@codyswann/lisa 4.27.4 → 4.27.6

package/dist/core/enforcement-coverage.d.ts

@@ -0,0 +1,168 @@
+/**
+ * The guards the dispatcher runs, in its own order.
+ *
+ * Kept as data rather than inferred from the directory listing: a census that
+ * asks "which guard files are here" cannot notice a guard that is missing
+ * everywhere, which is the case it most needs to report.
+ */
+export declare const ENFORCEMENT_GUARDS: readonly ["block-no-verify", "parity-safety-net", "block-shell-json-parsing", "block-instruction-file-edits", "block-direct-issue-create", "block-managed-file-edits"];
+/** Which of the two trees a resolved guard came from. */
+export type GuardTree = "host" | "plugin";
+/**
+ * How much enforcement a checkout resolves.
+ *
+ * `unreadable` is a first-class answer and never a synonym for any of the
+ * others: a checkout the census could not look into has not been shown to
+ * resolve anything, and has not been shown to resolve nothing either.
+ */
+export type CoverageResolution = "unreadable" | "none" | "partial" | "full";
+/**
+ * How old the copy in force is.
+ *
+ * `not-applicable` belongs to checkouts that resolve nothing — they have no
+ * copy to be old. That value is what makes it structurally impossible to count
+ * an unguarded checkout as a stale one.
+ */
+export type CoverageVintage = "current" | "behind" | "undateable" | "not-applicable";
+/** One guard and the copy that would run for it, if any. */
+export interface GuardResolution {
+    /** Guard name, as the dispatcher spells it. */
+    readonly guard: string;
+    /** Tree the running copy comes from, or null when nothing resolved. */
+    readonly tree: GuardTree | null;
+    /** Absolute path of the copy that would run, or null. */
+    readonly script: string | null;
+    /** Whether a second copy exists that this one shadows. */
+    readonly shadows: boolean;
+}
+/** One guard tree, and the evidence that dates it. */
+export interface TreeVintage {
+    /** Which tree this is. */
+    readonly tree: GuardTree;
+    /** Absolute path of the tree. */
+    readonly root: string;
+    /** Lisa version that produced it, or null when it cannot be dated. */
+    readonly version: string | null;
+    /** The file that dated it, or the file whose absence left it undateable. */
+    readonly datedBy: string;
+}
+/** What `lisa apply` left behind, if anything. */
+export interface ReceiptSummary {
+    /** Whether a readable receipt exists. */
+    readonly present: boolean;
+    /** Lisa version that completed the apply. */
+    readonly version: string | null;
+    /** When that apply completed. */
+    readonly appliedAt: string | null;
+    /** Whether it was a full apply or the postinstall-safe subset. */
+    readonly mode: string | null;
+}
+/**
+ * What the checkout's own manifest asks for versus what is installed.
+ *
+ * Its own axis, because it fails in the affirmative: a checkout whose
+ * `node_modules` is majors behind its `package.json` resolves guards, runs
+ * them, and answers every question confidently about a version nobody is using.
+ */
+export interface InstallSummary {
+    /** Range the checkout's manifest declares, or null when it declares none. */
+    readonly declared: string | null;
+    /** Version actually present under `node_modules`, or null. */
+    readonly installed: string | null;
+}
+/** Everything one checkout resolves, right now. */
+export interface CheckoutCoverage {
+    /** Operator-facing label — the roster key, or the path when scanned. */
+    readonly label: string;
+    /** Absolute path of the checkout. */
+    readonly checkoutPath: string;
+    /** How much enforcement it resolves. */
+    readonly resolution: CoverageResolution;
+    /** Why it could not be read, when `resolution` is `unreadable`. */
+    readonly unreadableReason: string | null;
+    /** Per-guard resolution. Empty when the checkout could not be read. */
+    readonly guards: readonly GuardResolution[];
+    /** Guards no copy of which was found. */
+    readonly unresolvedGuards: readonly string[];
+    /** Every tree that contributes at least one running guard. */
+    readonly trees: readonly TreeVintage[];
+    /** The oldest tree in use — the copy that governs. Null when none is. */
+    readonly governing: TreeVintage | null;
+    /** Age of the governing copy against the reference version. */
+    readonly vintage: CoverageVintage;
+    /** The apply receipt, or its absence. */
+    readonly receipt: ReceiptSummary;
+    /** Declared versus installed Lisa in this checkout. */
+    readonly install: InstallSummary;
+}
+/**
+ * Read a dotted version's release fields, or refuse to read it at all.
+ *
+ * Prerelease and build suffixes are ignored. A string whose release fields are
+ * not all plain numbers yields `null` rather than a best guess: reading an
+ * unparseable field as 0 makes it sort BELOW every real version, which turns
+ * "this does not parse" into the confident claim "this is behind" — a
+ * measurement invented out of an absence, which is the shape of defect this
+ * whole module exists to end.
+ * @param value - A version string from a manifest or receipt this repo does not own
+ * @returns The release fields, or null when the string is not a version
+ */
+export declare function versionFields(value: string): readonly number[] | null;
+/**
+ * Compare two dotted versions on their release fields only.
+ *
+ * A version either side cannot parse yields `false`: absence of proof never
+ * becomes proof of drift, the same rule `isInstallBehindDeclared` follows. The
+ * caller that needs to distinguish "not older" from "could not tell" asks
+ * {@link versionFields} directly — `classifyVintage` does, and reports an
+ * unparseable copy as undateable rather than letting it fall through to
+ * "current".
+ * @param left - Candidate version
+ * @param right - Version to compare against
+ * @returns Whether `left` names an older Lisa than `right`
+ */
+export declare function isOlderVersion(left: string, right: string): boolean;
+/** Everything the caller must supply to measure one checkout. */
+export interface CoverageRequest {
+    /** Operator-facing label for the checkout. */
+    readonly label: string;
+    /** Path to the checkout, already expanded and resolved. */
+    readonly checkoutPath: string;
+    /** Newest Lisa the census can point at, or null when nothing dates it. */
+    readonly reference: string | null;
+}
+/**
+ * Measure what one checkout resolves right now.
+ *
+ * Every failure to look is reported as a failure to look. A checkout that is
+ * not there, or not readable, is never quietly dropped from the fleet and never
+ * counted as covered: a census that reports better coverage than exists is
+ * worse than no census, because it retires the question.
+ * @param request - The checkout to measure
+ * @returns What that checkout resolves
+ */
+export declare function collectCheckoutCoverage(request: CoverageRequest): Promise<CheckoutCoverage>;
+/**
+ * Re-classify a record's vintage against a reference resolved later.
+ *
+ * The census cannot know the newest Lisa on the disk until it has read every
+ * checkout, and the reference is a maximum over exactly that evidence. So
+ * records are collected first with no reference and dated afterwards, rather
+ * than the census guessing a reference up front and being wrong about the one
+ * checkout that carries the newest copy.
+ * @param coverage - A record collected with no reference
+ * @param reference - Newest Lisa the census can point at
+ * @returns The same record, dated
+ */
+export declare function applyReference(coverage: CheckoutCoverage, reference: string | null): CheckoutCoverage;
+/**
+ * Every Lisa version this checkout proves exists somewhere on the disk.
+ *
+ * Used to build the reference the way the dispatcher builds its own: a maximum
+ * over evidence on the same disk, never a nominated authority and never a
+ * network lookup. A copy is behind only when something newer can be pointed at.
+ * @param coverage - A collected record
+ * @returns The versions it can vouch for
+ */
+export declare function versionEvidence(coverage: CheckoutCoverage): readonly string[];
+//# sourceMappingURL=enforcement-coverage.d.ts.map

package/dist/core/enforcement-coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement-coverage.d.ts","sourceRoot":"","sources":["../../src/core/enforcement-coverage.ts"],"names":[],"mappings":"AAsCA;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,wKAOrB,CAAC;AAEX,yDAAyD;AACzD,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,QAAQ,GACR,YAAY,GACZ,gBAAgB,CAAC;AAErB,4DAA4D;AAC5D,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC1B,0BAA0B;IAC1B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,iCAAiC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,kDAAkD;AAClD,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,iCAAiC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,mDAAmD;AACnD,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,wCAAwC;IACxC,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,mEAAmE;IACnE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAC;IAC5C,yCAAyC;IACzC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,yEAAyE;IACzE,QAAQ,CAAC,SAAS,EAAE,WAAW,GAAG,IAAI,CAAC;IACvC,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,yCAAyC;IACzC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;CAClC;AAKD;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,IAAI,CAKrE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAUnE;AA6JD,iEAAiE;AACjE,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AA2BD;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,gBAAgB,CAAC,CAkD3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,gBAAgB,EAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB,gBAAgB,CAKlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,MAAM,EAAE,CAM7E"}

package/dist/core/enforcement-coverage.js

@@ -0,0 +1,342 @@
+/**
+ * What enforcement one checkout actually resolves — measured, not remembered.
+ *
+ * `scripts/lisa-enforcement-fallback.sh` answers this question for the checkout
+ * an agent is sitting in, once per session, to that session. Nobody was looking
+ * at the fleet, so the only fleet-wide number that ever existed was taken by
+ * hand and written into a comment in that file, where it recorded that most
+ * checkouts resolved no guard and none that did was current. A number in a
+ * comment is a measurement, not a
+ * monitor — it was true on the day it was written and nothing re-takes it
+ * (CodySwannGT/lisa#3490).
+ *
+ * This module is the re-derivation. Given a checkout root it reads the same
+ * evidence the dispatcher reads, by the same rules, and returns what that
+ * checkout resolves right now:
+ *
+ *   - Six guards, first-wins PER GUARD: `scripts/lisa-hooks/` (written into a
+ *     host by `lisa apply`) shadows `plugins/lisa/hooks/` (the Lisa monorepo's
+ *     own source) outright, and the shadowed copy never runs.
+ *   - The aggregate takes the strongest refusal, so **the oldest resolved copy
+ *     governs** (CodySwannGT/lisa#3205). "Which copy governs" is therefore the
+ *     oldest tree in use, never the newest present.
+ *   - A tree with no manifest beside it is *undateable*, which is reported as
+ *     its own answer rather than folded into "current". Reading an undateable
+ *     copy as current is exactly how a stale copy stays invisible.
+ *
+ * Two things are deliberately kept apart in the result, because folding them
+ * together is the defect this exists to end. `resolution` says whether anything
+ * is enforcing at all; `vintage` says how old the thing enforcing is. A
+ * checkout resolving nothing has no vintage — it is not "very stale", it is
+ * unprotected, and the two have different remedies.
+ * @module core/enforcement-coverage
+ */
+import * as path from "node:path";
+import { readApplyReceipt } from "./apply-receipt.js";
+import { readJsonOrNull } from "../utils/json-utils.js";
+import { pathExists } from "../utils/file-operations.js";
+/**
+ * The guards the dispatcher runs, in its own order.
+ *
+ * Kept as data rather than inferred from the directory listing: a census that
+ * asks "which guard files are here" cannot notice a guard that is missing
+ * everywhere, which is the case it most needs to report.
+ */
+export const ENFORCEMENT_GUARDS = [
+    "block-no-verify",
+    "parity-safety-net",
+    "block-shell-json-parsing",
+    "block-instruction-file-edits",
+    "block-direct-issue-create",
+    "block-managed-file-edits",
+];
+/** The npm package every host checkout installs Lisa as. */
+const LISA_PACKAGE = "@codyswann/lisa";
+/**
+ * Read a dotted version's release fields, or refuse to read it at all.
+ *
+ * Prerelease and build suffixes are ignored. A string whose release fields are
+ * not all plain numbers yields `null` rather than a best guess: reading an
+ * unparseable field as 0 makes it sort BELOW every real version, which turns
+ * "this does not parse" into the confident claim "this is behind" — a
+ * measurement invented out of an absence, which is the shape of defect this
+ * whole module exists to end.
+ * @param value - A version string from a manifest or receipt this repo does not own
+ * @returns The release fields, or null when the string is not a version
+ */
+export function versionFields(value) {
+    const parts = (value.split(/[-+]/u)[0] ?? "").split(".").slice(0, 3);
+    return parts.length > 0 && parts.every(field => /^\d{1,9}$/u.test(field))
+        ? parts.map(Number)
+        : null;
+}
+/**
+ * Compare two dotted versions on their release fields only.
+ *
+ * A version either side cannot parse yields `false`: absence of proof never
+ * becomes proof of drift, the same rule `isInstallBehindDeclared` follows. The
+ * caller that needs to distinguish "not older" from "could not tell" asks
+ * {@link versionFields} directly — `classifyVintage` does, and reports an
+ * unparseable copy as undateable rather than letting it fall through to
+ * "current".
+ * @param left - Candidate version
+ * @param right - Version to compare against
+ * @returns Whether `left` names an older Lisa than `right`
+ */
+export function isOlderVersion(left, right) {
+    const a = versionFields(left);
+    const b = versionFields(right);
+    if (a === null || b === null)
+        return false;
+    const differing = [0, 1, 2].find(index => (a[index] ?? 0) !== (b[index] ?? 0));
+    return differing === undefined
+        ? false
+        : (a[differing] ?? 0) < (b[differing] ?? 0);
+}
+/**
+ * Read the first top-level occurrence of a version-shaped key from a JSON file.
+ * @param filePath - File to read
+ * @param key - Key naming the version
+ * @returns The version string, or null when the file or key is absent
+ */
+async function readVersionKey(filePath, key) {
+    const parsed = await readJsonOrNull(filePath);
+    const value = parsed?.[key];
+    return typeof value === "string" && value.trim() !== "" ? value : null;
+}
+/**
+ * Resolve each guard to the copy that would actually run for it.
+ * @param root - Checkout root
+ * @returns One entry per guard, in dispatcher order
+ */
+async function resolveGuards(root) {
+    const hostTree = path.join(root, "scripts", "lisa-hooks");
+    const pluginTree = path.join(root, "plugins", "lisa", "hooks");
+    return Promise.all(ENFORCEMENT_GUARDS.map(async (guard) => {
+        const hostScript = path.join(hostTree, `${guard}.sh`);
+        const pluginScript = path.join(pluginTree, `${guard}.sh`);
+        const [host, plugin] = await Promise.all([
+            pathExists(hostScript),
+            pathExists(pluginScript),
+        ]);
+        if (host) {
+            return {
+                guard,
+                tree: "host",
+                script: hostScript,
+                shadows: plugin,
+            };
+        }
+        if (plugin) {
+            return {
+                guard,
+                tree: "plugin",
+                script: pluginScript,
+                shadows: false,
+            };
+        }
+        return { guard, tree: null, script: null, shadows: false };
+    }));
+}
+/**
+ * Date one tree from the evidence that produced it.
+ *
+ * The host tree is dated by the apply receipt because the same `lisa apply` run
+ * wrote both, so they cannot disagree. The plugin tree is dated by the plugin
+ * manifest beside it, which the release bumps in lockstep with the package.
+ * @param root - Checkout root
+ * @param tree - Which tree to date
+ * @returns The tree's vintage, dated or explicitly undateable
+ */
+async function dateTree(root, tree) {
+    if (tree === "host") {
+        const datedBy = path.join(root, ".lisa", "apply-receipt.json");
+        const receipt = await readApplyReceipt(root);
+        return {
+            tree,
+            root: path.join(root, "scripts", "lisa-hooks"),
+            version: receipt?.lisa_version ?? null,
+            datedBy,
+        };
+    }
+    const datedBy = path.join(root, "plugins", "lisa", ".claude-plugin", "plugin.json");
+    return {
+        tree,
+        root: path.join(root, "plugins", "lisa", "hooks"),
+        version: await readVersionKey(datedBy, "version"),
+        datedBy,
+    };
+}
+/**
+ * Pick the copy that governs: the oldest tree in use, undateable first.
+ *
+ * Undateable outranks any dated tree because a copy that cannot be shown
+ * current must not be allowed to report the checkout as current — the whole
+ * point of dating in the first place.
+ * @param trees - Trees contributing at least one running guard
+ * @returns The governing tree, or null when nothing is in use
+ */
+function pickGoverning(trees) {
+    return trees.reduce((worst, candidate) => {
+        if (worst === null)
+            return candidate;
+        if (worst.version === null)
+            return worst;
+        if (candidate.version === null)
+            return candidate;
+        return isOlderVersion(candidate.version, worst.version) ? candidate : worst;
+    }, null);
+}
+/**
+ * Classify the governing copy's age against the reference version.
+ * @param governing - The copy in force, or null when there is none
+ * @param reference - Newest Lisa the census can point at
+ * @returns The vintage class
+ */
+function classifyVintage(governing, reference) {
+    if (governing === null)
+        return "not-applicable";
+    if (governing.version === null)
+        return "undateable";
+    // A version string that will not parse dates the copy no better than a
+    // missing one does. Falling through to "current" would report coverage the
+    // census cannot show, which is the same error as counting an unreadable
+    // checkout as covered.
+    if (versionFields(governing.version) === null)
+        return "undateable";
+    if (reference !== null && isOlderVersion(governing.version, reference)) {
+        return "behind";
+    }
+    return "current";
+}
+/**
+ * Read what the checkout declares and what it has installed.
+ * @param root - Checkout root
+ * @returns Declared range and installed version, each null when absent
+ */
+async function readInstallSummary(root) {
+    const manifest = await readJsonOrNull(path.join(root, "package.json"));
+    const sections = ["dependencies", "devDependencies", "optionalDependencies"];
+    const declared = sections.reduce((found, section) => {
+        if (found !== null)
+            return found;
+        const block = manifest?.[section];
+        if (typeof block !== "object" || block === null)
+            return null;
+        const value = block[LISA_PACKAGE];
+        return typeof value === "string" ? value : null;
+    }, null);
+    return {
+        declared,
+        installed: await readVersionKey(path.join(root, "node_modules", LISA_PACKAGE, "package.json"), "version"),
+    };
+}
+/**
+ * The unreadable answer, built once so every caller reports it identically.
+ * @param request - The checkout that could not be read
+ * @param reason - Why it could not be read, in the operator's language
+ * @returns A coverage record that is not, and cannot become, "covered"
+ */
+function unreadable(request, reason) {
+    return {
+        label: request.label,
+        checkoutPath: request.checkoutPath,
+        resolution: "unreadable",
+        unreadableReason: reason,
+        guards: [],
+        unresolvedGuards: [],
+        trees: [],
+        governing: null,
+        vintage: "not-applicable",
+        receipt: { present: false, version: null, appliedAt: null, mode: null },
+        install: { declared: null, installed: null },
+    };
+}
+/**
+ * Measure what one checkout resolves right now.
+ *
+ * Every failure to look is reported as a failure to look. A checkout that is
+ * not there, or not readable, is never quietly dropped from the fleet and never
+ * counted as covered: a census that reports better coverage than exists is
+ * worse than no census, because it retires the question.
+ * @param request - The checkout to measure
+ * @returns What that checkout resolves
+ */
+export async function collectCheckoutCoverage(request) {
+    const root = request.checkoutPath;
+    if (!(await pathExists(root))) {
+        return unreadable(request, "path does not exist");
+    }
+    const attempt = await resolveGuards(root).then(guards => ({ guards, failure: null }), (error) => ({
+        guards: null,
+        failure: `could not read the guard trees: ${error instanceof Error ? error.message : String(error)}`,
+    }));
+    if (attempt.guards === null) {
+        return unreadable(request, attempt.failure ?? "unknown read failure");
+    }
+    const guards = attempt.guards;
+    const running = guards.filter(entry => entry.tree !== null);
+    const usedTrees = ["host", "plugin"].filter(tree => running.some(entry => entry.tree === tree));
+    const trees = await Promise.all(usedTrees.map(tree => dateTree(root, tree)));
+    const governing = pickGoverning(trees);
+    const receipt = await readApplyReceipt(root);
+    return {
+        label: request.label,
+        checkoutPath: root,
+        resolution: running.length === 0
+            ? "none"
+            : running.length === ENFORCEMENT_GUARDS.length
+                ? "full"
+                : "partial",
+        unreadableReason: null,
+        guards,
+        unresolvedGuards: guards
+            .filter(entry => entry.tree === null)
+            .map(entry => entry.guard),
+        trees,
+        governing,
+        vintage: classifyVintage(governing, request.reference),
+        receipt: {
+            present: receipt !== null,
+            version: receipt?.lisa_version ?? null,
+            appliedAt: receipt?.applied_at ?? null,
+            mode: receipt?.apply_mode ?? null,
+        },
+        install: await readInstallSummary(root),
+    };
+}
+/**
+ * Re-classify a record's vintage against a reference resolved later.
+ *
+ * The census cannot know the newest Lisa on the disk until it has read every
+ * checkout, and the reference is a maximum over exactly that evidence. So
+ * records are collected first with no reference and dated afterwards, rather
+ * than the census guessing a reference up front and being wrong about the one
+ * checkout that carries the newest copy.
+ * @param coverage - A record collected with no reference
+ * @param reference - Newest Lisa the census can point at
+ * @returns The same record, dated
+ */
+export function applyReference(coverage, reference) {
+    return {
+        ...coverage,
+        vintage: classifyVintage(coverage.governing, reference),
+    };
+}
+/**
+ * Every Lisa version this checkout proves exists somewhere on the disk.
+ *
+ * Used to build the reference the way the dispatcher builds its own: a maximum
+ * over evidence on the same disk, never a nominated authority and never a
+ * network lookup. A copy is behind only when something newer can be pointed at.
+ * @param coverage - A collected record
+ * @returns The versions it can vouch for
+ */
+export function versionEvidence(coverage) {
+    return [
+        coverage.install.installed,
+        coverage.receipt.version,
+        ...coverage.trees.map(tree => tree.version),
+    ].filter((value) => value !== null);
+}
+//# sourceMappingURL=enforcement-coverage.js.map

package/dist/core/enforcement-coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement-coverage.js","sourceRoot":"","sources":["../../src/core/enforcement-coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,iBAAiB;IACjB,mBAAmB;IACnB,0BAA0B;IAC1B,8BAA8B;IAC9B,2BAA2B;IAC3B,0BAA0B;CAClB,CAAC;AAuGX,4DAA4D;AAC5D,MAAM,YAAY,GAAG,iBAAiB,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QACnB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAa;IACxD,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAC9B,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAC7C,CAAC;IACF,OAAO,SAAS,KAAK,SAAS;QAC5B,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAC3B,QAAgB,EAChB,GAAW;IAEX,MAAM,MAAM,GAAG,MAAM,cAAc,CAA0B,QAAQ,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/D,OAAO,OAAO,CAAC,GAAG,CAChB,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAC,KAAK,EAAC,EAAE;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,KAAK,KAAK,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,KAAK,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvC,UAAU,CAAC,UAAU,CAAC;YACtB,UAAU,CAAC,YAAY,CAAC;SACzB,CAAC,CAAC;QACH,IAAI,IAAI,EAAE,CAAC;YACT,OAAO;gBACL,KAAK;gBACL,IAAI,EAAE,MAAe;gBACrB,MAAM,EAAE,UAAU;gBAClB,OAAO,EAAE,MAAM;aAChB,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,KAAK;gBACL,IAAI,EAAE,QAAiB;gBACvB,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,KAAK;aACf,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC7D,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,IAAe;IACnD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO;YACL,IAAI;YACJ,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC;YAC9C,OAAO,EAAE,OAAO,EAAE,YAAY,IAAI,IAAI;YACtC,OAAO;SACR,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CACvB,IAAI,EACJ,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,aAAa,CACd,CAAC;IACF,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC;QACjD,OAAO,EAAE,MAAM,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC;QACjD,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,KAA6B;IAClD,OAAO,KAAK,CAAC,MAAM,CAAqB,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QAC3D,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACrC,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACzC,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACjD,OAAO,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9E,CAAC,EAAE,IAAI,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,SAA6B,EAC7B,SAAwB;IAExB,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,gBAAgB,CAAC;IAChD,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,YAAY,CAAC;IACpD,uEAAuE;IACvE,2EAA2E;IAC3E,wEAAwE;IACxE,uBAAuB;IACvB,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI;QAAE,OAAO,YAAY,CAAC;IACnE,IAAI,SAAS,KAAK,IAAI,IAAI,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QACvE,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAAC,IAAY;IAC5C,MAAM,QAAQ,GAAG,MAAM,cAAc,CACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAChC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACjE,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACjC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC7D,MAAM,KAAK,GAAI,KAAiC,CAAC,YAAY,CAAC,CAAC;QAC/D,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC,EAAE,IAAI,CAAC,CAAC;IACT,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,MAAM,cAAc,CAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,CAAC,EAC7D,SAAS,CACV;KACF,CAAC;AACJ,CAAC;AAYD;;;;;GAKG;AACH,SAAS,UAAU,CACjB,OAAwB,EACxB,MAAc;IAEd,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,UAAU,EAAE,YAAY;QACxB,gBAAgB,EAAE,MAAM;QACxB,MAAM,EAAE,EAAE;QACV,gBAAgB,EAAE,EAAE;QACpB,KAAK,EAAE,EAAE;QACT,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,gBAAgB;QACzB,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;QACvE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;KAC7C,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAwB;IAExB,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC;IAClC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC9B,OAAO,UAAU,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAC5C,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAqB,EAAE,CAAC,EACtD,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC;QACnB,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,mCACP,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE;KACH,CAAC,CACH,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,sBAAsB,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAI,CAAC,MAAM,EAAE,QAAQ,CAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAC5D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAC3C,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,YAAY,EAAE,IAAI;QAClB,UAAU,EACR,OAAO,CAAC,MAAM,KAAK,CAAC;YAClB,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM;gBAC5C,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,SAAS;QACjB,gBAAgB,EAAE,IAAI;QACtB,MAAM;QACN,gBAAgB,EAAE,MAAM;aACrB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;aACpC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAC5B,KAAK;QACL,SAAS;QACT,OAAO,EAAE,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC;QACtD,OAAO,EAAE;YACP,OAAO,EAAE,OAAO,KAAK,IAAI;YACzB,OAAO,EAAE,OAAO,EAAE,YAAY,IAAI,IAAI;YACtC,SAAS,EAAE,OAAO,EAAE,UAAU,IAAI,IAAI;YACtC,IAAI,EAAE,OAAO,EAAE,UAAU,IAAI,IAAI;SAClC;QACD,OAAO,EAAE,MAAM,kBAAkB,CAAC,IAAI,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAC5B,QAA0B,EAC1B,SAAwB;IAExB,OAAO;QACL,GAAG,QAAQ;QACX,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;KACxD,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,QAA0B;IACxD,OAAO;QACL,QAAQ,CAAC,OAAO,CAAC,SAAS;QAC1B,QAAQ,CAAC,OAAO,CAAC,OAAO;QACxB,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;KAC5C,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;AACvD,CAAC"}

package/dist/core/lisa-owned-hash-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA2zBjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA8tBjC,CAAC"}
+{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAg0BjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAmuBjC,CAAC"}

package/dist/core/lisa-owned-hash-ledger.js

@@ -360,6 +360,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
     ]),
     "scripts/lisa-enforcement-fallback.sh": Object.freeze([
         "1bec5f3c284b3febdc471487ee6a23ffb72bd4e7b293f9e26b0188f32318c722",
+        "27f4e4b54986f49ddb9a3bf6e02b926d41d85ecd46ab2263cb17a5746820f8bd",
         "3049c2f1051c7c02dd60b62355964651e1565ebe6bdcb5e37634cd686cf1deb1",
         "68e1b78d5d4471fadbe2eb575ae46221838217290123a9910d76dba0f1c34131",
         "7d333dc10be8c810b9b5aca35ab7f6f60413134414d82bf0cdaedb4e6e3ca8da",
@@ -375,6 +376,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "d922508529c0ffd6b8411d7fc618b3d14ceb70901746adfbcf49e46eb685d6b9",
         "e0f4f2b11bea5497af12bae0d52902eb3d02b4ec3a7ae8e07236fb09b59cf560",
         "e17c45f7cadf0fb55dd07270776caf211af99b7d4771a4fde75aafe5919e8dbe",
+        "e481f9940fa6e7ab9fa6a990ec42e08a6c76023abca80b6ab7bbf545ab185b9e",
     ]),
     "scripts/lisa-environment-prepare.mjs": Object.freeze([
         "0c2c2aeed3a8d843b3019e5263aab26790856c0c33f028925d2f0f795a26872d",
@@ -757,6 +759,8 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "2289eb74705b6e24fc947182fb3cd64422b918d0dcb3abf546c2452ab247b5b8",
         "238dc2da29938edd92518c2b08192d14c6f2751ed175c07d6e882814829b7b7e",
         "2d9ca0841db9e75ddfd95e3a4d485fd01aa639a512ef648996f565b7991d8e2b",
+        "3a9ec1ff863693a0fa0fef0ade6fa5534485d0249fb78302d37cdac3781348f1",
+        "4372872a448d3b943dea5541167ed5be6155703b57b9f8224d19ddefd3b80898",
         "475cb9ef86c2ac54c8fd8cb6d63e9a55ea8cd0017e26efbe3c44391a4aeeab41",
         "4c263fef48c03b3b6c623ea8a6cd55505bfaf28197e5072226ea35f9f3d26885",
         "5a0b82045d9795284a109c28e5e9dd97a5488ff540bb7034b84077d1447ffd7c",
@@ -766,6 +770,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "637741a9e5d2904aed24d48efd6bec1326c5573f718a13152807aa0e4b42f0a1",
         "6a8be8577242588f14ab52b25b2a22b6def53aefa9513b4d3d7c49f4d8027079",
         "71ff42c2cb8ac7022e0066132476764dd745fb92bf19ccd395000b1fe319abc7",
+        "7573b5170fcba45ccd6123cd0712baba8faa52f063b639140be829d9ce87327d",
         "83e7f1257bfee293bcdcdafef4272f40fcdca2d9e43ceb9df647c13c8277423d",
         "8c3effe804dfbea75011271f9d96eeb125fcbb97dc6397cc2c2dffd935f3aef0",
         "8cd8d102d4b3276f92bb4706274d280c302269fb2f564ca93b1d79cb3ff26841",
@@ -1180,6 +1185,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
     ]),
     "scripts/lisa-enforcement-fallback.sh": Object.freeze([
         "1bec5f3c284b3febdc471487ee6a23ffb72bd4e7b293f9e26b0188f32318c722",
+        "27f4e4b54986f49ddb9a3bf6e02b926d41d85ecd46ab2263cb17a5746820f8bd",
         "3049c2f1051c7c02dd60b62355964651e1565ebe6bdcb5e37634cd686cf1deb1",
         "68e1b78d5d4471fadbe2eb575ae46221838217290123a9910d76dba0f1c34131",
         "7d333dc10be8c810b9b5aca35ab7f6f60413134414d82bf0cdaedb4e6e3ca8da",
@@ -1195,6 +1201,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "d922508529c0ffd6b8411d7fc618b3d14ceb70901746adfbcf49e46eb685d6b9",
         "e0f4f2b11bea5497af12bae0d52902eb3d02b4ec3a7ae8e07236fb09b59cf560",
         "e17c45f7cadf0fb55dd07270776caf211af99b7d4771a4fde75aafe5919e8dbe",
+        "e481f9940fa6e7ab9fa6a990ec42e08a6c76023abca80b6ab7bbf545ab185b9e",
     ]),
     "scripts/lisa-environment-prepare.mjs": Object.freeze([
         "0c2c2aeed3a8d843b3019e5263aab26790856c0c33f028925d2f0f795a26872d",
@@ -1510,6 +1517,8 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "2289eb74705b6e24fc947182fb3cd64422b918d0dcb3abf546c2452ab247b5b8",
         "238dc2da29938edd92518c2b08192d14c6f2751ed175c07d6e882814829b7b7e",
         "2d9ca0841db9e75ddfd95e3a4d485fd01aa639a512ef648996f565b7991d8e2b",
+        "3a9ec1ff863693a0fa0fef0ade6fa5534485d0249fb78302d37cdac3781348f1",
+        "4372872a448d3b943dea5541167ed5be6155703b57b9f8224d19ddefd3b80898",
         "475cb9ef86c2ac54c8fd8cb6d63e9a55ea8cd0017e26efbe3c44391a4aeeab41",
         "4c263fef48c03b3b6c623ea8a6cd55505bfaf28197e5072226ea35f9f3d26885",
         "5a0b82045d9795284a109c28e5e9dd97a5488ff540bb7034b84077d1447ffd7c",
@@ -1518,6 +1527,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "62f53156d425198609564e996f3844f52ab110e63f99f22e8338fcf7a83f316d",
         "6a8be8577242588f14ab52b25b2a22b6def53aefa9513b4d3d7c49f4d8027079",
         "71ff42c2cb8ac7022e0066132476764dd745fb92bf19ccd395000b1fe319abc7",
+        "7573b5170fcba45ccd6123cd0712baba8faa52f063b639140be829d9ce87327d",
         "83e7f1257bfee293bcdcdafef4272f40fcdca2d9e43ceb9df647c13c8277423d",
         "8c3effe804dfbea75011271f9d96eeb125fcbb97dc6397cc2c2dffd935f3aef0",
         "8cd8d102d4b3276f92bb4706274d280c302269fb2f564ca93b1d79cb3ff26841",