@msn-control/liftoff 0.11.2 → 0.12.0

package/dist/domain/governance/activation/graph.js

@@ -1,5 +1,6 @@
 import { canonicalJson, canonicalSha256, sha256Hex } from './canonical-json.js';
 import { activationContractVersion, approvalEnvelopeSchemaVersion, buildActivationCompatibilityMap, createActivationIdentity, evidenceHeaderSchemaVersion, governanceActivationPolicyVersion, liftoffActivationPackageVersion, phaseGraphSchemaVersion } from '../policy/identity.js';
+import { activationPhaseIds, lifecyclePhaseIds, localSetupPhaseIds } from './types.js';
 const terminalVerified = ['verified', 'failed'];
 const terminalApproved = ['approved', 'failed'];
 const terminalConditional = ['verified', 'failed', 'inapplicable'];
@@ -12,7 +13,7 @@ function mutations(local, remote = ['none']) {
         !normalizedLocal.includes('write-activation-state')) {
         normalizedLocal.push('write-activation-state');
     }
-    return { local: normalizedLocal, remote };
+    return { local: normalizedLocal.filter((mutation) => mutation !== 'none'), remote };
 }
 function evidence(schema, required = true, liveReadbackProviders = []) {
     return { schema, required, headerSchemaVersion: evidenceHeaderSchemaVersion, liveReadbackProviders };
@@ -23,394 +24,438 @@ function approval(kind, required) {
 function rollback(kind, target, description) {
     return { kind, target, description };
 }
-export const canonicalPhaseGraph = {
-    schemaVersion: phaseGraphSchemaVersion,
-    versions: {
-        liftoffVersion: liftoffActivationPackageVersion,
-        policyVersion: governanceActivationPolicyVersion,
-        activationContractVersion,
-        phaseGraphSchemaVersion
+const nonGovernanceTaskPhases = new Set([
+    'seed-valid',
+    'seed-verified',
+    'seed-archived',
+    'committed',
+    'pushed',
+    'phase-0-complete'
+]);
+const rawPhases = [
+    {
+        id: 'seed-valid',
+        label: 'Generated bootstrap seed is strict-valid',
+        dependencies: [],
+        applicability: { kind: 'always' },
+        allowedMutations: mutations(['read-worktree', 'write-evidence']),
+        evidence: evidence('seed-valid.v1'),
+        approvalGate: approval('none', false),
+        invalidationInputs: ['project-files', 'policy', 'activation-identity'],
+        rollback: rollback('none', null, 'No mutation is authorized by seed validation.'),
+        terminalStates: terminalVerified
     },
-    phases: [
-        {
-            id: 'seed-valid',
-            label: 'Generated bootstrap seed is strict-valid',
-            dependencies: [],
-            applicability: { kind: 'always' },
-            allowedMutations: mutations(['read-worktree', 'write-evidence']),
-            evidence: evidence('seed-valid.v1'),
-            approvalGate: approval('none', false),
-            invalidationInputs: ['project-files', 'policy', 'activation-identity'],
-            rollback: rollback('none', null, 'No mutation is authorized by seed validation.'),
-            terminalStates: terminalVerified
-        },
-        {
-            id: 'seed-verified',
-            label: 'Generated bootstrap baseline checks are verified',
-            dependencies: [dep(['seed-valid'], 'Seed strict validation must pass first.')],
-            applicability: { kind: 'always' },
-            allowedMutations: mutations(['read-worktree', 'write-seed-tasks', 'write-evidence']),
-            evidence: evidence('seed-verified.v1'),
-            approvalGate: approval('none', false),
-            invalidationInputs: ['project-files', 'activation-identity'],
-            rollback: rollback('none', null, 'A failed baseline leaves the seed active.'),
-            terminalStates: terminalVerified
-        },
-        {
-            id: 'seed-archived',
-            label: 'Generated bootstrap seed is synced and archived',
-            dependencies: [dep(['seed-verified'], 'Only a verified seed may be archived.')],
-            applicability: { kind: 'always' },
-            allowedMutations: mutations(['read-worktree', 'write-openspec-seed', 'write-evidence']),
-            evidence: evidence('seed-archived.v1'),
-            approvalGate: approval('none', false),
-            invalidationInputs: ['project-files', 'activation-identity'],
-            rollback: rollback('none', null, 'Archive failures keep the seed active.'),
-            terminalStates: terminalVerified
-        },
-        {
-            id: 'committed',
-            label: 'Initial repository baseline is committed',
-            dependencies: [dep(['seed-archived'], 'Generated seed must be complete before commit guidance.')],
-            applicability: { kind: 'always' },
-            allowedMutations: mutations(['read-worktree', 'git-commit', 'write-evidence']),
-            evidence: evidence('committed.v1'),
-            approvalGate: approval('repository-publish', true),
-            invalidationInputs: ['baseline-sha', 'project-files', 'approval-envelope'],
-            rollback: rollback('none', null, 'Never rewrite a committed user history automatically.'),
-            terminalStates: terminalVerified
-        },
-        {
-            id: 'pushed',
-            label: 'Initial repository baseline is pushed',
-            dependencies: [dep(['committed'], 'Commit evidence precedes initial push.')],
-            applicability: { kind: 'always' },
-            allowedMutations: mutations(['read-worktree', 'write-evidence'], ['git-push', 'github-read']),
-            evidence: evidence('pushed.v1', true, ['github']),
-            approvalGate: approval('repository-publish', true),
-            invalidationInputs: ['baseline-sha', 'approval-envelope'],
-            rollback: rollback('none', null, 'Never force-push, delete, or rewrite refs.'),
-            terminalStates: terminalVerified
-        },
-        {
-            id: 'phase-0-complete',
-            label: 'Read-only Phase 0 discovery is complete',
-            dependencies: [dep(['pushed'], 'Remote repository identity must be resolvable.')],
-            applicability: { kind: 'always' },
-            allowedMutations: mutations(['write-evidence'], ['github-read', 'azure-read']),
-            evidence: evidence('phase-0-complete.v1', true, ['github']),
-            approvalGate: approval('none', false),
-            invalidationInputs: ['baseline-sha', 'policy', 'live-readback'],
-            rollback: rollback('none', null, 'Discovery is read-only and can be refreshed.'),
-            terminalStates: terminalVerified
-        },
-        {
-            id: 'activation-approved',
-            label: 'Governance activation plan is approved',
-            dependencies: [dep(['phase-0-complete'], 'Approval reviews Phase 0 evidence.')],
-            applicability: { kind: 'always' },
-            allowedMutations: mutations(['write-openspec-governance', 'write-activation-state', 'write-evidence']),
-            evidence: evidence('activation-approved.v1', false),
-            approvalGate: approval('activation-plan', true),
-            invalidationInputs: ['baseline-sha', 'approval-envelope', 'policy'],
-            rollback: rollback('none', null, 'Approval expiry returns descendants to blocked.'),
-            terminalStates: terminalApproved
-        },
-        {
-            id: 'credential-ready',
-            label: 'Runner preflight credential policy is ready when required',
-            dependencies: [dep(['activation-approved'], 'Credential enrollment follows approved activation scope.')],
-            applicability: {
-                kind: 'conditional',
-                discriminator: 'credential-required',
-                when: 'credentialRequired=true',
-                inapplicableWhen: 'credentialRequired=false',
-                exclusiveWith: []
-            },
-            allowedMutations: mutations(['write-evidence'], ['github-secret-write', 'github-read']),
-            evidence: evidence('credential-ready.v1', true, ['github']),
-            approvalGate: approval('credential-enrollment', true),
-            invalidationInputs: ['credentials', 'approval-envelope', 'activation-identity'],
-            rollback: rollback('none', null, 'Leaked or expired credentials block use and require rotation.'),
-            terminalStates: terminalConditional
-        },
-        {
-            id: 'provider-ready',
-            label: 'Azure provider namespaces are terminal ready',
-            dependencies: [
-                dep(['activation-approved'], 'Provider readiness belongs to approved infrastructure scope.'),
-                dep(['credential-ready'], 'Runner preflight credential readiness or inapplicability precedes provider work.')
-            ],
-            applicability: {
-                kind: 'conditional',
-                discriminator: 'private-staging-dast',
-                when: 'privateStagingDast=true',
-                inapplicableWhen: 'privateStagingDast=false',
-                exclusiveWith: []
-            },
-            allowedMutations: mutations(['write-evidence'], ['azure-read', 'azure-provider-register']),
-            evidence: evidence('provider-ready.v1', true, ['azure']),
-            approvalGate: approval('infrastructure-cost', true),
-            invalidationInputs: ['provider-inventory', 'approval-envelope', 'policy'],
-            rollback: rollback('retain', null, 'Provider registrations are retained subscription capabilities.'),
-            terminalStates: ['verified', 'failed', 'inapplicable', 'retained']
-        },
-        {
-            id: 'state-path-selected',
-            label: 'Private state path is selected',
-            dependencies: [dep(['provider-ready'], 'Provider readiness precedes private state path selection.')],
-            applicability: {
-                kind: 'conditional',
-                discriminator: 'private-staging-dast',
-                when: 'privateStagingDast=true',
-                inapplicableWhen: 'privateStagingDast=false',
-                exclusiveWith: []
-            },
-            allowedMutations: mutations(['write-activation-state', 'write-evidence'], ['azure-read']),
-            evidence: evidence('state-path-selected.v1', true, ['azure']),
-            approvalGate: approval('infrastructure-cost', true),
-            invalidationInputs: ['remote-state', 'provider-inventory', 'approval-envelope'],
-            rollback: rollback('none', null, 'A changed path selection invalidates mutually exclusive descendants.'),
-            terminalStates: terminalConditional
-        },
-        {
-            id: 'existing-private-path',
-            label: 'Existing private backend management path is verified',
-            dependencies: [dep(['state-path-selected'], 'State path selection chooses this branch.')],
-            applicability: {
-                kind: 'conditional',
-                discriminator: 'state-path',
-                when: 'statePath=existing-private',
-                inapplicableWhen: 'statePath!=existing-private',
-                exclusiveWith: ['bootstrap-local']
-            },
-            allowedMutations: mutations(['write-evidence'], ['azure-read']),
-            evidence: evidence('existing-private-path.v1', true, ['azure']),
-            approvalGate: approval('none', false),
-            invalidationInputs: ['remote-state', 'live-readback'],
-            rollback: rollback('none', null, 'Existing path verification is read-only.'),
-            terminalStates: terminalConditional
-        },
-        {
-            id: 'bootstrap-local',
-            label: 'Bounded local bootstrap creates access-establishing resources',
-            dependencies: [
-                dep(['provider-ready'], 'Provider readiness precedes local bootstrap.'),
-                dep(['state-path-selected'], 'State path selection precedes local bootstrap.')
-            ],
-            applicability: {
-                kind: 'conditional',
-                discriminator: 'state-path',
-                when: 'statePath=bootstrap-local',
-                inapplicableWhen: 'statePath!=bootstrap-local',
-                exclusiveWith: ['existing-private-path']
-            },
-            allowedMutations: mutations(['write-local-state', 'write-evidence'], ['azure-network-provision', 'github-write']),
-            evidence: evidence('bootstrap-local.v1', true, ['github', 'azure']),
-            approvalGate: approval('infrastructure-cost', true),
-            invalidationInputs: ['approval-envelope', 'provider-inventory', 'remote-state'],
-            rollback: rollback('reverse-to', 'provider-ready', 'Remove only repository-owned bootstrap resources in dependency order.'),
-            terminalStates: terminalConditional
-        },
-        {
-            id: 'runner-ready',
-            label: 'Restricted larger runner is assigned and ready',
-            dependencies: [dep(['bootstrap-local'], 'Local bootstrap must establish runner networking before runner proof.')],
-            applicability: {
-                kind: 'conditional',
-                discriminator: 'state-path',
-                when: 'statePath=bootstrap-local',
-                inapplicableWhen: 'statePath!=bootstrap-local',
-                exclusiveWith: []
-            },
-            allowedMutations: mutations(['write-evidence'], ['github-read', 'github-write']),
-            evidence: evidence('runner-ready.v1', true, ['github']),
-            approvalGate: approval('infrastructure-cost', true),
-            invalidationInputs: ['runner-inventory', 'approval-envelope'],
-            rollback: rollback('reverse-to', 'bootstrap-local', 'Remove repository runner assignment before network resources.'),
-            terminalStates: terminalConditional
-        },
-        {
-            id: 'private-backend-proof',
-            label: 'Private backend is reachable from runner',
-            dependencies: [dep(['runner-ready'], 'Runner readiness precedes private backend proof.')],
-            applicability: {
-                kind: 'conditional',
-                discriminator: 'state-path',
-                when: 'statePath=bootstrap-local',
-                inapplicableWhen: 'statePath!=bootstrap-local',
-                exclusiveWith: []
-            },
-            allowedMutations: mutations(['write-evidence'], ['github-read', 'azure-read']),
-            evidence: evidence('private-backend-proof.v1', true, ['github', 'azure']),
-            approvalGate: approval('none', false),
-            invalidationInputs: ['runner-inventory', 'remote-state', 'live-readback'],
-            rollback: rollback('reverse-to', 'runner-ready', 'Failed proof keeps remote import blocked.'),
-            terminalStates: terminalConditional
-        },
-        {
-            id: 'remote-import-verified',
-            label: 'Declarative remote import and no-change plan are verified',
-            dependencies: [dep(['private-backend-proof'], 'Private backend proof precedes remote import.')],
-            applicability: {
-                kind: 'conditional',
-                discriminator: 'state-path',
-                when: 'statePath=bootstrap-local',
-                inapplicableWhen: 'statePath!=bootstrap-local',
-                exclusiveWith: []
-            },
-            allowedMutations: mutations(['write-evidence'], ['azure-state-import']),
-            evidence: evidence('remote-import-verified.v1', true, ['azure']),
-            approvalGate: approval('infrastructure-cost', true),
-            invalidationInputs: ['remote-state', 'approval-envelope'],
-            rollback: rollback('reverse-to', 'private-backend-proof', 'Failed import leaves local state retained for remediation.'),
-            terminalStates: terminalConditional
-        },
-        {
-            id: 'remote-ready',
-            label: 'Remote state is ready and local bootstrap state is frozen',
-            dependencies: [dep(['existing-private-path', 'remote-import-verified'], 'Remote readiness follows either existing private path or verified remote import.')],
-            applicability: {
-                kind: 'conditional',
-                discriminator: 'private-staging-dast',
-                when: 'privateStagingDast=true',
-                inapplicableWhen: 'privateStagingDast=false',
-                exclusiveWith: []
-            },
-            allowedMutations: mutations(['write-evidence'], ['azure-read']),
-            evidence: evidence('remote-ready.v1'),
-            approvalGate: approval('none', false),
-            invalidationInputs: ['remote-state', 'live-readback'],
-            rollback: rollback('retain', null, 'Retain local bootstrap state read-only for exactly 30 days when used.'),
-            terminalStates: ['verified', 'failed', 'inapplicable', 'retained']
-        },
-        {
-            id: 'application-foundation',
-            label: 'Application infrastructure foundation is reconciled',
-            dependencies: [dep(['remote-ready'], 'Application resources wait for remote state readiness or inapplicability.')],
-            applicability: { kind: 'always' },
-            allowedMutations: mutations(['write-evidence', 'write-openspec-governance'], ['azure-resource-provision']),
-            evidence: evidence('application-foundation.v1', true, ['azure']),
-            approvalGate: approval('infrastructure-cost', true),
-            invalidationInputs: ['project-files', 'remote-state', 'approval-envelope'],
-            rollback: rollback('reverse-to', 'remote-ready', 'Application resources are removed without unregistering providers.'),
-            terminalStates: terminalVerified
+    {
+        id: 'seed-verified',
+        label: 'Generated bootstrap baseline checks are verified',
+        dependencies: [dep(['seed-valid'], 'Seed strict validation must pass first.')],
+        applicability: { kind: 'always' },
+        allowedMutations: mutations(['read-worktree', 'write-seed-tasks', 'write-evidence']),
+        evidence: evidence('seed-verified.v1'),
+        approvalGate: approval('none', false),
+        invalidationInputs: ['project-files', 'activation-identity'],
+        rollback: rollback('none', null, 'A failed baseline leaves the seed active.'),
+        terminalStates: terminalVerified
+    },
+    {
+        id: 'seed-archived',
+        label: 'Generated bootstrap seed is synced and archived',
+        dependencies: [dep(['seed-verified'], 'Only a verified seed may be archived.')],
+        applicability: { kind: 'always' },
+        allowedMutations: mutations(['read-worktree', 'write-openspec-seed', 'write-evidence']),
+        evidence: evidence('seed-archived.v1'),
+        approvalGate: approval('none', false),
+        invalidationInputs: ['project-files', 'activation-identity'],
+        rollback: rollback('none', null, 'Archive failures keep the seed active.'),
+        terminalStates: terminalVerified
+    },
+    {
+        id: 'committed',
+        label: 'Initial repository baseline is committed',
+        dependencies: [dep(['seed-archived'], 'Generated seed must be complete before commit guidance.')],
+        applicability: { kind: 'always' },
+        allowedMutations: mutations(['read-worktree', 'git-commit', 'write-evidence']),
+        evidence: evidence('committed.v1'),
+        approvalGate: approval('repository-publish', true),
+        invalidationInputs: ['baseline-sha', 'project-files', 'approval-envelope'],
+        rollback: rollback('none', null, 'Never rewrite a committed user history automatically.'),
+        terminalStates: terminalVerified
+    },
+    {
+        id: 'pushed',
+        label: 'Initial repository baseline is pushed',
+        dependencies: [dep(['committed'], 'Commit evidence precedes initial push.')],
+        applicability: { kind: 'always' },
+        allowedMutations: mutations(['read-worktree', 'git-remote-bind', 'write-evidence'], ['git-push', 'github-read', 'github-repository-create', 'github-write']),
+        evidence: evidence('pushed.v1', true, ['github']),
+        approvalGate: approval('repository-publish', true),
+        invalidationInputs: ['baseline-sha', 'approval-envelope'],
+        rollback: rollback('none', null, 'Never force-push, delete, or rewrite refs.'),
+        terminalStates: terminalVerified
+    },
+    {
+        id: 'phase-0-complete',
+        label: 'Read-only Phase 0 discovery is complete',
+        dependencies: [dep(['pushed'], 'Remote repository identity must be resolvable.')],
+        applicability: { kind: 'always' },
+        allowedMutations: mutations(['write-evidence'], ['github-read', 'azure-read']),
+        evidence: evidence('phase-0-complete.v1', true, ['github']),
+        approvalGate: approval('none', false),
+        invalidationInputs: ['baseline-sha', 'policy', 'live-readback'],
+        rollback: rollback('none', null, 'Discovery is read-only and can be refreshed.'),
+        terminalStates: terminalVerified
+    },
+    {
+        id: 'activation-approved',
+        label: 'Governance activation plan is approved',
+        dependencies: [dep(['phase-0-complete'], 'Approval reviews Phase 0 evidence.')],
+        applicability: { kind: 'always' },
+        allowedMutations: mutations(['write-openspec-governance', 'write-activation-state', 'write-evidence']),
+        evidence: evidence('activation-approved.v1', false),
+        approvalGate: approval('activation-plan', true),
+        invalidationInputs: ['baseline-sha', 'approval-envelope', 'policy'],
+        rollback: rollback('none', null, 'Approval expiry returns descendants to blocked.'),
+        terminalStates: terminalApproved
+    },
+    {
+        id: 'bootstrap-workflow-source-ready',
+        label: 'Scoped bootstrap verification workflows are published',
+        dependencies: [dep(['activation-approved'], 'Bootstrap workflow publication requires the reviewed activation scope.')],
+        applicability: { kind: 'always' },
+        allowedMutations: mutations(['read-worktree', 'write-workflows', 'git-commit', 'write-evidence'], ['git-push', 'github-read', 'github-write']),
+        evidence: evidence('bootstrap-workflow-source-ready.v1', true, ['github']),
+        approvalGate: approval('repository-publish', true),
+        invalidationInputs: ['workflow-source', 'approval-envelope', 'baseline-sha'],
+        rollback: rollback('none', null, 'Preserve published history; repair only the approved workflow scope.'),
+        terminalStates: terminalVerified
+    },
+    {
+        id: 'credential-ready',
+        label: 'Runner preflight credential policy is ready when required',
+        dependencies: [dep(['bootstrap-workflow-source-ready'], 'Credential use is verified through the published approved bootstrap workflow.')],
+        applicability: {
+            kind: 'conditional',
+            discriminator: 'credential-required',
+            when: 'credentialRequired=true',
+            inapplicableWhen: 'credentialRequired=false',
+            exclusiveWith: []
         },
-        {
-            id: 'workflow-source-ready',
-            label: 'Workflow source and ruleset payloads are ready',
-            dependencies: [dep(['application-foundation'], 'Workflow source targets the reconciled application foundation.')],
-            applicability: { kind: 'always' },
-            allowedMutations: mutations(['write-workflows', 'write-ruleset-source', 'write-evidence']),
-            evidence: evidence('workflow-source-ready.v1'),
-            approvalGate: approval('none', false),
-            invalidationInputs: ['project-files', 'policy'],
-            rollback: rollback('reverse-to', 'application-foundation', 'Remove or repair only workflow/ruleset source changes.'),
-            terminalStates: terminalVerified
+        allowedMutations: mutations(['write-credential-policy', 'write-evidence'], ['github-secret-write', 'github-read', 'github-workflow-dispatch']),
+        evidence: evidence('credential-ready.v1', true, ['github']),
+        approvalGate: approval('credential-enrollment', true),
+        invalidationInputs: ['credentials', 'approval-envelope', 'activation-identity'],
+        rollback: rollback('none', null, 'Leaked or expired credentials block use and require rotation.'),
+        terminalStates: terminalConditional
+    },
+    {
+        id: 'provider-ready',
+        label: 'Azure provider namespaces are terminal ready',
+        dependencies: [
+            dep(['activation-approved'], 'Provider readiness belongs to approved infrastructure scope.'),
+            dep(['credential-ready'], 'Runner preflight credential readiness or inapplicability precedes provider work.')
+        ],
+        applicability: { kind: 'always' },
+        allowedMutations: mutations(['write-evidence'], ['azure-read', 'azure-provider-register']),
+        evidence: evidence('provider-ready.v1', true, ['azure']),
+        approvalGate: approval('infrastructure-cost', true),
+        invalidationInputs: ['provider-inventory', 'approval-envelope', 'policy'],
+        rollback: rollback('retain', null, 'Provider registrations are retained subscription capabilities.'),
+        terminalStates: ['verified', 'failed', 'inapplicable', 'retained']
+    },
+    {
+        id: 'state-path-selected',
+        label: 'Private state path is selected',
+        dependencies: [dep(['provider-ready'], 'Provider readiness precedes private state path selection.')],
+        applicability: {
+            kind: 'conditional',
+            discriminator: 'cloud-state-required',
+            when: 'cloudStateRequired=true',
+            inapplicableWhen: 'cloudStateRequired=false',
+            exclusiveWith: []
         },
-        {
-            id: 'dev-proof',
-            label: 'Development proof is green',
-            dependencies: [dep(['workflow-source-ready'], 'Workflow source must exist before proving checks.')],
-            applicability: { kind: 'always' },
-            allowedMutations: mutations(['write-evidence'], ['github-read']),
-            evidence: evidence('dev-proof.v1', true, ['github']),
-            approvalGate: approval('none', false),
-            invalidationInputs: ['workflow-source', 'project-files'],
-            rollback: rollback('none', null, 'A failed check blocks descendants until fixed.'),
-            terminalStates: terminalVerified
+        allowedMutations: mutations(['write-activation-state', 'write-evidence'], ['azure-read']),
+        evidence: evidence('state-path-selected.v1', true, ['azure']),
+        approvalGate: approval('infrastructure-cost', true),
+        invalidationInputs: ['remote-state', 'provider-inventory', 'approval-envelope'],
+        rollback: rollback('none', null, 'A changed path selection invalidates mutually exclusive descendants.'),
+        terminalStates: terminalConditional
+    },
+    {
+        id: 'existing-private-path',
+        label: 'Existing private backend management path is verified',
+        dependencies: [dep(['state-path-selected'], 'State path selection chooses this branch.')],
+        applicability: {
+            kind: 'conditional',
+            discriminator: 'state-path',
+            when: 'statePath=existing-private',
+            inapplicableWhen: 'statePath!=existing-private',
+            exclusiveWith: ['bootstrap-local']
         },
-        {
-            id: 'staging-qualified',
-            label: 'Staging release qualification is complete',
-            dependencies: [dep(['dev-proof'], 'Development proof precedes staging qualification.')],
-            applicability: { kind: 'always' },
-            allowedMutations: mutations(['write-evidence'], ['github-read', 'azure-read']),
-            evidence: evidence('staging-qualified.v1', true, ['github', 'azure']),
-            approvalGate: approval('none', false),
-            invalidationInputs: ['workflow-source', 'security-evidence', 'live-readback'],
-            rollback: rollback('none', null, 'Qualification failures keep production blocked.'),
-            terminalStates: terminalVerified
+        allowedMutations: mutations(['write-evidence'], ['azure-read', 'github-read', 'backend-state-read']),
+        evidence: evidence('existing-private-path.v1', true, ['azure']),
+        approvalGate: approval('none', false),
+        invalidationInputs: ['remote-state', 'live-readback'],
+        rollback: rollback('none', null, 'Existing path verification is read-only.'),
+        terminalStates: terminalConditional
+    },
+    {
+        id: 'bootstrap-local',
+        label: 'Bounded local bootstrap creates access-establishing resources',
+        dependencies: [
+            dep(['provider-ready'], 'Provider readiness precedes local bootstrap.'),
+            dep(['state-path-selected'], 'State path selection precedes local bootstrap.')
+        ],
+        applicability: {
+            kind: 'conditional',
+            discriminator: 'state-path',
+            when: 'statePath=bootstrap-local',
+            inapplicableWhen: 'statePath!=bootstrap-local',
+            exclusiveWith: ['existing-private-path']
         },
-        {
-            id: 'production-rehearsed',
-            label: 'Production promotion and rollback are rehearsed',
-            dependencies: [dep(['staging-qualified'], 'Only a staging-qualified candidate may be rehearsed.')],
-            applicability: { kind: 'always' },
-            allowedMutations: mutations(['write-evidence'], ['github-read', 'azure-read']),
-            evidence: evidence('production-rehearsed.v1', true, ['github', 'azure']),
-            approvalGate: approval('none', false),
-            invalidationInputs: ['live-readback', 'workflow-source'],
-            rollback: rollback('none', null, 'Rollback remains ungated and documented.'),
-            terminalStates: terminalVerified
+        allowedMutations: mutations(['read-worktree', 'write-local-state', 'write-evidence'], ['azure-network-provision', 'azure-read']),
+        evidence: evidence('bootstrap-local.v1', true, ['azure']),
+        approvalGate: approval('infrastructure-cost', true),
+        invalidationInputs: ['approval-envelope', 'provider-inventory', 'remote-state'],
+        rollback: rollback('reverse-to', 'provider-ready', 'Remove only repository-owned bootstrap resources in dependency order.'),
+        terminalStates: terminalConditional
+    },
+    {
+        id: 'runner-ready',
+        label: 'Restricted larger runner is assigned and ready',
+        dependencies: [dep(['bootstrap-local'], 'Local bootstrap must establish runner networking before runner proof.')],
+        applicability: {
+            kind: 'conditional',
+            discriminator: 'state-path',
+            when: 'statePath=bootstrap-local',
+            inapplicableWhen: 'statePath!=bootstrap-local',
+            exclusiveWith: []
         },
-        {
-            id: 'green-red-proof',
-            label: 'Required checks are proven green and deliberately red',
-            dependencies: [dep(['production-rehearsed'], 'Promotion rehearsal precedes final context proof.')],
-            applicability: { kind: 'always' },
-            allowedMutations: mutations(['write-evidence'], ['github-read']),
-            evidence: evidence('green-red-proof.v1', true, ['github']),
-            approvalGate: approval('none', false),
-            invalidationInputs: ['security-evidence', 'workflow-source'],
-            rollback: rollback('none', null, 'Missing red proof prevents enforcement.'),
-            terminalStates: terminalVerified
+        allowedMutations: mutations(['write-evidence'], ['github-read', 'github-write', 'github-workflow-dispatch']),
+        evidence: evidence('runner-ready.v1', true, ['github']),
+        approvalGate: approval('infrastructure-cost', true),
+        invalidationInputs: ['runner-inventory', 'approval-envelope'],
+        rollback: rollback('reverse-to', 'bootstrap-local', 'Remove repository runner assignment before network resources.'),
+        terminalStates: terminalConditional
+    },
+    {
+        id: 'private-backend-proof',
+        label: 'Private backend is reachable from runner',
+        dependencies: [dep(['runner-ready'], 'Runner readiness precedes private backend proof.')],
+        applicability: {
+            kind: 'conditional',
+            discriminator: 'state-path',
+            when: 'statePath=bootstrap-local',
+            inapplicableWhen: 'statePath!=bootstrap-local',
+            exclusiveWith: []
         },
-        {
-            id: 'enforcement-approved',
-            label: 'Final ruleset enforcement is approved',
-            dependencies: [dep(['green-red-proof'], 'Only exact green/red evidence may request enforcement.')],
-            applicability: { kind: 'always' },
-            allowedMutations: mutations(['write-activation-state', 'write-evidence']),
-            evidence: evidence('enforcement-approved.v1', false),
-            approvalGate: approval('enforcement', true),
-            invalidationInputs: ['approval-envelope', 'ruleset-readback'],
-            rollback: rollback('none', null, 'Approval expiry blocks ruleset application.'),
-            terminalStates: terminalApproved
+        allowedMutations: mutations(['write-evidence'], ['github-read', 'github-workflow-dispatch', 'azure-read', 'backend-state-read']),
+        evidence: evidence('private-backend-proof.v1', true, ['github', 'azure']),
+        approvalGate: approval('activation-plan', true),
+        invalidationInputs: ['runner-inventory', 'remote-state', 'live-readback'],
+        rollback: rollback('reverse-to', 'runner-ready', 'Failed proof keeps remote import blocked.'),
+        terminalStates: terminalConditional
+    },
+    {
+        id: 'remote-import-verified',
+        label: 'Declarative remote import and no-change plan are verified',
+        dependencies: [dep(['private-backend-proof'], 'Private backend proof precedes remote import.')],
+        applicability: {
+            kind: 'conditional',
+            discriminator: 'state-path',
+            when: 'statePath=bootstrap-local',
+            inapplicableWhen: 'statePath!=bootstrap-local',
+            exclusiveWith: []
         },
-        {
-            id: 'rulesets-applied',
-            label: 'Repository rulesets are applied idempotently last',
-            dependencies: [dep(['enforcement-approved'], 'Final enforcement approval precedes ruleset mutation.')],
-            applicability: { kind: 'always' },
-            allowedMutations: mutations(['write-evidence'], ['github-ruleset-write', 'github-read']),
-            evidence: evidence('rulesets-applied.v1', true, ['github']),
-            approvalGate: approval('enforcement', true),
-            invalidationInputs: ['approval-envelope', 'ruleset-readback'],
-            rollback: rollback('reverse-to', 'green-red-proof', 'Rulesets can be disabled or repaired without approval-gating rollback.'),
-            terminalStates: terminalVerified
+        allowedMutations: mutations(['write-evidence'], ['azure-state-import', 'azure-read', 'backend-state-read', 'backend-state-write']),
+        evidence: evidence('remote-import-verified.v1', true, ['azure']),
+        approvalGate: approval('infrastructure-cost', true),
+        invalidationInputs: ['remote-state', 'approval-envelope'],
+        rollback: rollback('reverse-to', 'private-backend-proof', 'Failed import leaves local state retained for remediation.'),
+        terminalStates: terminalConditional
+    },
+    {
+        id: 'remote-ready',
+        label: 'Remote state is ready and local bootstrap state is frozen',
+        dependencies: [dep(['existing-private-path', 'remote-import-verified'], 'Remote readiness follows either existing private path or verified remote import.')],
+        applicability: {
+            kind: 'conditional',
+            discriminator: 'cloud-state-required',
+            when: 'cloudStateRequired=true',
+            inapplicableWhen: 'cloudStateRequired=false',
+            exclusiveWith: []
         },
-        {
-            id: 'live-readback',
-            label: 'Live enforcement readback matches source',
-            dependencies: [dep(['rulesets-applied'], 'Live readback follows ruleset application.')],
-            applicability: { kind: 'always' },
-            allowedMutations: mutations(['write-evidence'], ['github-read']),
-            evidence: evidence('live-readback.v1', true, ['github']),
-            approvalGate: approval('none', false),
-            invalidationInputs: ['ruleset-readback', 'live-readback'],
-            rollback: rollback('reverse-to', 'rulesets-applied', 'Mismatched live readback blocks completion.'),
-            terminalStates: terminalVerified
+        allowedMutations: mutations(['write-evidence'], ['azure-read', 'backend-state-read']),
+        evidence: evidence('remote-ready.v1'),
+        approvalGate: approval('none', false),
+        invalidationInputs: ['remote-state', 'live-readback'],
+        rollback: rollback('retain', null, 'Retain local bootstrap state read-only for exactly 30 days when used.'),
+        terminalStates: ['verified', 'failed', 'inapplicable', 'retained']
+    },
+    {
+        id: 'application-prerequisites-ready',
+        label: 'Application registry and workload identity prerequisites are ready',
+        dependencies: [dep(['remote-ready'], 'Registry and identity prerequisites require verified backend readiness.')],
+        applicability: { kind: 'always' },
+        allowedMutations: mutations(['read-worktree', 'write-evidence', 'write-openspec-governance'], ['azure-resource-provision', 'azure-read', 'backend-state-read', 'backend-state-write']),
+        evidence: evidence('application-prerequisites-ready.v1', true, ['azure']),
+        approvalGate: approval('infrastructure-cost', true),
+        invalidationInputs: ['project-files', 'remote-state', 'approval-envelope'],
+        rollback: rollback('reverse-to', 'remote-ready', 'Compensate only owned prerequisites within the approved recovery scope.'),
+        terminalStates: terminalVerified
+    },
+    {
+        id: 'workflow-source-ready',
+        label: 'Workflow source and ruleset payloads are ready',
+        dependencies: [dep(['application-prerequisites-ready'], 'Workflow source binds the verified registry and workload identities.')],
+        applicability: { kind: 'always' },
+        allowedMutations: mutations(['read-worktree', 'write-workflows', 'write-ruleset-source', 'write-evidence']),
+        evidence: evidence('workflow-source-ready.v1'),
+        approvalGate: approval('none', false),
+        invalidationInputs: ['project-files', 'policy'],
+        rollback: rollback('reverse-to', 'application-prerequisites-ready', 'Repair only approved workflow/ruleset changes without rewriting Git history.'),
+        terminalStates: terminalVerified
+    },
+    {
+        id: 'application-artifact-ready',
+        label: 'Immutable application artifacts are built and published from approved source',
+        dependencies: [dep(['workflow-source-ready'], 'The reviewed build workflow must be published before artifact production.')],
+        applicability: { kind: 'always' },
+        allowedMutations: mutations(['read-worktree', 'write-evidence'], ['github-read', 'github-workflow-dispatch', 'registry-publish', 'azure-read']),
+        evidence: evidence('application-artifact-ready.v1', true, ['github', 'azure']),
+        approvalGate: approval('infrastructure-cost', true),
+        invalidationInputs: ['project-files', 'workflow-source', 'approval-envelope'],
+        rollback: rollback('retain', null, 'Keep immutable published artifacts; never replace an existing digest.'),
+        terminalStates: terminalVerified
+    },
+    {
+        id: 'application-foundation',
+        label: 'Application infrastructure is deployed with the verified immutable artifact',
+        dependencies: [dep(['application-artifact-ready'], 'Deployment requires real source-bound immutable application artifacts.')],
+        applicability: { kind: 'always' },
+        allowedMutations: mutations(['read-worktree', 'write-evidence', 'write-openspec-governance'], ['azure-resource-provision', 'azure-read', 'backend-state-read', 'backend-state-write']),
+        evidence: evidence('application-foundation.v1', true, ['azure']),
+        approvalGate: approval('infrastructure-cost', true),
+        invalidationInputs: ['project-files', 'remote-state', 'approval-envelope'],
+        rollback: rollback('reverse-to', 'application-artifact-ready', 'Recover only approved owned resources; never unregister shared providers.'),
+        terminalStates: terminalVerified
+    },
+    {
+        id: 'dev-proof',
+        label: 'Development proof is green',
+        dependencies: [dep(['application-foundation'], 'The real application deployment precedes development proof.')],
+        applicability: { kind: 'always' },
+        allowedMutations: mutations(['write-evidence'], ['github-read', 'github-workflow-dispatch']),
+        evidence: evidence('dev-proof.v1', true, ['github']),
+        approvalGate: approval('activation-plan', true),
+        invalidationInputs: ['workflow-source', 'project-files'],
+        rollback: rollback('none', null, 'A failed check blocks descendants until fixed.'),
+        terminalStates: terminalVerified
+    },
+    {
+        id: 'staging-qualified',
+        label: 'Staging release qualification is complete',
+        dependencies: [dep(['dev-proof'], 'Development proof precedes staging qualification.')],
+        applicability: { kind: 'always' },
+        allowedMutations: mutations(['write-evidence'], ['github-read', 'github-workflow-dispatch', 'azure-read', 'azure-resource-provision', 'backend-state-write']),
+        evidence: evidence('staging-qualified.v1', true, ['github', 'azure']),
+        approvalGate: approval('infrastructure-cost', true),
+        invalidationInputs: ['workflow-source', 'security-evidence', 'live-readback'],
+        rollback: rollback('none', null, 'Qualification failures keep production blocked.'),
+        terminalStates: terminalVerified
+    },
+    {
+        id: 'production-rehearsed',
+        label: 'Production promotion and rollback are rehearsed',
+        dependencies: [dep(['staging-qualified'], 'Only a staging-qualified candidate may be rehearsed.')],
+        applicability: { kind: 'always' },
+        allowedMutations: mutations(['write-evidence'], ['github-read', 'github-workflow-dispatch', 'azure-read', 'azure-resource-provision', 'backend-state-write']),
+        evidence: evidence('production-rehearsed.v1', true, ['github', 'azure']),
+        approvalGate: approval('infrastructure-cost', true),
+        invalidationInputs: ['live-readback', 'workflow-source'],
+        rollback: rollback('none', null, 'Rollback remains ungated and documented.'),
+        terminalStates: terminalVerified
+    },
+    {
+        id: 'green-red-proof',
+        label: 'Required checks are proven green and deliberately red',
+        dependencies: [dep(['production-rehearsed'], 'Promotion rehearsal precedes final context proof.')],
+        applicability: { kind: 'always' },
+        allowedMutations: mutations(['write-evidence'], ['github-read', 'github-workflow-dispatch']),
+        evidence: evidence('green-red-proof.v1', true, ['github']),
+        approvalGate: approval('activation-plan', true),
+        invalidationInputs: ['security-evidence', 'workflow-source'],
+        rollback: rollback('none', null, 'Missing red proof prevents enforcement.'),
+        terminalStates: terminalVerified
+    },
+    {
+        id: 'enforcement-approved',
+        label: 'Final ruleset enforcement is approved',
+        dependencies: [dep(['green-red-proof'], 'Only exact green/red evidence may request enforcement.')],
+        applicability: { kind: 'always' },
+        allowedMutations: mutations(['write-activation-state', 'write-evidence']),
+        evidence: evidence('enforcement-approved.v1', false),
+        approvalGate: approval('enforcement', true),
+        invalidationInputs: ['approval-envelope', 'ruleset-readback'],
+        rollback: rollback('none', null, 'Approval expiry blocks ruleset application.'),
+        terminalStates: terminalApproved
+    },
+    {
+        id: 'rulesets-applied',
+        label: 'Repository rulesets are applied idempotently last',
+        dependencies: [dep(['enforcement-approved'], 'Final enforcement approval precedes ruleset mutation.')],
+        applicability: { kind: 'always' },
+        allowedMutations: mutations(['write-evidence'], ['github-ruleset-write', 'github-read']),
+        evidence: evidence('rulesets-applied.v1', true, ['github']),
+        approvalGate: approval('enforcement', true),
+        invalidationInputs: ['approval-envelope', 'ruleset-readback'],
+        rollback: rollback('reverse-to', 'green-red-proof', 'Rulesets can be disabled or repaired without approval-gating rollback.'),
+        terminalStates: terminalVerified
+    },
+    {
+        id: 'live-readback',
+        label: 'Live enforcement readback matches source',
+        dependencies: [dep(['rulesets-applied'], 'Live readback follows ruleset application.')],
+        applicability: { kind: 'always' },
+        allowedMutations: mutations(['write-evidence'], ['github-read']),
+        evidence: evidence('live-readback.v1', true, ['github']),
+        approvalGate: approval('none', false),
+        invalidationInputs: ['ruleset-readback', 'live-readback'],
+        rollback: rollback('reverse-to', 'rulesets-applied', 'Mismatched live readback blocks completion.'),
+        terminalStates: terminalVerified
+    },
+    {
+        id: 'bootstrap-state-disposed',
+        label: 'Retained local bootstrap state is disposed after day 30',
+        dependencies: [dep(['live-readback'], 'Disposal is scheduled only after live enforcement readback.')],
+        applicability: {
+            kind: 'conditional',
+            discriminator: 'state-path',
+            when: 'statePath=bootstrap-local',
+            inapplicableWhen: 'statePath!=bootstrap-local',
+            exclusiveWith: []
         },
-        {
-            id: 'bootstrap-state-disposed',
-            label: 'Retained local bootstrap state is disposed after day 30',
-            dependencies: [dep(['live-readback'], 'Disposal is scheduled only after live enforcement readback.')],
-            applicability: {
-                kind: 'conditional',
-                discriminator: 'state-path',
-                when: 'statePath=bootstrap-local',
-                inapplicableWhen: 'statePath!=bootstrap-local',
-                exclusiveWith: []
-            },
-            allowedMutations: mutations(['delete-local-state', 'write-evidence']),
-            evidence: evidence('bootstrap-state-disposed.v1'),
-            approvalGate: approval('destructive-disposal', true),
-            invalidationInputs: ['remote-state', 'approval-envelope'],
-            rollback: rollback('dispose', null, 'Deletion destroys only the local encryption key and records no payload.'),
-            terminalStates: ['disposed', 'failed', 'inapplicable']
-        }
-    ]
+        allowedMutations: mutations(['delete-local-state', 'write-evidence']),
+        evidence: evidence('bootstrap-state-disposed.v1'),
+        approvalGate: approval('destructive-disposal', true),
+        invalidationInputs: ['remote-state', 'approval-envelope'],
+        rollback: rollback('dispose', null, 'Deletion destroys only the local encryption key and records no payload.'),
+        terminalStates: ['disposed', 'failed', 'inapplicable']
+    }
+];
+export const canonicalPhaseGraph = {
+    schemaVersion: phaseGraphSchemaVersion,
+    versions: {
+        liftoffVersion: liftoffActivationPackageVersion,
+        policyVersion: governanceActivationPolicyVersion,
+        activationContractVersion,
+        phaseGraphSchemaVersion
+    },
+    completionGroups: {
+        local: localSetupPhaseIds,
+        activation: activationPhaseIds,
+        lifecycle: lifecyclePhaseIds
+    },
+    phases: rawPhases
 };
 function phaseBehavior(node) {
     return {