@msn-control/liftoff 0.10.4 → 0.11.2

package/dist/governance-activation/commands.js

@@ -1,23 +1,33 @@
 import { access, readdir } from 'node:fs/promises';
 import path from 'node:path';
-import { readBooleanFlag, readStringFlag } from '../args.js';
-import { findProjectRoot, loadManifest, readProjectFile, resolveProjectPath, validateArtifactPathParts } from '../file-system.js';
+import { readBooleanFlag, readStringFlag } from '../cli/args/readers.js';
+import { findProjectRoot } from '../adapters/filesystem/project-discovery.js';
+import { loadManifest } from '../application/project/manifest.js';
+import { formatUpdateCommand } from '../application/update/command-guidance.js';
+import { readProjectFile } from '../adapters/filesystem/project-files.js';
+import { resolveProjectPath } from '../adapters/filesystem/project-paths.js';
+import { validateArtifactPathParts } from '../domain/project/paths.js';
 import { governanceArtifactPaths, validateGovernancePolicy } from '../repository-governance.js';
 import { governanceAssessmentCommand } from '../governance-assessment/command.js';
 import { loadActivationState } from './activation-state.js';
-import { canonicalSha256 } from './canonical-json.js';
-import { canonicalApprovalEnvelopeHash, evaluateApprovalForTransitionPlan, transitionPlanForPhase } from './approvals.js';
+import { canonicalSha256 } from '../domain/governance/activation/canonical-json.js';
+import { canonicalApprovalEnvelopeHash, evaluateApprovalForTransitionPlan, transitionPlanForPhase } from '../domain/governance/activation/approvals.js';
 import { buildPatEnrollmentGuidance, canonicalCredentialRepository, credentialPolicyPathParts, detectCredentialLeaks, runnerPreflightPermissions, validateCredentialPolicyUsage } from './credentials.js';
-import { evidenceContextForPhase, requiredLiveReadbackProviders, selectLatestPhaseEvidence } from './evidence.js';
-import { canonicalPhaseGraph, canonicalPhaseGraphHash, currentActivationIdentity, phaseContractDigests } from './graph.js';
-import { governanceActivationPolicyVersion } from './identity.js';
-import { calculatePhaseReadiness } from './readiness.js';
+import { selectLatestPhaseEvidence } from '../domain/governance/activation/evidence.js';
+import { canonicalPhaseGraph, canonicalPhaseGraphHash, currentActivationIdentity } from '../domain/governance/activation/graph.js';
+import { governanceActivationPolicyVersion } from '../domain/governance/policy/identity.js';
+import { calculatePhaseReadiness } from '../domain/governance/activation/readiness.js';
 import { projectOpenSpecTaskCheckboxes } from './task-projection.js';
 import { inspectGovernanceSourceOfTruth } from './source-of-truth.js';
-import { discoverGeneratedSeed, inspectArchivedSeedIntegrity } from './seed-lifecycle.js';
+import { discoverGeneratedSeed, inspectArchivedSeedIntegrity, seedInfrastructureBaselineBlocker } from './seed-lifecycle.js';
 import { executeApplyNext, previewApplyNext } from './transitions.js';
-import { phaseIds } from './types.js';
-import { validateApprovalEnvelope, validateEvidenceHeader, validateLiveReadbackProof, validateManagedPhaseGraph, validateCredentialPolicy } from './validators.js';
+import { phaseIds } from '../domain/governance/activation/types.js';
+import { activationEvidenceContexts, readActivationInputSnapshot } from './inputs.js';
+import { phaseCapabilities } from '../domain/governance/activation/capabilities.js';
+import { readActivationEvidence, readReviewedTransitionPlans } from './read-only.js';
+import { inspectActivationMigrationHistory } from './migration-history.js';
+import { migrationRevalidationPhaseIds } from './history-contracts.js';
+import { validateApprovalEnvelope, validateManagedPhaseGraph, validateCredentialPolicy, validateManifestActivationForExecution } from '../domain/governance/activation/validators.js';
 const governanceSubcommands = new Set([
     'status',
     'plan',
@@ -27,7 +37,6 @@ const governanceSubcommands = new Set([
 ]);
 const managedPhaseGraphPathParts = ['.liftoff', 'governance', 'phase-graph.json'];
 const approvalDirectoryPathParts = ['governance', 'approvals'];
-const evidenceDirectoryPathParts = ['governance', 'evidence'];
 const terminalEvidenceStates = new Set([
     'verified',
     'failed',
@@ -100,15 +109,15 @@ function notStartedState(manifest) {
         schemaVersion: currentActivationIdentity.activationStateSchemaVersion,
         identity: currentActivationIdentity,
         repository: {
-            id: `local:${manifest.project.name}`,
+            id: 'unbound',
             name: manifest.project.name,
             defaultBranch: 'develop'
         },
         activeChange: null,
         applicability: {
             statePath: 'none',
-            privateStagingDast: false,
-            credentialRequired: false
+            privateStagingDast: 'unknown',
+            credentialRequired: 'unknown'
         },
         phases: emptyPhaseState(now),
         createdAt: now,
@@ -180,63 +189,8 @@ async function loadApprovals(projectRoot, identity) {
         }
     });
 }
-function asRecord(value, pathLabel) {
-    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
-        throw new Error(`${pathLabel} must be a JSON object.`);
-    }
-    return value;
-}
-function validateEvidenceRecord(value, evidenceId, pathLabel) {
-    const record = asRecord(value, pathLabel);
-    if (Object.hasOwn(record, 'header')) {
-        const allowed = new Set(['evidenceId', 'header', 'liveReadback', 'payload']);
-        for (const key of Object.keys(record)) {
-            if (!allowed.has(key)) {
-                throw new Error(`${pathLabel}.${key} is not allowed.`);
-            }
-        }
-        if (typeof record.evidenceId !== 'string' || record.evidenceId.length === 0) {
-            throw new Error(`${pathLabel}.evidenceId must be a non-empty string.`);
-        }
-        const liveReadback = record.liveReadback === undefined
-            ? undefined
-            : validateLiveReadbackArray(record.liveReadback, `${pathLabel}.liveReadback`);
-        return {
-            evidenceId: record.evidenceId,
-            header: validateEvidenceHeader(record.header),
-            ...(liveReadback ? { liveReadback } : {}),
-            ...(Object.hasOwn(record, 'payload') ? { payload: record.payload } : {})
-        };
-    }
-    return {
-        evidenceId,
-        header: validateEvidenceHeader(value)
-    };
-}
-function validateLiveReadbackArray(value, pathLabel) {
-    if (!Array.isArray(value)) {
-        throw new Error(`${pathLabel} must be an array.`);
-    }
-    return value.map((entry, index) => {
-        try {
-            return validateLiveReadbackProof(entry);
-        }
-        catch (error) {
-            throw new Error(`${pathLabel}[${index}]: ${errorMessage(error)}`);
-        }
-    });
-}
 async function loadEvidence(projectRoot) {
-    const entries = await readJsonFiles(projectRoot, evidenceDirectoryPathParts, 'Evidence');
-    return entries.map((entry) => {
-        try {
-            const evidenceId = entry.name.replace(/\.json$/u, '');
-            return validateEvidenceRecord(entry.value, evidenceId, `${evidenceDirectoryPathParts.join('/')}/${entry.name}`);
-        }
-        catch (error) {
-            throw new Error(`Invalid ${evidenceDirectoryPathParts.join('/')}/${entry.name}: ${errorMessage(error)}`);
-        }
-    });
+    return readActivationEvidence(projectRoot);
 }
 function repositoryFromState(state) {
     const repositoryName = state.repository.name.includes('/')
@@ -253,7 +207,11 @@ function repositoryFromState(state) {
 }
 async function inspectCredentialPolicy(projectRoot, state) {
     const pathLabel = credentialPolicyPathParts.join('/');
-    if (!state.applicability.credentialRequired) {
+    if (state.applicability.credentialRequired === 'unknown') {
+        return { applicable: true, readOnly: true, path: pathLabel, status: 'not-ready', ready: false,
+            guidance: null, policy: null, issues: ['Credential applicability is unknown; independent discovery and a supported enrollment/readback capability are required.'] };
+    }
+    if (state.applicability.credentialRequired === false) {
         return {
             applicable: false,
             readOnly: true,
@@ -277,7 +235,7 @@ async function inspectCredentialPolicy(projectRoot, state) {
             ready: false,
             guidance,
             policy: null,
-            issues: [`${pathLabel} is missing; deterministic PAT enrollment is required if no selected-repository App is available.`]
+            issues: [`${pathLabel} is missing. Public credential enrollment and independent credential readback are unavailable; do not hand-create credential proof or supply a token through setup.`]
         };
     }
     const text = bytes.toString('utf8');
@@ -324,10 +282,10 @@ async function inspectCredentialPolicy(projectRoot, state) {
             readOnly: true,
             path: pathLabel,
             status: usage.ready ? 'valid' : 'not-ready',
-            ready: usage.ready,
-            guidance: usage.ready ? null : guidance,
+            ready: false,
+            guidance: null,
             policy,
-            issues: usage.issues
+            issues: [...usage.issues, 'Independent credential readback and public credential enrollment are unavailable; a policy file alone is not proof.']
         };
     }
     catch (error) {
@@ -346,22 +304,6 @@ async function inspectCredentialPolicy(projectRoot, state) {
 function phaseMap(graph) {
     return Object.fromEntries(graph.phases.map((phase) => [phase.id, phase]));
 }
-function buildEvidenceContexts(graph, state, now) {
-    const digests = phaseContractDigests(graph);
-    return Object.fromEntries(graph.phases.map((phase) => {
-        const context = evidenceContextForPhase(phase.id, {
-            repositoryId: state.repository.id,
-            identity: state.identity,
-            phaseGraphHash: state.identity.phaseGraphHash,
-            now,
-            liveReadbackProviders: requiredLiveReadbackProviders(phase)
-        });
-        return [phase.id, {
-                ...context,
-                phaseContractDigest: digests[phase.id]
-            }];
-    }));
-}
 function freshnessEntry(phase, selection) {
     return {
         phaseId: phase.id,
@@ -380,11 +322,13 @@ function buildEvidenceFreshness(graph, evidence, contexts) {
         return [phase.id, freshnessEntry(phase, selection)];
     }));
 }
-async function inspectGovernance(projectRoot) {
+async function inspectGovernance(projectRoot, runner, now = new Date()) {
     const manifest = await loadManifest(projectRoot);
+    validateManifestActivationForExecution(manifest);
     const graph = await loadGovernanceGraph(projectRoot);
     await assertPolicyIdentity(projectRoot, manifest);
     const loadedState = await loadActivationState(projectRoot);
+    const migration = await inspectActivationMigrationHistory(projectRoot);
     const state = loadedState?.state ?? notStartedState(manifest);
     if (state.identity.phaseGraphHash !== graph.hash) {
         throw new Error(`Activation state graph hash ${state.identity.phaseGraphHash} does not match loaded graph hash ${graph.hash}.`);
@@ -394,18 +338,22 @@ async function inspectGovernance(projectRoot) {
     }
     const approvals = await loadApprovals(projectRoot, state.identity);
     const evidence = await loadEvidence(projectRoot);
+    const snapshot = await readActivationInputSnapshot(projectRoot, manifest, runner);
+    const contexts = activationEvidenceContexts(graph.graph, state, snapshot, now);
+    const reviewedPlans = await readReviewedTransitionPlans(projectRoot);
+    for (const phase of phaseIds)
+        contexts[phase].reviewedPlans = reviewedPlans;
     const sourceOfTruth = await inspectGovernanceSourceOfTruth({
         projectRoot,
         manifest,
         state,
-        evidence
+        evidence,
+        contexts
     });
     const archivedSeedIntegrity = await inspectArchivedSeedIntegrity(projectRoot, manifest);
     const archivedBaselineBlocked = state.phases['seed-verified'].state === 'blocked' &&
         archivedSeedIntegrity.status === 'valid';
-    const seedDiscovery = sourceOfTruth.status === 'seed-blocked' || archivedBaselineBlocked
-        ? await discoverGeneratedSeed(projectRoot)
-        : undefined;
+    const seedDiscovery = await discoverGeneratedSeed(projectRoot);
     const retryArchivedSeedBaseline = archivedBaselineBlocked && seedDiscovery?.state === 'archived';
     const archiveAndLaterPhases = phaseIds.slice(phaseIds.indexOf('seed-archived'));
     const expectedActiveSeed = sourceOfTruth.status === 'seed-blocked' &&
@@ -414,10 +362,9 @@ async function inspectGovernance(projectRoot) {
         state.activeChange === null &&
         archiveAndLaterPhases.every((phaseId) => state.phases[phaseId].state === 'pending' || state.phases[phaseId].state === 'blocked') &&
         !evidence.some((record) => archiveAndLaterPhases.includes(record.header.phaseId));
-    const now = new Date();
     const credential = await inspectCredentialPolicy(projectRoot, state);
-    const contexts = buildEvidenceContexts(graph.graph, state, now);
     const evidenceFreshness = buildEvidenceFreshness(graph.graph, evidence, contexts);
+    const infrastructureBlocker = seedInfrastructureBaselineBlocker(manifest);
     const readiness = calculatePhaseReadiness({
         graph: graph.graph,
         state,
@@ -425,9 +372,13 @@ async function inspectGovernance(projectRoot) {
         evidence,
         transitionContexts: contexts,
         retryArchivedSeedBaseline,
-        phaseBlockers: archivedSeedIntegrity.status === 'invalid'
-            ? { 'seed-archived': archivedSeedIntegrity.issues }
-            : undefined,
+        phaseBlockers: {
+            ...Object.fromEntries(Object.entries(phaseCapabilities).filter(([, capability]) => capability.blocker)
+                .map(([id, capability]) => [id, [capability.blocker]])),
+            ...(archivedSeedIntegrity.status === 'invalid' ? { 'seed-archived': archivedSeedIntegrity.issues } : {}),
+            ...(seedDiscovery.state === 'blocked' ? { 'seed-valid': seedDiscovery.issues } : {}),
+            ...(infrastructureBlocker ? { 'seed-verified': [infrastructureBlocker] } : {})
+        },
         now
     });
     return {
@@ -446,7 +397,8 @@ async function inspectGovernance(projectRoot) {
         credential,
         archivedSeedIntegrity,
         retryArchivedSeedBaseline,
-        expectedActiveSeed
+        expectedActiveSeed,
+        migration: migration.status === 'committed' ? migration.journal : null
     };
 }
 async function assertPolicyIdentity(projectRoot, manifest) {
@@ -466,7 +418,7 @@ function approvalStatus(approval, now = new Date()) {
     return Date.parse(approval.expiresAt) > now.getTime() ? 'valid' : 'expired';
 }
 function approvalEvaluationForPhase(phase, inspection) {
-    const plan = transitionPlanForPhase(phase, inspection.state, inspection.contexts[phase.id].transition, inspection.projectRoot);
+    const plan = transitionPlanForPhase(phase, inspection.state, inspection.contexts[phase.id].transition, inspection.projectRoot, inspection.contexts[phase.id].publicationDestination);
     return evaluateApprovalForTransitionPlan(plan, inspection.approvals);
 }
 function approvalEvaluationJson(evaluation) {
@@ -480,6 +432,55 @@ function approvalEvaluationJson(evaluation) {
         expansionReasons: evaluation.expansionReasons
     };
 }
+function summarizeMigration(inspection) {
+    const journal = inspection.migration;
+    if (!journal)
+        return null;
+    const phases = migrationRevalidationPhaseIds.map((phaseId) => journal.revalidation.phases.find((phase) => phase.phaseId === phaseId));
+    const needsRevalidation = journal.revalidation.status !== 'complete' ||
+        migrationRevalidationPhaseIds.some((phaseId) => inspection.readiness.phases[phaseId].state !== 'verified');
+    const checkCommand = formatUpdateCommand(inspection.projectRoot, 'check');
+    return {
+        localCommit: journal.transaction,
+        snapshot: {
+            id: journal.snapshotId,
+            indexPathParts: journal.historyIndexPathParts,
+            indexDigest: journal.historyIndexDigest,
+            linkage: 'validated',
+            successor: journal.successor
+        },
+        revalidation: { ...journal.revalidation, phases },
+        nextRecordedPhase: phases.find((phase) => phase.status !== 'complete')?.phaseId ?? null,
+        currentProofRequired: true,
+        remedy: needsRevalidation
+            ? `Keep the committed v2 successor and preserved v1 history. Repair the named blockers or stale current proof, run ${checkCommand} for a fresh preview, then explicitly approve the exact remaining local plan before retrying. Prior migration approval does not authorize new work.`
+            : null
+    };
+}
+function renderMigrationHuman(summary, presentation) {
+    if (!summary)
+        return;
+    presentation.definitions('Migration progress (journal)', [
+        { label: 'Local migration', value: `${summary.localCommit.status} at ${summary.localCommit.committedAt}` },
+        { label: 'History snapshot', value: summary.snapshot.id },
+        { label: 'History index', value: summary.snapshot.indexPathParts.join('/') },
+        { label: 'History index digest', value: summary.snapshot.indexDigest },
+        { label: 'History linkage', value: `${summary.snapshot.linkage}; successor ${summary.snapshot.successor.repositoryId}` },
+        { label: 'Recorded revalidation', value: summary.revalidation.status },
+        { label: 'Next recorded phase', value: summary.nextRecordedPhase ?? 'none' }
+    ]);
+    presentation.table('Recorded local revalidation', ['Phase', 'Progress', 'Blockers'], summary.revalidation.phases.map((phase) => [
+        phase.phaseId,
+        phase.status,
+        phase.blockers.join('; ') || 'none recorded'
+    ]));
+    if (summary.revalidation.nextAction) {
+        presentation.status('pending', 'Recorded next action', summary.revalidation.nextAction);
+    }
+    presentation.status('info', 'Migration scope', 'Journal progress is audit information, not current proof, governance completion, approval, or provider authority. Current readiness is evaluated separately from v2 evidence.');
+    if (summary.remedy)
+        presentation.remedy(summary.remedy);
+}
 function statusJson(inspection, command) {
     const blockers = phaseIds.flatMap((phaseId) => inspection.readiness.phases[phaseId].blockers.map((message) => ({ phaseId, message })));
     return {
@@ -489,6 +490,10 @@ function statusJson(inspection, command) {
         readOnly: command !== 'apply-next',
         stateSource: inspection.stateSource,
         activationIdentity: inspection.state.identity,
+        migration: inspection.migration,
+        migrationSummary: summarizeMigration(inspection),
+        executionAnchor: inspection.state.repository.id === 'unbound' ? null : inspection.state.repository.id,
+        remoteBinding: inspection.state.remoteBinding ?? null,
         graphHash: inspection.graph.hash,
         graph: {
             source: inspection.graph.source,
@@ -504,7 +509,9 @@ function statusJson(inspection, command) {
             state: inspection.readiness.phases[phase.id].state,
             storedState: inspection.state.phases[phase.id].state,
             storedBlockers: inspection.state.phases[phase.id].blockers,
-            retryable: phase.id === 'seed-verified' && inspection.retryArchivedSeedBaseline,
+            retryable: phaseCapabilities[phase.id].retry === 'explicit-local' &&
+                ['failed', 'blocked'].includes(inspection.state.phases[phase.id].state),
+            capability: phaseCapabilities[phase.id],
             blockers: inspection.readiness.phases[phase.id].blockers,
             evidence: {
                 schema: phase.evidence.schema,
@@ -545,6 +552,7 @@ function renderStatusHuman(inspection, command) {
                 : inspection.sourceOfTruth.status
         }
     ]);
+    renderMigrationHuman(summarizeMigration(inspection), presentation);
     if (inspection.sourceOfTruth.status === 'seed-blocked') {
         presentation.status('error', 'Seed blocker', inspection.sourceOfTruth.blockers.join('; '));
     }
@@ -768,6 +776,16 @@ function validateReadinessCheck(inspection) {
     };
 }
 async function activeTaskProjectionCheck(inspection) {
+    if (inspection.manifest.project.specWorkflow === 'spec-kit') {
+        const bytes = await readProjectFile(inspection.projectRoot, ['specs', '000-liftoff-bootstrap', 'tasks.md']);
+        if (!bytes)
+            return { id: 'task-projection', status: 'failed', issues: ['Spec Kit seed-adoption-required: real bootstrap tasks are missing.'] };
+        const expected = inspection.readiness.phases['seed-verified'].state === 'verified';
+        const tasks = [...bytes.toString('utf8').matchAll(/^\s*- \[([ xX])\] (B00[1-6]) /gm)];
+        const issues = tasks.filter((match) => (match[1].toLowerCase() === 'x') !== expected)
+            .map((match) => `Spec Kit task ${match[2]} differs from the authoritative local baseline projection. Verification did not edit it.`);
+        return { id: 'task-projection', status: issues.length ? 'failed' : 'passed', issues };
+    }
     const activeChange = inspection.state.activeChange;
     if (!activeChange || activeChange.kind !== 'openspec') {
         return { id: 'task-projection', status: 'skipped', issues: [] };
@@ -835,6 +853,10 @@ function credentialPolicyCheck(inspection) {
     if (!inspection.credential.applicable) {
         return { id: 'credential-policy', status: 'skipped', issues: [] };
     }
+    if (inspection.state.applicability.credentialRequired === 'unknown' &&
+        !terminalEvidenceStates.has(inspection.state.phases['credential-ready'].state)) {
+        return { id: 'credential-policy', status: 'skipped', issues: inspection.credential.issues };
+    }
     return {
         id: 'credential-policy',
         status: inspection.credential.ready ? 'passed' : 'failed',
@@ -972,6 +994,8 @@ async function verifyJson(inspection) {
         stateSource: inspection.stateSource,
         summary,
         activationIdentity: inspection.state.identity,
+        migration: inspection.migration,
+        migrationSummary: summarizeMigration(inspection),
         graphHash: inspection.graph.hash,
         activeChange: inspection.state.activeChange,
         activeSourceOfTruth: inspection.sourceOfTruth,
@@ -984,6 +1008,7 @@ async function renderVerifyHuman(inspection, presentation) {
     const checks = result.checks;
     presentation.commandIdentity('governance verify', 'Read-only activation verification');
     presentation.status(result.complete ? 'success' : result.consistent ? 'pending' : 'error', 'setup-completion', result.summary);
+    renderMigrationHuman(result.migrationSummary, presentation);
     for (const check of checks) {
         presentation.status(check.status === 'failed' ? 'error' : check.status === 'skipped' ? 'info' : 'success', check.id, check.issues[0]);
     }
@@ -1039,6 +1064,9 @@ function transitionInspection(inspection) {
         sourceOfTruth: inspection.sourceOfTruth
     };
 }
+export async function inspectGovernanceTransition(projectRoot, options = {}) {
+    return transitionInspection(await inspectGovernance(projectRoot, options.runner, options.now));
+}
 function renderApplyNextHuman(result, presentation) {
     presentation.commandIdentity('governance apply-next', 'Controlled activation transition');
     presentation.status(result.applied ? 'success' : result.authorized ? 'pending' : 'error', result.reason, result.message);
@@ -1102,7 +1130,7 @@ export async function governanceCommand(parsed, context) {
     }
     let inspection;
     try {
-        inspection = attachPresentation(await inspectGovernance(projectRoot), presentation);
+        inspection = attachPresentation(await inspectGovernance(projectRoot, context.runner), presentation);
     }
     catch (error) {
         if (subcommand === 'verify') {
@@ -1163,7 +1191,7 @@ export async function governanceCommand(parsed, context) {
         ? await executeApplyNext({
             inspection: transitionInput,
             runner: context.runner,
-            reinspect: async () => transitionInspection(attachPresentation(await inspectGovernance(projectRoot), presentation))
+            reinspect: async () => transitionInspection(attachPresentation(await inspectGovernance(projectRoot, context.runner), presentation))
         })
         : await previewApplyNext({
             inspection: transitionInput,