@msn-control/liftoff 0.9.8 → 0.10.0

package/dist/process-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"process-runner.js","sourceRoot":"","sources":["../src/process-runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,aAAa,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA6BpD,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAwB,EAAE,gBAAgB,GAAa,EAAE;IACrF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC3C,OAAO;QACL,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC;QACnC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;KACzG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,MAAM,OAAO,iBAAiB;IAC5B,KAAK,CAAC,GAAG,CAAC,OAAwB,EAAE,OAAO,GAAsB,EAAE;QACjE,MAAM,cAAc,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACxE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,SAA6B,CAAC;YAClC,IAAI,YAAgC,CAAC;YACrC,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE;gBACpD,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;gBACnE,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACjC,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,CAAC,MAAqB,EAAE,MAA6B,EAAE,EAAE;gBACtE,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO;gBACT,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,KAAK,EAAE,CAAC;oBACV,YAAY,CAAC,KAAK,CAAC,CAAC;gBACtB,CAAC;gBACD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,CAAC;gBAC9B,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,CAAC;gBAC9B,OAAO,CAAC;oBACN,OAAO;oBACP,cAAc;oBACd,MAAM;oBACN,MAAM;oBACN,MAAM;oBACN,MAAM;oBACN,QAAQ;oBACR,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1C,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;gBAClD,MAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACzE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACnB,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;gBAClD,MAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACzE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACnB,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;gBACjD,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC;gBACvB,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC;YAC/B,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAE1B,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,GAAG,CAAC;gBACtD,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;oBACd,QAAQ,GAAG,IAAI,CAAC;oBAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC;gBACvB,CAAC,CAAC,SAAS,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"process-runner.js","sourceRoot":"","sources":["../src/process-runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,aAAa,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA+BpD,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAwB,EAAE,gBAAgB,GAAa,EAAE;IACrF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC3C,OAAO;QACL,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC;QACnC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;KACzG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,eAAe,GAAsB,EAAE;IACxF,OAAO,eAAe;SACnB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;SACnC,MAAM,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,KAAK,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,oBAAoB,CAAC,eAAkC;IAC9D,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnE,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,OAAO;QACL,IAAI,CAAC,KAAa;YAChB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,IAAI,KAAK,CAAC;YACjB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,KAAK;YACH,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAClD,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,iBAAiB;IAC5B,KAAK,CAAC,GAAG,CAAC,OAAwB,EAAE,OAAO,GAAsB,EAAE;QACjE,MAAM,cAAc,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACxE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,SAA6B,CAAC;YAClC,IAAI,YAAgC,CAAC;YACrC,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,cAAc,GAAG,oBAAoB,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;YACxE,MAAM,cAAc,GAAG,oBAAoB,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;YACxE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE;gBACpD,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;gBACnE,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBACxE,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAChC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;YAED,MAAM,MAAM,GAAG,CAAC,MAAqB,EAAE,MAA6B,EAAE,EAAE;gBACtE,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO;gBACT,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,KAAK,EAAE,CAAC;oBACV,YAAY,CAAC,KAAK,CAAC,CAAC;gBACtB,CAAC;gBACD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC;gBACtC,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC;gBACtC,MAAM,IAAI,SAAS,CAAC;gBACpB,MAAM,IAAI,SAAS,CAAC;gBACpB,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9D,MAAM,UAAU,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC;oBAChF,MAAM,UAAU,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC;oBAChF,IAAI,UAAU,EAAE,CAAC;wBACf,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;oBACvD,CAAC;oBACD,IAAI,UAAU,EAAE,CAAC;wBACf,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;oBACvD,CAAC;gBACH,CAAC;gBACD,OAAO,CAAC;oBACN,OAAO;oBACP,cAAc;oBACd,MAAM;oBACN,MAAM;oBACN,MAAM,EAAE,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC;oBACzD,MAAM,EAAE,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC;oBACzD,QAAQ;oBACR,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,mBAAmB,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnG,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;gBAClD,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC/E,MAAM,IAAI,OAAO,CAAC;gBAClB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACnB,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;wBAC1C,IAAI,IAAI,EAAE,CAAC;4BACT,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBACjD,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAClD,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;gBAClD,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC/E,MAAM,IAAI,OAAO,CAAC;gBAClB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACnB,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;wBAC1C,IAAI,IAAI,EAAE,CAAC;4BACT,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBACjD,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAClD,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;gBACjD,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC;gBACvB,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC;YAC/B,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAE1B,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,GAAG,CAAC;gBACtD,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;oBACd,QAAQ,GAAG,IAAI,CAAC;oBAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC;gBACvB,CAAC,CAAC,SAAS,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/repository-governance.d.ts

@@ -1,17 +1,27 @@
 import type { GeneratedArtifact, ProjectPlan } from './types.js';
 export declare const governancePolicySchemaVersion: 1;
-export declare const governancePolicyVersion: '4';
+export declare const governancePolicyVersion: '6';
 export declare const governanceContextSchemaVersion: 1;
 export declare const governanceArtifactPaths: {
     readonly policy: readonly ['.liftoff', 'governance', 'policy.md'];
     readonly context: readonly ['.liftoff', 'governance', 'context.json'];
     readonly guide: readonly ['.liftoff', 'governance', 'README.md'];
-    readonly 'github-copilot': readonly ['.github', 'prompts', 'liftoff-repository-governance.prompt.md'];
-    readonly claude: readonly ['.claude', 'commands', 'liftoff-repository-governance.md'];
+    readonly phaseGraph: readonly ['.liftoff', 'governance', 'phase-graph.json'];
+    readonly compatibility: readonly ['.liftoff', 'governance', 'compatibility.json'];
+    readonly credentialPolicySchema: readonly ['.liftoff', 'governance', 'credential-policy.schema.json'];
+    readonly setup: {
+        readonly 'github-copilot': readonly ['.github', 'prompts', 'liftoff-setup.prompt.md'];
+        readonly claude: readonly ['.claude', 'commands', 'liftoff-setup.md'];
+    };
+    readonly alias: {
+        readonly 'github-copilot': readonly ['.github', 'prompts', 'liftoff-repository-governance.prompt.md'];
+        readonly claude: readonly ['.claude', 'commands', 'liftoff-repository-governance.md'];
+    };
 };
 export declare function renderCanonicalGovernancePolicy(): string;
 export declare function validateGovernancePolicy(policy: string): void;
 export declare function assertGovernanceContentSafe(content: string): void;
+export declare function renderCredentialPolicySchema(): string;
 export declare function validateGovernanceContext(value: unknown): void;
 export declare function renderGovernanceContext(plan: ProjectPlan): string;
 export declare function buildRepositoryGovernanceArtifacts(plan: ProjectPlan): GeneratedArtifact[];

package/dist/repository-governance.js

@@ -1,22 +1,48 @@
 import { readFileSync } from 'node:fs';
 import { supportedStack } from './supported-stack.js';
+import { canonicalJson } from './governance-activation/canonical-json.js';
+import { buildGovernanceCompatibilityMetadata, validateGovernanceCompatibilityMetadata } from './governance-activation/compatibility.js';
+import { canonicalPhaseGraphJson, currentActivationIdentity } from './governance-activation/graph.js';
+import { activationContractVersion, activationStateSchemaVersion, approvalEnvelopeSchemaVersion, credentialPolicySchemaVersion, evidenceHeaderSchemaVersion, governanceActivationPolicyVersion, liftoffActivationPackageVersion, liftoffManifestArtifactVersion, phaseGraphSchemaVersion, supersessionSchemaVersion } from './governance-activation/identity.js';
+import { runnerPreflightDisplayNameTemplate, runnerPreflightOrganizationPermissions, runnerPreflightPatLifetimeDays, runnerPreflightRepositoryPermissions, runnerPreflightRotationLeadDays, runnerPreflightSecretName } from './governance-activation/types.js';
 export const governancePolicySchemaVersion = 1;
-export const governancePolicyVersion = '4';
+export const governancePolicyVersion = '6';
 export const governanceContextSchemaVersion = 1;
+const governanceManagedCoreLogicalNames = [
+    'repository-governance-policy',
+    'repository-governance-context',
+    'repository-governance-guide',
+    'repository-governance-phase-graph',
+    'repository-governance-compatibility',
+    'repository-governance-credential-policy-schema',
+    'liftoff-setup-copilot',
+    'liftoff-setup-claude',
+    'repository-governance-copilot-launcher',
+    'repository-governance-claude-launcher'
+];
 export const governanceArtifactPaths = {
     policy: ['.liftoff', 'governance', 'policy.md'],
     context: ['.liftoff', 'governance', 'context.json'],
     guide: ['.liftoff', 'governance', 'README.md'],
-    'github-copilot': [
-        '.github',
-        'prompts',
-        'liftoff-repository-governance.prompt.md'
-    ],
-    claude: [
-        '.claude',
-        'commands',
-        'liftoff-repository-governance.md'
-    ]
+    phaseGraph: ['.liftoff', 'governance', 'phase-graph.json'],
+    compatibility: ['.liftoff', 'governance', 'compatibility.json'],
+    credentialPolicySchema: ['.liftoff', 'governance', 'credential-policy.schema.json'],
+    setup: {
+        'github-copilot': ['.github', 'prompts', 'liftoff-setup.prompt.md'],
+        claude: ['.claude', 'commands', 'liftoff-setup.md']
+    },
+    alias: {
+        'github-copilot': [
+            '.github',
+            'prompts',
+            'liftoff-repository-governance.prompt.md'
+        ],
+        claude: [
+            '.claude',
+            'commands',
+            'liftoff-repository-governance.md'
+        ]
+    }
 };
 const suppliedPolicy = readFileSync(new URL('../assets/governance/single-maintainer-gitflow/policy.md', import.meta.url), 'utf8').replace(/\r\n/g, '\n').trimEnd();
 export function renderCanonicalGovernancePolicy() {
@@ -28,7 +54,9 @@ export function renderCanonicalGovernancePolicy() {
 const requiredPolicyFragments = [
     'schemaVersion: 1',
     'profile: single-maintainer-gitflow',
-    'policyVersion: "4"',
+    'policyVersion: "6"',
+    'capability chapters, not execution order',
+    'managed phase graph is the sole execution-order authority',
     'develop` is the integration branch and the **default branch**',
     'main` is production truth',
     'release/X.Y.Z',
@@ -82,6 +110,26 @@ const requiredPolicyFragments = [
     'Dev LRS',
     'ZRS in every environment',
     '30 days read-only after verified remote import',
+    'Derive the minimal namespace set',
+    'Microsoft.Network',
+    'GitHub.Network',
+    'resource_provider_registrations = "none"',
+    'missing required namespace and no unrelated provider',
+    'provider-ready',
+    'terminal `Registered` readback',
+    'directly or transitively after its namespace registration',
+    'retained subscription capabilities',
+    'teardown from unregistering them',
+    'Register subscription features only for intended capabilities',
+    'SubscriptionNotRegisteredForFeature',
+    'Do not broaden subscription features',
+    'Microsoft.Network/AllowBringYourOwnPublicIpAddress',
+    'Do not register the BYOIP feature as a workaround',
+    "Validate every network service tag's direction and action",
+    'AzurePlatformDNS',
+    'used only in a Deny rule',
+    'Allow rule for that tag',
+    'allow TCP and UDP port 53 to the exact resolver addresses',
     'Production: zone-redundant HA',
     'User-assigned managed identity with OIDC federation',
     'Small — fewer than 1,000 users',
@@ -136,7 +184,15 @@ const forbiddenPolicyFragments = [
     'retain local bootstrap state indefinitely',
     'upload local bootstrap state as a GitHub artifact',
     'delete local bootstrap state immediately after import',
-    'retained local state remains an active backend'
+    'retained local state remains an active backend',
+    'provider registration may remain pending while resources are created',
+    'approved minimum `bootstrap-local`; delegated private',
+    'register all Azure providers',
+    'unregister provider registrations during teardown',
+    'resource_provider_registrations = "none" requires no explicit registrations',
+    'register AllowBringYourOwnPublicIpAddress for every Standard public IP',
+    'Allow AzurePlatformDNS in an outbound NSG rule',
+    'register any feature named by SubscriptionNotRegisteredForFeature'
 ];
 export function validateGovernancePolicy(policy) {
     const missing = requiredPolicyFragments.filter((fragment) => !policy.includes(fragment));
@@ -154,6 +210,7 @@ export function validateGovernancePolicy(policy) {
 }
 const secretValuePatterns = [
     /\bghp_[A-Za-z0-9]{20,}\b/,
+    /\bgh[orsup]_[A-Za-z0-9_]{20,}\b/,
     /\bgithub_pat_[A-Za-z0-9_]{20,}\b/,
     /https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9/]+/,
     /\bAccountKey=[^;\s]+/i,
@@ -166,6 +223,187 @@ export function assertGovernanceContentSafe(content) {
         }
     }
 }
+function credentialPolicySchema() {
+    const activationIdentityProperties = {
+        liftoffVersion: { const: liftoffActivationPackageVersion },
+        manifestArtifactVersion: { const: liftoffManifestArtifactVersion },
+        policyVersion: { const: governanceActivationPolicyVersion },
+        activationContractVersion: { const: activationContractVersion },
+        phaseGraphSchemaVersion: { const: phaseGraphSchemaVersion },
+        phaseGraphHash: { const: currentActivationIdentity.phaseGraphHash },
+        activationStateSchemaVersion: { const: activationStateSchemaVersion },
+        evidenceHeaderSchemaVersion: { const: evidenceHeaderSchemaVersion },
+        approvalEnvelopeSchemaVersion: { const: approvalEnvelopeSchemaVersion },
+        supersessionSchemaVersion: { const: supersessionSchemaVersion },
+        credentialPolicySchemaVersion: { const: credentialPolicySchemaVersion }
+    };
+    return {
+        $schema: 'https://json-schema.org/draft/2020-12/schema',
+        $id: 'https://mission-control.local/liftoff/governance/credential-policy.schema.v1.json',
+        title: 'Liftoff governance credential policy v1',
+        type: 'object',
+        additionalProperties: false,
+        required: [
+            'schemaVersion',
+            'identity',
+            'repository',
+            'owner',
+            'authKind',
+            'displayNameTemplate',
+            'displayName',
+            'secretName',
+            'createdAt',
+            'expiresAt',
+            'rotationLeadDays',
+            'rotationDueAt',
+            'permissions',
+            'allowedWorkflows',
+            'nonForwarding',
+            'status',
+            'proof',
+            'app',
+            'pat'
+        ],
+        properties: {
+            schemaVersion: { const: credentialPolicySchemaVersion },
+            identity: {
+                type: 'object',
+                additionalProperties: false,
+                required: Object.keys(activationIdentityProperties),
+                properties: activationIdentityProperties
+            },
+            repository: {
+                type: 'object',
+                additionalProperties: false,
+                required: ['id', 'owner', 'name', 'fullName'],
+                properties: {
+                    id: { type: 'string', minLength: 1 },
+                    owner: { type: 'string', minLength: 1 },
+                    name: { type: 'string', minLength: 1 },
+                    fullName: { type: 'string', minLength: 1 }
+                }
+            },
+            owner: { type: 'string', minLength: 1 },
+            authKind: { enum: ['github-app', 'fine-grained-pat'] },
+            displayNameTemplate: { const: runnerPreflightDisplayNameTemplate },
+            displayName: { type: 'string', pattern: '^[A-Za-z0-9_.-]+-runner-preflight-read$' },
+            secretName: { const: runnerPreflightSecretName },
+            createdAt: { type: 'string', format: 'date-time' },
+            expiresAt: { type: 'string', format: 'date-time' },
+            rotationLeadDays: { const: runnerPreflightRotationLeadDays },
+            rotationDueAt: { type: 'string', format: 'date-time' },
+            permissions: {
+                type: 'object',
+                additionalProperties: false,
+                required: ['repository', 'organization'],
+                properties: {
+                    repository: {
+                        type: 'array',
+                        const: [...runnerPreflightRepositoryPermissions]
+                    },
+                    organization: {
+                        type: 'array',
+                        const: [...runnerPreflightOrganizationPermissions]
+                    }
+                }
+            },
+            allowedWorkflows: {
+                type: 'array',
+                items: {
+                    type: 'object',
+                    additionalProperties: false,
+                    required: ['path', 'jobs'],
+                    properties: {
+                        path: { type: 'string', minLength: 1 },
+                        jobs: {
+                            type: 'array',
+                            items: { type: 'string', minLength: 1 },
+                            uniqueItems: true
+                        }
+                    }
+                }
+            },
+            nonForwarding: { const: true },
+            status: { enum: ['active', 'expiring', 'expired', 'compromised'] },
+            proof: {
+                type: 'object',
+                additionalProperties: false,
+                required: ['verifiedAt', 'readbackDigest', 'readbackProvider', 'payloadFree'],
+                properties: {
+                    verifiedAt: { type: 'string', format: 'date-time' },
+                    readbackDigest: { type: 'string', pattern: '^[a-f0-9]{64}$' },
+                    readbackProvider: { enum: ['github-api', 'adapter-fixture'] },
+                    payloadFree: { const: true }
+                }
+            },
+            app: {
+                anyOf: [
+                    { type: 'null' },
+                    {
+                        type: 'object',
+                        additionalProperties: false,
+                        required: ['installationId', 'appSlug', 'selection', 'repositoryFullName', 'permissionsVerifiedAt', 'token'],
+                        properties: {
+                            installationId: { type: 'integer', minimum: 1 },
+                            appSlug: { type: 'string', minLength: 1 },
+                            selection: { const: 'selected-repository' },
+                            repositoryFullName: { type: 'string', minLength: 1 },
+                            permissionsVerifiedAt: { type: 'string', format: 'date-time' },
+                            token: {
+                                type: 'object',
+                                additionalProperties: false,
+                                required: ['strategy', 'ttlSeconds', 'generatedBy'],
+                                properties: {
+                                    strategy: { const: 'installation-token' },
+                                    ttlSeconds: { type: 'integer', minimum: 1, maximum: 3600 },
+                                    generatedBy: { const: 'github-app' }
+                                }
+                            }
+                        }
+                    }
+                ]
+            },
+            pat: {
+                anyOf: [
+                    { type: 'null' },
+                    {
+                        type: 'object',
+                        additionalProperties: false,
+                        required: ['lifetimeDays', 'selectedRepositoryOnly', 'createdBy'],
+                        properties: {
+                            lifetimeDays: { const: runnerPreflightPatLifetimeDays },
+                            selectedRepositoryOnly: { const: true },
+                            createdBy: { const: 'manual-masked-entry' }
+                        }
+                    }
+                ]
+            }
+        },
+        allOf: [
+            {
+                if: { properties: { authKind: { const: 'github-app' } }, required: ['authKind'] },
+                then: {
+                    properties: {
+                        app: { type: 'object' },
+                        pat: { type: 'null' }
+                    }
+                }
+            },
+            {
+                if: { properties: { authKind: { const: 'fine-grained-pat' } }, required: ['authKind'] },
+                then: {
+                    properties: {
+                        app: { type: 'null' },
+                        pat: { type: 'object' }
+                    }
+                }
+            }
+        ]
+    };
+}
+export function renderCredentialPolicySchema() {
+    return canonicalJson(credentialPolicySchema());
+}
 function apiCommands(plan) {
     const backend = plan.apiStack.id === 'python-fastapi'
         ? [
@@ -485,58 +723,112 @@ export function renderGovernanceContext(plan) {
 }
 function renderGovernanceGuide(plan) {
     const launchers = plan.agents.map((agent) => agent.id === 'github-copilot'
-        ? '- GitHub Copilot: `/liftoff-repository-governance` from the repository root.'
-        : '- Claude Code: `/liftoff-repository-governance` from the repository root.').join('\n');
-    return `# Repository governance handoff
+        ? '- GitHub Copilot: `/liftoff-setup` (`/liftoff-repository-governance` remains an alias).'
+        : '- Claude Code: `/liftoff-setup` (`/liftoff-repository-governance` remains an alias).').join('\n');
+    return `# Liftoff deterministic setup
 
-State: **handoff generated; live enforcement is not active**.
+State: **managed setup generated; live enforcement is not active**.
 
 Liftoff generated deterministic policy and workload context only. It did not
 create or change branches, commits, tags, remotes, pull requests, releases,
 rulesets, GitHub settings, security features, environments, runners, cloud
 resources, deployments, monitoring, alerts, or Slack routes.
 
-## Before activation
+## Next command after init
+
+\`\`\`text
+liftoff init ${plan.safeProjectName}
+cd ${plan.safeProjectName}
+/liftoff-setup
+\`\`\`
 
-1. Review \`policy.md\` and \`context.json\`.
-2. Commit the complete project and push it to its intended GitHub repository.
-3. Invoke one selected-agent launcher:
+Use the generated setup integration from any selected agent:
 
 ${launchers}
 
-4. The agent performs read-only Phase 0, reports evidence, gaps,
-   inapplicable controls, the proposed current \`main\` activation SHA, and an
-   ordered plan.
-5. The agent stops. Explicitly approve or revise that conversational plan.
-   This approval is required before implementation and is distinct from the
-   policy's prohibition on human merge or deployment approval gates.
-6. After approval, the agent creates a new ${plan.specWorkflow.label}
-   governance change. Liftoff does not own or recreate that change.
+\`/liftoff-repository-governance\` is preserved only as a compatibility alias
+that enters the same Liftoff governance engine and user-owned activation state.
+
+## What setup does
+
+\`/liftoff-setup\` delegates every transition to
+\`liftoff governance status|plan|apply-next|resume|verify\`. The CLI resolves
+the project root, loads \`phase-graph.json\`, validates policy ${governancePolicyVersion},
+and records no separate setup-integration version.
+
+Before any live governance work, setup completes the deterministic baseline seed:
+\`liftoff validate\`, applicable backend tests, frontend build,
+\`docker compose config -q\`, \`tofu fmt -check -recursive\`,
+\`tofu init -backend=false\`, \`tofu validate\`, and strict ${plan.specWorkflow.label}
+checks. Missing project boundaries are recorded as inapplicable, not successful.
+The seed's completion means generated files were locally verified and archived;
+it does not mean product behavior, infrastructure, or enforcement exists.
+
+Questions are limited to repository publication, credentials, billed resources
+or policy exceptions, final enforcement, destructive cleanup, and external
+blockers. Rerun \`/liftoff-setup\` to resume; verified phases are not repeated.
+
+Runner-preflight credentials are deterministic. Setup first prefers an existing
+verified selected-repository GitHub App with the required read permissions. If a
+fine-grained PAT is required, use display name
+\`${runnerPreflightDisplayNameTemplate}\`, secret
+\`${runnerPreflightSecretName}\`, 30-day lifetime, current repository only,
+repository metadata read, organization hosted-runner and network-configuration
+read, no writes, and the recorded workflow/job allowlist. Enter the value only
+through the masked input; never paste or show it in chat, argv, command
+arguments, logs, evidence, files, or screenshots. A leaked value is compromised and must be
+manually revoked and rotated.
 
 Live status must be proven from user-owned activation evidence and GitHub
 read-back, never inferred from these local files.
 `;
 }
-function renderAgentLauncher(plan) {
-    return `# Activate Liftoff repository governance
+function renderSetupIntegration() {
+    return `# /liftoff-setup
+
+Continue deterministic Liftoff setup for this repository through the same
+deterministic Liftoff governance engine used by compatibility aliases.
 
-Require a committed and pushed GitHub repository. Read
-\`.liftoff/governance/policy.md\` and
-\`.liftoff/governance/context.json\` as the canonical inputs.
+Contract:
+
+1. Work from the current directory; the Liftoff CLI resolves the nearest project root.
+2. Invoke only these commands: \`liftoff governance status --json\`,
+   \`liftoff governance plan --json\`, \`liftoff governance apply-next --json\`,
+   \`liftoff governance resume --json\`, and \`liftoff governance verify --json\`.
+3. Explain blockers, approval requirements, and permitted next actions exactly
+   from command output.
+4. If a blocker may have changed, run \`liftoff governance resume --json\`.
+5. If a next transition is ready and approved, run
+   \`liftoff governance apply-next --json\`, then
+   \`liftoff governance verify --json\`.
+6. Never infer phase completion from prose, tasks, or local files. Never use a
+   separate activation state or duplicate the Liftoff engine.
+`;
+}
+function renderGovernanceAlias() {
+    return `# /liftoff-repository-governance
 
-Perform only the policy's read-only Phase 0. Report all evidence, gaps,
-inapplicable controls, GitFlow or continuous-delivery conflicts, the proposed
-current \`main\` activation baseline SHA, and the ordered implementation plan.
-Then stop for explicit user approval.
+Compatibility alias for \`/liftoff-setup\`.
 
-Before approval, do not write files, create a ${plan.specWorkflow.label} change,
-mutate Git, call a mutating GitHub API, configure security, deploy, or create
-monitoring. After approval, create a new ${plan.specWorkflow.label} governance
-change from the discovered facts. Never treat the Liftoff handoff as live
-enforcement and never create or modify
-\`governance/activation-baseline.json\` before approval.
+Enter the same deterministic Liftoff governance engine and user-owned activation
+state. Follow the \`/liftoff-setup\` contract exactly: invoke only
+\`liftoff governance status --json\`, \`liftoff governance plan --json\`,
+\`liftoff governance apply-next --json\`, \`liftoff governance resume --json\`,
+and \`liftoff governance verify --json\`; explain blockers, approvals, and
+results from their output; and never infer completion or create a separate path.
 `;
 }
+function managedCompatibilityInventory(artifacts) {
+    return artifacts.map((artifact) => ({
+        logicalName: artifact.logicalName,
+        pathParts: artifact.pathParts,
+        lifecycle: 'managed-core',
+        contentHashAuthority: 'liftoff.manifest.json managedArtifacts[].contentHash'
+    }));
+}
+function sortedGovernancePathAllowlist(artifacts) {
+    return artifacts.map((artifact) => [...artifact.pathParts]);
+}
 export function buildRepositoryGovernanceArtifacts(plan) {
     if (plan.governanceProfile.id === 'none') {
         return [];
@@ -544,7 +836,8 @@ export function buildRepositoryGovernanceArtifacts(plan) {
     const policy = renderCanonicalGovernancePolicy();
     const context = renderGovernanceContext(plan);
     const guide = `${renderGovernanceGuide(plan).trimEnd()}\n`;
-    const launcher = `${renderAgentLauncher(plan).trimEnd()}\n`;
+    const setupIntegration = `${renderSetupIntegration().trimEnd()}\n`;
+    const alias = `${renderGovernanceAlias().trimEnd()}\n`;
     const artifacts = [
         {
             logicalName: 'repository-governance-policy',
@@ -567,16 +860,56 @@ export function buildRepositoryGovernanceArtifacts(plan) {
             pathParts: [...governanceArtifactPaths.guide],
             content: guide
         },
-        ...plan.agents.map((agent) => ({
-            logicalName: agent.id === 'github-copilot'
-                ? 'repository-governance-copilot-launcher'
-                : 'repository-governance-claude-launcher',
+        {
+            logicalName: 'repository-governance-phase-graph',
+            category: 'governance',
+            lifecycle: 'managed-core',
+            pathParts: [...governanceArtifactPaths.phaseGraph],
+            content: canonicalPhaseGraphJson
+        },
+        {
+            logicalName: 'repository-governance-compatibility',
             category: 'governance',
             lifecycle: 'managed-core',
-            pathParts: [...governanceArtifactPaths[agent.id]],
-            content: launcher
-        }))
+            pathParts: [...governanceArtifactPaths.compatibility],
+            content: ''
+        },
+        {
+            logicalName: 'repository-governance-credential-policy-schema',
+            category: 'governance',
+            lifecycle: 'managed-core',
+            pathParts: [...governanceArtifactPaths.credentialPolicySchema],
+            content: renderCredentialPolicySchema()
+        },
+        ...plan.agents.flatMap((agent) => [{
+                logicalName: agent.id === 'github-copilot'
+                    ? 'liftoff-setup-copilot'
+                    : 'liftoff-setup-claude',
+                category: 'governance',
+                lifecycle: 'managed-core',
+                pathParts: [...governanceArtifactPaths.setup[agent.id]],
+                content: setupIntegration
+            }, {
+                logicalName: agent.id === 'github-copilot'
+                    ? 'repository-governance-copilot-launcher'
+                    : 'repository-governance-claude-launcher',
+                category: 'governance',
+                lifecycle: 'managed-core',
+                pathParts: [...governanceArtifactPaths.alias[agent.id]],
+                content: alias
+            }])
     ];
+    const compatibility = artifacts.find((artifact) => artifact.logicalName === 'repository-governance-compatibility');
+    if (!compatibility) {
+        throw new Error('Governance compatibility artifact was not rendered.');
+    }
+    const compatibilityMetadata = buildGovernanceCompatibilityMetadata(managedCompatibilityInventory(artifacts), governanceManagedCoreLogicalNames, sortedGovernancePathAllowlist(artifacts));
+    validateGovernanceCompatibilityMetadata(compatibilityMetadata, {
+        logicalNameAllowlist: governanceManagedCoreLogicalNames,
+        pathAllowlist: sortedGovernancePathAllowlist(artifacts),
+        inventory: managedCompatibilityInventory(artifacts)
+    });
+    compatibility.content = `${canonicalJson(compatibilityMetadata)}\n`;
     for (const artifact of artifacts) {
         assertGovernanceContentSafe(artifact.content);
     }