@msn-control/liftoff 0.9.9 → 0.10.0

package/docs/safety-and-consent.md

@@ -14,6 +14,7 @@ dependencies. No one permission implies another.
 | `--configure-openspec-profile` | The displayed global OpenSpec workflow, delivery, and profile changes | Tools, project files, dependencies, or Copilot cloud opt-in |
 | `--copilot-cloud` / `--no-copilot-cloud` | Enable or disable OpenSpec's project-local hosted Copilot agent files | Global profile changes, tools, dependencies, or unrelated project writes |
 | `--install-dependencies` | Locked project-local dependency commands after a successful merge | Machine tools, global profile changes, project decisions, or overwrites |
+| `liftoff governance apply-next --execute` | Execute at most one reviewed, graph-ready, evidence-ready governance transition | Earlier or later phases, broader resources, credentials outside the envelope, live plan/apply during baseline, force-push, reset, rebase, or unknown-file deletion |
 
 Interactive sessions ask separately at the point each permission is needed.
 
@@ -21,8 +22,9 @@ Selecting repository governance or passing `--yes` authorizes only deterministic
 local handoff files. It never authorizes agent execution, Git mutation, GitHub
 APIs, Azure or other cloud resources, rulesets, security configuration,
 deployment, monitoring, file replacement, machine tools, or project
-dependencies. Live activation begins only after commit, push, read-only Phase 0,
-and explicit plan approval.
+dependencies. `/liftoff-setup` first completes and archives the local bootstrap
+seed, then stops at authority gates. Live activation begins only after explicit
+commit/push approval, read-only Phase 0, and activation-plan approval.
 
 An approved downstream local-state bootstrap remains encrypted, gitignored, and
 single-writer. It is never transferred through GitHub artifacts or secrets,
@@ -94,6 +96,14 @@ create-only provisioning path and applies those writes, managed-core moves or
 deletes, and the manifest as one rollback-capable transaction. Schema upgrades
 are committed only after the other mutations succeed.
 
+Managed update may install manifest v7, policy v6, activation-contract v1,
+phase graph, compatibility metadata, credential-policy schema, setup
+integrations, and compatibility aliases. It preserves user-owned activation
+state, approvals, immutable evidence, credential policies, active OpenSpec
+changes, and bootstrap retention/disposal records. If the current activation
+identity is future, unsupported, or graph-incompatible, update and setup block
+with a remedy instead of downgrading or rewriting state.
+
 If automatic rollback itself cannot safely restore a path because another
 process changed it, Liftoff reports the incomplete rollback rather than
 overwriting unknown bytes.
@@ -181,3 +191,15 @@ Liftoff does not:
 - Run Microsoft's broad Code Apps marketplace installer.
 
 Those actions require their own review, authentication, and consent.
+
+Governance runner-preflight credentials have a stricter contract. Setup first
+uses an existing verified selected-repository GitHub App installation when it
+has the required read permissions. Otherwise it guides one fine-grained PAT:
+display name `<repo>-runner-preflight-read`, repository secret
+`RUNNER_CONFIGURATION_READ_TOKEN`, 30-day lifetime, current repository only,
+repository metadata read, organization hosted-runner read and
+network-configuration read, no writes, and only the recorded workflow/job
+allowlist. The value must be entered through masked input only. Never paste or
+show it in chat, argv, command arguments, logs, evidence, generated files, or
+screenshots. If it appears there, treat it as compromised and manually revoke and
+rotate it before continuing.

package/docs/troubleshooting.md

@@ -158,7 +158,7 @@ failed update, but Liftoff keeps no backup after success.
 
 For a new governance policy or launcher conflict, review that exact local file
 before considering `liftoff update --force`; do not delete it or activate remote
-governance merely to make update pass. The schema-v6 manifest records
+governance merely to make update pass. The manifest-v7 record stores
 `handoff-partial` and no ownership entry for each preserved unrecorded conflict.
 Run `liftoff update --check` to inspect the remaining paths. Once each path is
 absent or matches the current artifact, plain update promotes the handoff to
@@ -184,9 +184,13 @@ the existing project files and infrastructure are project-owned.
 ## Governance handoff exists but nothing is enforced
 
 That is the expected initial state. The manifest records `handoff-generated`,
-not active enforcement. Commit and push the repository, run the selected-agent
-launcher, review its read-only Phase 0 report, and explicitly approve the plan
-before the agent creates a governance change.
+not active enforcement. Run `/liftoff-setup` from a selected agent. It first
+completes, syncs, and archives the generated bootstrap seed with local baseline
+checks, then stops at explicit authority gates for commit/push, credentials,
+billed infrastructure or exceptions, final enforcement, destructive cleanup, or
+external blockers. Rerun `/liftoff-setup` to resume; verified phases are not
+repeated. `/liftoff-repository-governance` is only a compatibility alias for the
+same engine and state.
 
 Missing licenses, runner-provisioning authority, a private Staging assignment or
 reachable network path, alert routes, parallel deployment, or sufficient canary
@@ -224,6 +228,52 @@ Do not use `AzurePlatformDNS` in an Allow NSG rule. The special tag is deny-only
 for disabling default platform DNS. Omit the rule when platform DNS is enabled,
 or allow TCP and UDP 53 to exact custom resolver addresses.
 
+## Governance doctor reports a blocked state
+
+`liftoff doctor` and `liftoff governance status --json` use precise states:
+
+| State | Remedy |
+| --- | --- |
+| `seed-incomplete` | Run `/liftoff-setup`; fix failing local baseline checks and rerun until the seed is archived. |
+| `phase-blocked` | Read the blocking phase, evidence requirement, and approval gate; satisfy the named prerequisite rather than skipping it. |
+| `evidence-stale` | Regenerate evidence from the current baseline, activation identity, graph hash, and phase input digest. |
+| `credential-expiring` | Rotate before the recorded lead time using the same App or PAT policy. |
+| `reconciliation-required` | Review the policy/contract/schema/graph change and acknowledge the current compatible identity before applying another phase. |
+| `identity-incompatible` | Upgrade to the reported minimum Liftoff version or provide an explicit supported migration/import mapping. |
+| `enforcement-incomplete` | Prove exact required contexts green and deliberately red, then approve final enforcement before ruleset mutation. |
+| `disposal-pending` | After day 30, approve destructive disposal of retained bootstrap state and rerun setup. |
+
+Do not hand-edit task checkboxes to clear these states. Tasks are projections of
+validated phase evidence.
+
+## Runner-preflight credential setup is blocked
+
+Setup first prefers an existing verified selected-repository GitHub App with the
+required read permissions. If none is available, create one fine-grained PAT with
+exactly these fields: display name `<repo>-runner-preflight-read`, secret
+`RUNNER_CONFIGURATION_READ_TOKEN`, 30-day lifetime, current repository only,
+repository metadata read, organization hosted-runner read and
+network-configuration read, no writes, and the recorded workflow/job allowlist
+(`.github/workflows/bootstrap-import-preflight.yml` job
+`bootstrap-import-preflight`; `.github/workflows/private-dast-preflight.yml` job
+`private-dast-preflight` unless the generated policy records a narrower
+applicable set).
+
+Enter the value only through the masked input. Never paste or show the value in
+chat, argv, command arguments, logs, evidence, files, or screenshots. A leaked value is
+compromised; manually revoke it, create a replacement, update the repository
+secret through setup, and rerun `liftoff governance verify --json`.
+
+## Governance identity or manifest migration is blocked
+
+Current Liftoff reads manifest v2-v7 and writes v7. It resumes only explicit
+compatible tuples: policy version 6, activation contract 1, schema-v1 activation
+artifacts, and a recognized phase-graph hash. Future versions, individually
+known but unsupported combinations, unknown graph hashes, or unversioned ad hoc
+state block without rewriting files. Use the exact upgrade, import-mapping, or
+reconciliation remedy printed by status or update; do not downgrade the
+manifest or copy evidence between identities.
+
 Do not run an older Liftoff release to reverse a completed baseline migration.
 Restore the affected generated files and `liftoff.manifest.json` through version
 control, then reinstall from the restored locks.
@@ -295,6 +345,7 @@ The old command has no compatibility alias.
 ```bash
 liftoff help
 liftoff init --help
+liftoff governance --help
 liftoff update --help
 ```
 

package/docs/workloads.md

@@ -104,7 +104,7 @@ environment, API frontend, Docker, or OpenTofu selection.
 - React, Vite, TypeScript, Tailwind, and the Power Apps SDK and Vite plugin.
 - Locked root `package.json` and `package-lock.json`.
 - Project-local `power-apps` CLI supplied by the generated dependency graph.
-- `liftoff.config.json`, schema-v6 `liftoff.manifest.json`, starter provenance,
+- `liftoff.config.json`, manifest-v7 `liftoff.manifest.json`, starter provenance,
   and third-party attribution.
 - Official OpenSpec or Spec Kit output and every selected agent marker.
 - The common local governance policy and selected-agent launcher, with backend,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@msn-control/liftoff",
-  "version": "0.9.9",
+  "version": "0.10.0",
   "description": "Interactive CLI for governed GenAI, API, and Power Apps code app projects.",
   "type": "module",
   "license": "GPL-3.0-only",
@@ -37,6 +37,7 @@
     "assets/supported-stack.json",
     "docs",
     "README.md",
+    "DEVELOPER.md",
     "LICENSE"
   ],
   "publishConfig": {