@msn-control/liftoff 0.11.1 → 0.11.2

package/dist/governance-activation/proof-records.d.ts

@@ -0,0 +1,3 @@
+import type { PhaseEvidenceRecord } from '../domain/governance/activation/types.js';
+export declare function readReviewedTransitionPlans(projectRoot: string): Promise<import("../domain/governance/activation/types.js").SavedTransitionPlan[]>;
+export declare function readActivationEvidence(projectRoot: string): Promise<PhaseEvidenceRecord[]>;

package/dist/governance-activation/proof-records.js

@@ -0,0 +1,78 @@
+import { readdir } from 'node:fs/promises';
+import { readProjectFile } from '../adapters/filesystem/project-files.js';
+import { resolveProjectPath } from '../adapters/filesystem/project-paths.js';
+import { isHistoricalActivationIdentity } from '../domain/governance/policy/identity.js';
+import { validateEvidenceHeader, validateLiveReadbackProof, validateSavedTransitionPlan } from '../domain/governance/activation/validators.js';
+async function readJsonDirectory(projectRoot, parts) {
+    let entries;
+    try {
+        entries = await readdir(await resolveProjectPath(projectRoot, parts), { withFileTypes: true });
+    }
+    catch (error) {
+        if (typeof error === 'object' && error !== null && 'code' in error && error.code === 'ENOENT')
+            return [];
+        throw error;
+    }
+    const results = [];
+    for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name, 'en'))) {
+        if (!entry.name.endsWith('.json'))
+            continue;
+        if (!entry.isFile())
+            throw new Error(`Activation proof ${[...parts, entry.name].join('/')} must be a regular file.`);
+        const bytes = await readProjectFile(projectRoot, [...parts, entry.name]);
+        if (!bytes)
+            throw new Error('Activation proof changed during inspection.');
+        const source = [...parts, entry.name].join('/');
+        try {
+            results.push({ path: source, value: JSON.parse(bytes.toString('utf8')) });
+        }
+        catch (error) {
+            if (!(error instanceof SyntaxError))
+                throw error;
+            throw new Error(`Unable to parse ${source}: invalid JSON.`);
+        }
+    }
+    return results;
+}
+export async function readReviewedTransitionPlans(projectRoot) {
+    return (await readJsonDirectory(projectRoot, ['governance', 'plans'])).map(({ path, value }) => {
+        try {
+            return validateSavedTransitionPlan(value);
+        }
+        catch (error) {
+            throw new Error(`Invalid ${path}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    });
+}
+export async function readActivationEvidence(projectRoot) {
+    return (await readJsonDirectory(projectRoot, ['governance', 'evidence'])).map(({ path, value }) => {
+        try {
+            if (typeof value !== 'object' || value === null || !('header' in value) || !('evidenceId' in value) ||
+                typeof value.evidenceId !== 'string' || !value.evidenceId) {
+                throw new Error('Activation v2 requires a body-bound evidence record; historical headers are diagnostic-only.');
+            }
+            const record = value;
+            const header = record.header;
+            if (typeof header === 'object' && header !== null && 'schemaVersion' in header &&
+                header.schemaVersion === 1 && 'identity' in header && isHistoricalActivationIdentity(header.identity)) {
+                throw new Error('Historical activation v1 evidence is diagnostic-only; its original bytes are preserved and cannot authorize current execution or read scope.');
+            }
+            if (Object.keys(record).some((key) => !['evidenceId', 'header', 'payload', 'liveReadback'].includes(key))) {
+                throw new Error('Unknown activation evidence fields.');
+            }
+            const rawReadback = record.liveReadback;
+            if (rawReadback !== undefined && !Array.isArray(rawReadback)) {
+                throw new Error('Evidence liveReadback must be an array.');
+            }
+            const liveReadback = rawReadback?.map(validateLiveReadbackProof) ?? [];
+            return {
+                evidenceId: value.evidenceId, header: validateEvidenceHeader(value.header),
+                payload: record.payload, liveReadback
+            };
+        }
+        catch (error) {
+            throw new Error(`Invalid ${path}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    });
+}
+//# sourceMappingURL=proof-records.js.map

package/dist/governance-activation/proof-records.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-records.js","sourceRoot":"","sources":["../../src/governance-activation/proof-records.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AACzF,OAAO,EACL,sBAAsB,EAAE,yBAAyB,EAAE,2BAA2B,EAC/E,MAAM,+CAA+C,CAAC;AAGvD,KAAK,UAAU,iBAAiB,CAAC,WAAmB,EAAE,KAAe;IACnE,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,kBAAkB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzG,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,CAAC;IACnB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAC/E,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QAC5C,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACrH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,EAAE,CAAC,CAAC;QACvF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,WAAW,CAAC;gBAAE,MAAM,KAAK,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,iBAAiB,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,WAAmB;IACnE,OAAO,CAAC,MAAM,iBAAiB,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QAC7F,IAAI,CAAC;YAAC,OAAO,2BAA2B,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAClD,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;IAClH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,WAAmB;IAC9D,OAAO,CAAC,MAAM,iBAAiB,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QAChG,IAAI,CAAC;YACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,YAAY,IAAI,KAAK,CAAC;gBACjG,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;YAClH,CAAC;YACD,MAAM,MAAM,GAAG,KAAgC,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,eAAe,IAAI,MAAM;gBAC5E,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,UAAU,IAAI,MAAM,IAAI,8BAA8B,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxG,MAAM,IAAI,KAAK,CAAC,8IAA8I,CAAC,CAAC;YAClK,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC1G,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;YACxC,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,YAAY,GAAG,WAAW,EAAE,GAAG,CAAC,yBAAyB,CAAC,IAAI,EAAE,CAAC;YACvE,OAAO;gBACL,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC1E,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,YAAY;aACtC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/governance-activation/read-only.d.ts

@@ -1,8 +1,6 @@
 import type { LiftoffManifest } from '../domain/project/contracts.js';
 import type { CommandRunner } from '../process-runner.js';
-import { type PhaseEvidenceRecord } from '../domain/governance/activation/types.js';
-export declare function readReviewedTransitionPlans(projectRoot: string): Promise<import("../domain/governance/activation/types.js").SavedTransitionPlan[]>;
-export declare function readActivationEvidence(projectRoot: string): Promise<PhaseEvidenceRecord[]>;
+export { readActivationEvidence, readReviewedTransitionPlans } from './proof-records.js';
 /** Read-only proof boundary: returned values carry no executor, credential, or mutation port. */
 export declare function inspectCurrentActivationEvidence(projectRoot: string, manifest: LiftoffManifest, options?: {
     runner?: CommandRunner;
@@ -14,15 +12,17 @@ export declare function inspectCurrentActivationEvidence(projectRoot: string, ma
     contexts?: undefined;
     records?: undefined;
     selections?: undefined;
+    migration?: undefined;
 } | {
     status: 'inspected';
     state: import("../domain/governance/activation/types.js").UserActivationState;
     snapshot: import("./inputs.js").ActivationInputSnapshot;
     contexts: Record<"activation-approved" | "application-foundation" | "bootstrap-local" | "bootstrap-state-disposed" | "committed" | "credential-ready" | "dev-proof" | "enforcement-approved" | "existing-private-path" | "green-red-proof" | "live-readback" | "phase-0-complete" | "private-backend-proof" | "production-rehearsed" | "provider-ready" | "pushed" | "remote-import-verified" | "remote-ready" | "rulesets-applied" | "runner-ready" | "seed-archived" | "seed-valid" | "seed-verified" | "staging-qualified" | "state-path-selected" | "workflow-source-ready", import("../domain/governance/activation/evidence.js").EvidenceFreshnessContext>;
-    records: PhaseEvidenceRecord[];
+    records: import("../domain/governance/activation/types.js").PhaseEvidenceRecord[];
     selections: {
         [k: string]: import("../domain/governance/activation/evidence.js").EvidenceSelectionResult;
     };
+    migration: import("./history-contracts.js").MigrationJournal | null;
 }>;
 export { evidenceBodyDigest, evidenceHeaderDigest, selectLatestPhaseEvidence, validateEvidenceFreshness } from '../domain/governance/activation/evidence.js';
 export { activationEvidenceContexts, readActivationInputSnapshot } from './inputs.js';

package/dist/governance-activation/read-only.js

@@ -1,82 +1,19 @@
-import { readdir } from 'node:fs/promises';
-import { readProjectFile } from '../adapters/filesystem/project-files.js';
-import { resolveProjectPath } from '../adapters/filesystem/project-paths.js';
 import { loadActivationState } from './activation-state.js';
 import { activationEvidenceContexts, readActivationInputSnapshot } from './inputs.js';
 import { canonicalPhaseGraph } from '../domain/governance/activation/graph.js';
 import { selectLatestPhaseEvidence } from '../domain/governance/activation/evidence.js';
-import { validateEvidenceHeader, validateLiveReadbackProof, validateSavedTransitionPlan, validateManifestActivationForExecution } from '../domain/governance/activation/validators.js';
+import { validateManifestActivationForExecution } from '../domain/governance/activation/validators.js';
 import { phaseIds } from '../domain/governance/activation/types.js';
-import { isHistoricalActivationIdentity } from '../domain/governance/policy/identity.js';
-async function readJsonDirectory(projectRoot, parts) {
-    let entries;
-    try {
-        entries = await readdir(await resolveProjectPath(projectRoot, parts), { withFileTypes: true });
-    }
-    catch (error) {
-        if (typeof error === 'object' && error !== null && 'code' in error && error.code === 'ENOENT')
-            return [];
-        throw error;
-    }
-    const results = [];
-    for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name, 'en'))) {
-        if (!entry.name.endsWith('.json'))
-            continue;
-        if (!entry.isFile())
-            throw new Error(`Activation proof ${[...parts, entry.name].join('/')} must be a regular file.`);
-        const bytes = await readProjectFile(projectRoot, [...parts, entry.name]);
-        if (!bytes)
-            throw new Error('Activation proof changed during inspection.');
-        const source = [...parts, entry.name].join('/');
-        try {
-            results.push({ path: source, value: JSON.parse(bytes.toString('utf8')) });
-        }
-        catch {
-            throw new Error(`Unable to parse ${source}: invalid JSON.`);
-        }
-    }
-    return results;
-}
-export async function readReviewedTransitionPlans(projectRoot) {
-    return (await readJsonDirectory(projectRoot, ['governance', 'plans'])).map(({ path, value }) => {
-        try {
-            return validateSavedTransitionPlan(value);
-        }
-        catch (error) {
-            throw new Error(`Invalid ${path}: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    });
-}
-export async function readActivationEvidence(projectRoot) {
-    return (await readJsonDirectory(projectRoot, ['governance', 'evidence'])).map(({ path, value }) => {
-        try {
-            if (typeof value !== 'object' || value === null || !('header' in value) || !('evidenceId' in value) ||
-                typeof value.evidenceId !== 'string' || !value.evidenceId)
-                throw new Error('Activation v2 requires a body-bound evidence record; historical headers are diagnostic-only.');
-            const record = value;
-            const header = record.header;
-            if (typeof header === 'object' && header !== null && 'schemaVersion' in header &&
-                header.schemaVersion === 1 && 'identity' in header && isHistoricalActivationIdentity(header.identity)) {
-                throw new Error('Historical activation v1 evidence is diagnostic-only; its original bytes are preserved and cannot authorize current execution or read scope.');
-            }
-            if (Object.keys(record).some((key) => !['evidenceId', 'header', 'payload', 'liveReadback'].includes(key)))
-                throw new Error('Unknown activation evidence fields.');
-            if (record.liveReadback !== undefined && !Array.isArray(record.liveReadback))
-                throw new Error('Evidence liveReadback must be an array.');
-            return { evidenceId: value.evidenceId, header: validateEvidenceHeader(value.header), payload: record.payload,
-                liveReadback: record.liveReadback?.map(validateLiveReadbackProof) ?? [] };
-        }
-        catch (error) {
-            throw new Error(`Invalid ${path}: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    });
-}
+import { readActivationEvidence, readReviewedTransitionPlans } from './proof-records.js';
+import { inspectActivationMigrationHistory } from './migration-history.js';
+export { readActivationEvidence, readReviewedTransitionPlans } from './proof-records.js';
 /** Read-only proof boundary: returned values carry no executor, credential, or mutation port. */
 export async function inspectCurrentActivationEvidence(projectRoot, manifest, options = {}) {
     validateManifestActivationForExecution(manifest);
     const loaded = await loadActivationState(projectRoot);
     if (!loaded)
         return { status: 'not-started' };
+    const migration = await inspectActivationMigrationHistory(projectRoot);
     const snapshot = await readActivationInputSnapshot(projectRoot, manifest, options.runner);
     const contexts = activationEvidenceContexts(canonicalPhaseGraph, loaded.state, snapshot, options.now);
     const plans = await readReviewedTransitionPlans(projectRoot);
@@ -85,7 +22,10 @@ export async function inspectCurrentActivationEvidence(projectRoot, manifest, op
         contexts[phaseId].reviewedPlans = plans;
     const selections = Object.fromEntries(phaseIds.map((phaseId) => [phaseId,
         selectLatestPhaseEvidence(records.filter((record) => record.header.phaseId === phaseId), contexts[phaseId])]));
-    return { status: 'inspected', state: loaded.state, snapshot, contexts, records, selections };
+    return {
+        status: 'inspected', state: loaded.state, snapshot, contexts, records, selections,
+        migration: migration.status === 'committed' ? migration.journal : null
+    };
 }
 export { evidenceBodyDigest, evidenceHeaderDigest, selectLatestPhaseEvidence, validateEvidenceFreshness } from '../domain/governance/activation/evidence.js';
 export { activationEvidenceContexts, readActivationInputSnapshot } from './inputs.js';

package/dist/governance-activation/read-only.js.map

@@ -1 +1 @@
-{"version":3,"file":"read-only.js","sourceRoot":"","sources":["../../src/governance-activation/read-only.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAG7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,sCAAsC,EAAE,MAAM,+CAA+C,CAAC;AACvL,OAAO,EAAE,QAAQ,EAA4B,MAAM,0CAA0C,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AAEzF,KAAK,UAAU,iBAAiB,CAAC,WAAmB,EAAE,KAAe;IACnE,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QAAC,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,kBAAkB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IACvG,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzG,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,CAAC;IACnB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAC/E,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QAC5C,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACrH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,EAAE,CAAC,CAAC;QAAC,CAAC;QAC7F,MAAM,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,iBAAiB,CAAC,CAAC;QAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,WAAmB;IACnE,OAAO,CAAC,MAAM,iBAAiB,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QAC7F,IAAI,CAAC;YAAC,OAAO,2BAA2B,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAClD,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;IAClH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,WAAmB;IAC9D,OAAO,CAAC,MAAM,iBAAiB,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QAChG,IAAI,CAAC;YACL,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,YAAY,IAAI,KAAK,CAAC;gBACjG,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;YAC7K,MAAM,MAAM,GAAG,KAAgC,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,eAAe,IAAI,MAAM;gBAC5E,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,UAAU,IAAI,MAAM,IAAI,8BAA8B,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxG,MAAM,IAAI,KAAK,CAAC,8IAA8I,CAAC,CAAC;YAClK,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAClK,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzI,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO;gBAC1G,YAAY,EAAG,MAAM,CAAC,YAAsC,EAAE,GAAG,CAAC,yBAAyB,CAAC,IAAI,EAAE,EAAE,CAAC;QACvG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,WAAmB,EAAE,QAAyB,EAAE,OAAO,GAA2C,EAAE;IACzJ,sCAAsC,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,aAAsB,EAAE,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAG,0BAA0B,CAAC,mBAAmB,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACtG,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAC1D,KAAK,MAAM,OAAO,IAAI,QAAQ;QAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,aAAa,GAAG,KAAK,CAAC;IACxE,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO;QACtE,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjH,OAAO,EAAE,MAAM,EAAE,WAAoB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACxG,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AAC7J,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAEtF,OAAO,EAAE,aAAa,EAAwB,MAAM,+CAA+C,CAAC"}
+{"version":3,"file":"read-only.js","sourceRoot":"","sources":["../../src/governance-activation/read-only.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,EAAE,sCAAsC,EAAE,MAAM,+CAA+C,CAAC;AACvG,OAAO,EAAE,QAAQ,EAAE,MAAM,0CAA0C,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACzF,OAAO,EAAE,iCAAiC,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAEzF,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,WAAmB,EAAE,QAAyB,EAAE,OAAO,GAA2C,EAAE;IACzJ,sCAAsC,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,aAAsB,EAAE,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,iCAAiC,CAAC,WAAW,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAG,0BAA0B,CAAC,mBAAmB,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACtG,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAC1D,KAAK,MAAM,OAAO,IAAI,QAAQ;QAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,aAAa,GAAG,KAAK,CAAC;IACxE,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO;QACtE,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjH,OAAO;QACL,MAAM,EAAE,WAAoB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU;QAC1F,SAAS,EAAE,SAAS,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;KACvE,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AAC7J,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAEtF,OAAO,EAAE,aAAa,EAAwB,MAAM,+CAA+C,CAAC"}

package/dist/governance-activation/seed-lifecycle.d.ts

@@ -1,12 +1,14 @@
 import { type ProjectFileMutation, type ProjectFileSnapshot } from '../adapters/filesystem/project-transaction.js';
 import type { PhaseAdapterExecutionInput, PhaseAdapterOutcome } from './transition-ports.js';
 import type { CommandResult, CommandRunner } from '../process-runner.js';
+import type { TransitionOperation } from '../domain/governance/activation/types.js';
 import type { ExternalCommand, LiftoffManifest, ManifestWorkload } from '../domain/project/contracts.js';
 export type SeedBaselineCheckId = 'liftoff-validate' | 'backend-tests' | 'worker-tests' | 'frontend-build' | 'docker-compose-config' | 'tofu-fmt' | 'tofu-init' | 'tofu-validate' | 'openspec-strict';
 export type SeedBaselineCheckApplicability = {
     applicable: true;
     command: ExternalCommand;
     cwdPathParts: readonly string[];
+    env?: Readonly<Record<string, string>>;
 } | {
     applicable: false;
     reason: string;
@@ -24,6 +26,7 @@ export type SeedBaselineCheckOutcome = {
     status: 'passed';
     command: ExternalCommand;
     cwdPathParts: readonly string[];
+    env?: Readonly<Record<string, string>>;
     result: CommandResult;
 } | {
     id: SeedBaselineCheckId;
@@ -32,6 +35,7 @@ export type SeedBaselineCheckOutcome = {
     status: 'failed';
     command: ExternalCommand;
     cwdPathParts: readonly string[];
+    env?: Readonly<Record<string, string>>;
     result: CommandResult;
     detail: string;
 } | {
@@ -119,6 +123,7 @@ export type SeedPhaseArchiveResult = {
     archiveSyncBehavior?: string;
     detail: string;
     synchronizedSpecDigest?: string;
+    validation?: CommandResult;
 } | {
     status: 'blocked';
     changeName: string;
@@ -126,17 +131,34 @@ export type SeedPhaseArchiveResult = {
     retryableAfterRepair?: boolean;
     archiveCompleted?: boolean;
 };
+export type LocalSeedPhaseId = 'seed-valid' | 'seed-verified' | 'seed-archived';
+export interface LocalSeedCommand {
+    command: ExternalCommand;
+    cwdPathParts: readonly string[];
+    env: Readonly<Record<string, string>>;
+}
+export interface LocalSeedPhasePreview {
+    phaseId: LocalSeedPhaseId;
+    operation: TransitionOperation;
+    commands: readonly LocalSeedCommand[];
+    blockers: readonly string[];
+}
+interface SeedExecutionOptions {
+    localRevalidation?: boolean;
+}
 export declare function generatedSeedChangeName(manifest: LiftoffManifest): string;
 export declare function generatedSeedCapabilityId(workload: ManifestWorkload): string;
 export declare function seedInfrastructureBaselineBlocker(manifest: LiftoffManifest): string | undefined;
-export declare function selectSeedBaselineChecks(manifest: LiftoffManifest, changeName?: string, seedState?: 'active' | 'archived'): SeedBaselineCheck[];
+export declare function selectSeedBaselineChecks(manifest: LiftoffManifest, changeName?: string, seedState?: 'active' | 'archived', options?: SeedExecutionOptions): SeedBaselineCheck[];
+export declare function previewLocalSeedPhase(projectRoot: string, manifest: LiftoffManifest, phaseId: LocalSeedPhaseId): Promise<LocalSeedPhasePreview>;
 export declare function inspectArchivedSeedIntegrity(projectRoot: string, suppliedManifest?: LiftoffManifest): Promise<ArchivedSeedIntegrity>;
-export declare function discoverGeneratedSeed(projectRoot: string): Promise<GeneratedSeedDiscovery>;
+export declare function discoverGeneratedSeed(projectRoot: string, suppliedManifest?: LiftoffManifest): Promise<GeneratedSeedDiscovery>;
 export declare function runSeedBaselineChecks(projectRoot: string, runner: CommandRunner, checks: readonly SeedBaselineCheck[]): Promise<SeedBaselineCheckOutcome[]>;
 export declare function markSuccessfulSeedTasks(markdown: string, outcomes: readonly SeedBaselineCheckOutcome[]): string;
 export declare function markAllSeedTasksForArchive(markdown: string): string;
-export declare function validateGeneratedSeedForPhase(projectRoot: string, runner: CommandRunner): Promise<SeedPhaseValidationResult>;
-export declare function verifyGeneratedSeedBaselineForPhase(projectRoot: string, runner: CommandRunner): Promise<SeedPhaseVerificationResult>;
-export declare function archiveGeneratedSeedForPhase(projectRoot: string, runner: CommandRunner): Promise<SeedPhaseArchiveResult>;
-export declare function executeSeedOperations(input: PhaseAdapterExecutionInput): Promise<PhaseAdapterOutcome | null>;
+export declare function validateGeneratedSeedForPhase(projectRoot: string, runner: CommandRunner, options?: SeedExecutionOptions): Promise<SeedPhaseValidationResult>;
+export declare function verifyGeneratedSeedBaselineForPhase(projectRoot: string, runner: CommandRunner, options?: SeedExecutionOptions): Promise<SeedPhaseVerificationResult>;
+export declare function archiveGeneratedSeedForPhase(projectRoot: string, runner: CommandRunner, options?: SeedExecutionOptions): Promise<SeedPhaseArchiveResult>;
+export declare function executeSeedOperations(input: PhaseAdapterExecutionInput, options?: SeedExecutionOptions): Promise<PhaseAdapterOutcome | null>;
 export declare function completeGeneratedSeedLifecycle(projectRoot: string, runner: CommandRunner): Promise<GeneratedSeedLifecycleResult>;
+export {};