ * Two rules it does not get to bend:
+ *
+ * - **A source this run could not read is `warn`, never `pass`.** A comparison
+ *   that silently passes when it could not reach the live ruleset is the exact
+ *   defect this check exists to catch, sited on the check itself.
+ * - **Nothing here proposes removing a live required context.** A context no
+ *   declaration asks for is reported so it can be told apart from a third-party
+ *   check, not so it can be pruned. The remedy vocabulary in
+ *   `core/gate-declaration-drift` structurally contains no removal.
+ * @module health/declared-checks-inspection
+ */
+import { classifyDeclarationDrift, contextOwners, } from "../core/gate-declaration-drift.js";
+import { loadGateRegistry } from "../cli/gate-report-registry.js";
+import { deterministicFinding, namedReason } from "./finding-utils.js";
+import { liveRequiredContexts, } from "./ruleset-inspection.js";
+/** This check's stable id. */
+const CHECK = "github.declared-checks";
+/** The workflow whose name prefixes a run gate's status context. */
+const QUALITY_WORKFLOW_NAME = "🔍 Quality Checks";
+/** Repository slug parts this check will address. */
+const REPOSITORY_PART = /^[A-Za-z0-9_.-]{1,100}$/u;
+/**
+ * The repository this check would read, when the settings file names one.
+ * @param config - Safe project config
+ * @returns The owner and repository, or undefined
+ */
+function githubTarget(config) {
+    const github = config.github;
+    if (github === null || typeof github !== "object" || Array.isArray(github)) {
+        return undefined;
+    }
+    const owner = Reflect.get(github, "org");
+    const repo = Reflect.get(github, "repo");
+    return typeof owner === "string" &&
+        typeof repo === "string" &&
+        REPOSITORY_PART.test(owner) &&
+        REPOSITORY_PART.test(repo)
+        ? { owner, repo }
+        : undefined;
+}
+/**
+ * The finding one completed comparison produces.
+ *
+ * A contradiction fails: the two surfaces state opposite things, and one of
+ * them is wrong. A gap warns: the declaration is silent, and silence is not
+ * permission to stop requiring the context — the registry still carries gates
+ * whose jobs run with no declaration anywhere, so reading silence as a defect
+ * of the ruleset would point the operator at the wrong file.
+ * @param report - The completed comparison
+ * @returns The finding
+ */
+export function declaredChecksFinding(report) {
+    const contradictions = report.entries.filter(entry => entry.verdict === "declared-not-enforced" ||
+        entry.verdict === "enforced-declared-off");
+    if (contradictions.length > 0) {
+        return deterministicFinding(CHECK, "fail", namedReason("Gates declarations contradict live branch protection", contradictions.map(entry => `${entry.context} (${entry.verdict})`)));
+    }
+    const gaps = report.entries.filter(entry => entry.verdict === "enforced-undeclared" ||
+        entry.verdict === "enforced-declared-optional");
+    return gaps.length === 0
+        ? deterministicFinding(CHECK, "pass", "Every context live branch protection requires is governed by a gates declaration.")
+        : deterministicFinding(CHECK, "warn", namedReason("Live branch protection requires contexts no declaration governs", gaps.map(entry => `${entry.context} (${entry.verdict})`)));
+}
+/**
+ * Compare the gates declaration with the live ruleset.
+ * @param projectRoot - Canonical host root
+ * @param config - Safe project config
+ * @param reader - Structured remote ruleset reader
+ * @param timeoutMs - Remaining shared deadline
+ * @param signal - Shared cancellation signal
+ * @returns The finding, never a pass on an unread source
+ */
+export async function declaredChecksDriftFinding(projectRoot, config, reader, timeoutMs, signal) {
+    const target = githubTarget(config);
+    if (target === undefined) {
+        return deterministicFinding(CHECK, "warn", "Unproven: no GitHub repository is configured, so the gates declarations were not held against live branch protection.");
+    }
+    const registry = await loadGateRegistry();
+    if (registry === null) {
+        return deterministicFinding(CHECK, "warn", "Unproven: Lisa's shipped gate registry could not be located, so no declaration could be resolved into a status context.");
+    }
+    const actual = await readLive(reader, {
+        owner: target.owner,
+        repo: target.repo,
+        projectRoot,
+        timeoutMs,
+        signal,
+    });
+    if (actual === undefined) {
+        return deterministicFinding(CHECK, "warn", "Unproven: live branch protection could not be read within the deterministic deadline, so nothing here claims a declaration does or does not match it.");
+    }
+    const gates = readGatesSafely(registry, projectRoot);
+    if (gates === null) {
+        return deterministicFinding(CHECK, "warn", "Unproven: the gates block could not be read, so the contexts it implies could not be compared with live branch protection.");
+    }
+    return declaredChecksFinding(classifyDeclarationDrift({
+        surface: "live-ruleset",
+        owners: contextOwners({
+            registry,
+            gates,
+            workflowName: QUALITY_WORKFLOW_NAME,
+        }),
+        enforced: liveRequiredContexts(actual),
+    }));
+}
+/**
+ * Call the ruleset reader, surviving a reader that throws synchronously.
+ *
+ * `.catch()` on the returned promise handles a rejection and nothing else; a
+ * reader whose failure happens before it returns one would take the entire
+ * health run down, turning "this source was unreadable" into no report at all.
+ * @param reader - Structured remote ruleset reader
+ * @param options - Reader arguments
+ * @param options.owner - Repository owner
+ * @param options.repo - Repository name
+ * @param options.projectRoot - Canonical host root
+ * @param options.timeoutMs - Remaining shared deadline
+ * @param options.signal - Shared cancellation signal
+ * @returns The rulesets, or undefined when they could not be read
+ */
+async function readLive(reader, options) {
+    try {
+        return await reader(options.owner, options.repo, options.projectRoot, options.timeoutMs, options.signal);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Read the gates block, keeping a refusal distinguishable from an empty one.
+ * @param registry - The shipped registry
+ * @param projectRoot - Canonical host root
+ * @returns The gates block, or null when it could not be read
+ */
+function readGatesSafely(registry, projectRoot) {
+    try {
+        return registry.readGates(projectRoot).gates;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=declared-checks-inspection.js.map

package/dist/health/declared-checks-inspection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"declared-checks-inspection.js","sourceRoot":"","sources":["../../src/health/declared-checks-inspection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EACL,wBAAwB,EACxB,aAAa,GAEd,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EACL,oBAAoB,GAGrB,MAAM,yBAAyB,CAAC;AAEjC,8BAA8B;AAC9B,MAAM,KAAK,GAAG,wBAAwB,CAAC;AAEvC,oEAAoE;AACpE,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAElD,qDAAqD;AACrD,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAEnD;;;;GAIG;AACH,SAAS,YAAY,CACnB,MAAyC;IAEzC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ;QAC9B,OAAO,IAAI,KAAK,QAAQ;QACxB,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1B,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE;QACjB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA8B;IAE9B,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAC1C,KAAK,CAAC,EAAE,CACN,KAAK,CAAC,OAAO,KAAK,uBAAuB;QACzC,KAAK,CAAC,OAAO,KAAK,uBAAuB,CAC5C,CAAC;IACF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,oBAAoB,CACzB,KAAK,EACL,MAAM,EACN,WAAW,CACT,sDAAsD,EACtD,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,GAAG,CAAC,CACnE,CACF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAChC,KAAK,CAAC,EAAE,CACN,KAAK,CAAC,OAAO,KAAK,qBAAqB;QACvC,KAAK,CAAC,OAAO,KAAK,4BAA4B,CACjD,CAAC;IACF,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC;QACtB,CAAC,CAAC,oBAAoB,CAClB,KAAK,EACL,MAAM,EACN,mFAAmF,CACpF;QACH,CAAC,CAAC,oBAAoB,CAClB,KAAK,EACL,MAAM,EACN,WAAW,CACT,iEAAiE,EACjE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,GAAG,CAAC,CACzD,CACF,CAAC;AACR,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAAmB,EACnB,MAAyC,EACzC,MAAqB,EACrB,SAAiB,EACjB,MAAmB;IAEnB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,oBAAoB,CACzB,KAAK,EACL,MAAM,EACN,uHAAuH,CACxH,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAC1C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,oBAAoB,CACzB,KAAK,EACL,MAAM,EACN,yHAAyH,CAC1H,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE;QACpC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW;QACX,SAAS;QACT,MAAM;KACP,CAAC,CAAC;IACH,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,oBAAoB,CACzB,KAAK,EACL,MAAM,EACN,uJAAuJ,CACxJ,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACrD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,oBAAoB,CACzB,KAAK,EACL,MAAM,EACN,4HAA4H,CAC7H,CAAC;IACJ,CAAC;IACD,OAAO,qBAAqB,CAC1B,wBAAwB,CAAC;QACvB,OAAO,EAAE,cAAc;QACvB,MAAM,EAAE,aAAa,CAAC;YACpB,QAAQ;YACR,KAAK;YACL,YAAY,EAAE,qBAAqB;SACpC,CAAC;QACF,QAAQ,EAAE,oBAAoB,CAAC,MAAM,CAAC;KACvC,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,QAAQ,CACrB,MAAqB,EACrB,OAMC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CACjB,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,CACf,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAOD;;;;;GAKG;AACH,SAAS,eAAe,CACtB,QAAqB,EACrB,WAAmB;IAEnB,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/health/deterministic-inputs.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The two confined project reads every deterministic probe is built on.
+ *
+ * Both preserve a distinction the checks above them depend on and cannot
+ * recover once lost: a settings file that is MISSING is a different finding
+ * from one that is present and unreadable, and a JSON file that will not parse
+ * is a different finding from one that is not there. Collapsing either into
+ * "absent" is how a health run reports a clean project that it simply could
+ * not read.
+ * @module health/deterministic-inputs
+ */
+import type { SyncReadDependencies } from "../sync/config-sync.js";
+import type { HealthConfigState } from "./project-probes.js";
+import type { RulesetReader } from "./ruleset-inspection.js";
+/**
+ * Read config while preserving missing vs malformed state.
+ * @param projectRoot - Canonical host project root
+ * @returns Whether the settings file is present, readable, and its contents
+ */
+export declare function loadConfigState(projectRoot: string): Promise<HealthConfigState>;
+/**
+ * Confined JSON/path readers for the shared sync planner.
+ * @param projectRoot - Canonical host project root
+ * @returns Readers that never escape the project root
+ */
+export declare function safeSyncReads(projectRoot: string): SyncReadDependencies;
+/**
+ * Share one ruleset read between the probes that both need it.
+ *
+ * Two checks now compare against the same live rulesets — one against Lisa's
+ * template, one against the project's declarations — and reading them twice
+ * would double a bounded N+1 of GitHub calls inside one shared deadline for an
+ * answer that cannot differ between them. A rejection is shared too, on
+ * purpose: both probes should report the same source as unread rather than
+ * disagree about whether it could be reached.
+ * @param reader - The underlying reader
+ * @returns A reader that calls through at most once per repository
+ */
+export declare function shareRulesetReader(reader: RulesetReader): RulesetReader;
+//# sourceMappingURL=deterministic-inputs.d.ts.map

package/dist/health/deterministic-inputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deterministic-inputs.d.ts","sourceRoot":"","sources":["../../src/health/deterministic-inputs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAO7D;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAiB5B;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,oBAAoB,CAevE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,CAWvE"}

package/dist/health/deterministic-inputs.js

@@ -0,0 +1,71 @@
+import { projectPathKind, readProjectJsonObject, readProjectText, } from "./read-only-fs.js";
+/**
+ * Read config while preserving missing vs malformed state.
+ * @param projectRoot - Canonical host project root
+ * @returns Whether the settings file is present, readable, and its contents
+ */
+export async function loadConfigState(projectRoot) {
+    const kind = await projectPathKind(projectRoot, ".lisa.config.json");
+    if (kind === "missing") {
+        return { config: {}, present: false, readable: false };
+    }
+    if (kind !== "file") {
+        return { config: {}, present: true, readable: false };
+    }
+    try {
+        const config = await readProjectJsonObject(projectRoot, ".lisa.config.json");
+        return { config: config ?? {}, present: true, readable: true };
+    }
+    catch {
+        return { config: {}, present: true, readable: false };
+    }
+}
+/**
+ * Confined JSON/path readers for the shared sync planner.
+ * @param projectRoot - Canonical host project root
+ * @returns Readers that never escape the project root
+ */
+export function safeSyncReads(projectRoot) {
+    return {
+        readJson: async (relativePath) => {
+            const text = await readProjectText(projectRoot, relativePath);
+            if (text === undefined)
+                return null;
+            try {
+                return JSON.parse(text);
+            }
+            catch (error) {
+                if (error instanceof SyntaxError)
+                    return null;
+                throw error;
+            }
+        },
+        pathExists: async (relativePath) => (await projectPathKind(projectRoot, relativePath)) !== "missing",
+    };
+}
+/**
+ * Share one ruleset read between the probes that both need it.
+ *
+ * Two checks now compare against the same live rulesets — one against Lisa's
+ * template, one against the project's declarations — and reading them twice
+ * would double a bounded N+1 of GitHub calls inside one shared deadline for an
+ * answer that cannot differ between them. A rejection is shared too, on
+ * purpose: both probes should report the same source as unread rather than
+ * disagree about whether it could be reached.
+ * @param reader - The underlying reader
+ * @returns A reader that calls through at most once per repository
+ */
+export function shareRulesetReader(reader) {
+    const inFlight = new Map();
+    return (owner, repo, projectRoot, timeoutMs, signal) => {
+        const key = `${owner}/${repo}`;
+        const existing = inFlight.get(key);
+        if (existing !== undefined)
+            return existing;
+        const started = reader(owner, repo, projectRoot, timeoutMs, signal);
+        // eslint-disable-next-line functional/immutable-data -- the cache is the point
+        inFlight.set(key, started);
+        return started;
+    };
+}
+//# sourceMappingURL=deterministic-inputs.js.map

package/dist/health/deterministic-inputs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deterministic-inputs.js","sourceRoot":"","sources":["../../src/health/deterministic-inputs.ts"],"names":[],"mappings":"AAcA,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAE3B;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,WAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IACrE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CACxC,WAAW,EACX,mBAAmB,CACpB,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACxD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,WAAmB;IAC/C,OAAO;QACL,QAAQ,EAAE,KAAK,EAAE,YAAoB,EAAE,EAAE;YACvC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAC9D,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACpC,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;YACrC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,WAAW;oBAAE,OAAO,IAAI,CAAC;gBAC9C,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,YAAoB,EAAE,EAAE,CACzC,CAAC,MAAM,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,KAAK,SAAS;KACnE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAqB;IACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAqC,CAAC;IAC9D,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;QACrD,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACpE,+EAA+E;QAC/E,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3B,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC"}

package/dist/health/deterministic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deterministic.d.ts","sourceRoot":"","sources":["../../src/health/deterministic.ts"],"names":[],"mappings":"AAUA,OAAO,EAGL,KAAK,YAAY,EAGlB,MAAM,eAAe,CAAC;AAUvB,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,wBAAwB,CAAC;AAchC,OAAO,EACL,kBAAkB,EAElB,KAAK,aAAa,EACnB,MAAM,yBAAyB,CAAC;AAQjC;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IACtC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IACtD,uDAAuD;IACvD,QAAQ,CAAC,aAAa,CAAC,EAAE,eAAe,CAAC;CAC1C;AAqOD;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,YAAY,CAAC,CA4CvB;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAC9B,YAAY,EAAE,aAAa,EAAE,CAAC"}
+{"version":3,"file":"deterministic.d.ts","sourceRoot":"","sources":["../../src/health/deterministic.ts"],"names":[],"mappings":"AAOA,OAAO,EAGL,KAAK,YAAY,EAGlB,MAAM,eAAe,CAAC;AAgBvB,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,wBAAwB,CAAC;AAShC,OAAO,EACL,kBAAkB,EAElB,KAAK,aAAa,EACnB,MAAM,yBAAyB,CAAC;AAQjC;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IACtC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IACtD,uDAAuD;IACvD,QAAQ,CAAC,aAAa,CAAC,EAAE,eAAe,CAAC;CAC1C;AAsMD;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,YAAY,CAAC,CA4CvB;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAC9B,YAAY,EAAE,aAAa,EAAE,CAAC"}

package/dist/health/deterministic.js

@@ -3,15 +3,16 @@
 import { lstat, realpath } from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { runConfigSync, } from "../sync/config-sync.js";
+import { runConfigSync } from "../sync/config-sync.js";
 import { summarizeHealthFindings, validateHealthResult, } from "./contract.js";
 import { HealthDeadline } from "./deadline.js";
+import { declaredChecksDriftFinding } from "./declared-checks-inspection.js";
+import { loadConfigState, safeSyncReads, shareRulesetReader, } from "./deterministic-inputs.js";
 import { deterministicFinding } from "./finding-utils.js";
 import { hookFinding, managedTemplateFinding, packageFinding, pluginFinding, workflowFinding, } from "./governance-probes.js";
 import { readCoreHooksPath } from "./hook-inspection.js";
 import { readInstalledClaudePlugins, } from "./plugin-inspection.js";
 import { configFindings, instructionFinding, projectStateFinding, starterFinding, wikiFinding, } from "./project-probes.js";
-import { projectPathKind, readProjectJsonObject, readProjectText, } from "./read-only-fs.js";
 import { readGithubRulesets, rulesetFinding, } from "./ruleset-inspection.js";
 import { detectHealthProjectShape, } from "./template-inspection.js";
 const DEFAULT_DEADLINE_MS = 110_000;
@@ -28,6 +29,7 @@ const CHECKS = [
     { check: "plugins.current", unavailable: "warn" },
     { check: "ci.workflows", unavailable: "fail" },
     { check: "github.rulesets", unavailable: "warn" },
+    { check: "github.declared-checks", unavailable: "warn" },
 ];
 /**
  * Stable fallback when a check cannot complete inside the shared deadline.
@@ -37,48 +39,6 @@ const CHECKS = [
 function unavailableFinding(check, status) {
     return deterministicFinding(check, status, `${check} could not be safely observed within the deterministic deadline.`);
 }
-/**
- * Read config while preserving missing vs malformed state.
- * @param projectRoot
- */
-async function loadConfigState(projectRoot) {
-    const kind = await projectPathKind(projectRoot, ".lisa.config.json");
-    if (kind === "missing") {
-        return { config: {}, present: false, readable: false };
-    }
-    if (kind !== "file") {
-        return { config: {}, present: true, readable: false };
-    }
-    try {
-        const config = await readProjectJsonObject(projectRoot, ".lisa.config.json");
-        return { config: config ?? {}, present: true, readable: true };
-    }
-    catch {
-        return { config: {}, present: true, readable: false };
-    }
-}
-/**
- * Confined JSON/path readers for the shared sync planner.
- * @param projectRoot
- */
-function safeSyncReads(projectRoot) {
-    return {
-        readJson: async (relativePath) => {
-            const text = await readProjectText(projectRoot, relativePath);
-            if (text === undefined)
-                return null;
-            try {
-                return JSON.parse(text);
-            }
-            catch (error) {
-                if (error instanceof SyntaxError)
-                    return null;
-                throw error;
-            }
-        },
-        pathExists: async (relativePath) => (await projectPathKind(projectRoot, relativePath)) !== "missing",
-    };
-}
 /**
  * Build a validated immutable HealthResult from ordered findings.
  * @param started
@@ -132,6 +92,7 @@ function probes(roots, configState, shape, deadline, options) {
         dryRun: true,
         reads: safeSyncReads(roots.projectRoot),
     });
+    const rulesets = shareRulesetReader(options.readRulesets ?? readGithubRulesets);
     return [
         {
             ...CHECKS[0],
@@ -164,7 +125,11 @@ function probes(roots, configState, shape, deadline, options) {
         },
         {
             ...CHECKS[11],
-            run: () => rulesetFinding(roots.lisaRoot, roots.projectRoot, safeShape.types, configState.config, options.readRulesets ?? readGithubRulesets, deadline.remainingMs(), deadline.signal),
+            run: () => rulesetFinding(roots.lisaRoot, roots.projectRoot, safeShape.types, configState.config, rulesets, deadline.remainingMs(), deadline.signal),
+        },
+        {
+            ...CHECKS[12],
+            run: () => declaredChecksDriftFinding(roots.projectRoot, configState.config, rulesets, deadline.remainingMs(), deadline.signal),
         },
     ];
 }

package/dist/health/deterministic.js.map

@@ -1 +1 @@
-{"version":3,"file":"deterministic.js","sourceRoot":"","sources":["../../src/health/deterministic.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,+HAA+H;AAC/H,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EACL,aAAa,GAEd,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EAIvB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,cAAc,EACd,aAAa,EACb,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAwB,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EACL,0BAA0B,GAE3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,WAAW,GAEZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,cAAc,GAEf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,wBAAwB,GAEzB,MAAM,0BAA0B,CAAC;AAElC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AA6BpC,MAAM,MAAM,GAAoD;IAC9D,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE;IAC/C,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE;IAC9C,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE;IACjD,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE;IACjD,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE;IAC7C,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,EAAE;IACnD,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,EAAE;IACrD,EAAE,KAAK,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,EAAE;IACxD,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE;IAC/C,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE;IACjD,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE;IAC9C,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE;CAClD,CAAC;AAEF;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,KAAa,EACb,MAAoB;IAEpB,OAAO,oBAAoB,CACzB,KAAK,EACL,MAAM,EACN,GAAG,KAAK,kEAAkE,CAC3E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC5B,WAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IACrE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CACxC,WAAW,EACX,mBAAmB,CACpB,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACxD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,WAAmB;IACxC,OAAO;QACL,QAAQ,EAAE,KAAK,EAAC,YAAY,EAAC,EAAE;YAC7B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAC9D,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACpC,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;YACrC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,WAAW;oBAAE,OAAO,IAAI,CAAC;gBAC9C,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,UAAU,EAAE,KAAK,EAAC,YAAY,EAAC,EAAE,CAC/B,CAAC,MAAM,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,KAAK,SAAS;KACnE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CACb,OAAa,EACb,SAAe,EACf,QAAkC;IAElC,MAAM,aAAa,GAAG,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,OAAO,oBAAoB,CAAC;QAC1B,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,UAAU,MAAM,CAAC,UAAU,EAAE,EAAE;QACtC,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,aAAa,CAAC,WAAW,EAAE;QACxC,QAAQ;QACR,OAAO,EAAE,uBAAuB,CAAC,QAAQ,CAAC;KAC3C,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,WAAmB,EACnB,QAAgB;IAEhB,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACnC,QAAQ,CAAC,QAAQ,CAAC;KACnB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;GASG;AACH,gHAAgH;AAChH,SAAS,MAAM,CACb,KAAkE,EAClE,WAA8B,EAC9B,KAAqC,EACrC,QAAwB,EACxB,OAAmC;IAEnC,MAAM,SAAS,GAAuB,KAAK,IAAI;QAC7C,KAAK,EAAE,EAAE;QACT,WAAW,EAAE,SAAS;KACvB,CAAC;IACF,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE;QAC5C,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC;KACxC,CAAC,CAAC;IACH,OAAO;QACL;YACE,GAAG,MAAM,CAAC,CAAC,CAAE;YACb,GAAG,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC;SACtE;QACD,EAAE,GAAG,MAAM,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;QAC5D,EAAE,GAAG,MAAM,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE;QACpD,EAAE,GAAG,MAAM,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,cAAc,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QACzE,EAAE,GAAG,MAAM,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,cAAc,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QACzE;YACE,GAAG,MAAM,CAAC,CAAC,CAAE;YACb,GAAG,EAAE,GAAG,EAAE,CACR,sBAAsB,CACpB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,WAAW,EACjB,SAAS,EACT,WAAW,CAAC,MAAM,CACnB;SACJ;QACD;YACE,GAAG,MAAM,CAAC,CAAC,CAAE;YACb,GAAG,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC;SACxE;QACD,EAAE,GAAG,MAAM,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;QACnE;YACE,GAAG,MAAM,CAAC,CAAC,CAAE;YACb,GAAG,EAAE,GAAG,EAAE,CACR,WAAW,CACT,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,WAAW,EACjB,SAAS,CAAC,KAAK,EACf,WAAW,CAAC,MAAM,EAClB,OAAO,CAAC,aAAa,IAAI,iBAAiB,EAC1C,QAAQ,CAAC,WAAW,EAAE,EACtB,QAAQ,CAAC,MAAM,CAChB;SACJ;QACD;YACE,GAAG,MAAM,CAAC,CAAC,CAAE;YACb,GAAG,EAAE,GAAG,EAAE,CACR,aAAa,CACX,KAAK,CAAC,WAAW,EACjB,WAAW,CAAC,MAAM,EAClB,SAAS,CAAC,KAAK,EACf,OAAO,CAAC,oBAAoB,IAAI,0BAA0B,EAC1D,QAAQ,CAAC,WAAW,EAAE,EACtB,QAAQ,CAAC,MAAM,CAChB;SACJ;QACD;YACE,GAAG,MAAM,CAAC,EAAE,CAAE;YACd,GAAG,EAAE,GAAG,EAAE,CACR,eAAe,CACb,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,WAAW,EACjB,SAAS,CAAC,KAAK,EACf,WAAW,CAAC,MAAM,CACnB;SACJ;QACD;YACE,GAAG,MAAM,CAAC,EAAE,CAAE;YACd,GAAG,EAAE,GAAG,EAAE,CACR,cAAc,CACZ,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,WAAW,EACjB,SAAS,CAAC,KAAK,EACf,WAAW,CAAC,MAAM,EAClB,OAAO,CAAC,YAAY,IAAI,kBAAkB,EAC1C,QAAQ,CAAC,WAAW,EAAE,EACtB,QAAQ,CAAC,MAAM,CAChB;SACJ;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,WAAmB,EACnB,UAAsC,EAAE;IAExC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;IACtB,MAAM,QAAQ,GAAG,IAAI,cAAc,CACjC,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAC1C,CAAC;IACF,IAAI,CAAC;QACH,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ;YAChB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,CAC9B,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,EACzC,SAAS,CACV,CAAC;QACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,MAAM,CACX,OAAO,EACP,GAAG,EAAE,EACL,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;gBACrD,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,KAAK;aAChB,CAAC;YACF,QAAQ,CAAC,GAAG,CACV,GAAG,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC,EACjD,SAAS,CACV;SACF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAC/D,QAAQ,CAAC,GAAG,CACV,KAAK,CAAC,GAAG,EACT,kBAAkB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CACnD,CACF,CACF,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC1C,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B,uHAAuH"}
+{"version":3,"file":"deterministic.js","sourceRoot":"","sources":["../../src/health/deterministic.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,+HAA+H;AAC/H,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EACL,uBAAuB,EAIvB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EACL,eAAe,EACf,aAAa,EACb,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,cAAc,EACd,aAAa,EACb,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAwB,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EACL,0BAA0B,GAE3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,WAAW,GAEZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kBAAkB,EAClB,cAAc,GAEf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,wBAAwB,GAEzB,MAAM,0BAA0B,CAAC;AAElC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AA6BpC,MAAM,MAAM,GAAoD;IAC9D,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE;IAC/C,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE;IAC9C,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE;IACjD,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE;IACjD,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE;IAC7C,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,EAAE;IACnD,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,EAAE;IACrD,EAAE,KAAK,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,EAAE;IACxD,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE;IAC/C,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE;IACjD,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE;IAC9C,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE;IACjD,EAAE,KAAK,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,EAAE;CACzD,CAAC;AAEF;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,KAAa,EACb,MAAoB;IAEpB,OAAO,oBAAoB,CACzB,KAAK,EACL,MAAM,EACN,GAAG,KAAK,kEAAkE,CAC3E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CACb,OAAa,EACb,SAAe,EACf,QAAkC;IAElC,MAAM,aAAa,GAAG,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,OAAO,oBAAoB,CAAC;QAC1B,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,UAAU,MAAM,CAAC,UAAU,EAAE,EAAE;QACtC,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,aAAa,CAAC,WAAW,EAAE;QACxC,QAAQ;QACR,OAAO,EAAE,uBAAuB,CAAC,QAAQ,CAAC;KAC3C,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,WAAmB,EACnB,QAAgB;IAEhB,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACnC,QAAQ,CAAC,QAAQ,CAAC;KACnB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;GASG;AACH,gHAAgH;AAChH,SAAS,MAAM,CACb,KAAkE,EAClE,WAA8B,EAC9B,KAAqC,EACrC,QAAwB,EACxB,OAAmC;IAEnC,MAAM,SAAS,GAAuB,KAAK,IAAI;QAC7C,KAAK,EAAE,EAAE;QACT,WAAW,EAAE,SAAS;KACvB,CAAC;IACF,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE;QAC5C,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,kBAAkB,CACjC,OAAO,CAAC,YAAY,IAAI,kBAAkB,CAC3C,CAAC;IACF,OAAO;QACL;YACE,GAAG,MAAM,CAAC,CAAC,CAAE;YACb,GAAG,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC;SACtE;QACD,EAAE,GAAG,MAAM,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;QAC5D,EAAE,GAAG,MAAM,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE;QACpD,EAAE,GAAG,MAAM,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,cAAc,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QACzE,EAAE,GAAG,MAAM,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,cAAc,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QACzE;YACE,GAAG,MAAM,CAAC,CAAC,CAAE;YACb,GAAG,EAAE,GAAG,EAAE,CACR,sBAAsB,CACpB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,WAAW,EACjB,SAAS,EACT,WAAW,CAAC,MAAM,CACnB;SACJ;QACD;YACE,GAAG,MAAM,CAAC,CAAC,CAAE;YACb,GAAG,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC;SACxE;QACD,EAAE,GAAG,MAAM,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;QACnE;YACE,GAAG,MAAM,CAAC,CAAC,CAAE;YACb,GAAG,EAAE,GAAG,EAAE,CACR,WAAW,CACT,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,WAAW,EACjB,SAAS,CAAC,KAAK,EACf,WAAW,CAAC,MAAM,EAClB,OAAO,CAAC,aAAa,IAAI,iBAAiB,EAC1C,QAAQ,CAAC,WAAW,EAAE,EACtB,QAAQ,CAAC,MAAM,CAChB;SACJ;QACD;YACE,GAAG,MAAM,CAAC,CAAC,CAAE;YACb,GAAG,EAAE,GAAG,EAAE,CACR,aAAa,CACX,KAAK,CAAC,WAAW,EACjB,WAAW,CAAC,MAAM,EAClB,SAAS,CAAC,KAAK,EACf,OAAO,CAAC,oBAAoB,IAAI,0BAA0B,EAC1D,QAAQ,CAAC,WAAW,EAAE,EACtB,QAAQ,CAAC,MAAM,CAChB;SACJ;QACD;YACE,GAAG,MAAM,CAAC,EAAE,CAAE;YACd,GAAG,EAAE,GAAG,EAAE,CACR,eAAe,CACb,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,WAAW,EACjB,SAAS,CAAC,KAAK,EACf,WAAW,CAAC,MAAM,CACnB;SACJ;QACD;YACE,GAAG,MAAM,CAAC,EAAE,CAAE;YACd,GAAG,EAAE,GAAG,EAAE,CACR,cAAc,CACZ,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,WAAW,EACjB,SAAS,CAAC,KAAK,EACf,WAAW,CAAC,MAAM,EAClB,QAAQ,EACR,QAAQ,CAAC,WAAW,EAAE,EACtB,QAAQ,CAAC,MAAM,CAChB;SACJ;QACD;YACE,GAAG,MAAM,CAAC,EAAE,CAAE;YACd,GAAG,EAAE,GAAG,EAAE,CACR,0BAA0B,CACxB,KAAK,CAAC,WAAW,EACjB,WAAW,CAAC,MAAM,EAClB,QAAQ,EACR,QAAQ,CAAC,WAAW,EAAE,EACtB,QAAQ,CAAC,MAAM,CAChB;SACJ;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,WAAmB,EACnB,UAAsC,EAAE;IAExC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;IACtB,MAAM,QAAQ,GAAG,IAAI,cAAc,CACjC,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAC1C,CAAC;IACF,IAAI,CAAC;QACH,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ;YAChB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,CAC9B,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,EACzC,SAAS,CACV,CAAC;QACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,MAAM,CACX,OAAO,EACP,GAAG,EAAE,EACL,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;gBACrD,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,KAAK;aAChB,CAAC;YACF,QAAQ,CAAC,GAAG,CACV,GAAG,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC,EACjD,SAAS,CACV;SACF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAC/D,QAAQ,CAAC,GAAG,CACV,KAAK,CAAC,GAAG,EACT,kBAAkB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CACnD,CACF,CACF,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC1C,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B,uHAAuH"}

package/dist/health/ruleset-inspection.d.ts

@@ -1,4 +1,5 @@
 import type { ProjectType } from "../core/config.js";
+import type { EnforcedContext } from "../core/gate-declaration-drift.js";
 import type { HealthFinding } from "./contract.js";
 /** Material ruleset fields health compares. */
 export interface HealthRuleset {
@@ -36,6 +37,32 @@ export declare const readGithubRulesets: RulesetReader;
  * @returns Expected rulesets sorted by name
  */
 export declare function expectedRulesets(lisaRoot: string, projectRoot: string, types: readonly ProjectType[], config: Readonly<Record<string, unknown>>): Promise<readonly HealthRuleset[]>;
+/**
+ * The required status contexts one project's ruleset templates name, with the
+ * file each requirement was read from.
+ *
+ * `expectedRulesets` already normalizes templates the way apply does, but it
+ * answers with whole ruleset documents and loses which file said what. The
+ * declaration comparison has to name the template file — "this context is
+ * required and no declaration asks for it" is not actionable without it — so
+ * this walk keeps the attribution instead.
+ *
+ * Returning an empty list is meaningful and must not be read as "nothing is
+ * enforced": callers treat an empty result as a source they could not reach,
+ * because a comparison against nothing reports every declaration as unenforced.
+ * @param lisaRoot - Lisa package root
+ * @param projectRoot - Canonical host root
+ * @param types - Canonically ordered project types
+ * @param config - Safe project config
+ * @returns Required contexts with their ruleset and source file
+ */
+export declare function expectedRequiredContexts(lisaRoot: string, projectRoot: string, types: readonly ProjectType[], config: Readonly<Record<string, unknown>>): Promise<readonly EnforcedContext[]>;
+/**
+ * The required status contexts a live ruleset payload names.
+ * @param actual - Rulesets as the repository actually holds them
+ * @returns Required contexts with their ruleset, sorted
+ */
+export declare function liveRequiredContexts(actual: readonly HealthRuleset[]): readonly EnforcedContext[];
 /**
  * Compare expected and observed material ruleset documents.
  * @param expected

package/dist/health/ruleset-inspection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ruleset-inspection.d.ts","sourceRoot":"","sources":["../../src/health/ruleset-inspection.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AA0BnD,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,KAChB,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;AAEvC,uDAAuD;AACvD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAsED;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,EAAE,aAsChC,CAAC;AA8LF;;;;;;;GAOG;AAEH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxC,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAmCnC;AAwJD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,SAAS,aAAa,EAAE,EAClC,MAAM,EAAE,SAAS,aAAa,EAAE,GAC/B,YAAY,CAiCd;AAuBD;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,MAAM,EAAE,aAAa,EACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,aAAa,CAAC,CAsDxB"}
+{"version":3,"file":"ruleset-inspection.d.ts","sourceRoot":"","sources":["../../src/health/ruleset-inspection.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AA+BnD,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,KAChB,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;AAEvC,uDAAuD;AACvD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAsED;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,EAAE,aAsChC,CAAC;AA8LF;;;;;;;GAOG;AAEH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxC,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAmCnC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxC,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC,CA4CrC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,SAAS,aAAa,EAAE,GAC/B,SAAS,eAAe,EAAE,CAW5B;AAwJD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,SAAS,aAAa,EAAE,EAClC,MAAM,EAAE,SAAS,aAAa,EAAE,GAC/B,YAAY,CAiCd;AAuBD;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,MAAM,EAAE,aAAa,EACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,aAAa,CAAC,CAsDxB"}

package/dist/health/ruleset-inspection.js

@@ -13,6 +13,10 @@ const ACTIONS_INTEGRATION_ID = 15_368;
 const REPOSITORY_PART = /^[A-Za-z0-9_.-]{1,100}$/u;
 const RULESET_CHECK = "github.rulesets";
 const WARN = "warn";
+/** Where a per-repo required-check opt-in is declared. */
+const CONFIGURED_CHECK_SOURCE = ".lisa.config.json \u2192 github.rulesets.addRequiredChecks";
+/** Where a live requirement was read from. */
+const LIVE_CHECK_SOURCE = "the repository's live rulesets";
 /**
  * Return a sorted copy without mutating caller-owned input.
  * @param items - Caller-owned items
@@ -299,6 +303,72 @@ export async function expectedRulesets(lisaRoot, projectRoot, types, config) {
     }
     return [...byName.values()].sort((left, right) => left.name.localeCompare(right.name));
 }
+/**
+ * The required status contexts one project's ruleset templates name, with the
+ * file each requirement was read from.
+ *
+ * `expectedRulesets` already normalizes templates the way apply does, but it
+ * answers with whole ruleset documents and loses which file said what. The
+ * declaration comparison has to name the template file — "this context is
+ * required and no declaration asks for it" is not actionable without it — so
+ * this walk keeps the attribution instead.
+ *
+ * Returning an empty list is meaningful and must not be read as "nothing is
+ * enforced": callers treat an empty result as a source they could not reach,
+ * because a comparison against nothing reports every declaration as unenforced.
+ * @param lisaRoot - Lisa package root
+ * @param projectRoot - Canonical host root
+ * @param types - Canonically ordered project types
+ * @param config - Safe project config
+ * @returns Required contexts with their ruleset and source file
+ */
+export async function expectedRequiredContexts(lisaRoot, projectRoot, types, config) {
+    const hasWorkflows = (await projectPathKind(projectRoot, path.join(".github", "workflows"))) ===
+        "directory";
+    const dropped = droppedChecks(config);
+    const byName = new Map();
+    for (const type of ["all", ...types]) {
+        const directory = path.join(lisaRoot, type, "github-rulesets");
+        try {
+            for (const file of await listFilesRecursive(directory)) {
+                const parsed = JSON.parse(await readFile(file, "utf8"));
+                const projected = projectRuleset(parsed);
+                const added = addedChecks(config, projected.name);
+                const rules = normalizeExpectedRules(withAddedChecks(projected.rules, added), hasWorkflows, dropped);
+                const addedContexts = new Set(added.map(check => String(check.context)));
+                const template = path
+                    .relative(lisaRoot, file)
+                    .split(path.sep)
+                    .join(path.posix.sep);
+                // eslint-disable-next-line functional/immutable-data -- most-specific stack wins, matching expectedRulesets
+                byName.set(projected.name, [...requiredStatusChecksByContext(rules).keys()].map(context => ({
+                    context,
+                    ruleset: projected.name,
+                    source: addedContexts.has(context)
+                        ? CONFIGURED_CHECK_SOURCE
+                        : template,
+                })));
+            }
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+    return sortedCopy([...byName.values()].flat(), (left, right) => left.context.localeCompare(right.context));
+}
+/**
+ * The required status contexts a live ruleset payload names.
+ * @param actual - Rulesets as the repository actually holds them
+ * @returns Required contexts with their ruleset, sorted
+ */
+export function liveRequiredContexts(actual) {
+    return sortedCopy(actual.flatMap(ruleset => [...requiredStatusChecksByContext(ruleset.rules).keys()].map(context => ({
+        context,
+        ruleset: ruleset.name,
+        source: LIVE_CHECK_SOURCE,
+    }))), (left, right) => left.context.localeCompare(right.context));
+}
 /**
  * Canonicalize semantically unordered JSON objects and arrays.
  * @param value