@msn-control/liftoff 0.9.0 → 0.9.2

package/dist/commands.js

@@ -5,11 +5,11 @@ import { cp, lstat, mkdir, mkdtemp, readFile, readdir, readlink, rm, stat } from
 import os from 'node:os';
 import path from 'node:path';
 import { getCommandHelp, getGeneralHelp, readBooleanFlag, readListFlag, readStringFlag } from './args.js';
-import { getCodingAgent, getFrameworkDefinition, getSpecWorkflow, listRegions, patterns, providers, searchRegions } from './catalogs.js';
+import { getCodingAgent, getEnvironment, getFrameworkDefinition, getSpecWorkflow, listRegions, patterns, providers, searchRegions } from './catalogs.js';
 import { probeCodeAppsPlugin } from './code-apps-plugin.js';
 import { initializeFramework } from './framework-adapters.js';
 import { validateFrameworkInstallation } from './framework-validation.js';
-import { artifactPath, applyProjectFileTransaction, assertNewOrEmptyDirectory, captureProjectFileSnapshot, findProjectRoot, loadManifest, manifestHadFilteredLegacySeedOwnership, manifestDisplayPath, resolveProjectPath, validateGeneratedProject, writeArtifacts, writeProjectFile } from './file-system.js';
+import { artifactPath, applyProjectFileTransaction, assertNewOrEmptyDirectory, captureProjectFileSnapshot, findProjectRoot, loadManifest, manifestHadFilteredLegacyNonDurableOwnership, manifestDisplayPath, readProjectFile, resolveProjectPath, validateGeneratedProject, writeArtifacts, writeProjectFile } from './file-system.js';
 import { InteractiveCancelledError, InteractivePrompter } from './interactive.js';
 import { applyMergePreflight, assertSafeInitTarget, authorizeMergePreflight, buildMergePreflight, captureTreeState, discoverGitRoot, resolveInitTargetFromDiscovery, validateStagedTree, withStagingArea, writeStagedArtifacts } from './init-filesystem.js';
 import { renderMigrationChecklist, renderMigrationProposal, renderMigrationTasks, seedMigrationGroups } from './migrate-plan.js';
@@ -166,7 +166,7 @@ async function initCommand(parsed, context) {
         presentation.stage('Stage project files');
         const staged = await withStagingArea(async (area) => {
             const partition = partitionGeneratedArtifacts(buildArtifacts(plan));
-            await writeStagedArtifacts(area, partition.durable, 'liftoff');
+            await writeStagedArtifacts(area, partition.liftoff, 'liftoff');
             presentation.stage('Initialize spec-driven framework', `${plan.specWorkflow.label} ${plan.framework.version}`);
             await initializeFramework(area, plan, runner, {
                 env: context.env,
@@ -255,7 +255,13 @@ async function planCommand(parsed, context) {
     const plan = buildProjectPlan(options, { requireProjectName: false });
     const artifacts = buildArtifacts(plan);
     presentation.definitions('Project decisions', projectPlanEntries(plan));
-    presentation.table(`Artifacts (${artifacts.length})`, ['Artifact', 'Path'], artifacts.map((artifact) => [artifact.logicalName, artifact.pathParts.join('/')]));
+    presentation.table(`Artifacts (${artifacts.length})`, ['Artifact', 'Lifecycle', 'Path'], artifacts.map((artifact) => [
+        artifact.logicalName,
+        artifact.lifecycle === 'project'
+            ? `${artifact.lifecycle} (${artifact.provisioningGroup})`
+            : artifact.lifecycle,
+        artifact.pathParts.join('/')
+    ]));
     const workstationRows = selectWorkstationRequirements(plan).map((requirement) => [
         requirement.definition.label,
         requirement.exactVersion
@@ -458,7 +464,7 @@ async function handleProjectDependencies(plan, projectRoot, options, probes, con
     if (plan.workload === 'power-apps-code-app') {
         const issues = await verifyPowerAppsPackageMetadata(projectRoot);
         if (issues.length > 0) {
-            presentation.error('Power Apps dependency installation blocked', `${issues.join(' ')} Restore package.json and package-lock.json or run \`liftoff update\`.`);
+            presentation.error('Power Apps dependency installation blocked', `${issues.join(' ')} Repair the project-owned package.json and package-lock.json before installing dependencies.`);
             return { success: false, deferred: [] };
         }
     }
@@ -617,12 +623,14 @@ function migrationPlanArtifacts(plan, inventory) {
                 {
                     logicalName: 'migration-proposal',
                     category: 'seed',
+                    lifecycle: 'seed',
                     pathParts: ['openspec', 'changes', 'migrate-to-liftoff', 'proposal.md'],
                     content: renderMigrationProposal(plan, inventory)
                 },
                 {
                     logicalName: 'migration-tasks',
                     category: 'seed',
+                    lifecycle: 'seed',
                     pathParts: ['openspec', 'changes', 'migrate-to-liftoff', 'tasks.md'],
                     content: renderMigrationTasks(groups)
                 }
@@ -634,6 +642,7 @@ function migrationPlanArtifacts(plan, inventory) {
         artifacts: [{
                 logicalName: 'migration-checklist',
                 category: 'seed',
+                lifecycle: 'seed',
                 pathParts: ['MIGRATION.md'],
                 content: renderMigrationChecklist(plan, inventory, groups)
             }],
@@ -729,7 +738,7 @@ async function executeMigration(parsed, context, sourceRoot) {
         presentation.stage('Stage fresh migration project');
         await withStagingArea(async (area) => {
             const partition = partitionGeneratedArtifacts(buildArtifacts(plan));
-            await writeStagedArtifacts(area, partition.durable, 'liftoff');
+            await writeStagedArtifacts(area, partition.liftoff, 'liftoff');
             presentation.stage('Initialize spec-driven framework', `${plan.specWorkflow.label} ${plan.framework.version}`);
             await initializeFramework(area, plan, runner, {
                 env: context.env,
@@ -829,7 +838,7 @@ async function migrateCommand(parsed, context) {
         return 1;
     }
     if (existsSync(path.join(sourceRoot, 'liftoff.manifest.json'))) {
-        context.presentation.error(`${sourceRoot} is already a Liftoff project.`, 'Use `liftoff update` instead.');
+        context.presentation.error(`${sourceRoot} is already a Liftoff project.`, 'Use `liftoff update` for managed-core maintenance; in-place project template migration is not automated.');
         return 1;
     }
     context.presentation.identity('Migrate an existing application into a fresh Liftoff project');
@@ -885,6 +894,151 @@ function isDirtyGitWorktree(projectRoot) {
     const result = spawnSync('git', ['status', '--porcelain'], { cwd: projectRoot, encoding: 'utf8' });
     return result.status === 0 && result.stdout.trim().length > 0;
 }
+function requestedProvisioningGroups(manifest, plan) {
+    if (plan.workload === 'power-apps-code-app' ||
+        manifest.project.workload.kind === 'power-apps-code-app') {
+        return [];
+    }
+    const provisioned = new Set(manifest.projectArtifacts.map((artifact) => artifact.provisioningGroup));
+    const groups = [];
+    if (plan.includeFrontend &&
+        !manifest.project.workload.frontend &&
+        !provisioned.has('frontend')) {
+        groups.push('frontend');
+    }
+    const recordedEnvironments = new Set(manifest.project.workload.environments);
+    for (const environment of plan.environments) {
+        const group = `environment:${environment.id}`;
+        if (!recordedEnvironments.has(environment.id) &&
+            !provisioned.has(group)) {
+            groups.push(group);
+        }
+    }
+    return groups;
+}
+async function inspectProvisioningGroups(projectRoot, render, groups) {
+    const projectArtifacts = render.filter((artifact) => artifact.lifecycle === 'project');
+    const plans = [];
+    for (const group of groups) {
+        const artifacts = projectArtifacts.filter((artifact) => artifact.provisioningGroup === group);
+        if (artifacts.length === 0) {
+            throw new Error(`Provisioning group ${group} did not render any project artifacts.`);
+        }
+        const entries = await Promise.all(artifacts.map(async (artifact) => {
+            const disk = await readProjectFile(projectRoot, artifact.pathParts);
+            if (disk === undefined) {
+                return {
+                    group,
+                    status: 'create',
+                    rendered: artifact,
+                    reason: 'destination is absent'
+                };
+            }
+            if (disk.toString('utf8') === artifact.content) {
+                return {
+                    group,
+                    status: 'adopt',
+                    rendered: artifact,
+                    reason: 'destination already matches the selected component'
+                };
+            }
+            return {
+                group,
+                status: 'conflict',
+                rendered: artifact,
+                reason: 'destination contains project-owned bytes'
+            };
+        }));
+        plans.push({
+            group,
+            entries,
+            blocked: entries.some((entry) => entry.status === 'conflict')
+        });
+    }
+    return plans;
+}
+function provisioningJson(plans) {
+    return plans.map((plan) => ({
+        group: plan.group,
+        status: plan.blocked ? 'blocked' : 'ready',
+        entries: plan.entries.map((entry) => ({
+            status: entry.status,
+            path: manifestDisplayPath(entry.rendered.pathParts),
+            reason: entry.reason
+        }))
+    }));
+}
+function projectProvenanceFor(artifact) {
+    return {
+        logicalName: artifact.logicalName,
+        category: artifact.category,
+        pathParts: artifact.pathParts,
+        generatedBy: liftoffVersion,
+        generationHash: `sha256:${createHash('sha256').update(artifact.content, 'utf8').digest('hex')}`,
+        provisioningGroup: artifact.provisioningGroup
+    };
+}
+function appendProvisionedProjectArtifacts(existing, plans) {
+    const byName = new Map(existing.map((artifact) => [artifact.logicalName, artifact]));
+    for (const plan of plans) {
+        if (plan.blocked) {
+            continue;
+        }
+        for (const entry of plan.entries) {
+            if (!byName.has(entry.rendered.logicalName)) {
+                byName.set(entry.rendered.logicalName, projectProvenanceFor(entry.rendered));
+            }
+        }
+    }
+    return [...byName.values()];
+}
+function sameWorkloadIntent(left, right) {
+    if (left.kind !== right.kind) {
+        return false;
+    }
+    if (left.kind === 'power-apps-code-app' && right.kind === 'power-apps-code-app') {
+        return left.codeAppsPlugin === right.codeAppsPlugin &&
+            left.starter.repository === right.starter.repository &&
+            left.starter.path === right.starter.path &&
+            left.starter.commit === right.starter.commit;
+    }
+    if (left.kind === 'power-apps-code-app' || right.kind === 'power-apps-code-app') {
+        return false;
+    }
+    return left.apiStack === right.apiStack &&
+        left.cloud === right.cloud &&
+        left.region === right.region &&
+        left.frontend === right.frontend &&
+        left.environments.length === right.environments.length &&
+        left.environments.every((environment, index) => environment === right.environments[index]) &&
+        (left.kind !== 'genai' || right.kind !== 'genai' || left.pattern === right.pattern);
+}
+function planWithBlockedProvisioning(plan, recordedWorkload, provisioningPlans) {
+    if (plan.workload === 'power-apps-code-app' ||
+        recordedWorkload.kind === 'power-apps-code-app') {
+        return plan;
+    }
+    const blockedGroups = new Set(provisioningPlans
+        .filter((group) => group.blocked)
+        .map((group) => group.group));
+    const hasBlockedEnvironment = [...blockedGroups].some((group) => group.startsWith('environment:'));
+    const environments = hasBlockedEnvironment
+        ? recordedWorkload.environments.map((id) => {
+            const environment = getEnvironment(id);
+            if (!environment) {
+                throw new Error(`Recorded environment ${id} is no longer supported.`);
+            }
+            return environment;
+        })
+        : plan.environments;
+    return {
+        ...plan,
+        includeFrontend: blockedGroups.has('frontend')
+            ? recordedWorkload.frontend
+            : plan.includeFrontend,
+        environments
+    };
+}
 async function preflightUpdate(projectRoot, entries, force) {
     for (const entry of entries) {
         const writesDestination = entry.status === 'new' ||
@@ -909,10 +1063,8 @@ async function captureUpdateSnapshots(projectRoot, manifest, render, initialSnap
     const snapshots = new Map(initialSnapshots.map((snapshot) => [updateSnapshotKey(snapshot.pathParts), snapshot]));
     const seenKeys = new Set(snapshots.keys());
     const candidates = [
-        ...manifest.artifacts.map((artifact) => artifact.pathParts),
-        ...render
-            .filter((artifact) => artifact.category !== 'seed' && artifact.category !== 'framework')
-            .map((artifact) => artifact.pathParts)
+        ...manifest.managedArtifacts.map((artifact) => artifact.pathParts),
+        ...render.map((artifact) => artifact.pathParts)
     ];
     const uncaptured = [];
     for (const pathParts of candidates) {
@@ -927,10 +1079,11 @@ async function captureUpdateSnapshots(projectRoot, manifest, render, initialSnap
     }
     return [...snapshots.values()];
 }
-function selectUpdatePreconditions(snapshots, entries, mutations) {
+function selectUpdatePreconditions(snapshots, entries, mutations, additionalPaths = []) {
     const requiredKeys = new Set([
         updateSnapshotKey(['liftoff.config.json']),
-        ...mutations.map((mutation) => updateSnapshotKey(mutation.pathParts))
+        ...mutations.map((mutation) => updateSnapshotKey(mutation.pathParts)),
+        ...additionalPaths.map((pathParts) => updateSnapshotKey(pathParts))
     ]);
     for (const entry of entries) {
         const adoptsExistingDestination = entry.status === 'moved' && entry.destinationMatches === true;
@@ -945,12 +1098,41 @@ function selectUpdatePreconditions(snapshots, entries, mutations) {
     }
     return snapshots.filter((snapshot) => requiredKeys.has(updateSnapshotKey(snapshot.pathParts)));
 }
+function assertAuthorizedUpdateMutations(mutations, entries, provisioningPlans) {
+    const authorized = new Set([
+        updateSnapshotKey(['liftoff.manifest.json'])
+    ]);
+    for (const entry of entries) {
+        if (entry.rendered && entry.rendered.lifecycle !== 'managed-core') {
+            throw new Error(`Update reconciliation produced a non-core mutation candidate: ${entry.logicalName}`);
+        }
+        authorized.add(updateSnapshotKey(entry.pathParts));
+        if (entry.previousPathParts) {
+            authorized.add(updateSnapshotKey(entry.previousPathParts));
+        }
+    }
+    for (const plan of provisioningPlans) {
+        if (plan.blocked) {
+            continue;
+        }
+        for (const entry of plan.entries) {
+            if (entry.status === 'create') {
+                authorized.add(updateSnapshotKey(entry.rendered.pathParts));
+            }
+        }
+    }
+    for (const mutation of mutations) {
+        if (!authorized.has(updateSnapshotKey(mutation.pathParts))) {
+            throw new Error(`Update mutation is outside managed-core or authorized provisioning scope: ${manifestDisplayPath(mutation.pathParts)}`);
+        }
+    }
+}
 async function updateCommand(parsed, context) {
     const { presentation } = context;
     const check = readBooleanFlag(parsed.flags, 'check') ?? false;
     const force = readBooleanFlag(parsed.flags, 'force') ?? false;
     const jsonMode = readBooleanFlag(parsed.flags, 'json') ?? false;
-    presentation.commandIdentity('update', 'Reconcile the project with current Liftoff templates');
+    presentation.commandIdentity('update', 'Reconcile Liftoff-managed core files');
     if (force && check) {
         presentation.error('--force cannot be combined with --check.', 'Run `liftoff update --check` to inspect drift or `liftoff update --force` to overwrite conflicts.');
         return 1;
@@ -980,7 +1162,7 @@ async function updateCommand(parsed, context) {
             recordedWorkload.kind === 'power-apps-code-app';
         presentation.error(`Project type changes (${recordedWorkload.kind} -> ${plan.workload}) are not supported by update.`, involvesPowerApps
             ? 'Initialize a fresh project for the new workload.'
-            : 'Run `liftoff migrate` instead.');
+            : 'Initialize a fresh project and move production behavior through a reviewed project change.');
         return 1;
     }
     if (plan.workload === 'power-apps-code-app' && recordedWorkload.kind === 'power-apps-code-app') {
@@ -997,13 +1179,13 @@ async function updateCommand(parsed, context) {
     }
     else if (plan.workload !== 'power-apps-code-app' && recordedWorkload.kind !== 'power-apps-code-app') {
         if (plan.apiStack.id !== recordedWorkload.apiStack) {
-            presentation.error(`API stack changes (${recordedWorkload.apiStack} -> ${plan.apiStack.id}) are a migration, not an update.`, 'Run `liftoff migrate` instead.');
+            presentation.error(`API stack changes (${recordedWorkload.apiStack} -> ${plan.apiStack.id}) are a migration, not an update.`, 'Initialize a fresh project and move production behavior through a reviewed project change.');
             return 1;
         }
         const recordedPattern = recordedWorkload.kind === 'genai' ? recordedWorkload.pattern : undefined;
         const desiredPattern = plan.workload === 'genai' ? plan.pattern.id : undefined;
         if (desiredPattern !== recordedPattern) {
-            presentation.error(`Pattern changes (${recordedPattern ?? 'none'} -> ${desiredPattern ?? 'none'}) are a migration, not an update.`, 'Run `liftoff migrate` instead.');
+            presentation.error(`Pattern changes (${recordedPattern ?? 'none'} -> ${desiredPattern ?? 'none'}) are a migration, not an update.`, 'Use a separately reviewed project migration; the existing migrate command only adopts non-Liftoff sources into a fresh target.');
             return 1;
         }
     }
@@ -1018,48 +1200,65 @@ async function updateCommand(parsed, context) {
         presentation.error('AI agent or default-agent changes require official framework initialization and are not supported by liftoff update.', 'Restore liftoff.config.json to the integrations recorded in liftoff.manifest.json.');
         return 1;
     }
-    const renderPlan = manifest.framework.state === 'legacy'
+    let desiredRenderPlan = manifest.framework.state === 'legacy'
         ? { ...plan, agents: [], defaultAgent: undefined }
         : plan;
+    if (desiredRenderPlan.workload === 'power-apps-code-app' &&
+        recordedWorkload.kind === 'power-apps-code-app') {
+        desiredRenderPlan = {
+            ...desiredRenderPlan,
+            starter: recordedWorkload.starter
+        };
+    }
+    const desiredRender = buildArtifacts(desiredRenderPlan);
+    const provisioningPlans = await inspectProvisioningGroups(projectRoot, desiredRender, requestedProvisioningGroups(manifest, desiredRenderPlan));
+    const renderPlan = planWithBlockedProvisioning(desiredRenderPlan, recordedWorkload, provisioningPlans);
     const render = buildArtifacts(renderPlan);
+    const scopedRender = [
+        ...render.filter((artifact) => artifact.lifecycle === 'managed-core'),
+        ...desiredRender.filter((artifact) => artifact.lifecycle === 'project' &&
+            provisioningPlans.some((group) => group.group === artifact.provisioningGroup))
+    ];
     const updateSnapshots = check
         ? []
-        : await captureUpdateSnapshots(projectRoot, manifest, render, initialUpdateSnapshots);
+        : await captureUpdateSnapshots(projectRoot, manifest, scopedRender, initialUpdateSnapshots);
     const entries = await reconcileProject(manifest, render, projectRoot);
     const summary = summarizeEntries(entries);
-    const manifestUpgradePending = manifest.artifactVersion !== 5;
-    const starterUpgradePending = plan.workload === 'power-apps-code-app' &&
-        recordedWorkload.kind === 'power-apps-code-app' &&
-        recordedWorkload.starter.commit !== plan.starter.commit;
-    const nonDurableNames = new Set(render
-        .filter((artifact) => artifact.category === 'seed' || artifact.category === 'framework')
-        .map((artifact) => artifact.logicalName));
-    const manifestOwnershipCleanupPending = manifest.artifacts.some((artifact) => nonDurableNames.has(artifact.logicalName)) || manifestHadFilteredLegacySeedOwnership(manifest);
-    const manifestRewritePending = manifestUpgradePending ||
-        manifestOwnershipCleanupPending ||
-        starterUpgradePending;
-    const drift = hasDrift(entries) || manifestRewritePending;
+    const ownershipMigrationPending = manifest.artifactVersion !== 6 ||
+        manifestHadFilteredLegacyNonDurableOwnership(manifest);
+    const plannedManifest = buildManifest(renderPlan, render, {
+        frameworkState: manifest.framework.state,
+        projectArtifacts: manifest.projectArtifacts
+    });
+    const workloadIntentChanged = !sameWorkloadIntent(plannedManifest.project.workload, manifest.project.workload);
+    const manifestRewritePending = ownershipMigrationPending ||
+        workloadIntentChanged;
+    const drift = hasDrift(entries) ||
+        manifestRewritePending ||
+        provisioningPlans.length > 0;
     const visible = entries.filter((entry) => entry.status !== 'unchanged' || entry.refreshHash);
     if (!drift) {
         if (jsonMode) {
             presentation.rawStdout(`${JSON.stringify(check ? {
-                schemaVersion: 1,
+                schemaVersion: 2,
                 mode: 'check',
+                scope: 'managed-core',
                 cliVersion: liftoffVersion,
                 projectVersion: manifest.liftoffVersion,
                 entries: [],
-                manifestUpgradePending,
-                manifestOwnershipCleanupPending,
+                provisioning: [],
+                ownershipMigrationPending,
                 summary
             } : {
-                schemaVersion: 1,
+                schemaVersion: 2,
                 mode: 'apply',
+                scope: 'managed-core',
                 cliVersion: liftoffVersion,
                 projectVersion: manifest.liftoffVersion,
                 written: [],
                 skipped: [],
-                manifestUpgradePending,
-                manifestOwnershipCleanupPending,
+                provisioning: [],
+                ownershipMigrationPending,
                 summary
             }, null, 2)}\n`);
             return 0;
@@ -1068,14 +1267,15 @@ async function updateCommand(parsed, context) {
             { label: 'Liftoff CLI', value: liftoffVersion },
             { label: 'Project generated by', value: manifest.liftoffVersion }
         ]);
-        presentation.status('success', 'No drift', `${summary.unchanged} artifacts match the current templates and configuration`);
+        presentation.status('success', 'Liftoff core is current', `${summary.unchanged} managed-core artifacts match; project files are not compared`);
         return 0;
     }
     if (check) {
         if (jsonMode) {
             presentation.rawStdout(`${JSON.stringify({
-                schemaVersion: 1,
+                schemaVersion: 2,
                 mode: 'check',
+                scope: 'managed-core',
                 cliVersion: liftoffVersion,
                 projectVersion: manifest.liftoffVersion,
                 entries: visible.map((entry) => ({
@@ -1085,8 +1285,8 @@ async function updateCommand(parsed, context) {
                     previousPath: entry.previousPathParts ? manifestDisplayPath(entry.previousPathParts) : undefined,
                     reason: entry.reason
                 })),
-                manifestUpgradePending,
-                manifestOwnershipCleanupPending,
+                provisioning: provisioningJson(provisioningPlans),
+                ownershipMigrationPending,
                 summary
             }, null, 2)}\n`);
             return 2;
@@ -1097,19 +1297,21 @@ async function updateCommand(parsed, context) {
         ]);
         if (visible.length > 0) {
             if (presentation.stdout.layout === 'plain') {
-                presentation.section('Template drift', visible.map((entry) => `${entryMarker(entry)} ${entryDisplay(entry)}  ${entry.reason}`));
+                presentation.section('Liftoff core drift', visible.map((entry) => `${entryMarker(entry)} ${entryDisplay(entry)}  ${entry.reason}`));
             }
             else {
-                presentation.table('Template drift', ['Change', 'Artifact', 'Reason'], visible.map((entry) => [entryMarker(entry), entryDisplay(entry), entry.reason]));
+                presentation.table('Liftoff core drift', ['Change', 'Artifact', 'Reason'], visible.map((entry) => [entryMarker(entry), entryDisplay(entry), entry.reason]));
             }
         }
+        for (const group of provisioningPlans) {
+            presentation.bullets(`Project component provisioning: ${group.group}`, group.entries.map((entry) => `${entry.status} ${manifestDisplayPath(entry.rendered.pathParts)}  ${entry.reason}`));
+        }
         const manifestMaintenance = [
-            manifestUpgradePending ? 'upgrade liftoff.manifest.json to schema v5' : undefined,
-            manifestOwnershipCleanupPending
-                ? 'remove obsolete seed or framework entries from durable manifest ownership'
+            ownershipMigrationPending
+                ? 'release legacy project artifacts from Liftoff update authority in manifest schema v6; no production file will be written'
                 : undefined,
-            starterUpgradePending
-                ? `record the current packaged Power Apps starter ${plan.starter.commit}`
+            workloadIntentChanged
+                ? 'record the requested project configuration intent after safe provisioning'
                 : undefined
         ].filter((item) => item !== undefined);
         if (manifestMaintenance.length > 0) {
@@ -1120,8 +1322,11 @@ async function updateCommand(parsed, context) {
             summary.upgrade +
             summary.moved +
             summary.refresh +
+            provisioningPlans.reduce((count, group) => count + (group.blocked
+                ? 0
+                : group.entries.filter((entry) => entry.status === 'create').length), 0) +
             (manifestRewritePending ? 1 : 0);
-        presentation.status('warning', 'Drift detected', `${toWrite} to write, ${summary.conflict} conflict(s), ${summary.orphan} orphan(s), ${summary.unchanged} unchanged`);
+        presentation.status('warning', 'Liftoff core maintenance available', `${toWrite} to write, ${summary.conflict} core conflict(s), ${summary.orphan} core orphan(s), ${summary.unchanged} core unchanged`);
         if (toWrite > 0) {
             presentation.command('liftoff update');
         }
@@ -1130,6 +1335,7 @@ async function updateCommand(parsed, context) {
         }
         return 2;
     }
+    const blockedProvisioning = provisioningPlans.filter((group) => group.blocked);
     if (isDirtyGitWorktree(projectRoot)) {
         const warning = 'The project worktree has uncommitted changes; consider committing before applying.';
         if (jsonMode) {
@@ -1139,7 +1345,7 @@ async function updateCommand(parsed, context) {
             presentation.warning(warning);
         }
     }
-    presentation.stage('Apply safe template changes', projectRoot);
+    presentation.stage('Apply safe Liftoff core changes', projectRoot);
     await preflightUpdate(projectRoot, entries, force);
     const written = [];
     const skipped = [];
@@ -1192,12 +1398,32 @@ async function updateCommand(parsed, context) {
                 break;
         }
     }
-    const oldByName = new Map(manifest.artifacts.map((artifact) => [artifact.logicalName, artifact]));
+    const provisioned = [];
+    for (const group of provisioningPlans) {
+        if (group.blocked) {
+            continue;
+        }
+        for (const entry of group.entries) {
+            if (entry.status === 'create') {
+                mutations.push({
+                    type: 'write',
+                    pathParts: entry.rendered.pathParts,
+                    content: entry.rendered.content
+                });
+            }
+            provisioned.push(entry);
+        }
+    }
+    const oldByName = new Map(manifest.managedArtifacts.map((artifact) => [artifact.logicalName, artifact]));
     const skippedByName = new Map(skipped.map((entry) => [entry.logicalName, entry]));
     const hasUnrecordedGovernanceConflict = skipped.some((entry) => entry.status === 'conflict' &&
         entry.rendered?.category === 'governance' &&
         !oldByName.has(entry.logicalName));
-    const nextManifest = buildManifest(plan, render.filter((artifact) => artifact.logicalName !== 'manifest'), { frameworkState: manifest.framework.state });
+    const nextProjectArtifacts = appendProvisionedProjectArtifacts(manifest.projectArtifacts, provisioningPlans);
+    const nextManifest = buildManifest(renderPlan, render.filter((artifact) => artifact.logicalName !== 'manifest'), {
+        frameworkState: manifest.framework.state,
+        projectArtifacts: nextProjectArtifacts
+    });
     nextManifest.framework = manifest.framework;
     nextManifest.project.specWorkflow = manifest.project.specWorkflow;
     nextManifest.project.agents = manifest.project.agents;
@@ -1211,11 +1437,7 @@ async function updateCommand(parsed, context) {
         nextManifest.governance.profile !== 'none') {
         nextManifest.governance.state = 'handoff-partial';
     }
-    nextManifest.artifacts = nextManifest.artifacts.flatMap((artifact) => {
-        // config is user-owned after create: carry the recorded entry forward untouched
-        if (artifact.logicalName === 'liftoff-config') {
-            return [oldByName.get('liftoff-config') ?? artifact];
-        }
+    nextManifest.managedArtifacts = nextManifest.managedArtifacts.flatMap((artifact) => {
         if (!skippedByName.has(artifact.logicalName)) {
             return [artifact];
         }
@@ -1232,7 +1454,7 @@ async function updateCommand(parsed, context) {
                 previous.category === 'governance') {
                 continue;
             }
-            nextManifest.artifacts.push(previous);
+            nextManifest.managedArtifacts.push(previous);
         }
     }
     mutations.push({
@@ -1240,34 +1462,52 @@ async function updateCommand(parsed, context) {
         pathParts: ['liftoff.manifest.json'],
         content: `${JSON.stringify(nextManifest, null, 2)}\n`
     });
+    assertAuthorizedUpdateMutations(mutations, entries, provisioningPlans);
     await applyProjectFileTransaction(projectRoot, mutations, {
-        preconditions: selectUpdatePreconditions(updateSnapshots, entries, mutations)
+        preconditions: selectUpdatePreconditions(updateSnapshots, entries, mutations, provisioned.map((entry) => entry.rendered.pathParts))
     });
     if (jsonMode) {
         presentation.rawStdout(`${JSON.stringify({
-            schemaVersion: 1,
+            schemaVersion: 2,
             mode: 'apply',
+            scope: 'managed-core',
+            status: blockedProvisioning.length > 0 ? 'partial' : 'applied',
             cliVersion: liftoffVersion,
             projectVersion: manifest.liftoffVersion,
             written: written.map((entry) => manifestDisplayPath(entry.pathParts)),
             skipped: skipped.map((entry) => ({ path: manifestDisplayPath(entry.pathParts), reason: entry.reason })),
-            manifestUpgradePending,
-            manifestOwnershipCleanupPending,
+            provisioning: provisioningJson(provisioningPlans),
+            ownershipMigrationPending,
             summary
         }, null, 2)}\n`);
         return 0;
     }
     if (written.length > 0) {
-        presentation.bullets('Applied changes', written.map((entry) => `wrote ${entryDisplay(entry)}`));
+        presentation.bullets('Applied Liftoff core changes', written.map((entry) => `wrote ${entryDisplay(entry)}`));
+    }
+    if (provisioned.length > 0) {
+        presentation.bullets('Provisioned project components', provisioned.map((entry) => `${entry.status === 'create' ? 'wrote' : 'adopted'} ${manifestDisplayPath(entry.rendered.pathParts)}`));
+    }
+    if (blockedProvisioning.length > 0) {
+        presentation.bullets('Blocked project component provisioning', blockedProvisioning.flatMap((group) => group.entries
+            .filter((entry) => entry.status === 'conflict')
+            .map((entry) => `${group.group}: preserved ${manifestDisplayPath(entry.rendered.pathParts)}; --force cannot overwrite project-owned bytes`)));
     }
     if (skipped.length > 0) {
-        presentation.bullets('Skipped conflicts', skipped.map((entry) => `skipped ${entryDisplay(entry)}  ${entry.reason}${force ? '' : ' (use --force to overwrite)'}`));
+        presentation.bullets('Skipped Liftoff core conflicts', skipped.map((entry) => `skipped ${entryDisplay(entry)}  ${entry.reason}${force ? '' : ' (use --force to overwrite)'}`));
     }
     const orphans = entries.filter((entry) => entry.status === 'orphan');
     if (orphans.length > 0) {
-        presentation.bullets('Orphaned artifacts', orphans.map((entry) => `orphan ${entryDisplay(entry)}  ${entry.reason}`));
+        presentation.bullets('Orphaned Liftoff core artifacts', orphans.map((entry) => `orphan ${entryDisplay(entry)}  ${entry.reason}`));
     }
-    presentation.completion('Updated project', `${written.length} written, ${skipped.length} skipped, ${summary.orphan} orphan(s)`, [{ label: 'Manifest version', value: liftoffVersion }], 'liftoff validate && liftoff doctor');
+    presentation.completion('Updated project', [
+        `${written.length} core written`,
+        `${provisioned.length} project provisioned`,
+        ...(blockedProvisioning.length > 0
+            ? [`${blockedProvisioning.length} provisioning group(s) blocked`]
+            : []),
+        `${skipped.length} core skipped`
+    ].join(', '), [{ label: 'Manifest version', value: liftoffVersion }], 'liftoff validate && liftoff doctor');
     return 0;
 }
 function renderSelfUpgradeResult(value, presentation) {
@@ -1514,7 +1754,7 @@ function stackProjectCheck(projectRoot, apiStack) {
             label: `${apiStack} project`,
             severity: 'fail',
             detail: `missing locked dependency metadata: ${missingMetadata}`,
-            remedy: `restore ${missingMetadata} or run liftoff update`
+            remedy: `restore or repair the project-owned ${missingMetadata}`
         };
     }
     if (apiStack === 'python-fastapi') {
@@ -1527,7 +1767,7 @@ function stackProjectCheck(projectRoot, apiStack) {
                 label: `${apiStack} project`,
                 severity: 'fail',
                 detail: 'pyproject.toml and uv.lock do not identify the same project',
-                remedy: 'restore backend/pyproject.toml and backend/uv.lock or run liftoff update'
+                remedy: 'repair the project-owned backend/pyproject.toml and backend/uv.lock'
             };
         }
     }
@@ -1579,7 +1819,7 @@ async function powerAppsProjectCheck(projectRoot) {
         severity: 'fail',
         state: 'unhealthy',
         detail: issues[0],
-        remedy: 'restore package.json and package-lock.json or run liftoff update'
+        remedy: 'repair the project-owned package.json and package-lock.json'
     };
 }
 function runReadOnly(command, args, cwd) {
@@ -1660,11 +1900,15 @@ async function projectLayer(projectRoot, manifest) {
             label: 'manifest',
             severity: 'fail',
             detail: `${issues.length} issue(s): ${issues[0]}${issues.length > 1 ? ' ...' : ''}`,
-            remedy: 'restore missing artifacts or run liftoff update'
+            remedy: 'restore the manifest or run liftoff update for managed-core repair'
         });
     }
     else {
-        checks.push({ label: 'manifest', severity: 'ok', detail: `valid, ${manifest.artifacts.length} artifacts present` });
+        checks.push({
+            label: 'manifest',
+            severity: 'ok',
+            detail: `valid, ${manifest.managedArtifacts.length} managed core and ${manifest.projectArtifacts.length} project provenance entries`
+        });
     }
     if (compareSemver(manifest.liftoffVersion, liftoffVersion) > 0) {
         checks.push({
@@ -1738,22 +1982,29 @@ async function projectLayer(projectRoot, manifest) {
         const plan = buildProjectPlan(config, { requireProjectName: true });
         const render = buildArtifacts(plan);
         const entries = await reconcileProject(manifest, render, projectRoot);
-        const driftCount = entries.filter((entry) => entry.status !== 'unchanged' || entry.refreshHash).length;
+        const provisioningPlans = await inspectProvisioningGroups(projectRoot, render, requestedProvisioningGroups(manifest, plan));
+        const driftCount = entries.filter((entry) => entry.status !== 'unchanged' || entry.refreshHash).length +
+            provisioningPlans.length +
+            (manifest.artifactVersion === 6 ? 0 : 1);
         if (driftCount > 0) {
             checks.push({
-                label: 'scaffold drift',
+                label: 'managed core',
                 severity: 'warn',
-                detail: `${driftCount} update(s) available`,
+                detail: `${driftCount} core maintenance action(s) available`,
                 remedy: 'run liftoff update'
             });
         }
         else {
-            checks.push({ label: 'scaffold drift', severity: 'ok', detail: 'project matches the current templates' });
+            checks.push({
+                label: 'managed core',
+                severity: 'ok',
+                detail: 'Liftoff core is current; project templates are not compared'
+            });
         }
     }
     catch (error) {
         checks.push({
-            label: 'scaffold drift',
+            label: 'managed core',
             severity: 'fail',
             detail: `liftoff.config.json could not be evaluated: ${error.message.split('\n')[0]}`,
             remedy: 'repair liftoff.config.json'