@codyswann/lisa 3.52.0 → 3.54.0

package/dist/core/gate-declaration-drift.d.ts

@@ -0,0 +1,190 @@
+/**
+ * Hold the gates declaration against the ruleset that enforces it.
+ *
+ * Three surfaces answer "what must pass before this merges" — the project's
+ * `gates` declarations, the shipped ruleset template, and the live GitHub
+ * ruleset — and until this module existed no comparator joined the first to
+ * either of the others. `contextsFor()` derived contexts from declarations,
+ * `lisa health` compared template against live, and the two halves never met,
+ * so a declaration and the protection enforcing it could disagree indefinitely
+ * with every check green.
+ *
+ * Two properties are load-bearing, and both are structural rather than
+ * conventional:
+ *
+ * 1. **`off` and undeclared are different findings.** `off` is a decision that
+ *    a property is not proved here, so protection requiring it is a live
+ *    contradiction. Undeclared is silence — the registry still has gates whose
+ *    jobs run with no declaration at all, so silence must never be read as
+ *    "not required", and must never justify removing live protection.
+ * 2. **Agreement is not proof.** A `matched` verdict means the declaration and
+ *    the ruleset name the same required context. It says nothing about whether
+ *    that context proves anything: one required context in this repository
+ *    ships a skip step printing "This job going green does NOT mean any
+ *    ast-grep rule has test coverage", and a required review context has gone
+ *    green carrying "Review skipped". A drift report that could not tell
+ *    "agreed and proved" from "agreed and unproved" would itself be a control
+ *    reporting more than it measured, so the word this module uses is
+ *    `matched` — the two surfaces agree — and never `enforced` or `proved`.
+ * 3. **No remedy in this module can say "remove the context".** Third-party
+ *    contexts are enforced by construction and declared by nobody; a
+ *    comparator whose vocabulary contained a removal would eventually propose
+ *    deleting one. The `DriftRemedy` union simply has no such member, so the
+ *    guarantee holds for every caller rather than for the careful ones.
+ * @module core/gate-declaration-drift
+ */
+/**
+ * What the settings file says about one gate at one moment.
+ *
+ * `off` and `not-declared` are deliberately separate. Collapsing them is what
+ * let a declaration govern nothing: the CI façade read both as
+ * `configured=false` and ran its built-in fallback, so `off` could not turn a
+ * job off.
+ */
+export type DeclarationState = "required" | "optional" | "off" | "not-declared";
+/** Which enforcing surface a comparison was made against. */
+export type DriftSurface = "ruleset-templates" | "live-ruleset";
+/**
+ * One context's verdict, in the vocabulary an operator can act on.
+ *
+ * Six members rather than a matched/unmatched pair, because the four unmatched
+ * cases need four different actions and one of them is not a defect at all.
+ */
+export type DriftVerdict = 
+/** Declared `required`, and the enforcing surface requires it. */
+"matched"
+/** Declared `required`; nothing on the enforcing surface requires it. */
+ | "declared-not-enforced"
+/** Enforced, while the declaration says `optional`. */
+ | "enforced-declared-optional"
+/** Enforced, while the declaration says `off` — a live contradiction. */
+ | "enforced-declared-off"
+/** Enforced, and a registry gate produces it, but nothing declares it. */
+ | "enforced-undeclared"
+/** Enforced, and no registry gate produces it — a third-party check. */
+ | "enforced-not-lisa-owned";
+/**
+ * What to do about one verdict.
+ *
+ * Deliberately closed, and deliberately without a removal. See the module note.
+ */
+export type DriftRemedy = "none" | "declare-the-gate" | "enforce-the-context" | "resolve-the-contradiction" | "decide-which-surface-wins";
+/** One required status context, and where the requirement was read from. */
+export interface EnforcedContext {
+    /** The context string, exactly as the ruleset spells it. */
+    readonly context: string;
+    /** The ruleset requiring it. */
+    readonly ruleset: string;
+    /**
+     * Where the requirement was read. A package-relative template path or a
+     * settings-file key — never an absolute path, which differs per machine and
+     * would break the byte-identical property the report is built on.
+     */
+    readonly source: string;
+}
+/** The gate a context belongs to, and what the settings file says about it. */
+export interface ContextOwner {
+    /** Registry gate id. */
+    readonly gateId: string;
+    /** The declaration at the merge moment. */
+    readonly declaration: DeclarationState;
+    /** Whether the registry permits declaring this gate at the merge moment. */
+    readonly legalAtMerge: boolean;
+}
+/** One context, its verdict, and the evidence behind it. */
+export interface DeclarationDriftEntry {
+    /** The context string. */
+    readonly context: string;
+    /** The verdict. */
+    readonly verdict: DriftVerdict;
+    /** The action this verdict calls for. Never a removal. */
+    readonly remedy: DriftRemedy;
+    /** The registry gate producing this context, when one does. */
+    readonly gateId: string | null;
+    /** What the settings file says, or null when no gate owns the context. */
+    readonly declaration: DeclarationState | null;
+    /** The rulesets requiring it, sorted. Empty when nothing enforces it. */
+    readonly rulesets: readonly string[];
+    /** Where the requirement was read from, sorted. */
+    readonly sources: readonly string[];
+    /** One operator-readable sentence. */
+    readonly detail: string;
+}
+/** The whole comparison against one enforcing surface. */
+export interface DeclarationDriftReport {
+    /** Which surface the declarations were held against. */
+    readonly surface: DriftSurface;
+    /** One entry per context, sorted by context. */
+    readonly entries: readonly DeclarationDriftEntry[];
+    /** How many entries carry each verdict. Every key is present. */
+    readonly counts: Readonly<Record<DriftVerdict, number>>;
+    /** Entries whose verdict is a contradiction rather than a gap. */
+    readonly contradictions: number;
+    /** Entries whose verdict is a gap the declaration surface could close. */
+    readonly gaps: number;
+}
+/** The slice of the shipped registry this comparison reads. */
+export interface MergeContextRegistry {
+    readonly REGISTRY: Readonly<Record<string, {
+        readonly label: string;
+        readonly moments: readonly string[];
+    }>>;
+    readonly resolveMoment: (options: {
+        gates: Record<string, unknown>;
+        moment: string;
+        includeOff?: boolean;
+    }) => readonly {
+        readonly id: string;
+        readonly level: string;
+        readonly mode: string;
+        readonly awaits: string | null;
+    }[];
+    readonly momentFamily: (moment: string) => string;
+}
+/** The moment a branch ruleset guards. */
+export declare const MERGE_MOMENT = "pull-request";
+/**
+ * Map every context a registry gate can produce to that gate.
+ *
+ * Built from the whole registry rather than from the declared gates, which is
+ * the difference between "protection requires a context whose gate nobody
+ * declared" and "protection requires a context Lisa knows nothing about". Those
+ * are different findings with different remedies, and a map built only from
+ * declarations could not tell them apart.
+ * @param options - Inputs
+ * @param options.registry - The shipped registry
+ * @param options.gates - The project's gates block
+ * @param options.workflowName - The workflow whose name prefixes a context
+ * @returns Context string to owning gate
+ */
+export declare function contextOwners(options: {
+    registry: MergeContextRegistry;
+    gates: Record<string, unknown>;
+    workflowName: string;
+}): ReadonlyMap<string, ContextOwner>;
+/**
+ * The contexts a `required` declaration promises protection will require.
+ * @param owners - Context to owning gate
+ * @returns The contexts, sorted
+ */
+export declare function declaredRequiredContexts(owners: ReadonlyMap<string, ContextOwner>): readonly string[];
+/**
+ * Compare a project's declarations with one enforcing surface.
+ *
+ * Total and pure — the same inputs always produce the same entries in the same
+ * order. Reaching the surface is the caller's job, and a caller that could not
+ * reach it must report an unknown rather than call this with an empty list: a
+ * comparison against nothing would report every declaration as unenforced,
+ * which is a different and false claim.
+ * @param options - Inputs
+ * @param options.surface - Which surface `enforced` was read from
+ * @param options.owners - Context to owning gate
+ * @param options.enforced - Contexts the surface requires
+ * @returns The comparison
+ */
+export declare function classifyDeclarationDrift(options: {
+    surface: DriftSurface;
+    owners: ReadonlyMap<string, ContextOwner>;
+    enforced: readonly EnforcedContext[];
+}): DeclarationDriftReport;
+//# sourceMappingURL=gate-declaration-drift.d.ts.map

package/dist/core/gate-declaration-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-declaration-drift.d.ts","sourceRoot":"","sources":["../../src/core/gate-declaration-drift.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,UAAU,GAAG,KAAK,GAAG,cAAc,CAAC;AAEhF,6DAA6D;AAC7D,MAAM,MAAM,YAAY,GAAG,mBAAmB,GAAG,cAAc,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,MAAM,YAAY;AACtB,kEAAkE;AAChE,SAAS;AACX,yEAAyE;GACvE,uBAAuB;AACzB,uDAAuD;GACrD,4BAA4B;AAC9B,yEAAyE;GACvE,uBAAuB;AACzB,0EAA0E;GACxE,qBAAqB;AACvB,wEAAwE;GACtE,yBAAyB,CAAC;AAE9B;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,kBAAkB,GAClB,qBAAqB,GACrB,2BAA2B,GAC3B,2BAA2B,CAAC;AAEhC,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gCAAgC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,wBAAwB;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2CAA2C;IAC3C,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,4DAA4D;AAC5D,MAAM,WAAW,qBAAqB;IACpC,0BAA0B;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mBAAmB;IACnB,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC9C,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,sCAAsC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,0DAA0D;AAC1D,MAAM,WAAW,sBAAsB;IACrC,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACnD,iEAAiE;IACjE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,kEAAkE;IAClE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CACzB,MAAM,CACJ,MAAM,EACN;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAChE,CACF,CAAC;IACF,QAAQ,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE;QAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,KAAK,SAAS;QACb,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;KAChC,EAAE,CAAC;IACJ,QAAQ,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC;CACnD;AAED,0CAA0C;AAC1C,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAgE3C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE;IACrC,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAiCpC;AA8BD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,GACxC,SAAS,MAAM,EAAE,CAMnB;AAwED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,OAAO,EAAE,YAAY,CAAC;IACtB,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC1C,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;CACtC,GAAG,sBAAsB,CA8DzB"}

package/dist/core/gate-declaration-drift.js

@@ -0,0 +1,300 @@
+/**
+ * Hold the gates declaration against the ruleset that enforces it.
+ *
+ * Three surfaces answer "what must pass before this merges" — the project's
+ * `gates` declarations, the shipped ruleset template, and the live GitHub
+ * ruleset — and until this module existed no comparator joined the first to
+ * either of the others. `contextsFor()` derived contexts from declarations,
+ * `lisa health` compared template against live, and the two halves never met,
+ * so a declaration and the protection enforcing it could disagree indefinitely
+ * with every check green.
+ *
+ * Two properties are load-bearing, and both are structural rather than
+ * conventional:
+ *
+ * 1. **`off` and undeclared are different findings.** `off` is a decision that
+ *    a property is not proved here, so protection requiring it is a live
+ *    contradiction. Undeclared is silence — the registry still has gates whose
+ *    jobs run with no declaration at all, so silence must never be read as
+ *    "not required", and must never justify removing live protection.
+ * 2. **Agreement is not proof.** A `matched` verdict means the declaration and
+ *    the ruleset name the same required context. It says nothing about whether
+ *    that context proves anything: one required context in this repository
+ *    ships a skip step printing "This job going green does NOT mean any
+ *    ast-grep rule has test coverage", and a required review context has gone
+ *    green carrying "Review skipped". A drift report that could not tell
+ *    "agreed and proved" from "agreed and unproved" would itself be a control
+ *    reporting more than it measured, so the word this module uses is
+ *    `matched` — the two surfaces agree — and never `enforced` or `proved`.
+ * 3. **No remedy in this module can say "remove the context".** Third-party
+ *    contexts are enforced by construction and declared by nobody; a
+ *    comparator whose vocabulary contained a removal would eventually propose
+ *    deleting one. The `DriftRemedy` union simply has no such member, so the
+ *    guarantee holds for every caller rather than for the careful ones.
+ * @module core/gate-declaration-drift
+ */
+/** The moment a branch ruleset guards. */
+export const MERGE_MOMENT = "pull-request";
+/** Every verdict, named once so no two mentions can drift apart. */
+const MATCHED = "matched";
+const DECLARED_NOT_ENFORCED = "declared-not-enforced";
+const ENFORCED_DECLARED_OPTIONAL = "enforced-declared-optional";
+const ENFORCED_DECLARED_OFF = "enforced-declared-off";
+const ENFORCED_UNDECLARED = "enforced-undeclared";
+const ENFORCED_NOT_LISA_OWNED = "enforced-not-lisa-owned";
+/** Verdicts where the two surfaces state opposite things. */
+const CONTRADICTIONS = new Set([
+    DECLARED_NOT_ENFORCED,
+    ENFORCED_DECLARED_OFF,
+]);
+/** Verdicts where one surface is silent rather than contrary. */
+const GAPS = new Set([
+    ENFORCED_DECLARED_OPTIONAL,
+    ENFORCED_UNDECLARED,
+]);
+/** The remedy each verdict calls for. */
+const REMEDIES = {
+    [MATCHED]: "none",
+    [DECLARED_NOT_ENFORCED]: "enforce-the-context",
+    [ENFORCED_DECLARED_OPTIONAL]: "decide-which-surface-wins",
+    [ENFORCED_DECLARED_OFF]: "resolve-the-contradiction",
+    [ENFORCED_UNDECLARED]: "declare-the-gate",
+    [ENFORCED_NOT_LISA_OWNED]: "none",
+};
+/** Every verdict, so a count of zero is still a stated zero. */
+const VERDICTS = Object.keys(REMEDIES);
+/** How the enforcing surface is named in a sentence. */
+const SURFACE_NAMES = {
+    "ruleset-templates": "the shipped ruleset template",
+    "live-ruleset": "the live branch-protection ruleset",
+};
+/**
+ * Sort strings the same way everywhere, so two runs emit the same bytes.
+ * @param values - Caller-owned strings
+ * @returns A sorted copy
+ */
+function sorted(values) {
+    return [...values].sort((left, right) => left.localeCompare(right));
+}
+/**
+ * The declaration state one resolved level names.
+ *
+ * Anything that is not one of the three levels is `not-declared`, because an
+ * unknown level is a typo rather than a claim.
+ * @param level - The resolved level
+ * @returns The declaration state
+ */
+function asDeclaration(level) {
+    return level === "required" || level === "optional" || level === "off"
+        ? level
+        : "not-declared";
+}
+/**
+ * Map every context a registry gate can produce to that gate.
+ *
+ * Built from the whole registry rather than from the declared gates, which is
+ * the difference between "protection requires a context whose gate nobody
+ * declared" and "protection requires a context Lisa knows nothing about". Those
+ * are different findings with different remedies, and a map built only from
+ * declarations could not tell them apart.
+ * @param options - Inputs
+ * @param options.registry - The shipped registry
+ * @param options.gates - The project's gates block
+ * @param options.workflowName - The workflow whose name prefixes a context
+ * @returns Context string to owning gate
+ */
+export function contextOwners(options) {
+    const { registry, gates, workflowName } = options;
+    const resolved = resolveMergeMoment(registry, gates);
+    const family = registry.momentFamily(MERGE_MOMENT);
+    const owners = Object.entries(registry.REGISTRY).map(([gateId, definition]) => {
+        const hit = resolved.get(gateId);
+        return [
+            `${workflowName} / ${definition.label}`,
+            {
+                gateId,
+                declaration: asDeclaration(hit?.level),
+                legalAtMerge: definition.moments.includes(family),
+            },
+        ];
+    });
+    const awaited = [...resolved.values()].flatMap(hit => hit.mode === "await" && hit.awaits !== null
+        ? [
+            [
+                hit.awaits,
+                {
+                    gateId: hit.id,
+                    declaration: asDeclaration(hit.level),
+                    legalAtMerge: registry.REGISTRY[hit.id]?.moments.includes(family) === true,
+                },
+            ],
+        ]
+        : []);
+    return new Map([...owners, ...awaited]);
+}
+/**
+ * Resolve the merge moment, treating a refusal as "nothing resolved".
+ *
+ * A refusal is never swallowed by the caller: `readTemplateEnforcement` and the
+ * health check both report the declaration problems separately. What must not
+ * happen here is a throw that turns a comparison into no comparison at all.
+ * @param registry - The shipped registry
+ * @param gates - The project's gates block
+ * @returns Resolved gates keyed by id
+ */
+function resolveMergeMoment(registry, gates) {
+    try {
+        return new Map(registry
+            .resolveMoment({ gates, moment: MERGE_MOMENT, includeOff: true })
+            .map(entry => [entry.id, { ...entry }]));
+    }
+    catch {
+        return new Map();
+    }
+}
+/**
+ * The contexts a `required` declaration promises protection will require.
+ * @param owners - Context to owning gate
+ * @returns The contexts, sorted
+ */
+export function declaredRequiredContexts(owners) {
+    return sorted([...owners.entries()]
+        .filter(([, owner]) => owner.declaration === "required")
+        .map(([context]) => context));
+}
+/**
+ * The verdict for one enforced context.
+ * @param owner - The gate producing it, when one does
+ * @returns The verdict
+ */
+function verdictForEnforced(owner) {
+    if (owner === undefined)
+        return ENFORCED_NOT_LISA_OWNED;
+    if (owner.declaration === "required")
+        return MATCHED;
+    if (owner.declaration === "optional")
+        return ENFORCED_DECLARED_OPTIONAL;
+    if (owner.declaration === "off")
+        return ENFORCED_DECLARED_OFF;
+    return ENFORCED_UNDECLARED;
+}
+/**
+ * The sentence one verdict is explained with.
+ * @param options - Inputs
+ * @param options.verdict - The verdict
+ * @param options.surface - The enforcing surface
+ * @param options.gateId - The owning gate, when there is one
+ * @param options.sources - Where the requirement was read from
+ * @returns One operator-readable sentence
+ */
+// eslint-disable-next-line sonarjs/cognitive-complexity -- one branch per verdict keeps the wording auditable
+function detailFor(options) {
+    const { verdict, gateId, sources } = options;
+    const surface = SURFACE_NAMES[options.surface];
+    const where = sources.length === 0 ? "" : ` (${sources.join(", ")})`;
+    if (verdict === MATCHED) {
+        return `Declared required, and ${surface} requires it${where}. The two surfaces agree; that is not evidence the check proves its property.`;
+    }
+    if (verdict === DECLARED_NOT_ENFORCED) {
+        return `The settings file declares "${String(gateId)}" required at ${MERGE_MOMENT}, but ${surface} does not require this context, so the declaration blocks nothing.`;
+    }
+    if (verdict === ENFORCED_DECLARED_OPTIONAL) {
+        return `${surface} requires this context${where}, while the settings file declares "${String(gateId)}" optional at ${MERGE_MOMENT}. Two surfaces, two answers — name which one wins.`;
+    }
+    if (verdict === ENFORCED_DECLARED_OFF) {
+        return `The settings file declares "${String(gateId)}" off at ${MERGE_MOMENT} — an explicit decision not to prove it here — yet ${surface} requires this context${where}. That is a contradiction, not a gap.`;
+    }
+    if (verdict === ENFORCED_UNDECLARED) {
+        return `${surface} requires this context${where}, and it is produced by the gate "${String(gateId)}", which the settings file never declares at any moment. Undeclared is silence, not permission to stop requiring it.`;
+    }
+    return `${surface} requires this context${where}, and no gate in Lisa's registry produces it — it comes from a third-party app or from a job this project's own CI defines. Matching is on the exact context string, never on a job name that merely resembles it: a third-party app status and a Lisa job with a similar name are different things, and treating them as one produces a false drift report, or worse a false clean one. Reported so it can be told apart from a Lisa gate that fell out of the settings file, never so it can be removed.`;
+}
+/**
+ * Group enforced contexts, keeping every ruleset and source that named one.
+ * @param enforced - Enforced contexts, possibly repeating a context
+ * @returns Context to its rulesets and sources
+ */
+function groupEnforced(enforced) {
+    return enforced.reduce((grouped, entry) => {
+        const existing = grouped.get(entry.context) ?? {
+            rulesets: [],
+            sources: [],
+        };
+        return new Map(grouped).set(entry.context, {
+            rulesets: [...existing.rulesets, entry.ruleset],
+            sources: [...existing.sources, entry.source],
+        });
+    }, new Map());
+}
+/**
+ * Compare a project's declarations with one enforcing surface.
+ *
+ * Total and pure — the same inputs always produce the same entries in the same
+ * order. Reaching the surface is the caller's job, and a caller that could not
+ * reach it must report an unknown rather than call this with an empty list: a
+ * comparison against nothing would report every declaration as unenforced,
+ * which is a different and false claim.
+ * @param options - Inputs
+ * @param options.surface - Which surface `enforced` was read from
+ * @param options.owners - Context to owning gate
+ * @param options.enforced - Contexts the surface requires
+ * @returns The comparison
+ */
+export function classifyDeclarationDrift(options) {
+    const { surface, owners, enforced } = options;
+    const grouped = groupEnforced(enforced);
+    const enforcedEntries = sorted(grouped.keys()).map((context) => {
+        const owner = owners.get(context);
+        const verdict = verdictForEnforced(owner);
+        const found = grouped.get(context);
+        const sources = sorted(new Set(found?.sources ?? []));
+        return {
+            context,
+            verdict,
+            remedy: REMEDIES[verdict],
+            gateId: owner?.gateId ?? null,
+            declaration: owner?.declaration ?? null,
+            rulesets: sorted(new Set(found?.rulesets ?? [])),
+            sources,
+            detail: detailFor({
+                verdict,
+                surface,
+                gateId: owner?.gateId ?? null,
+                sources,
+            }),
+        };
+    });
+    const unenforced = declaredRequiredContexts(owners)
+        .filter(context => !grouped.has(context))
+        .map((context) => {
+        const gateId = owners.get(context)?.gateId ?? null;
+        return {
+            context,
+            verdict: DECLARED_NOT_ENFORCED,
+            remedy: REMEDIES[DECLARED_NOT_ENFORCED],
+            gateId,
+            declaration: "required",
+            rulesets: [],
+            sources: [],
+            detail: detailFor({
+                verdict: DECLARED_NOT_ENFORCED,
+                surface,
+                gateId,
+                sources: [],
+            }),
+        };
+    });
+    const entries = [...enforcedEntries, ...unenforced].sort((left, right) => left.context.localeCompare(right.context));
+    return {
+        surface,
+        entries,
+        counts: Object.fromEntries(VERDICTS.map(verdict => [
+            verdict,
+            entries.filter(entry => entry.verdict === verdict).length,
+        ])),
+        contradictions: entries.filter(entry => CONTRADICTIONS.has(entry.verdict))
+            .length,
+        gaps: entries.filter(entry => GAPS.has(entry.verdict)).length,
+    };
+}
+//# sourceMappingURL=gate-declaration-drift.js.map

package/dist/core/gate-declaration-drift.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-declaration-drift.js","sourceRoot":"","sources":["../../src/core/gate-declaration-drift.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AA8HH,0CAA0C;AAC1C,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAE3C,oEAAoE;AACpE,MAAM,OAAO,GAAG,SAAS,CAAC;AAC1B,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AACtD,MAAM,0BAA0B,GAAG,4BAA4B,CAAC;AAChE,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AACtD,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAClD,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAE1D,6DAA6D;AAC7D,MAAM,cAAc,GAA8B,IAAI,GAAG,CAAe;IACtE,qBAAqB;IACrB,qBAAqB;CACtB,CAAC,CAAC;AAEH,iEAAiE;AACjE,MAAM,IAAI,GAA8B,IAAI,GAAG,CAAe;IAC5D,0BAA0B;IAC1B,mBAAmB;CACpB,CAAC,CAAC;AAEH,yCAAyC;AACzC,MAAM,QAAQ,GAAgD;IAC5D,CAAC,OAAO,CAAC,EAAE,MAAM;IACjB,CAAC,qBAAqB,CAAC,EAAE,qBAAqB;IAC9C,CAAC,0BAA0B,CAAC,EAAE,2BAA2B;IACzD,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;IACpD,CAAC,mBAAmB,CAAC,EAAE,kBAAkB;IACzC,CAAC,uBAAuB,CAAC,EAAE,MAAM;CAClC,CAAC;AAEF,gEAAgE;AAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAA4B,CAAC;AAElE,wDAAwD;AACxD,MAAM,aAAa,GAA2C;IAC5D,mBAAmB,EAAE,8BAA8B;IACnD,cAAc,EAAE,oCAAoC;CACrD,CAAC;AAEF;;;;GAIG;AACH,SAAS,MAAM,CAAC,MAAwB;IACtC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,KAAyB;IAC9C,OAAO,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,KAAK;QACpE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,cAAc,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAAC,OAI7B;IACC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CAClD,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,EAAmC,EAAE;QACxD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO;YACL,GAAG,YAAY,MAAM,UAAU,CAAC,KAAK,EAAE;YACvC;gBACE,MAAM;gBACN,WAAW,EAAE,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC;gBACtC,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;aAClD;SACO,CAAC;IACb,CAAC,CACF,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CACnD,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;QACzC,CAAC,CAAC;YACE;gBACE,GAAG,CAAC,MAAM;gBACV;oBACE,MAAM,EAAE,GAAG,CAAC,EAAE;oBACd,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;oBACrC,YAAY,EACV,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI;iBAC/D;aACO;SACX;QACH,CAAC,CAAC,EAAE,CACP,CAAC;IACF,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CACzB,QAA8B,EAC9B,KAA8B;IAK9B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CACZ,QAAQ;aACL,aAAa,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;aAChE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAyC;IAEzC,OAAO,MAAM,CACX,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,UAAU,CAAC;SACvD,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAA+B;IACzD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,uBAAuB,CAAC;IACxD,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU;QAAE,OAAO,0BAA0B,CAAC;IACxE,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK;QAAE,OAAO,qBAAqB,CAAC;IAC9D,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;;;;;;;GAQG;AACH,8GAA8G;AAC9G,SAAS,SAAS,CAAC,OAKlB;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACrE,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,0BAA0B,OAAO,eAAe,KAAK,+EAA+E,CAAC;IAC9I,CAAC;IACD,IAAI,OAAO,KAAK,qBAAqB,EAAE,CAAC;QACtC,OAAO,+BAA+B,MAAM,CAAC,MAAM,CAAC,iBAAiB,YAAY,SAAS,OAAO,oEAAoE,CAAC;IACxK,CAAC;IACD,IAAI,OAAO,KAAK,0BAA0B,EAAE,CAAC;QAC3C,OAAO,GAAG,OAAO,yBAAyB,KAAK,uCAAuC,MAAM,CAAC,MAAM,CAAC,iBAAiB,YAAY,oDAAoD,CAAC;IACxL,CAAC;IACD,IAAI,OAAO,KAAK,qBAAqB,EAAE,CAAC;QACtC,OAAO,+BAA+B,MAAM,CAAC,MAAM,CAAC,YAAY,YAAY,sDAAsD,OAAO,yBAAyB,KAAK,uCAAuC,CAAC;IACjN,CAAC;IACD,IAAI,OAAO,KAAK,mBAAmB,EAAE,CAAC;QACpC,OAAO,GAAG,OAAO,yBAAyB,KAAK,qCAAqC,MAAM,CAAC,MAAM,CAAC,sHAAsH,CAAC;IAC3N,CAAC;IACD,OAAO,GAAG,OAAO,yBAAyB,KAAK,4eAA4e,CAAC;AAC9hB,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CACpB,QAAoC;IAEpC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI;YAC7C,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,EAAE;SACZ,CAAC;QACF,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE;YACzC,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC;YAC/C,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC,EAAE,IAAI,GAAG,EAAqD,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAIxC;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC9C,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAChD,CAAC,OAAO,EAAyB,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,OAAO;YACL,OAAO;YACP,OAAO;YACP,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;YACzB,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,IAAI;YAC7B,WAAW,EAAE,KAAK,EAAE,WAAW,IAAI,IAAI;YACvC,QAAQ,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;YAChD,OAAO;YACP,MAAM,EAAE,SAAS,CAAC;gBAChB,OAAO;gBACP,OAAO;gBACP,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,IAAI;gBAC7B,OAAO;aACR,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IACF,MAAM,UAAU,GAAG,wBAAwB,CAAC,MAAM,CAAC;SAChD,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;SACxC,GAAG,CAAC,CAAC,OAAO,EAAyB,EAAE;QACtC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;QACnD,OAAO;YACL,OAAO;YACP,OAAO,EAAE,qBAAqB;YAC9B,MAAM,EAAE,QAAQ,CAAC,qBAAqB,CAAC;YACvC,MAAM;YACN,WAAW,EAAE,UAAU;YACvB,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,SAAS,CAAC;gBAChB,OAAO,EAAE,qBAAqB;gBAC9B,OAAO;gBACP,MAAM;gBACN,OAAO,EAAE,EAAE;aACZ,CAAC;SACH,CAAC;IACJ,CAAC,CAAC,CAAC;IACL,MAAM,OAAO,GAAG,CAAC,GAAG,eAAe,EAAE,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACvE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAC1C,CAAC;IACF,OAAO;QACL,OAAO;QACP,OAAO;QACP,MAAM,EAAE,MAAM,CAAC,WAAW,CACxB,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACtB,OAAO;YACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,MAAM;SAC1D,CAAC,CAC6B;QACjC,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;aACvE,MAAM;QACT,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;KAC9D,CAAC;AACJ,CAAC"}

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAg3EpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk5OjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAg3EpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CA85OjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -521,7 +521,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-detect-tooling/SKILL.md": "6ea2b1404d5c27f8a5bec8c90ad35ed0124789b70c091869455f538a2a9debbe",
     "plugins/src/base/skills/lisa-detect-tooling/scripts/commands.mjs": "e28bd61fdde4a336b56ae3395423026943a5816015719d31d04f0d5a0ab50eec",
     "plugins/src/base/skills/lisa-detect-tooling/scripts/detect-tooling.mjs": "d9419814fc04c935bd7e320e85b1977c9bfc9275d9ea5fb557002ad438ee7925",
-    "plugins/src/base/skills/lisa-doctor/SKILL.md": "a16ded88a648852c02f7ee3e30ef97afb644384f2ea2e977c3e4a288600278de",
+    "plugins/src/base/skills/lisa-doctor/SKILL.md": "83fd779c341108729a926bc2680d54f0b69044137840b1d80d660243a7f74ba5",
     "plugins/src/base/skills/lisa-drive-pr-to-merge/SKILL.md": "e27849a2567081bce5ea3aa31f7cc5868f884a59c343c685b900ac7aa707666a",
     "plugins/src/base/skills/lisa-epic-triage/SKILL.md": "d02760411249bddbd396f283191fe3e82bb7b95bf9393a19a7025dc5a57c3ab7",
     "plugins/src/base/skills/lisa-evaluation-suite/SKILL.md": "96b5c2091ccd22a565935a7b0b917f67998881b81055ce3e4d518319472eac8b",
@@ -7110,6 +7110,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/cli/cross-pollinate-nudge.ts": true,
     "src/cli/doctor-apply-failure.ts": true,
     "src/cli/doctor-apply-freshness.ts": true,
+    "src/cli/doctor-declared-contexts.ts": true,
     "src/cli/doctor-gate-recommendation.ts": true,
     "src/cli/doctor-hook-copy-parity.ts": true,
     "src/cli/doctor-kane.ts": true,
@@ -7174,6 +7175,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/cli/gate-report-cells.ts": true,
     "src/cli/gate-report-config.ts": true,
     "src/cli/gate-report-contexts.ts": true,
+    "src/cli/gate-report-drift-section.ts": true,
     "src/cli/gate-report-executors.ts": true,
     "src/cli/gate-report-facade.ts": true,
     "src/cli/gate-report-fragment.ts": true,
@@ -7188,6 +7190,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/cli/gate-report-skip-jobs.ts": true,
     "src/cli/gate-report-style.ts": true,
     "src/cli/gate-report-summary.ts": true,
+    "src/cli/gate-report-templates.ts": true,
     "src/cli/gate-report-types.ts": true,
     "src/cli/gate-report-upstream.ts": true,
     "src/cli/gate-report.ts": true,
@@ -7300,6 +7303,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/core/config.ts": true,
     "src/core/downstream-names.ts": true,
     "src/core/downstream-references.ts": true,
+    "src/core/gate-declaration-drift.ts": true,
     "src/core/git-service.ts": true,
     "src/core/guard-capabilities.ts": true,
     "src/core/hook-copy-parity.ts": true,
@@ -7361,6 +7365,8 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/health/consumer.ts": true,
     "src/health/contract.ts": true,
     "src/health/deadline.ts": true,
+    "src/health/declared-checks-inspection.ts": true,
+    "src/health/deterministic-inputs.ts": true,
     "src/health/deterministic.ts": true,
     "src/health/drift-tickets.ts": true,
     "src/health/evaluation-protocol.ts": true,
@@ -7660,6 +7666,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/cli/check-learnings-budget-cmd.test.ts": true,
     "tests/unit/cli/doctor-apply-failure.test.ts": true,
     "tests/unit/cli/doctor-apply-freshness.test.ts": true,
+    "tests/unit/cli/doctor-declared-contexts.test.ts": true,
     "tests/unit/cli/doctor-gate-recommendation.test.ts": true,
     "tests/unit/cli/doctor-hook-copy-parity.test.ts": true,
     "tests/unit/cli/doctor-kane.test.ts": true,
@@ -7715,10 +7722,13 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/cli/file-upstream-contract.test.ts": true,
     "tests/unit/cli/gate-commands.test.ts": true,
     "tests/unit/cli/gate-report-attribution.test.ts": true,
+    "tests/unit/cli/gate-report-declaration-drift.test.ts": true,
     "tests/unit/cli/gate-report-executors.test.ts": true,
     "tests/unit/cli/gate-report-fixtures.ts": true,
+    "tests/unit/cli/gate-report-preview-escaping.test.ts": true,
     "tests/unit/cli/gate-report-preview.test.ts": true,
     "tests/unit/cli/gate-report-ruleset.test.ts": true,
+    "tests/unit/cli/gate-report-skip-jobs-render.test.ts": true,
     "tests/unit/cli/gate-report-states.test.ts": true,
     "tests/unit/cli/gate-report-workflows.ts": true,
     "tests/unit/cli/gate-report.test.ts": true,
@@ -7856,6 +7866,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/core/bootstrap-environment.test.ts": true,
     "tests/unit/core/fs-extra-namespace-callsites.test.ts": true,
     "tests/unit/core/fs-extra-namespace-members.test.ts": true,
+    "tests/unit/core/gate-declaration-drift.test.ts": true,
     "tests/unit/core/hook-copy-parity.test.ts": true,
     "tests/unit/core/host-rules-parity.test.ts": true,
     "tests/unit/core/host-rules-pointer.test.ts": true,
@@ -7913,6 +7924,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/health/consumer.test.ts": true,
     "tests/unit/health/contract.test.ts": true,
     "tests/unit/health/deadline.test.ts": true,
+    "tests/unit/health/declared-checks.test.ts": true,
     "tests/unit/health/deterministic-regressions.test.ts": true,
     "tests/unit/health/deterministic.test.ts": true,
     "tests/unit/health/drift-tickets.test.ts": true,