@msn-control/liftoff 0.9.9 → 0.10.0

package/dist/commands.js

@@ -26,12 +26,19 @@ import { lookupStableRelease } from './stable-release.js';
 import { supportedStack } from './supported-stack.js';
 import { buildArtifacts, buildManifest, partitionGeneratedArtifacts } from './templates.js';
 import { PresentationSession } from './terminal.js';
+import { governanceCommand } from './governance-activation/commands.js';
+import { loadActivationState as loadCurrentActivationState } from './governance-activation/activation-state.js';
+import { planHistoricalActivationStateMigration, updateFailureInjectionEnv } from './governance-activation/migration.js';
+import { currentActivationIdentity } from './governance-activation/graph.js';
+import { governanceChangeMetadataFileName, reconcileActiveGovernanceChange, validateGovernanceChangeMetadata } from './governance-activation/source-of-truth.js';
+import { governanceDoctorChecks } from './governance-activation/doctor.js';
 import { liftoffVersion } from './version.js';
 import { blockingReadinessFailures, detectHostEnvironment, installRequirement, probeWorkstation, selectLiftoffRuntimeRequirements, selectWorkstationRequirements } from './workstation.js';
 export async function runCommand(parsed, context) {
     const helpRequested = parsed.command !== undefined && readBooleanFlag(parsed.flags, 'help') === true;
     const jsonMode = !helpRequested && (parsed.command === 'doctor' ||
         parsed.command === 'update' ||
+        parsed.command === 'governance' ||
         parsed.command === 'upgrade' ||
         parsed.command === 'validate') &&
         readBooleanFlag(parsed.flags, 'json') === true;
@@ -81,6 +88,8 @@ export async function runCommand(parsed, context) {
                 return await migrateCommand(parsed, executionContext);
             case 'doctor':
                 return await doctorCommand(parsed, executionContext);
+            case 'governance':
+                return await governanceCommand(parsed, executionContext);
             case 'dev':
                 return helperCommand(parsed, executionContext, 'docker compose');
             case 'infra':
@@ -239,9 +248,11 @@ async function initCommand(parsed, context) {
                 label: 'Repository governance',
                 value: plan.governanceProfile.id === 'none'
                     ? 'Disabled'
-                    : 'Handoff generated; commit and push before read-only Phase 0'
+                    : 'Deterministic setup generated; run /liftoff-setup next'
             }
-        ], `liftoff validate ${JSON.stringify(target.root)}`);
+        ], plan.governanceProfile.id === 'none'
+            ? `liftoff validate ${JSON.stringify(target.root)}`
+            : '/liftoff-setup');
         return 0;
     }
     finally {
@@ -718,7 +729,11 @@ async function executeMigration(parsed, context, sourceRoot) {
         await assertSafeInitTarget(target, parentDir);
         await assertNewOrEmptyDirectory(targetRoot);
         presentation.stage('Check workstation readiness');
-        const readinessRoot = await mkdtemp(path.join(os.tmpdir(), 'liftoff-migrate-readiness-'));
+        const readinessParent = process.env.LIFTOFF_STAGING_ROOT
+            ? path.resolve(process.env.LIFTOFF_STAGING_ROOT)
+            : os.tmpdir();
+        await mkdir(readinessParent, { recursive: true });
+        const readinessRoot = await mkdtemp(path.join(readinessParent, 'liftoff-migrate-readiness-'));
         const readiness = await (async () => {
             try {
                 return await ensureWorkstationReady(plan, options, context, runner, presentation, prompter, `liftoff migrate ${JSON.stringify(sourceRoot)}`, readinessRoot);
@@ -1098,9 +1113,10 @@ function selectUpdatePreconditions(snapshots, entries, mutations, additionalPath
     }
     return snapshots.filter((snapshot) => requiredKeys.has(updateSnapshotKey(snapshot.pathParts)));
 }
-function assertAuthorizedUpdateMutations(mutations, entries, provisioningPlans) {
+function assertAuthorizedUpdateMutations(mutations, entries, provisioningPlans, additionalAuthorizedPaths = []) {
     const authorized = new Set([
-        updateSnapshotKey(['liftoff.manifest.json'])
+        updateSnapshotKey(['liftoff.manifest.json']),
+        ...additionalAuthorizedPaths.map((pathParts) => updateSnapshotKey(pathParts))
     ]);
     for (const entry of entries) {
         if (entry.rendered && entry.rendered.lifecycle !== 'managed-core') {
@@ -1127,6 +1143,232 @@ function assertAuthorizedUpdateMutations(mutations, entries, provisioningPlans)
         }
     }
 }
+function identityFieldChanges(from, to = currentActivationIdentity) {
+    return Object.keys(to)
+        .filter((field) => from[field] !== undefined && from[field] !== to[field])
+        .map((field) => ({
+        field: `activationIdentity.${field}`,
+        from: from[field],
+        to: to[field]
+    }));
+}
+function manifestChanges(manifest, plannedManifest) {
+    const changes = [];
+    if (manifest.artifactVersion !== plannedManifest.artifactVersion) {
+        changes.push({
+            field: 'artifactVersion',
+            from: manifest.artifactVersion,
+            to: plannedManifest.artifactVersion
+        });
+    }
+    if (manifest.liftoffVersion !== plannedManifest.liftoffVersion) {
+        changes.push({
+            field: 'liftoffVersion',
+            from: manifest.liftoffVersion,
+            to: plannedManifest.liftoffVersion
+        });
+    }
+    if (manifest.governance.profile !== 'none' &&
+        manifest.governance.profile !== 'unspecified' &&
+        plannedManifest.governance.profile !== 'none' &&
+        plannedManifest.governance.profile !== 'unspecified') {
+        if (manifest.governance.policyVersion !== plannedManifest.governance.policyVersion) {
+            changes.push({
+                field: 'governance.policyVersion',
+                from: manifest.governance.policyVersion,
+                to: plannedManifest.governance.policyVersion
+            });
+        }
+        const fromIdentity = manifest.governance.activationIdentity;
+        const toIdentity = plannedManifest.governance.activationIdentity;
+        if (toIdentity) {
+            if (!fromIdentity) {
+                changes.push({
+                    field: 'governance.activationIdentity',
+                    from: null,
+                    to: toIdentity
+                });
+            }
+            else {
+                changes.push(...identityFieldChanges(fromIdentity, toIdentity));
+            }
+        }
+    }
+    return changes;
+}
+function stateMigrationReconciliation(stateMigration) {
+    if (stateMigration.status === 'blocked') {
+        return {
+            status: 'blocked',
+            changedIdentityFields: [],
+            phaseImpact: { preservedPhaseIds: [], invalidPhaseIds: [] },
+            issues: stateMigration.report.issues,
+            remedy: 'Preserve governance/activation-state.json byte-for-byte and provide an explicit versioned import mapping; checkboxes, filenames, and prose cannot become evidence.'
+        };
+    }
+    if (stateMigration.status === 'migrate') {
+        return {
+            status: 'reconciliation-required',
+            changedIdentityFields: identityFieldChanges(stateMigration.report.fromIdentity, stateMigration.report.toIdentity),
+            phaseImpact: {
+                preservedPhaseIds: stateMigration.report.preservedPhaseIds,
+                invalidPhaseIds: stateMigration.report.invalidPhaseIds
+            },
+            issues: [
+                `Historical activation state will be migrated with the managed update transaction; evidence bytes are preserved and ${stateMigration.report.reconciliationPath} records the explicit graph mapping.`
+            ],
+            remedy: 'Run governance status/verify after update and acknowledge the reconciliation record before executing affected phases.'
+        };
+    }
+    return {
+        status: 'not-required',
+        changedIdentityFields: [],
+        phaseImpact: { preservedPhaseIds: [], invalidPhaseIds: [] },
+        issues: []
+    };
+}
+function activeChangePathParts(stateKind, changeId) {
+    return stateKind === 'openspec'
+        ? ['openspec', 'changes', changeId]
+        : ['specs', changeId];
+}
+async function activeChangeReconciliationReport(projectRoot) {
+    let loaded;
+    try {
+        loaded = await loadCurrentActivationState(projectRoot);
+    }
+    catch {
+        return {
+            status: 'not-required',
+            changedIdentityFields: [],
+            phaseImpact: { preservedPhaseIds: [], invalidPhaseIds: [] },
+            issues: []
+        };
+    }
+    const activeChange = loaded?.state.activeChange;
+    if (!activeChange) {
+        return {
+            status: 'not-required',
+            changedIdentityFields: [],
+            phaseImpact: { preservedPhaseIds: [], invalidPhaseIds: [] },
+            issues: []
+        };
+    }
+    const metadataPathParts = [
+        ...activeChangePathParts(activeChange.kind, activeChange.id),
+        governanceChangeMetadataFileName
+    ];
+    const bytes = await readProjectFile(projectRoot, metadataPathParts);
+    if (bytes === undefined) {
+        return {
+            status: 'blocked',
+            changedIdentityFields: [],
+            phaseImpact: { preservedPhaseIds: [], invalidPhaseIds: [] },
+            issues: [
+                `${metadataPathParts.join('/')} is missing for active change ${activeChange.id}; no update mode can infer it from tasks or prose.`
+            ],
+            remedy: 'Restore schema-valid governance metadata or record an explicit supersession before continuing setup.'
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(bytes.toString('utf8'));
+    }
+    catch (error) {
+        return {
+            status: 'blocked',
+            changedIdentityFields: [],
+            phaseImpact: { preservedPhaseIds: [], invalidPhaseIds: [] },
+            issues: [`Unable to parse ${metadataPathParts.join('/')}: ${error instanceof Error ? error.message : String(error)}`],
+            remedy: 'Restore schema-valid governance metadata; no update mode can infer active governance from checkboxes, filenames, or prose.'
+        };
+    }
+    let reconciliation;
+    try {
+        const metadata = validateGovernanceChangeMetadata(parsed);
+        reconciliation = reconcileActiveGovernanceChange({ metadata, evidence: [] });
+    }
+    catch (error) {
+        return {
+            status: 'blocked',
+            changedIdentityFields: [],
+            phaseImpact: { preservedPhaseIds: [], invalidPhaseIds: [] },
+            issues: [`Invalid ${metadataPathParts.join('/')}: ${error instanceof Error ? error.message : String(error)}`],
+            remedy: 'Restore schema-valid governance metadata; no update mode can infer active governance from checkboxes, filenames, or prose.'
+        };
+    }
+    if (reconciliation.status === 'not-required') {
+        return {
+            status: 'not-required',
+            changedIdentityFields: [],
+            phaseImpact: {
+                preservedPhaseIds: reconciliation.preservedPhaseIds,
+                invalidPhaseIds: reconciliation.invalidPhaseIds
+            },
+            issues: []
+        };
+    }
+    if (reconciliation.status === 'blocked') {
+        return {
+            status: 'blocked',
+            changedIdentityFields: [],
+            phaseImpact: {
+                preservedPhaseIds: reconciliation.preservedPhaseIds,
+                invalidPhaseIds: reconciliation.invalidPhaseIds
+            },
+            issues: reconciliation.issues,
+            remedy: 'Upgrade Liftoff or add an explicit compatibility mapping before executing affected governance phases.'
+        };
+    }
+    return {
+        status: 'reconciliation-required',
+        changedIdentityFields: identityFieldChanges(reconciliation.fromIdentity, reconciliation.toIdentity),
+        phaseImpact: {
+            preservedPhaseIds: reconciliation.preservedPhaseIds,
+            invalidPhaseIds: reconciliation.invalidPhaseIds
+        },
+        issues: reconciliation.issues,
+        remedy: 'Managed definitions and manifest may be updated, but governance status/verify will block affected execution until the active change acknowledges the installed identity.'
+    };
+}
+function combineReconciliationReports(reports) {
+    if (reports.some((report) => report.status === 'blocked')) {
+        return {
+            status: 'blocked',
+            changedIdentityFields: reports.flatMap((report) => report.changedIdentityFields),
+            phaseImpact: {
+                preservedPhaseIds: [],
+                invalidPhaseIds: [...new Set(reports.flatMap((report) => report.phaseImpact.invalidPhaseIds))]
+            },
+            issues: reports.flatMap((report) => report.issues),
+            remedy: reports.find((report) => report.remedy)?.remedy
+        };
+    }
+    if (reports.some((report) => report.status === 'reconciliation-required')) {
+        return {
+            status: 'reconciliation-required',
+            changedIdentityFields: reports.flatMap((report) => report.changedIdentityFields),
+            phaseImpact: {
+                preservedPhaseIds: [...new Set(reports.flatMap((report) => report.phaseImpact.preservedPhaseIds))],
+                invalidPhaseIds: [...new Set(reports.flatMap((report) => report.phaseImpact.invalidPhaseIds))]
+            },
+            issues: reports.flatMap((report) => report.issues),
+            remedy: reports.find((report) => report.remedy)?.remedy
+        };
+    }
+    return {
+        status: 'not-required',
+        changedIdentityFields: [],
+        phaseImpact: { preservedPhaseIds: [], invalidPhaseIds: [] },
+        issues: []
+    };
+}
+function maybeInjectUpdateFailure(env, stage) {
+    const requested = env?.[updateFailureInjectionEnv] ?? process.env[updateFailureInjectionEnv];
+    if (requested === stage) {
+        throw new Error(`Injected managed-update failure at ${stage}.`);
+    }
+}
 async function updateCommand(parsed, context) {
     const { presentation } = context;
     const check = readBooleanFlag(parsed.flags, 'check') ?? false;
@@ -1224,18 +1466,52 @@ async function updateCommand(parsed, context) {
         : await captureUpdateSnapshots(projectRoot, manifest, scopedRender, initialUpdateSnapshots);
     const entries = await reconcileProject(manifest, render, projectRoot);
     const summary = summarizeEntries(entries);
-    const ownershipMigrationPending = manifest.artifactVersion !== 6 ||
+    const ownershipMigrationPending = manifest.artifactVersion !== 7 ||
         manifestHadFilteredLegacyNonDurableOwnership(manifest);
     const plannedManifest = buildManifest(renderPlan, render, {
         frameworkState: manifest.framework.state,
         projectArtifacts: manifest.projectArtifacts
     });
+    const plannedManifestChanges = manifestChanges(manifest, plannedManifest);
+    const stateMigration = await planHistoricalActivationStateMigration(projectRoot);
+    const reconciliation = combineReconciliationReports([
+        stateMigrationReconciliation(stateMigration),
+        await activeChangeReconciliationReport(projectRoot)
+    ]);
+    if (reconciliation.status === 'blocked') {
+        const blockedReport = {
+            schemaVersion: 2,
+            mode: check ? 'check' : 'apply',
+            scope: 'managed-core',
+            status: 'blocked',
+            cliVersion: liftoffVersion,
+            projectVersion: manifest.liftoffVersion,
+            entries: [],
+            provisioning: [],
+            ownershipMigrationPending: false,
+            manifestChanges: plannedManifestChanges,
+            activationStateMigration: stateMigration.report,
+            reconciliation,
+            summary
+        };
+        if (jsonMode) {
+            presentation.rawStdout(`${JSON.stringify(blockedReport, null, 2)}\n`);
+        }
+        else {
+            presentation.status('error', 'Managed update blocked', reconciliation.issues.join('; '));
+            if (reconciliation.remedy) {
+                presentation.remedy(reconciliation.remedy);
+            }
+        }
+        return 1;
+    }
     const workloadIntentChanged = !sameWorkloadIntent(plannedManifest.project.workload, manifest.project.workload);
     const manifestRewritePending = ownershipMigrationPending ||
         workloadIntentChanged;
     const drift = hasDrift(entries) ||
         manifestRewritePending ||
-        provisioningPlans.length > 0;
+        provisioningPlans.length > 0 ||
+        stateMigration.status === 'migrate';
     const visible = entries.filter((entry) => entry.status !== 'unchanged' || entry.refreshHash);
     if (!drift) {
         if (jsonMode) {
@@ -1243,22 +1519,36 @@ async function updateCommand(parsed, context) {
                 schemaVersion: 2,
                 mode: 'check',
                 scope: 'managed-core',
+                status: reconciliation.status === 'reconciliation-required' ? 'reconciliation-required' : 'current',
                 cliVersion: liftoffVersion,
                 projectVersion: manifest.liftoffVersion,
                 entries: [],
                 provisioning: [],
                 ownershipMigrationPending,
+                manifestChanges: plannedManifestChanges,
+                activationIdentity: manifest.governance.profile !== 'none' && manifest.governance.profile !== 'unspecified'
+                    ? manifest.governance.activationIdentity ?? null
+                    : null,
+                activationStateMigration: stateMigration.report,
+                reconciliation,
                 summary
             } : {
                 schemaVersion: 2,
                 mode: 'apply',
                 scope: 'managed-core',
+                status: reconciliation.status === 'reconciliation-required' ? 'reconciliation-required' : 'current',
                 cliVersion: liftoffVersion,
                 projectVersion: manifest.liftoffVersion,
                 written: [],
                 skipped: [],
                 provisioning: [],
                 ownershipMigrationPending,
+                manifestChanges: plannedManifestChanges,
+                activationIdentity: manifest.governance.profile !== 'none' && manifest.governance.profile !== 'unspecified'
+                    ? manifest.governance.activationIdentity ?? null
+                    : null,
+                activationStateMigration: stateMigration.report,
+                reconciliation,
                 summary
             }, null, 2)}\n`);
             return 0;
@@ -1287,6 +1577,12 @@ async function updateCommand(parsed, context) {
                 })),
                 provisioning: provisioningJson(provisioningPlans),
                 ownershipMigrationPending,
+                manifestChanges: plannedManifestChanges,
+                activationIdentity: plannedManifest.governance.profile !== 'none' && plannedManifest.governance.profile !== 'unspecified'
+                    ? plannedManifest.governance.activationIdentity ?? null
+                    : null,
+                activationStateMigration: stateMigration.report,
+                reconciliation,
                 summary
             }, null, 2)}\n`);
             return 2;
@@ -1308,7 +1604,7 @@ async function updateCommand(parsed, context) {
         }
         const manifestMaintenance = [
             ownershipMigrationPending
-                ? 'release legacy project artifacts from Liftoff update authority in manifest schema v6; no production file will be written'
+                ? 'release legacy project artifacts from Liftoff update authority in manifest schema v7; no production file will be written'
                 : undefined,
             workloadIntentChanged
                 ? 'record the requested project configuration intent after safe provisioning'
@@ -1317,6 +1613,18 @@ async function updateCommand(parsed, context) {
         if (manifestMaintenance.length > 0) {
             presentation.bullets('Manifest maintenance', manifestMaintenance);
         }
+        if (stateMigration.status === 'migrate') {
+            presentation.bullets('Activation-state migration', [
+                `${stateMigration.report.path}: explicit compatibility mapping preserves evidence bytes and stages ${stateMigration.report.reconciliationPath}`
+            ]);
+        }
+        if (reconciliation.status === 'reconciliation-required') {
+            presentation.bullets('Reconciliation required after update', [
+                ...reconciliation.changedIdentityFields.map((field) => `${field.field}: ${JSON.stringify(field.from)} -> ${JSON.stringify(field.to)}`),
+                `invalid phases: ${reconciliation.phaseImpact.invalidPhaseIds.join(', ') || 'none'}`,
+                reconciliation.remedy ?? 'Run governance status/verify before executing affected phases.'
+            ]);
+        }
         const toWrite = summary.new +
             summary.missing +
             summary.upgrade +
@@ -1325,7 +1633,8 @@ async function updateCommand(parsed, context) {
             provisioningPlans.reduce((count, group) => count + (group.blocked
                 ? 0
                 : group.entries.filter((entry) => entry.status === 'create').length), 0) +
-            (manifestRewritePending ? 1 : 0);
+            (manifestRewritePending ? 1 : 0) +
+            stateMigration.mutations.length;
         presentation.status('warning', 'Liftoff core maintenance available', `${toWrite} to write, ${summary.conflict} core conflict(s), ${summary.orphan} core orphan(s), ${summary.unchanged} core unchanged`);
         if (toWrite > 0) {
             presentation.command('liftoff update');
@@ -1347,6 +1656,7 @@ async function updateCommand(parsed, context) {
     }
     presentation.stage('Apply safe Liftoff core changes', projectRoot);
     await preflightUpdate(projectRoot, entries, force);
+    maybeInjectUpdateFailure(context.env, 'after-preflight');
     const written = [];
     const skipped = [];
     const mutations = [];
@@ -1414,6 +1724,9 @@ async function updateCommand(parsed, context) {
             provisioned.push(entry);
         }
     }
+    for (const mutation of stateMigration.mutations) {
+        mutations.push(mutation);
+    }
     const oldByName = new Map(manifest.managedArtifacts.map((artifact) => [artifact.logicalName, artifact]));
     const skippedByName = new Map(skipped.map((entry) => [entry.logicalName, entry]));
     const hasUnrecordedGovernanceConflict = skipped.some((entry) => entry.status === 'conflict' &&
@@ -1462,22 +1775,40 @@ async function updateCommand(parsed, context) {
         pathParts: ['liftoff.manifest.json'],
         content: `${JSON.stringify(nextManifest, null, 2)}\n`
     });
-    assertAuthorizedUpdateMutations(mutations, entries, provisioningPlans);
+    assertAuthorizedUpdateMutations(mutations, entries, provisioningPlans, stateMigration.mutations.map((mutation) => mutation.pathParts));
     await applyProjectFileTransaction(projectRoot, mutations, {
-        preconditions: selectUpdatePreconditions(updateSnapshots, entries, mutations, provisioned.map((entry) => entry.rendered.pathParts))
+        onBeforeMutation: async (mutation, index) => {
+            maybeInjectUpdateFailure(context.env, `before-mutation:${index}`);
+            maybeInjectUpdateFailure(context.env, `before-path:${mutation.pathParts.join('/')}`);
+        },
+        preconditions: [
+            ...selectUpdatePreconditions(updateSnapshots, entries, mutations, provisioned.map((entry) => entry.rendered.pathParts)),
+            ...stateMigration.preconditions
+        ]
     });
     if (jsonMode) {
         presentation.rawStdout(`${JSON.stringify({
             schemaVersion: 2,
             mode: 'apply',
             scope: 'managed-core',
-            status: blockedProvisioning.length > 0 ? 'partial' : 'applied',
+            status: blockedProvisioning.length > 0
+                ? 'partial'
+                : reconciliation.status === 'reconciliation-required'
+                    ? 'reconciliation-required'
+                    : 'applied',
             cliVersion: liftoffVersion,
             projectVersion: manifest.liftoffVersion,
             written: written.map((entry) => manifestDisplayPath(entry.pathParts)),
+            stateWritten: stateMigration.mutations.map((mutation) => manifestDisplayPath(mutation.pathParts)),
             skipped: skipped.map((entry) => ({ path: manifestDisplayPath(entry.pathParts), reason: entry.reason })),
             provisioning: provisioningJson(provisioningPlans),
             ownershipMigrationPending,
+            manifestChanges: manifestChanges(manifest, nextManifest),
+            activationIdentity: nextManifest.governance.profile !== 'none' && nextManifest.governance.profile !== 'unspecified'
+                ? nextManifest.governance.activationIdentity ?? null
+                : null,
+            activationStateMigration: stateMigration.report,
+            reconciliation,
             summary
         }, null, 2)}\n`);
         return 0;
@@ -1485,6 +1816,9 @@ async function updateCommand(parsed, context) {
     if (written.length > 0) {
         presentation.bullets('Applied Liftoff core changes', written.map((entry) => `wrote ${entryDisplay(entry)}`));
     }
+    if (stateMigration.status === 'migrate') {
+        presentation.bullets('Migrated activation state', stateMigration.mutations.map((mutation) => `wrote ${manifestDisplayPath(mutation.pathParts)}; evidence bytes preserved`));
+    }
     if (provisioned.length > 0) {
         presentation.bullets('Provisioned project components', provisioned.map((entry) => `${entry.status === 'create' ? 'wrote' : 'adopted'} ${manifestDisplayPath(entry.rendered.pathParts)}`));
     }
@@ -1500,6 +1834,13 @@ async function updateCommand(parsed, context) {
     if (orphans.length > 0) {
         presentation.bullets('Orphaned Liftoff core artifacts', orphans.map((entry) => `orphan ${entryDisplay(entry)}  ${entry.reason}`));
     }
+    if (reconciliation.status === 'reconciliation-required') {
+        presentation.bullets('Reconciliation required', [
+            ...reconciliation.changedIdentityFields.map((field) => `${field.field}: ${JSON.stringify(field.from)} -> ${JSON.stringify(field.to)}`),
+            `invalid phases: ${reconciliation.phaseImpact.invalidPhaseIds.join(', ') || 'none'}`,
+            reconciliation.remedy ?? 'Run governance status/verify before executing affected phases.'
+        ]);
+    }
     presentation.completion('Updated project', [
         `${written.length} core written`,
         `${provisioned.length} project provisioned`,
@@ -1961,6 +2302,7 @@ async function projectLayer(projectRoot, manifest) {
             detail,
             ...(remedy ? { remedy } : {})
         });
+        checks.push(...await governanceDoctorChecks(projectRoot, manifest));
     }
     checks.push(...await frameworkDoctorChecks(projectRoot, manifest));
     if (manifest.project.workload.kind === 'power-apps-code-app') {
@@ -1985,7 +2327,7 @@ async function projectLayer(projectRoot, manifest) {
         const provisioningPlans = await inspectProvisioningGroups(projectRoot, render, requestedProvisioningGroups(manifest, plan));
         const driftCount = entries.filter((entry) => entry.status !== 'unchanged' || entry.refreshHash).length +
             provisioningPlans.length +
-            (manifest.artifactVersion === 6 ? 0 : 1);
+            (manifest.artifactVersion === 7 ? 0 : 1);
         if (driftCount > 0) {
             checks.push({
                 label: 'managed core',