@msn-control/liftoff 0.9.9 → 0.10.0

package/dist/governance-activation/doctor.js

@@ -0,0 +1,379 @@
+import { readdir } from 'node:fs/promises';
+import { readProjectFile, resolveProjectPath } from '../file-system.js';
+import { loadActivationState } from './activation-state.js';
+import { credentialPolicyPathParts } from './credentials.js';
+import { evidenceContextForPhase, requiredLiveReadbackProviders, validateEvidenceFreshness } from './evidence.js';
+import { canonicalPhaseGraph, currentActivationIdentity, phaseContractDigests } from './graph.js';
+import { planHistoricalActivationStateMigration } from './migration.js';
+import { calculatePhaseReadiness } from './readiness.js';
+import { inspectGovernanceSourceOfTruth } from './source-of-truth.js';
+import { phaseIds } from './types.js';
+import { validateCredentialPolicy, validateEvidenceHeader } from './validators.js';
+const evidencePathParts = ['governance', 'evidence'];
+const terminalEvidenceStates = new Set([
+    'verified',
+    'failed',
+    'inapplicable',
+    'retained',
+    'disposed'
+]);
+function errorCode(error) {
+    if (typeof error !== 'object' || error === null || !('code' in error)) {
+        return undefined;
+    }
+    const code = error.code;
+    return typeof code === 'string' ? code : undefined;
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function asRecord(value, pathLabel) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new Error(`${pathLabel} must be a JSON object.`);
+    }
+    return value;
+}
+async function readJsonDirectory(projectRoot, pathParts) {
+    const directory = await resolveProjectPath(projectRoot, [...pathParts]);
+    let entries;
+    try {
+        entries = await readdir(directory, { withFileTypes: true });
+    }
+    catch (error) {
+        if (errorCode(error) === 'ENOENT') {
+            return [];
+        }
+        throw error;
+    }
+    const values = [];
+    for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name, 'en'))) {
+        if (!entry.isFile() || !entry.name.endsWith('.json')) {
+            continue;
+        }
+        const filePathParts = [...pathParts, entry.name];
+        const bytes = await readProjectFile(projectRoot, filePathParts);
+        if (bytes === undefined) {
+            throw new Error(`${filePathParts.join('/')} disappeared during doctor inspection.`);
+        }
+        values.push({
+            name: entry.name,
+            value: JSON.parse(bytes.toString('utf8'))
+        });
+    }
+    return values;
+}
+function evidenceRecord(value, evidenceId) {
+    const record = asRecord(value, `governance/evidence/${evidenceId}.json`);
+    if (Object.hasOwn(record, 'header')) {
+        return {
+            evidenceId: typeof record.evidenceId === 'string' && record.evidenceId.length > 0
+                ? record.evidenceId
+                : evidenceId,
+            header: validateEvidenceHeader(record.header),
+            ...(Array.isArray(record.liveReadback) ? { liveReadback: record.liveReadback } : {}),
+            ...(Object.hasOwn(record, 'payload') ? { payload: record.payload } : {})
+        };
+    }
+    return {
+        evidenceId,
+        header: validateEvidenceHeader(value)
+    };
+}
+async function loadEvidenceForDoctor(projectRoot) {
+    const entries = await readJsonDirectory(projectRoot, evidencePathParts);
+    return entries.map((entry) => evidenceRecord(entry.value, entry.name.replace(/\.json$/u, '')));
+}
+function contextForPhase(phaseId, state, now) {
+    const phase = canonicalPhaseGraph.phases.find((entry) => entry.id === phaseId);
+    return {
+        ...evidenceContextForPhase(phaseId, {
+            repositoryId: state.repository.id,
+            identity: state.identity,
+            phaseGraphHash: state.identity.phaseGraphHash,
+            now,
+            liveReadbackProviders: requiredLiveReadbackProviders(phase)
+        }),
+        phaseContractDigest: phaseContractDigests(canonicalPhaseGraph)[phaseId]
+    };
+}
+function evidenceStaleCheck(state, evidence, now) {
+    const stale = [];
+    for (const phaseId of phaseIds) {
+        const stored = state.phases[phaseId];
+        if (!terminalEvidenceStates.has(stored.state)) {
+            continue;
+        }
+        const context = contextForPhase(phaseId, state, now);
+        const records = evidence.filter((entry) => entry.header.phaseId === phaseId);
+        const valid = records.some((entry) => {
+            const result = validateEvidenceFreshness(entry, context);
+            return result.valid && result.record.header.result === stored.state;
+        });
+        if (!valid) {
+            stale.push(phaseId);
+        }
+    }
+    if (stale.length === 0) {
+        return undefined;
+    }
+    return {
+        id: 'governance-evidence-stale',
+        label: 'governance evidence',
+        severity: 'fail',
+        state: 'evidence-stale',
+        detail: `stored terminal phase(s) lack current authoritative evidence: ${stale.join(', ')}`,
+        remedy: 'Rerun liftoff governance verify and provide fresh evidence or an explicit approved reconciliation mapping; do not use checkboxes, filenames, or prose as evidence.'
+    };
+}
+function phaseBlockedCheck(state) {
+    const blocked = phaseIds.filter((phaseId) => state.phases[phaseId].state === 'blocked' &&
+        state.phases[phaseId].blockers.length > 0);
+    if (blocked.length === 0) {
+        return undefined;
+    }
+    return {
+        id: 'governance-phase-blocked',
+        label: 'governance phase',
+        severity: 'warn',
+        state: 'phase-blocked',
+        detail: `${blocked[0]} is blocked: ${state.phases[blocked[0]].blockers[0]}`,
+        remedy: 'Resolve the named blocker, then run liftoff governance resume --json.'
+    };
+}
+function enforcementIncompleteCheck(state) {
+    const approved = state.phases['enforcement-approved'].state === 'approved' ||
+        state.phases['enforcement-approved'].state === 'verified';
+    const liveReadbackComplete = state.phases['live-readback'].state === 'verified';
+    if (!approved || liveReadbackComplete) {
+        return undefined;
+    }
+    return {
+        id: 'governance-enforcement-incomplete',
+        label: 'governance enforcement',
+        severity: 'warn',
+        state: 'enforcement-incomplete',
+        detail: 'final enforcement was approved but ruleset application/live readback is incomplete',
+        remedy: 'Run liftoff governance plan --json and continue only through approved rulesets-applied and live-readback phases.'
+    };
+}
+function disposalPendingCheck(state, now) {
+    if (state.bootstrapState?.status !== 'retained') {
+        return undefined;
+    }
+    const due = Date.parse(state.bootstrapState.disposeAfter) <= now.getTime();
+    return {
+        id: 'governance-disposal-pending',
+        label: 'bootstrap state disposal',
+        severity: due ? 'warn' : 'skipped',
+        state: 'disposal-pending',
+        detail: due
+            ? `retained bootstrap state reached disposal date ${state.bootstrapState.disposeAfter}`
+            : `retained bootstrap state is not disposable until ${state.bootstrapState.disposeAfter}`,
+        remedy: due
+            ? 'Approve destructive disposal, then run liftoff governance apply-next --execute.'
+            : 'Leave retained local bootstrap state untouched until the disposal date.'
+    };
+}
+async function credentialExpiringCheck(projectRoot, now) {
+    const bytes = await readProjectFile(projectRoot, [...credentialPolicyPathParts]);
+    if (bytes === undefined) {
+        return undefined;
+    }
+    const policy = validateCredentialPolicy(JSON.parse(bytes.toString('utf8')));
+    const rotationDue = Date.parse(policy.rotationDueAt) <= now.getTime();
+    const expired = Date.parse(policy.expiresAt) <= now.getTime();
+    if (policy.status !== 'expiring' && policy.status !== 'expired' && !rotationDue && !expired) {
+        return undefined;
+    }
+    return {
+        id: 'governance-credential-expiring',
+        label: 'governance credential',
+        severity: expired || policy.status === 'expired' ? 'fail' : 'warn',
+        state: 'credential-expiring',
+        detail: `credential policy status ${policy.status}; rotation due ${policy.rotationDueAt}; expires ${policy.expiresAt}`,
+        remedy: 'Revoke/rotate the runner preflight credential through the deterministic masked enrollment flow before using credential-ready evidence.'
+    };
+}
+export async function governanceDoctorChecks(projectRoot, manifest, now = new Date()) {
+    if (manifest.governance.profile === 'none' || manifest.governance.profile === 'unspecified') {
+        return [];
+    }
+    const checks = [];
+    const migration = await planHistoricalActivationStateMigration(projectRoot, now.toISOString());
+    if (migration.status === 'blocked') {
+        checks.push({
+            id: 'governance-identity-incompatible',
+            label: 'governance activation identity',
+            severity: 'fail',
+            state: 'identity-incompatible',
+            detail: migration.report.issues[0] ?? 'activation state is not compatible with this Liftoff version',
+            remedy: 'Upgrade Liftoff or provide an explicit versioned import mapping. Preserve user-owned state and evidence bytes; never import checkboxes, filenames, or prose as evidence.'
+        });
+        return checks;
+    }
+    if (migration.status === 'migrate') {
+        checks.push({
+            id: 'governance-reconciliation-required',
+            label: 'governance reconciliation',
+            severity: 'warn',
+            state: 'reconciliation-required',
+            detail: `historical activation state has an explicit migration mapping to graph ${currentActivationIdentity.phaseGraphHash}`,
+            remedy: 'Run liftoff update after review; the migration is staged with managed definitions and preserves evidence bytes.'
+        });
+        return checks;
+    }
+    let loaded;
+    try {
+        loaded = await loadActivationState(projectRoot);
+    }
+    catch (error) {
+        checks.push({
+            id: 'governance-identity-incompatible',
+            label: 'governance activation identity',
+            severity: 'fail',
+            state: 'identity-incompatible',
+            detail: errorMessage(error),
+            remedy: 'Restore a supported activation identity tuple and recognized graph hash, or upgrade Liftoff before running setup.'
+        });
+        return checks;
+    }
+    let evidence;
+    try {
+        evidence = await loadEvidenceForDoctor(projectRoot);
+    }
+    catch (error) {
+        checks.push({
+            id: 'governance-evidence-stale',
+            label: 'governance evidence',
+            severity: 'fail',
+            state: 'evidence-stale',
+            detail: errorMessage(error),
+            remedy: 'Repair malformed evidence or provide an explicit approved reconciliation mapping; do not infer evidence from filenames or prose.'
+        });
+        return checks;
+    }
+    const state = loaded?.state;
+    if (!state) {
+        const source = await inspectGovernanceSourceOfTruth({
+            projectRoot,
+            manifest,
+            state: {
+                schemaVersion: currentActivationIdentity.activationStateSchemaVersion,
+                identity: currentActivationIdentity,
+                repository: {
+                    id: `local:${manifest.project.name}`,
+                    name: manifest.project.name,
+                    defaultBranch: 'develop'
+                },
+                activeChange: null,
+                applicability: {
+                    statePath: 'none',
+                    privateStagingDast: false,
+                    credentialRequired: false
+                },
+                phases: Object.fromEntries(phaseIds.map((phaseId) => [phaseId, {
+                        state: 'pending',
+                        updatedAt: '1970-01-01T00:00:00.000Z',
+                        evidence: [],
+                        approvals: [],
+                        blockers: []
+                    }])),
+                createdAt: '1970-01-01T00:00:00.000Z',
+                updatedAt: '1970-01-01T00:00:00.000Z'
+            },
+            evidence
+        });
+        if (source.status === 'seed-blocked') {
+            checks.push({
+                id: 'governance-seed-incomplete',
+                label: 'governance seed',
+                severity: 'warn',
+                state: 'seed-incomplete',
+                detail: source.blockers.join('; '),
+                remedy: 'Run /liftoff-setup to complete, sync, and archive the generated seed before governance activation.'
+            });
+        }
+        else {
+            checks.push({
+                id: 'governance-activation',
+                label: 'governance activation',
+                severity: 'skipped',
+                state: 'phase-blocked',
+                detail: 'no user-owned activation state exists yet',
+                remedy: 'Run /liftoff-setup or liftoff governance status --json to start deterministic setup.'
+            });
+        }
+        return checks;
+    }
+    const source = await inspectGovernanceSourceOfTruth({ projectRoot, manifest, state, evidence });
+    if (source.status === 'seed-blocked') {
+        checks.push({
+            id: 'governance-seed-incomplete',
+            label: 'governance seed',
+            severity: 'warn',
+            state: 'seed-incomplete',
+            detail: source.blockers.join('; '),
+            remedy: 'Complete and archive the generated bootstrap seed; update modes do not bypass this gate.'
+        });
+    }
+    else if (source.status === 'selected' && source.reconciliation.status !== 'not-required') {
+        checks.push({
+            id: 'governance-reconciliation-required',
+            label: 'governance reconciliation',
+            severity: source.reconciliation.status === 'blocked' ? 'fail' : 'warn',
+            state: 'reconciliation-required',
+            detail: source.reconciliation.issues.join('; '),
+            remedy: 'Acknowledge the installed activation identity and graph hash in the active governance change before executing affected phases.'
+        });
+    }
+    else if (source.status === 'ambiguous' || source.status === 'incompatible') {
+        checks.push({
+            id: 'governance-identity-incompatible',
+            label: 'governance activation identity',
+            severity: 'fail',
+            state: 'identity-incompatible',
+            detail: source.blockers.join('; '),
+            remedy: 'Resolve active-change ownership with schema-valid metadata or supersession records before continuing setup.'
+        });
+    }
+    const readiness = calculatePhaseReadiness({
+        graph: canonicalPhaseGraph,
+        state,
+        approvals: [],
+        evidence,
+        now
+    });
+    if (!readiness.identityCompatible) {
+        checks.push({
+            id: 'governance-identity-incompatible',
+            label: 'governance activation identity',
+            severity: 'fail',
+            state: 'identity-incompatible',
+            detail: readiness.identityBlocker ?? 'activation identity tuple is not compatible',
+            remedy: 'Upgrade Liftoff or restore a supported tuple and recognized phase graph hash.'
+        });
+    }
+    for (const check of [
+        evidenceStaleCheck(state, evidence, now),
+        phaseBlockedCheck(state),
+        await credentialExpiringCheck(projectRoot, now),
+        enforcementIncompleteCheck(state),
+        disposalPendingCheck(state, now)
+    ]) {
+        if (check) {
+            checks.push(check);
+        }
+    }
+    if (checks.length === 0) {
+        checks.push({
+            id: 'governance-activation',
+            label: 'governance activation',
+            severity: 'ok',
+            state: 'ready',
+            detail: 'state, evidence, credentials, source of truth, and compatibility identity are readable',
+            remedy: 'Continue with liftoff governance plan --json when a phase is ready.'
+        });
+    }
+    return checks;
+}
+//# sourceMappingURL=doctor.js.map

package/dist/governance-activation/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/governance-activation/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EACL,eAAe,EACf,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAEL,mBAAmB,EACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yBAAyB,EAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,yBAAyB,EAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,sCAAsC,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EACL,8BAA8B,EAC/B,MAAM,sBAAsB,CAAC;AAQ9B,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,iBAAiB,CAAC;AAWzB,MAAM,iBAAiB,GAAG,CAAC,YAAY,EAAE,UAAU,CAAU,CAAC;AAC9D,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAa;IACjD,UAAU;IACV,QAAQ;IACR,cAAc;IACd,UAAU;IACV,UAAU;CACX,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;IAChD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,SAAiB;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,yBAAyB,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,WAAmB,EACnB,SAA4B;IAE5B,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAA4C,EAAE,CAAC;IAC3D,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAC7F,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,SAAS;QACX,CAAC;QACD,MAAM,aAAa,GAAG,CAAC,GAAG,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAChE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY;SACrD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,UAAkB;IACxD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,uBAAuB,UAAU,OAAO,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,UAAU,EAAE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;gBAC/E,CAAC,CAAC,MAAM,CAAC,UAAU;gBACnB,CAAC,CAAC,UAAU;YACd,MAAM,EAAE,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC;YAC7C,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,UAAU;QACV,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,WAAmB;IACtD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IACxE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,eAAe,CACtB,OAAgB,EAChB,KAA0B,EAC1B,GAAS;IAET,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,OAAO,CAAE,CAAC;IAChF,OAAO;QACL,GAAG,uBAAuB,CAAC,OAAO,EAAE;YAClC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE;YACjC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;YAC7C,GAAG;YACH,qBAAqB,EAAE,6BAA6B,CAAC,KAAK,CAAC;SAC5D,CAAC;QACF,mBAAmB,EAAE,oBAAoB,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC;KACxE,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,KAA0B,EAC1B,QAAwC,EACxC,GAAS;IAET,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QAC7E,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACnC,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACzD,OAAO,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC;QACtE,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,EAAE,EAAE,2BAA2B;QAC/B,KAAK,EAAE,qBAAqB;QAC5B,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,gBAAgB;QACvB,MAAM,EAAE,iEAAiE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC3F,MAAM,EAAE,oKAAoK;KAC7K,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,KAA0B;IAE1B,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1C,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,SAAS;QACzC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAC1C,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,EAAE,EAAE,0BAA0B;QAC9B,KAAK,EAAE,kBAAkB;QACzB,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,gBAAgB,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAE,CAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QAC7E,MAAM,EAAE,uEAAuE;KAChF,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,KAA0B;IAE1B,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,KAAK,KAAK,UAAU;QACxE,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC;IAC5D,MAAM,oBAAoB,GAAG,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC;IAChF,IAAI,CAAC,QAAQ,IAAI,oBAAoB,EAAE,CAAC;QACtC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,EAAE,EAAE,mCAAmC;QACvC,KAAK,EAAE,wBAAwB;QAC/B,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,wBAAwB;QAC/B,MAAM,EAAE,oFAAoF;QAC5F,MAAM,EAAE,kHAAkH;KAC3H,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAA0B,EAC1B,GAAS;IAET,IAAI,KAAK,CAAC,cAAc,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;IAC3E,OAAO;QACL,EAAE,EAAE,6BAA6B;QACjC,KAAK,EAAE,0BAA0B;QACjC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAClC,KAAK,EAAE,kBAAkB;QACzB,MAAM,EAAE,GAAG;YACT,CAAC,CAAC,kDAAkD,KAAK,CAAC,cAAc,CAAC,YAAY,EAAE;YACvF,CAAC,CAAC,oDAAoD,KAAK,CAAC,cAAc,CAAC,YAAY,EAAE;QAC3F,MAAM,EAAE,GAAG;YACT,CAAC,CAAC,iFAAiF;YACnF,CAAC,CAAC,yEAAyE;KAC9E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,WAAmB,EACnB,GAAS;IAET,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,CAAC,GAAG,yBAAyB,CAAC,CAAC,CAAC;IACjF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC,CAAC;IACvF,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;IAC9D,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,EAAE,EAAE,gCAAgC;QACpC,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE,OAAO,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAClE,KAAK,EAAE,qBAAqB;QAC5B,MAAM,EAAE,4BAA4B,MAAM,CAAC,MAAM,kBAAkB,MAAM,CAAC,aAAa,aAAa,MAAM,CAAC,SAAS,EAAE;QACtH,MAAM,EAAE,wIAAwI;KACjJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,WAAmB,EACnB,QAAyB,EACzB,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;QAC5F,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,sCAAsC,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/F,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,kCAAkC;YACtC,KAAK,EAAE,gCAAgC;YACvC,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,uBAAuB;YAC9B,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,8DAA8D;YACpG,MAAM,EAAE,0KAA0K;SACnL,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,oCAAoC;YACxC,KAAK,EAAE,2BAA2B;YAClC,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,yBAAyB;YAChC,MAAM,EAAE,0EAA0E,yBAAyB,CAAC,cAAc,EAAE;YAC5H,MAAM,EAAE,iHAAiH;SAC1H,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,kCAAkC;YACtC,KAAK,EAAE,gCAAgC;YACvC,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,uBAAuB;YAC9B,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC;YAC3B,MAAM,EAAE,mHAAmH;SAC5H,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,QAA+B,CAAC;IACpC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,qBAAqB,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,2BAA2B;YAC/B,KAAK,EAAE,qBAAqB;YAC5B,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC;YAC3B,MAAM,EAAE,kIAAkI;SAC3I,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,EAAE,KAAK,CAAC;IAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC;YAClD,WAAW;YACX,QAAQ;YACR,KAAK,EAAE;gBACL,aAAa,EAAE,yBAAyB,CAAC,4BAA4B;gBACrE,QAAQ,EAAE,yBAAyB;gBACnC,UAAU,EAAE;oBACV,EAAE,EAAE,SAAS,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE;oBACpC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI;oBAC3B,aAAa,EAAE,SAAS;iBACzB;gBACD,YAAY,EAAE,IAAI;gBAClB,aAAa,EAAE;oBACb,SAAS,EAAE,MAAM;oBACjB,kBAAkB,EAAE,KAAK;oBACzB,kBAAkB,EAAE,KAAK;iBAC1B;gBACD,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;wBAC7D,KAAK,EAAE,SAAS;wBAChB,SAAS,EAAE,0BAA0B;wBACrC,QAAQ,EAAE,EAAE;wBACZ,SAAS,EAAE,EAAE;wBACb,QAAQ,EAAE,EAAE;qBACb,CAAC,CAAC,CAA6C;gBAChD,SAAS,EAAE,0BAA0B;gBACrC,SAAS,EAAE,0BAA0B;aACtC;YACD,QAAQ;SACT,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,4BAA4B;gBAChC,KAAK,EAAE,iBAAiB;gBACxB,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,iBAAiB;gBACxB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;gBAClC,MAAM,EAAE,oGAAoG;aAC7G,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,uBAAuB;gBAC3B,KAAK,EAAE,uBAAuB;gBAC9B,QAAQ,EAAE,SAAS;gBACnB,KAAK,EAAE,eAAe;gBACtB,MAAM,EAAE,2CAA2C;gBACnD,MAAM,EAAE,sFAAsF;aAC/F,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChG,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,4BAA4B;YAChC,KAAK,EAAE,iBAAiB;YACxB,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,iBAAiB;YACxB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAClC,MAAM,EAAE,0FAA0F;SACnG,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAC3F,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,oCAAoC;YACxC,KAAK,EAAE,2BAA2B;YAClC,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YACtE,KAAK,EAAE,yBAAyB;YAChC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YAC/C,MAAM,EAAE,gIAAgI;SACzI,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAC7E,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,kCAAkC;YACtC,KAAK,EAAE,gCAAgC;YACvC,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,uBAAuB;YAC9B,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAClC,MAAM,EAAE,6GAA6G;SACtH,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,uBAAuB,CAAC;QACxC,KAAK,EAAE,mBAAmB;QAC1B,KAAK;QACL,SAAS,EAAE,EAAE;QACb,QAAQ;QACR,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,kBAAkB,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,kCAAkC;YACtC,KAAK,EAAE,gCAAgC;YACvC,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,uBAAuB;YAC9B,MAAM,EAAE,SAAS,CAAC,eAAe,IAAI,6CAA6C;YAClF,MAAM,EAAE,+EAA+E;SACxF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,KAAK,IAAI;QAClB,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC;QACxC,iBAAiB,CAAC,KAAK,CAAC;QACxB,MAAM,uBAAuB,CAAC,WAAW,EAAE,GAAG,CAAC;QAC/C,0BAA0B,CAAC,KAAK,CAAC;QACjC,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC;KACjC,EAAE,CAAC;QACF,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,uBAAuB;YAC9B,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,wFAAwF;YAChG,MAAM,EAAE,qEAAqE;SAC9E,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/governance-activation/evidence.d.ts

@@ -0,0 +1,49 @@
+import type { ActivationIdentity, EvidenceHeader, EvidenceTransitionIdentity, LiveReadbackProof, LiveReadbackProvider, ManagedPhaseGraph, PhaseEvidenceRecord, PhaseGraphNode, PhaseId } from './types.js';
+export interface EvidenceValidationIssue {
+    evidenceId?: string;
+    field: string;
+    expected?: string | number | boolean;
+    actual?: string | number | boolean;
+    message: string;
+}
+export interface EvidenceFreshnessContext {
+    repositoryId: string;
+    identity: ActivationIdentity;
+    phaseGraphHash: string;
+    phaseId: PhaseId;
+    phaseContractDigest: string;
+    baselineSha: string;
+    inputDigest: string;
+    transition: EvidenceTransitionIdentity;
+    now?: Date;
+    liveReadbackProviders?: readonly LiveReadbackProvider[];
+}
+export interface ValidatedPhaseEvidenceRecord {
+    evidenceId: string;
+    header: EvidenceHeader;
+    headerDigest: string;
+    producedAtEpochMs: number;
+    liveReadback: readonly LiveReadbackProof[];
+}
+export interface EvidenceSelectionResult {
+    selected: ValidatedPhaseEvidenceRecord | null;
+    issues: readonly EvidenceValidationIssue[];
+    ignoredOlderContradictions: readonly string[];
+}
+export declare function evidenceHeaderDigest(header: EvidenceHeader): string;
+export declare function validateEvidenceFreshness(record: PhaseEvidenceRecord, context: EvidenceFreshnessContext): {
+    valid: true;
+    record: ValidatedPhaseEvidenceRecord;
+} | {
+    valid: false;
+    issues: readonly EvidenceValidationIssue[];
+};
+export declare function selectLatestPhaseEvidence(records: readonly PhaseEvidenceRecord[], context: EvidenceFreshnessContext): EvidenceSelectionResult;
+export declare function evidenceContextForPhase(phaseId: PhaseId, overrides?: Partial<Omit<EvidenceFreshnessContext, 'phaseId' | 'phaseContractDigest' | 'transition'>> & {
+    transitionDigest?: string;
+}): EvidenceFreshnessContext;
+export declare function requiredLiveReadbackProviders(node: PhaseGraphNode): readonly LiveReadbackProvider[];
+export declare function phaseRequiresLiveReadback(node: PhaseGraphNode): boolean;
+export declare function phaseNode(graph: ManagedPhaseGraph, phaseId: PhaseId): PhaseGraphNode;
+export declare function canonicalEvidenceContextForPhase(phaseId: PhaseId): EvidenceFreshnessContext;
+export declare function emptyEvidenceRecordsByPhase(): Record<PhaseId, readonly PhaseEvidenceRecord[]>;