@msn-control/liftoff 0.10.4 → 0.11.2

package/dist/governance-assessment/engine.js

@@ -1,23 +1,41 @@
-import { canonicalJson, canonicalSha256, sha256Hex } from '../governance-activation/canonical-json.js';
-import { currentActivationIdentity, canonicalPhaseGraph } from '../governance-activation/graph.js';
-import { evidenceContextForPhase, requiredLiveReadbackProviders, selectLatestPhaseEvidence } from '../governance-activation/evidence.js';
-import { canonicalApprovalEnvelopeHash, evaluateApprovalForTransitionPlan, transitionPlanForPhase } from '../governance-activation/approvals.js';
-import { planDigestFor } from '../governance-activation/transitions.js';
+import { canonicalJson, canonicalSha256, sha256Hex } from '../domain/governance/activation/canonical-json.js';
+import { currentActivationIdentity, canonicalPhaseGraph } from '../domain/governance/activation/graph.js';
+import { canonicalApprovalEnvelopeHash, evaluateApprovalForTransitionPlan, transitionPlanForPhase } from '../domain/governance/activation/approvals.js';
+import { formatUpdateCommand } from '../application/update/command-guidance.js';
+import { inspectCurrentActivationEvidence } from '../governance-activation/read-only.js';
 import { governanceChangeMetadataFileName, validateGovernanceChangeMetadata } from '../governance-activation/source-of-truth.js';
+import { phaseIds } from '../domain/governance/activation/types.js';
 import { loadAssessmentCatalog } from './catalog.js';
-import { inspectAssessmentGit, inspectAssessmentProject, repositoryName } from './project.js';
+import { inspectAssessmentHistoricalActivation, inspectAssessmentProject, ordinaryGitAssessmentProject } from './project.js';
+import { inspectAssessmentGit, repositoryName } from '../adapters/git/governance-assessment.js';
 import { AssessmentFiles, AssessmentInputError, parseAssessmentJson } from './readers.js';
 import { parseAssessmentWorkflow } from './yaml.js';
 import { collectLiveAssessment } from './live.js';
-import { classifyFinding, assembleAssessmentReport } from './report.js';
-import { actionReferences, failOpenFlags, pinnedActions, protectedRefs, requiredCheckContexts, requiredContextBindings, securityPipeline, singleMaintainer, tagControls, workflowPermissions, observedRequiredContexts } from './predicates.js';
-import { isRecord, jsonValue, notObserved, observed, sanitizeAssessmentText, source } from './sanitize.js';
+import { classifyFinding, assembleAssessmentReport } from '../domain/governance/assessment/report.js';
+import { actionReferences, effectiveProtectedRefs, effectiveRequiredContextBindings, failOpenFlags, pinnedActions, protectedRefs, requiredCheckContexts, requiredContextBindings, runnerAlignment, securityPipeline, singleMaintainer, tagControls, workflowPermissions, observedRequiredContexts } from '../domain/governance/assessment/predicates.js';
+import { isRecord, jsonValue, notObserved, observed, sanitizeAssessmentText, source } from '../domain/governance/assessment/sanitize.js';
 const documentationPaths = [
     ['CONTRIBUTING.md'], ['docs', 'operations', 'github-governance.md'],
     ['docs', 'security', 'scanning.md'], ['docs', 'operations', 'alerting.md'],
     ['docs', 'operations', 'service-health.md'], ['docs', 'security', 'audit-evidence.md'],
     ['docs', 'ai-acceptable-use.md']
 ];
+function activationAuthorityFingerprint(inspection) {
+    if (inspection.status === 'not-started') {
+        return canonicalSha256({ status: inspection.status });
+    }
+    const firstContext = inspection.contexts[phaseIds[0]];
+    const stable = JSON.parse(JSON.stringify({
+        status: inspection.status,
+        state: inspection.state,
+        snapshot: inspection.snapshot,
+        migration: inspection.migration,
+        records: inspection.records,
+        reviewedPlans: firstContext.reviewedPlans ?? [],
+        selections: inspection.selections
+    }));
+    return canonicalSha256(stable);
+}
 async function localFacts(files, project, capturedAt) {
     const workflowParts = await files.list(['.github', 'workflows'], ['.yml', '.yaml']);
     const workflows = [];
@@ -76,6 +94,15 @@ async function localFacts(files, project, capturedAt) {
                     throw new Error('Active governance metadata does not match the recorded change and identity.');
                 }
                 baseline = metadata.baselineSha === '0'.repeat(64) ? null : metadata.baselineSha;
+                if (baseline && project.inputSnapshot && baseline !== project.inputSnapshot.baselineSha) {
+                    project.diagnostics.push({
+                        code: 'current-input-mismatch',
+                        severity: 'warning',
+                        source: parts.join('/'),
+                        message: 'The recorded governance baseline does not match the independently recomputed current input snapshot; evidence-backed scope is withheld.'
+                    });
+                    baseline = null;
+                }
             }
             catch (error) {
                 project.diagnostics.push({
@@ -97,58 +124,45 @@ async function localFacts(files, project, capturedAt) {
     };
 }
 function boundPlan(project, phaseId, now) {
-    if (!project.state || !project.bindingBaseline || project.identity.availability !== 'known')
+    const currentContext = project.evidenceContexts?.[phaseId];
+    const selection = project.activationSelections?.[phaseId];
+    const selected = selection?.issues.length === 0 ? selection.selected : null;
+    const payload = selected?.payload;
+    if (!project.state || !currentContext || !selected ||
+        !isRecord(payload) || typeof payload.planDigest !== 'string' ||
+        typeof payload.savedPlanDigest !== 'string' ||
+        project.identity.availability !== 'known')
         return null;
-    const candidates = project.plans.filter((plan) => plan.phaseId === phaseId && plan.baselineDigest === project.bindingBaseline &&
+    const candidates = (currentContext.reviewedPlans ?? []).filter((plan) => plan.phaseId === phaseId &&
+        plan.planDigest === payload.planDigest &&
+        canonicalSha256(plan) === payload.savedPlanDigest &&
+        plan.baselineDigest === currentContext.baselineSha &&
         canonicalJson(plan.identity) === canonicalJson(currentActivationIdentity) &&
         Date.parse(plan.createdAt) <= now.getTime() &&
         Date.parse(plan.createdAt) <= Date.parse(project.state.phases[phaseId].updatedAt)).sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt));
     const plan = candidates[0];
     if (!plan || plan.baselineDigest === '0'.repeat(64) || plan.inputDigest === '1'.repeat(64) ||
+        plan.baselineDigest !== currentContext.baselineSha ||
+        plan.inputDigest !== currentContext.inputDigest ||
+        plan.transitionDigest !== currentContext.transition.transitionDigest ||
         candidates.some((candidate) => candidate.createdAt === plan.createdAt && candidate.planDigest !== plan.planDigest))
         return null;
-    const phase = canonicalPhaseGraph.phases.find((entry) => entry.id === phaseId);
-    if (!phase)
-        return null;
-    const authority = transitionPlanForPhase(phase, project.state, {
-        phaseId, baselineSha: plan.baselineDigest, inputDigest: plan.inputDigest, transitionDigest: plan.transitionDigest
-    });
-    if (plan.planDigest !== planDigestFor({
-        phase, transitionDigest: plan.transitionDigest, operations: plan.operations, approvalPlanDigest: authority.planDigest
-    }))
-        return null;
     return plan;
 }
 export function selectBoundAssessmentEvidence(project, phaseId, now) {
     const plan = boundPlan(project, phaseId, now);
-    if (!plan || !project.state)
+    const selection = project.activationSelections?.[phaseId];
+    const selected = selection?.issues.length === 0 ? selection.selected : null;
+    if (!plan || !project.state || !selected ||
+        selected.header.result !== project.state.phases[phaseId].state)
         return null;
-    if (new Set(project.evidence.map((record) => record.evidenceId)).size !== project.evidence.length)
-        return null;
-    const phase = canonicalPhaseGraph.phases.find((entry) => entry.id === phaseId);
-    const references = project.state.phases[phaseId].evidence;
-    const candidates = project.evidence.filter((record) => record.header.phaseId === phaseId &&
-        references.some((reference) => reference.phaseId === phaseId && reference.evidenceId === record.evidenceId &&
-            reference.headerDigest === canonicalSha256(record.header) && reference.result === record.header.result));
-    const selected = selectLatestPhaseEvidence(candidates, evidenceContextForPhase(phaseId, {
-        repositoryId: project.state.repository.id, identity: currentActivationIdentity,
-        phaseGraphHash: currentActivationIdentity.phaseGraphHash, now,
-        baselineSha: plan.baselineDigest, inputDigest: plan.inputDigest, transitionDigest: plan.transitionDigest,
-        liveReadbackProviders: phase ? requiredLiveReadbackProviders(phase) : []
-    })).selected;
-    if (!selected || selected.header.result !== project.state.phases[phaseId].state)
-        return null;
-    const record = candidates.find((entry) => entry.evidenceId === selected.evidenceId &&
-        canonicalSha256(entry.header) === selected.headerDigest);
-    return record ? { ...selected, record } : null;
+    return selected;
 }
 function applicability(control, project, now) {
     if (control.applicability === 'always')
         return 'applicable';
-    if (project.project.workload.kind === 'power-apps-code-app')
-        return 'inapplicable';
     if (control.applicability === 'api')
-        return 'applicable';
+        return project.kind === 'liftoff' ? 'applicable' : 'unknown';
     const discovery = selectBoundAssessmentEvidence(project, 'phase-0-complete', now);
     if (!project.state || discovery?.header.result !== 'verified')
         return 'unknown';
@@ -156,41 +170,81 @@ function applicability(control, project, now) {
         ? project.state.applicability.privateStagingDast
         : project.state.applicability.statePath === 'bootstrap-local') ? 'applicable' : 'inapplicable';
 }
+function approvalBindsRepository(project, approval, repository, now) {
+    const currentBaseline = project.inputSnapshot?.baselineSha ??
+        project.bindingBaseline;
+    if (!project.state || !currentBaseline)
+        return false;
+    const plan = boundPlan(project, approval.phaseId, now);
+    const phase = canonicalPhaseGraph.phases.find((entry) => entry.id === approval.phaseId);
+    const authority = plan && phase ? transitionPlanForPhase(phase, project.state, {
+        phaseId: phase.id,
+        baselineSha: plan.baselineDigest,
+        inputDigest: plan.inputDigest,
+        transitionDigest: plan.transitionDigest
+    }) : null;
+    return approval.baselineSha === currentBaseline &&
+        project.identity.availability === 'known' &&
+        Date.parse(approval.approvedAt) <= now.getTime() &&
+        Date.parse(approval.expiresAt) > now.getTime() &&
+        project.state.phases[approval.phaseId].approvals.includes(approval.id) &&
+        Boolean(plan && authority && phase?.approvalGate.required) &&
+        authority?.planDigest === approval.planDigest &&
+        !evaluateApprovalForTransitionPlan(authority, [approval], { now }).approvalRequired &&
+        plan.approval.envelopeId === approval.id &&
+        plan.approval.envelopeHash === canonicalApprovalEnvelopeHash(approval) &&
+        approval.destinations.some((destination) => destination.type === 'repository' &&
+            (destination.repository ?? destination.identity).toLowerCase() === repository.toLowerCase());
+}
 export function resolveAssessmentLiveScope(project, git, now) {
-    const stateRepo = project.state ? repositoryName(project.state.repository.name, project.state.repository.id) : null;
-    let repository = git.originState === 'unavailable' ? null : git.repository ?? stateRepo;
-    if (git.repository && stateRepo) {
-        if (`${git.repository.owner}/${git.repository.name}`.toLowerCase() !== `${stateRepo.owner}/${stateRepo.name}`.toLowerCase()) {
-            repository = null;
-            project.diagnostics.push({ code: 'repository-binding-conflict', severity: 'warning', source: 'Git/activation state', message: 'Git origin and recorded repository disagree; live collection is withheld.' });
+    let repository = git.originState === 'verified' ? git.repository : null;
+    let remoteBindingVerified = false;
+    if (git.repository && project.state?.remoteBinding) {
+        const remote = project.state.remoteBinding;
+        const bound = repositoryName(remote.name, remote.id);
+        const matchingPush = git.pushUrls.length === 1 &&
+            git.pushUrls[0] === remote.pushUrl &&
+            project.inputSnapshot?.git.pushUrls.length === 1 &&
+            project.inputSnapshot.git.pushUrls[0] === remote.pushUrl;
+        if (!bound ||
+            `${git.repository.owner}/${git.repository.name}`.toLowerCase() !==
+                `${bound.owner}/${bound.name}`.toLowerCase() ||
+            !matchingPush) {
+            project.diagnostics.push({
+                code: 'repository-binding-conflict',
+                severity: 'warning',
+                source: 'Git/activation state',
+                message: 'Git fetch/push origin and the verified remote repository binding disagree; evidence-backed provider scope is withheld.'
+            });
+        }
+        else {
+            repository = { ...git.repository, id: bound.id };
+            remoteBindingVerified = true;
         }
-        else
-            repository = { ...git.repository, id: stateRepo.id };
     }
     const scope = {
-        repository, refs: ['develop', 'main'],
-        environments: project.project.workload.kind === 'power-apps-code-app' ? [] : [...project.project.workload.environments],
+        repository,
+        refs: repository ? ['develop', 'main'] : [],
+        ...(repository ? { refPrefixes: ['release/', 'hotfix/'] } : {}),
+        environments: project.project ? [...project.project.workload.environments] : [],
         runner: null, azure: []
     };
     if (!repository || !project.state)
         return scope;
+    if (!remoteBindingVerified) {
+        project.diagnostics.push({
+            code: 'remote-binding-unavailable',
+            severity: 'warning',
+            source: 'activation state',
+            message: 'No matching verified remote repository binding is available; evidence-backed runner and Azure reads are withheld.'
+        });
+        return scope;
+    }
     const fullName = `${repository.owner}/${repository.name}`;
+    const azureBindings = new Map();
+    const conflictingAzureBindings = new Set();
     for (const approval of project.approvals) {
-        const plan = boundPlan(project, approval.phaseId, now);
-        const phase = canonicalPhaseGraph.phases.find((entry) => entry.id === approval.phaseId);
-        const authority = plan && phase ? transitionPlanForPhase(phase, project.state, {
-            phaseId: phase.id, baselineSha: plan.baselineDigest, inputDigest: plan.inputDigest, transitionDigest: plan.transitionDigest
-        }) : null;
-        if (!project.bindingBaseline || approval.baselineSha !== project.bindingBaseline ||
-            project.identity.availability !== 'known' ||
-            Date.parse(approval.approvedAt) > now.getTime() ||
-            Date.parse(approval.expiresAt) <= now.getTime() ||
-            !project.state.phases[approval.phaseId].approvals.includes(approval.id) ||
-            !plan || !authority || !phase?.approvalGate.required || authority.planDigest !== approval.planDigest ||
-            evaluateApprovalForTransitionPlan(authority, [approval], { now }).approvalRequired ||
-            plan.approval.envelopeId !== approval.id ||
-            plan.approval.envelopeHash !== canonicalApprovalEnvelopeHash(approval) ||
-            !approval.destinations.some((destination) => destination.type === 'repository' && (destination.repository ?? destination.identity).toLowerCase() === fullName.toLowerCase()))
+        if (!approvalBindsRepository(project, approval, fullName, now))
             continue;
         const environments = approval.destinations.filter((destination) => destination.type === 'environment' &&
             ['dev', 'staging', 'prod'].includes(destination.identity)).map((destination) => destination.identity);
@@ -199,22 +253,79 @@ export function resolveAssessmentLiveScope(project, git, now) {
         const environment = environments[0];
         if (environment !== 'dev' && environment !== 'staging' && environment !== 'prod')
             continue;
-        for (const resource of approval.resources) {
-            const match = resource.identity.match(/^\/subscriptions\/([a-f0-9-]{36})\/resourceGroups\/[^/]+\/providers\/([A-Za-z0-9.]+)\/([A-Za-z0-9]+)\/[^/]+(?:\/[A-Za-z0-9]+\/[^/]+)*$/iu);
-            if (!match || !approval.destinations.some((destination) => destination.type === 'subscription' && (destination.subscriptionId ?? destination.identity).toLowerCase() === match[1].toLowerCase()))
+        const selected = selectBoundAssessmentEvidence(project, approval.phaseId, now);
+        const payload = selected?.payload;
+        const assessmentScope = isRecord(payload) && isRecord(payload.assessmentScope)
+            ? payload.assessmentScope
+            : null;
+        if (!assessmentScope || !Array.isArray(assessmentScope.azure)) {
+            if (approval.resources.some((resource) => resource.identity.startsWith('/subscriptions/')) &&
+                !project.diagnostics.some((entry) => entry.code === 'unbound-resource-role' && entry.source === approval.phaseId)) {
+                project.diagnostics.push({
+                    code: 'unbound-resource-role',
+                    severity: 'warning',
+                    source: approval.phaseId,
+                    message: 'Approved ARM resources lacked a current body-committed evidence payload with explicit assessment environment and role; Azure reads were withheld.'
+                });
+            }
+            continue;
+        }
+        for (const value of assessmentScope.azure) {
+            if (!isRecord(value) ||
+                Object.keys(value).some((key) => ![
+                    'subscriptionId', 'environment', 'resourceId', 'resourceType', 'role'
+                ].includes(key)) ||
+                typeof value.subscriptionId !== 'string' ||
+                value.environment !== environment ||
+                typeof value.resourceId !== 'string' ||
+                typeof value.resourceType !== 'string' ||
+                !['state', 'application', 'runner-network'].includes(String(value.role))) {
                 continue;
-            const role = ['remote-ready', 'remote-import-verified'].includes(approval.phaseId) ? 'state'
-                : ['bootstrap-local', 'runner-ready', 'private-backend-proof'].includes(approval.phaseId) ? 'runner-network' : 'application';
-            const resourceSegments = resource.identity.split('/').slice(6);
-            scope.azure.push({
-                subscriptionId: match[1], environment, resourceId: resource.identity,
-                resourceType: [resourceSegments[0], ...resourceSegments.slice(1).filter((_, index) => index % 2 === 0)].join('/'), role
-            });
+            }
+            const subscriptionId = value.subscriptionId;
+            const resourceId = value.resourceId;
+            const resourceType = value.resourceType;
+            const match = resourceId.match(/^\/subscriptions\/([a-f0-9-]{36})\/resourceGroups\/[^/]+\/providers\/([A-Za-z0-9.]+)\/([A-Za-z0-9]+)\/[^/]+(?:\/[A-Za-z0-9]+\/[^/]+)*$/iu);
+            if (!match ||
+                match[1].toLowerCase() !== subscriptionId.toLowerCase() ||
+                !approval.resources.some((resource) => resource.identity.toLowerCase() === resourceId.toLowerCase()) ||
+                !approval.destinations.some((destination) => destination.type === 'subscription' &&
+                    (destination.subscriptionId ?? destination.identity).toLowerCase() === subscriptionId.toLowerCase())) {
+                continue;
+            }
+            const binding = {
+                subscriptionId,
+                environment: environment,
+                resourceId,
+                resourceType,
+                role: value.role
+            };
+            const key = binding.resourceId.toLowerCase();
+            const previous = azureBindings.get(key);
+            if (conflictingAzureBindings.has(key) ||
+                previous && (previous.environment !== binding.environment ||
+                    previous.role !== binding.role ||
+                    previous.resourceType.toLowerCase() !== binding.resourceType.toLowerCase())) {
+                azureBindings.delete(key);
+                conflictingAzureBindings.add(key);
+                project.diagnostics.push({
+                    code: 'conflicting-resource-binding',
+                    severity: 'warning',
+                    source: binding.resourceId,
+                    message: 'Conflicting body-committed ARM environment, role, or resource-type bindings were excluded before live scope deduplication.'
+                });
+                continue;
+            }
+            if (!previous)
+                azureBindings.set(key, binding);
         }
     }
     const runnerRecord = selectBoundAssessmentEvidence(project, 'runner-ready', now);
-    const rawRunner = runnerRecord?.record.payload;
-    if (runnerRecord?.header.result === 'verified' && isRecord(rawRunner) && rawRunner.kind === 'runner-ready.v1' &&
+    const rawRunner = runnerRecord?.payload;
+    const runnerApproval = project.approvals.some((approval) => approval.phaseId === 'runner-ready' &&
+        approvalBindsRepository(project, approval, fullName, now));
+    if (runnerApproval && runnerRecord?.header.result === 'verified' &&
+        isRecord(rawRunner) && rawRunner.kind === 'runner-ready.v1' &&
         rawRunner.organization === repository.owner && Number.isInteger(rawRunner.runnerId) && Number(rawRunner.runnerId) > 0 &&
         (rawRunner.groupId === null || Number.isInteger(rawRunner.groupId)) &&
         (rawRunner.networkConfigurationId === null || typeof rawRunner.networkConfigurationId === 'string')) {
@@ -224,7 +335,7 @@ export function resolveAssessmentLiveScope(project, git, now) {
             networkConfigurationId: typeof rawRunner.networkConfigurationId === 'string' ? rawRunner.networkConfigurationId : null
         };
     }
-    scope.azure = [...new Map(scope.azure.map((binding) => [binding.resourceId.toLowerCase(), binding])).values()]
+    scope.azure = [...azureBindings.values()]
         .sort((a, b) => a.resourceId.localeCompare(b.resourceId, 'en'));
     return scope;
 }
@@ -252,6 +363,34 @@ function livePredicate(live, key, evaluate) {
         converted.facts = observation.value;
     return converted;
 }
+function partialLivePredicate(live, key, evaluate) {
+    const observation = live.observations[key];
+    if (!observation) {
+        return {
+            observation: notObserved(`Live ${key} was not collected.`),
+            provenDifference: false
+        };
+    }
+    if (observation.availability === 'observed') {
+        return {
+            observation: livePredicate(live, key, evaluate),
+            provenDifference: false
+        };
+    }
+    if (observation.facts !== undefined) {
+        const evaluated = evaluate(observation.facts);
+        if (evaluated.value === false) {
+            return {
+                observation: {
+                    ...observation,
+                    reason: `${observation.reason ?? 'Live collection was incomplete.'} Independently observed facts prove a difference: ${evaluated.reason}`
+                },
+                provenDifference: true
+            };
+        }
+    }
+    return { observation, provenDifference: false };
+}
 function bool(value, reason) { return { value, reason }; }
 function rows(value) {
     return Array.isArray(value) && value.every(isRecord) ? value : null;
@@ -268,6 +407,18 @@ export function findAssessmentException(control, approvals, scope, baseline, res
         (scope.environment === null || approval.destinations.some((entry) => entry.type === 'environment' && entry.identity === scope.environment)));
     return found ? { id: found.id, expiresAt: found.expiresAt, envelopeDigest: canonicalApprovalEnvelopeHash(found) } : null;
 }
+export function rejectedAssessmentExceptionDiagnostic(control, approvals, exception) {
+    if (exception !== null ||
+        !approvals.some((approval) => approval.policyExceptions.includes(control.id))) {
+        return null;
+    }
+    return {
+        code: 'rejected-exception',
+        severity: 'warning',
+        source: control.id,
+        message: 'A recorded exception was rejected because its current identity, baseline, scope, resource, approval time, or expiry did not match this finding.'
+    };
+}
 function evidenceObservation(project, git, capturedAt) {
     if (!project.state)
         return notObserved('No compatible activation state is available.');
@@ -288,14 +439,78 @@ function evidenceObservation(project, git, capturedAt) {
         return notObserved('Baseline/setup progress, approvals, applicability and current readback are not all established.');
     return observed(true, source('evidence', 'governance/evidence', capturedAt, project.evidence.map((record) => record.header.phaseId)));
 }
+function invalidateUnstableObservations(findings, kinds, reason) {
+    for (const finding of findings) {
+        if (finding.applicability === 'inapplicable')
+            continue;
+        let invalidated = false;
+        for (const layer of finding.requiredProof) {
+            const observation = finding.observations[layer];
+            if (observation?.source && kinds.has(observation.source.kind)) {
+                finding.observations[layer] = notObserved(reason);
+                invalidated = true;
+            }
+        }
+        if (!invalidated)
+            continue;
+        finding.exception = null;
+        finding.missingProof = finding.requiredProof.filter((layer) => finding.observations[layer]?.availability === 'not-observed');
+        const remaining = finding.requiredProof
+            .map((layer) => finding.observations[layer])
+            .filter((observation) => observation !== undefined);
+        const absent = remaining.some((observation) => observation.availability === 'missing');
+        const differs = remaining.some((observation) => observation.availability === 'observed' &&
+            canonicalJson(observation.value) !== canonicalJson(finding.expected));
+        finding.classification = differs
+            ? 'conflicting'
+            : absent
+                ? 'missing'
+                : 'not-observed';
+        finding.reasons.push(reason);
+    }
+}
+function invalidateChangedActivationAuthority(findings, controls) {
+    const controlsById = new Map(controls.map((control) => [
+        control.id,
+        control
+    ]));
+    for (const finding of findings) {
+        const control = controlsById.get(finding.controlId);
+        const evidenceDerivedApplicability = control?.applicability === 'private-dast' ||
+            control?.applicability === 'state-path';
+        if (finding.applicability === 'inapplicable' &&
+            !evidenceDerivedApplicability ||
+            !(evidenceDerivedApplicability ||
+                finding.requiredProof.includes('evidence') ||
+                finding.controlId.startsWith('azure.') ||
+                finding.controlId.startsWith('runner.') ||
+                finding.controlId.startsWith('evidence.'))) {
+            continue;
+        }
+        if (evidenceDerivedApplicability) {
+            finding.applicability = 'unknown';
+        }
+        finding.classification = 'not-observed';
+        finding.exception = null;
+        finding.missingProof = [...finding.requiredProof];
+        finding.reasons.push('Current activation inputs, evidence references, evidence bodies, or reviewed plans changed during collection; evidence-backed scope and results were withheld.');
+        for (const layer of finding.requiredProof) {
+            finding.observations[layer] = notObserved('Activation authority changed during collection.');
+        }
+    }
+}
 async function managedFindings(control, project, files, scope, capturedAt) {
     const findings = [];
     if (project.renderedCore.length === 0) {
         return [classifyFinding({
                 control, scope, applicability: 'applicable',
                 observations: {
-                    recorded: notObserved('Historical agent selection is not recorded.'),
-                    declared: notObserved('The current handoff cannot be rendered without inferring agent configuration.')
+                    recorded: notObserved(project.kind === 'git'
+                        ? 'Ordinary Git repositories have no recorded Liftoff ownership inventory.'
+                        : 'Historical agent selection is not recorded.'),
+                    declared: notObserved(project.kind === 'git'
+                        ? 'No Liftoff managed handoff is inferred for an ordinary Git repository.'
+                        : 'The current handoff cannot be rendered without inferring agent configuration.')
                 }
             })];
     }
@@ -349,7 +564,22 @@ function evaluateControl(control, project, facts, live, git, liveScope, now) {
             const branch = repository?.availability === 'observed' && isRecord(repository.value) && typeof repository.value.defaultBranch === 'string'
                 ? repository.value.defaultBranch : null;
             observations.declared = declaredRules((value) => protectedRefs(value, project.state?.repository.defaultBranch ?? null));
-            observations.live = livePredicate(live, 'github.rulesets', (value) => protectedRefs(value, branch));
+            const rules = live.observations['github.rulesets'];
+            const branches = live.observations['github.branches'];
+            const families = live.observations['github.ref-families'];
+            if (rules?.availability === 'observed' &&
+                branches?.availability === 'observed' &&
+                families?.availability === 'observed') {
+                observations.live = predicateObservation(effectiveProtectedRefs(rules.value, branches.value, families.value, branch), rules.source);
+                observations.live.facts = jsonValue({
+                    rulesets: rules.value,
+                    branches: branches.value,
+                    refFamilies: families.value
+                });
+            }
+            else {
+                observations.live = notObserved('Complete repository/inherited rulesets, classic/effective branch protection, and bounded release/hotfix enumeration are required.');
+            }
             break;
         }
         case 'single-maintainer':
@@ -381,14 +611,27 @@ function evaluateControl(control, project, facts, live, git, liveScope, now) {
                 : contexts.length ? predicateObservation(bool(true, `Declared contexts: ${contexts.map((entry) => entry.name).join(', ')}`), facts.ruleSource)
                     : absent('No required status check contexts were declared.', facts.ruleSource);
             const rules = live.observations['github.rulesets'];
+            const branches = live.observations['github.branches'];
+            const families = live.observations['github.ref-families'];
             const repository = live.observations['github.repository'];
             const branch = repository?.availability === 'observed' && isRecord(repository.value) && typeof repository.value.defaultBranch === 'string'
                 ? repository.value.defaultBranch : null;
-            const declaredBindings = requiredContextBindings(facts.rulesets, liveScope.refs, branch);
-            const enforcedBindings = rules?.availability === 'observed' ? requiredContextBindings(rules.value, liveScope.refs, branch) : null;
+            const familyRefs = families?.availability === 'observed' && isRecord(families.value) &&
+                Array.isArray(families.value.refs)
+                ? families.value.refs.filter((value) => typeof value === 'string')
+                : [];
+            const assessedRefs = [...new Set([...liveScope.refs, ...familyRefs])].sort();
+            const comparisonRefs = assessedRefs.length ? assessedRefs : ['develop', 'main'];
+            const declaredBindings = requiredContextBindings(facts.rulesets, comparisonRefs, branch);
+            const rulesetBindings = rules?.availability === 'observed'
+                ? requiredContextBindings(rules.value, comparisonRefs, branch)
+                : null;
+            const enforcedBindings = rules?.availability === 'observed' && branches?.availability === 'observed'
+                ? effectiveRequiredContextBindings(rules.value, branches.value, comparisonRefs, branch)
+                : rulesetBindings;
             observations.declared.facts = jsonValue(declaredBindings);
-            const bindingsDiffer = Boolean(contexts?.length && declaredBindings && enforcedBindings &&
-                canonicalJson(declaredBindings) !== canonicalJson(enforcedBindings));
+            const bindingsDiffer = Boolean(contexts?.length && declaredBindings && rulesetBindings &&
+                canonicalJson(declaredBindings) !== canonicalJson(rulesetBindings));
             if (bindingsDiffer) {
                 difference = 'conflicting';
                 const checks = live.observations['github.checks'];
@@ -398,8 +641,11 @@ function evaluateControl(control, project, facts, live, git, liveScope, now) {
                     : notObserved(`${reason} Check-run proof remains unobserved: ${checks?.reason ?? 'not collected'}`, rules?.source ?? null);
             }
             else {
-                observations.live = rules?.availability === 'observed' && declaredBindings && enforcedBindings
-                    ? livePredicate(live, 'github.checks', (value) => observedRequiredContexts(rules.value, value, branch))
+                observations.live = rules?.availability === 'observed' &&
+                    families?.availability === 'observed' &&
+                    declaredBindings &&
+                    enforcedBindings
+                    ? livePredicate(live, 'github.checks', (value) => observedRequiredContexts(rules.value, value, branch, branches?.value))
                     : notObserved('Live rule and exact commit-bound check observations are required.');
             }
             observations.live.facts = jsonValue({
@@ -457,19 +703,22 @@ function evaluateControl(control, project, facts, live, git, liveScope, now) {
             break;
         case 'runner': {
             observations.recorded = liveScope.runner ? observed(true, source('evidence', 'runner-ready repository binding', capturedAt, jsonValue(liveScope.runner))) : notObserved('No current, exact runner/group/network binding is available.');
-            observations.live = livePredicate(live, 'github.runner', (value) => bool(isRecord(value) && value.repositoryAssigned === true
-                && value.groupId === liveScope.runner?.groupId && value.runnerId === liveScope.runner?.runnerId ? true : null, 'Exact repository/group/network assignment, labels and runner capacity must be observed.'));
+            observations.live = livePredicate(live, 'github.runner', (value) => runnerAlignment(value, scope.repository));
             break;
         }
-        case 'providers':
-            observations.live = livePredicate(live, 'azure.providers', (value) => {
+        case 'providers': {
+            const evaluation = partialLivePredicate(live, 'azure.providers', (value) => {
                 const providers = rows(value);
                 return bool(!providers?.length ? null : providers.every((entry) => entry.registrationState === 'Registered'), 'Every explicitly required namespace must have terminal Registered readback.');
             });
+            observations.live = evaluation.observation;
+            if (evaluation.provenDifference)
+                difference = 'conflicting';
             expected = true;
             break;
-        case 'storage':
-            observations.live = livePredicate(live, 'azure.resources', (value) => {
+        }
+        case 'storage': {
+            const evaluation = partialLivePredicate(live, 'azure.resources', (value) => {
                 const storage = rows(value)?.filter((entry) => String(entry.resourceType).toLowerCase() === 'microsoft.storage/storageaccounts');
                 if (!storage?.length)
                     return bool(null, 'No explicit environment/role-bound storage observation is available.');
@@ -481,11 +730,15 @@ function evaluateControl(control, project, facts, live, git, liveScope, now) {
                 });
                 return bool(values.includes(false) ? false : values.includes(null) ? null : true, 'State storage requires ZRS; application storage uses Dev LRS and Staging/Production ZRS.');
             });
+            observations.live = evaluation.observation;
+            if (evaluation.provenDifference)
+                difference = 'conflicting';
             expected = true;
             break;
-        case 'network':
+        }
+        case 'network': {
             observations.recorded = liveScope.azure.some((entry) => entry.role === 'runner-network') ? observed(true, source('evidence', 'approved Staging network bindings', capturedAt, jsonValue(liveScope.azure))) : notObserved('No approved Staging network bindings were available.');
-            observations.live = livePredicate(live, 'azure.resources', (value) => {
+            const evaluation = partialLivePredicate(live, 'azure.resources', (value) => {
                 const network = rows(value)?.filter((entry) => entry.role === 'runner-network');
                 if (!network?.length)
                     return bool(null, 'No bound runner-network readback is available.');
@@ -494,7 +747,11 @@ function evaluateControl(control, project, facts, live, git, liveScope, now) {
                     return bool(false, 'A runner subnet still enables implicit default outbound access.');
                 return bool(null, 'Full subnet, route, DNS and exclusive NAT/Firewall proof is required; observed metadata alone is insufficient.');
             });
+            observations.live = evaluation.observation;
+            if (evaluation.provenDifference)
+                difference = 'conflicting';
             break;
+        }
         case 'evidence':
             observations.evidence = evidenceObservation(project, git, capturedAt);
             break;
@@ -505,9 +762,15 @@ function evaluateControl(control, project, facts, live, git, liveScope, now) {
             for (const layer of control.proofLayers)
                 observations[layer] = notObserved(`No supported evaluator exists for ${control.id}; the required proof is not inferred.`);
     }
+    const exception = findAssessmentException(control, project.approvals, scope, facts.baseline, exceptionResource, now);
+    const exceptionDiagnostic = rejectedAssessmentExceptionDiagnostic(control, project.approvals, exception);
+    if (exceptionDiagnostic &&
+        !project.diagnostics.some((entry) => entry.code === 'rejected-exception' && entry.source === control.id)) {
+        project.diagnostics.push(exceptionDiagnostic);
+    }
     return classifyFinding({
         control, scope, expected, applicability: applicability(control, project, now), observations, difference,
-        exception: findAssessmentException(control, project.approvals, scope, facts.baseline, exceptionResource, now)
+        exception
     });
 }
 export async function assessGovernance(projectRoot, options = {}) {
@@ -522,7 +785,88 @@ export async function assessGovernance(projectRoot, options = {}) {
     try {
         const loaded = loadAssessmentCatalog();
         target = loaded.target;
-        const project = await inspectAssessmentProject(files);
+        let project;
+        let git;
+        let initialActivationInspection = null;
+        let initialActivationFingerprint = null;
+        try {
+            project = await inspectAssessmentProject(files);
+            git = await inspectAssessmentGit(projectRoot, options.runner);
+        }
+        catch (error) {
+            if (!(error instanceof AssessmentInputError) || error.code !== 'project-not-found') {
+                throw error;
+            }
+            git = await inspectAssessmentGit(projectRoot, options.runner);
+            if (!git.isRepository) {
+                throw new AssessmentInputError('project-not-found', 'No Liftoff manifest or valid Git worktree was found at the selected boundary.');
+            }
+            project = ordinaryGitAssessmentProject();
+        }
+        if (project.manifest && project.identity.availability === 'known') {
+            try {
+                const activation = await inspectCurrentActivationEvidence(projectRoot, project.manifest, {
+                    ...(options.runner ? { runner: options.runner } : {}),
+                    now: captured
+                });
+                initialActivationInspection = activation;
+                initialActivationFingerprint = activationAuthorityFingerprint(activation);
+                if (activation.status === 'inspected') {
+                    project.state = activation.state;
+                    project.stateIdentity = jsonValue(activation.state.identity);
+                    project.identity.stateSource = 'user';
+                    project.inputSnapshot = activation.snapshot;
+                    project.evidenceContexts = activation.contexts;
+                    project.evidence = activation.records;
+                    project.plans = activation.contexts[phaseIds[0]].reviewedPlans
+                        ? [...activation.contexts[phaseIds[0]].reviewedPlans]
+                        : [];
+                    project.activationSelections = activation.selections;
+                    if (activation.migration) {
+                        const complete = activation.migration.revalidation.status === 'complete';
+                        project.diagnostics.push({
+                            code: complete ? 'activation-migration-committed' : 'activation-revalidation-blocked',
+                            severity: complete ? 'info' : 'warning',
+                            source: 'governance/migration-state.json',
+                            message: sanitizeAssessmentText(complete
+                                ? 'Local v2 migration and approved local revalidation are complete. Preserved v1 history is informational, not live enforcement proof.'
+                                : `Local v2 migration committed; revalidation is ${activation.migration.revalidation.status}. ${activation.migration.revalidation.nextAction} Run ${formatUpdateCommand(projectRoot, 'check')} after repairing the named blocker.`)
+                        });
+                    }
+                    for (const [phaseId, selection] of Object.entries(activation.selections)) {
+                        if (selection.selected && selection.historicalIssues?.length) {
+                            project.diagnostics.push({
+                                code: 'historical-evidence-ignored',
+                                severity: 'info',
+                                source: phaseId,
+                                message: sanitizeAssessmentText(selection.historicalIssues.map((issue) => issue.message).join('; '))
+                            });
+                        }
+                        if (selection.issues.length === 0)
+                            continue;
+                        project.invalidEvidence = true;
+                        project.diagnostics.push({
+                            code: 'invalid-current-evidence',
+                            severity: 'warning',
+                            source: phaseId,
+                            message: sanitizeAssessmentText(selection.issues.map((issue) => issue.message).join('; '))
+                        });
+                    }
+                }
+            }
+            catch (error) {
+                project.identity.availability = 'unsupported';
+                project.identity.stateSource = 'unsupported';
+                project.diagnostics.push({
+                    code: 'activation-history-diagnostic-only',
+                    severity: 'warning',
+                    source: 'activation read-only inspection',
+                    message: sanitizeAssessmentText(error instanceof Error
+                        ? error.message
+                        : 'Activation history could not be interpreted as current executable proof.')
+                });
+            }
+        }
         projectIdentity = project.identity;
         const disabled = project.identity.profile === 'none';
         if (disabled)
@@ -531,7 +875,6 @@ export async function assessGovernance(projectRoot, options = {}) {
                 snapshot: { capturedAt: captured.toISOString(), repository: null, localHead: null, worktreeDigest: files.digest(), inputsStable: await files.stable() },
                 findings: [], diagnostics: project.diagnostics, disabled: true
             });
-        const git = await inspectAssessmentGit(projectRoot, options.runner);
         project.diagnostics.push(...git.issues.map((message) => ({
             code: 'git-not-observed', severity: 'warning', message, source: 'Git metadata'
         })));
@@ -549,21 +892,54 @@ export async function assessGovernance(projectRoot, options = {}) {
                 findings.push(evaluateControl(control, project, facts, live, git, scope, captured));
         }
         const worktreeDigest = files.digest();
-        const finalGit = await inspectAssessmentGit(projectRoot, options.runner);
-        const inputsStable = await files.stable() && live.refsStable &&
-            canonicalJson(git) === canonicalJson(finalGit);
-        if (!inputsStable) {
-            for (const finding of findings) {
-                if (finding.applicability === 'inapplicable')
-                    continue;
-                finding.classification = 'not-observed';
-                finding.exception = null;
-                finding.missingProof = [...finding.requiredProof];
-                finding.reasons.push('Relevant files or refs changed during collection; rerun assessment for a consistent snapshot.');
-                for (const layer of finding.requiredProof)
-                    finding.observations[layer] = notObserved('Inputs changed during collection.');
+        let activationStable = true;
+        if (project.manifest && initialActivationInspection && initialActivationFingerprint) {
+            try {
+                const finalActivation = await inspectCurrentActivationEvidence(projectRoot, project.manifest, {
+                    ...(options.runner ? { runner: options.runner } : {}),
+                    now: captured
+                });
+                activationStable =
+                    activationAuthorityFingerprint(finalActivation) ===
+                        initialActivationFingerprint;
+            }
+            catch {
+                activationStable = false;
+            }
+        }
+        let historicalActivationStable = true;
+        if (project.historicalActivation) {
+            const finalHistorical = await inspectAssessmentHistoricalActivation(projectRoot);
+            historicalActivationStable = finalHistorical.fingerprint === project.historicalActivation.fingerprint;
+            if (!historicalActivationStable) {
+                project.diagnostics = project.diagnostics.filter((entry) => entry !== project.historicalActivation?.diagnostic);
+                project.diagnostics.push({
+                    code: 'activation-history-changed',
+                    severity: 'warning',
+                    source: 'activation read-only inspection',
+                    message: sanitizeAssessmentText(`Historical activation inputs changed during collection; migration eligibility was withheld. Rerun assessment, then use ${formatUpdateCommand(projectRoot, 'check')} to review a stable source.`)
+                });
             }
         }
+        const finalGit = await inspectAssessmentGit(projectRoot, options.runner);
+        const filesStable = await files.stable();
+        const gitStable = canonicalJson(git) === canonicalJson(finalGit);
+        const inputsStable = filesStable && gitStable && activationStable && historicalActivationStable;
+        if (!filesStable) {
+            invalidateUnstableObservations(findings, new Set(['file', 'evidence']), 'Relevant local files changed during collection; rerun assessment for current local proof.');
+        }
+        if (!gitStable) {
+            invalidateUnstableObservations(findings, new Set(['git']), 'Relevant Git metadata changed during collection; rerun assessment for current Git proof.');
+        }
+        if (!activationStable) {
+            invalidateChangedActivationAuthority(findings, loaded.catalog.controls);
+            project.diagnostics.push({
+                code: 'activation-authority-changed',
+                severity: 'warning',
+                source: 'activation read-only inspection',
+                message: 'Current activation inputs, evidence, state references, or reviewed plans changed during collection; dependent proof was withheld.'
+            });
+        }
         return assembleAssessmentReport({
             projectRoot, mode: options.live ? 'live' : 'local', target, projectIdentity,
             snapshot: { capturedAt: captured.toISOString(), repository, localHead: git.head, worktreeDigest, inputsStable },