@msn-control/liftoff 0.9.7 → 0.9.8

package/assets/governance/single-maintainer-gitflow/policy.md

@@ -1,7 +1,7 @@
 ---
 schemaVersion: 1
 profile: single-maintainer-gitflow
-policyVersion: "3"
+policyVersion: "4"
 state: handoff-generated
 ---
 
@@ -71,6 +71,7 @@ workload actually uses that component; a database default does not justify provi
 | --- | --- |
 | Storage redundancy | **Dev LRS · Staging ZRS · Production ZRS** |
 | IaC state storage | **ZRS in every environment**, including bootstrap |
+| Local bootstrap state retention | **30 days read-only after verified remote import, then securely delete.** |
 | Database high availability | **Dev and Staging: no HA. Production: zone-redundant HA.** |
 | Cloud identity for CI | **User-assigned managed identity with OIDC federation** per repository and environment. No app registrations, no client secrets, no long-lived credentials. |
 | Workload scale | **Small — fewer than 1,000 users** |
@@ -113,7 +114,9 @@ Report before you change anything.
    organisation network configurations; billing owner; remote state owner; deterministic resource
    names; non-overlapping address space; Staging VNet, route, private DNS and security topology;
    required outbound policy; current costs and service limits; and dependency-ordered teardown
-   owner. Any unresolved input is a blocker, not permission to begin a partial bootstrap.
+   owner. Determine whether an approved private management path can already reach the remote backend
+   and, if not, whether the private-backend cycle requires the bounded local bootstrap below. Any
+   unresolved input is a blocker, not permission to begin a partial bootstrap.
 6. What monitoring and alerting already exists — alert rules, action groups, where they route, and
    which components have no coverage at all. Name the gaps explicitly.
 7. Which components expose a health endpoint, and whether it is shallow (process is alive) or deep
@@ -173,6 +176,34 @@ private DNS resolution, and live Staging reachability. A standard hosted preflig
 and labels before scheduling DAST; the larger-runner job proves the private target path. Missing,
 stale, denied, skipped, or partial evidence fails closed.
 
+**Break a private-state bootstrap cycle without transferring state.** Prefer an existing approved
+private management path that can reach the remote backend. If none exists and the private backend
+cannot be reached until repository networking and its restricted execution runner exist, an explicitly
+approved minimum local-state bootstrap may create only those access-establishing resources. Its phase
+is `bootstrap-local`, never `remote-ready`, and it cannot authorize application or unrelated
+infrastructure provisioning.
+
+Keep that local state encrypted at rest on the approved workstation, excluded from version control,
+and under one writer. Record resource identities and a state checksum without state content. Never
+copy local bootstrap state through GitHub artifacts, repository secrets, ordinary messaging, or
+another unapproved transfer path. Public access to the private state backend remains disabled.
+
+From the exact private execution runner, prove private Blob DNS and authenticated backend access,
+initialize the empty repository-owned ZRS backend, and use reviewed declarative imports to adopt every
+bootstrap resource without transferring the local state file. Remote import is verified only when
+each expected live resource identity appears exactly once in remote state, state locking and Blob
+versioning are active, and a clean checkout produces a no-change plan with no create, update, or
+destroy action. If any evidence is missing, the retention clock does not start, local state is not
+deleted, and normal provisioning remains blocked.
+
+After verified remote import, freeze the encrypted local bootstrap state as read-only evidence for
+exactly **30 days**. Retained local state must never run plan or apply. At expiry, securely delete the
+encrypted state and every approved temporary copy by destroying the encryption key and removing the
+encrypted files with platform-management evidence where available; do not claim unverifiable sector
+overwrites on copy-on-write filesystems or SSDs. Record the state identity or checksum, remote-import
+evidence, verification and scheduled deletion timestamps, actual deletion timestamp, operator,
+method, and outcome. The deletion record must contain no state payload, credential, or secret output.
+
 **Remove in dependency order.** Stop new scheduling and repository access first; delete the larger
 runner; remove repository and workflow access; detach and delete the runner group and hosted-compute
 network configuration; delete the Azure network setting and wait for its service association to be
@@ -816,7 +847,9 @@ Inspect and report all of the following with evidence before changing anything:
    tenant, region, organisation and Azure write authority, enterprise network
    policy, billing, state, deterministic names, address space, route or peering,
    private DNS, inbound denial, strict-domain-egress requirement, explicit
-   Firewall Basic or NAT Gateway mode, costs, limits, and teardown ownership.
+   Firewall Basic or NAT Gateway mode, costs, limits, teardown ownership, remote
+   backend reachability, any bounded local-bootstrap need, state custody, remote
+   import evidence, and the fixed 30-day deletion schedule.
 7. Live deployment mechanisms, parallel-version support, version-specific
    origins, traffic volume, statistically valid canary capacity, and provider
    status sources.
@@ -845,12 +878,16 @@ OpenSpec or Spec Kit workflow. The generated Liftoff policy remains an input;
 Liftoff does not own, name, restore, or recreate that active change.
 
 When the approved plan includes the runner provisioning exception, treat it as
-a fail-closed state machine: remote state and the Azure network; delegated
-private subnet and exactly one explicit egress mode; Azure network setting and
-GitHub ID; organisation network configuration; selected-access group; bounded
-larger runner; complete API readback; private DNS and live Staging reachability;
-then DAST eligibility. Stop at the first failed transition and reconcile or
-remove partial resources in reverse dependency order.
+a fail-closed state machine. Use an existing private state path when available;
+otherwise progress through approved minimum `bootstrap-local`; delegated private
+subnet and exactly one explicit egress mode; Azure network setting and GitHub ID;
+organisation network configuration; selected-access group; bounded larger
+runner; private backend proof; declarative remote import; identity, locking,
+versioning and clean no-change verification; remote-ready state; private DNS and
+live Staging reachability; then DAST eligibility. Freeze verified local state
+read-only for 30 days and delete it with evidence at expiry. Stop at the first
+failed transition and reconcile or remove partial resources in reverse
+dependency order.
 
 Author workflows, exact ruleset payloads, runbooks, and documentation first.
 Observe every proposed required context green on all applicable paths, then

package/dist/repository-governance.d.ts

@@ -1,6 +1,6 @@
 import type { GeneratedArtifact, ProjectPlan } from './types.js';
 export declare const governancePolicySchemaVersion: 1;
-export declare const governancePolicyVersion: '3';
+export declare const governancePolicyVersion: '4';
 export declare const governanceContextSchemaVersion: 1;
 export declare const governanceArtifactPaths: {
     readonly policy: readonly ['.liftoff', 'governance', 'policy.md'];

package/dist/repository-governance.js

@@ -1,7 +1,7 @@
 import { readFileSync } from 'node:fs';
 import { supportedStack } from './supported-stack.js';
 export const governancePolicySchemaVersion = 1;
-export const governancePolicyVersion = '3';
+export const governancePolicyVersion = '4';
 export const governanceContextSchemaVersion = 1;
 export const governanceArtifactPaths = {
     policy: ['.liftoff', 'governance', 'policy.md'],
@@ -28,7 +28,7 @@ export function renderCanonicalGovernancePolicy() {
 const requiredPolicyFragments = [
     'schemaVersion: 1',
     'profile: single-maintainer-gitflow',
-    'policyVersion: "3"',
+    'policyVersion: "4"',
     'develop` is the integration branch and the **default branch**',
     'main` is production truth',
     'release/X.Y.Z',
@@ -46,7 +46,7 @@ const requiredPolicyFragments = [
     'private Staging DAST genuinely applies',
     'If DAST is inapplicable, provision no runner networking',
     'consume it without creating a duplicate',
-    'Any unresolved input is a blocker',
+    'unresolved input is a blocker',
     'Every Azure runner-network resource, remote state',
     'Staging subscription.',
     "Do not share or depend on another repository's or subscription's firewall",
@@ -66,9 +66,22 @@ const requiredPolicyFragments = [
     'maximum concurrency of one',
     'Remove in dependency order',
     'live Staging reachability',
+    'Prefer an existing approved',
+    'bootstrap-local',
+    'encrypted at rest on the approved workstation',
+    'copy local bootstrap state through GitHub artifacts',
+    'private Blob DNS and authenticated backend access',
+    'reviewed declarative imports',
+    'state locking and Blob',
+    'clean checkout produces a no-change plan',
+    'retention clock does not start',
+    'Retained local state must never run plan or apply',
+    'destroying the encryption key',
+    'The deletion record must contain no state payload',
     'Pre-answered platform defaults',
     'Dev LRS',
     'ZRS in every environment',
+    '30 days read-only after verified remote import',
     'Production: zone-redundant HA',
     'User-assigned managed identity with OIDC federation',
     'Small — fewer than 1,000 users',
@@ -119,7 +132,11 @@ const forbiddenPolicyFragments = [
     'Treat it as an **external prerequisite**',
     'share a firewall across repository subscriptions',
     'NAT Gateway may coexist with Azure Firewall',
-    'resource creation is sufficient proof of Staging connectivity'
+    'resource creation is sufficient proof of Staging connectivity',
+    'retain local bootstrap state indefinitely',
+    'upload local bootstrap state as a GitHub artifact',
+    'delete local bootstrap state immediately after import',
+    'retained local state remains an active backend'
 ];
 export function validateGovernancePolicy(policy) {
     const missing = requiredPolicyFragments.filter((fragment) => !policy.includes(fragment));

package/dist/repository-governance.js.map

@@ -1 +1 @@
-{"version":3,"file":"repository-governance.js","sourceRoot":"","sources":["../src/repository-governance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAKvC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAU,CAAC;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAY,CAAC;AACpD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAU,CAAC;AAEzD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,MAAM,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,WAAW,CAAC;IAC/C,OAAO,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,cAAc,CAAC;IACnD,KAAK,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,WAAW,CAAC;IAC9C,gBAAgB,EAAE;QAChB,SAAS;QACT,SAAS;QACT,yCAAyC;KAC1C;IACD,MAAM,EAAE;QACN,SAAS;QACT,UAAU;QACV,kCAAkC;KACnC;CACO,CAAC;AAEX,MAAM,cAAc,GAAG,YAAY,CACjC,IAAI,GAAG,CACL,0DAA0D,EAC1D,OAAO,IAAI,CAAC,GAAG,CAChB,EACD,MAAM,CACP,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AAEnC,MAAM,UAAU,+BAA+B;IAC7C,MAAM,QAAQ,GAAG,cAAc,CAAC;IAChC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACnC,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;AACnC,CAAC;AAED,MAAM,uBAAuB,GAAG;IAC9B,kBAAkB;IAClB,oCAAoC;IACpC,oBAAoB;IACpB,+DAA+D;IAC/D,2BAA2B;IAC3B,eAAe;IACf,cAAc;IACd,oCAAoC;IACpC,kCAAkC;IAClC,mCAAmC;IACnC,mCAAmC;IACnC,uBAAuB;IACvB,cAAc;IACd,wBAAwB;IACxB,kCAAkC;IAClC,kCAAkC;IAClC,sBAAsB;IACtB,wCAAwC;IACxC,yDAAyD;IACzD,yCAAyC;IACzC,mCAAmC;IACnC,mDAAmD;IACnD,uBAAuB;IACvB,2EAA2E;IAC3E,0CAA0C;IAC1C,sBAAsB;IACtB,mBAAmB;IACnB,+CAA+C;IAC/C,4CAA4C;IAC5C,0CAA0C;IAC1C,8BAA8B;IAC9B,0CAA0C;IAC1C,+BAA+B;IAC/B,aAAa;IACb,6BAA6B;IAC7B,+CAA+C;IAC/C,8DAA8D;IAC9D,4BAA4B;IAC5B,4BAA4B;IAC5B,2BAA2B;IAC3B,gCAAgC;IAChC,SAAS;IACT,0BAA0B;IAC1B,+BAA+B;IAC/B,qDAAqD;IACrD,gCAAgC;IAChC,2CAA2C;IAC3C,gDAAgD;IAChD,iBAAiB;IACjB,qCAAqC;IACrC,sBAAsB;IACtB,yDAAyD;IACzD,0BAA0B;IAC1B,gCAAgC;IAChC,0BAA0B;IAC1B,SAAS;IACT,OAAO;IACP,OAAO;IACP,WAAW;IACX,uBAAuB;IACvB,oEAAoE;IACpE,qCAAqC;IACrC,6BAA6B;IAC7B,gBAAgB;IAChB,mCAAmC;IACnC,YAAY;IACZ,2CAA2C;IAC3C,6BAA6B;IAC7B,qBAAqB;IACrB,cAAc;IACd,yBAAyB;IACzB,8BAA8B;IAC9B,oCAAoC;IACpC,2BAA2B;IAC3B,iBAAiB;IACjB,4BAA4B;IAC5B,0BAA0B;IAC1B,gBAAgB;IAChB,oBAAoB;IACpB,yBAAyB;IACzB,wBAAwB;IACxB,iCAAiC;IACjC,qCAAqC;IACrC,4BAA4B;IAC5B,wBAAwB;CAChB,CAAC;AAEX,MAAM,wBAAwB,GAAG;IAC/B,uCAAuC;IACvC,qDAAqD;IACrD,wCAAwC;IACxC,0CAA0C;IAC1C,kDAAkD;IAClD,6CAA6C;IAC7C,+DAA+D;CACvD,CAAC;AAEX,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1D,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC3B,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,4DAA4D,OAAO,CAAC,CAAC,CAAC,EAAE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC3D,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC1B,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,kEAAkE,SAAS,EAAE,CAC9E,CAAC;IACJ,CAAC;IACD,IACE,CAAC,mEAAmE,CAAC,IAAI,CAAC,MAAM,CAAC;QACjF,CAAC,MAAM,CAAC,QAAQ,CAAC,6EAA6E,CAAC,EAC/F,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAAG;IAC1B,0BAA0B;IAC1B,kCAAkC;IAClC,sDAAsD;IACtD,uBAAuB;IACvB,mDAAmD;CAC3C,CAAC;AAEX,MAAM,UAAU,2BAA2B,CAAC,OAAe;IACzD,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;AACH,CAAC;AASD,SAAS,WAAW,CAAC,IAA+D;IAClF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,gBAAgB;QACnD,CAAC,CAAC;YACE;gBACE,EAAE,EAAE,iBAAiB;gBACrB,YAAY,EAAE,CAAC,SAAS,CAAC;gBACzB,UAAU,EAAE,IAAI;gBAChB,IAAI,EAAE;oBACJ,MAAM;oBACN,UAAU;oBACV,SAAS;oBACT,MAAM;oBACN,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;wBAClD,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC;wBAC1B,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;YACD;gBACE,EAAE,EAAE,cAAc;gBAClB,YAAY,EAAE,CAAC,SAAS,CAAC;gBACzB,UAAU,EAAE,IAAI;gBAChB,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC;aAC9C;SACF;QACH,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,cAAc;YACnC,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,iBAAiB;oBACrB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,IAAI,CAAC;iBACb;gBACD;oBACE,EAAE,EAAE,eAAe;oBACnB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;iBACvB;gBACD;oBACE,EAAE,EAAE,cAAc;oBAClB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,MAAM,CAAC;iBACf;aACF;YACH,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,iBAAiB;oBACrB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC;iBAC1B;gBACD;oBACE,EAAE,EAAE,cAAc;oBAClB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;iBACxB;aACF,CAAC;IACR,OAAO;QACL,GAAG,OAAO;QACV,GAAG,CAAC,IAAI,CAAC,eAAe;YACtB,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,kBAAkB;oBACtB,YAAY,EAAE,CAAC,UAAU,CAAC;oBAC1B,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,IAAI,CAAC;iBACb;gBACD;oBACE,EAAE,EAAE,gBAAgB;oBACpB,YAAY,EAAE,CAAC,UAAU,CAAC;oBAC1B,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;iBACvB;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;YAClD,CAAC,CAAC,CAAC;oBACC,EAAE,EAAE,sBAAsB;oBAC1B,YAAY,EAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;oBACxD,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE;wBACJ,KAAK;wBACL,WAAW;wBACX,eAAe;wBACf,aAAa;wBACb,GAAG;wBACH,QAAQ;wBACR,IAAI;wBACJ,QAAQ;wBACR,IAAI;qBACL;iBACF,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;QACP;YACE,EAAE,EAAE,sBAAsB;YAC1B,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,QAAQ;YACpB,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC;SAClC;QACD;YACE,EAAE,EAAE,iBAAiB;YACrB,YAAY,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;YACrD,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC;SACtC;QACD;YACE,EAAE,EAAE,qBAAqB;YACzB,YAAY,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;YACrD,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC;SACjC;QACD;YACE,EAAE,EAAE,mBAAmB;YACvB,YAAY,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;YACrD,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAiB;IAC1C,MAAM,MAAM,GAAG;QACb,aAAa,EAAE,8BAA8B;QAC7C,MAAM,EAAE;YACN,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE;YAClC,OAAO,EAAE,uBAAuB;YAChC,KAAK,EAAE,mBAAmB;YAC1B,eAAe,EAAE,YAAY;SAC9B;QACD,OAAO,EAAE;YACP,IAAI,EAAE,IAAI,CAAC,WAAW;YACtB,QAAQ,EAAE,IAAI,CAAC,eAAe;YAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,QAAQ,KAAK,qBAAqB;gBACnD,CAAC,CAAC,oCAAoC;gBACtC,CAAC,CAAC,IAAI,CAAC,eAAe;oBACpB,CAAC,CAAC,qCAAqC;oBACvC,CAAC,CAAC,mBAAmB;SAC1B;QACD,cAAc,EAAE;YACd,EAAE,EAAE,cAAc,CAAC,EAAE;YACrB,UAAU,EAAE,cAAc,CAAC,UAAU;YACrC,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO;YAC1C,GAAG,EAAE,cAAc,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO;YAC/C,SAAS,EAAE;gBACT,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE;gBACrB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;aAChC;SACF;QACD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,SAAS,EAAE;YACT,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE;YACxB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;YAC/B,GAAG,CAAC,IAAI,CAAC,YAAY;gBACnB,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC;SACR;QACD,SAAS,EAAE;YACT,gBAAgB,EAAE,cAAc;YAChC,aAAa,EAAE,cAAc;YAC7B,IAAI,EAAE,cAAc;YACpB,uBAAuB,EAAE,cAAc;YACvC,QAAQ,EAAE,cAAc;YACxB,eAAe,EAAE,cAAc;YAC/B,wBAAwB,EAAE,cAAc;YACxC,mBAAmB,EAAE,cAAc;YACnC,eAAe,EAAE,cAAc;YAC/B,yBAAyB,EAAE,cAAc;YACzC,mBAAmB,EAAE,cAAc;YACnC,mBAAmB,EAAE,cAAc;YACnC,mBAAmB,EAAE,cAAc;YACnC,cAAc,EAAE,cAAc;SAC/B;KACF,CAAC;IAEF,IAAI,IAAI,CAAC,QAAQ,KAAK,qBAAqB,EAAE,CAAC;QAC5C,OAAO;YACL,GAAG,MAAM;YACT,cAAc,EAAE;gBACd,GAAG,MAAM,CAAC,cAAc;gBACxB,WAAW,EAAE;oBACX,KAAK,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBACrD,QAAQ,CAAC,YAAY,CAAC,KAAK;oBAC9B,IAAI,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBACpD,QAAQ,CAAC,eAAe,CAAC,IAAI;oBAChC,UAAU,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBAC1D,QAAQ,CAAC,eAAe,CAAC,UAAU;oBACtC,YAAY,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBAC5D,QAAQ,CAAC,YAAY,CAAC,uBAAuB,CAAC;iBAClD;aACF;YACD,MAAM,EAAE;gBACN,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;gBACnC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;gBACvB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;aAC5B;YACD,QAAQ,EAAE;gBACR,EAAE,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE;gBACzE,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;gBAC/E,EAAE,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE;aAClF;YACD,mBAAmB,EAAE;gBACnB,eAAe,EAAE,WAAW;gBAC5B,OAAO,EAAE,cAAc;gBACvB,QAAQ,EAAE,cAAc;gBACxB,MAAM,EAAE,cAAc;gBACtB,QAAQ,EAAE,cAAc;gBACxB,eAAe,EAAE,cAAc;gBAC/B,wBAAwB,EAAE,cAAc;gBACxC,OAAO,EAAE,cAAc;gBACvB,aAAa,EAAE,cAAc;gBAC7B,uBAAuB,EAAE,yBAAyB;aACnD;YACD,YAAY,EAAE,EAAE;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAChE,OAAO;QACL,GAAG,MAAM;QACT,cAAc,EAAE;YACd,GAAG,MAAM,CAAC,cAAc;YACxB,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,gBAAgB;gBACnD,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO;gBACxC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,cAAc;oBACnC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO;oBACtC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO;YACxC,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO;SACnD;QACD,GAAG,EAAE;YACH,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACvB,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO;gBAC3B,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE;gBAC9B,CAAC,CAAC,EAAE,CAAC;SACR;QACD,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC;QAC3B,mBAAmB,EAAE;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB;YACD,QAAQ,EAAE,IAAI,CAAC,eAAe;gBAC5B,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE;gBACjD,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE;YAC7B,MAAM,EAAE,MAAM;gBACZ,CAAC,CAAC;oBACE,KAAK,EAAE,WAAW;oBAClB,SAAS,EAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;iBACtD;gBACH,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE;YAC7B,MAAM,EAAE;gBACN,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,CAAC,oBAAoB,CAAC;aAClC;YACD,QAAQ,EAAE;gBACR,KAAK,EAAE,wBAAwB;gBAC/B,SAAS,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;aACnD;SACF;QACD,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;QACpE,UAAU,EAAE;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACxB,SAAS,EAAE,cAAc;YACzB,wBAAwB,EAAE,yBAAyB;YACnD,OAAO,EAAE,4CAA4C;SACtD;QACD,MAAM,EAAE;YACN;gBACE,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,SAAS;aACjB;YACD;gBACE,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,SAAS;gBAChB,GAAG,EAAE,2DAA2D;aACjE;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,aAAa,KAAK,8BAA8B,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IACE,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,2BAA2B;QACpD,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,uBAAuB;QAChD,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,mBAAmB;QAC1C,KAAK,CAAC,MAAM,CAAC,eAAe,KAAK,YAAY,EAC7C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,cAAc,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAiB;IACvD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IACvD,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAiB;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1C,KAAK,CAAC,EAAE,KAAK,gBAAgB;QAC3B,CAAC,CAAC,8EAA8E;QAChF,CAAC,CAAC,2EAA2E,CAChF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO;;;;;;;;;;;;;;;EAeP,SAAS;;;;;;;;6CAQkC,IAAI,CAAC,YAAY,CAAC,KAAK;;;;;CAKnE,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAiB;IAC5C,OAAO;;;;;;;;;;;gDAWuC,IAAI,CAAC,YAAY,CAAC,KAAK;;2CAE5B,IAAI,CAAC,YAAY,CAAC,KAAK;;;;CAIjE,CAAC;AACF,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,IAAiB;IAEjB,IAAI,IAAI,CAAC,iBAAiB,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;QACzC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,+BAA+B,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC;IAC3D,MAAM,QAAQ,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC;IAC5D,MAAM,SAAS,GAAwB;QACrC;YACE,WAAW,EAAE,8BAA8B;YAC3C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,MAAM,CAAC;YAC9C,OAAO,EAAE,MAAM;SAChB;QACD;YACE,WAAW,EAAE,+BAA+B;YAC5C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,OAAO,CAAC;YAC/C,OAAO,EAAE,OAAO;SACjB;QACD;YACE,WAAW,EAAE,6BAA6B;YAC1C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC;YAC7C,OAAO,EAAE,KAAK;SACf;QACD,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAqB,EAAE,CAAC,CAAC;YAChD,WAAW,EAAE,KAAK,CAAC,EAAE,KAAK,gBAAgB;gBACxC,CAAC,CAAC,wCAAwC;gBAC1C,CAAC,CAAC,uCAAuC;YAC3C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;KACJ,CAAC;IACF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,2BAA2B,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"repository-governance.js","sourceRoot":"","sources":["../src/repository-governance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAKvC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAU,CAAC;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAY,CAAC;AACpD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAU,CAAC;AAEzD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,MAAM,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,WAAW,CAAC;IAC/C,OAAO,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,cAAc,CAAC;IACnD,KAAK,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,WAAW,CAAC;IAC9C,gBAAgB,EAAE;QAChB,SAAS;QACT,SAAS;QACT,yCAAyC;KAC1C;IACD,MAAM,EAAE;QACN,SAAS;QACT,UAAU;QACV,kCAAkC;KACnC;CACO,CAAC;AAEX,MAAM,cAAc,GAAG,YAAY,CACjC,IAAI,GAAG,CACL,0DAA0D,EAC1D,OAAO,IAAI,CAAC,GAAG,CAChB,EACD,MAAM,CACP,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AAEnC,MAAM,UAAU,+BAA+B;IAC7C,MAAM,QAAQ,GAAG,cAAc,CAAC;IAChC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACnC,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;AACnC,CAAC;AAED,MAAM,uBAAuB,GAAG;IAC9B,kBAAkB;IAClB,oCAAoC;IACpC,oBAAoB;IACpB,+DAA+D;IAC/D,2BAA2B;IAC3B,eAAe;IACf,cAAc;IACd,oCAAoC;IACpC,kCAAkC;IAClC,mCAAmC;IACnC,mCAAmC;IACnC,uBAAuB;IACvB,cAAc;IACd,wBAAwB;IACxB,kCAAkC;IAClC,kCAAkC;IAClC,sBAAsB;IACtB,wCAAwC;IACxC,yDAAyD;IACzD,yCAAyC;IACzC,+BAA+B;IAC/B,mDAAmD;IACnD,uBAAuB;IACvB,2EAA2E;IAC3E,0CAA0C;IAC1C,sBAAsB;IACtB,mBAAmB;IACnB,+CAA+C;IAC/C,4CAA4C;IAC5C,0CAA0C;IAC1C,8BAA8B;IAC9B,0CAA0C;IAC1C,+BAA+B;IAC/B,aAAa;IACb,6BAA6B;IAC7B,+CAA+C;IAC/C,8DAA8D;IAC9D,4BAA4B;IAC5B,4BAA4B;IAC5B,2BAA2B;IAC3B,6BAA6B;IAC7B,iBAAiB;IACjB,+CAA+C;IAC/C,qDAAqD;IACrD,mDAAmD;IACnD,8BAA8B;IAC9B,wBAAwB;IACxB,0CAA0C;IAC1C,gCAAgC;IAChC,mDAAmD;IACnD,+BAA+B;IAC/B,mDAAmD;IACnD,gCAAgC;IAChC,SAAS;IACT,0BAA0B;IAC1B,gDAAgD;IAChD,+BAA+B;IAC/B,qDAAqD;IACrD,gCAAgC;IAChC,2CAA2C;IAC3C,gDAAgD;IAChD,iBAAiB;IACjB,qCAAqC;IACrC,sBAAsB;IACtB,yDAAyD;IACzD,0BAA0B;IAC1B,gCAAgC;IAChC,0BAA0B;IAC1B,SAAS;IACT,OAAO;IACP,OAAO;IACP,WAAW;IACX,uBAAuB;IACvB,oEAAoE;IACpE,qCAAqC;IACrC,6BAA6B;IAC7B,gBAAgB;IAChB,mCAAmC;IACnC,YAAY;IACZ,2CAA2C;IAC3C,6BAA6B;IAC7B,qBAAqB;IACrB,cAAc;IACd,yBAAyB;IACzB,8BAA8B;IAC9B,oCAAoC;IACpC,2BAA2B;IAC3B,iBAAiB;IACjB,4BAA4B;IAC5B,0BAA0B;IAC1B,gBAAgB;IAChB,oBAAoB;IACpB,yBAAyB;IACzB,wBAAwB;IACxB,iCAAiC;IACjC,qCAAqC;IACrC,4BAA4B;IAC5B,wBAAwB;CAChB,CAAC;AAEX,MAAM,wBAAwB,GAAG;IAC/B,uCAAuC;IACvC,qDAAqD;IACrD,wCAAwC;IACxC,0CAA0C;IAC1C,kDAAkD;IAClD,6CAA6C;IAC7C,+DAA+D;IAC/D,2CAA2C;IAC3C,mDAAmD;IACnD,uDAAuD;IACvD,gDAAgD;CACxC,CAAC;AAEX,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1D,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC3B,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,4DAA4D,OAAO,CAAC,CAAC,CAAC,EAAE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC3D,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC1B,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,kEAAkE,SAAS,EAAE,CAC9E,CAAC;IACJ,CAAC;IACD,IACE,CAAC,mEAAmE,CAAC,IAAI,CAAC,MAAM,CAAC;QACjF,CAAC,MAAM,CAAC,QAAQ,CAAC,6EAA6E,CAAC,EAC/F,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAAG;IAC1B,0BAA0B;IAC1B,kCAAkC;IAClC,sDAAsD;IACtD,uBAAuB;IACvB,mDAAmD;CAC3C,CAAC;AAEX,MAAM,UAAU,2BAA2B,CAAC,OAAe;IACzD,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;AACH,CAAC;AASD,SAAS,WAAW,CAAC,IAA+D;IAClF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,gBAAgB;QACnD,CAAC,CAAC;YACE;gBACE,EAAE,EAAE,iBAAiB;gBACrB,YAAY,EAAE,CAAC,SAAS,CAAC;gBACzB,UAAU,EAAE,IAAI;gBAChB,IAAI,EAAE;oBACJ,MAAM;oBACN,UAAU;oBACV,SAAS;oBACT,MAAM;oBACN,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;wBAClD,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC;wBAC1B,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;YACD;gBACE,EAAE,EAAE,cAAc;gBAClB,YAAY,EAAE,CAAC,SAAS,CAAC;gBACzB,UAAU,EAAE,IAAI;gBAChB,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC;aAC9C;SACF;QACH,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,cAAc;YACnC,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,iBAAiB;oBACrB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,IAAI,CAAC;iBACb;gBACD;oBACE,EAAE,EAAE,eAAe;oBACnB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;iBACvB;gBACD;oBACE,EAAE,EAAE,cAAc;oBAClB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,MAAM,CAAC;iBACf;aACF;YACH,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,iBAAiB;oBACrB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC;iBAC1B;gBACD;oBACE,EAAE,EAAE,cAAc;oBAClB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;iBACxB;aACF,CAAC;IACR,OAAO;QACL,GAAG,OAAO;QACV,GAAG,CAAC,IAAI,CAAC,eAAe;YACtB,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,kBAAkB;oBACtB,YAAY,EAAE,CAAC,UAAU,CAAC;oBAC1B,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,IAAI,CAAC;iBACb;gBACD;oBACE,EAAE,EAAE,gBAAgB;oBACpB,YAAY,EAAE,CAAC,UAAU,CAAC;oBAC1B,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;iBACvB;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;YAClD,CAAC,CAAC,CAAC;oBACC,EAAE,EAAE,sBAAsB;oBAC1B,YAAY,EAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;oBACxD,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE;wBACJ,KAAK;wBACL,WAAW;wBACX,eAAe;wBACf,aAAa;wBACb,GAAG;wBACH,QAAQ;wBACR,IAAI;wBACJ,QAAQ;wBACR,IAAI;qBACL;iBACF,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;QACP;YACE,EAAE,EAAE,sBAAsB;YAC1B,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,QAAQ;YACpB,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC;SAClC;QACD;YACE,EAAE,EAAE,iBAAiB;YACrB,YAAY,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;YACrD,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC;SACtC;QACD;YACE,EAAE,EAAE,qBAAqB;YACzB,YAAY,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;YACrD,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC;SACjC;QACD;YACE,EAAE,EAAE,mBAAmB;YACvB,YAAY,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;YACrD,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAiB;IAC1C,MAAM,MAAM,GAAG;QACb,aAAa,EAAE,8BAA8B;QAC7C,MAAM,EAAE;YACN,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE;YAClC,OAAO,EAAE,uBAAuB;YAChC,KAAK,EAAE,mBAAmB;YAC1B,eAAe,EAAE,YAAY;SAC9B;QACD,OAAO,EAAE;YACP,IAAI,EAAE,IAAI,CAAC,WAAW;YACtB,QAAQ,EAAE,IAAI,CAAC,eAAe;YAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,QAAQ,KAAK,qBAAqB;gBACnD,CAAC,CAAC,oCAAoC;gBACtC,CAAC,CAAC,IAAI,CAAC,eAAe;oBACpB,CAAC,CAAC,qCAAqC;oBACvC,CAAC,CAAC,mBAAmB;SAC1B;QACD,cAAc,EAAE;YACd,EAAE,EAAE,cAAc,CAAC,EAAE;YACrB,UAAU,EAAE,cAAc,CAAC,UAAU;YACrC,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO;YAC1C,GAAG,EAAE,cAAc,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO;YAC/C,SAAS,EAAE;gBACT,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE;gBACrB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;aAChC;SACF;QACD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,SAAS,EAAE;YACT,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE;YACxB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;YAC/B,GAAG,CAAC,IAAI,CAAC,YAAY;gBACnB,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC;SACR;QACD,SAAS,EAAE;YACT,gBAAgB,EAAE,cAAc;YAChC,aAAa,EAAE,cAAc;YAC7B,IAAI,EAAE,cAAc;YACpB,uBAAuB,EAAE,cAAc;YACvC,QAAQ,EAAE,cAAc;YACxB,eAAe,EAAE,cAAc;YAC/B,wBAAwB,EAAE,cAAc;YACxC,mBAAmB,EAAE,cAAc;YACnC,eAAe,EAAE,cAAc;YAC/B,yBAAyB,EAAE,cAAc;YACzC,mBAAmB,EAAE,cAAc;YACnC,mBAAmB,EAAE,cAAc;YACnC,mBAAmB,EAAE,cAAc;YACnC,cAAc,EAAE,cAAc;SAC/B;KACF,CAAC;IAEF,IAAI,IAAI,CAAC,QAAQ,KAAK,qBAAqB,EAAE,CAAC;QAC5C,OAAO;YACL,GAAG,MAAM;YACT,cAAc,EAAE;gBACd,GAAG,MAAM,CAAC,cAAc;gBACxB,WAAW,EAAE;oBACX,KAAK,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBACrD,QAAQ,CAAC,YAAY,CAAC,KAAK;oBAC9B,IAAI,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBACpD,QAAQ,CAAC,eAAe,CAAC,IAAI;oBAChC,UAAU,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBAC1D,QAAQ,CAAC,eAAe,CAAC,UAAU;oBACtC,YAAY,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBAC5D,QAAQ,CAAC,YAAY,CAAC,uBAAuB,CAAC;iBAClD;aACF;YACD,MAAM,EAAE;gBACN,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;gBACnC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;gBACvB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;aAC5B;YACD,QAAQ,EAAE;gBACR,EAAE,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE;gBACzE,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;gBAC/E,EAAE,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE;aAClF;YACD,mBAAmB,EAAE;gBACnB,eAAe,EAAE,WAAW;gBAC5B,OAAO,EAAE,cAAc;gBACvB,QAAQ,EAAE,cAAc;gBACxB,MAAM,EAAE,cAAc;gBACtB,QAAQ,EAAE,cAAc;gBACxB,eAAe,EAAE,cAAc;gBAC/B,wBAAwB,EAAE,cAAc;gBACxC,OAAO,EAAE,cAAc;gBACvB,aAAa,EAAE,cAAc;gBAC7B,uBAAuB,EAAE,yBAAyB;aACnD;YACD,YAAY,EAAE,EAAE;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAChE,OAAO;QACL,GAAG,MAAM;QACT,cAAc,EAAE;YACd,GAAG,MAAM,CAAC,cAAc;YACxB,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,gBAAgB;gBACnD,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO;gBACxC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,cAAc;oBACnC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO;oBACtC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO;YACxC,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO;SACnD;QACD,GAAG,EAAE;YACH,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACvB,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO;gBAC3B,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE;gBAC9B,CAAC,CAAC,EAAE,CAAC;SACR;QACD,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC;QAC3B,mBAAmB,EAAE;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB;YACD,QAAQ,EAAE,IAAI,CAAC,eAAe;gBAC5B,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE;gBACjD,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE;YAC7B,MAAM,EAAE,MAAM;gBACZ,CAAC,CAAC;oBACE,KAAK,EAAE,WAAW;oBAClB,SAAS,EAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;iBACtD;gBACH,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE;YAC7B,MAAM,EAAE;gBACN,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,CAAC,oBAAoB,CAAC;aAClC;YACD,QAAQ,EAAE;gBACR,KAAK,EAAE,wBAAwB;gBAC/B,SAAS,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;aACnD;SACF;QACD,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;QACpE,UAAU,EAAE;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACxB,SAAS,EAAE,cAAc;YACzB,wBAAwB,EAAE,yBAAyB;YACnD,OAAO,EAAE,4CAA4C;SACtD;QACD,MAAM,EAAE;YACN;gBACE,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,SAAS;aACjB;YACD;gBACE,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,SAAS;gBAChB,GAAG,EAAE,2DAA2D;aACjE;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,aAAa,KAAK,8BAA8B,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IACE,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,2BAA2B;QACpD,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,uBAAuB;QAChD,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,mBAAmB;QAC1C,KAAK,CAAC,MAAM,CAAC,eAAe,KAAK,YAAY,EAC7C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,cAAc,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAiB;IACvD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IACvD,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAiB;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1C,KAAK,CAAC,EAAE,KAAK,gBAAgB;QAC3B,CAAC,CAAC,8EAA8E;QAChF,CAAC,CAAC,2EAA2E,CAChF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO;;;;;;;;;;;;;;;EAeP,SAAS;;;;;;;;6CAQkC,IAAI,CAAC,YAAY,CAAC,KAAK;;;;;CAKnE,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAiB;IAC5C,OAAO;;;;;;;;;;;gDAWuC,IAAI,CAAC,YAAY,CAAC,KAAK;;2CAE5B,IAAI,CAAC,YAAY,CAAC,KAAK;;;;CAIjE,CAAC;AACF,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,IAAiB;IAEjB,IAAI,IAAI,CAAC,iBAAiB,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;QACzC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,+BAA+B,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC;IAC3D,MAAM,QAAQ,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC;IAC5D,MAAM,SAAS,GAAwB;QACrC;YACE,WAAW,EAAE,8BAA8B;YAC3C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,MAAM,CAAC;YAC9C,OAAO,EAAE,MAAM;SAChB;QACD;YACE,WAAW,EAAE,+BAA+B;YAC5C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,OAAO,CAAC;YAC/C,OAAO,EAAE,OAAO;SACjB;QACD;YACE,WAAW,EAAE,6BAA6B;YAC1C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC;YAC7C,OAAO,EAAE,KAAK;SACf;QACD,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAqB,EAAE,CAAC,CAAC;YAChD,WAAW,EAAE,KAAK,CAAC,EAAE,KAAK,gBAAgB;gBACxC,CAAC,CAAC,wCAAwC;gBAC1C,CAAC,CAAC,uCAAuC;YAC3C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;KACJ,CAAC;IACF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,2BAA2B,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/docs/existing-repositories.md

@@ -98,10 +98,10 @@ Selecting `none` leaves previously managed handoff files as undeleted orphans
 while unrecorded conflicts remain user-owned. No update mode runs an agent or
 activates GitHub settings.
 
-Projects carrying governance policy version 2 preview policy version 3 as
-managed-core drift. Review the new conditional private-runner provisioning
-contract before replacement. Updating the handoff never provisions Azure or
-GitHub resources; reconcile any active downstream runner change with version 3
+Projects carrying governance policy versions 2 or 3 preview policy version 4 as
+managed-core drift. Review the private-runner and bootstrap-state retirement
+contracts before replacement. Updating the handoff never provisions Azure or
+GitHub resources; reconcile any active downstream runner change with version 4
 before applying its infrastructure.
 
 The schema-v6 transition releases every legacy non-core artifact into project

package/docs/prerequisites.md

@@ -47,6 +47,11 @@ Azure and GitHub provisioning authority, Slack, and deployment access are
 discovered only during post-push Phase 0 and may be reported as gaps; they do
 not block local generation or authorize cloud mutation.
 
+When private backend access creates a runner bootstrap cycle, Phase 0 also
+discovers an existing private management path or proposes the policy's bounded
+encrypted local-state bootstrap. Liftoff itself neither creates nor transfers
+state.
+
 ## Preview requirements without writes
 
 `liftoff plan` shows both generated artifacts and workstation requirements

package/docs/repository-governance.md

@@ -34,7 +34,7 @@ tools, fail-closed checks, immutable release evidence, build-once promotion,
 deployment and rollback, monitoring and health, DORA metrics, ruleset
 sequencing, negative tests, documentation, and workload adaptation.
 
-Policy version 3 also fixes platform decisions that generated projects should
+Policy version 4 also fixes platform decisions that generated projects should
 not repeatedly ask users to make:
 
 - Dev storage uses LRS; Staging and Production use ZRS. IaC state uses ZRS in
@@ -47,6 +47,8 @@ not repeatedly ask users to make:
   non-LTS major updates ignored.
 - Slack webhooks are required environment-level GitHub Actions secrets so the
   alert path does not depend on private-vault connectivity.
+- Encrypted local bootstrap state is retained read-only for 30 days after
+  verified remote import, then securely deleted with dated evidence.
 
 These are applicable defaults, not reasons to create unused resources. A
 managed service is included only when application code consumes it, after its
@@ -58,7 +60,7 @@ than creating a parallel stack or forcing replacement.
 
 DAST for a privately networked Staging environment uses an ephemeral
 GitHub-hosted larger runner with Azure VNet injection. Activation reuses a
-suitable existing repository assignment. If none exists, policy version 3
+suitable existing repository assignment. If none exists, policy version 4
 permits one narrow post-approval exception to provision the Azure network
 setting, organisation hosted-compute network configuration, selected-access
 runner group, and bounded larger runner required by that repository.
@@ -97,6 +99,34 @@ qualification rather than leaving a required job queued or reporting success.
 Teardown reverses those dependencies and removes the Azure network only after
 GitHub scheduling, assignment, and service associations are gone.
 
+### Private state bootstrap and retention
+
+Phase 0 prefers an existing approved private execution path to the
+repository-owned ZRS backend. When public access is disabled and no such path
+exists, an approved governance change may use encrypted local OpenTofu state for
+only the minimum networking, private endpoint, DNS, network setting, and
+restricted runner resources needed to establish access. This
+`bootstrap-local` phase is not remote-ready and cannot authorize application
+provisioning.
+
+The local state remains gitignored, single-writer, encrypted on the approved
+workstation, and is never transferred through GitHub artifacts, repository
+secrets, or ordinary messages. From the exact private runner, reviewed import
+declarations adopt the resources into an empty ZRS backend without copying the
+local state file.
+
+Remote import is complete only after private Blob access, exact live-to-state
+resource identity, state locking, Blob versioning, and a clean-checkout
+no-change plan are verified. Failure starts no retention clock and keeps normal
+provisioning blocked.
+
+At successful verification, the local state becomes evidence-only and read-only
+for exactly 30 days. It cannot run plan or apply. At expiry, its encryption key
+and encrypted files are removed, along with every approved temporary copy. A
+dated record captures the state identity or checksum, verification evidence,
+scheduled and actual deletion, operator, method, and outcome without containing
+state data or secrets.
+
 ## Release identity and automated completion
 
 Staging qualifies the release or hotfix candidate commit and binds it to the
@@ -172,11 +202,11 @@ conflict remains outside Liftoff ownership and produces `handoff-partial`.
 After every conflict is removed or matches the current artifact, the next
 update records the full artifact set as `handoff-generated`.
 
-Projects generated with policy version 2 review the version-3 managed-core drift
+Projects generated with policy versions 2 or 3 review the version-4 managed-core drift
 before replacement. `liftoff update` changes only the local handoff; it never
 provisions Azure or GitHub resources. Any active downstream runner change based
-on the external-only version-2 contract must reconcile its plan and
-implementation with version 3 before applying cloud or organisation resources.
+on an older contract must reconcile its plan and implementation with version 4
+before applying cloud or organisation resources.
 
 Setting `"governanceProfile": "none"` stops future rendering. Previously managed
 handoff files are reported once as orphans and left on disk; Liftoff never

package/docs/safety-and-consent.md

@@ -24,6 +24,11 @@ deployment, monitoring, file replacement, machine tools, or project
 dependencies. Live activation begins only after commit, push, read-only Phase 0,
 and explicit plan approval.
 
+An approved downstream local-state bootstrap remains encrypted, gitignored, and
+single-writer. It is never transferred through GitHub artifacts or secrets,
+becomes read-only after verified remote import, and is securely deleted after
+the fixed 30-day retention period with non-sensitive evidence.
+
 ## CLI self-upgrade boundary
 
 `liftoff upgrade` is itself the narrow authorization to replace a supported

package/docs/troubleshooting.md

@@ -197,6 +197,14 @@ explicit approval before creating any Azure or GitHub resource. Do not replace
 missing capability with duplicate scanners, partial provisioning, or
 placeholder success.
 
+If a private ZRS state backend cannot be reached because public network access
+is disabled and no approved private management path exists, do not enable
+public access or upload local state to GitHub. Use the policy's explicitly
+approved minimum `bootstrap-local` phase, adopt resources through declarative
+imports from the private runner, verify identity parity, locking, versioning,
+and a clean no-change plan, then retain the frozen local state read-only for 30
+days before secure deletion.
+
 Do not run an older Liftoff release to reverse a completed baseline migration.
 Restore the affected generated files and `liftoff.manifest.json` through version
 control, then reinstall from the restored locks.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@msn-control/liftoff",
-  "version": "0.9.7",
+  "version": "0.9.8",
   "description": "Interactive CLI for governed GenAI, API, and Power Apps code app projects.",
   "type": "module",
   "license": "GPL-3.0-only",