@codyswann/lisa 3.69.5 → 3.70.0

package/all/copy-overwrite/scripts/lisa-gates.mjs

@@ -60,7 +60,7 @@
  * @module lisa-gates
  */
 
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 
 import { invokedAsScript } from "./lib/invoked-as-script.mjs";
@@ -491,6 +491,26 @@ export const REGISTRY = Object.freeze({
     moments: PR_ONWARD,
     work: "routes measured",
   },
+  "behavior-contract": {
+    label: "🧾 BDD Behavior Contract",
+    summary:
+      "Every declared behavior is mapped to an automated test, or waived on the record.",
+    task: "check:behavior-contract",
+    shippedAs: "bdd:coverage",
+    declareOnly:
+      "The prover ships as `scripts/check-bdd-coverage.mjs`, and the expo stack ships the task that invokes it as `bdd:coverage`, which an expo project resolves through automatically. Elsewhere, point `run:` at your own behavior-contract check.",
+    // THE gate for this property, and the only one. The job used to answer to a
+    // `bdd_mode` workflow input carrying its own three states, one of which —
+    // `bootstrap` — was a time-boxed grace period: a visible, non-blocking check
+    // with a named owner and an expiry date. That is `optional` plus paperwork,
+    // and it hid red while calling itself adoption. The owner retired it, and
+    // the private axis went with it, so the three levels here are the whole
+    // vocabulary: `required` to make the context a merge condition, `optional`
+    // to see the red without being blocked by it, `off` to say on the record
+    // that this project does not govern the property.
+    moments: PR_ONWARD,
+    work: "scenarios declared",
+  },
   "state-classification": {
     label: "🧬 State Classification",
     summary:
@@ -741,6 +761,20 @@ export const REGISTRY = Object.freeze({
       "Which files are generated is project-specific. Lisa's own prover checks Lisa's own artifacts and would answer nothing useful elsewhere.",
     moments: COMMIT_ONWARD,
   },
+  "learnings-budget": {
+    label: "📚 Learnings Budget",
+    summary: "The project learnings ledger stays inside its hard budget.",
+    task: "check:learnings-budget",
+    declareOnly:
+      "Lisa ships the prover as the `lisa check-learnings-budget` CLI subcommand, not as an npm script, so no stack template ships this task. The `📚 Learnings Budget` job runs the CLI itself when nothing is declared; declare `run:` only to point at your own prover.",
+    // CORPUS HEALTH, not change correctness: this can fail on a commit that
+    // touched nothing near the ledger, because the ledger is a shared document
+    // that grows. `artifact-freshness` has the same shape and the same moments,
+    // and the reasoning is the same in both — a document that must stay
+    // serveable is worth checking at every moment a change is offered, not only
+    // at the one where the change happened to touch it.
+    moments: COMMIT_ONWARD,
+  },
   "conflict-residue": {
     label: "🩹 Conflict Markers",
     summary: "No leftover merge-conflict markers in tracked files.",
@@ -815,11 +849,21 @@ export const QUALITY_JOB_GATES = Object.freeze({
   environment_reset: "environment-reset",
   environment_reseed: "environment-reseed",
   dead_code: "dead-code",
+  // Governs the property in EVERY workflow that enforces it, which is what
+  // #2932 turned on. `quality.yml` and `quality-rails.yml` both run the check
+  // in a job named `📚 Learnings Budget`; `plugins-sync.yml` used to run the
+  // same command as one step among fifteen inside `🧩 Plugin artifacts match
+  // source` — a REQUIRED context the `learnings_budget` skip token could not
+  // reach, so the property stayed enforced here no matter what a project
+  // declared. That step moved into this job, so one declaration now decides
+  // every place the property is proved.
+  learnings_budget: "learnings-budget",
   conflict_markers: "conflict-residue",
   sg_scan: STRUCTURAL_RULES,
   npm_security_scan: DEPENDENCY_VULNERABILITY,
   threshold_ratchet: "threshold-monotonicity",
   e2e_coverage: "journey-coverage",
+  bdd_coverage: "behavior-contract",
   state_classification: "state-classification",
   floor_collisions: "security-floor-integrity",
   // These four could not be wired until their jobs were renamed onto their
@@ -918,20 +962,46 @@ export const SECONDARY_PROVER_JOBS = Object.freeze(["snyk"]);
  * own expiry rather than becoming permanent by inattention.
  */
 export const UNGATED_QUALITY_JOBS = Object.freeze({
-  bdd_coverage: Object.freeze({
-    reason:
-      "The job already has a three-state adoption control, `bdd_mode` (not-adopted / bootstrap / enforced), passed as a workflow input. The registry has three levels (off / optional / required). Whether those are the same three states — and therefore whether `bdd_mode` should collapse into the declaration, or whether `bootstrap` is a genuine fourth level the registry has to grow — is a decision that affects every gate, not this one.",
-    owner: "#2930",
-  }),
-  learnings_budget: Object.freeze({
+  zap_baseline: Object.freeze({
     reason:
-      "The property is enforced in three workflows and the skip token reaches two of them. The third runs the same command inside a context that is REQUIRED on this repository's ruleset, so a gate that governed only the two would be the same defect one layer up: a declaration satisfied in one workflow and ignored in another.",
-    owner: "#2932",
+      '`runtime-web-vulnerability` names the property, but its legal moments are deploy-only, so there is no declaration a caller can write at pull-request — where this job runs. #2832 built the deploy-moment runner and did NOT retire this: the gate now has an executor at the moments where it is legal, and this job still has none at the moment where it runs. Adding the row today would be worse than the gap. The job posts `🕷️ OWASP ZAP Baseline`, the gate\'s label is `🕷️ DAST Baseline`, and `contextsFor` derives `🔍 Quality Checks / <label>` — so a required declaration would derive a context nothing ever posts and hold every pull request at "Expected — Waiting for status to be reported", here and in every consumer. Closing the gap renames a live required check, which is a ruleset migration and a ruling, not an edit.',
+    owner: "#3022",
   }),
-  zap_baseline: Object.freeze({
+});
+
+/**
+ * Gated jobs that ALSO read an adoption input, and why that is not yet fixed.
+ *
+ * A job with a `QUALITY_JOB_GATES` row has a declaration that decides whether
+ * it runs. A job whose `if:` additionally reads a workflow input has a SECOND
+ * control, and the two can disagree — which is worse than one control in the
+ * wrong place, because the losing one fails silently. `verification_coverage`
+ * is that today: it carries the `coverage-adequacy` row and the façade, and its
+ * `if:` also gates on `verify_enforced`, whose default is `false`. A project
+ * declaring `coverage-adequacy: required` at pull-request and leaving the input
+ * alone gets no job at all, and its declaration is ignored with no signal.
+ *
+ * This table exists for the same reason `UNGATED_QUALITY_JOBS` does: the defect
+ * is not that the second control exists, it is that nothing SAID SO anywhere a
+ * consumer could read. `tests/integration/quality-dual-adoption-controls.test.ts`
+ * derives the set from the shipped workflows and refuses a job that is in
+ * neither table, so a second one cannot appear in silence — which is the
+ * property that survives the individual entries being retired.
+ *
+ * `owner` is the issue that resolves the entry, so it carries its own expiry.
+ *
+ * Retiring an entry is NOT a matter of deleting the input. Measured on
+ * `verify_enforced` (#3016): with the input gone, the job runs for every
+ * consumer and the façade's `configured=false` fallback runs a bespoke check
+ * most projects will fail. "Not declared" is not "off" — only an explicit `off`
+ * skips — so the migration has to give every consumer a way to say `off` first.
+ */
+export const DUAL_ADOPTION_CONTROLS = Object.freeze({
+  verification_coverage: Object.freeze({
+    input: "verify_enforced",
     reason:
-      "`runtime-web-vulnerability` names the property, but its legal moments are deploy-only, so there is no declaration a caller can write at pull-request — where this job runs.",
-    owner: "#2832",
+      "The job carries the `coverage-adequacy` row AND gates on the `verify_enforced` boolean, which defaults to false — so a project that declares the gate `required` still gets no job, and the declaration loses silently. Retiring the input is not a deletion: with it gone the job runs for every consumer and the fallback runs a bespoke check most will fail, because an undeclared gate falls back rather than standing down. The migration has to reach consumers first.",
+    owner: "#3016",
   }),
 });
 
@@ -1150,6 +1220,18 @@ const QUALITY_FALLBACKS = Object.freeze({
     seedRun: [KNIP_CHECK_TASK, KNIP],
     steps: ["🗑️ Run dead code detection (knip)"],
   },
+  learnings_budget: {
+    // The built-in runs Lisa's own in-tree checker on the Lisa source repo and
+    // the published CLI everywhere else, AT THE PROJECT'S OWN VERSION — read
+    // from its `@codyswann/lisa` dependency range, because the literal that
+    // used to be written here drifted sixty releases behind (#2932). Nothing is
+    // seeded: no npm stack ships a task for this, and a project naming one
+    // would replace a branch that also decides WHICH prover to run.
+    command:
+      "bun scripts/check-learnings-budget.ts (Lisa source) or bunx @codyswann/lisa@<project version> check-learnings-budget",
+    seedRun: [],
+    steps: ["📚 Check learnings budget"],
+  },
   conflict_markers: {
     // The built-in resolves the shipped `check-conflict-markers.mjs` from
     // whichever of three locations the project has it in, so the command is a
@@ -1205,6 +1287,21 @@ const QUALITY_FALLBACKS = Object.freeze({
       "⏭️ Skip e2e coverage (no check-e2e-coverage.mjs script)",
     ],
   },
+  bdd_coverage: {
+    // The one façade job with NO written-in command. Every other entry here
+    // records what runs when nothing declares the gate; this job runs nothing,
+    // because its prover ships to every project on the stack and a fallback
+    // would enforce a behavior contract on every consumer that never adopted
+    // one. Recorded anyway, and with the same shape as the environment façade
+    // above: an inventory that omitted it would read as an oversight, and the
+    // stand-down step is what an operator needs pointed at.
+    command: "(none — the job stands down when the gate is undeclared)",
+    // The expo stack ships the prover as , which is what a
+    // declaration should point  at; the registry default names the
+    // concern and resolves nowhere.
+    seedRun: ["bdd:coverage"],
+    steps: ["⏭️ Stand down (behavior-contract is not declared)"],
+  },
   state_classification: {
     command:
       "node scripts/check-state-classification.mjs (when the script exists)",
@@ -2416,7 +2513,11 @@ export const DEFAULT_RUNNER = "npm run";
  * This is ONE control for the whole family, deliberately. `bdd_coverage`
  * hand-rolled a private three-state input (`bdd_mode`) for the same decision;
  * repeating that six more times would be six more adoption operations and six
- * more places to drift.
+ * more places to drift. That input is now retired and `bdd_coverage` answers to
+ * the `behavior-contract` declaration like everything else — but it does NOT
+ * join this family, because it has no absent-script path to fall back from: its
+ * prover ships to every project on the stack, so an undeclared gate there would
+ * mean enforcing a contract nobody adopted. It stands down unless declared.
  *
  * `warn` is the default and reproduces today's behaviour exactly, because
  * making absence fatal before a declaration is guaranteed turns every
@@ -2727,14 +2828,162 @@ export const EXECUTOR_VERDICTS = Object.freeze([
  */
 const BLOCKING_VERDICTS = Object.freeze([ORPHANED, VACUOUS_PROVER]);
 
-/** Moment families whose executor is the generic hook runner. */
-const HOOK_RUNNER_MOMENTS = Object.freeze([
-  SESSION_START,
-  PRE_TOOL,
-  POST_TOOL,
-  COMMIT,
-  PUSH,
-]);
+/** Where a repository declares which moments it runs gates at. */
+export const MOMENT_EXECUTOR_DIR = ".github/workflows";
+
+/**
+ * A moment handed to a gate runner, in either spelling a workflow uses.
+ *
+ * `moment: <value>` is how a caller parameterises a reusable workflow, and
+ * `--moment=<value>` is how a shell step invokes `lisa-run-gates.mjs` directly.
+ * Both are the same statement — "this workflow executes gates at this moment" —
+ * and a scan that read only one of them would report a repository as having no
+ * runner while looking straight at one.
+ *
+ * `[ \t]*` rather than `\s*` around the colon, deliberately. A workflow that
+ * DEFINES a `moment:` input writes the key with its value on following lines,
+ * and `\s*` would step over the newline and capture `description` as the
+ * moment. The definition of an input is not the use of one.
+ *
+ * The backtick is excluded from the unquoted form for the same class of reason,
+ * and it was measured rather than anticipated: the header of Lisa's own
+ * `gates.yml` documents the defect it fixes by quoting
+ * ``list --moment=pre-deploy:production``, and the first version of this scan
+ * read that PROSE as a runner and reported the moment executed. A workflow
+ * describing a command is not a workflow running one.
+ */
+const MOMENT_ARGUMENT =
+  /(?:\bmoment[ \t]*:[ \t]*|--moment=)(?:'([^'\n]+)'|"([^"\n]+)"|([^\s'"#`]+))/g;
+
+/** A line that is entirely a comment — YAML's and the shell's are both `#`. */
+const COMMENT_LINE = /^\s*#/;
+
+/** The answer when nothing has been measured: no moment is executed. */
+const NOTHING_EXECUTED = Object.freeze({
+  moments: Object.freeze([]),
+  families: Object.freeze([]),
+});
+
+/**
+ * Which moments THIS repository actually runs gates at, read off its workflows.
+ *
+ * The registry's `no-runner-for-moment` verdict used to be an ASSERTION: every
+ * declaration in a deploy or continuous family got told "nothing runs gates
+ * here at all yet", because at the time nothing did. That sentence is a fact
+ * about the repository, not about the gate, and hardcoding it has two failure
+ * modes that arrive together. It keeps saying "nothing runs this" after a runner
+ * ships — a control lying in the reassuring direction. And it keeps EXCUSING a
+ * declaration that resolves to no prover, calling it inert-but-fine, at exactly
+ * the moment the runner would have executed it and reported UNPROVABLE.
+ *
+ * So it is measured instead. A repository executes a moment when one of its
+ * workflows names that moment to a gate runner.
+ *
+ * ## Family, when the environment is computed
+ *
+ * A deploy caller writes `moment: pre-deploy:${{ ... }}` — the family is
+ * literal and the environment is a run-time expression. Requiring an exact
+ * match would report "no runner" for every real deploy façade there is, so a
+ * computed environment registers the FAMILY, and any moment in it counts as
+ * executed. A value with no readable family (`moment: ${{ inputs.moment }}`,
+ * which is how a reusable workflow forwards its own input) contributes nothing:
+ * it is plumbing between two workflows, and the caller at the other end is the
+ * one that made a statement about a moment.
+ *
+ * ## An unreadable directory answers "nothing", and that is the honest answer
+ *
+ * A repository with no `.github/workflows` runs no workflows, so no workflow of
+ * its executes any moment. That is not a guess made under uncertainty; it is
+ * the measurement.
+ * @param {object} [options] Inputs.
+ * @param {string} [options.cwd] Repository root.
+ * @param {string} [options.dir] Directory holding the workflows.
+ * @returns {{moments: string[], families: string[]}} Exact moments executed, and families executed at a computed environment.
+ */
+export function momentsExecutedBy({
+  cwd = process.cwd(),
+  dir = MOMENT_EXECUTOR_DIR,
+} = {}) {
+  const moments = new Set();
+  const families = new Set();
+  const root = join(cwd, dir);
+  let entries;
+  try {
+    entries = readdirSync(root);
+  } catch {
+    return NOTHING_EXECUTED;
+  }
+  for (const entry of entries) {
+    if (!entry.endsWith(".yml") && !entry.endsWith(".yaml")) continue;
+    let text;
+    try {
+      text = readFileSync(join(root, entry), "utf8");
+    } catch {
+      continue;
+    }
+    for (const value of momentArguments(text)) {
+      recordExecutedMoment(value, moments, families);
+    }
+  }
+  return {
+    moments: [...moments].sort(),
+    families: [...families].sort(),
+  };
+}
+
+/**
+ * Every moment argument one workflow file names.
+ * @param {string} text The workflow source.
+ * @returns {string[]} The raw values, unvalidated.
+ */
+function momentArguments(text) {
+  const found = [];
+  // Line by line, so a whole-line comment can be dropped before it is read.
+  // Both languages in a workflow file — YAML and the shell inside `run:` —
+  // comment with `#`, so one rule covers both, and a header documenting the
+  // very command this scan looks for stops counting as an invocation of it.
+  for (const line of text.split("\n")) {
+    if (COMMENT_LINE.test(line)) continue;
+    for (const match of line.matchAll(MOMENT_ARGUMENT)) {
+      const value = match[1] ?? match[2] ?? match[3];
+      if (value) found.push(value.trim());
+    }
+  }
+  return found;
+}
+
+/**
+ * Record one workflow's moment argument against the exact/family sets.
+ * @param {string} value The raw value read from the workflow.
+ * @param {Set<string>} moments Exact moments, mutated in place.
+ * @param {Set<string>} families Families executed at a computed environment.
+ */
+function recordExecutedMoment(value, moments, families) {
+  if (MOMENTS.includes(value)) {
+    moments.add(value);
+    return;
+  }
+  const separator = value.indexOf(":");
+  if (separator === -1) return;
+  const family = value.slice(0, separator);
+  const environment = value.slice(separator + 1);
+  if (!MOMENT_FAMILIES.includes(family) || environment === "") return;
+  // `${{ ... }}` and `$VAR` both mean "decided at run time". The family is
+  // still a statement, and it is the only one available.
+  if (environment.includes("$")) families.add(family);
+  else moments.add(`${family}:${environment}`);
+}
+
+/**
+ * Whether the measured inventory covers one declared moment.
+ * @param {{moments?: string[], families?: string[]}} executed The inventory.
+ * @param {string} moment The declared moment.
+ * @returns {boolean} Whether something in the repository runs gates there.
+ */
+function executesMoment(executed, moment) {
+  const { moments = [], families = [] } = executed ?? {};
+  return moments.includes(moment) || families.includes(momentFamily(moment));
+}
 
 /**
  * Gates whose only prover reports findings and cannot fail.
@@ -2792,15 +3041,44 @@ function declaredLevel(entry) {
 }
 
 /**
- * The task one gate resolves to, honouring a `run:` override.
- * @param {string} gate Gate id.
- * @param {object} block The gate's own block from the config.
- * @returns {string|undefined} The task name.
+ * The task one declaration resolves to, by the SAME order `resolveMoment` uses.
+ *
+ * It has to be the same order or the classifier judges a command the runner
+ * would never issue. The five sources, narrowest first: the moment entry's own
+ * `run:`, the gate block's `run:`, the `shippedAs` alias when the registry
+ * default is absent and the alias is present, the moment family's `taskAt`
+ * default, and finally the plain registry `task`.
+ *
+ * The alias matters most here and is the easiest to omit. `security:dast` is the
+ * registry name for a dynamic scan and NO stack ships a script under it; two
+ * stacks ship `security:zap`, and the runner substitutes it. A classifier that
+ * looked only at `task` would call every real DAST declaration an orphan and
+ * refuse a configuration that works.
+ * @param {object} options Inputs.
+ * @param {string} options.gate Gate id.
+ * @param {object} options.block The gate's own block from the config.
+ * @param {string} options.moment The declared moment.
+ * @param {Record<string, string>} options.scripts The project's package scripts.
+ * @returns {string|null|undefined} The task the runner would run.
  */
-function declaredTask(gate, block) {
-  const override =
-    block !== null && typeof block === "object" ? block.run : undefined;
-  return typeof override === "string" ? override : REGISTRY[gate]?.task;
+function resolvedTaskFor({ gate, block, moment, scripts }) {
+  const definition = REGISTRY[gate];
+  const entry = block?.[moment];
+  const entryRun =
+    entry !== null && typeof entry === "object" && typeof entry.run === "string"
+      ? entry.run
+      : null;
+  const blockRun = typeof block?.run === "string" ? block.run : null;
+  const declared = entryRun ?? blockRun;
+  const registryTask =
+    definition?.taskAt?.[momentFamily(moment)] ?? definition?.task ?? null;
+  const alias = aliasFor({
+    declared,
+    registryTask,
+    shippedAs: definition?.shippedAs ?? null,
+    scripts,
+  });
+  return declared ?? alias?.to ?? registryTask;
 }
 
 /**
@@ -2837,6 +3115,7 @@ export function classifyDeclaredExecutors({
   gates,
   scripts,
   outsideFacade = PROVED_OUTSIDE_FACADE,
+  executedMoments = NOTHING_EXECUTED,
 }) {
   const findings = [];
   for (const [gate, block] of Object.entries(gates ?? {})) {
@@ -2860,6 +3139,7 @@ export function classifyDeclaredExecutors({
         level,
         scripts,
         outsideFacade,
+        executedMoments,
       });
       if (finding !== null) findings.push(finding);
     }
@@ -2876,9 +3156,18 @@ export function classifyDeclaredExecutors({
  * @param {string} options.level Declared level.
  * @param {Record<string, string>|null|undefined} options.scripts Project scripts.
  * @param {Record<string, string>} options.outsideFacade Gates proved outside the façade.
+ * @param {{moments?: string[], families?: string[]}} options.executedMoments Moments this repository actually runs gates at.
  * @returns {{gate: string, moment: string, level: string, verdict: string, detail: string}|null} The finding.
  */
-function verdictFor({ gate, block, moment, level, scripts, outsideFacade }) {
+function verdictFor({
+  gate,
+  block,
+  moment,
+  level,
+  scripts,
+  outsideFacade,
+  executedMoments,
+}) {
   const make = (verdict, detail) => ({ gate, moment, level, verdict, detail });
   if (level === "required" && Object.hasOwn(ADVISORY_PROVERS, gate)) {
     return make(VACUOUS_PROVER, ADVISORY_PROVERS[gate]);
@@ -2892,17 +3181,6 @@ function verdictFor({ gate, block, moment, level, scripts, outsideFacade }) {
     );
   }
   const family = momentFamily(moment);
-  if (HOOK_RUNNER_MOMENTS.includes(family)) {
-    if (scripts === null || scripts === undefined) return null;
-    const task = declaredTask(gate, block);
-    if (task !== undefined && Object.hasOwn(scripts, task)) return null;
-    return make(
-      ORPHANED,
-      `gates."${gate}"."${moment}" resolves to the task "${task}", and this ` +
-        `project has no such script. The hook runner would find nothing to ` +
-        `run, so the level in front of it describes nothing.`
-    );
-  }
   if (family === PULL_REQUEST) {
     if (Object.values(QUALITY_JOB_GATES).includes(gate)) return null;
     return make(
@@ -2914,10 +3192,44 @@ function verdictFor({ gate, block, moment, level, scripts, outsideFacade }) {
         `reported" indefinitely.`
     );
   }
+  // The deploy and continuous families have a generic runner the same way the
+  // hooks do — `lisa-run-gates.mjs --moment=<moment>` — but unlike a hook,
+  // which every repository installs, the CALLER is a workflow this repository
+  // either has or does not. So the question is asked of the repository rather
+  // than answered from a table: is there a workflow that hands this moment to
+  // the runner?
+  if (
+    MOMENT_FAMILIES.includes(family) &&
+    !executesMoment(executedMoments, moment)
+  ) {
+    return make(
+      NO_RUNNER_FOR_MOMENT,
+      `nothing in this repository runs gates at "${moment}": no workflow ` +
+        `under ${MOMENT_EXECUTOR_DIR} hands that moment to Lisa's gate ` +
+        `runner. The declaration is read, validated and listed, and then ` +
+        `never executed — inert rather than wrong. Add a caller for Lisa's ` +
+        `gates.yml at this moment (the shipped deploy.yml and ` +
+        `continuous-gates.yml templates do exactly that), or declare it ` +
+        `"off" to put on record that you meant it not to run.`
+    );
+  }
+  // Everything remaining is executed by the generic runner: a hook at its
+  // moment, or a workflow at a deploy or scheduled one. Both resolve a task and
+  // run it, so both need a task that exists.
+  if (scripts === null || scripts === undefined) return null;
+  const task = resolvedTaskFor({ gate, block, moment, scripts });
+  if (
+    task !== undefined &&
+    task !== null &&
+    Object.hasOwn(scripts ?? {}, task)
+  ) {
+    return null;
+  }
   return make(
-    NO_RUNNER_FOR_MOMENT,
-    `nothing runs gates at "${moment}" at all yet, so this declaration is ` +
-      `inert rather than wrong. A different defect, tracked separately.`
+    ORPHANED,
+    `gates."${gate}"."${moment}" resolves to the task "${task}", and this ` +
+      `project has no such script. The gate runner would find nothing to ` +
+      `run, so the level in front of it describes nothing.`
   );
 }
 
@@ -3776,7 +4088,15 @@ function main() {
     // suppress "configuration is valid" for every project that ever runs this,
     // which turns the verdict into noise and trains an operator to ignore both.
     reportUngoverned(gates);
-    const executors = classifyDeclaredExecutors({ gates, scripts });
+    // MEASURED, not assumed. Whether a deploy or continuous declaration has
+    // anything able to run it is a fact about THIS repository's workflows, and
+    // the answer changed the day a deploy façade shipped. Reading it here means
+    // the report cannot go stale in the reassuring direction.
+    const executors = classifyDeclaredExecutors({
+      gates,
+      scripts,
+      executedMoments: momentsExecutedBy(),
+    });
     // BLOCKING, and this is the change #2843 called "the substantive work".
     // The classifier existed as a vitest suite reading THIS repository's own
     // config — so the check existed for Lisa and did not exist for anyone Lisa

package/all/create-only/.github/workflows/continuous-gates.yml

@@ -0,0 +1,74 @@
+---
+# Seeded by Lisa on first setup — this file is YOURS.
+# Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
+#
+# The `continuous:<environment>` moment, on a schedule.
+#
+# Every other gate moment blocks a DIFF — the commit, the push, the merge, the
+# deploy. A continuous gate has no diff to block: it runs against a stable
+# target, and by the time it fails, whatever it covered merged hours ago. What it
+# establishes is whether that target is HEALTHY, and the enforcement point is
+# promotion out of it — a red `continuous:staging` means staging is not
+# promotable, which a `pre-deploy:production` gate can require.
+#
+# The clearest case is a CVE: one published today makes yesterday's green wrong
+# with no change to trigger a re-scan. A per-change gate cannot catch that,
+# because there is no change. Only a scheduled run can.
+#
+# ## Nothing runs until you declare something
+#
+# This workflow runs exactly what the `gates` block of `.lisa.config.json`
+# declares at `continuous:<environment>`, and nothing else. Out of the box that
+# is nothing, and the run says so rather than reporting a green that implies a
+# proof. To use it, declare a gate at this moment:
+#
+# ```json
+# "gates": {
+#   "dependency-vulnerability": { "continuous:production": "required" },
+#   "runtime-web-vulnerability": { "continuous:production": "required" }
+# }
+# ```
+#
+# Eleven of Lisa's gates are legal here; `lisa-gates.mjs list
+# --moment=continuous:production` prints the ones this project can use, and
+# `validate` tells you when a declaration resolves to no prover.
+#
+# ## Customise the environment and the cadence
+#
+# `ENVIRONMENT` below is the suffix of the moment, so it must match what you
+# write in `.lisa.config.json`. Change the cron to suit — a load profile nightly
+# and a dependency scan hourly are two workflows, not one, and splitting them is
+# cheaper than running the expensive one twelve times a day.
+name: 🌙 Continuous Gates
+
+on:
+  schedule:
+    # 07:00 UTC daily.
+    - cron: '0 7 * * *'
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: 'Environment whose continuous gates to run.'
+        required: false
+        default: 'production'
+        type: string
+
+permissions:
+  contents: read
+
+# One run per environment. A second scheduled run arriving while the first is
+# still going would prove the same property about the same target twice, and the
+# provers here — a DAST scan, a load profile — are the ones that mind.
+concurrency:
+  group: continuous-gates-${{ inputs.environment || 'production' }}
+  cancel-in-progress: false
+
+jobs:
+  continuous:
+    name: 🌙 Continuous Gates
+    uses: CodySwannGT/lisa/.github/workflows/gates.yml@main
+    with:
+      moment: continuous:${{ inputs.environment || 'production' }}
+      node_version: '22.21.1'
+      package_manager: 'npm'
+    secrets: inherit

package/cdk/create-only/.github/workflows/deploy.yml

@@ -64,11 +64,36 @@ jobs:
           echo "approval_environment=$APPROVAL_ENV" >> $GITHUB_OUTPUT
           echo "require_approval=$REQUIRE" >> $GITHUB_OUTPUT
 
+  # ── Pre-deploy gates ──────────────────────────────────────────────────────
+  # Resolves `pre-deploy:<environment>` from the `gates` block of
+  # .lisa.config.json and runs whatever is declared there, BEFORE the release.
+  #
+  # This is what makes a declaration like
+  #
+  #   "runtime-web-vulnerability": { "pre-deploy:production": "required" }
+  #
+  # mean something. A required gate that fails — or that resolves to no prover at
+  # all, which is UNPROVABLE rather than passing — stops the workflow here, so
+  # the release is never cut. A gate job running BESIDE the deploy would go red
+  # after the tag and the artefacts had already shipped, which is a report.
+  #
+  # A project that declares nothing at this moment gets a green job that ran no
+  # gates and says so, and the deploy behaves exactly as it did before.
+  pre_deploy_gates:
+    name: 🚦 Pre-Deploy Gates
+    uses: CodySwannGT/lisa/.github/workflows/gates.yml@main
+    needs: [determine_environment]
+    with:
+      moment: pre-deploy:${{ needs.determine_environment.outputs.environment }}
+      node_version: '22.21.1'
+      package_manager: 'npm'
+    secrets: inherit
+
   release:
     name: 📦 Release
     # Reference to the quality checks workflow
     uses: CodySwannGT/lisa/.github/workflows/release.yml@main
-    needs: [determine_environment]
+    needs: [determine_environment, pre_deploy_gates]
     permissions:
       contents: write
       pull-requests: read
@@ -91,4 +116,19 @@ jobs:
       SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
       SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
       SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
+
+  # ── Post-deploy gates ─────────────────────────────────────────────────────
+  # Proves a property of what is now live. A red here does not un-ship the
+  # release; it names the gate that does not hold so an operator can act on it,
+  # which is the difference between a post-deploy gate and a post-deploy log.
+  post_deploy_gates:
+    name: 🚦 Post-Deploy Gates
+    uses: CodySwannGT/lisa/.github/workflows/gates.yml@main
+    needs: [determine_environment, release]
+    if: ${{ always() && !cancelled() && needs.release.result == 'success' }}
+    with:
+      moment: post-deploy:${{ needs.determine_environment.outputs.environment }}
+      node_version: '22.21.1'
+      package_manager: 'npm'
+    secrets: inherit
 # Trigger staging deployment after CDK trust fix

package/dist/core/lisa-owned-hash-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA8hBjC,CAAC"}
+{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAwiBjC,CAAC"}