@msn-control/liftoff 0.10.3 → 0.11.1

package/docs/troubleshooting.md

@@ -5,7 +5,7 @@
 Check the canonical release:
 
 ```bash
-npm view @msn-control/liftoff@latest version --registry=https://registry.npmjs.org
+npm view @msn-control/liftoff@latest version --registry=https://registry.npmjs.org --@msn-control:registry=https://registry.npmjs.org
 liftoff --version
 liftoff upgrade --check
 liftoff upgrade
@@ -21,7 +21,7 @@ that version supported.
 Versions that predate `liftoff upgrade` require one manual global installation:
 
 ```bash
-npm install -g @msn-control/liftoff@latest --registry=https://registry.npmjs.org
+npm install -g @msn-control/liftoff@latest
 ```
 
 ## CLI upgrade is blocked by installation origin
@@ -38,6 +38,14 @@ Canonical npm defines the exact stable target, but Liftoff installs through the
 configured registry. Ask the mirror owner to synchronize or approve that exact
 version, then rerun `liftoff upgrade --check`. Liftoff does not edit `.npmrc` or
 bypass the managed registry.
+The package's machine-level `@msn-control:registry` takes precedence over npm's
+default `registry`. A canonical default does not cancel a scoped mirror.
+Liftoff reads this configuration from a neutral directory, not a project's
+`.npmrc`, and never prints credential-bearing registry values.
+
+A response-body timeout is a transport failure, not invalid release metadata.
+Retry after connectivity is restored; do not change registry policy or regenerate
+project locks to work around it.
 
 ## npm cannot write the global prefix
 
@@ -168,7 +176,7 @@ unrecorded conflicting file remains user-owned and is not reported as an
 orphan.
 
 If a newer Liftoff release contains different source, dependencies, schemas,
-containers, environment files, Power Apps starter files, or infrastructure,
+containers, environment files, or infrastructure,
 ordinary update intentionally reports nothing for those project-owned
 differences. Review and migrate them as production changes. The existing
 `liftoff migrate` command does not perform an in-place Liftoff project upgrade.
@@ -189,8 +197,9 @@ the existing project files and infrastructure are project-owned.
 
 That is the expected initial state. The manifest records `handoff-generated`,
 not active enforcement. Run `/liftoff-setup` from a selected agent. It first
-completes, syncs, and archives the generated bootstrap seed with local baseline
-checks, then stops at explicit authority gates for commit/push, credentials,
+completes, syncs, and archives the OpenSpec bootstrap, or finalizes Spec Kit's
+real `000-liftoff-bootstrap` bundle locally after baseline checks. It then stops
+at explicit authority gates for commit/push, credentials,
 billed infrastructure or exceptions, final enforcement, destructive cleanup, or
 external blockers. Rerun `/liftoff-setup` to resume; verified phases are not
 repeated. Older generated setup aliases are retired; after review,
@@ -205,14 +214,20 @@ policy's repository-dedicated provisioning exception, but it must stop for
 explicit approval before creating any Azure or GitHub resource. Do not replace
 missing capability with duplicate scanners, partial provisioning, or
 placeholder success.
+These are target-policy requirements; 14 production phases lack executors and
+two ruleset phases require an injected adapter absent from the public CLI.
+Public approval persistence and credential enrollment also remain unavailable.
+An unavailable executor or authority entry point is a blocker, not an instruction
+to run its provider commands directly.
 
 If a private ZRS state backend cannot be reached because public network access
 is disabled and no approved private management path exists, do not enable
-public access or upload local state to GitHub. Use the policy's explicitly
-approved minimum `bootstrap-local` phase, adopt resources through declarative
+public access or upload local state to GitHub. The target policy requires an
+explicitly approved minimum `bootstrap-local` phase, adoption through declarative
 imports from the private runner, verify identity parity, locking, versioning,
 and a clean no-change plan, then retain the frozen local state read-only for 30
-days before secure deletion.
+days before secure deletion. That production adapter is not implemented by this
+release; stop at the capability blocker and plan separately reviewed platform work.
 
 If an Azure bootstrap fails with a namespace-not-registered error while
 `resource_provider_registrations = "none"` is configured, do not retry the same
@@ -239,23 +254,23 @@ or allow TCP and UDP 53 to exact custom resolver addresses.
 
 | State | Remedy |
 | --- | --- |
-| `seed-incomplete` | Run `/liftoff-setup`; fix failing local baseline checks and rerun until the seed is archived. |
-| `phase-blocked` | Read the blocking phase, evidence requirement, and approval gate; satisfy the named prerequisite rather than skipping it. |
-| `evidence-stale` | Regenerate evidence from the current baseline, activation identity, graph hash, and phase input digest. |
+| `seed-incomplete` | Repair local checks, then explicitly retry the supported seed phase. OpenSpec archives; Spec Kit finalizes its real bundle locally. |
+| `phase-blocked` | Read the phase, proof, and authority blocker; unavailable production or enrollment capabilities remain blocked. |
+| `evidence-stale` | Obtain fresh proof through supported, authorized execution from current inputs; never edit receipts or reuse stale headers as current inputs. |
 | `credential-expiring` | Rotate before the recorded lead time using the same App or PAT policy. |
-| `reconciliation-required` | Review the policy/contract/schema/graph change and acknowledge the current compatible identity before applying another phase. |
-| `identity-incompatible` | Upgrade to the reported minimum Liftoff version or provide an explicit supported migration/import mapping. |
+| `reconciliation-required` | Review the precise identity/input diagnostic. Historical v1 has no public reconciliation workflow; preserve its bytes rather than acknowledging a new identity by editing JSON. |
+| `identity-incompatible` | Upgrade when the supported tuple requires a newer CLI. Unknown or historical tuples cannot be made executable with force or invented mappings. |
 | `enforcement-incomplete` | Prove exact required contexts green and deliberately red, then approve final enforcement before ruleset mutation. |
-| `disposal-pending` | After day 30, approve destructive disposal of retained bootstrap state and rerun setup. |
+| `disposal-pending` | Review retention, exact imported paths, destructive scope, and proof. Execution requires valid authority; there is no public approval-entry shortcut. |
 
 Do not hand-edit task checkboxes to clear these states. Tasks are projections of
 validated phase evidence.
 
 ## Runner-preflight credential setup is blocked
 
-Setup first prefers an existing verified selected-repository GitHub App with the
-required read permissions. If none is available, create one fine-grained PAT with
-exactly these fields: display name `<repo>-runner-preflight-read`, secret
+The policy prefers an existing verified selected-repository GitHub App with the
+required read permissions. Its fallback contract describes a fine-grained PAT
+with these fields: display name `<repo>-runner-preflight-read`, secret
 `RUNNER_CONFIGURATION_READ_TOKEN`, 30-day lifetime, current repository only,
 repository metadata read, organization hosted-runner read and
 network-configuration read, no writes, and the recorded workflow/job allowlist
@@ -264,24 +279,81 @@ network-configuration read, no writes, and the recorded workflow/job allowlist
 `private-dast-preflight` unless the generated policy records a narrower
 applicable set).
 
-Enter the value only through the masked input. Never paste or show the value in
-chat, argv, command arguments, logs, evidence, files, or screenshots. A leaked value is
-compromised; manually revoke it, create a replacement, update the repository
-secret through setup, and rerun `liftoff governance verify --json`.
+This release does not expose public credential enrollment or masked input.
+Do not create or submit a credential through an invented setup channel, and do
+not hand-write state or receipts to bypass the capability blocker. Never paste
+or show the value in chat, argv, command arguments, logs, evidence, files, or
+screenshots. Revoke and rotate leaked credentials through their owner-controlled
+system. A payload-free policy file alone is not independent readback evidence.
 
 ## Governance identity or manifest migration is blocked
 
 Current Liftoff reads manifest v2-v7 and writes v7. It resumes only explicit
-compatible tuples: policy version 6, activation contract 1, schema-v1 activation
-artifacts, and a recognized phase-graph hash. Future versions, individually
+compatible tuples: policy version 6, activation contract 2, state/evidence-header/
+approval/compatibility metadata versions 2, and a recognized phase-graph hash.
+Phase graph, supersession, and credential-policy schemas stay at 1.
+Future versions, individually
 known but unsupported combinations, unknown graph hashes, or unversioned ad hoc
 state block without rewriting files. Use the exact upgrade, import-mapping, or
-reconciliation remedy printed by status or update; do not downgrade the
-manifest or copy evidence between identities.
+reconciliation diagnostic printed by status or update; do not downgrade the
+manifest or copy evidence between identities. Historical v1 state and evidence
+remain diagnostic-only and byte-preserved. This release has no automatic or
+public historical-state reconciliation workflow; managed-core update does not
+make that history executable.
 
 Do not run an older Liftoff release to reverse a completed baseline migration.
-Restore the affected generated files and `liftoff.manifest.json` through version
-control, then reinstall from the restored locks.
+Restore separately reviewed project changes through version control and reinstall
+from the restored locks; do not alter immutable activation evidence to claim
+compatibility.
+
+## Spec Kit setup reports seed adoption required
+
+The real bundle must contain `specs/000-liftoff-bootstrap/spec.md`, `plan.md`,
+and `tasks.md`, its identity markers, and B001–B006 exactly once. Framework
+templates are not a substitute for project artifacts. Existing projects missing
+the bundle need separate reviewed adoption; update, force, assessment, or
+read-only resume will not create it. Never invent an OpenSpec archive or Git
+branch to make Spec Kit setup pass.
+
+## Infrastructure helpers or baseline report migration required
+
+Independent roots require exact recorded shared-module/root provenance and safe
+existing module files. Creating folders alone, changing tfvars paths, or updating
+managed governance context does not establish eligibility. Existing flat-root
+provenance remains unchanged after the explicit new-output-only retirement.
+Do not move state or force new roots into place to clear the result; plan a
+separate reviewed migration.
+
+## Native startup rejects configuration or appears to ignore the file
+
+Python and Node read root `.env`; Python backend-CWD startup still resolves that
+same file. Go's backend-CWD recipe reads `../runtime.config.json`. Use
+`LIFTOFF_ENV_FILE` for an explicit selection, relative to the startup directory
+unless absolute. Process values override the file, and settings are resolved
+once, so restart after edits.
+
+An explicit missing, unreadable, malformed, invalid-UTF-8, or NUL-containing
+dotenv file fails rather than falling back. Fix `KEY=value` syntax and balanced
+quotes; Node rejects escaped quote delimiters, so use the other quote style.
+Go requires valid JSON with string values, not null or numeric values.
+Do not source configuration as shell code. An absent default file is allowed
+only when the required settings come from process configuration.
+
+For offline `/health`, `/ready`, and `/openapi.json` probes, provide
+`DATABASE_URL` and `REDIS_URL` but leave `PYDANTIC_AI_MODEL`,
+`LANGFUSE_PUBLIC_KEY`, and `LANGFUSE_SECRET_KEY` blank. These probes do not
+contact a model or prove external-service health. `PYDANTIC_AI_MODEL=test` is
+not a supported model provider; no special test-model flag is needed.
+
+See [runtime recipes](configuration-and-manifests.md#application-runtime-configuration).
+
+## A locally prepared container build includes host files
+
+Keep the generated root and frontend `.dockerignore` files in their respective
+build contexts. They exclude host `.venv`, `node_modules`, caches, build output,
+VCS metadata, state, and local secrets. Function publication uses its own
+`.funcignore`. If those project-owned files were changed or removed, repair them
+through reviewed project work; update or force cannot restore them.
 
 ## A frozen Python install cannot reach the package index
 
@@ -299,30 +371,16 @@ docker build --build-arg UV_DEFAULT_INDEX=https://packages.example.test/simple/
 Do not place credentials in build arguments. Configure authenticated registries
 through an approved secret-aware build mechanism.
 
-## Power Apps dependencies or CLI are missing
-
-From the project root:
-
-```bash
-npm ci
-npx --no-install power-apps --version
-npm run dev
-```
+## Power Apps workload or Code Apps options are rejected
 
-The CLI is project-local. Do not replace the locked install with an unrelated
-global package.
-
-## The Code Apps plugin is missing or not observable
-
-Plugin state is advisory. In each selected agent session, use:
-
-```text
-/plugin marketplace add microsoft/power-platform-skills
-/plugin install code-apps-preview@power-platform-skills
-```
+Power Apps creation and existing-project support are retired. The workload and
+plugin options now fail explicitly; this is not a missing dependency or an
+installation problem.
 
-Then rerun `liftoff doctor`. Do not run `/create-code-app` in a Liftoff project.
-Liftoff does not run Microsoft's broad plugin installer.
+The rejection leaves application files, dependencies, framework files, and
+historical state unchanged. Do not change the manifest's workload identity, hide
+it to trigger another discovery path, or use force to bypass retirement. This
+CLI provides no automatic conversion or continued Power Apps maintenance lane.
 
 ## Terminal output is hard to read or being captured
 

package/docs/workloads.md

@@ -1,5 +1,12 @@
 # Workloads
 
+Liftoff generates starter projects and governance definitions, not a blanket
+production-readiness guarantee. Catalog scaffold labels and complete file
+generation do not prove every GenAI behavior, worker deployment, authentication,
+private-network path, or operational safeguard is implemented. Review the
+[documented capability follow-ups](../DEVELOPER.md#broader-audit-follow-ups)
+before deploying generated applications unchanged.
+
 Liftoff asks for one workload first, then routes only the questions,
 prerequisites, generated artifacts, and maintenance checks that apply to it.
 
@@ -7,12 +14,13 @@ prerequisites, generated artifacts, and maintenance checks that apply to it.
 
 | Workload | Primary choices | Required runtime | Liftoff-generated platform areas |
 | --- | --- | --- | --- |
-| GenAI application | Pattern, Azure region, environments, optional frontend | Python 3.14, `uv` 0.12.7+, and Node.js 24.20+ | API, orchestration, data, messaging, Docker, Azure OpenTofu |
-| API application | Python 3.14, Node.js 24, or Go 1.27 API stack; Azure region; environments; optional frontend | Selected API runtime and Node.js 24.20+ | API, data, Docker, Azure OpenTofu |
-| Power Apps code app | Spec workflow, agents, optional Code Apps plugin | Node.js 24.20+ | Official React/Vite starter and project-local Power Apps tooling |
+| GenAI application | Pattern, Azure region, environments, optional frontend | Python 3.14.x, `uv` 0.12.x, and Node.js 24.20+ within 24 LTS | API, orchestration, data, messaging, Docker, Azure OpenTofu |
+| API application | Python 3.14, Node.js 24, or Go 1.27 API stack; Azure region; environments; optional frontend | Selected supported API release line and Node.js 24.20+ within 24 LTS | API, data, Docker, Azure OpenTofu |
 
-All three workloads continue into the common OpenSpec or Spec Kit and coding
+Both workloads continue into the common OpenSpec or Spec Kit and coding
 agent flow and the default local repository-governance handoff.
+Required package managers are separate prerequisites: npm 12.x at 12.0.2 or
+newer is required for Node.js dependencies, the optional frontend, or OpenSpec.
 
 ## GenAI application
 
@@ -55,6 +63,33 @@ tools, streaming adapters, fine-tuning datasets, or workflow structures.
 Specializing it later is reviewed project migration work; `liftoff update` and
 `--force` cannot convert project-owned application files.
 
+### Pattern capability limits
+
+All nine identifiers remain available and have `foundation` maturity.
+That label describes starter boundaries, not a completed specialized application.
+
+| Pattern ID | Existing boundary | Deliberately not implemented |
+| --- | --- | --- |
+| `generic` | Neutral model invocation | Retrieval, pgvector, workers, or other specialization |
+| `rag` | Model-only answers, configured ingestion publication, pgvector/worker extension points | Retrieval, citations, embeddings, indexing, and grounded RAG answers |
+| `chatbot` | Single-turn model invocation | Persisted conversation history and memory |
+| `agent` | Model invocation and worker extension points | Tool execution and task automation |
+| `prompt` | Invocation and prompt artifacts | Loading named prompt files into the model call |
+| `multi-agent` | Single-model invocation and worker extension points | Multi-agent coordination |
+| `fine-tuned` | Configured-model invocation and sample evaluation dataset | Fine-tuning and evaluation execution |
+| `streaming` | One completed model response wrapped as buffered SSE | Incremental token streaming |
+| `workflow` | Invocation and worker extension points | Workflow stages and durable pipeline execution |
+
+Generic's default Python `pyproject.toml` and `uv.lock` have no `pgvector`
+dependency. Only RAG requests the pgvector database extension/image; generic
+has no application worker. The optional Langfuse observability-profile worker
+is not application-worker specialization. Generated Function triggers log
+message keys rather than implementing indexing or orchestration.
+
+See [runtime configuration](configuration-and-manifests.md#application-runtime-configuration)
+for Python/Node dotenv, Go JSON, explicit-file validation, and native/Compose
+recipes. No API stack inherits GenAI-only model or tracing credentials.
+
 ## API application
 
 ### Questions
@@ -81,71 +116,27 @@ Specializing it later is reviewed project migration work; `liftoff update` and
 Service secrets, cloud authentication, external integrations, and deployment
 remain explicit developer or delivery-pipeline actions.
 
-## Power Apps code app
-
-Power Apps uses an immutable, packaged snapshot of Microsoft's official
-[`PowerAppsCodeApps/templates/starter`](https://github.com/microsoft/PowerAppsCodeApps/tree/main/templates/starter).
-Initialization and update do not fetch the mutable upstream branch.
-
-### Questions
-
-- Project name.
-- OpenSpec or Spec Kit.
-- GitHub Copilot, Claude Code, or both.
-- Spec Kit default agent when both are selected.
-- Whether to request the optional Microsoft Code Apps agent plugin
-  (Preview).
-
-Power Apps does not ask for an API stack, GenAI pattern, cloud, region, API
-environment, API frontend, Docker, or OpenTofu selection.
-
-### Generated output
-
-- React, Vite, TypeScript, Tailwind, and the Power Apps SDK and Vite plugin.
-- Locked root `package.json` and `package-lock.json`.
-- Project-local `power-apps` CLI supplied by the generated dependency graph.
-- `liftoff.config.json`, manifest-v7 `liftoff.manifest.json`, starter provenance,
-  and third-party attribution.
-- Official OpenSpec or Spec Kit output and every selected agent marker.
-- The common local governance policy and selected-agent `/liftoff-setup` integration, with backend,
-  container, OpenTofu, custom deployment, and API DAST controls marked
-  inapplicable.
-
-Liftoff does not create an API backend, `docker-compose.yml`,
-`infrastructure/`, API environments, or an environment-bound
-`power.config.json` for this workload.
-
-### Deferred actions
-
-After initialization:
-
-```bash
-npm ci
-npm run dev
-npx --no-install power-apps --version
-```
-
-Environment binding, connector creation, authentication, and deployment remain
-outside initialization. Follow Microsoft's current Code Apps documentation
-before running `power-apps init` or `power-apps push`.
-
-If the optional Code Apps plugin was requested, install only the targeted
-plugin from an agent session:
+## Retired Power Apps workload
 
-```text
-/plugin marketplace add microsoft/power-platform-skills
-/plugin install code-apps-preview@power-platform-skills
-```
+Power Apps code apps and the Code Apps preview-plugin integration are no longer
+supported. The retired `power-apps-code-app` type and plugin options are rejected
+before preparation or generation.
 
-Do not run `/create-code-app` inside the generated project; Liftoff already
-created the application.
+Existing Power Apps manifests are also rejected, including by update, force,
+doctor, and governance assessment. Liftoff does not convert the project, delete
+application files, update its dependencies, or fall back to a different workload.
+Existing Power Platform applications and machine-wide tooling remain under
+their owners' control outside Liftoff.
 
 ## Change workload later
 
 `liftoff update` maintains explicit Liftoff core files and can provision a
 previously absent frontend or environment once after a corresponding desired
-state edit. It does not convert workloads, change API stacks or GenAI patterns,
-transition a Power Apps starter, or modernize production project templates.
+state edit. New environments additionally require recorded independent-root
+infrastructure; legacy or unknown shared-state layouts need reviewed migration.
+It does not convert workloads, change API stacks or GenAI patterns,
+or modernize production project templates. Retired workloads have no update or
+automatic migration path.
 
 Plain update applies safe core changes immediately. Use `liftoff update
 --check` for read-only inspection. `--force` applies only to listed

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@msn-control/liftoff",
-  "version": "0.10.3",
-  "description": "Interactive CLI for governed GenAI, API, and Power Apps code app projects.",
+  "version": "0.11.1",
+  "description": "Interactive CLI for governed GenAI applications and APIs.",
   "type": "module",
   "license": "GPL-3.0-only",
   "homepage": "https://github.com/voyager163/liftoff#readme",
@@ -21,7 +21,6 @@
     "fastify",
     "golang",
     "pydanticai",
-    "power-apps",
     "opentofu",
     "openspec",
     "mission-control"
@@ -33,7 +32,6 @@
     "dist",
     "assets/locks",
     "assets/governance",
-    "assets/power-apps-code-app",
     "assets/supported-stack.json",
     "docs",
     "README.md",
@@ -45,18 +43,16 @@
     "provenance": true
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json",
+    "build": "node scripts/clean-build.mjs && tsc -p tsconfig.json",
     "test": "vitest run",
     "audit:template-dependencies": "node scripts/audit-template-dependencies.mjs",
     "refresh:supported-stack": "node scripts/refresh-supported-stack-baseline.mjs --write",
     "check:supported-stack": "node scripts/refresh-supported-stack-baseline.mjs",
     "check:supported-stack-freshness": "node scripts/check-supported-stack-freshness.mjs",
     "canonicalize:python-locks": "node scripts/canonicalize-uv-lock.mjs assets/locks/python-standard/uv.lock assets/locks/python-genai/uv.lock",
-    "refresh:power-apps-starter": "node scripts/refresh-power-apps-starter.mjs",
     "smoke:package": "npm run build && node scripts/package-smoke-test.mjs",
     "verify:standard-node-templates": "npm run build && node scripts/verify-standard-node-templates.mjs",
     "verify:generated-containers": "npm run build && node scripts/verify-generated-containers.mjs",
-    "verify:power-apps-starter": "npm run build && node scripts/verify-power-apps-starter.mjs",
     "verify:release-identity": "npm run build && node scripts/verify-release-identity.mjs",
     "verify:published": "npm run build && node scripts/verify-published-package.mjs",
     "check": "npm run check:supported-stack && npm run build && npm test"
@@ -74,6 +70,8 @@
   "dependencies": {
     "@inquirer/prompts": "^8.6.0",
     "cross-spawn": "^7.0.6",
-    "picocolors": "^1.1.1"
+    "picocolors": "^1.1.1",
+    "smol-toml": "1.8.0",
+    "yaml": "^2.9.0"
   }
 }

package/assets/power-apps-code-app/3438c352483e40982f6c5c0fc36fd71f8e7adbbb/UPSTREAM_LICENSE.txt

@@ -1,21 +0,0 @@
-Copyright (c) Microsoft Corporation.
-
-MIT License
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.