@msn-control/liftoff 0.9.8 → 0.9.9

package/assets/governance/single-maintainer-gitflow/policy.md

@@ -1,7 +1,7 @@
 ---
 schemaVersion: 1
 profile: single-maintainer-gitflow
-policyVersion: "4"
+policyVersion: "5"
 state: handoff-generated
 ---
 
@@ -72,6 +72,7 @@ workload actually uses that component; a database default does not justify provi
 | Storage redundancy | **Dev LRS · Staging ZRS · Production ZRS** |
 | IaC state storage | **ZRS in every environment**, including bootstrap |
 | Local bootstrap state retention | **30 days read-only after verified remote import, then securely delete.** |
+| Azure provider registration | **Derive the minimal namespace set; when auto-registration is disabled, register every missing required provider explicitly before dependent resources.** |
 | Database high availability | **Dev and Staging: no HA. Production: zone-redundant HA.** |
 | Cloud identity for CI | **User-assigned managed identity with OIDC federation** per repository and environment. No app registrations, no client secrets, no long-lived credentials. |
 | Workload scale | **Small — fewer than 1,000 users** |
@@ -115,8 +116,10 @@ Report before you change anything.
    names; non-overlapping address space; Staging VNet, route, private DNS and security topology;
    required outbound policy; current costs and service limits; and dependency-ordered teardown
    owner. Determine whether an approved private management path can already reach the remote backend
-   and, if not, whether the private-backend cycle requires the bounded local bootstrap below. Any
-   unresolved input is a blocker, not permission to begin a partial bootstrap.
+   and, if not, whether the private-backend cycle requires the bounded local bootstrap below. Derive
+   every Azure resource-provider namespace from the approved resource types, record the AzureRM
+   registration mode and subscription registration permission, and read each live registration
+   state. Any unresolved input is a blocker, not permission to begin a partial bootstrap.
 6. What monitoring and alerting already exists — alert rules, action groups, where they route, and
    which components have no coverage at all. Name the gaps explicitly.
 7. Which components expose a health endpoint, and whether it is shallow (process is alive) or deep
@@ -176,6 +179,47 @@ private DNS resolution, and live Staging reachability. A standard hosted preflig
 and labels before scheduling DAST; the larger-runner job proves the private target path. Missing,
 stale, denied, skipped, or partial evidence fails closed.
 
+**Make Azure resource providers ready before dependent provisioning.** Derive and deduplicate the
+minimal namespace inventory from every approved bootstrap, state, network, identity, monitoring, and
+application resource type. A hosted-runner network always requires at least `Microsoft.Network` and
+`GitHub.Network`; include other namespaces only when approved resources use them.
+
+Record whether AzureRM automatic provider registration is enabled and whether the execution identity
+has the required subscription registration permission. When automatic registration is enabled and
+sufficient for every planned namespace, do not add duplicate explicit registrations. When
+`resource_provider_registrations = "none"` or equivalent disables it, explicitly register every
+missing required namespace and no unrelated provider.
+
+Provider inventory and registration form a `provider-ready` transition before `bootstrap-local`,
+remote state, runner networking, or application resources. An already `Registered` namespace is a
+no-op. An absent, unauthorized, `NotRegistered`, `Registering`, `Unregistering`, or failed namespace
+blocks every dependent and billable resource. Wait for terminal `Registered` readback and order every
+resource directly or transitively after its namespace registration. For the runner stack, all VNet,
+subnet, private DNS, private endpoint, firewall, public IP, NAT, NSG, route, and peering resources
+depend on `Microsoft.Network`; `GitHub.Network/networkSettings` also depends on `GitHub.Network`.
+
+Treat successful provider registrations as retained subscription capabilities. Prevent repository
+teardown from unregistering them: remove only repository-owned resources and record that the
+registration may have consumers outside this change. Never infer that an empty resource group or a
+partial apply proves provider readiness.
+
+**Register subscription features only for intended capabilities.** A
+`SubscriptionNotRegisteredForFeature` response is not permission to register the named feature.
+First prove that the approved resource design intentionally uses that capability. If it does not,
+correct the resource properties, pinned provider behavior, or API shape and regenerate the no-apply
+plan. Do not broaden subscription features merely to make a failed apply pass.
+
+Ordinary Firewall or NAT Standard public IPs do not require BYOIP. If one unexpectedly requests
+`Microsoft.Network/AllowBringYourOwnPublicIpAddress` without an approved custom IP prefix, remove
+properties that accidentally trigger BYOIP or use a reviewed supported API shape that does not
+request BYOIP. Do not register the BYOIP feature as a workaround.
+
+**Validate every network service tag's direction and action before apply.** `AzurePlatformDNS` is a
+special outbound tag used only in a Deny rule to disable Azure's default platform DNS; never create an
+Allow rule for that tag. When default Azure DNS remains enabled, no explicit NSG allow is required.
+When approved custom resolvers replace it, allow TCP and UDP port 53 to the exact resolver addresses
+and prove DNS reachability before dependent provisioning.
+
 **Break a private-state bootstrap cycle without transferring state.** Prefer an existing approved
 private management path that can reach the remote backend. If none exists and the private backend
 cannot be reached until repository networking and its restricted execution runner exist, an explicitly
@@ -849,7 +893,9 @@ Inspect and report all of the following with evidence before changing anything:
    private DNS, inbound denial, strict-domain-egress requirement, explicit
    Firewall Basic or NAT Gateway mode, costs, limits, teardown ownership, remote
    backend reachability, any bounded local-bootstrap need, state custody, remote
-   import evidence, and the fixed 30-day deletion schedule.
+   import evidence, the fixed 30-day deletion schedule, minimal Azure namespace
+   inventory, AzureRM registration mode, registration permission, and terminal
+   provider readiness.
 7. Live deployment mechanisms, parallel-version support, version-specific
    origins, traffic volume, statistically valid canary capacity, and provider
    status sources.
@@ -880,7 +926,8 @@ Liftoff does not own, name, restore, or recreate that active change.
 When the approved plan includes the runner provisioning exception, treat it as
 a fail-closed state machine. Use an existing private state path when available;
 otherwise progress through approved minimum `bootstrap-local`; delegated private
-subnet and exactly one explicit egress mode; Azure network setting and GitHub ID;
+namespace inventory and `provider-ready`; subnet and exactly one explicit egress
+mode; Azure network setting and GitHub ID;
 organisation network configuration; selected-access group; bounded larger
 runner; private backend proof; declarative remote import; identity, locking,
 versioning and clean no-change verification; remote-ready state; private DNS and

package/dist/repository-governance.d.ts

@@ -1,6 +1,6 @@
 import type { GeneratedArtifact, ProjectPlan } from './types.js';
 export declare const governancePolicySchemaVersion: 1;
-export declare const governancePolicyVersion: '4';
+export declare const governancePolicyVersion: '5';
 export declare const governanceContextSchemaVersion: 1;
 export declare const governanceArtifactPaths: {
     readonly policy: readonly ['.liftoff', 'governance', 'policy.md'];

package/dist/repository-governance.js

@@ -1,7 +1,7 @@
 import { readFileSync } from 'node:fs';
 import { supportedStack } from './supported-stack.js';
 export const governancePolicySchemaVersion = 1;
-export const governancePolicyVersion = '4';
+export const governancePolicyVersion = '5';
 export const governanceContextSchemaVersion = 1;
 export const governanceArtifactPaths = {
     policy: ['.liftoff', 'governance', 'policy.md'],
@@ -28,7 +28,7 @@ export function renderCanonicalGovernancePolicy() {
 const requiredPolicyFragments = [
     'schemaVersion: 1',
     'profile: single-maintainer-gitflow',
-    'policyVersion: "4"',
+    'policyVersion: "5"',
     'develop` is the integration branch and the **default branch**',
     'main` is production truth',
     'release/X.Y.Z',
@@ -82,6 +82,26 @@ const requiredPolicyFragments = [
     'Dev LRS',
     'ZRS in every environment',
     '30 days read-only after verified remote import',
+    'Derive the minimal namespace set',
+    'Microsoft.Network',
+    'GitHub.Network',
+    'resource_provider_registrations = "none"',
+    'missing required namespace and no unrelated provider',
+    'provider-ready',
+    'terminal `Registered` readback',
+    'directly or transitively after its namespace registration',
+    'retained subscription capabilities',
+    'teardown from unregistering them',
+    'Register subscription features only for intended capabilities',
+    'SubscriptionNotRegisteredForFeature',
+    'Do not broaden subscription features',
+    'Microsoft.Network/AllowBringYourOwnPublicIpAddress',
+    'Do not register the BYOIP feature as a workaround',
+    "Validate every network service tag's direction and action",
+    'AzurePlatformDNS',
+    'used only in a Deny rule',
+    'Allow rule for that tag',
+    'allow TCP and UDP port 53 to the exact resolver addresses',
     'Production: zone-redundant HA',
     'User-assigned managed identity with OIDC federation',
     'Small — fewer than 1,000 users',
@@ -136,7 +156,14 @@ const forbiddenPolicyFragments = [
     'retain local bootstrap state indefinitely',
     'upload local bootstrap state as a GitHub artifact',
     'delete local bootstrap state immediately after import',
-    'retained local state remains an active backend'
+    'retained local state remains an active backend',
+    'provider registration may remain pending while resources are created',
+    'register all Azure providers',
+    'unregister provider registrations during teardown',
+    'resource_provider_registrations = "none" requires no explicit registrations',
+    'register AllowBringYourOwnPublicIpAddress for every Standard public IP',
+    'Allow AzurePlatformDNS in an outbound NSG rule',
+    'register any feature named by SubscriptionNotRegisteredForFeature'
 ];
 export function validateGovernancePolicy(policy) {
     const missing = requiredPolicyFragments.filter((fragment) => !policy.includes(fragment));

package/dist/repository-governance.js.map

@@ -1 +1 @@
-{"version":3,"file":"repository-governance.js","sourceRoot":"","sources":["../src/repository-governance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAKvC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAU,CAAC;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAY,CAAC;AACpD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAU,CAAC;AAEzD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,MAAM,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,WAAW,CAAC;IAC/C,OAAO,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,cAAc,CAAC;IACnD,KAAK,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,WAAW,CAAC;IAC9C,gBAAgB,EAAE;QAChB,SAAS;QACT,SAAS;QACT,yCAAyC;KAC1C;IACD,MAAM,EAAE;QACN,SAAS;QACT,UAAU;QACV,kCAAkC;KACnC;CACO,CAAC;AAEX,MAAM,cAAc,GAAG,YAAY,CACjC,IAAI,GAAG,CACL,0DAA0D,EAC1D,OAAO,IAAI,CAAC,GAAG,CAChB,EACD,MAAM,CACP,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AAEnC,MAAM,UAAU,+BAA+B;IAC7C,MAAM,QAAQ,GAAG,cAAc,CAAC;IAChC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACnC,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;AACnC,CAAC;AAED,MAAM,uBAAuB,GAAG;IAC9B,kBAAkB;IAClB,oCAAoC;IACpC,oBAAoB;IACpB,+DAA+D;IAC/D,2BAA2B;IAC3B,eAAe;IACf,cAAc;IACd,oCAAoC;IACpC,kCAAkC;IAClC,mCAAmC;IACnC,mCAAmC;IACnC,uBAAuB;IACvB,cAAc;IACd,wBAAwB;IACxB,kCAAkC;IAClC,kCAAkC;IAClC,sBAAsB;IACtB,wCAAwC;IACxC,yDAAyD;IACzD,yCAAyC;IACzC,+BAA+B;IAC/B,mDAAmD;IACnD,uBAAuB;IACvB,2EAA2E;IAC3E,0CAA0C;IAC1C,sBAAsB;IACtB,mBAAmB;IACnB,+CAA+C;IAC/C,4CAA4C;IAC5C,0CAA0C;IAC1C,8BAA8B;IAC9B,0CAA0C;IAC1C,+BAA+B;IAC/B,aAAa;IACb,6BAA6B;IAC7B,+CAA+C;IAC/C,8DAA8D;IAC9D,4BAA4B;IAC5B,4BAA4B;IAC5B,2BAA2B;IAC3B,6BAA6B;IAC7B,iBAAiB;IACjB,+CAA+C;IAC/C,qDAAqD;IACrD,mDAAmD;IACnD,8BAA8B;IAC9B,wBAAwB;IACxB,0CAA0C;IAC1C,gCAAgC;IAChC,mDAAmD;IACnD,+BAA+B;IAC/B,mDAAmD;IACnD,gCAAgC;IAChC,SAAS;IACT,0BAA0B;IAC1B,gDAAgD;IAChD,+BAA+B;IAC/B,qDAAqD;IACrD,gCAAgC;IAChC,2CAA2C;IAC3C,gDAAgD;IAChD,iBAAiB;IACjB,qCAAqC;IACrC,sBAAsB;IACtB,yDAAyD;IACzD,0BAA0B;IAC1B,gCAAgC;IAChC,0BAA0B;IAC1B,SAAS;IACT,OAAO;IACP,OAAO;IACP,WAAW;IACX,uBAAuB;IACvB,oEAAoE;IACpE,qCAAqC;IACrC,6BAA6B;IAC7B,gBAAgB;IAChB,mCAAmC;IACnC,YAAY;IACZ,2CAA2C;IAC3C,6BAA6B;IAC7B,qBAAqB;IACrB,cAAc;IACd,yBAAyB;IACzB,8BAA8B;IAC9B,oCAAoC;IACpC,2BAA2B;IAC3B,iBAAiB;IACjB,4BAA4B;IAC5B,0BAA0B;IAC1B,gBAAgB;IAChB,oBAAoB;IACpB,yBAAyB;IACzB,wBAAwB;IACxB,iCAAiC;IACjC,qCAAqC;IACrC,4BAA4B;IAC5B,wBAAwB;CAChB,CAAC;AAEX,MAAM,wBAAwB,GAAG;IAC/B,uCAAuC;IACvC,qDAAqD;IACrD,wCAAwC;IACxC,0CAA0C;IAC1C,kDAAkD;IAClD,6CAA6C;IAC7C,+DAA+D;IAC/D,2CAA2C;IAC3C,mDAAmD;IACnD,uDAAuD;IACvD,gDAAgD;CACxC,CAAC;AAEX,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1D,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC3B,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,4DAA4D,OAAO,CAAC,CAAC,CAAC,EAAE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC3D,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC1B,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,kEAAkE,SAAS,EAAE,CAC9E,CAAC;IACJ,CAAC;IACD,IACE,CAAC,mEAAmE,CAAC,IAAI,CAAC,MAAM,CAAC;QACjF,CAAC,MAAM,CAAC,QAAQ,CAAC,6EAA6E,CAAC,EAC/F,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAAG;IAC1B,0BAA0B;IAC1B,kCAAkC;IAClC,sDAAsD;IACtD,uBAAuB;IACvB,mDAAmD;CAC3C,CAAC;AAEX,MAAM,UAAU,2BAA2B,CAAC,OAAe;IACzD,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;AACH,CAAC;AASD,SAAS,WAAW,CAAC,IAA+D;IAClF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,gBAAgB;QACnD,CAAC,CAAC;YACE;gBACE,EAAE,EAAE,iBAAiB;gBACrB,YAAY,EAAE,CAAC,SAAS,CAAC;gBACzB,UAAU,EAAE,IAAI;gBAChB,IAAI,EAAE;oBACJ,MAAM;oBACN,UAAU;oBACV,SAAS;oBACT,MAAM;oBACN,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;wBAClD,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC;wBAC1B,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;YACD;gBACE,EAAE,EAAE,cAAc;gBAClB,YAAY,EAAE,CAAC,SAAS,CAAC;gBACzB,UAAU,EAAE,IAAI;gBAChB,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC;aAC9C;SACF;QACH,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,cAAc;YACnC,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,iBAAiB;oBACrB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,IAAI,CAAC;iBACb;gBACD;oBACE,EAAE,EAAE,eAAe;oBACnB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;iBACvB;gBACD;oBACE,EAAE,EAAE,cAAc;oBAClB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,MAAM,CAAC;iBACf;aACF;YACH,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,iBAAiB;oBACrB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC;iBAC1B;gBACD;oBACE,EAAE,EAAE,cAAc;oBAClB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;iBACxB;aACF,CAAC;IACR,OAAO;QACL,GAAG,OAAO;QACV,GAAG,CAAC,IAAI,CAAC,eAAe;YACtB,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,kBAAkB;oBACtB,YAAY,EAAE,CAAC,UAAU,CAAC;oBAC1B,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,IAAI,CAAC;iBACb;gBACD;oBACE,EAAE,EAAE,gBAAgB;oBACpB,YAAY,EAAE,CAAC,UAAU,CAAC;oBAC1B,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;iBACvB;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;YAClD,CAAC,CAAC,CAAC;oBACC,EAAE,EAAE,sBAAsB;oBAC1B,YAAY,EAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;oBACxD,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE;wBACJ,KAAK;wBACL,WAAW;wBACX,eAAe;wBACf,aAAa;wBACb,GAAG;wBACH,QAAQ;wBACR,IAAI;wBACJ,QAAQ;wBACR,IAAI;qBACL;iBACF,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;QACP;YACE,EAAE,EAAE,sBAAsB;YAC1B,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,QAAQ;YACpB,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC;SAClC;QACD;YACE,EAAE,EAAE,iBAAiB;YACrB,YAAY,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;YACrD,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC;SACtC;QACD;YACE,EAAE,EAAE,qBAAqB;YACzB,YAAY,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;YACrD,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC;SACjC;QACD;YACE,EAAE,EAAE,mBAAmB;YACvB,YAAY,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;YACrD,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAiB;IAC1C,MAAM,MAAM,GAAG;QACb,aAAa,EAAE,8BAA8B;QAC7C,MAAM,EAAE;YACN,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE;YAClC,OAAO,EAAE,uBAAuB;YAChC,KAAK,EAAE,mBAAmB;YAC1B,eAAe,EAAE,YAAY;SAC9B;QACD,OAAO,EAAE;YACP,IAAI,EAAE,IAAI,CAAC,WAAW;YACtB,QAAQ,EAAE,IAAI,CAAC,eAAe;YAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,QAAQ,KAAK,qBAAqB;gBACnD,CAAC,CAAC,oCAAoC;gBACtC,CAAC,CAAC,IAAI,CAAC,eAAe;oBACpB,CAAC,CAAC,qCAAqC;oBACvC,CAAC,CAAC,mBAAmB;SAC1B;QACD,cAAc,EAAE;YACd,EAAE,EAAE,cAAc,CAAC,EAAE;YACrB,UAAU,EAAE,cAAc,CAAC,UAAU;YACrC,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO;YAC1C,GAAG,EAAE,cAAc,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO;YAC/C,SAAS,EAAE;gBACT,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE;gBACrB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;aAChC;SACF;QACD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,SAAS,EAAE;YACT,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE;YACxB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;YAC/B,GAAG,CAAC,IAAI,CAAC,YAAY;gBACnB,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC;SACR;QACD,SAAS,EAAE;YACT,gBAAgB,EAAE,cAAc;YAChC,aAAa,EAAE,cAAc;YAC7B,IAAI,EAAE,cAAc;YACpB,uBAAuB,EAAE,cAAc;YACvC,QAAQ,EAAE,cAAc;YACxB,eAAe,EAAE,cAAc;YAC/B,wBAAwB,EAAE,cAAc;YACxC,mBAAmB,EAAE,cAAc;YACnC,eAAe,EAAE,cAAc;YAC/B,yBAAyB,EAAE,cAAc;YACzC,mBAAmB,EAAE,cAAc;YACnC,mBAAmB,EAAE,cAAc;YACnC,mBAAmB,EAAE,cAAc;YACnC,cAAc,EAAE,cAAc;SAC/B;KACF,CAAC;IAEF,IAAI,IAAI,CAAC,QAAQ,KAAK,qBAAqB,EAAE,CAAC;QAC5C,OAAO;YACL,GAAG,MAAM;YACT,cAAc,EAAE;gBACd,GAAG,MAAM,CAAC,cAAc;gBACxB,WAAW,EAAE;oBACX,KAAK,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBACrD,QAAQ,CAAC,YAAY,CAAC,KAAK;oBAC9B,IAAI,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBACpD,QAAQ,CAAC,eAAe,CAAC,IAAI;oBAChC,UAAU,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBAC1D,QAAQ,CAAC,eAAe,CAAC,UAAU;oBACtC,YAAY,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBAC5D,QAAQ,CAAC,YAAY,CAAC,uBAAuB,CAAC;iBAClD;aACF;YACD,MAAM,EAAE;gBACN,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;gBACnC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;gBACvB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;aAC5B;YACD,QAAQ,EAAE;gBACR,EAAE,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE;gBACzE,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;gBAC/E,EAAE,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE;aAClF;YACD,mBAAmB,EAAE;gBACnB,eAAe,EAAE,WAAW;gBAC5B,OAAO,EAAE,cAAc;gBACvB,QAAQ,EAAE,cAAc;gBACxB,MAAM,EAAE,cAAc;gBACtB,QAAQ,EAAE,cAAc;gBACxB,eAAe,EAAE,cAAc;gBAC/B,wBAAwB,EAAE,cAAc;gBACxC,OAAO,EAAE,cAAc;gBACvB,aAAa,EAAE,cAAc;gBAC7B,uBAAuB,EAAE,yBAAyB;aACnD;YACD,YAAY,EAAE,EAAE;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAChE,OAAO;QACL,GAAG,MAAM;QACT,cAAc,EAAE;YACd,GAAG,MAAM,CAAC,cAAc;YACxB,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,gBAAgB;gBACnD,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO;gBACxC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,cAAc;oBACnC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO;oBACtC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO;YACxC,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO;SACnD;QACD,GAAG,EAAE;YACH,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACvB,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO;gBAC3B,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE;gBAC9B,CAAC,CAAC,EAAE,CAAC;SACR;QACD,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC;QAC3B,mBAAmB,EAAE;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB;YACD,QAAQ,EAAE,IAAI,CAAC,eAAe;gBAC5B,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE;gBACjD,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE;YAC7B,MAAM,EAAE,MAAM;gBACZ,CAAC,CAAC;oBACE,KAAK,EAAE,WAAW;oBAClB,SAAS,EAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;iBACtD;gBACH,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE;YAC7B,MAAM,EAAE;gBACN,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,CAAC,oBAAoB,CAAC;aAClC;YACD,QAAQ,EAAE;gBACR,KAAK,EAAE,wBAAwB;gBAC/B,SAAS,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;aACnD;SACF;QACD,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;QACpE,UAAU,EAAE;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACxB,SAAS,EAAE,cAAc;YACzB,wBAAwB,EAAE,yBAAyB;YACnD,OAAO,EAAE,4CAA4C;SACtD;QACD,MAAM,EAAE;YACN;gBACE,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,SAAS;aACjB;YACD;gBACE,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,SAAS;gBAChB,GAAG,EAAE,2DAA2D;aACjE;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,aAAa,KAAK,8BAA8B,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IACE,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,2BAA2B;QACpD,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,uBAAuB;QAChD,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,mBAAmB;QAC1C,KAAK,CAAC,MAAM,CAAC,eAAe,KAAK,YAAY,EAC7C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,cAAc,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAiB;IACvD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IACvD,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAiB;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1C,KAAK,CAAC,EAAE,KAAK,gBAAgB;QAC3B,CAAC,CAAC,8EAA8E;QAChF,CAAC,CAAC,2EAA2E,CAChF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO;;;;;;;;;;;;;;;EAeP,SAAS;;;;;;;;6CAQkC,IAAI,CAAC,YAAY,CAAC,KAAK;;;;;CAKnE,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAiB;IAC5C,OAAO;;;;;;;;;;;gDAWuC,IAAI,CAAC,YAAY,CAAC,KAAK;;2CAE5B,IAAI,CAAC,YAAY,CAAC,KAAK;;;;CAIjE,CAAC;AACF,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,IAAiB;IAEjB,IAAI,IAAI,CAAC,iBAAiB,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;QACzC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,+BAA+B,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC;IAC3D,MAAM,QAAQ,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC;IAC5D,MAAM,SAAS,GAAwB;QACrC;YACE,WAAW,EAAE,8BAA8B;YAC3C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,MAAM,CAAC;YAC9C,OAAO,EAAE,MAAM;SAChB;QACD;YACE,WAAW,EAAE,+BAA+B;YAC5C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,OAAO,CAAC;YAC/C,OAAO,EAAE,OAAO;SACjB;QACD;YACE,WAAW,EAAE,6BAA6B;YAC1C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC;YAC7C,OAAO,EAAE,KAAK;SACf;QACD,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAqB,EAAE,CAAC,CAAC;YAChD,WAAW,EAAE,KAAK,CAAC,EAAE,KAAK,gBAAgB;gBACxC,CAAC,CAAC,wCAAwC;gBAC1C,CAAC,CAAC,uCAAuC;YAC3C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;KACJ,CAAC;IACF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,2BAA2B,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"repository-governance.js","sourceRoot":"","sources":["../src/repository-governance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAKvC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAU,CAAC;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAY,CAAC;AACpD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAU,CAAC;AAEzD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,MAAM,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,WAAW,CAAC;IAC/C,OAAO,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,cAAc,CAAC;IACnD,KAAK,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,WAAW,CAAC;IAC9C,gBAAgB,EAAE;QAChB,SAAS;QACT,SAAS;QACT,yCAAyC;KAC1C;IACD,MAAM,EAAE;QACN,SAAS;QACT,UAAU;QACV,kCAAkC;KACnC;CACO,CAAC;AAEX,MAAM,cAAc,GAAG,YAAY,CACjC,IAAI,GAAG,CACL,0DAA0D,EAC1D,OAAO,IAAI,CAAC,GAAG,CAChB,EACD,MAAM,CACP,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AAEnC,MAAM,UAAU,+BAA+B;IAC7C,MAAM,QAAQ,GAAG,cAAc,CAAC;IAChC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACnC,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;AACnC,CAAC;AAED,MAAM,uBAAuB,GAAG;IAC9B,kBAAkB;IAClB,oCAAoC;IACpC,oBAAoB;IACpB,+DAA+D;IAC/D,2BAA2B;IAC3B,eAAe;IACf,cAAc;IACd,oCAAoC;IACpC,kCAAkC;IAClC,mCAAmC;IACnC,mCAAmC;IACnC,uBAAuB;IACvB,cAAc;IACd,wBAAwB;IACxB,kCAAkC;IAClC,kCAAkC;IAClC,sBAAsB;IACtB,wCAAwC;IACxC,yDAAyD;IACzD,yCAAyC;IACzC,+BAA+B;IAC/B,mDAAmD;IACnD,uBAAuB;IACvB,2EAA2E;IAC3E,0CAA0C;IAC1C,sBAAsB;IACtB,mBAAmB;IACnB,+CAA+C;IAC/C,4CAA4C;IAC5C,0CAA0C;IAC1C,8BAA8B;IAC9B,0CAA0C;IAC1C,+BAA+B;IAC/B,aAAa;IACb,6BAA6B;IAC7B,+CAA+C;IAC/C,8DAA8D;IAC9D,4BAA4B;IAC5B,4BAA4B;IAC5B,2BAA2B;IAC3B,6BAA6B;IAC7B,iBAAiB;IACjB,+CAA+C;IAC/C,qDAAqD;IACrD,mDAAmD;IACnD,8BAA8B;IAC9B,wBAAwB;IACxB,0CAA0C;IAC1C,gCAAgC;IAChC,mDAAmD;IACnD,+BAA+B;IAC/B,mDAAmD;IACnD,gCAAgC;IAChC,SAAS;IACT,0BAA0B;IAC1B,gDAAgD;IAChD,kCAAkC;IAClC,mBAAmB;IACnB,gBAAgB;IAChB,0CAA0C;IAC1C,sDAAsD;IACtD,gBAAgB;IAChB,gCAAgC;IAChC,2DAA2D;IAC3D,oCAAoC;IACpC,kCAAkC;IAClC,+DAA+D;IAC/D,qCAAqC;IACrC,sCAAsC;IACtC,oDAAoD;IACpD,mDAAmD;IACnD,2DAA2D;IAC3D,kBAAkB;IAClB,0BAA0B;IAC1B,yBAAyB;IACzB,2DAA2D;IAC3D,+BAA+B;IAC/B,qDAAqD;IACrD,gCAAgC;IAChC,2CAA2C;IAC3C,gDAAgD;IAChD,iBAAiB;IACjB,qCAAqC;IACrC,sBAAsB;IACtB,yDAAyD;IACzD,0BAA0B;IAC1B,gCAAgC;IAChC,0BAA0B;IAC1B,SAAS;IACT,OAAO;IACP,OAAO;IACP,WAAW;IACX,uBAAuB;IACvB,oEAAoE;IACpE,qCAAqC;IACrC,6BAA6B;IAC7B,gBAAgB;IAChB,mCAAmC;IACnC,YAAY;IACZ,2CAA2C;IAC3C,6BAA6B;IAC7B,qBAAqB;IACrB,cAAc;IACd,yBAAyB;IACzB,8BAA8B;IAC9B,oCAAoC;IACpC,2BAA2B;IAC3B,iBAAiB;IACjB,4BAA4B;IAC5B,0BAA0B;IAC1B,gBAAgB;IAChB,oBAAoB;IACpB,yBAAyB;IACzB,wBAAwB;IACxB,iCAAiC;IACjC,qCAAqC;IACrC,4BAA4B;IAC5B,wBAAwB;CAChB,CAAC;AAEX,MAAM,wBAAwB,GAAG;IAC/B,uCAAuC;IACvC,qDAAqD;IACrD,wCAAwC;IACxC,0CAA0C;IAC1C,kDAAkD;IAClD,6CAA6C;IAC7C,+DAA+D;IAC/D,2CAA2C;IAC3C,mDAAmD;IACnD,uDAAuD;IACvD,gDAAgD;IAChD,sEAAsE;IACtE,8BAA8B;IAC9B,mDAAmD;IACnD,6EAA6E;IAC7E,wEAAwE;IACxE,gDAAgD;IAChD,mEAAmE;CAC3D,CAAC;AAEX,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1D,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC3B,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,4DAA4D,OAAO,CAAC,CAAC,CAAC,EAAE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC3D,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC1B,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,kEAAkE,SAAS,EAAE,CAC9E,CAAC;IACJ,CAAC;IACD,IACE,CAAC,mEAAmE,CAAC,IAAI,CAAC,MAAM,CAAC;QACjF,CAAC,MAAM,CAAC,QAAQ,CAAC,6EAA6E,CAAC,EAC/F,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAAG;IAC1B,0BAA0B;IAC1B,kCAAkC;IAClC,sDAAsD;IACtD,uBAAuB;IACvB,mDAAmD;CAC3C,CAAC;AAEX,MAAM,UAAU,2BAA2B,CAAC,OAAe;IACzD,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;AACH,CAAC;AASD,SAAS,WAAW,CAAC,IAA+D;IAClF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,gBAAgB;QACnD,CAAC,CAAC;YACE;gBACE,EAAE,EAAE,iBAAiB;gBACrB,YAAY,EAAE,CAAC,SAAS,CAAC;gBACzB,UAAU,EAAE,IAAI;gBAChB,IAAI,EAAE;oBACJ,MAAM;oBACN,UAAU;oBACV,SAAS;oBACT,MAAM;oBACN,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;wBAClD,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC;wBAC1B,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;YACD;gBACE,EAAE,EAAE,cAAc;gBAClB,YAAY,EAAE,CAAC,SAAS,CAAC;gBACzB,UAAU,EAAE,IAAI;gBAChB,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC;aAC9C;SACF;QACH,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,cAAc;YACnC,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,iBAAiB;oBACrB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,IAAI,CAAC;iBACb;gBACD;oBACE,EAAE,EAAE,eAAe;oBACnB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;iBACvB;gBACD;oBACE,EAAE,EAAE,cAAc;oBAClB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,MAAM,CAAC;iBACf;aACF;YACH,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,iBAAiB;oBACrB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC;iBAC1B;gBACD;oBACE,EAAE,EAAE,cAAc;oBAClB,YAAY,EAAE,CAAC,SAAS,CAAC;oBACzB,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;iBACxB;aACF,CAAC;IACR,OAAO;QACL,GAAG,OAAO;QACV,GAAG,CAAC,IAAI,CAAC,eAAe;YACtB,CAAC,CAAC;gBACE;oBACE,EAAE,EAAE,kBAAkB;oBACtB,YAAY,EAAE,CAAC,UAAU,CAAC;oBAC1B,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,IAAI,CAAC;iBACb;gBACD;oBACE,EAAE,EAAE,gBAAgB;oBACpB,YAAY,EAAE,CAAC,UAAU,CAAC;oBAC1B,UAAU,EAAE,KAAK;oBACjB,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;iBACvB;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;YAClD,CAAC,CAAC,CAAC;oBACC,EAAE,EAAE,sBAAsB;oBAC1B,YAAY,EAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;oBACxD,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE;wBACJ,KAAK;wBACL,WAAW;wBACX,eAAe;wBACf,aAAa;wBACb,GAAG;wBACH,QAAQ;wBACR,IAAI;wBACJ,QAAQ;wBACR,IAAI;qBACL;iBACF,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;QACP;YACE,EAAE,EAAE,sBAAsB;YAC1B,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,QAAQ;YACpB,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC;SAClC;QACD;YACE,EAAE,EAAE,iBAAiB;YACrB,YAAY,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;YACrD,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC;SACtC;QACD;YACE,EAAE,EAAE,qBAAqB;YACzB,YAAY,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;YACrD,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC;SACjC;QACD;YACE,EAAE,EAAE,mBAAmB;YACvB,YAAY,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;YACrD,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAiB;IAC1C,MAAM,MAAM,GAAG;QACb,aAAa,EAAE,8BAA8B;QAC7C,MAAM,EAAE;YACN,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE;YAClC,OAAO,EAAE,uBAAuB;YAChC,KAAK,EAAE,mBAAmB;YAC1B,eAAe,EAAE,YAAY;SAC9B;QACD,OAAO,EAAE;YACP,IAAI,EAAE,IAAI,CAAC,WAAW;YACtB,QAAQ,EAAE,IAAI,CAAC,eAAe;YAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,QAAQ,KAAK,qBAAqB;gBACnD,CAAC,CAAC,oCAAoC;gBACtC,CAAC,CAAC,IAAI,CAAC,eAAe;oBACpB,CAAC,CAAC,qCAAqC;oBACvC,CAAC,CAAC,mBAAmB;SAC1B;QACD,cAAc,EAAE;YACd,EAAE,EAAE,cAAc,CAAC,EAAE;YACrB,UAAU,EAAE,cAAc,CAAC,UAAU;YACrC,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO;YAC1C,GAAG,EAAE,cAAc,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO;YAC/C,SAAS,EAAE;gBACT,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE;gBACrB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;aAChC;SACF;QACD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,SAAS,EAAE;YACT,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE;YACxB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;YAC/B,GAAG,CAAC,IAAI,CAAC,YAAY;gBACnB,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC;SACR;QACD,SAAS,EAAE;YACT,gBAAgB,EAAE,cAAc;YAChC,aAAa,EAAE,cAAc;YAC7B,IAAI,EAAE,cAAc;YACpB,uBAAuB,EAAE,cAAc;YACvC,QAAQ,EAAE,cAAc;YACxB,eAAe,EAAE,cAAc;YAC/B,wBAAwB,EAAE,cAAc;YACxC,mBAAmB,EAAE,cAAc;YACnC,eAAe,EAAE,cAAc;YAC/B,yBAAyB,EAAE,cAAc;YACzC,mBAAmB,EAAE,cAAc;YACnC,mBAAmB,EAAE,cAAc;YACnC,mBAAmB,EAAE,cAAc;YACnC,cAAc,EAAE,cAAc;SAC/B;KACF,CAAC;IAEF,IAAI,IAAI,CAAC,QAAQ,KAAK,qBAAqB,EAAE,CAAC;QAC5C,OAAO;YACL,GAAG,MAAM;YACT,cAAc,EAAE;gBACd,GAAG,MAAM,CAAC,cAAc;gBACxB,WAAW,EAAE;oBACX,KAAK,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBACrD,QAAQ,CAAC,YAAY,CAAC,KAAK;oBAC9B,IAAI,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBACpD,QAAQ,CAAC,eAAe,CAAC,IAAI;oBAChC,UAAU,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBAC1D,QAAQ,CAAC,eAAe,CAAC,UAAU;oBACtC,YAAY,EAAE,cAAc,CAAC,WAAW,CAAC,qBAAqB,CAAC;yBAC5D,QAAQ,CAAC,YAAY,CAAC,uBAAuB,CAAC;iBAClD;aACF;YACD,MAAM,EAAE;gBACN,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;gBACnC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;gBACvB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;aAC5B;YACD,QAAQ,EAAE;gBACR,EAAE,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE;gBACzE,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;gBAC/E,EAAE,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE;aAClF;YACD,mBAAmB,EAAE;gBACnB,eAAe,EAAE,WAAW;gBAC5B,OAAO,EAAE,cAAc;gBACvB,QAAQ,EAAE,cAAc;gBACxB,MAAM,EAAE,cAAc;gBACtB,QAAQ,EAAE,cAAc;gBACxB,eAAe,EAAE,cAAc;gBAC/B,wBAAwB,EAAE,cAAc;gBACxC,OAAO,EAAE,cAAc;gBACvB,aAAa,EAAE,cAAc;gBAC7B,uBAAuB,EAAE,yBAAyB;aACnD;YACD,YAAY,EAAE,EAAE;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAChE,OAAO;QACL,GAAG,MAAM;QACT,cAAc,EAAE;YACd,GAAG,MAAM,CAAC,cAAc;YACxB,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,gBAAgB;gBACnD,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO;gBACxC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,cAAc;oBACnC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO;oBACtC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO;YACxC,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO;SACnD;QACD,GAAG,EAAE;YACH,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACvB,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO;gBAC3B,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE;gBAC9B,CAAC,CAAC,EAAE,CAAC;SACR;QACD,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC;QAC3B,mBAAmB,EAAE;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB;YACD,QAAQ,EAAE,IAAI,CAAC,eAAe;gBAC5B,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE;gBACjD,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE;YAC7B,MAAM,EAAE,MAAM;gBACZ,CAAC,CAAC;oBACE,KAAK,EAAE,WAAW;oBAClB,SAAS,EAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;iBACtD;gBACH,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE;YAC7B,MAAM,EAAE;gBACN,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,CAAC,oBAAoB,CAAC;aAClC;YACD,QAAQ,EAAE;gBACR,KAAK,EAAE,wBAAwB;gBAC/B,SAAS,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC;aACnD;SACF;QACD,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;QACpE,UAAU,EAAE;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACxB,SAAS,EAAE,cAAc;YACzB,wBAAwB,EAAE,yBAAyB;YACnD,OAAO,EAAE,4CAA4C;SACtD;QACD,MAAM,EAAE;YACN;gBACE,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,SAAS;aACjB;YACD;gBACE,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,SAAS;gBAChB,GAAG,EAAE,2DAA2D;aACjE;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,aAAa,KAAK,8BAA8B,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IACE,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,2BAA2B;QACpD,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,uBAAuB;QAChD,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,mBAAmB;QAC1C,KAAK,CAAC,MAAM,CAAC,eAAe,KAAK,YAAY,EAC7C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,cAAc,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAiB;IACvD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IACvD,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAiB;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1C,KAAK,CAAC,EAAE,KAAK,gBAAgB;QAC3B,CAAC,CAAC,8EAA8E;QAChF,CAAC,CAAC,2EAA2E,CAChF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO;;;;;;;;;;;;;;;EAeP,SAAS;;;;;;;;6CAQkC,IAAI,CAAC,YAAY,CAAC,KAAK;;;;;CAKnE,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAiB;IAC5C,OAAO;;;;;;;;;;;gDAWuC,IAAI,CAAC,YAAY,CAAC,KAAK;;2CAE5B,IAAI,CAAC,YAAY,CAAC,KAAK;;;;CAIjE,CAAC;AACF,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,IAAiB;IAEjB,IAAI,IAAI,CAAC,iBAAiB,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;QACzC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,+BAA+B,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC;IAC3D,MAAM,QAAQ,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC;IAC5D,MAAM,SAAS,GAAwB;QACrC;YACE,WAAW,EAAE,8BAA8B;YAC3C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,MAAM,CAAC;YAC9C,OAAO,EAAE,MAAM;SAChB;QACD;YACE,WAAW,EAAE,+BAA+B;YAC5C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,OAAO,CAAC;YAC/C,OAAO,EAAE,OAAO;SACjB;QACD;YACE,WAAW,EAAE,6BAA6B;YAC1C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC;YAC7C,OAAO,EAAE,KAAK;SACf;QACD,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAqB,EAAE,CAAC,CAAC;YAChD,WAAW,EAAE,KAAK,CAAC,EAAE,KAAK,gBAAgB;gBACxC,CAAC,CAAC,wCAAwC;gBAC1C,CAAC,CAAC,uCAAuC;YAC3C,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;KACJ,CAAC;IACF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,2BAA2B,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/docs/existing-repositories.md

@@ -98,10 +98,10 @@ Selecting `none` leaves previously managed handoff files as undeleted orphans
 while unrecorded conflicts remain user-owned. No update mode runs an agent or
 activates GitHub settings.
 
-Projects carrying governance policy versions 2 or 3 preview policy version 4 as
+Projects carrying governance policy versions 2 through 4 preview policy version 5 as
 managed-core drift. Review the private-runner and bootstrap-state retirement
 contracts before replacement. Updating the handoff never provisions Azure or
-GitHub resources; reconcile any active downstream runner change with version 4
+GitHub resources; reconcile any active downstream runner change with version 5
 before applying its infrastructure.
 
 The schema-v6 transition releases every legacy non-core artifact into project

package/docs/prerequisites.md

@@ -52,6 +52,11 @@ discovers an existing private management path or proposes the policy's bounded
 encrypted local-state bootstrap. Liftoff itself neither creates nor transfers
 state.
 
+Azure governance plans also inspect the AzureRM provider-registration mode,
+derive the minimal required namespace set, and verify subscription registration
+permission. Disabled auto-registration is not a blocker when the approved plan
+can register each missing namespace explicitly before dependent resources.
+
 ## Preview requirements without writes
 
 `liftoff plan` shows both generated artifacts and workstation requirements

package/docs/repository-governance.md

@@ -34,7 +34,7 @@ tools, fail-closed checks, immutable release evidence, build-once promotion,
 deployment and rollback, monitoring and health, DORA metrics, ruleset
 sequencing, negative tests, documentation, and workload adaptation.
 
-Policy version 4 also fixes platform decisions that generated projects should
+Policy version 5 also fixes platform decisions that generated projects should
 not repeatedly ask users to make:
 
 - Dev storage uses LRS; Staging and Production use ZRS. IaC state uses ZRS in
@@ -49,6 +49,9 @@ not repeatedly ask users to make:
   alert path does not depend on private-vault connectivity.
 - Encrypted local bootstrap state is retained read-only for 30 days after
   verified remote import, then securely deleted with dated evidence.
+- Azure resource-provider namespaces are derived from the approved plan. When
+  auto-registration is disabled, each missing required namespace is registered
+  explicitly before dependent resources.
 
 These are applicable defaults, not reasons to create unused resources. A
 managed service is included only when application code consumes it, after its
@@ -60,7 +63,7 @@ than creating a parallel stack or forcing replacement.
 
 DAST for a privately networked Staging environment uses an ephemeral
 GitHub-hosted larger runner with Azure VNet injection. Activation reuses a
-suitable existing repository assignment. If none exists, policy version 4
+suitable existing repository assignment. If none exists, policy version 5
 permits one narrow post-approval exception to provision the Azure network
 setting, organisation hosted-compute network configuration, selected-access
 runner group, and bounded larger runner required by that repository.
@@ -99,6 +102,45 @@ qualification rather than leaving a required job queued or reporting success.
 Teardown reverses those dependencies and removes the Azure network only after
 GitHub scheduling, assignment, and service associations are gone.
 
+### Azure resource-provider readiness
+
+Phase 0 derives the minimal namespace inventory from every approved Azure
+resource type and records AzureRM's registration mode and the execution
+identity's subscription registration permission. A hosted-runner network always
+requires at least `Microsoft.Network` and `GitHub.Network`; additional providers
+are included only when approved state, identity, monitoring, or application
+resources use them.
+
+When AzureRM automatic registration is enabled and sufficient, no duplicate
+explicit resources are added. When
+`resource_provider_registrations = "none"` disables it, every missing required
+namespace is registered explicitly. Dependent and billable resources remain
+blocked until live subscription readback reports each namespace as
+`Registered`.
+
+Every explicit resource has a direct or transitive dependency on its namespace
+registration. Existing registrations are no-ops. Pending, unauthorized,
+unregistering, or failed states require a revised no-apply plan rather than
+partial provisioning. Successful registrations remain subscription capabilities
+during repository teardown and are not automatically unregistered.
+
+Subscription features are narrower than provider namespaces. A
+`SubscriptionNotRegisteredForFeature` error does not authorize registering the
+named feature unless the approved resource design intentionally uses it.
+Unexpected feature requests require correction of the resource properties,
+provider behavior, or API shape and a revised no-apply plan.
+
+Ordinary Firewall and NAT Standard public IPs do not require BYOIP. If such a
+resource requests `Microsoft.Network/AllowBringYourOwnPublicIpAddress` without a
+custom IP prefix, the plan must remove accidental BYOIP properties or use a
+supported API shape; it must not register BYOIP merely to retry.
+
+Network service-tag rules also require semantic validation.
+`AzurePlatformDNS` is deny-only for intentionally disabling Azure platform DNS,
+not a valid Allow target. Default platform DNS needs no explicit NSG allow.
+Custom resolvers instead receive TCP and UDP port 53 allows to their exact IP
+addresses.
+
 ### Private state bootstrap and retention
 
 Phase 0 prefers an existing approved private execution path to the
@@ -202,10 +244,10 @@ conflict remains outside Liftoff ownership and produces `handoff-partial`.
 After every conflict is removed or matches the current artifact, the next
 update records the full artifact set as `handoff-generated`.
 
-Projects generated with policy versions 2 or 3 review the version-4 managed-core drift
+Projects generated with policy versions 2 through 4 review the version-5 managed-core drift
 before replacement. `liftoff update` changes only the local handoff; it never
 provisions Azure or GitHub resources. Any active downstream runner change based
-on an older contract must reconcile its plan and implementation with version 4
+on an older contract must reconcile its plan and implementation with version 5
 before applying cloud or organisation resources.
 
 Setting `"governanceProfile": "none"` stops future rendering. Previously managed

package/docs/safety-and-consent.md

@@ -29,6 +29,11 @@ single-writer. It is never transferred through GitHub artifacts or secrets,
 becomes read-only after verified remote import, and is securely deleted after
 the fixed 30-day retention period with non-sensitive evidence.
 
+Explicit Azure resource-provider registration is limited to namespaces used by
+the approved plan. Registration must reach `Registered` before dependent
+resources, and repository teardown must not unregister the retained
+subscription capability.
+
 ## CLI self-upgrade boundary
 
 `liftoff upgrade` is itself the narrow authorization to replace a supported

package/docs/troubleshooting.md

@@ -205,6 +205,25 @@ imports from the private runner, verify identity parity, locking, versioning,
 and a clean no-change plan, then retain the frozen local state read-only for 30
 days before secure deletion.
 
+If an Azure bootstrap fails with a namespace-not-registered error while
+`resource_provider_registrations = "none"` is configured, do not retry the same
+plan or enable broad auto-registration without review. Derive the provider set
+from the planned resource types, add explicit missing registrations, confirm
+subscription permission and terminal `Registered` readback, then regenerate a
+no-apply plan. VNet-injected runner networking requires both
+`Microsoft.Network` and `GitHub.Network`. Preserve successful registrations
+during teardown.
+
+If an ordinary Standard public IP requests
+`Microsoft.Network/AllowBringYourOwnPublicIpAddress`, do not register BYOIP
+unless the approved design actually imports a custom IP prefix. Remove
+accidental feature-triggering properties or use a reviewed supported API shape,
+then regenerate the no-apply plan.
+
+Do not use `AzurePlatformDNS` in an Allow NSG rule. The special tag is deny-only
+for disabling default platform DNS. Omit the rule when platform DNS is enabled,
+or allow TCP and UDP 53 to exact custom resolver addresses.
+
 Do not run an older Liftoff release to reverse a completed baseline migration.
 Restore the affected generated files and `liftoff.manifest.json` through version
 control, then reinstall from the restored locks.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@msn-control/liftoff",
-  "version": "0.9.8",
+  "version": "0.9.9",
   "description": "Interactive CLI for governed GenAI, API, and Power Apps code app projects.",
   "type": "module",
   "license": "GPL-3.0-only",