@msn-control/liftoff 0.10.4 → 0.11.2

package/dist/governance-activation/seed-lifecycle.js

@@ -1,8 +1,15 @@
-import { readdir, readFile } from 'node:fs/promises';
+import { lstat, readdir, readFile } from 'node:fs/promises';
 import { stripVTControlCharacters } from 'node:util';
-import { loadManifest, resolveProjectPath, writeProjectFile } from '../file-system.js';
-import { getPattern } from '../catalogs.js';
-import { toSafeProjectName } from '../planner.js';
+import { loadManifest } from '../application/project/manifest.js';
+import { readProjectFile, writeProjectFile } from '../adapters/filesystem/project-files.js';
+import { resolveProjectPath } from '../adapters/filesystem/project-paths.js';
+import { captureProjectFileSnapshot } from '../adapters/filesystem/project-transaction.js';
+import { withProjectMutationLock } from '../adapters/filesystem/project-lock.js';
+import { completedSpecKitTasks, inspectSpecKitBootstrap, specKitBootstrapId, specKitBootstrapPath } from './spec-kit-seed.js';
+import { canonicalSha256 } from '../domain/governance/activation/canonical-json.js';
+import { getPattern } from '../application/project/catalog.js';
+import { toSafeProjectName } from '../domain/project/planning.js';
+import { assessInfrastructureLayout } from '../domain/project/infrastructure-layout.js';
 import { formatCommand } from '../process-runner.js';
 import { detectCredentialLeaks } from './credentials.js';
 const seedChangePathParts = (changeName) => ['openspec', 'changes', changeName];
@@ -17,12 +24,11 @@ function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
 export function generatedSeedChangeName(manifest) {
+    if (manifest.project.specWorkflow === 'spec-kit')
+        return specKitBootstrapId;
     return `bootstrap-${toSafeProjectName(manifest.project.name)}`;
 }
 export function generatedSeedCapabilityId(workload) {
-    if (workload.kind === 'power-apps-code-app') {
-        return 'power-apps-code-app-baseline';
-    }
     if (workload.kind === 'standard') {
         return `${workload.apiStack}-application-baseline`;
     }
@@ -31,7 +37,16 @@ export function generatedSeedCapabilityId(workload) {
 function isWorkerWorkload(workload) {
     return workload.kind === 'genai' && getPattern(workload.pattern)?.worker === true;
 }
-export function selectSeedBaselineChecks(manifest, changeName = generatedSeedChangeName(manifest), seedState = 'active') {
+export function seedInfrastructureBaselineBlocker(manifest) {
+    const layout = assessInfrastructureLayout(manifest);
+    return layout.kind === 'independent' ? undefined :
+        `Infrastructure layout migration-required (${layout.kind}): ${layout.reason} ` +
+            'No baseline infrastructure recipe is available; existing roots and state are not moved or initialized.';
+}
+export function selectSeedBaselineChecks(manifest, changeName = generatedSeedChangeName(manifest), seedState = 'active', options = {}) {
+    const layoutBlocker = seedInfrastructureBaselineBlocker(manifest);
+    if (layoutBlocker)
+        throw new Error(layoutBlocker);
     const workload = manifest.project.workload;
     const checks = [
         {
@@ -45,18 +60,7 @@ export function selectSeedBaselineChecks(manifest, changeName = generatedSeedCha
             }
         }
     ];
-    if (workload.kind === 'power-apps-code-app') {
-        checks.push({
-            id: 'backend-tests',
-            taskId: '2.2',
-            label: 'Record backend tests as inapplicable',
-            applicability: {
-                applicable: false,
-                reason: 'no Liftoff backend is generated for Power Apps code apps'
-            }
-        });
-    }
-    else if (workload.kind === 'genai' || workload.apiStack === 'python-fastapi') {
+    if (workload.kind === 'genai' || workload.apiStack === 'python-fastapi') {
         checks.push({
             id: 'backend-tests',
             taskId: '2.2',
@@ -115,19 +119,7 @@ export function selectSeedBaselineChecks(manifest, changeName = generatedSeedCha
             }
         });
     }
-    if (workload.kind === 'power-apps-code-app') {
-        checks.push({
-            id: 'frontend-build',
-            taskId: '2.4',
-            label: 'Run frontend build',
-            applicability: {
-                applicable: true,
-                command: { executable: 'npm', args: ['run', 'build'] },
-                cwdPathParts: []
-            }
-        });
-    }
-    else if (workload.frontend) {
+    if (workload.frontend) {
         checks.push({
             id: 'frontend-build',
             taskId: '2.4',
@@ -150,27 +142,7 @@ export function selectSeedBaselineChecks(manifest, changeName = generatedSeedCha
             }
         });
     }
-    if (workload.kind === 'power-apps-code-app') {
-        for (const [id, taskId, label] of [
-            ['docker-compose-config', '2.5', 'Record Docker Compose validation as inapplicable'],
-            ['tofu-fmt', '2.6', 'Record OpenTofu formatting as inapplicable'],
-            ['tofu-init', '2.7', 'Record OpenTofu initialization as inapplicable'],
-            ['tofu-validate', '2.8', 'Record OpenTofu validation as inapplicable']
-        ]) {
-            checks.push({
-                id,
-                taskId,
-                label,
-                applicability: {
-                    applicable: false,
-                    reason: id === 'docker-compose-config'
-                        ? 'no generated Docker Compose boundary is present'
-                        : 'no generated OpenTofu boundary is present'
-                }
-            });
-        }
-    }
-    else {
+    {
         checks.push({
             id: 'docker-compose-config',
             taskId: '2.5',
@@ -213,7 +185,10 @@ export function selectSeedBaselineChecks(manifest, changeName = generatedSeedCha
         id: 'openspec-strict',
         taskId: '2.9',
         label: 'Run strict OpenSpec validation',
-        applicability: {
+        applicability: manifest.project.specWorkflow === 'spec-kit' ? {
+            applicable: false,
+            reason: 'Spec Kit validates its real bootstrap bundle and official markers locally; OpenSpec is inapplicable.'
+        } : {
             applicable: true,
             command: {
                 executable: 'openspec',
@@ -224,7 +199,183 @@ export function selectSeedBaselineChecks(manifest, changeName = generatedSeedCha
             cwdPathParts: []
         }
     });
-    return checks;
+    const environmentChecks = manifest.project.workload.environments.flatMap((environment, index) => {
+        const cwdPathParts = ['infrastructure', 'opentofu', 'azure', 'environments', environment];
+        return [
+            { id: 'tofu-init', taskId: `2.7.${index + 1}`, label: `Initialize ${environment} OpenTofu without a backend`, applicability: {
+                    applicable: true, command: { executable: 'tofu', args: ['init', '-backend=false'] }, cwdPathParts
+                } },
+            { id: 'tofu-validate', taskId: `2.8.${index + 1}`, label: `Validate ${environment} OpenTofu without plan or apply`, applicability: {
+                    applicable: true, command: { executable: 'tofu', args: ['validate'] }, cwdPathParts
+                } }
+        ];
+    });
+    const firstInit = checks.findIndex((check) => check.id === 'tofu-init');
+    const selected = [...checks.slice(0, firstInit), ...environmentChecks, ...checks.slice(firstInit + 2)];
+    if (!options.localRevalidation)
+        return selected;
+    return selected.filter((check) => check.id !== 'tofu-init').map((check) => {
+        if (!check.applicability.applicable)
+            return check;
+        const applicability = check.applicability;
+        const command = applicability.command;
+        if (command.executable === 'uv')
+            return {
+                ...check,
+                applicability: {
+                    ...applicability,
+                    command: { executable: 'uv', args: ['run', '--no-sync', '--offline', ...command.args.slice(1)] },
+                    env: { UV_PYTHON_DOWNLOADS: 'never' }
+                }
+            };
+        if (command.executable === 'go')
+            return {
+                ...check,
+                applicability: {
+                    ...applicability,
+                    command: { executable: 'go', args: ['test', '-mod=readonly', './...'] },
+                    env: { GOPROXY: 'off', GOSUMDB: 'off', GOTOOLCHAIN: 'local', GONOPROXY: 'none', GOVCS: '*:off', GOFLAGS: '', GOWORK: 'off' }
+                }
+            };
+        if (command.executable === 'npm')
+            return {
+                ...check,
+                applicability: {
+                    ...applicability,
+                    command: { executable: 'npm', args: ['--offline', '--ignore-scripts', '--no-audit', '--no-fund', ...command.args] },
+                    env: { npm_config_offline: 'true', npm_config_ignore_scripts: 'true', npm_config_update_notifier: 'false' }
+                }
+            };
+        if (command.executable === 'tofu')
+            return {
+                ...check,
+                label: check.id === 'tofu-validate'
+                    ? `Observe already initialized OpenTofu at ${applicability.cwdPathParts.join('/')} with validate (no init)`
+                    : check.label,
+                applicability: {
+                    ...applicability,
+                    env: { TF_CLI_ARGS: '', TF_CLI_ARGS_validate: '', TF_CLI_ARGS_fmt: '', TF_DATA_DIR: '.terraform', TF_INPUT: '0', CHECKPOINT_DISABLE: '1' }
+                }
+            };
+        return check;
+    });
+}
+export async function previewLocalSeedPhase(projectRoot, manifest, phaseId) {
+    const discovery = await discoverGeneratedSeed(projectRoot, manifest);
+    const blockers = discovery.state === 'blocked' ? [...discovery.issues] : [];
+    const changeName = generatedSeedChangeName(manifest);
+    const commands = [];
+    const observations = [];
+    let checks = [];
+    if (discovery.state === 'archived') {
+        const integrity = await inspectArchivedSeedIntegrity(projectRoot, manifest);
+        if (integrity.status !== 'valid')
+            blockers.push(...(integrity.status === 'invalid'
+                ? integrity.issues : ['The archived seed is no longer independently observable.']));
+        const archiveRoot = ['openspec', 'changes', 'archive'];
+        const archives = (await readdir(await resolveProjectPath(projectRoot, archiveRoot), { withFileTypes: true }))
+            .filter((entry) => entry.isDirectory() && (entry.name === changeName || entry.name.endsWith(`-${changeName}`)));
+        if (archives.length !== 1)
+            blockers.push('The exact archived seed location changed during inspection.');
+        else {
+            const archived = [...archiveRoot, archives[0].name];
+            const capability = generatedSeedCapabilityId(manifest.project.workload);
+            const artifacts = [
+                ['.openspec.yaml'], ['proposal.md'], ['design.md'], ['tasks.md'], ['specs', capability, 'spec.md']
+            ].map((parts) => [...archived, ...parts]);
+            observations.push(...artifacts, ['openspec', 'specs', capability, 'spec.md']);
+            for (const parts of artifacts) {
+                if (!(await readRequiredProjectText(projectRoot, parts)).trim())
+                    blockers.push(`Archived seed artifact ${parts.join('/')} is empty.`);
+            }
+            const declared = extractDeclaredCapabilities(await readRequiredProjectText(projectRoot, [...archived, 'proposal.md']));
+            if (declared.length !== 1 || declared[0] !== capability)
+                blockers.push(`Archived seed proposal must declare exactly the generated capability ${capability}.`);
+        }
+    }
+    else if (discovery.state === 'active') {
+        observations.push(discovery.changePathParts);
+    }
+    if (phaseId === 'seed-verified') {
+        const infrastructureBlocker = seedInfrastructureBaselineBlocker(manifest);
+        if (infrastructureBlocker)
+            blockers.push(infrastructureBlocker);
+        else
+            checks = selectSeedBaselineChecks(manifest, changeName, discovery.state === 'archived' ? 'archived' : 'active', { localRevalidation: true });
+        for (const check of checks) {
+            if (!check.applicability.applicable)
+                continue;
+            const { command, cwdPathParts, env } = check.applicability;
+            commands.push({ command, cwdPathParts, env: env ?? {} });
+        }
+        for (const environment of manifest.project.workload.environments) {
+            const root = ['infrastructure', 'opentofu', 'azure', 'environments', environment];
+            if (await readProjectFile(projectRoot, [...root, 'main.tf']) === undefined) {
+                blockers.push(`Missing selected OpenTofu environment root ${[...root, 'main.tf'].join('/')}.`);
+            }
+            await requireInstalledDirectory([...root, '.terraform'], 'OpenTofu initialization');
+        }
+        if (manifest.project.workload.kind === 'genai' || manifest.project.workload.apiStack === 'python-fastapi') {
+            await requireInstalledDirectory(['backend', '.venv'], 'Python environment');
+        }
+        else if (manifest.project.workload.apiStack === 'node-fastify') {
+            await requireInstalledDirectory(['backend', 'node_modules'], 'Backend dependencies');
+        }
+        if (manifest.project.workload.frontend)
+            await requireInstalledDirectory(['frontend', 'node_modules'], 'Frontend dependencies');
+    }
+    else if (manifest.project.specWorkflow === 'openspec') {
+        if (phaseId === 'seed-archived' && discovery.state !== 'archived') {
+            blockers.push('The seed is not already archived. Review liftoff governance plan and complete its separate setup/archive transition; update revalidation never archives or edits seed files.');
+        }
+        else {
+            commands.push({
+                command: { executable: 'openspec', args: discovery.state === 'archived'
+                        ? ['validate', '--all', '--strict'] : ['validate', changeName, '--strict'] },
+                cwdPathParts: [], env: {}
+            });
+        }
+    }
+    if (manifest.project.specWorkflow === 'spec-kit' && phaseId !== 'seed-valid') {
+        const bundle = await inspectSpecKitBootstrap(projectRoot, manifest);
+        if (bundle.tasks !== undefined && completedSpecKitTasks(bundle.tasks) !== bundle.tasks) {
+            blockers.push('Spec Kit bootstrap tasks are not already the completed matching projection. Review the separate governance setup transition; update revalidation does not write tasks.');
+        }
+    }
+    const actionId = phaseId === 'seed-valid' ? 'openspec.seed.validate'
+        : phaseId === 'seed-verified' ? 'openspec.seed.baseline-verify' : 'openspec.seed.archive';
+    const operation = {
+        adapter: 'selected-spec-workflow', actionId, mutationClass: 'read-worktree', phaseId,
+        inputs: {
+            changeName, localRevalidation: true, workflow: manifest.project.specWorkflow,
+            seedState: discovery.state, observations, commands,
+            ...(phaseId === 'seed-verified' ? {
+                checks: checks.map((check) => ({
+                    id: check.id, taskId: check.taskId, label: check.label,
+                    applicable: check.applicability.applicable,
+                    ...(check.applicability.applicable ? {
+                        command: check.applicability.command, cwdPathParts: check.applicability.cwdPathParts,
+                        env: check.applicability.env ?? {}
+                    } : { reason: check.applicability.reason })
+                }))
+            } : {})
+        },
+        destination: { type: 'local', identity: projectRoot },
+        remote: false, destructive: false
+    };
+    return { phaseId, operation, commands, blockers };
+    async function requireInstalledDirectory(parts, label) {
+        const target = await resolveProjectPath(projectRoot, parts);
+        try {
+            if (!(await lstat(target)).isDirectory())
+                throw new Error(`${parts.join('/')} must be an existing regular directory.`);
+        }
+        catch (error) {
+            if (errorCode(error) !== 'ENOENT')
+                throw error;
+            blockers.push(`${label} is unavailable at ${parts.join('/')}. Install or initialize it separately, then run liftoff update --check; revalidation never installs dependencies or runs tofu init.`);
+        }
+    }
 }
 function extractDeclaredCapabilities(proposal) {
     const capabilities = [];
@@ -331,21 +482,44 @@ export async function inspectArchivedSeedIntegrity(projectRoot, suppliedManifest
             ]
         };
     }
-    return { status: 'valid', changeName, capabilityId, issues: [] };
+    return { status: 'valid', changeName, capabilityId, contentDigest: canonicalSha256(spec.replace(/\r\n/g, '\n')), issues: [] };
 }
-export async function discoverGeneratedSeed(projectRoot) {
-    const manifest = await loadManifest(projectRoot);
+export async function discoverGeneratedSeed(projectRoot, suppliedManifest) {
+    const manifest = suppliedManifest ?? await loadManifest(projectRoot);
     const changeName = generatedSeedChangeName(manifest);
     if (manifest.project.specWorkflow !== 'openspec') {
-        return {
-            state: 'blocked',
-            changeName,
-            issues: ['The generated project does not use OpenSpec, so no OpenSpec bootstrap seed can be completed.']
+        const bundle = await inspectSpecKitBootstrap(projectRoot, manifest);
+        return bundle.issues.length ? { state: 'blocked', changeName, issues: bundle.issues } : {
+            state: 'active', changeName, changePathParts: specKitBootstrapPath,
+            capabilityId: generatedSeedCapabilityId(manifest.project.workload)
         };
     }
     const active = await activeBootstrapChanges(projectRoot);
     if (active.length === 0) {
         if (await archivedBootstrapChangeExists(projectRoot, changeName)) {
+            const archiveRoot = await resolveProjectPath(projectRoot, ['openspec', 'changes', 'archive']);
+            const archives = (await readdir(archiveRoot, { withFileTypes: true }))
+                .filter((entry) => entry.isDirectory() && (entry.name === changeName || entry.name.endsWith(`-${changeName}`)));
+            const issues = [];
+            if (archives.length !== 1) {
+                issues.push(`Expected exactly one archived generated seed ${changeName}; found ${archives.length}.`);
+            }
+            else {
+                const archived = ['openspec', 'changes', 'archive', archives[0].name];
+                for (const parts of [
+                    ['.openspec.yaml'], ['proposal.md'], ['design.md'], ['tasks.md'],
+                    ['specs', generatedSeedCapabilityId(manifest.project.workload), 'spec.md']
+                ]) {
+                    try {
+                        await readRequiredProjectText(projectRoot, [...archived, ...parts]);
+                    }
+                    catch (error) {
+                        issues.push(errorMessage(error));
+                    }
+                }
+            }
+            if (issues.length)
+                return { state: 'blocked', changeName, issues };
             return {
                 state: 'archived',
                 changeName,
@@ -365,6 +539,9 @@ export async function discoverGeneratedSeed(projectRoot) {
             issues: [`Expected exactly active generated seed ${changeName}; found ${active.join(', ')}.`]
         };
     }
+    if (await archivedBootstrapChangeExists(projectRoot, changeName)) {
+        return { state: 'blocked', changeName, issues: [`Generated seed ${changeName} has both active and archived copies; resolve ownership explicitly without deleting or inventing history.`] };
+    }
     const changePathParts = seedChangePathParts(changeName);
     const issues = [];
     let proposal = '';
@@ -411,11 +588,28 @@ function checkFailureDetail(result) {
     if (result.timedOut) {
         return 'command timed out';
     }
+    if (result.aborted)
+        return 'command was interrupted or cancelled';
+    if (result.outputLimitExceeded)
+        return 'command output exceeded the supported limit';
+    if (result.signal)
+        return `command terminated by ${result.signal}`;
     if (result.errorCode || result.errorMessage) {
         return [result.errorCode, result.errorMessage].filter(Boolean).join(': ');
     }
     return `exit status ${result.status ?? 'unknown'}`;
 }
+function commandSucceeded(result) {
+    return result.status === 0 && !result.signal && !result.timedOut && !result.errorCode &&
+        !result.errorMessage && !result.aborted && !result.outputLimitExceeded;
+}
+function localValidationObservation(result) {
+    return {
+        command: result.command,
+        exitStatus: result.status,
+        outputDigest: canonicalSha256({ stdout: result.stdout, stderr: result.stderr })
+    };
+}
 function sanitizeOpenSpecDiagnostic(output) {
     const plain = stripVTControlCharacters(output)
         .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]/gu, '')
@@ -438,7 +632,7 @@ async function validateAllOpenSpecAfterArchive(projectRoot, runner, changeName)
         args: ['validate', '--all', '--strict']
     };
     const result = await runner.run(command, { cwd: projectRoot });
-    if (result.status !== 0 || result.timedOut || result.errorCode) {
+    if (!commandSucceeded(result)) {
         return {
             status: 'blocked',
             issues: [
@@ -463,8 +657,10 @@ async function runSeedBaselineCheck(projectRoot, runner, check) {
     const cwd = check.applicability.cwdPathParts.length === 0
         ? projectRoot
         : await resolveProjectPath(projectRoot, [...check.applicability.cwdPathParts]);
-    const result = await runner.run(check.applicability.command, { cwd });
-    if (result.status === 0 && !result.timedOut && !result.errorCode) {
+    const result = await runner.run(check.applicability.command, {
+        cwd, ...(check.applicability.env ? { env: check.applicability.env } : {})
+    });
+    if (commandSucceeded(result)) {
         return {
             id: check.id,
             taskId: check.taskId,
@@ -472,6 +668,7 @@ async function runSeedBaselineCheck(projectRoot, runner, check) {
             status: 'passed',
             command: check.applicability.command,
             cwdPathParts: check.applicability.cwdPathParts,
+            ...(check.applicability.env ? { env: check.applicability.env } : {}),
             result
         };
     }
@@ -482,6 +679,7 @@ async function runSeedBaselineCheck(projectRoot, runner, check) {
         status: 'failed',
         command: check.applicability.command,
         cwdPathParts: check.applicability.cwdPathParts,
+        ...(check.applicability.env ? { env: check.applicability.env } : {}),
         result,
         detail: checkFailureDetail(result)
     };
@@ -532,6 +730,12 @@ export function markAllSeedTasksForArchive(markdown) {
         '2.6',
         '2.7',
         '2.8',
+        '2.7.1',
+        '2.7.2',
+        '2.7.3',
+        '2.8.1',
+        '2.8.2',
+        '2.8.3',
         '2.9',
         '3.1'
     ];
@@ -552,9 +756,22 @@ export function markAllSeedTasksForArchive(markdown) {
     }
     return lines.join('\n');
 }
-export async function validateGeneratedSeedForPhase(projectRoot, runner) {
+export async function validateGeneratedSeedForPhase(projectRoot, runner, options = {}) {
     const discovery = await discoverGeneratedSeed(projectRoot);
     if (discovery.state === 'archived') {
+        if (options.localRevalidation) {
+            const integrity = await inspectArchivedSeedIntegrity(projectRoot);
+            if (integrity.status !== 'valid')
+                return {
+                    status: 'blocked', changeName: discovery.changeName,
+                    issues: integrity.status === 'invalid' ? integrity.issues : ['The archived seed is no longer independently observable.']
+                };
+            const validation = await validateAllOpenSpecAfterArchive(projectRoot, runner, discovery.changeName);
+            if (validation.status === 'blocked')
+                return { status: 'blocked', changeName: discovery.changeName, issues: validation.issues };
+            return { status: 'passed', changeName: discovery.changeName, command: validation.command,
+                detail: 'Existing archived seed artifacts are present and synchronized main specifications are strict-valid; no archive was replayed.' };
+        }
         return {
             status: 'passed',
             changeName: discovery.changeName,
@@ -568,9 +785,13 @@ export async function validateGeneratedSeedForPhase(projectRoot, runner) {
             issues: discovery.issues
         };
     }
+    const manifest = await loadManifest(projectRoot);
+    if (manifest.project.specWorkflow === 'spec-kit') {
+        return { status: 'passed', changeName: discovery.changeName, detail: 'Real Spec Kit bootstrap bundle and independent official initialization markers are valid.' };
+    }
     const command = { executable: 'openspec', args: ['validate', discovery.changeName, '--strict'] };
     const result = await runner.run(command, { cwd: projectRoot });
-    if (result.status !== 0 || result.timedOut || result.errorCode) {
+    if (!commandSucceeded(result)) {
         return {
             status: 'blocked',
             changeName: discovery.changeName,
@@ -587,7 +808,7 @@ export async function validateGeneratedSeedForPhase(projectRoot, runner) {
         detail: 'Generated seed artifacts are present and strict-valid.'
     };
 }
-export async function verifyGeneratedSeedBaselineForPhase(projectRoot, runner) {
+export async function verifyGeneratedSeedBaselineForPhase(projectRoot, runner, options = {}) {
     const manifest = await loadManifest(projectRoot);
     const discovery = await discoverGeneratedSeed(projectRoot);
     if (discovery.state === 'blocked') {
@@ -611,7 +832,21 @@ export async function verifyGeneratedSeedBaselineForPhase(projectRoot, runner) {
             };
         }
     }
-    const checks = selectSeedBaselineChecks(manifest, discovery.changeName, discovery.state);
+    const layoutBlocker = seedInfrastructureBaselineBlocker(manifest);
+    if (layoutBlocker)
+        return { status: 'blocked', changeName: discovery.changeName, checks: [], issues: [layoutBlocker] };
+    if (options.localRevalidation) {
+        const preview = await previewLocalSeedPhase(projectRoot, manifest, 'seed-verified');
+        if (preview.blockers.length)
+            return { status: 'blocked', changeName: discovery.changeName, checks: [], issues: preview.blockers };
+    }
+    const checks = selectSeedBaselineChecks(manifest, discovery.changeName, discovery.state, options);
+    for (const environment of manifest.project.workload.environments) {
+        const parts = ['infrastructure', 'opentofu', 'azure', 'environments', environment, 'main.tf'];
+        if (await readProjectFile(projectRoot, parts) === undefined) {
+            return { status: 'blocked', changeName: discovery.changeName, checks: [], issues: [`Missing selected OpenTofu environment root ${parts.join('/')}.`] };
+        }
+    }
     const outcomes = await runSeedBaselineChecks(projectRoot, runner, checks);
     const failures = outcomes.filter((outcome) => outcome.status === 'failed');
     if (failures.length > 0) {
@@ -622,17 +857,46 @@ export async function verifyGeneratedSeedBaselineForPhase(projectRoot, runner) {
             checks: outcomes
         };
     }
+    if (manifest.project.specWorkflow === 'spec-kit') {
+        const bundle = await inspectSpecKitBootstrap(projectRoot, manifest);
+        if (bundle.issues.length || bundle.tasks === undefined)
+            return { status: 'blocked', changeName: discovery.changeName, checks: outcomes, issues: bundle.issues };
+        const snapshot = await captureProjectFileSnapshot(projectRoot, [...specKitBootstrapPath, 'tasks.md']);
+        if (snapshot.content?.toString('utf8') !== bundle.tasks)
+            return {
+                status: 'blocked', changeName: discovery.changeName, checks: outcomes, issues: ['Spec Kit tasks changed during baseline finalization; concurrent bytes were preserved.']
+            };
+        return {
+            status: 'passed', changeName: discovery.changeName, checks: outcomes,
+            fileMutations: [{ type: 'write', pathParts: [...specKitBootstrapPath, 'tasks.md'], content: completedSpecKitTasks(bundle.tasks) }],
+            filePreconditions: [snapshot]
+        };
+    }
     return { status: 'passed', changeName: discovery.changeName, checks: outcomes };
 }
-export async function archiveGeneratedSeedForPhase(projectRoot, runner) {
+export async function archiveGeneratedSeedForPhase(projectRoot, runner, options = {}) {
+    return withProjectMutationLock(projectRoot, (lease) => archiveGeneratedSeedForPhaseLocked(projectRoot, runner, lease, options));
+}
+async function archiveGeneratedSeedForPhaseLocked(projectRoot, runner, lease, options) {
+    const manifest = await loadManifest(projectRoot);
+    if (manifest.project.specWorkflow === 'spec-kit') {
+        const bundle = await inspectSpecKitBootstrap(projectRoot, manifest);
+        if (bundle.issues.length || !bundle.tasks || /^\s*- \[ \] B00[1-6] /m.test(bundle.tasks)) {
+            return { status: 'blocked', changeName: specKitBootstrapId, issues: [
+                    ...bundle.issues, 'The explicit Spec Kit local baseline task projection must be finalized by successful baseline execution.'
+                ] };
+        }
+        return { status: 'already-archived', changeName: specKitBootstrapId,
+            detail: 'Spec Kit local bootstrap handoff is finalized; no OpenSpec archive or Git branch was created.' };
+    }
     const discovery = await discoverGeneratedSeed(projectRoot);
     if (discovery.state === 'archived') {
         const integrity = await inspectArchivedSeedIntegrity(projectRoot);
-        if (integrity.status === 'invalid') {
+        if (integrity.status === 'invalid' || options.localRevalidation && integrity.status !== 'valid') {
             return {
                 status: 'blocked',
                 changeName: discovery.changeName,
-                issues: integrity.issues,
+                issues: integrity.status === 'invalid' ? integrity.issues : ['The archived seed is no longer independently observable.'],
                 retryableAfterRepair: true
             };
         }
@@ -648,6 +912,8 @@ export async function archiveGeneratedSeedForPhase(projectRoot, runner) {
         return {
             status: 'already-archived',
             changeName: discovery.changeName,
+            ...(integrity.status === 'valid' ? { synchronizedSpecDigest: integrity.contentDigest } : {}),
+            ...(options.localRevalidation ? { validation: validation.command } : {}),
             detail: `${discovery.detail} The synchronized main specs remain strict-valid.`
         };
     }
@@ -658,29 +924,43 @@ export async function archiveGeneratedSeedForPhase(projectRoot, runner) {
             issues: discovery.issues
         };
     }
+    if (options.localRevalidation)
+        return {
+            status: 'blocked', changeName: discovery.changeName,
+            issues: ['The seed is not already archived. Review the separate governance setup/archive transition; update revalidation never archives or edits seed files.']
+        };
     const taskPathParts = [...discovery.changePathParts, 'tasks.md'];
     const originalTasks = await readRequiredProjectText(projectRoot, taskPathParts);
     const completedTasks = markAllSeedTasksForArchive(originalTasks);
     await writeProjectFile(projectRoot, taskPathParts, completedTasks);
     const archiveCommand = { executable: 'openspec', args: ['archive', discovery.changeName, '--yes', '--json'] };
+    await lease.assertHeld();
     const archive = await runner.run(archiveCommand, { cwd: projectRoot });
     if (archive.status !== 0 || archive.timedOut || archive.errorCode) {
-        await writeProjectFile(projectRoot, taskPathParts, originalTasks);
+        const remaining = await readProjectFile(projectRoot, taskPathParts);
+        const archiveCompleted = remaining === undefined && await archivedBootstrapChangeExists(projectRoot, discovery.changeName);
+        const restored = remaining?.toString('utf8') === completedTasks;
+        if (restored)
+            await writeProjectFile(projectRoot, taskPathParts, originalTasks);
         return {
             status: 'blocked',
             changeName: discovery.changeName,
+            retryableAfterRepair: true,
+            archiveCompleted,
             issues: [
                 `OpenSpec archive failed: ${formatCommand(archiveCommand)} (${checkFailureDetail(archive)}). ` +
-                    'Seed tasks were restored and the seed remains active.'
+                    (archiveCompleted ? 'The seed was already moved to the archive; explicit retry revalidates it without recreating an active seed.' :
+                        restored ? 'Seed tasks were restored and the seed remains active.' :
+                            'Concurrent or uncertain seed task changes were preserved; no original task bytes were written over them.')
             ]
         };
     }
     const integrity = await inspectArchivedSeedIntegrity(projectRoot);
-    if (integrity.status === 'invalid') {
+    if (integrity.status !== 'valid') {
         return {
             status: 'blocked',
             changeName: discovery.changeName,
-            issues: integrity.issues,
+            issues: integrity.status === 'invalid' ? integrity.issues : ['Archive success was not independently observed; the seed handoff remains incomplete.'],
             retryableAfterRepair: true,
             archiveCompleted: true
         };
@@ -698,13 +978,100 @@ export async function archiveGeneratedSeedForPhase(projectRoot, runner) {
     return {
         status: 'archived',
         changeName: discovery.changeName,
+        synchronizedSpecDigest: integrity.contentDigest,
         capabilityId: discovery.capabilityId,
         archive,
         archiveSyncBehavior: 'OpenSpec archive updates main specs as part of archive; the lifecycle engine intentionally never passes --skip-specs.',
         detail: 'Generated seed was archived and the synchronized main specs passed strict validation.'
     };
 }
+export async function executeSeedOperations(input, options = {}) {
+    if (!input.phase.id.startsWith('seed-'))
+        return null;
+    if (input.phase.id === 'seed-valid') {
+        const result = await validateGeneratedSeedForPhase(input.inspection.projectRoot, input.runner, options);
+        if (result.status === 'blocked') {
+            return { status: 'blocked', blocker: result.issues[0] ?? 'Seed validation failed.', completedOperations: [] };
+        }
+        return {
+            status: 'completed',
+            resultState: 'verified',
+            evidencePayload: {
+                kind: 'seed-valid.v1', changeName: result.changeName, detail: result.detail,
+                ...(options.localRevalidation && result.command ? { validation: localValidationObservation(result.command) } : {})
+            },
+            completedOperations: input.plan.operations.filter((op) => op.actionId === 'openspec.seed.validate')
+        };
+    }
+    if (input.phase.id === 'seed-verified') {
+        const result = await verifyGeneratedSeedBaselineForPhase(input.inspection.projectRoot, input.runner, options);
+        if (result.status === 'blocked') {
+            return { status: 'blocked', blocker: result.issues[0] ?? 'Seed baseline verification failed.', completedOperations: [] };
+        }
+        if (options.localRevalidation) {
+            for (const mutation of result.fileMutations ?? []) {
+                const current = await readProjectFile(input.inspection.projectRoot, mutation.pathParts);
+                if (mutation.type !== 'write' || current?.toString('utf8') !== mutation.content)
+                    return {
+                        status: 'blocked',
+                        blocker: 'The baseline requires a differing Spec Kit task projection. Review the separate setup transition; revalidation preserved the existing tasks.',
+                        completedOperations: []
+                    };
+            }
+        }
+        return {
+            status: 'completed',
+            resultState: 'verified',
+            evidencePayload: {
+                kind: 'seed-verified.v1',
+                checks: result.checks.map((check) => ({
+                    id: check.id, taskId: check.taskId, status: check.status,
+                    ...(options.localRevalidation && check.status === 'passed' ? {
+                        label: check.label, cwdPathParts: check.cwdPathParts, env: check.env ?? {},
+                        ...localValidationObservation(check.result)
+                    } : {})
+                }))
+            },
+            completedOperations: input.plan.operations.filter((op) => op.actionId === 'openspec.seed.baseline-verify' || op.actionId === 'seed.tasks.project'),
+            fileMutations: options.localRevalidation ? undefined : result.fileMutations,
+            filePreconditions: result.filePreconditions
+        };
+    }
+    const result = await archiveGeneratedSeedForPhase(input.inspection.projectRoot, input.runner, options);
+    if (result.status === 'blocked') {
+        return {
+            status: 'blocked',
+            blocker: result.issues[0] ?? 'Seed archive failed.',
+            completedOperations: result.archiveCompleted ? input.plan.operations.filter((op) => op.actionId === 'openspec.seed.archive') : [],
+            retryableWithoutStateMutation: result.retryableAfterRepair
+        };
+    }
+    return {
+        status: 'completed',
+        resultState: 'verified',
+        evidencePayload: {
+            kind: 'seed-archived.v1',
+            ...(result.synchronizedSpecDigest ? { synchronizedSpecDigest: result.synchronizedSpecDigest } : {}),
+            archiveSyncBehavior: result.archiveSyncBehavior ?? null,
+            ...(options.localRevalidation ? {
+                observation: result.detail,
+                ...(result.validation ? { validation: localValidationObservation(result.validation) } : {})
+            } : {})
+        },
+        completedOperations: input.plan.operations.filter((op) => op.actionId === 'openspec.seed.archive')
+    };
+}
 export async function completeGeneratedSeedLifecycle(projectRoot, runner) {
+    return withProjectMutationLock(projectRoot, () => completeGeneratedSeedLifecycleLocked(projectRoot, runner));
+}
+async function completeGeneratedSeedLifecycleLocked(projectRoot, runner) {
+    const manifest = await loadManifest(projectRoot);
+    if (manifest.project.specWorkflow === 'spec-kit') {
+        return {
+            status: 'blocked', changeName: specKitBootstrapId, checks: [],
+            issues: ['Spec Kit local completion requires the explicitly planned governance apply-next --execute phases so task projection and the body-bound baseline receipt are persisted together. No standalone archive is supported.']
+        };
+    }
     const discovery = await discoverGeneratedSeed(projectRoot);
     if (discovery.state === 'archived') {
         const archive = await archiveGeneratedSeedForPhase(projectRoot, runner);