@msn-control/liftoff 0.10.4 → 0.11.1

package/docs/configuration-and-manifests.md

@@ -18,11 +18,9 @@ Supported edits are reconciled by `liftoff update`:
   manifests; replace it with `staging` before validation or update.
 - Removing or re-enabling a previously provisioned component never deletes,
   restores, or overwrites its project-owned files.
-- Power Apps can change the optional Code Apps plugin preference; only manifest
-  intent and applicable managed-core context change.
 
-Workload kind, API stack, GenAI pattern, spec workflow, selected agents, and a
-user-supplied Power Apps starter source change are not ordinary updates.
+Workload kind, API stack, GenAI pattern, spec workflow, and selected agents are
+not ordinary updates.
 
 An undecided GenAI project records an explicit generic identity rather than
 omitting the pattern:
@@ -46,21 +44,98 @@ omitting the pattern:
 Changing `generic` to a specialized pattern later is a reviewed project
 migration because application files are project-owned; it is not an update.
 
-A Power Apps configuration contains only applicable fields:
+The `power-apps-code-app` workload and `codeAppsPlugin` configuration field are
+retired. They are rejected rather than ignored or converted to another workload.
 
-```json
-{
-  "projectName": "sales-hub",
-  "projectType": "power-apps-code-app",
-  "specWorkflow": "openspec",
-  "agents": ["github-copilot"],
-  "governanceProfile": "single-maintainer-gitflow",
-  "codeAppsPlugin": false
-}
+## Application runtime configuration
+
+These settings are separate from Liftoff desired state. Each backend resolves
+**process environment > selected local configuration file > nonsecret defaults**
+once per process. Restart after changing configuration; do not shell-source a
+file to make it work.
+
+| Backend | Default native file | Selected-file override |
+| --- | --- | --- |
+| Python/FastAPI, including GenAI | Project-root `.env`, resolved from `backend/config/settings.py`, not the working directory | `LIFTOFF_ENV_FILE` names a dotenv file |
+| Node.js/Fastify | Project-root `.env`, resolved from source or compiled configuration location | `LIFTOFF_ENV_FILE` names a dotenv file |
+| Go/Huma | `../runtime.config.json` when launched from `backend/` | `LIFTOFF_ENV_FILE` names a JSON object of string values |
+
+Override paths are relative to the startup working directory unless absolute.
+An explicitly selected missing, unreadable, or malformed file fails even when
+process values could otherwise satisfy startup. An absent default file is allowed
+when process values provide the required settings. All stacks need
+`DATABASE_URL` and `REDIS_URL`; model credentials are not required for operational
+endpoints.
+
+Python and Node validate dotenv assignments, balanced quotes, UTF-8, and NUL
+input before accepting a file. Use `KEY=value`, optional `export`, comments,
+and single- or double-quoted values. Node uses the runtime dotenv parser and
+rejects escaped quote delimiters that it would otherwise truncate; use the other
+quote style, for example `APP_NAME="Bob's API"`. Go uses `encoding/json`, not a
+dotenv dependency: numbers such as `PORT` must be quoted strings, and null or
+other non-string values are rejected.
+
+### Native development
+
+From the project root in a POSIX shell, prepare the documented local settings:
+
+```bash
+cp .env.example .env
+docker compose up -d postgres redis azurite mailpit
 ```
 
-API, cloud, region, frontend, and environment fields are rejected for this
-workload rather than silently ignored.
+Then run **only the selected backend** after its locked dependency preparation:
+
+| Backend | Native command |
+| --- | --- |
+| Python | `uv sync --frozen --project backend --extra test`, then `uv run --project backend uvicorn backend.apis.main:app --host 127.0.0.1 --port 8000` |
+| Node.js | `(cd backend && npm ci && npm run build && npm start)` |
+| Go | Copy `runtime.config.example.json` to `runtime.config.json`, then `(cd backend && go mod download && go run ./cmd/api)` |
+
+Worker-enabled Python projects add `--extra functions` to frozen synchronization.
+For a Python launch from `backend/`, use
+`uv run uvicorn --app-dir .. backend.apis.main:app --port 8000`; it still reads
+root `.env` without exporting the file's values. PowerShell users can use
+`Copy-Item` and `Set-Location` rather than the POSIX parenthesized commands.
+An explicit selector from `backend/` is `$env:LIFTOFF_ENV_FILE = '..\.env'`
+for Python/Node, or `'..\runtime.config.json'` for Go.
+
+Migration tools use the same resolved settings: Python Alembic, Node Drizzle,
+and Go's `make migrate` wrapper around the existing pinned Goose tool. Running
+migrations is a separate database mutation, not part of the startup probes.
+
+### Compose and integration boundaries
+
+Compose reads root `.env` for interpolation. Select a different dotenv file with
+`docker compose --env-file environments/<env>/backend.env up --build`, using an
+actually selected environment. Process values take precedence. Compose deliberately
+keeps PostgreSQL, Redis, and blob addresses container-reachable while forwarding
+the applicable model, messaging, CORS, and tracing settings.
+
+`/health` and `/ready` are local process/configuration endpoints, not dependency
+connectivity or production-readiness proofs. They make no model/provider request.
+Backend containers listen on 8000; the frontend container serves static files on
+80, mapped to 5173 by Compose.
+
+For GenAI:
+
+- `PYDANTIC_AI_MODEL` supports the locked `openai:`, `openai-chat:`, and
+  `openai-responses:` providers with `OPENAI_API_KEY` and optional
+  `OPENAI_BASE_URL`. Other providers need reviewed dependency/configuration work.
+- Redis Streams publishes to `REDIS_STREAM_NAME` using `REDIS_URL`.
+- `SERVICE_BUS_AUTH_MODE=managed-identity` requires
+  `SERVICE_BUS_FULLY_QUALIFIED_NAMESPACE`, `SERVICE_BUS_QUEUE_NAME`, and
+  `AZURE_CLIENT_ID`. `connection-string` requires the queue and
+  `SERVICE_BUS_CONNECTION_STRING`. Missing sender settings cannot report queued
+  ingestion.
+- Both Langfuse keys blank means tracing is disabled; configuring exactly one
+  of `LANGFUSE_PUBLIC_KEY` and `LANGFUSE_SECRET_KEY` is an error.
+  `LANGFUSE_HOST` is optional.
+
+Keep local secrets out of source control and build contexts. Root/frontend
+`.dockerignore` files exclude host dependencies, caches, outputs, VCS metadata,
+state, and secrets; the Function publish context also has `.funcignore`.
+These runtime files remain project-owned, not managed update targets.
 
 ## `liftoff.manifest.json`: CLI-owned compatibility record
 
@@ -71,8 +146,6 @@ workload:
 
 - `genai`: API stack, pattern, cloud, region, frontend, and environments.
 - `standard`: API stack, cloud, region, frontend, and environments.
-- `power-apps-code-app`: immutable starter repository, template path, commit,
-  and Code Apps plugin preference.
 
 The manifest also records:
 
@@ -85,12 +158,14 @@ The manifest also records:
   authorize update writes.
 - OS-neutral path-part arrays.
 - Repository governance profile, policy version 6, activation-contract version
-  1, graph/state/evidence/approval/supersession/credential schema versions, the
+  2, state/evidence-header/approval schema versions 2,
+  graph/supersession/credential schema versions 1, the
   exact phase-graph hash, and local `handoff-generated`, `handoff-partial`, or
   disabled state.
 
-Power Apps source identity uses explicit repository, path, and 40-character
-commit fields. It is not inferred from mutable URLs or generated file paths.
+An existing Power Apps manifest is rejected at its retired workload boundary
+before starter metadata or artifact paths are interpreted. Its original files
+remain unchanged.
 
 Treat the manifest as CLI-owned. Restore it from version control or regenerate
 with the matching Liftoff version when validation reports malformed identity,
@@ -98,19 +173,20 @@ paths, or hashes.
 
 ## Compatibility
 
-Readers support artifact versions v2, v3, v4, v5, v6, and v7:
+Readers support artifact versions v2, v3, v4, v5, v6, and v7 for API/GenAI projects:
 
 - V2 normalizes the legacy flat API identity and records framework state as
   uncertain without inventing agents.
 - V3 normalizes flat GenAI or API identity plus framework and agent metadata.
-- V4 represents the discriminated workload model, including Power Apps.
+- V4 introduces the discriminated workload model. Its formerly supported Power
+  Apps variant is now retired.
 - V5 adds repository-governance handoff identity without claiming live
   enforcement.
 - V6 separates managed-core update authority from project generation
   provenance.
-- V7 adds deterministic setup identity: manifest artifact version 7, policy
-  version 6, activation-contract version 1, schema-v1 activation artifacts, and
-  the canonical phase-graph hash. Governance-disabled v7 manifests use the
+- V7 adds deterministic setup identity. Current output uses
+  manifest artifact version 7, policy version 6, activation-contract version 2, and the canonical
+  phase-graph hash. Governance-disabled v7 manifests use the
   disabled variant and do not fabricate activation identity.
 
 Enabled governance manifests retain their recorded positive-integer policy
@@ -123,18 +199,37 @@ rewrite.
 `liftoff update --check`, including `--check --json`, leaves an old manifest
 byte-for-byte unchanged. A successful plain update writes v7 only after the
 transaction succeeds. V2-v6 backend, frontend, database, dependency, container,
-environment, documentation, Power Apps, and infrastructure entries become
+environment, documentation, and infrastructure entries become
 project provenance without reading or changing current production bytes.
 Intentionally deleted files remain absent. Only exact current core logical names
 retain write authority.
 
 The compatibility map is explicit; Liftoff does not use numeric less-than
-comparisons to infer safety. Supported v7 identity resumes when policy 6,
-activation contract 1, schema versions 1, and a recognized graph hash match.
-Future identities, individually known versions in unsupported combinations,
-unversioned ad hoc governance state, and unknown graph hashes block with an
-upgrade, import-mapping, or reconciliation remedy. No reader converts prose,
-filenames, or checked tasks into evidence.
+comparisons to infer execution safety.
+
+| Contract | Current version |
+| --- | --- |
+| CLI package version | 0.11.1 |
+| Activation package identity | 0.11.0 |
+| Manifest write / supported reads | 7 / 2-7 for API and GenAI |
+| Normative policy | 6 |
+| Activation contract, state, evidence header, approval envelope, compatibility metadata | 2 |
+| Phase graph, supersession, credential policy | 1 |
+| Assessment report and control catalog | 1 |
+
+The 0.11.1 CLI patch retains the 0.11.0 activation identity because its phase
+semantics and graph are unchanged. Independent infrastructure provenance
+explicitly recognizes both generation versions; unknown releases are not
+automatically trusted or treated as compatible.
+
+Known activation-v1 history remains readable but **diagnostic-only**, not
+executable proof. Managed-core maintenance can continue without rewriting user-owned
+historical identity, state, or receipts. A readable historical manifest cannot
+bootstrap current activation or authorize provider scope, even when no state
+file exists or a separate current state is supplied. No automatic conversion, reset, or public
+historical reconciliation workflow is provided. Future/mixed tuples, ad hoc
+state, and unknown graph hashes remain blocked. No reader converts prose,
+filenames, checked tasks, or old placeholder digests into current evidence.
 
 ## Artifact ownership
 
@@ -149,6 +244,11 @@ category or filename:
 | `framework` | Official framework | Validated through framework markers and maintained by that framework |
 | `seed` | Developer/project | Written once and never reconciled |
 
+New Spec Kit projects explicitly seed
+`specs/000-liftoff-bootstrap/{spec.md,plan.md,tasks.md}`. These are not framework
+templates or managed-core files. Missing older bundles are an adoption blocker,
+not permission for update or force to create them.
+
 The manifest is a CLI-owned transaction record rather than an ordinary
 template artifact. Current managed core is limited to the exact repository
 governance policy, context, guide, phase graph, compatibility metadata,
@@ -174,7 +274,12 @@ those files, but it does not advance, reset, or delete a phase.
 ## Contract conventions
 
 - Writers use `artifactVersion` 7; readers support v2, v3, v4, v5, v6, and v7.
-- Artifact logical names and catalog identifiers are append-only.
+- Artifact logical names and catalog identifiers are append-only except for
+  explicitly reviewed retirements. In 0.11.0, the eight
+  [flat-root OpenTofu identities](azure-deployment.md#explicit-flat-root-identity-retirement)
+  are retired from **new scaffold output only**. Their historical paths,
+  identities, and generation hashes remain provenance, not aliases or deletion
+  authority. Retained tfvars IDs alone do not establish the independent layout.
 - Rendering is deterministic and does not depend on timestamps, host versions,
   or network state.
 - `.liftoff/governance/` contains managed setup definitions; `governance/`

package/docs/existing-repositories.md

@@ -102,12 +102,15 @@ while unrecorded conflicts remain user-owned. No update mode runs an agent or
 activates GitHub settings.
 
 Projects carrying governance policy versions 2 through 5 preview policy version
-6, manifest v7, and activation-contract v1 as managed-core drift. Review the
+6, manifest v7, and activation-contract v2 as managed-core drift. Review the
 canonical phase graph, private-runner credential contract, bootstrap-state
 retention/disposal contract, and active-change reconciliation before
 replacement. Updating the handoff never provisions Azure or GitHub resources;
-any active downstream governance change must acknowledge the supported
-activation identity and exact graph hash before applying infrastructure.
+active downstream work must have supported identity and current evidence before
+it can execute. The CLI provides no public identity-acknowledgment or historical
+reconciliation workflow.
+Historical activation-v1 state and receipts are diagnostic-only, not
+automatically migrated or made executable by updating core files.
 
 The manifest-v7 transition releases every legacy non-core artifact into project
 provenance without writing, restoring, moving, or deleting its path.
@@ -118,7 +121,16 @@ Supported readers normalize manifest v2-v6 and write only v7 after all
 preflights pass. Future versions, unsupported policy/contract/schema tuples,
 unknown graph hashes, unversioned activation state, or prose-only task history
 block with explicit upgrade, import-mapping, or reconciliation remedies. Liftoff
-never fabricates evidence from old checkboxes.
+never fabricates evidence from old checkboxes. A diagnostic is not a command to
+hand-write mappings, retag receipts, or manufacture missing history.
+
+The new infrastructure layout uses shared application modules and independent
+environment roots. Its eight [retired flat-root identities](azure-deployment.md#explicit-flat-root-identity-retirement)
+remain readable as historical provenance, not aliases for new paths. Existing
+files, state, and generation hashes remain untouched. Adding an environment
+requires recorded independent-root provenance and safe existing module files;
+legacy or unknown layouts need separately reviewed migration. Core context
+updates cannot claim that this migration happened.
 
 Major supported-stack releases apply to new scaffolds. Existing projects adopt
 runtime, lock, Docker, provider, framework, and application changes through a
@@ -146,5 +158,20 @@ framework pipeline, including separate global OpenSpec profile authorization,
 and leaves the source byte-for-byte unchanged. `--force` does not permit a
 non-empty migration target.
 
-Arbitrary existing Power Apps application migration is not currently
-supported.
+The scan reads dependency declarations rather than comments or example text.
+Python setup/test configuration and non-workflow `.github` files remain
+explicit inventory items; dynamic or malformed declarations produce review
+diagnostics rather than invented stack defaults. Source configuration code is
+never executed to discover dependencies.
+
+Explicit workload, API-stack, and frontend choices control the target mapping.
+For example, Go source selected for a Node target receives porting instructions,
+not Go-only destination paths; a declined frontend remains a placement decision.
+
+Complete the mapped work and run the backend tests, `liftoff validate`, and
+`liftoff doctor` before deleting `migration/legacy/`. OpenSpec archival follows
+the completed change; a Spec Kit migration checklist is finalized locally
+without an invented archive command.
+
+Power Apps creation, maintenance, and migration are retired. Existing Power Apps
+manifests are rejected without modifying or converting their application files.

package/docs/getting-started.md

@@ -1,18 +1,19 @@
 # Getting started
 
-Liftoff is an interactive project initializer for governed GenAI applications,
-standard APIs, and Power Apps code apps.
+Liftoff is an interactive project initializer for governed GenAI applications
+and standard APIs.
 
 ## 1. Install the CLI
 
-Liftoff and generated Node.js workloads require Node.js 24.20 or newer.
-Python workloads use Python 3.14 with frozen `uv` dependency locks.
+Workstation readiness requires stable Node.js 24 LTS at 24.20.0 or newer within
+that line, plus npm 12.x at 12.0.2 or newer when selected tools need it.
+Python workloads use Python 3.14.x with frozen `uv` dependency locks.
 
 The canonical release registry is `https://registry.npmjs.org`:
 
 ```bash
-npm view @msn-control/liftoff@latest version --registry=https://registry.npmjs.org
-npm install -g @msn-control/liftoff@latest --registry=https://registry.npmjs.org
+npm view @msn-control/liftoff@latest version --registry=https://registry.npmjs.org --@msn-control:registry=https://registry.npmjs.org
+npm install -g @msn-control/liftoff@latest
 liftoff --version
 ```
 
@@ -22,6 +23,10 @@ If your organization requires a managed npm registry, query
 canonical npm. Stop if the mirror is older or rejects the explicit current
 version; ask the mirror owner to synchronize or approve the release. Liftoff
 does not modify `.npmrc` or bypass registry policy.
+The read-only canonical query isolates both default and scoped registry
+overrides. Installation intentionally honors the configured
+`@msn-control:registry` before the default registry; do not force a canonical
+download around an organization's delivery policy.
 
 Versions predating the self-upgrade command require that manual global install
 once. After a capable version is installed globally with npm, use:
@@ -50,7 +55,7 @@ cd my-project
 
 The guided flow asks for:
 
-1. Project identity and workload: GenAI, API, or Power Apps code app.
+1. Project identity and workload: GenAI or API.
 2. Only the architecture choices applicable to that workload.
    For GenAI, **I'm not sure yet - Generic GenAI starter** is the safe default
    when no specialization has been selected.
@@ -62,8 +67,7 @@ The guided flow asks for:
 6. Whether to configure the default-off GitHub-hosted Copilot coding agent when
    OpenSpec and GitHub Copilot are selected.
 7. A Spec Kit default agent when both agents are selected.
-8. The optional Preview Code Apps plugin preference for Power Apps projects.
-9. Plan confirmation, workstation readiness, and any separate install or
+8. Plan confirmation, workstation readiness, and any separate install or
    overwrite permissions that are needed.
 
 Liftoff renders into temporary staging, runs the official framework initializer
@@ -74,12 +78,12 @@ and asks separately before staging.
 
 When governance is enabled, `/liftoff-setup` is the next selected-agent action.
 It has no model-selection requirement: safety comes from the Liftoff CLI phase
-graph, local evidence, approval envelopes, and readback. Setup first completes,
-syncs, and archives the generated `bootstrap-<project>` seed. Only then does it
-reach explicit authority gates for repository commit/push, credentials, billed
-infrastructure or policy exceptions, final enforcement, destructive cleanup, and
-external blockers. Commit and push are never implicit in `liftoff init`, `--yes`,
-or read-only checks.
+graph, local evidence, approval envelopes, and readback. OpenSpec setup completes,
+syncs, and archives `bootstrap-<project>`; Spec Kit validates and finalizes
+`specs/000-liftoff-bootstrap/` locally. Neither workflow invents completed product
+work. Missing approval-persistence, credential-enrollment, and production phase
+executors remain specific blockers. Commit and push are never implicit in
+`liftoff init`, `--yes`, or read-only checks.
 
 For deterministic generic generation, use `--type genai --pattern generic`.
 
@@ -97,26 +101,35 @@ non-empty target.
 
 ## 4. Local baseline setup verifies
 
-`/liftoff-setup` runs only local, project-applicable baseline checks before it
-archives the seed:
+`/liftoff-setup` runs only local, project-applicable baseline checks before
+archiving the OpenSpec seed or finalizing the Spec Kit bundle. Commands run in
+their declared component directories, not all from an arbitrary working directory:
 
 ```bash
 liftoff validate
 # backend tests from the generated README when a backend exists
 # frontend build from the generated README when a frontend exists
 docker compose config -q
+# From infrastructure/opentofu/azure/:
 tofu fmt -check -recursive
+# Within each selected environments/<environment>/ infrastructure root:
 tofu init -backend=false
 tofu validate
-openspec validate --strict
+# OpenSpec only, from the project root (replace the generated change name):
+openspec validate bootstrap-my-project --strict
 ```
 
-Absent components are inapplicable: a Power Apps project does not fabricate
-backend, Docker, or OpenTofu success, and an API project without a frontend skips
-frontend build evidence. The baseline does not run `tofu plan`, `tofu apply`,
+Absent optional components are inapplicable: an API project without a frontend
+skips frontend build evidence. The baseline does not run `tofu plan`, `tofu apply`,
 start containers, deploy, mutate GitHub, or require cloud credentials. If a check
-fails, the seed remains active and `/liftoff-setup` resumes idempotently after
-you fix the blocker; verified phases are not repeated.
+fails, the seed remains unfinished. After repair, explicit execution can retry
+the local baseline; read-only `resume` does not run it. Current unchanged proof
+can be reused, while changed inputs require new evidence.
+Dependencies must already be usable, or separately installed with explicit
+consent; passing a baseline does not prove that installation or consent happened.
+Spec Kit's B001–B006 projection is finalized only after its checks pass.
+Legacy/shared or unknown infrastructure layouts block baseline execution with a
+migration-required result rather than omitting those checks.
 
 You can run read-only maintenance at any time:
 
@@ -132,14 +145,14 @@ liftoff governance verify --json
 adds read-only workstation, runtime, authentication, dependency,
 workload-specific, and governance-state diagnostics.
 
-After setup archives the seed and you explicitly approve repository publication,
-normal development follows your selected workflow:
+After the local bootstrap handoff, normal development follows your selected
+workflow. Repository publication and production activation remain separate:
 
 - GenAI and API projects: copy `.env.example` to `.env`, install the generated
   stack dependencies, then use `liftoff dev` and `liftoff infra` to print local
-  development and infrastructure commands.
-- Power Apps projects: run `npm ci`, then `npm run dev`. Environment binding,
-  connector addition, and `power-apps push` are deliberately deferred.
+  development and infrastructure commands. Native Go also copies
+  `runtime.config.example.json` to `runtime.config.json`; see the
+  [stack-specific configuration recipes](configuration-and-manifests.md#application-runtime-configuration).
 - OpenSpec or Spec Kit changes drive normal feature work; release and hotfix
   flows follow the governed GitFlow plan after activation evidence is green.
 
@@ -151,7 +164,7 @@ Use `liftoff plan` to resolve choices and preview requirements without writing
 files or running installers:
 
 ```bash
-liftoff plan --type power-apps-code-app --spec openspec --agents copilot
+liftoff plan --type standard --api node --spec openspec --agents copilot
 ```
 
 Automation can pass the same options to `liftoff init`. Use `--yes` for project
@@ -176,5 +189,5 @@ source remains byte-for-byte unchanged.
 liftoff migrate ../legacy-app --region eastus --agents copilot,claude --yes
 ```
 
-Power Apps migration from an arbitrary existing application is not part of the
-current workload contract.
+Power Apps support is retired, including existing-project maintenance. Retired
+inputs are rejected without converting or deleting the original application.

package/docs/prerequisites.md

@@ -1,18 +1,26 @@
 # Prerequisites
 
 Liftoff derives workstation and project requirements from the complete resolved
-plan. A Power Apps project is not asked to install API or infrastructure tools,
-and a Go API is not asked to install Python.
+plan. A Go API does not inherit Python backend dependencies, although a selected
+framework such as Spec Kit can require Python for its own tooling.
 
 ## Baseline
 
-- Liftoff CLI and generated Node.js workloads: Node.js 24.20 or newer.
-- Python projects: Python 3.14 and `uv` 0.12.7 or newer.
-- Go projects: Go 1.27 or newer.
-- Generated Azure infrastructure: OpenTofu 1.12.6 or newer.
+- Workstation Node.js: stable Node.js 24 LTS, version 24.20.0 or newer within 24.x.
+- npm-dependent stacks or OpenSpec: stable npm 12.x, version 12.0.2 or newer.
+- Python projects: stable Python 3.14.x and `uv` 0.12.x at version 0.12.7 or newer.
+- Go projects: stable Go 1.27.x.
+- Generated Azure infrastructure: stable OpenTofu 1.12.x at version 1.12.6 or newer.
 - Selected framework: OpenSpec 1.11.0 or Spec Kit 1.0.1 exactly.
 - Selected agents: GitHub Copilot, Claude Code, or both.
 
+Minimum versions do not authorize a different, untested release line. Release
+candidates and other prereleases do not satisfy stable floors or exact framework
+pins. A working Node.js executable does not establish npm readiness: when npm is
+required, it is probed separately before destination writes. A missing npm
+executable requires a separately reviewed machine-level repair; Liftoff does not
+try to run the missing executable or reinstall Node.js on its behalf.
+
 Automatic `liftoff upgrade` additionally requires that the running canonical
 `@msn-control/liftoff` package is a normal global npm installation beneath
 `npm root --global`. Local dependencies, `npx` cache copies, linked checkouts,
@@ -27,6 +35,8 @@ runtime. GenAI uses Python 3.14 and the Python/FastAPI/PydanticAI stack.
 Blocking checks must be ready before initialization can safely complete:
 
 - Required runtime and minimum version.
+- Required package managers, including npm for Node.js dependencies, a frontend,
+  or OpenSpec.
 - Selected spec framework CLI.
 - Every selected coding agent.
 - For OpenSpec, global profile `custom`, delivery `both`, and all 12 workflows.
@@ -36,7 +46,6 @@ Advisory checks describe useful but deferrable capabilities:
 - Docker CLI and daemon health for API workloads.
 - OpenTofu for generated Azure infrastructure.
 - Azure CLI and observable authentication health.
-- Optional Code Apps plugin state for Power Apps.
 
 Authentication checks are read-only. Liftoff never stores credentials or signs
 in to a cloud or agent on your behalf.
@@ -63,7 +72,7 @@ can register each missing namespace explicitly before dependent resources.
 without writing files or running installers:
 
 ```bash
-liftoff plan --type power-apps-code-app --spec openspec --agents copilot,claude
+liftoff plan --type standard --api node --spec openspec --agents copilot,claude
 ```
 
 ## Tool installation consent
@@ -103,19 +112,22 @@ Project-local dependency setup is separate from workstation tools and requires
 `--install-dependencies` or interactive approval after a successful project
 merge.
 
-For Power Apps, Liftoff runs only the root locked install:
-
-```bash
-npm ci
-```
-
-The generated `package.json` and `package-lock.json` are validated before
-installation and protected from installer mutation. If dependency setup is
-skipped or fails, Liftoff prints the exact resume command rather than claiming
-the project is ready.
-
 GenAI and API projects use their generated stack-native locked dependency
-commands.
+commands. If dependency setup is skipped or fails, Liftoff prints the exact
+resume command rather than claiming the project is ready.
+
+Recovery output identifies its shell: POSIX shell on macOS/Linux and PowerShell
+on Windows. Copy the command into that shell; directory names and arguments are
+quoted literally rather than expanded as environment variables.
+
+If protected metadata changes during dependency setup, Liftoff stops and lists
+the changed paths. It preserves those edits instead of assuming the installer
+caused them and restoring older bytes over concurrent work. Review and repair
+the metadata before retrying. Dependency scripts can also change other project
+files; this check is not a script sandbox.
+Dependencies that are already installed and usable do not need a new install
+merely to satisfy a bootstrap checkbox. Local checks prove usability, not that
+an installation or its consent occurred.
 
 Python projects use the generated lock without resolving new versions:
 
@@ -130,24 +142,11 @@ Liftoff's npm locks are generated with npm 12.0.2 and verified in the supported
 compatibility lanes. Do not replace a committed lock with an install from
 open-ended manifest ranges.
 
-## Power Apps local CLI
-
-The Power Apps CLI is supplied by the generated project dependency graph.
-Liftoff checks it without downloading another package:
-
-```bash
-npx --no-install power-apps --version
-```
-
-If `node_modules` is absent, run `npm ci` first. Environment binding and cloud
-authentication remain separate later actions.
-
 ## Agent detection
 
 Copilot can be detected through its CLI or supported VS Code extensions.
 Claude Code is checked with its version and doctor commands. When both are
 selected, both must be ready.
 
-The optional Code Apps plugin uses independent, read-only probes for each
-selected agent. A missing executable, timeout, or unsupported plugin-list
-result is reported as not observable rather than silently treated as missing.
+Power Apps and Code Apps plugin preparation are retired. Their inputs are
+rejected before selecting or installing a former workload-specific tool set.