@msn-control/liftoff 0.9.4 → 0.9.6

package/assets/governance/single-maintainer-gitflow/policy.md

@@ -1,7 +1,7 @@
 ---
 schemaVersion: 1
 profile: single-maintainer-gitflow
-policyVersion: "1"
+policyVersion: "3"
 state: handoff-generated
 ---
 
@@ -26,25 +26,68 @@ one-off.
   best-practice default would introduce a human approver, override it and say so.
   To be precise: me approving *your plan* in this conversation is expected and required. What is
   forbidden is any *merge or deploy gate that waits on a person* once the automation is in place.
-- **Repository-scoped only. Org-level rulesets are out of scope and will not be set up.** I am a
-  repository admin, not an org owner. Every control must be applied per-repository and must work
+- **Repository-scoped only, with one bounded provisioning exception.** Org-level rulesets remain out
+  of scope and will not be set up. Every governance control must be applied per-repository and work
   standalone in a single repository. Do not propose, recommend, or design around org-level rulesets,
   org-level required workflows, or org-wide GitHub App installations — not even as a "better
-  alternative" or a future phase. Do not treat the per-repository approach as a limitation to be
-  worked around; it is the deliberate design. If a control genuinely cannot be enforced at repository
-  scope, say so plainly and leave it out rather than proposing an org-level substitute.
+  alternative" or future phase. If a control genuinely cannot be enforced at repository scope, say so
+  plainly and leave it out rather than proposing an org-level substitute.
+  **One provisioning exception only:** when private Staging DAST genuinely applies and no suitable
+  VNet-injected larger runner is assigned, an explicitly approved governance change may provision the
+  Azure network setting, organisation hosted-compute network configuration, selected-access runner
+  group, and bounded larger runner described below. Prove the required Azure and GitHub organisation
+  write authority first; never generalise this exception to any unrelated org-level control.
 - **Automation identity is the built-in `GITHUB_TOKEN`.** Set the **GitHub Actions app** as the bypass
   actor where automation must act on a protected ref — no custom GitHub App is available, since
   installing one requires org ownership. Note that pushes made with `GITHUB_TOKEN` do not trigger
-  further workflows: never rely on a tag-push trigger, and do the follow-on work in the same workflow
-  run.
+  further workflows: never rely on a tag-push trigger. Create the tag, Release and durable evidence in
+  the successful production workflow. Where a checked back-merge needs another run, dispatch it
+  explicitly for the exact SHA and fail if that dispatch or its required checks do not succeed.
 - **GitHub Advanced Security is licensed org-wide.** Use Secret Protection, CodeQL and Copilot Autofix.
   Do not add third-party equivalents such as Gitleaks or Semgrep — they would duplicate licensed
   capability.
-- **Staging sits behind private networking.** DAST must run on a self-hosted runner with access to it.
+- **Staging sits behind private networking, and DAST runs on a GitHub-hosted larger runner with
+  Azure VNet injection.** Do not build a self-hosted runner VM. An ephemeral hosted runner has
+  nothing to patch and leaves no long-lived compute inside the Staging network for a compromised
+  workflow to pivot from.
+  **This is a deliberate, approved deviation** from guidance that assumes self-hosted runners for
+  private targets — implement it as written and do not re-argue it.
+  Note the dependency: VNet injection requires an Azure **network configuration** and a **runner
+  group**, both represented at organisation or enterprise level. Reuse a suitable existing
+  repository assignment when one is verified. If none exists, keep release qualification blocked
+  until the exact repository-dedicated stack is explicitly approved, provisioned, read back, and
+  proven to reach Staging. Never silently skip DAST, and never substitute a self-hosted runner to
+  work around it.
 - **The GitHub Release plus attestations are the audit record.** There is no external GRC or
   change-management system to integrate with.
 
+### Pre-answered platform defaults — use these, do not ask again
+
+These were decided once and apply to every repository. Ask only if the repository has a specific,
+stated reason to differ, and say what that reason is. Apply a default only when the classified
+workload actually uses that component; a database default does not justify provisioning a database.
+
+| Decision | Default |
+| --- | --- |
+| Storage redundancy | **Dev LRS · Staging ZRS · Production ZRS** |
+| IaC state storage | **ZRS in every environment**, including bootstrap |
+| Database high availability | **Dev and Staging: no HA. Production: zone-redundant HA.** |
+| Cloud identity for CI | **User-assigned managed identity with OIDC federation** per repository and environment. No app registrations, no client secrets, no long-lived credentials. |
+| Workload scale | **Small — fewer than 1,000 users** |
+| Budget profile | **Cost-optimised with production safeguards** |
+| Slack webhook storage | **GitHub Actions secret at the environment level.** Not Key Vault — the alerting path must not depend on network access to a private vault, which is exactly how an alert path fails silently. |
+| Dependency policy | **Active LTS only.** Pin runtime majors to Active LTS, add Dependabot ignore rules for non-LTS majors, and group updates per ecosystem. Do not re-litigate this every time a new major ships. |
+
+**Provision nothing that no code uses.** Do not add a managed service to the infrastructure until the
+application actually consumes it. Before adopting any managed service, state its cost and its
+**known service limits** — per-subscription rate caps in particular, which have long lead times to
+raise and are discovered far too late otherwise.
+
+**When infrastructure as code does not match what already exists in the cloud**, report the
+reconciliation plan before applying anything, refactor the IaC to match the live resources and import
+them. Do not build a parallel stack and migrate, force replacement, or treat the estate as externally
+managed.
+
 ## Basis
 
 The branching model is Vincent Driessen's original GitFlow:
@@ -62,11 +105,18 @@ Report before you change anything.
 2. Language(s), package managers, and the build and test commands that genuinely work today.
 3. Anything already present: branches, workflows and their exact job names, rulesets, tags, releases,
    environments, deployment pipelines, security scanning.
-4. Whether a self-hosted runner group with Staging access exists. If it does not, say so plainly —
-   DAST cannot run without it, and the release lane will be unable to qualify a candidate.
-5. What monitoring and alerting already exists — alert rules, action groups, where they route, and
+4. Whether private Staging DAST applies and whether a **GitHub-hosted larger runner group with Azure
+   VNet injection into Staging** already exists, is assigned to this repository, exposes the exact
+   required labels, and can inspect and reach the real private target.
+5. If DAST applies and no suitable assignment exists: the repository's Staging subscription and
+   tenant; supported region; Azure and GitHub organisation write permissions; enterprise policy for
+   organisation network configurations; billing owner; remote state owner; deterministic resource
+   names; non-overlapping address space; Staging VNet, route, private DNS and security topology;
+   required outbound policy; current costs and service limits; and dependency-ordered teardown
+   owner. Any unresolved input is a blocker, not permission to begin a partial bootstrap.
+6. What monitoring and alerting already exists — alert rules, action groups, where they route, and
    which components have no coverage at all. Name the gaps explicitly.
-6. Which components expose a health endpoint, and whether it is shallow (process is alive) or deep
+7. Which components expose a health endpoint, and whether it is shallow (process is alive) or deep
    (dependencies are reachable). A shallow check reported as health is a gap, not coverage.
 
 Then state the gap and your proposed order of work, and **get my approval before making changes.**
@@ -75,6 +125,60 @@ Then state the gap and your proposed order of work, and **get my approval before
 apply to a library the same way. Implement what is real for this repo and tell me explicitly what you
 skipped and why. Never ship a workflow that cannot pass.
 
+### Private Staging runner provisioning contract
+
+Provision this stack only when private Staging DAST applies and no suitable assignment already
+exists. If DAST is inapplicable, provision no runner networking or hosted-compute resources. If a
+suitable assignment exists, consume it without creating a duplicate.
+
+**Keep repository ownership independent.** Every Azure runner-network resource, remote state,
+explicit egress resource, cost, and teardown responsibility belongs in the target repository's
+Staging subscription. Do not share or depend on another repository's or subscription's firewall,
+hub, route, state, billing boundary, or lifecycle. GitHub resources necessarily exist at organisation
+level, but the runner group must use selected access for only this repository and, where supported,
+only the required workflows.
+
+**Use one explicit outbound mode.** Disable implicit default outbound access on the runner subnet,
+then select exactly one of these modes from Phase 0 evidence:
+
+1. **Azure Firewall Basic** only when an applicable organisation or repository policy requires
+   domain-restricted egress. Populate HTTPS application rules from the current GitHub meta endpoint
+   domain set, record the selected set and capture time, refresh it at least weekly, use no retired
+   static GitHub IP allowlist, and perform no TLS interception. Firewall Basic has no DNS proxy, so it
+   does not replace the private DNS path to Staging.
+2. **Azure NAT Gateway** when strict domain-restricted egress is not required. Limit required
+   outbound protocols with an NSG, but state plainly that NAT Gateway and an NSG do not filter HTTPS
+   traffic by domain.
+
+Never attach NAT Gateway to a runner subnet whose default route uses Azure Firewall. NAT Gateway
+takes precedence for new outbound connections and would bypass the firewall path. Never treat
+implicit Azure outbound access as a durable design.
+
+**Prove isolation and the private path.** The delegated subnet must contain no existing NICs, use
+non-overlapping address space, and deny all unsolicited inbound connections; GitHub requires no
+inbound connection to the runner. Model the actual same-subscription route or peering to Staging,
+private DNS zone or resolver path, forwarding settings, NSGs, and target policy. A standalone runner
+VNet or a successfully created network setting is not proof that DAST can reach Staging.
+
+**Apply and verify idempotently.** Use reviewable infrastructure as code for the Azure resources and
+supported GitHub APIs for the hosted-compute network configuration, group, repository and workflow
+access, and runner. Use deterministic names and read before write. Default to the smallest
+organisation-supported Ubuntu x64 runner proven sufficient for ZAP — normally 4 cores and 16 GiB —
+with maximum concurrency of one unless Phase 0 justifies another bound.
+
+Do not mark the prerequisite satisfied until readback proves the Azure network setting and returned
+GitHub ID, organisation network configuration, selected-access group, exact repository and workflow
+assignment, runner image, size, labels, status, concurrency, billing owner, explicit egress path,
+private DNS resolution, and live Staging reachability. A standard hosted preflight checks assignment
+and labels before scheduling DAST; the larger-runner job proves the private target path. Missing,
+stale, denied, skipped, or partial evidence fails closed.
+
+**Remove in dependency order.** Stop new scheduling and repository access first; delete the larger
+runner; remove repository and workflow access; detach and delete the runner group and hosted-compute
+network configuration; delete the Azure network setting and wait for its service association to be
+removed; only then delete the repository-owned subnet, egress, network, and state resources. Never
+report rollback success while a billed or service-associated resource remains.
+
 ## Phase 1 — Branching model
 
 - `develop` is the integration branch and the **default branch**. Feature branches (`feat/`, `fix/`,
@@ -88,17 +192,34 @@ skipped and why. Never ship a workflow that cannot pass.
   `develop` — or into the open release branch if one exists.
 - Nobody pushes directly to any protected branch, including me.
 
+### Automated completion without protected-branch bypass
+
+Release and hotfix back-merges use pull requests and the same required checks as every other protected
+branch change. Protected branch rulesets keep `bypass_actors: []`; the GitHub Actions bypass applies
+only to restricted release-tag creation.
+
+When `GITHUB_TOKEN` creates the back-merge pull request, the coordinating workflow must explicitly
+dispatch validation for the sync branch's exact head SHA, wait until every required context is
+`success`, verify the head did not move, and merge through the pull-request API. A hotfix targets the
+single open release branch when one exists, otherwise `develop`; multiple open release branches are
+an ambiguity and must fail. If the token-generated merge suppresses the normal `develop` push
+workflow, explicitly dispatch the required deployment or follow-on work for the resulting merge SHA.
+Missing, skipped, cancelled or failed checks, a failed dispatch, or an unexpected SHA all fail closed.
+
 ## Phase 2 — Release versioning on `main`
 
 Every production merge must produce a real, visible version.
 
 - Semantic versioning. The `release/X.Y.Z` or `hotfix/X.Y.Z` branch name is the single source of truth
-  for the version; nothing else declares it.
+  for the version. If an artifact format requires embedded version metadata, derive it from or verify
+  it against the branch version during candidate stabilisation; conflicting metadata blocks
+  qualification and never becomes a second source of truth.
 - Merges into `main` are true merge commits, never squashed, so both parents stay traceable.
 - After a successful production deploy — and only then — automation creates an annotated `vX.Y.Z` tag
   on that exact `main` merge commit and a matching **GitHub Release** targeting `main`.
 - The Release body must contain: the changelog between the previous tag and this one, the deployed
-  artifact digest, the source `develop` SHA the release was cut from, a link to the staging
+  artifact digest, the qualified release or hotfix candidate SHA, the production `main` merge SHA,
+  the source `develop` SHA the release was cut from, a link to the staging
   qualification run, the **evidence bundle digest** and links to the SBOM and scan reports, the
   **expected signer identity and OIDC issuer** an auditor should pin when verifying, and an AI
   Acceptable Use Policy attestation record. For a hotfix, include the incident reference. Attach the
@@ -117,17 +238,20 @@ Every production merge must produce a real, visible version.
 
 ## Phase 3 — Promotion: build once, promote the identical artifact
 
-The artifact is built once per candidate and recorded in a release manifest with its digest, SBOM
-digest, provenance attestation and scan results. Dev, Staging and Production all deploy that same
-digest. Never rebuild per environment; never resolve a floating tag like `latest`. Configuration
-differs per environment; the artifact does not.
+The artifact is built once per candidate and recorded in a release manifest with its release version,
+release branch, candidate SHA, digest, SBOM digest, provenance attestation and scan results. Dev,
+Staging and Production all deploy that same digest. Never rebuild per environment; never resolve a
+floating tag like `latest`. Configuration differs per environment; the artifact does not.
 
 - **Dev** — every push to `develop` deploys automatically. No gate.
 - **Staging** — a push to `release/**` or `hotfix/**` builds the candidate, scans it, generates its
   SBOM, deploys to Staging, then runs the qualification suite and DAST. It records a qualification
-  record bound to that exact digest and commit.
+  record bound to that exact version, branch, candidate SHA, artifact digest and evidence-bundle
+  digest.
 - **Production** — merging into `main` promotes. The workflow resolves the already-qualified digest,
-  verifies the attestation and qualification record bind to that exact commit and digest, and refuses
+  verifies the commit is a true merge that incorporates the exact qualified candidate SHA, and
+  verifies the attestation and qualification record bind that candidate to the version, artifact
+  digest and evidence digest being promoted. It records the distinct production merge SHA and refuses
   to proceed on any mismatch. Deployment is recorded through a GitHub Environment for the deployment
   history and audit trail only — configure it with **no required reviewers**, so promotion is never
   blocked waiting on a person.
@@ -425,10 +549,11 @@ Stage mapping:
   using `actions/attest-build-provenance`.
 - **`release/**` and `hotfix/**`** — the full gate, all bound to the promoted digest: Trivy scan of
   that exact digest, SBOM, **SLSA Build L3** provenance via `slsa-github-generator`, OSSF Scorecard,
-  deploy to Staging, then OWASP ZAP against the deployed instance on a self-hosted runner. DAST needs a
-  running application and belongs here and nowhere else. Also run Grype against the candidate SBOM to
-  produce an exploitability-ranked risk report for the Release body — report only, never blocking. The
-  qualification record must not be issuable if any of the gating checks fail.
+  deploy to Staging, then OWASP ZAP against the deployed instance on the VNet-injected GitHub-hosted
+  larger runner. DAST needs a running application and belongs here and nowhere else. Also run Grype
+  against the candidate SBOM to produce an exploitability-ranked risk report for the Release body —
+  report only, never blocking. The qualification record must not be issuable if any of the gating
+  checks fail.
 - **`main`** — verification only. Verify the L3 attestation, SBOM digest and qualification record all
   bind to the digest being promoted. No new scans; re-scanning would describe a rebuilt artifact.
 - **Scheduled** — re-scan released artifacts by running Grype against their **stored SBOMs**, which
@@ -448,6 +573,20 @@ Gating and evidence:
   recorded in the Release, not an automated check.
 - Every scan emits a stable, named status check suitable for requiring by ruleset.
 
+**The SLSA L3 generator is the one approved exception to SHA-pinning.** The official
+`slsa-github-generator` reusable workflow invokes mutable `@main` references internally, so pinning
+the outer workflow by SHA cannot make the whole call graph immutable. Resolve the conflict narrowly:
+
+- Keep **SLSA Build L3** for release candidates. Do not downgrade to L2 to satisfy the pinning rule.
+- Pin the outer reusable workflow as tightly as the generator supports.
+- Record an **explicit, narrow, expiring action-reference exception** naming that exact workflow,
+  reason, expiry and introducing commit. This is distinct from vulnerability acceptance; Trivy
+  remains the sole owner of vulnerability allowlisting and Grype remains non-gating.
+- The SHA-pinning check must allow this single exception by exact name, fail when it expires, and keep
+  failing on every other unpinned reference. A wildcard, blanket exemption, differently named
+  workflow or disabled check is invalid.
+- Re-evaluate at each expiry; remove the exception if the generator gains pinned internals.
+
 ### Audit evidence — every stage must produce a durable, reviewable report
 
 An auditor must be able to answer, years after the fact: what was scanned, when, with which tool and
@@ -475,7 +614,8 @@ The evidence bundle contains, for each pipeline stage:
 
 And at bundle level:
 
-- The artifact digest, source commit SHA, release version and branch.
+- The artifact digest, qualified candidate SHA, production `main` merge SHA, source `develop` SHA,
+  release version and branch.
 - A `manifest.json` listing every file with its SHA-256.
 - The suppression allowlist exactly as it stood at that moment, with each entry's reason, expiry and
   the commit that introduced it.
@@ -564,8 +704,11 @@ evidence.
 
 A required check that is skipped stays pending forever and deadlocks the ruleset. Every required job
 must reach a terminal conclusion on every triggering event, including a deliberate successful
-"nothing to do" path. **If the self-hosted runner group is unavailable, DAST must fail loudly with a
-clear message rather than hang pending.**
+"nothing to do" path. Before scheduling DAST, run a preflight on a standard hosted runner that verifies
+the exact VNet-injected larger runner assignment and labels are visible to the repository. If the API
+cannot be read, the assignment is absent or the labels differ, fail loudly without scheduling DAST.
+The aggregate qualification check must then treat the skipped DAST dependency as not successful
+rather than hang pending or report success.
 
 **No required check may fail open.** A check that reports success when it could not actually do its
 job is worse than no check at all, because it manufactures false assurance and nothing ever looks
@@ -665,15 +808,26 @@ Inspect and report all of the following with evidence before changing anything:
 4. Secret Protection, Dependabot, Dependency Review, CodeQL, Copilot Autofix,
    Checkov, Trivy, Grype, ZAP, attestations, SLSA, Scorecard, licenses, and every
    required input or suppression policy.
-5. GitHub Actions runner labels and whether a private-network runner can reach
-   Staging.
-6. Live deployment mechanisms, parallel-version support, version-specific
+5. Whether private Staging DAST applies; the exact GitHub-hosted larger runner
+   group and labels when present; its repository and workflow assignment; whether
+   its Azure VNet injection can resolve and reach Staging; and whether a standard
+   hosted preflight can verify the assignment before DAST is scheduled.
+6. When DAST applies but no suitable assignment exists: Staging subscription,
+   tenant, region, organisation and Azure write authority, enterprise network
+   policy, billing, state, deterministic names, address space, route or peering,
+   private DNS, inbound denial, strict-domain-egress requirement, explicit
+   Firewall Basic or NAT Gateway mode, costs, limits, and teardown ownership.
+7. Live deployment mechanisms, parallel-version support, version-specific
    origins, traffic volume, statistically valid canary capacity, and provider
    status sources.
-7. Monitoring signals, alert rules, severity routing, Slack delivery,
+8. Monitoring signals, alert rules, severity routing, Slack delivery,
    heartbeat coverage, alert-fire tests, dashboards, shallow/deep component
    health, dependency graph, recovery order, deployed versions/digests, and DORA
    event sources.
+9. Which settled platform defaults apply to components the workload actually
+   uses, the cost and known service limits of every required managed service, and
+   any live-resource drift that requires a refactor-and-import reconciliation
+   plan.
 
 Report every gap, blocker, inapplicable control, and GitFlow-versus-continuous-
 delivery conflict. Propose the current `main` SHA as the activation baseline for
@@ -690,6 +844,14 @@ After approval, create a new governance change using the project's selected
 OpenSpec or Spec Kit workflow. The generated Liftoff policy remains an input;
 Liftoff does not own, name, restore, or recreate that active change.
 
+When the approved plan includes the runner provisioning exception, treat it as
+a fail-closed state machine: remote state and the Azure network; delegated
+private subnet and exactly one explicit egress mode; Azure network setting and
+GitHub ID; organisation network configuration; selected-access group; bounded
+larger runner; complete API readback; private DNS and live Staging reachability;
+then DAST eligibility. Stop at the first failed transition and reconcile or
+remove partial resources in reverse dependency order.
+
 Author workflows, exact ruleset payloads, runbooks, and documentation first.
 Observe every proposed required context green on all applicable paths, then
 prove that exact context deliberately red with a controlled violation. Treat

package/dist/repository-governance.d.ts

@@ -1,6 +1,6 @@
 import type { GeneratedArtifact, ProjectPlan } from './types.js';
 export declare const governancePolicySchemaVersion: 1;
-export declare const governancePolicyVersion: '1';
+export declare const governancePolicyVersion: '3';
 export declare const governanceContextSchemaVersion: 1;
 export declare const governanceArtifactPaths: {
     readonly policy: readonly ['.liftoff', 'governance', 'policy.md'];

package/dist/repository-governance.js

@@ -1,7 +1,7 @@
 import { readFileSync } from 'node:fs';
 import { supportedStack } from './supported-stack.js';
 export const governancePolicySchemaVersion = 1;
-export const governancePolicyVersion = '1';
+export const governancePolicyVersion = '3';
 export const governanceContextSchemaVersion = 1;
 export const governanceArtifactPaths = {
     policy: ['.liftoff', 'governance', 'policy.md'],
@@ -28,7 +28,7 @@ export function renderCanonicalGovernancePolicy() {
 const requiredPolicyFragments = [
     'schemaVersion: 1',
     'profile: single-maintainer-gitflow',
-    'policyVersion: "1"',
+    'policyVersion: "3"',
     'develop` is the integration branch and the **default branch**',
     'main` is production truth',
     'release/X.Y.Z',
@@ -40,6 +40,44 @@ const requiredPolicyFragments = [
     'no required reviewers',
     'GITHUB_TOKEN',
     'Repository-scoped only',
+    'One provisioning exception only:',
+    'GitHub-hosted larger runner with',
+    'Azure VNet injection',
+    'private Staging DAST genuinely applies',
+    'If DAST is inapplicable, provision no runner networking',
+    'consume it without creating a duplicate',
+    'Any unresolved input is a blocker',
+    'Every Azure runner-network resource, remote state',
+    'Staging subscription.',
+    "Do not share or depend on another repository's or subscription's firewall",
+    'selected access for only this repository',
+    'Azure Firewall Basic',
+    'Azure NAT Gateway',
+    'takes precedence for new outbound connections',
+    'NAT Gateway and an NSG do not filter HTTPS',
+    'Disable implicit default outbound access',
+    'current GitHub meta endpoint',
+    'deny all unsolicited inbound connections',
+    'non-overlapping address space',
+    'private DNS',
+    'perform no TLS interception',
+    'A standard hosted preflight checks assignment',
+    'Do not mark the prerequisite satisfied until readback proves',
+    'maximum concurrency of one',
+    'Remove in dependency order',
+    'live Staging reachability',
+    'Pre-answered platform defaults',
+    'Dev LRS',
+    'ZRS in every environment',
+    'Production: zone-redundant HA',
+    'User-assigned managed identity with OIDC federation',
+    'Small — fewer than 1,000 users',
+    'Cost-optimised with production safeguards',
+    'GitHub Actions secret at the environment level',
+    'Active LTS only',
+    'Provision nothing that no code uses',
+    'known service limits',
+    'refactor the IaC to match the live resources and import',
     'GitHub Secret Protection',
     'Dependabot + Dependency Review',
     'CodeQL + Copilot Autofix',
@@ -48,9 +86,15 @@ const requiredPolicyFragments = [
     'Grype',
     'OWASP ZAP',
     'slsa-github-generator',
+    'The SLSA L3 generator is the one approved exception to SHA-pinning',
+    'expiring action-reference exception',
+    'wildcard, blanket exemption',
     'OSSF Scorecard',
     'Explicitly excluded as duplicates',
     'build once',
+    'qualified release or hotfix candidate SHA',
+    'production `main` merge SHA',
+    'explicitly dispatch',
     'zero traffic',
     'fresh baseline revision',
     'Rollback must never be gated',
@@ -68,11 +112,24 @@ const requiredPolicyFragments = [
     'rulesets idempotently last',
     'read the live rulesets'
 ];
+const forbiddenPolicyFragments = [
+    'DAST must run on a self-hosted runner',
+    'self-hosted runner group with Staging access exists',
+    'Consume it; never attempt to create it',
+    'Treat it as an **external prerequisite**',
+    'share a firewall across repository subscriptions',
+    'NAT Gateway may coexist with Azure Firewall',
+    'resource creation is sufficient proof of Staging connectivity'
+];
 export function validateGovernancePolicy(policy) {
     const missing = requiredPolicyFragments.filter((fragment) => !policy.includes(fragment));
     if (missing.length > 0) {
         throw new Error(`Governance policy is missing required contract fragment: ${missing[0]}`);
     }
+    const forbidden = forbiddenPolicyFragments.find((fragment) => policy.includes(fragment));
+    if (forbidden) {
+        throw new Error(`Governance policy contains forbidden legacy contract fragment: ${forbidden}`);
+    }
     if (!/No change in this repository\s+requires another person's approval/.test(policy) ||
         !policy.includes('Never enable a ruleset whose required contexts have not been observed green')) {
         throw new Error('Governance policy does not preserve fail-closed single-maintainer invariants.');

package/dist/repository-governance.js.map

@@ -1 +1 @@
-{"version":3,"file":"repository-governance.js","sourceRoot":"","sources":["../src/repository-governance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAKvC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAU,CAAC;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAY,CAAC;AACpD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAU,CAAC;AAEzD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,MAAM,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,WAAW,CAAC;IAC/C,OAAO,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,cAAc,CAAC;IACnD,KAAK,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,WAAW,CAAC;IAC9C,gBAAgB,EAAE;QAChB,SAAS;QACT,SAAS;QACT,yCAAyC;KAC1C;IACD,MAAM,EAAE;QACN,SAAS;QACT,UAAU;QACV,kCAAkC;KACnC;CACO,CAAC;AAEX,MAAM,cAAc,GAAG,YAAY,CACjC,IAAI,GAAG,CACL,0DAA0D,EAC1D,OAAO,IAAI,CAAC,GAAG,CAChB,EACD,MAAM,CACP,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AAEnC,MAAM,UAAU,+BAA+B;IAC7C,MAAM,QAAQ,GAAG,cAAc,CAAC;IAChC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACnC,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;AACnC,CAAC;AAED,MAAM,uBAAuB,GAAG;IAC9B,kBAAkB;IAClB,oCAAoC;IACpC,oBAAoB;IACpB,+DAA+D;IAC/D,2BAA2B;IAC3B,eAAe;IACf,cAAc;IACd,oCAAoC;IACpC,kCAAkC;IAClC,mCAAmC;IACnC,mCAAmC;IACnC,uBAAuB;IACvB,cAAc;IACd,wBAAwB;IACxB,0BAA0B;IAC1B,gCAAgC;IAChC,0BAA0B;IAC1B,SAAS;IACT,OAAO;IACP,OAAO;IACP,WAAW;IACX,uBAAuB;IACvB,gBAAgB;IAChB,mCAAmC;IACnC,YAAY;IACZ,cAAc;IACd,yBAAyB;IACzB,8BAA8B;IAC9B,oCAAoC;IACpC,2BAA2B;IAC3B,iBAAiB;IACjB,4BAA4B;IAC5B,0BAA0B;IAC1B,gBAAgB;IAChB,oBAAoB;IACpB,yBAAyB;IACzB,wBAAwB;IACxB,iCAAiC;IACjC,qCAAqC;IACrC,4BAA4B;IAC5B,wBAAwB;CAChB,CAAC;AAEX,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1D,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC3B,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,4DAA4D,OAAO,CAAC,CAAC,CAAC,EAAE,CACzE,CAAC;IACJ,CAAC;IACD,IACE,CAAC,mEAAmE,CAAC,IAAI,CAAC,MAAM,CAAC;QACjF,CAAC,MAAM,CAAC,QAAQ,CAAC,6EAA6E,CAAC,EAC/F,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAAG;IAC1B,0BAA0B;IAC1B,kCAAkC;IAClC,sDAAsD;IACtD,uBAAuB;IACvB,mDAAmD;CAC3C,CAAC;AAEX,MAAM,UAAU,2BAA2B,CAAC,OAAe;IACzD,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;AACH,CAAC;AASD,SAAS,WAAW,CAAC,IAA+D;IAClF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,gBAAgB;QACnD,CAAC,CAAC;YACE;gBACE,EAAE,EAAE,iBAAiB;gBACrB,YAAY,EAAE,CAAC,SAAS,CAAC;gBACzB,UAAU,EAAE,IAAI;gBAChB,IAAI,EAAE;oBACJ,MAAM;oBACN,UAAU;oBACV,SAAS;oBACT,MAAM;oBACN,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;wBAClD,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC;wBAC1B,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;YACD;gBACE,EAAE,EAAE,cAAc;gBAClB,YAAY,EAAE,CAAC,SAAS,CAAC;gBACzB,UAAU,EAAE,IAAI;gBAChB,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC;aAC9C;SACF;QACH,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,cAAc;YACnC,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,iBAAiB;oBACrB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,IAAI,CAAC;iBACb;gBACD;oBACE,EAAE,EAAE,eAAe;oBACnB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;iBACvB;gBACD;oBACE,EAAE,EAAE,cAAc;oBAClB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,MAAM,CAAC;iBACf;aACF;YACH,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,iBAAiB;oBACrB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC;iBAC1B;gBACD;oBACE,EAAE,EAAE,cAAc;oBAClB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;iBACxB;aACF,CAAC;IACR,OAAO;QACL,GAAG,OAAO;QACV,GAAG,CAAC,IAAI,CAAC,eAAe;YACtB,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,kBAAkB;oBACtB,YAAY,EAAE,CAAC,UAAU,CAAC;oBAC1B,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,IAAI,CAAC;iBACb;gBACD;oBACE,EAAE,EAAE,gBAAgB;oBACpB,YAAY,EAAE,CAAC,UAAU,CAAC;oBAC1B,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;iBACvB;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;YAClD,CAAC,CAAC,CAAC;oBACC,EAAE,EAAE,sBAAsB;oBAC1B,YAAY,EAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;oBACxD,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE;wBACJ,KAAK;wBACL,WAAW;wBACX,eAAe;wBACf,aAAa;wBACb,GAAG;wBACH,QAAQ;wBACR,IAAI;wBACJ,QAAQ;wBACR,IAAI;qBACL;iBACF,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;QACP;YACE,EAAE,EAAE,sBAAsB;YAC1B,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,QAAQ;YACpB,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC;SAClC;QACD;YACE,EAAE,EAAE,iBAAiB;YACrB,YAAY,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;YACrD,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC;SACtC;QACD;YACE,EAAE,EAAE,qBAAqB;YACzB,YAAY,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;YACrD,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC;SACjC;QACD;YACE,EAAE,EAAE,mBAAmB;YACvB,YAAY,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;YACrD,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAiB;IAC1C,MAAM,MAAM,GAAG;QACb,aAAa,EAAE,8BAA8B;QAC7C,MAAM,EAAE;YACN,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE;YAClC,OAAO,EAAE,uBAAuB;YAChC,KAAK,EAAE,mBAAmB;YAC1B,eAAe,EAAE,YAAY;SAC9B;QACD,OAAO,EAAE;YACP,IAAI,EAAE,IAAI,CAAC,WAAW;YACtB,QAAQ,EAAE,IAAI,CAAC,eAAe;YAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,QAAQ,KAAK,qBAAqB;gBACnD,CAAC,CAAC,oCAAoC;gBACtC,CAAC,CAAC,IAAI,CAAC,eAAe;oBACpB,CAAC,CAAC,qCAAqC;oBACvC,CAAC,CAAC,mBAAmB;SAC1B;QACD,cAAc,EAAE;YACd,EAAE,EAAE,cAAc,CAAC,EAAE;YACrB,UAAU,EAAE,cAAc,CAAC,UAAU;YACrC,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO;YAC1C,GAAG,EAAE,cAAc,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO;YAC/C,SAAS,EAAE;gBACT,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE;gBACrB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;aAChC;SACF;QACD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,SAAS,EAAE;YACT,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE;YACxB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;YAC/B,GAAG,CAAC,IAAI,CAAC,YAAY;gBACnB,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC;SACR;QACD,SAAS,EAAE;YACT,gBAAgB,EAAE,cAAc;YAChC,aAAa,EAAE,cAAc;YAC7B,IAAI,EAAE,cAAc;YACpB,uBAAuB,EAAE,cAAc;YACvC,QAAQ,EAAE,cAAc;YACxB,eAAe,EAAE,cAAc;YAC/B,wBAAwB,EAAE,cAAc;YACxC,mBAAmB,EAAE,cAAc;YACnC,eAAe,EAAE,cAAc;YAC/B,yBAAyB,EAAE,cAAc;YACzC,mBAAmB,EAAE,cAAc;YACnC,mBAAmB,EAAE,cAAc;YACnC,mBAAmB,EAAE,cAAc;YACnC,cAAc,EAAE,cAAc;SAC/B;KACF,CAAC;IAEF,IAAI,IAAI,CAAC,QAAQ,KAAK,qBAAqB,EAAE,CAAC;QAC5C,OAAO;YACL,GAAG,MAAM;YACT,cAAc,EAAE;gBACd,GAAG,MAAM,CAAC,cAAc;gBACxB,WAAW,EAAE;oBACX,KAAK,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBACrD,QAAQ,CAAC,YAAY,CAAC,KAAK;oBAC9B,IAAI,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBACpD,QAAQ,CAAC,eAAe,CAAC,IAAI;oBAChC,UAAU,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBAC1D,QAAQ,CAAC,eAAe,CAAC,UAAU;oBACtC,YAAY,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBAC5D,QAAQ,CAAC,YAAY,CAAC,uBAAuB,CAAC;iBAClD;aACF;YACD,MAAM,EAAE;gBACN,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;gBACnC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;gBACvB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;aAC5B;YACD,QAAQ,EAAE;gBACR,EAAE,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE;gBACzE,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;gBAC/E,EAAE,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE;aAClF;YACD,mBAAmB,EAAE;gBACnB,eAAe,EAAE,WAAW;gBAC5B,OAAO,EAAE,cAAc;gBACvB,QAAQ,EAAE,cAAc;gBACxB,MAAM,EAAE,cAAc;gBACtB,QAAQ,EAAE,cAAc;gBACxB,eAAe,EAAE,cAAc;gBAC/B,wBAAwB,EAAE,cAAc;gBACxC,OAAO,EAAE,cAAc;gBACvB,aAAa,EAAE,cAAc;gBAC7B,uBAAuB,EAAE,yBAAyB;aACnD;YACD,YAAY,EAAE,EAAE;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAChE,OAAO;QACL,GAAG,MAAM;QACT,cAAc,EAAE;YACd,GAAG,MAAM,CAAC,cAAc;YACxB,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,gBAAgB;gBACnD,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO;gBACxC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,cAAc;oBACnC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO;oBACtC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO;YACxC,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO;SACnD;QACD,GAAG,EAAE;YACH,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACvB,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO;gBAC3B,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE;gBAC9B,CAAC,CAAC,EAAE,CAAC;SACR;QACD,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC;QAC3B,mBAAmB,EAAE;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB;YACD,QAAQ,EAAE,IAAI,CAAC,eAAe;gBAC5B,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE;gBACjD,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE;YAC7B,MAAM,EAAE,MAAM;gBACZ,CAAC,CAAC;oBACE,KAAK,EAAE,WAAW;oBAClB,SAAS,EAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;iBACtD;gBACH,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE;YAC7B,MAAM,EAAE;gBACN,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,CAAC,oBAAoB,CAAC;aAClC;YACD,QAAQ,EAAE;gBACR,KAAK,EAAE,wBAAwB;gBAC/B,SAAS,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;aACnD;SACF;QACD,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;QACpE,UAAU,EAAE;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACxB,SAAS,EAAE,cAAc;YACzB,wBAAwB,EAAE,yBAAyB;YACnD,OAAO,EAAE,4CAA4C;SACtD;QACD,MAAM,EAAE;YACN;gBACE,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,SAAS;aACjB;YACD;gBACE,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,SAAS;gBAChB,GAAG,EAAE,2DAA2D;aACjE;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,aAAa,KAAK,8BAA8B,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IACE,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,2BAA2B;QACpD,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,uBAAuB;QAChD,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,mBAAmB;QAC1C,KAAK,CAAC,MAAM,CAAC,eAAe,KAAK,YAAY,EAC7C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,cAAc,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAiB;IACvD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IACvD,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAiB;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1C,KAAK,CAAC,EAAE,KAAK,gBAAgB;QAC3B,CAAC,CAAC,8EAA8E;QAChF,CAAC,CAAC,2EAA2E,CAChF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO;;;;;;;;;;;;;;;EAeP,SAAS;;;;;;;;6CAQkC,IAAI,CAAC,YAAY,CAAC,KAAK;;;;;CAKnE,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAiB;IAC5C,OAAO;;;;;;;;;;;gDAWuC,IAAI,CAAC,YAAY,CAAC,KAAK;;2CAE5B,IAAI,CAAC,YAAY,CAAC,KAAK;;;;CAIjE,CAAC;AACF,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,IAAiB;IAEjB,IAAI,IAAI,CAAC,iBAAiB,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;QACzC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,+BAA+B,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC;IAC3D,MAAM,QAAQ,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC;IAC5D,MAAM,SAAS,GAAwB;QACrC;YACE,WAAW,EAAE,8BAA8B;YAC3C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,MAAM,CAAC;YAC9C,OAAO,EAAE,MAAM;SAChB;QACD;YACE,WAAW,EAAE,+BAA+B;YAC5C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,OAAO,CAAC;YAC/C,OAAO,EAAE,OAAO;SACjB;QACD;YACE,WAAW,EAAE,6BAA6B;YAC1C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC;YAC7C,OAAO,EAAE,KAAK;SACf;QACD,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAqB,EAAE,CAAC,CAAC;YAChD,WAAW,EAAE,KAAK,CAAC,EAAE,KAAK,gBAAgB;gBACxC,CAAC,CAAC,wCAAwC;gBAC1C,CAAC,CAAC,uCAAuC;YAC3C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;KACJ,CAAC;IACF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,2BAA2B,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"repository-governance.js","sourceRoot":"","sources":["../src/repository-governance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAKvC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAU,CAAC;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAY,CAAC;AACpD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAU,CAAC;AAEzD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,MAAM,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,WAAW,CAAC;IAC/C,OAAO,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,cAAc,CAAC;IACnD,KAAK,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,WAAW,CAAC;IAC9C,gBAAgB,EAAE;QAChB,SAAS;QACT,SAAS;QACT,yCAAyC;KAC1C;IACD,MAAM,EAAE;QACN,SAAS;QACT,UAAU;QACV,kCAAkC;KACnC;CACO,CAAC;AAEX,MAAM,cAAc,GAAG,YAAY,CACjC,IAAI,GAAG,CACL,0DAA0D,EAC1D,OAAO,IAAI,CAAC,GAAG,CAChB,EACD,MAAM,CACP,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AAEnC,MAAM,UAAU,+BAA+B;IAC7C,MAAM,QAAQ,GAAG,cAAc,CAAC;IAChC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACnC,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;AACnC,CAAC;AAED,MAAM,uBAAuB,GAAG;IAC9B,kBAAkB;IAClB,oCAAoC;IACpC,oBAAoB;IACpB,+DAA+D;IAC/D,2BAA2B;IAC3B,eAAe;IACf,cAAc;IACd,oCAAoC;IACpC,kCAAkC;IAClC,mCAAmC;IACnC,mCAAmC;IACnC,uBAAuB;IACvB,cAAc;IACd,wBAAwB;IACxB,kCAAkC;IAClC,kCAAkC;IAClC,sBAAsB;IACtB,wCAAwC;IACxC,yDAAyD;IACzD,yCAAyC;IACzC,mCAAmC;IACnC,mDAAmD;IACnD,uBAAuB;IACvB,2EAA2E;IAC3E,0CAA0C;IAC1C,sBAAsB;IACtB,mBAAmB;IACnB,+CAA+C;IAC/C,4CAA4C;IAC5C,0CAA0C;IAC1C,8BAA8B;IAC9B,0CAA0C;IAC1C,+BAA+B;IAC/B,aAAa;IACb,6BAA6B;IAC7B,+CAA+C;IAC/C,8DAA8D;IAC9D,4BAA4B;IAC5B,4BAA4B;IAC5B,2BAA2B;IAC3B,gCAAgC;IAChC,SAAS;IACT,0BAA0B;IAC1B,+BAA+B;IAC/B,qDAAqD;IACrD,gCAAgC;IAChC,2CAA2C;IAC3C,gDAAgD;IAChD,iBAAiB;IACjB,qCAAqC;IACrC,sBAAsB;IACtB,yDAAyD;IACzD,0BAA0B;IAC1B,gCAAgC;IAChC,0BAA0B;IAC1B,SAAS;IACT,OAAO;IACP,OAAO;IACP,WAAW;IACX,uBAAuB;IACvB,oEAAoE;IACpE,qCAAqC;IACrC,6BAA6B;IAC7B,gBAAgB;IAChB,mCAAmC;IACnC,YAAY;IACZ,2CAA2C;IAC3C,6BAA6B;IAC7B,qBAAqB;IACrB,cAAc;IACd,yBAAyB;IACzB,8BAA8B;IAC9B,oCAAoC;IACpC,2BAA2B;IAC3B,iBAAiB;IACjB,4BAA4B;IAC5B,0BAA0B;IAC1B,gBAAgB;IAChB,oBAAoB;IACpB,yBAAyB;IACzB,wBAAwB;IACxB,iCAAiC;IACjC,qCAAqC;IACrC,4BAA4B;IAC5B,wBAAwB;CAChB,CAAC;AAEX,MAAM,wBAAwB,GAAG;IAC/B,uCAAuC;IACvC,qDAAqD;IACrD,wCAAwC;IACxC,0CAA0C;IAC1C,kDAAkD;IAClD,6CAA6C;IAC7C,+DAA+D;CACvD,CAAC;AAEX,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1D,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC3B,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,4DAA4D,OAAO,CAAC,CAAC,CAAC,EAAE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC3D,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC1B,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,kEAAkE,SAAS,EAAE,CAC9E,CAAC;IACJ,CAAC;IACD,IACE,CAAC,mEAAmE,CAAC,IAAI,CAAC,MAAM,CAAC;QACjF,CAAC,MAAM,CAAC,QAAQ,CAAC,6EAA6E,CAAC,EAC/F,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAAG;IAC1B,0BAA0B;IAC1B,kCAAkC;IAClC,sDAAsD;IACtD,uBAAuB;IACvB,mDAAmD;CAC3C,CAAC;AAEX,MAAM,UAAU,2BAA2B,CAAC,OAAe;IACzD,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;AACH,CAAC;AASD,SAAS,WAAW,CAAC,IAA+D;IAClF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,gBAAgB;QACnD,CAAC,CAAC;YACE;gBACE,EAAE,EAAE,iBAAiB;gBACrB,YAAY,EAAE,CAAC,SAAS,CAAC;gBACzB,UAAU,EAAE,IAAI;gBAChB,IAAI,EAAE;oBACJ,MAAM;oBACN,UAAU;oBACV,SAAS;oBACT,MAAM;oBACN,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;wBAClD,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC;wBAC1B,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;YACD;gBACE,EAAE,EAAE,cAAc;gBAClB,YAAY,EAAE,CAAC,SAAS,CAAC;gBACzB,UAAU,EAAE,IAAI;gBAChB,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC;aAC9C;SACF;QACH,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,cAAc;YACnC,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,iBAAiB;oBACrB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,IAAI,CAAC;iBACb;gBACD;oBACE,EAAE,EAAE,eAAe;oBACnB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;iBACvB;gBACD;oBACE,EAAE,EAAE,cAAc;oBAClB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,MAAM,CAAC;iBACf;aACF;YACH,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,iBAAiB;oBACrB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC;iBAC1B;gBACD;oBACE,EAAE,EAAE,cAAc;oBAClB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;iBACxB;aACF,CAAC;IACR,OAAO;QACL,GAAG,OAAO;QACV,GAAG,CAAC,IAAI,CAAC,eAAe;YACtB,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,kBAAkB;oBACtB,YAAY,EAAE,CAAC,UAAU,CAAC;oBAC1B,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,IAAI,CAAC;iBACb;gBACD;oBACE,EAAE,EAAE,gBAAgB;oBACpB,YAAY,EAAE,CAAC,UAAU,CAAC;oBAC1B,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;iBACvB;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;YAClD,CAAC,CAAC,CAAC;oBACC,EAAE,EAAE,sBAAsB;oBAC1B,YAAY,EAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;oBACxD,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE;wBACJ,KAAK;wBACL,WAAW;wBACX,eAAe;wBACf,aAAa;wBACb,GAAG;wBACH,QAAQ;wBACR,IAAI;wBACJ,QAAQ;wBACR,IAAI;qBACL;iBACF,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;QACP;YACE,EAAE,EAAE,sBAAsB;YAC1B,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,QAAQ;YACpB,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC;SAClC;QACD;YACE,EAAE,EAAE,iBAAiB;YACrB,YAAY,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;YACrD,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC;SACtC;QACD;YACE,EAAE,EAAE,qBAAqB;YACzB,YAAY,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;YACrD,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC;SACjC;QACD;YACE,EAAE,EAAE,mBAAmB;YACvB,YAAY,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;YACrD,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAiB;IAC1C,MAAM,MAAM,GAAG;QACb,aAAa,EAAE,8BAA8B;QAC7C,MAAM,EAAE;YACN,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE;YAClC,OAAO,EAAE,uBAAuB;YAChC,KAAK,EAAE,mBAAmB;YAC1B,eAAe,EAAE,YAAY;SAC9B;QACD,OAAO,EAAE;YACP,IAAI,EAAE,IAAI,CAAC,WAAW;YACtB,QAAQ,EAAE,IAAI,CAAC,eAAe;YAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,QAAQ,KAAK,qBAAqB;gBACnD,CAAC,CAAC,oCAAoC;gBACtC,CAAC,CAAC,IAAI,CAAC,eAAe;oBACpB,CAAC,CAAC,qCAAqC;oBACvC,CAAC,CAAC,mBAAmB;SAC1B;QACD,cAAc,EAAE;YACd,EAAE,EAAE,cAAc,CAAC,EAAE;YACrB,UAAU,EAAE,cAAc,CAAC,UAAU;YACrC,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO;YAC1C,GAAG,EAAE,cAAc,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO;YAC/C,SAAS,EAAE;gBACT,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE;gBACrB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;aAChC;SACF;QACD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,SAAS,EAAE;YACT,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE;YACxB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;YAC/B,GAAG,CAAC,IAAI,CAAC,YAAY;gBACnB,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC;SACR;QACD,SAAS,EAAE;YACT,gBAAgB,EAAE,cAAc;YAChC,aAAa,EAAE,cAAc;YAC7B,IAAI,EAAE,cAAc;YACpB,uBAAuB,EAAE,cAAc;YACvC,QAAQ,EAAE,cAAc;YACxB,eAAe,EAAE,cAAc;YAC/B,wBAAwB,EAAE,cAAc;YACxC,mBAAmB,EAAE,cAAc;YACnC,eAAe,EAAE,cAAc;YAC/B,yBAAyB,EAAE,cAAc;YACzC,mBAAmB,EAAE,cAAc;YACnC,mBAAmB,EAAE,cAAc;YACnC,mBAAmB,EAAE,cAAc;YACnC,cAAc,EAAE,cAAc;SAC/B;KACF,CAAC;IAEF,IAAI,IAAI,CAAC,QAAQ,KAAK,qBAAqB,EAAE,CAAC;QAC5C,OAAO;YACL,GAAG,MAAM;YACT,cAAc,EAAE;gBACd,GAAG,MAAM,CAAC,cAAc;gBACxB,WAAW,EAAE;oBACX,KAAK,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBACrD,QAAQ,CAAC,YAAY,CAAC,KAAK;oBAC9B,IAAI,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBACpD,QAAQ,CAAC,eAAe,CAAC,IAAI;oBAChC,UAAU,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBAC1D,QAAQ,CAAC,eAAe,CAAC,UAAU;oBACtC,YAAY,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBAC5D,QAAQ,CAAC,YAAY,CAAC,uBAAuB,CAAC;iBAClD;aACF;YACD,MAAM,EAAE;gBACN,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;gBACnC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;gBACvB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;aAC5B;YACD,QAAQ,EAAE;gBACR,EAAE,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE;gBACzE,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;gBAC/E,EAAE,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE;aAClF;YACD,mBAAmB,EAAE;gBACnB,eAAe,EAAE,WAAW;gBAC5B,OAAO,EAAE,cAAc;gBACvB,QAAQ,EAAE,cAAc;gBACxB,MAAM,EAAE,cAAc;gBACtB,QAAQ,EAAE,cAAc;gBACxB,eAAe,EAAE,cAAc;gBAC/B,wBAAwB,EAAE,cAAc;gBACxC,OAAO,EAAE,cAAc;gBACvB,aAAa,EAAE,cAAc;gBAC7B,uBAAuB,EAAE,yBAAyB;aACnD;YACD,YAAY,EAAE,EAAE;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAChE,OAAO;QACL,GAAG,MAAM;QACT,cAAc,EAAE;YACd,GAAG,MAAM,CAAC,cAAc;YACxB,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,gBAAgB;gBACnD,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO;gBACxC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,cAAc;oBACnC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO;oBACtC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO;YACxC,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO;SACnD;QACD,GAAG,EAAE;YACH,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACvB,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO;gBAC3B,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE;gBAC9B,CAAC,CAAC,EAAE,CAAC;SACR;QACD,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC;QAC3B,mBAAmB,EAAE;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB;YACD,QAAQ,EAAE,IAAI,CAAC,eAAe;gBAC5B,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE;gBACjD,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE;YAC7B,MAAM,EAAE,MAAM;gBACZ,CAAC,CAAC;oBACE,KAAK,EAAE,WAAW;oBAClB,SAAS,EAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;iBACtD;gBACH,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE;YAC7B,MAAM,EAAE;gBACN,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,CAAC,oBAAoB,CAAC;aAClC;YACD,QAAQ,EAAE;gBACR,KAAK,EAAE,wBAAwB;gBAC/B,SAAS,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;aACnD;SACF;QACD,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;QACpE,UAAU,EAAE;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACxB,SAAS,EAAE,cAAc;YACzB,wBAAwB,EAAE,yBAAyB;YACnD,OAAO,EAAE,4CAA4C;SACtD;QACD,MAAM,EAAE;YACN;gBACE,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,SAAS;aACjB;YACD;gBACE,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,SAAS;gBAChB,GAAG,EAAE,2DAA2D;aACjE;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,aAAa,KAAK,8BAA8B,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IACE,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,2BAA2B;QACpD,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,uBAAuB;QAChD,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,mBAAmB;QAC1C,KAAK,CAAC,MAAM,CAAC,eAAe,KAAK,YAAY,EAC7C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,cAAc,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAiB;IACvD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IACvD,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAiB;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1C,KAAK,CAAC,EAAE,KAAK,gBAAgB;QAC3B,CAAC,CAAC,8EAA8E;QAChF,CAAC,CAAC,2EAA2E,CAChF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO;;;;;;;;;;;;;;;EAeP,SAAS;;;;;;;;6CAQkC,IAAI,CAAC,YAAY,CAAC,KAAK;;;;;CAKnE,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAiB;IAC5C,OAAO;;;;;;;;;;;gDAWuC,IAAI,CAAC,YAAY,CAAC,KAAK;;2CAE5B,IAAI,CAAC,YAAY,CAAC,KAAK;;;;CAIjE,CAAC;AACF,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,IAAiB;IAEjB,IAAI,IAAI,CAAC,iBAAiB,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;QACzC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,+BAA+B,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC;IAC3D,MAAM,QAAQ,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC;IAC5D,MAAM,SAAS,GAAwB;QACrC;YACE,WAAW,EAAE,8BAA8B;YAC3C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,MAAM,CAAC;YAC9C,OAAO,EAAE,MAAM;SAChB;QACD;YACE,WAAW,EAAE,+BAA+B;YAC5C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,OAAO,CAAC;YAC/C,OAAO,EAAE,OAAO;SACjB;QACD;YACE,WAAW,EAAE,6BAA6B;YAC1C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC;YAC7C,OAAO,EAAE,KAAK;SACf;QACD,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAqB,EAAE,CAAC,CAAC;YAChD,WAAW,EAAE,KAAK,CAAC,EAAE,KAAK,gBAAgB;gBACxC,CAAC,CAAC,wCAAwC;gBAC1C,CAAC,CAAC,uCAAuC;YAC3C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;KACJ,CAAC;IACF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,2BAA2B,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/docs/existing-repositories.md

@@ -98,6 +98,12 @@ Selecting `none` leaves previously managed handoff files as undeleted orphans
 while unrecorded conflicts remain user-owned. No update mode runs an agent or
 activates GitHub settings.
 
+Projects carrying governance policy version 2 preview policy version 3 as
+managed-core drift. Review the new conditional private-runner provisioning
+contract before replacement. Updating the handoff never provisions Azure or
+GitHub resources; reconcile any active downstream runner change with version 3
+before applying its infrastructure.
+
 The schema-v6 transition releases every legacy non-core artifact into project
 provenance without writing, restoring, moving, or deleting its path.
 Intentionally removed infrastructure stays absent and production source stays

package/docs/prerequisites.md

@@ -43,8 +43,9 @@ in to a cloud or agent on your behalf.
 
 The default repository-governance handoff has no additional initialization
 prerequisite. `gh`, a remote, licensed GitHub security features, private runners,
-Slack, and deployment access are discovered only during post-push Phase 0 and
-may be reported as gaps; they do not block local generation.
+Azure and GitHub provisioning authority, Slack, and deployment access are
+discovered only during post-push Phase 0 and may be reported as gaps; they do
+not block local generation or authorize cloud mutation.
 
 ## Preview requirements without writes
 

package/docs/repository-governance.md

@@ -12,8 +12,8 @@ liftoff init --governance none
 ```
 
 Accepting the default or passing `--yes` authorizes only local project files. It
-does not run an agent, mutate Git, contact GitHub, configure security, install a
-ruleset, deploy, or create monitoring.
+does not run an agent, mutate Git, contact GitHub or Azure, configure security,
+install a ruleset, deploy, provision a runner, or create monitoring.
 
 ## Generated files
 
@@ -34,6 +34,96 @@ tools, fail-closed checks, immutable release evidence, build-once promotion,
 deployment and rollback, monitoring and health, DORA metrics, ruleset
 sequencing, negative tests, documentation, and workload adaptation.
 
+Policy version 3 also fixes platform decisions that generated projects should
+not repeatedly ask users to make:
+
+- Dev storage uses LRS; Staging and Production use ZRS. IaC state uses ZRS in
+  every environment.
+- Database HA is off in Dev and Staging and zone-redundant in Production.
+- CI uses one user-assigned managed identity with OIDC federation per repository
+  and environment, without app registrations or long-lived credentials.
+- The default workload is small and cost-optimised with production safeguards.
+  Runtimes remain on Active LTS majors, with grouped dependency updates and
+  non-LTS major updates ignored.
+- Slack webhooks are required environment-level GitHub Actions secrets so the
+  alert path does not depend on private-vault connectivity.
+
+These are applicable defaults, not reasons to create unused resources. A
+managed service is included only when application code consumes it, after its
+cost and known service limits are stated. When live infrastructure differs from
+IaC, activation planning adapts the IaC and imports the live resource rather
+than creating a parallel stack or forcing replacement.
+
+## Private Staging qualification
+
+DAST for a privately networked Staging environment uses an ephemeral
+GitHub-hosted larger runner with Azure VNet injection. Activation reuses a
+suitable existing repository assignment. If none exists, policy version 3
+permits one narrow post-approval exception to provision the Azure network
+setting, organisation hosted-compute network configuration, selected-access
+runner group, and bounded larger runner required by that repository.
+
+Phase 0 first proves that private Staging DAST applies. It then discovers the
+repository's Staging subscription and tenant, existing runner resources, Azure
+and GitHub write authority, enterprise network policy, billing, state, names,
+address space, DNS, routing, costs, limits, and teardown ownership. Missing
+authority or an unresolved input blocks provisioning without partial mutation.
+No self-hosted runner is substituted.
+
+Every Azure runner-network resource, its state, egress cost, and teardown owner
+remain inside the repository's Staging subscription. The design cannot share a
+firewall, hub, route, state, or lifecycle with another repository or
+subscription. GitHub resources exist at organisation level but grant selected
+access only to the target repository and required workflows.
+
+The delegated runner subnet disables implicit default outbound access, denies
+unsolicited inbound connectivity, and uses exactly one egress mode:
+
+- Azure Firewall Basic only when an applicable policy requires domain-restricted
+  egress. Its HTTPS rules use a current GitHub meta domain set without the
+  retired static-IP template or TLS interception.
+- Azure NAT Gateway otherwise, with required protocols constrained by an NSG.
+  NAT and NSG controls do not filter HTTPS by domain.
+
+NAT Gateway cannot be attached to a firewall-routed runner subnet because it
+takes precedence and would bypass the firewall. The approved topology must also
+prove non-overlapping address space, same-subscription routing or peering,
+private DNS, security rules, and live private Staging reachability.
+
+A standard hosted preflight verifies the assignment and labels before scheduling
+DAST. Azure and GitHub resources, associations, egress, DNS, and reachability
+must all be read back successfully. Missing or partial evidence blocks
+qualification rather than leaving a required job queued or reporting success.
+Teardown reverses those dependencies and removes the Azure network only after
+GitHub scheduling, assignment, and service associations are gone.
+
+## Release identity and automated completion
+
+Staging qualifies the release or hotfix candidate commit and binds it to the
+version, artifact digest, and evidence-bundle digest. A later true merge into
+`main` necessarily has a different SHA. Production verifies that the merge
+incorporates the exact qualified candidate, promotes the identical artifact,
+and records both identities:
+
+```text
+candidate SHA -> qualification -> artifact digest
+       |                              |
+       +---------- main merge SHA ----+
+                         |
+                         +-> deployment -> tag and GitHub Release
+```
+
+Package formats may require embedded version metadata, but that value must
+match the authoritative `release/X.Y.Z` or `hotfix/X.Y.Z` branch name.
+
+Release and hotfix back-merges remain pull-request-only and require successful
+checks. Because `GITHUB_TOKEN`-created events do not normally start more
+workflows, the coordinating workflow explicitly dispatches validation for the
+back-merge head and any required post-merge work for the resulting SHA. It does
+not push directly to a protected branch or rely on a tag push. Tag creation,
+Release publication, and durable evidence stay in the successful production
+workflow.
+
 `context.json` contains generated project facts only. GitHub repository state,
 runner access, licensed features, deployments, monitoring, alert routes,
 traffic, and rollout capabilities remain `undiscovered`. Power Apps context
@@ -48,7 +138,10 @@ and API DAST as inapplicable.
 4. The agent performs read-only Phase 0 and reports repository identity,
    artifacts, working commands, refs, workflows and exact checks, rulesets,
    releases, environments, security, runners, deployments, monitoring, alerts,
-   health depth, platform capabilities, gaps, and inapplicable controls.
+   health depth, platform capabilities, gaps, and inapplicable controls. When
+   private Staging DAST applies without a suitable runner, it also reports the
+   complete subscription-local topology, one explicit egress mode, authority,
+   costs, limits, verification, and teardown plan.
 5. The agent proposes the current `main` SHA as the activation baseline,
    presents an ordered plan, and stops.
 6. Explicitly approve or revise the conversational plan. This is not a human
@@ -79,13 +172,26 @@ conflict remains outside Liftoff ownership and produces `handoff-partial`.
 After every conflict is removed or matches the current artifact, the next
 update records the full artifact set as `handoff-generated`.
 
+Projects generated with policy version 2 review the version-3 managed-core drift
+before replacement. `liftoff update` changes only the local handoff; it never
+provisions Azure or GitHub resources. Any active downstream runner change based
+on the external-only version-2 contract must reconcile its plan and
+implementation with version 3 before applying cloud or organisation resources.
+
 Setting `"governanceProfile": "none"` stops future rendering. Previously managed
 handoff files are reported once as orphans and left on disk; Liftoff never
 deletes them automatically or changes live repository settings.
 
 ## Capability gaps
 
-Phase 0 must report missing GitHub licenses, private runners, staging access,
-monitoring routes, parallel-version mechanisms, or statistically meaningful
-canary traffic. It must mark controls inapplicable or blocked rather than
-creating a skipped, hanging, duplicate, or success-shaped placeholder.
+Phase 0 must report missing GitHub licenses, runner-provisioning authority,
+VNet-injected assignment or reachability, Staging access, monitoring routes,
+parallel-version mechanisms, or statistically meaningful canary traffic. It
+must mark controls inapplicable or blocked rather than creating a skipped,
+hanging, partial, duplicate, or success-shaped placeholder.
+
+The official SLSA L3 generator is the policy's only action SHA-pinning
+exception because its reusable workflow contains mutable internal references.
+The outer call is pinned as tightly as supported and the exact exception is
+narrow and expiring. It does not weaken pinning for any other action, create a
+second vulnerability allowlist, or make Grype a blocking gate.

package/docs/safety-and-consent.md

@@ -19,9 +19,10 @@ Interactive sessions ask separately at the point each permission is needed.
 
 Selecting repository governance or passing `--yes` authorizes only deterministic
 local handoff files. It never authorizes agent execution, Git mutation, GitHub
-APIs, rulesets, security configuration, deployment, monitoring, file
-replacement, machine tools, or project dependencies. Live activation begins
-only after commit, push, read-only Phase 0, and explicit plan approval.
+APIs, Azure or other cloud resources, rulesets, security configuration,
+deployment, monitoring, file replacement, machine tools, or project
+dependencies. Live activation begins only after commit, push, read-only Phase 0,
+and explicit plan approval.
 
 ## CLI self-upgrade boundary
 

package/docs/troubleshooting.md

@@ -188,9 +188,14 @@ not active enforcement. Commit and push the repository, run the selected-agent
 launcher, review its read-only Phase 0 report, and explicitly approve the plan
 before the agent creates a governance change.
 
-Missing licenses, a private Staging runner, alert routes, parallel deployment,
-or sufficient canary traffic must be reported as blockers or inapplicable
-controls. Do not replace them with duplicate scanners or placeholder success.
+Missing licenses, runner-provisioning authority, a private Staging assignment or
+reachable network path, alert routes, parallel deployment, or sufficient canary
+traffic must be reported as blockers or inapplicable controls. When private
+Staging DAST applies and no suitable runner exists, Phase 0 may propose the
+policy's repository-dedicated provisioning exception, but it must stop for
+explicit approval before creating any Azure or GitHub resource. Do not replace
+missing capability with duplicate scanners, partial provisioning, or
+placeholder success.
 
 Do not run an older Liftoff release to reverse a completed baseline migration.
 Restore the affected generated files and `liftoff.manifest.json` through version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@msn-control/liftoff",
-  "version": "0.9.4",
+  "version": "0.9.6",
   "description": "Interactive CLI for governed GenAI, API, and Power Apps code app projects.",
   "type": "module",
   "license": "GPL-3.0-only",