@msn-control/liftoff 0.10.2 → 0.10.4

package/dist/governance-assessment/command.js

@@ -0,0 +1,81 @@
+import path from 'node:path';
+import { stat } from 'node:fs/promises';
+import { readBooleanFlag, readStringFlag } from '../args.js';
+import { findProjectRoot } from '../file-system.js';
+import { canonicalSha256 } from '../governance-activation/canonical-json.js';
+import { assessGovernance } from './engine.js';
+import { assembleAssessmentReport } from './report.js';
+import { loadAssessmentCatalog } from './catalog.js';
+import { sanitizeAssessmentText } from './sanitize.js';
+export function renderAssessmentReport(report, presentation) {
+    presentation.commandIdentity('governance assess', 'Read-only governance comparison');
+    presentation.definitions('Assessment target', [
+        { label: 'CLI', value: report.target?.cliVersion ?? 'unavailable' },
+        { label: 'Policy', value: report.target?.policyVersion ?? 'unavailable' },
+        { label: 'Project policy', value: report.projectIdentity.policyVersion ?? 'unrecorded' },
+        { label: 'Scope', value: report.mode === 'live' ? 'Local and explicitly requested live metadata' : 'Local only; no network requests' },
+        { label: 'Recorded identity', value: report.projectIdentity.availability }
+    ]);
+    presentation.status(report.outcome === 'error' ? 'error' : report.outcome === 'aligned' ? 'success' : 'info', report.outcome, report.outcome === 'not-applicable'
+        ? 'Governance is disabled; no alignment or activation is claimed.'
+        : `${report.coverage.fullyObserved}/${report.coverage.applicable} applicable controls fully observed; ${report.coverage.unobserved} unobserved; ${report.coverage.differences} differences.`);
+    if (report.outcome === 'partial') {
+        presentation.status('warning', 'Incomplete coverage', 'Unobserved live proof, unsupported evaluators, and unknown applicability are not passes.');
+    }
+    const ordered = [...report.findings].sort((a, b) => {
+        const rank = { error: 0, warning: 1, info: 2 };
+        return rank[a.severity] - rank[b.severity] || a.controlId.localeCompare(b.controlId, 'en');
+    });
+    const display = (value) => sanitizeAssessmentText(typeof value === 'string' ? value : JSON.stringify(value), 180);
+    presentation.table('Governance comparisons', ['Control', 'Result', 'Expected', 'Observed'], ordered.map((finding) => [
+        `${finding.controlId}${finding.scope.resource ? ` (${finding.scope.resource})` : ''}`, finding.classification,
+        display(finding.expected),
+        Object.entries(finding.observations).map(([layer, observation]) => `${layer}: ${observation.availability === 'not-observed' ? 'not observed' : display(observation.facts ?? observation.value)}`).join('; ')
+    ]));
+    for (const finding of ordered.filter((entry) => entry.classification !== 'aligned' && entry.classification !== 'inapplicable')) {
+        presentation.status('info', finding.controlId, finding.reasons.join('; '));
+        const origins = Object.values(finding.observations).flatMap((observation) => observation.source ? [`${observation.source.kind}: ${observation.source.location}${observation.source.line ? `:${observation.source.line}` : ''}`] : []);
+        if (origins.length)
+            presentation.status('info', 'Evidence', [...new Set(origins)].join('; '));
+    }
+    for (const diagnostic of report.diagnostics) {
+        presentation.status(diagnostic.severity === 'error' ? 'error' : 'warning', diagnostic.code, diagnostic.message);
+    }
+    const actionable = ordered.filter((finding) => ['missing', 'outdated', 'conflicting'].includes(finding.classification));
+    if (actionable.length)
+        presentation.bullets('Advisory actions only', [...new Set(actionable.map((finding) => `${finding.recommendation.ownership}: ${finding.recommendation.action}`))]);
+    presentation.status('info', 'No changes made', 'Assessment does not update, approve, migrate, or activate governance.');
+}
+export async function governanceAssessmentCommand(parsed, context) {
+    const mode = readBooleanFlag(parsed.flags, 'live') ?? false;
+    const start = path.resolve(context.cwd, parsed.positional[0] ?? readStringFlag(parsed.flags, 'project') ?? '.');
+    let report;
+    let target = null;
+    try {
+        target = loadAssessmentCatalog().target;
+        if (!(await stat(start)).isDirectory())
+            throw new Error('Assessment project path must be a directory.');
+        const root = await findProjectRoot(start);
+        if (!root)
+            throw new Error('No liftoff.manifest.json found. Run assessment inside a Liftoff project or provide its path.');
+        report = await assessGovernance(root, { live: mode, runner: context.runner });
+    }
+    catch (error) {
+        report = assembleAssessmentReport({
+            projectRoot: start, mode: mode ? 'live' : 'local',
+            target,
+            projectIdentity: { availability: 'unavailable', manifestVersion: null, cliVersion: null, profile: null, policyVersion: null, recordedActivationIdentity: null, stateSource: 'unavailable' },
+            snapshot: { capturedAt: new Date().toISOString(), repository: null, localHead: null, worktreeDigest: canonicalSha256({}), inputsStable: false },
+            findings: [], diagnostics: [{
+                    code: 'project-discovery', severity: 'error', source: null,
+                    message: sanitizeAssessmentText(error instanceof Error ? error.message : 'Project discovery failed.')
+                }], failed: true
+        });
+    }
+    if (readBooleanFlag(parsed.flags, 'json'))
+        context.presentation.rawStdout(`${JSON.stringify(report, null, 2)}\n`);
+    else
+        renderAssessmentReport(report, context.presentation);
+    return report.exitCode;
+}
+//# sourceMappingURL=command.js.map

package/dist/governance-assessment/command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.js","sourceRoot":"","sources":["../../src/governance-assessment/command.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAKpD,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEvD,MAAM,UAAU,sBAAsB,CAAC,MAAwB,EAAE,YAAiC;IAChG,YAAY,CAAC,eAAe,CAAC,mBAAmB,EAAE,iCAAiC,CAAC,CAAC;IACrF,YAAY,CAAC,WAAW,CAAC,mBAAmB,EAAE;QAC5C,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,aAAa,EAAE;QACnE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,IAAI,aAAa,EAAE;QACzE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,aAAa,IAAI,YAAY,EAAE;QACxF,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,iCAAiC,EAAE;QACtI,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,YAAY,EAAE;KAC3E,CAAC,CAAC;IACH,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAC1G,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,gBAAgB;QACjD,CAAC,CAAC,gEAAgE;QAClE,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,wCAAwC,MAAM,CAAC,QAAQ,CAAC,UAAU,gBAAgB,MAAM,CAAC,QAAQ,CAAC,WAAW,eAAe,CAAC,CAAC;IAClM,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,qBAAqB,EAAE,0FAA0F,CAAC,CAAC;IACpJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,sBAAsB,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3H,YAAY,CAAC,KAAK,CAAC,wBAAwB,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACnH,GAAG,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,cAAc;QAC7G,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,EAAE,CAChE,GAAG,KAAK,KAAK,WAAW,CAAC,YAAY,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAC9H,CAAC,IAAI,CAAC,IAAI,CAAC;KACb,CAAC,CAAC,CAAC;IACJ,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,cAAc,KAAK,cAAc,CAAC,EAAE,CAAC;QAC/H,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAC1E,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,MAAM,CAAC,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CACxJ,CAAC;QACF,IAAI,OAAO,CAAC,MAAM;YAAE,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChG,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IACxH,IAAI,UAAU,CAAC,MAAM;QAAE,YAAY,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1G,GAAG,OAAO,CAAC,cAAc,CAAC,SAAS,KAAK,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,CACxE,CAAC,CAAC,CAAC,CAAC;IACL,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAAE,uEAAuE,CAAC,CAAC;AAC1H,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAkB,EAClB,OAAmF;IAEnF,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC;IAChH,IAAI,MAAwB,CAAC;IAC7B,IAAI,MAAM,GAA4B,IAAI,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,qBAAqB,EAAE,CAAC,MAAM,CAAC;QACxC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACxG,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;QAC3H,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,wBAAwB,CAAC;YAChC,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YACjD,MAAM;YACN,eAAe,EAAE,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE;YAC3L,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE;YAC/I,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;oBAC1B,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI;oBAC1D,OAAO,EAAE,sBAAsB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC;iBACtG,CAAC,EAAE,MAAM,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC;QAAE,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;;QAC7G,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC"}

package/dist/governance-assessment/engine.d.ts

@@ -0,0 +1,19 @@
+import type { ApprovalEnvelope } from '../governance-activation/types.js';
+import type { CommandRunner } from '../process-runner.js';
+import { type AssessmentProject, type AssessmentGitFacts } from './project.js';
+import type { AssessmentFinding, AssessmentReport, ControlDefinition, FindingScope, LiveAssessmentScope } from './types.js';
+export declare function selectBoundAssessmentEvidence(project: AssessmentProject, phaseId: ControlDefinition['phaseIds'][number], now: Date): {
+    evidenceId: string;
+    header: import("../governance-activation/types.js").EvidenceHeader;
+    headerDigest: string;
+    producedAtEpochMs: number;
+    liveReadback: readonly import("../governance-activation/types.js").LiveReadbackProof[];
+    record: import("../governance-activation/types.js").PhaseEvidenceRecord;
+} | null;
+export declare function resolveAssessmentLiveScope(project: AssessmentProject, git: AssessmentGitFacts, now: Date): LiveAssessmentScope;
+export declare function findAssessmentException(control: ControlDefinition, approvals: readonly ApprovalEnvelope[], scope: FindingScope, baseline: string | null, resource: string | undefined, now: Date): AssessmentFinding['exception'];
+export declare function assessGovernance(projectRoot: string, options?: {
+    live?: boolean;
+    runner?: CommandRunner;
+    now?: () => Date;
+}): Promise<AssessmentReport>;