@msn-control/liftoff 0.11.2 → 0.12.0

package/assets/governance/single-maintainer-gitflow/activation-v2-graph.json

@@ -0,0 +1,1583 @@
+{
+  "schemaVersion": 1,
+  "versions": {
+    "liftoffVersion": "0.11.0",
+    "policyVersion": "6",
+    "activationContractVersion": 2,
+    "phaseGraphSchemaVersion": 1
+  },
+  "phases": [
+    {
+      "id": "seed-valid",
+      "label": "Generated bootstrap seed is strict-valid",
+      "dependencies": [],
+      "applicability": {
+        "kind": "always"
+      },
+      "allowedMutations": {
+        "local": [
+          "read-worktree",
+          "write-evidence",
+          "write-activation-state"
+        ],
+        "remote": [
+          "none"
+        ]
+      },
+      "evidence": {
+        "schema": "seed-valid.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": []
+      },
+      "approvalGate": {
+        "kind": "none",
+        "required": false,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "project-files",
+        "policy",
+        "activation-identity"
+      ],
+      "rollback": {
+        "kind": "none",
+        "target": null,
+        "description": "No mutation is authorized by seed validation."
+      },
+      "terminalStates": [
+        "verified",
+        "failed"
+      ]
+    },
+    {
+      "id": "seed-verified",
+      "label": "Generated bootstrap baseline checks are verified",
+      "dependencies": [
+        {
+          "anyOf": [
+            "seed-valid"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Seed strict validation must pass first."
+        }
+      ],
+      "applicability": {
+        "kind": "always"
+      },
+      "allowedMutations": {
+        "local": [
+          "read-worktree",
+          "write-seed-tasks",
+          "write-evidence",
+          "write-activation-state"
+        ],
+        "remote": [
+          "none"
+        ]
+      },
+      "evidence": {
+        "schema": "seed-verified.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": []
+      },
+      "approvalGate": {
+        "kind": "none",
+        "required": false,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "project-files",
+        "activation-identity"
+      ],
+      "rollback": {
+        "kind": "none",
+        "target": null,
+        "description": "A failed baseline leaves the seed active."
+      },
+      "terminalStates": [
+        "verified",
+        "failed"
+      ]
+    },
+    {
+      "id": "seed-archived",
+      "label": "Generated bootstrap seed is synced and archived",
+      "dependencies": [
+        {
+          "anyOf": [
+            "seed-verified"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Only a verified seed may be archived."
+        }
+      ],
+      "applicability": {
+        "kind": "always"
+      },
+      "allowedMutations": {
+        "local": [
+          "read-worktree",
+          "write-openspec-seed",
+          "write-evidence",
+          "write-activation-state"
+        ],
+        "remote": [
+          "none"
+        ]
+      },
+      "evidence": {
+        "schema": "seed-archived.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": []
+      },
+      "approvalGate": {
+        "kind": "none",
+        "required": false,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "project-files",
+        "activation-identity"
+      ],
+      "rollback": {
+        "kind": "none",
+        "target": null,
+        "description": "Archive failures keep the seed active."
+      },
+      "terminalStates": [
+        "verified",
+        "failed"
+      ]
+    },
+    {
+      "id": "committed",
+      "label": "Initial repository baseline is committed",
+      "dependencies": [
+        {
+          "anyOf": [
+            "seed-archived"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Generated seed must be complete before commit guidance."
+        }
+      ],
+      "applicability": {
+        "kind": "always"
+      },
+      "allowedMutations": {
+        "local": [
+          "read-worktree",
+          "git-commit",
+          "write-evidence",
+          "write-activation-state"
+        ],
+        "remote": [
+          "none"
+        ]
+      },
+      "evidence": {
+        "schema": "committed.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": []
+      },
+      "approvalGate": {
+        "kind": "repository-publish",
+        "required": true,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "baseline-sha",
+        "project-files",
+        "approval-envelope"
+      ],
+      "rollback": {
+        "kind": "none",
+        "target": null,
+        "description": "Never rewrite a committed user history automatically."
+      },
+      "terminalStates": [
+        "verified",
+        "failed"
+      ]
+    },
+    {
+      "id": "pushed",
+      "label": "Initial repository baseline is pushed",
+      "dependencies": [
+        {
+          "anyOf": [
+            "committed"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Commit evidence precedes initial push."
+        }
+      ],
+      "applicability": {
+        "kind": "always"
+      },
+      "allowedMutations": {
+        "local": [
+          "read-worktree",
+          "write-evidence",
+          "write-activation-state"
+        ],
+        "remote": [
+          "git-push",
+          "github-read"
+        ]
+      },
+      "evidence": {
+        "schema": "pushed.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": [
+          "github"
+        ]
+      },
+      "approvalGate": {
+        "kind": "repository-publish",
+        "required": true,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "baseline-sha",
+        "approval-envelope"
+      ],
+      "rollback": {
+        "kind": "none",
+        "target": null,
+        "description": "Never force-push, delete, or rewrite refs."
+      },
+      "terminalStates": [
+        "verified",
+        "failed"
+      ]
+    },
+    {
+      "id": "phase-0-complete",
+      "label": "Read-only Phase 0 discovery is complete",
+      "dependencies": [
+        {
+          "anyOf": [
+            "pushed"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Remote repository identity must be resolvable."
+        }
+      ],
+      "applicability": {
+        "kind": "always"
+      },
+      "allowedMutations": {
+        "local": [
+          "write-evidence",
+          "write-activation-state"
+        ],
+        "remote": [
+          "github-read",
+          "azure-read"
+        ]
+      },
+      "evidence": {
+        "schema": "phase-0-complete.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": [
+          "github"
+        ]
+      },
+      "approvalGate": {
+        "kind": "none",
+        "required": false,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "baseline-sha",
+        "policy",
+        "live-readback"
+      ],
+      "rollback": {
+        "kind": "none",
+        "target": null,
+        "description": "Discovery is read-only and can be refreshed."
+      },
+      "terminalStates": [
+        "verified",
+        "failed"
+      ]
+    },
+    {
+      "id": "activation-approved",
+      "label": "Governance activation plan is approved",
+      "dependencies": [
+        {
+          "anyOf": [
+            "phase-0-complete"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Approval reviews Phase 0 evidence."
+        }
+      ],
+      "applicability": {
+        "kind": "always"
+      },
+      "allowedMutations": {
+        "local": [
+          "write-openspec-governance",
+          "write-activation-state",
+          "write-evidence"
+        ],
+        "remote": [
+          "none"
+        ]
+      },
+      "evidence": {
+        "schema": "activation-approved.v1",
+        "required": false,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": []
+      },
+      "approvalGate": {
+        "kind": "activation-plan",
+        "required": true,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "baseline-sha",
+        "approval-envelope",
+        "policy"
+      ],
+      "rollback": {
+        "kind": "none",
+        "target": null,
+        "description": "Approval expiry returns descendants to blocked."
+      },
+      "terminalStates": [
+        "approved",
+        "failed"
+      ]
+    },
+    {
+      "id": "credential-ready",
+      "label": "Runner preflight credential policy is ready when required",
+      "dependencies": [
+        {
+          "anyOf": [
+            "activation-approved"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Credential enrollment follows approved activation scope."
+        }
+      ],
+      "applicability": {
+        "kind": "conditional",
+        "discriminator": "credential-required",
+        "when": "credentialRequired=true",
+        "inapplicableWhen": "credentialRequired=false",
+        "exclusiveWith": []
+      },
+      "allowedMutations": {
+        "local": [
+          "write-evidence",
+          "write-activation-state"
+        ],
+        "remote": [
+          "github-secret-write",
+          "github-read"
+        ]
+      },
+      "evidence": {
+        "schema": "credential-ready.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": [
+          "github"
+        ]
+      },
+      "approvalGate": {
+        "kind": "credential-enrollment",
+        "required": true,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "credentials",
+        "approval-envelope",
+        "activation-identity"
+      ],
+      "rollback": {
+        "kind": "none",
+        "target": null,
+        "description": "Leaked or expired credentials block use and require rotation."
+      },
+      "terminalStates": [
+        "verified",
+        "failed",
+        "inapplicable"
+      ]
+    },
+    {
+      "id": "provider-ready",
+      "label": "Azure provider namespaces are terminal ready",
+      "dependencies": [
+        {
+          "anyOf": [
+            "activation-approved"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Provider readiness belongs to approved infrastructure scope."
+        },
+        {
+          "anyOf": [
+            "credential-ready"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Runner preflight credential readiness or inapplicability precedes provider work."
+        }
+      ],
+      "applicability": {
+        "kind": "conditional",
+        "discriminator": "private-staging-dast",
+        "when": "privateStagingDast=true",
+        "inapplicableWhen": "privateStagingDast=false",
+        "exclusiveWith": []
+      },
+      "allowedMutations": {
+        "local": [
+          "write-evidence",
+          "write-activation-state"
+        ],
+        "remote": [
+          "azure-read",
+          "azure-provider-register"
+        ]
+      },
+      "evidence": {
+        "schema": "provider-ready.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": [
+          "azure"
+        ]
+      },
+      "approvalGate": {
+        "kind": "infrastructure-cost",
+        "required": true,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "provider-inventory",
+        "approval-envelope",
+        "policy"
+      ],
+      "rollback": {
+        "kind": "retain",
+        "target": null,
+        "description": "Provider registrations are retained subscription capabilities."
+      },
+      "terminalStates": [
+        "verified",
+        "failed",
+        "inapplicable",
+        "retained"
+      ]
+    },
+    {
+      "id": "state-path-selected",
+      "label": "Private state path is selected",
+      "dependencies": [
+        {
+          "anyOf": [
+            "provider-ready"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Provider readiness precedes private state path selection."
+        }
+      ],
+      "applicability": {
+        "kind": "conditional",
+        "discriminator": "private-staging-dast",
+        "when": "privateStagingDast=true",
+        "inapplicableWhen": "privateStagingDast=false",
+        "exclusiveWith": []
+      },
+      "allowedMutations": {
+        "local": [
+          "write-activation-state",
+          "write-evidence"
+        ],
+        "remote": [
+          "azure-read"
+        ]
+      },
+      "evidence": {
+        "schema": "state-path-selected.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": [
+          "azure"
+        ]
+      },
+      "approvalGate": {
+        "kind": "infrastructure-cost",
+        "required": true,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "remote-state",
+        "provider-inventory",
+        "approval-envelope"
+      ],
+      "rollback": {
+        "kind": "none",
+        "target": null,
+        "description": "A changed path selection invalidates mutually exclusive descendants."
+      },
+      "terminalStates": [
+        "verified",
+        "failed",
+        "inapplicable"
+      ]
+    },
+    {
+      "id": "existing-private-path",
+      "label": "Existing private backend management path is verified",
+      "dependencies": [
+        {
+          "anyOf": [
+            "state-path-selected"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "State path selection chooses this branch."
+        }
+      ],
+      "applicability": {
+        "kind": "conditional",
+        "discriminator": "state-path",
+        "when": "statePath=existing-private",
+        "inapplicableWhen": "statePath!=existing-private",
+        "exclusiveWith": [
+          "bootstrap-local"
+        ]
+      },
+      "allowedMutations": {
+        "local": [
+          "write-evidence",
+          "write-activation-state"
+        ],
+        "remote": [
+          "azure-read"
+        ]
+      },
+      "evidence": {
+        "schema": "existing-private-path.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": [
+          "azure"
+        ]
+      },
+      "approvalGate": {
+        "kind": "none",
+        "required": false,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "remote-state",
+        "live-readback"
+      ],
+      "rollback": {
+        "kind": "none",
+        "target": null,
+        "description": "Existing path verification is read-only."
+      },
+      "terminalStates": [
+        "verified",
+        "failed",
+        "inapplicable"
+      ]
+    },
+    {
+      "id": "bootstrap-local",
+      "label": "Bounded local bootstrap creates access-establishing resources",
+      "dependencies": [
+        {
+          "anyOf": [
+            "provider-ready"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Provider readiness precedes local bootstrap."
+        },
+        {
+          "anyOf": [
+            "state-path-selected"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "State path selection precedes local bootstrap."
+        }
+      ],
+      "applicability": {
+        "kind": "conditional",
+        "discriminator": "state-path",
+        "when": "statePath=bootstrap-local",
+        "inapplicableWhen": "statePath!=bootstrap-local",
+        "exclusiveWith": [
+          "existing-private-path"
+        ]
+      },
+      "allowedMutations": {
+        "local": [
+          "write-local-state",
+          "write-evidence",
+          "write-activation-state"
+        ],
+        "remote": [
+          "azure-network-provision",
+          "github-write"
+        ]
+      },
+      "evidence": {
+        "schema": "bootstrap-local.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": [
+          "github",
+          "azure"
+        ]
+      },
+      "approvalGate": {
+        "kind": "infrastructure-cost",
+        "required": true,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "approval-envelope",
+        "provider-inventory",
+        "remote-state"
+      ],
+      "rollback": {
+        "kind": "reverse-to",
+        "target": "provider-ready",
+        "description": "Remove only repository-owned bootstrap resources in dependency order."
+      },
+      "terminalStates": [
+        "verified",
+        "failed",
+        "inapplicable"
+      ]
+    },
+    {
+      "id": "runner-ready",
+      "label": "Restricted larger runner is assigned and ready",
+      "dependencies": [
+        {
+          "anyOf": [
+            "bootstrap-local"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Local bootstrap must establish runner networking before runner proof."
+        }
+      ],
+      "applicability": {
+        "kind": "conditional",
+        "discriminator": "state-path",
+        "when": "statePath=bootstrap-local",
+        "inapplicableWhen": "statePath!=bootstrap-local",
+        "exclusiveWith": []
+      },
+      "allowedMutations": {
+        "local": [
+          "write-evidence",
+          "write-activation-state"
+        ],
+        "remote": [
+          "github-read",
+          "github-write"
+        ]
+      },
+      "evidence": {
+        "schema": "runner-ready.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": [
+          "github"
+        ]
+      },
+      "approvalGate": {
+        "kind": "infrastructure-cost",
+        "required": true,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "runner-inventory",
+        "approval-envelope"
+      ],
+      "rollback": {
+        "kind": "reverse-to",
+        "target": "bootstrap-local",
+        "description": "Remove repository runner assignment before network resources."
+      },
+      "terminalStates": [
+        "verified",
+        "failed",
+        "inapplicable"
+      ]
+    },
+    {
+      "id": "private-backend-proof",
+      "label": "Private backend is reachable from runner",
+      "dependencies": [
+        {
+          "anyOf": [
+            "runner-ready"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Runner readiness precedes private backend proof."
+        }
+      ],
+      "applicability": {
+        "kind": "conditional",
+        "discriminator": "state-path",
+        "when": "statePath=bootstrap-local",
+        "inapplicableWhen": "statePath!=bootstrap-local",
+        "exclusiveWith": []
+      },
+      "allowedMutations": {
+        "local": [
+          "write-evidence",
+          "write-activation-state"
+        ],
+        "remote": [
+          "github-read",
+          "azure-read"
+        ]
+      },
+      "evidence": {
+        "schema": "private-backend-proof.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": [
+          "github",
+          "azure"
+        ]
+      },
+      "approvalGate": {
+        "kind": "none",
+        "required": false,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "runner-inventory",
+        "remote-state",
+        "live-readback"
+      ],
+      "rollback": {
+        "kind": "reverse-to",
+        "target": "runner-ready",
+        "description": "Failed proof keeps remote import blocked."
+      },
+      "terminalStates": [
+        "verified",
+        "failed",
+        "inapplicable"
+      ]
+    },
+    {
+      "id": "remote-import-verified",
+      "label": "Declarative remote import and no-change plan are verified",
+      "dependencies": [
+        {
+          "anyOf": [
+            "private-backend-proof"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Private backend proof precedes remote import."
+        }
+      ],
+      "applicability": {
+        "kind": "conditional",
+        "discriminator": "state-path",
+        "when": "statePath=bootstrap-local",
+        "inapplicableWhen": "statePath!=bootstrap-local",
+        "exclusiveWith": []
+      },
+      "allowedMutations": {
+        "local": [
+          "write-evidence",
+          "write-activation-state"
+        ],
+        "remote": [
+          "azure-state-import"
+        ]
+      },
+      "evidence": {
+        "schema": "remote-import-verified.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": [
+          "azure"
+        ]
+      },
+      "approvalGate": {
+        "kind": "infrastructure-cost",
+        "required": true,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "remote-state",
+        "approval-envelope"
+      ],
+      "rollback": {
+        "kind": "reverse-to",
+        "target": "private-backend-proof",
+        "description": "Failed import leaves local state retained for remediation."
+      },
+      "terminalStates": [
+        "verified",
+        "failed",
+        "inapplicable"
+      ]
+    },
+    {
+      "id": "remote-ready",
+      "label": "Remote state is ready and local bootstrap state is frozen",
+      "dependencies": [
+        {
+          "anyOf": [
+            "existing-private-path",
+            "remote-import-verified"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Remote readiness follows either existing private path or verified remote import."
+        }
+      ],
+      "applicability": {
+        "kind": "conditional",
+        "discriminator": "private-staging-dast",
+        "when": "privateStagingDast=true",
+        "inapplicableWhen": "privateStagingDast=false",
+        "exclusiveWith": []
+      },
+      "allowedMutations": {
+        "local": [
+          "write-evidence",
+          "write-activation-state"
+        ],
+        "remote": [
+          "azure-read"
+        ]
+      },
+      "evidence": {
+        "schema": "remote-ready.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": []
+      },
+      "approvalGate": {
+        "kind": "none",
+        "required": false,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "remote-state",
+        "live-readback"
+      ],
+      "rollback": {
+        "kind": "retain",
+        "target": null,
+        "description": "Retain local bootstrap state read-only for exactly 30 days when used."
+      },
+      "terminalStates": [
+        "verified",
+        "failed",
+        "inapplicable",
+        "retained"
+      ]
+    },
+    {
+      "id": "application-foundation",
+      "label": "Application infrastructure foundation is reconciled",
+      "dependencies": [
+        {
+          "anyOf": [
+            "remote-ready"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Application resources wait for remote state readiness or inapplicability."
+        }
+      ],
+      "applicability": {
+        "kind": "always"
+      },
+      "allowedMutations": {
+        "local": [
+          "write-evidence",
+          "write-openspec-governance",
+          "write-activation-state"
+        ],
+        "remote": [
+          "azure-resource-provision"
+        ]
+      },
+      "evidence": {
+        "schema": "application-foundation.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": [
+          "azure"
+        ]
+      },
+      "approvalGate": {
+        "kind": "infrastructure-cost",
+        "required": true,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "project-files",
+        "remote-state",
+        "approval-envelope"
+      ],
+      "rollback": {
+        "kind": "reverse-to",
+        "target": "remote-ready",
+        "description": "Application resources are removed without unregistering providers."
+      },
+      "terminalStates": [
+        "verified",
+        "failed"
+      ]
+    },
+    {
+      "id": "workflow-source-ready",
+      "label": "Workflow source and ruleset payloads are ready",
+      "dependencies": [
+        {
+          "anyOf": [
+            "application-foundation"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Workflow source targets the reconciled application foundation."
+        }
+      ],
+      "applicability": {
+        "kind": "always"
+      },
+      "allowedMutations": {
+        "local": [
+          "write-workflows",
+          "write-ruleset-source",
+          "write-evidence",
+          "write-activation-state"
+        ],
+        "remote": [
+          "none"
+        ]
+      },
+      "evidence": {
+        "schema": "workflow-source-ready.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": []
+      },
+      "approvalGate": {
+        "kind": "none",
+        "required": false,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "project-files",
+        "policy"
+      ],
+      "rollback": {
+        "kind": "reverse-to",
+        "target": "application-foundation",
+        "description": "Remove or repair only workflow/ruleset source changes."
+      },
+      "terminalStates": [
+        "verified",
+        "failed"
+      ]
+    },
+    {
+      "id": "dev-proof",
+      "label": "Development proof is green",
+      "dependencies": [
+        {
+          "anyOf": [
+            "workflow-source-ready"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Workflow source must exist before proving checks."
+        }
+      ],
+      "applicability": {
+        "kind": "always"
+      },
+      "allowedMutations": {
+        "local": [
+          "write-evidence",
+          "write-activation-state"
+        ],
+        "remote": [
+          "github-read"
+        ]
+      },
+      "evidence": {
+        "schema": "dev-proof.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": [
+          "github"
+        ]
+      },
+      "approvalGate": {
+        "kind": "none",
+        "required": false,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "workflow-source",
+        "project-files"
+      ],
+      "rollback": {
+        "kind": "none",
+        "target": null,
+        "description": "A failed check blocks descendants until fixed."
+      },
+      "terminalStates": [
+        "verified",
+        "failed"
+      ]
+    },
+    {
+      "id": "staging-qualified",
+      "label": "Staging release qualification is complete",
+      "dependencies": [
+        {
+          "anyOf": [
+            "dev-proof"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Development proof precedes staging qualification."
+        }
+      ],
+      "applicability": {
+        "kind": "always"
+      },
+      "allowedMutations": {
+        "local": [
+          "write-evidence",
+          "write-activation-state"
+        ],
+        "remote": [
+          "github-read",
+          "azure-read"
+        ]
+      },
+      "evidence": {
+        "schema": "staging-qualified.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": [
+          "github",
+          "azure"
+        ]
+      },
+      "approvalGate": {
+        "kind": "none",
+        "required": false,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "workflow-source",
+        "security-evidence",
+        "live-readback"
+      ],
+      "rollback": {
+        "kind": "none",
+        "target": null,
+        "description": "Qualification failures keep production blocked."
+      },
+      "terminalStates": [
+        "verified",
+        "failed"
+      ]
+    },
+    {
+      "id": "production-rehearsed",
+      "label": "Production promotion and rollback are rehearsed",
+      "dependencies": [
+        {
+          "anyOf": [
+            "staging-qualified"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Only a staging-qualified candidate may be rehearsed."
+        }
+      ],
+      "applicability": {
+        "kind": "always"
+      },
+      "allowedMutations": {
+        "local": [
+          "write-evidence",
+          "write-activation-state"
+        ],
+        "remote": [
+          "github-read",
+          "azure-read"
+        ]
+      },
+      "evidence": {
+        "schema": "production-rehearsed.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": [
+          "github",
+          "azure"
+        ]
+      },
+      "approvalGate": {
+        "kind": "none",
+        "required": false,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "live-readback",
+        "workflow-source"
+      ],
+      "rollback": {
+        "kind": "none",
+        "target": null,
+        "description": "Rollback remains ungated and documented."
+      },
+      "terminalStates": [
+        "verified",
+        "failed"
+      ]
+    },
+    {
+      "id": "green-red-proof",
+      "label": "Required checks are proven green and deliberately red",
+      "dependencies": [
+        {
+          "anyOf": [
+            "production-rehearsed"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Promotion rehearsal precedes final context proof."
+        }
+      ],
+      "applicability": {
+        "kind": "always"
+      },
+      "allowedMutations": {
+        "local": [
+          "write-evidence",
+          "write-activation-state"
+        ],
+        "remote": [
+          "github-read"
+        ]
+      },
+      "evidence": {
+        "schema": "green-red-proof.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": [
+          "github"
+        ]
+      },
+      "approvalGate": {
+        "kind": "none",
+        "required": false,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "security-evidence",
+        "workflow-source"
+      ],
+      "rollback": {
+        "kind": "none",
+        "target": null,
+        "description": "Missing red proof prevents enforcement."
+      },
+      "terminalStates": [
+        "verified",
+        "failed"
+      ]
+    },
+    {
+      "id": "enforcement-approved",
+      "label": "Final ruleset enforcement is approved",
+      "dependencies": [
+        {
+          "anyOf": [
+            "green-red-proof"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Only exact green/red evidence may request enforcement."
+        }
+      ],
+      "applicability": {
+        "kind": "always"
+      },
+      "allowedMutations": {
+        "local": [
+          "write-activation-state",
+          "write-evidence"
+        ],
+        "remote": [
+          "none"
+        ]
+      },
+      "evidence": {
+        "schema": "enforcement-approved.v1",
+        "required": false,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": []
+      },
+      "approvalGate": {
+        "kind": "enforcement",
+        "required": true,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "approval-envelope",
+        "ruleset-readback"
+      ],
+      "rollback": {
+        "kind": "none",
+        "target": null,
+        "description": "Approval expiry blocks ruleset application."
+      },
+      "terminalStates": [
+        "approved",
+        "failed"
+      ]
+    },
+    {
+      "id": "rulesets-applied",
+      "label": "Repository rulesets are applied idempotently last",
+      "dependencies": [
+        {
+          "anyOf": [
+            "enforcement-approved"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Final enforcement approval precedes ruleset mutation."
+        }
+      ],
+      "applicability": {
+        "kind": "always"
+      },
+      "allowedMutations": {
+        "local": [
+          "write-evidence",
+          "write-activation-state"
+        ],
+        "remote": [
+          "github-ruleset-write",
+          "github-read"
+        ]
+      },
+      "evidence": {
+        "schema": "rulesets-applied.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": [
+          "github"
+        ]
+      },
+      "approvalGate": {
+        "kind": "enforcement",
+        "required": true,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "approval-envelope",
+        "ruleset-readback"
+      ],
+      "rollback": {
+        "kind": "reverse-to",
+        "target": "green-red-proof",
+        "description": "Rulesets can be disabled or repaired without approval-gating rollback."
+      },
+      "terminalStates": [
+        "verified",
+        "failed"
+      ]
+    },
+    {
+      "id": "live-readback",
+      "label": "Live enforcement readback matches source",
+      "dependencies": [
+        {
+          "anyOf": [
+            "rulesets-applied"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Live readback follows ruleset application."
+        }
+      ],
+      "applicability": {
+        "kind": "always"
+      },
+      "allowedMutations": {
+        "local": [
+          "write-evidence",
+          "write-activation-state"
+        ],
+        "remote": [
+          "github-read"
+        ]
+      },
+      "evidence": {
+        "schema": "live-readback.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": [
+          "github"
+        ]
+      },
+      "approvalGate": {
+        "kind": "none",
+        "required": false,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "ruleset-readback",
+        "live-readback"
+      ],
+      "rollback": {
+        "kind": "reverse-to",
+        "target": "rulesets-applied",
+        "description": "Mismatched live readback blocks completion."
+      },
+      "terminalStates": [
+        "verified",
+        "failed"
+      ]
+    },
+    {
+      "id": "bootstrap-state-disposed",
+      "label": "Retained local bootstrap state is disposed after day 30",
+      "dependencies": [
+        {
+          "anyOf": [
+            "live-readback"
+          ],
+          "accepts": [
+            "approved",
+            "verified",
+            "inapplicable",
+            "retained",
+            "disposed"
+          ],
+          "description": "Disposal is scheduled only after live enforcement readback."
+        }
+      ],
+      "applicability": {
+        "kind": "conditional",
+        "discriminator": "state-path",
+        "when": "statePath=bootstrap-local",
+        "inapplicableWhen": "statePath!=bootstrap-local",
+        "exclusiveWith": []
+      },
+      "allowedMutations": {
+        "local": [
+          "delete-local-state",
+          "write-evidence",
+          "write-activation-state"
+        ],
+        "remote": [
+          "none"
+        ]
+      },
+      "evidence": {
+        "schema": "bootstrap-state-disposed.v1",
+        "required": true,
+        "headerSchemaVersion": 2,
+        "liveReadbackProviders": []
+      },
+      "approvalGate": {
+        "kind": "destructive-disposal",
+        "required": true,
+        "envelopeSchemaVersion": 2
+      },
+      "invalidationInputs": [
+        "remote-state",
+        "approval-envelope"
+      ],
+      "rollback": {
+        "kind": "dispose",
+        "target": null,
+        "description": "Deletion destroys only the local encryption key and records no payload."
+      },
+      "terminalStates": [
+        "disposed",
+        "failed",
+        "inapplicable"
+      ]
+    }
+  ]
+}