@msn-control/liftoff 0.9.9 → 0.10.1

package/dist/governance-activation/transitions.js

@@ -0,0 +1,2128 @@
+import { readdir, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { NodeCommandRunner } from '../process-runner.js';
+import { applyProjectFileTransaction, readProjectFile, resolveProjectPath, validateArtifactPathParts } from '../file-system.js';
+import { archiveGeneratedSeedForPhase, generatedSeedChangeName, validateGeneratedSeedForPhase, verifyGeneratedSeedBaselineForPhase } from './seed-lifecycle.js';
+import { evaluateApprovalForTransitionPlan, transitionPlanForPhase } from './approvals.js';
+import { canonicalJson, canonicalSha256 } from './canonical-json.js';
+import { credentialPolicyPathParts, detectCredentialLeaks } from './credentials.js';
+import { evidenceHeaderDigest, selectLatestPhaseEvidence } from './evidence.js';
+import { phaseContractDigests } from './graph.js';
+import { buildApprovedPhase0FactsFromState, renderGovernanceChangeWritePlan, stateWithSelectedActiveChange } from './source-of-truth.js';
+import { phaseIds } from './types.js';
+import { validateEvidenceHeader, validateSavedTransitionPlan, validateUserActivationState } from './validators.js';
+import { activationStateContentHash } from './activation-state.js';
+export const governancePlanDirectoryPathParts = ['governance', 'plans'];
+const planLifetimeMs = 15 * 60 * 1000;
+const dayMs = 24 * 60 * 60 * 1000;
+const remoteImportPayloadKind = 'remote-import-verified.v1';
+const workflowSourcePayloadKind = 'workflow-source-ready.v1';
+const greenRedPayloadKind = 'green-red-proof.v1';
+const bootstrapStateDisposedPayloadKind = 'bootstrap-state-disposed.v1';
+const engineProducer = 'liftoff-governance-transition-engine';
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function commandSucceeded(result) {
+    return result.status === 0 && !result.timedOut && !result.errorCode;
+}
+function commandFailure(result) {
+    if (result.timedOut) {
+        return `${result.displayCommand} timed out`;
+    }
+    if (result.errorCode || result.errorMessage) {
+        return `${result.displayCommand}: ${[result.errorCode, result.errorMessage].filter(Boolean).join(': ')}`;
+    }
+    return `${result.displayCommand} exited ${result.status ?? 'unknown'}${result.stderr ? `: ${result.stderr.trim()}` : ''}`;
+}
+function phaseById(graph, phaseId) {
+    const phase = graph.phases.find((entry) => entry.id === phaseId);
+    if (!phase) {
+        throw new Error(`Unknown phase ${phaseId}.`);
+    }
+    return phase;
+}
+function safeTimestamp(value) {
+    return value.replace(/[^0-9A-Za-z]/g, '');
+}
+export function transitionPlanPathParts(plan) {
+    return validateArtifactPathParts([
+        ...governancePlanDirectoryPathParts,
+        `${plan.phaseId}-${safeTimestamp(plan.createdAt)}-${plan.planDigest.slice(0, 12)}.json`
+    ], 'Governance transition plan path');
+}
+function evidencePathParts(evidenceId) {
+    return validateArtifactPathParts(['governance', 'evidence', `${evidenceId}.json`], 'Governance evidence path');
+}
+function activationStatePathParts() {
+    return validateArtifactPathParts(['governance', 'activation-state.json'], 'Activation state path');
+}
+function cloneState(state) {
+    return JSON.parse(JSON.stringify(state));
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function phaseOrder(phaseId) {
+    return phaseIds.indexOf(phaseId);
+}
+function transitionDestination(type, identity, extras = {}) {
+    return { type, identity, ...extras };
+}
+function operation(input) {
+    return input;
+}
+const allowedActionsByPhase = {
+    'seed-valid': [
+        'openspec.seed.validate',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ],
+    'seed-verified': [
+        'openspec.seed.baseline-verify',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ],
+    'seed-archived': [
+        'openspec.seed.archive',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ],
+    committed: [
+        'git.init',
+        'git.add-reviewed',
+        'git.commit-reviewed',
+        'git.verify-existing-commit',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ],
+    pushed: [
+        'git.push-approved-ref',
+        'git.verify-existing-push',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ],
+    'phase-0-complete': [
+        'github.phase0.discover',
+        'azure.phase0.discover',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ],
+    'activation-approved': [
+        'openspec.governance.create-change',
+        'spec-kit.governance.create-change',
+        'governance.activation-state.write'
+    ],
+    'credential-ready': [
+        'github.credential.verify-policy',
+        'github.credential.enroll-masked',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ],
+    'provider-ready': [
+        'azure.provider.ensure-ready',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ],
+    'state-path-selected': [
+        'azure.state-path.select',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ],
+    'existing-private-path': [
+        'azure.existing-private-path.verify',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ],
+    'bootstrap-local': [
+        'azure.bootstrap-local.apply',
+        'github.bootstrap-local.configure',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ],
+    'runner-ready': [
+        'github.runner.ensure-ready',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ],
+    'private-backend-proof': [
+        'github.runner.backend-proof',
+        'azure.remote-state.read',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ],
+    'remote-import-verified': [
+        'azure.remote-import.verify',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ],
+    'remote-ready': [
+        'azure.remote-ready.verify',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ],
+    'application-foundation': [
+        'azure.application-foundation.apply',
+        'openspec.governance.update',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ],
+    'workflow-source-ready': [
+        'local.workflow-source.write',
+        'local.ruleset-source.write',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ],
+    'dev-proof': [
+        'github.checks.dev-proof',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ],
+    'staging-qualified': [
+        'github.checks.staging',
+        'azure.staging.readback',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ],
+    'production-rehearsed': [
+        'github.checks.production-rehearsal',
+        'azure.production-readback',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ],
+    'green-red-proof': [
+        'github.checks.green-red-proof',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ],
+    'enforcement-approved': [
+        'governance.activation-state.write'
+    ],
+    'rulesets-applied': [
+        'github.ruleset.apply',
+        'github.ruleset.readback',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ],
+    'live-readback': [
+        'github.ruleset.readback',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ],
+    'bootstrap-state-disposed': [
+        'local.bootstrap-state.dispose',
+        'governance.evidence.write',
+        'governance.activation-state.write'
+    ]
+};
+function isAllowedAction(phaseId, actionId) {
+    return allowedActionsByPhase[phaseId].includes(actionId);
+}
+function assertOperationAllowed(phase, op) {
+    if (op.phaseId !== phase.id) {
+        throw new Error(`Operation ${op.actionId} belongs to ${op.phaseId}, not ${phase.id}.`);
+    }
+    if (!isAllowedAction(phase.id, op.actionId)) {
+        throw new Error(`Operation ${op.actionId} is not allowlisted for phase ${phase.id}.`);
+    }
+    const allowed = op.remote ? phase.allowedMutations.remote : phase.allowedMutations.local;
+    if (!allowed.includes(op.mutationClass)) {
+        throw new Error(`Operation ${op.actionId} mutation ${op.mutationClass} is not declared in phase ${phase.id} ${op.remote ? 'remote' : 'local'} mutations.`);
+    }
+}
+function assertPlanOperationsAllowed(plan, phase) {
+    for (const op of plan.operations) {
+        assertOperationAllowed(phase, op);
+    }
+}
+function evidenceWriteOperation(phase, pathParts) {
+    return operation({
+        adapter: 'local-evidence',
+        actionId: 'governance.evidence.write',
+        mutationClass: 'write-evidence',
+        phaseId: phase.id,
+        inputs: { pathParts },
+        destination: transitionDestination('local', pathParts.join('/'), { pathParts }),
+        remote: false,
+        destructive: false
+    });
+}
+function stateWriteOperation(phase) {
+    return operation({
+        adapter: 'local-evidence',
+        actionId: 'governance.activation-state.write',
+        mutationClass: 'write-activation-state',
+        phaseId: phase.id,
+        inputs: { pathParts: activationStatePathParts() },
+        destination: transitionDestination('local', 'governance/activation-state.json', {
+            pathParts: activationStatePathParts()
+        }),
+        remote: false,
+        destructive: false
+    });
+}
+async function allProjectFiles(projectRoot) {
+    const files = [];
+    async function visit(current, relative) {
+        const entries = await readdir(current, { withFileTypes: true });
+        for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name, 'en'))) {
+            if (entry.name === '.git' ||
+                entry.name === 'node_modules' ||
+                entry.name === '.cache' ||
+                (relative === '' && entry.name === 'governance')) {
+                continue;
+            }
+            const child = path.join(current, entry.name);
+            const childRelative = relative ? `${relative}/${entry.name}` : entry.name;
+            if (entry.isDirectory()) {
+                await visit(child, childRelative);
+            }
+            else if (entry.isFile()) {
+                files.push(childRelative);
+            }
+        }
+    }
+    await visit(projectRoot, '');
+    return files;
+}
+function parsePorcelainStatus(output) {
+    const entries = output.split('\0').filter(Boolean);
+    const parsed = [];
+    for (const entry of entries) {
+        const index = entry.slice(0, 1);
+        const worktree = entry.slice(1, 2);
+        const rawPath = entry.slice(3);
+        const renamed = rawPath.includes('\0') ? rawPath.split('\0').at(-1) : rawPath;
+        parsed.push({ index, worktree, path: renamed });
+    }
+    return parsed.filter((entry) => !entry.path.startsWith('governance/'));
+}
+async function runCommand(runner, command, cwd) {
+    return await runner.run(command, { cwd });
+}
+async function runGit(runner, projectRoot, args) {
+    return await runCommand(runner, { executable: 'git', args }, projectRoot);
+}
+async function inspectGitRepository(projectRoot, runner) {
+    const rootResult = await runGit(runner, projectRoot, ['rev-parse', '--show-toplevel']);
+    if (!commandSucceeded(rootResult)) {
+        return {
+            insideWorkTree: false,
+            root: null,
+            branch: null,
+            head: null,
+            upstream: null,
+            status: [],
+            remotes: [],
+            issues: []
+        };
+    }
+    const root = path.resolve(rootResult.stdout.trim());
+    if (root !== path.resolve(projectRoot)) {
+        return {
+            insideWorkTree: true,
+            root,
+            branch: null,
+            head: null,
+            upstream: null,
+            status: [],
+            remotes: [],
+            issues: [`Git repository root ${root} does not match Liftoff project root ${projectRoot}.`]
+        };
+    }
+    const branchResult = await runGit(runner, projectRoot, ['symbolic-ref', '--quiet', '--short', 'HEAD']);
+    const branch = commandSucceeded(branchResult) ? branchResult.stdout.trim() : null;
+    const headResult = await runGit(runner, projectRoot, ['rev-parse', '--verify', 'HEAD']);
+    const head = commandSucceeded(headResult) ? headResult.stdout.trim() : null;
+    const upstreamResult = await runGit(runner, projectRoot, ['rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{u}']);
+    const upstream = commandSucceeded(upstreamResult) ? upstreamResult.stdout.trim() : null;
+    const statusResult = await runGit(runner, projectRoot, ['status', '--porcelain=v1', '-z', '--untracked-files=all']);
+    const status = commandSucceeded(statusResult) ? parsePorcelainStatus(statusResult.stdout) : [];
+    const remoteResult = await runGit(runner, projectRoot, ['remote', '-v']);
+    const remotes = commandSucceeded(remoteResult) ? parseRemotes(remoteResult.stdout) : [];
+    const issues = [];
+    if (!branch) {
+        issues.push('Detached HEAD or unborn branch cannot be reviewed for deterministic governance commit/push.');
+    }
+    if (!commandSucceeded(statusResult)) {
+        issues.push(commandFailure(statusResult));
+    }
+    if (status.some((entry) => entry.index === 'D' || entry.worktree === 'D')) {
+        issues.push('Unknown file deletion is outside the reviewed initial commit plan.');
+    }
+    return { insideWorkTree: true, root, branch, head, upstream, status, remotes, issues };
+}
+function parseRemotes(output) {
+    const remotes = new Map();
+    for (const line of output.split(/\r?\n/u)) {
+        const match = line.match(/^(\S+)\s+(\S+)\s+\((fetch|push)\)$/u);
+        if (match?.[3] === 'fetch') {
+            remotes.set(match[1], match[2]);
+        }
+    }
+    return [...remotes.entries()]
+        .map(([name, url]) => ({ name, url }))
+        .sort((left, right) => left.name.localeCompare(right.name, 'en'));
+}
+function gitStatusDigest(inspection) {
+    return canonicalSha256({
+        branch: inspection.branch,
+        head: inspection.head,
+        status: inspection.status,
+        remotes: inspection.remotes
+    });
+}
+async function remoteHead(runner, projectRoot, remote, branch) {
+    const result = await runGit(runner, projectRoot, ['ls-remote', '--heads', remote, branch]);
+    if (!commandSucceeded(result)) {
+        throw new Error(commandFailure(result));
+    }
+    const first = result.stdout.trim().split(/\s+/u)[0];
+    return first && /^[a-f0-9]{40}$/u.test(first) ? first : null;
+}
+async function isAncestor(runner, projectRoot, ancestor, descendant) {
+    const result = await runGit(runner, projectRoot, ['merge-base', '--is-ancestor', ancestor, descendant]);
+    return result.status === 0;
+}
+function defaultBranch(state) {
+    return state.repository.defaultBranch || 'main';
+}
+async function gitCommitOperations(inspection, phase, runner) {
+    const git = await inspectGitRepository(inspection.projectRoot, runner);
+    if (git.issues.length > 0) {
+        throw new Error(git.issues.join(' '));
+    }
+    const branch = defaultBranch(inspection.state);
+    if (!git.insideWorkTree) {
+        const files = await allProjectFiles(inspection.projectRoot);
+        return [
+            operation({
+                adapter: 'git',
+                actionId: 'git.init',
+                mutationClass: 'git-commit',
+                phaseId: phase.id,
+                inputs: { branch },
+                destination: transitionDestination('local', '.git'),
+                remote: false,
+                destructive: false
+            }),
+            operation({
+                adapter: 'git',
+                actionId: 'git.add-reviewed',
+                mutationClass: 'git-commit',
+                phaseId: phase.id,
+                inputs: { paths: files, statusDigest: canonicalSha256(files) },
+                destination: transitionDestination('local', 'git-index'),
+                remote: false,
+                destructive: false
+            }),
+            operation({
+                adapter: 'git',
+                actionId: 'git.commit-reviewed',
+                mutationClass: 'git-commit',
+                phaseId: phase.id,
+                inputs: {
+                    message: 'Initial Liftoff baseline',
+                    branch,
+                    paths: files
+                },
+                destination: transitionDestination('local', branch, { ref: branch }),
+                remote: false,
+                destructive: false
+            })
+        ];
+    }
+    if (git.branch !== branch) {
+        throw new Error(`Expected branch ${branch}, found ${git.branch ?? 'detached'}.`);
+    }
+    if (git.upstream) {
+        const divergence = await runGit(runner, inspection.projectRoot, ['rev-list', '--left-right', '--count', `${git.upstream}...HEAD`]);
+        if (!commandSucceeded(divergence)) {
+            throw new Error(commandFailure(divergence));
+        }
+        const [behind, ahead] = divergence.stdout.trim().split(/\s+/u).map((value) => Number.parseInt(value, 10));
+        if ((behind ?? 0) > 0 || (ahead ?? 0) > 0) {
+            throw new Error(`Branch ${branch} diverges from ${git.upstream}; refusing commit before explicit reconciliation.`);
+        }
+    }
+    if (git.status.length === 0 && git.head) {
+        return [
+            operation({
+                adapter: 'git',
+                actionId: 'git.verify-existing-commit',
+                mutationClass: 'read-worktree',
+                phaseId: phase.id,
+                inputs: { head: git.head, branch, statusDigest: gitStatusDigest(git) },
+                destination: transitionDestination('local', branch, { ref: branch }),
+                remote: false,
+                destructive: false
+            })
+        ];
+    }
+    const paths = git.status.map((entry) => entry.path).sort((left, right) => left.localeCompare(right, 'en'));
+    return [
+        operation({
+            adapter: 'git',
+            actionId: 'git.add-reviewed',
+            mutationClass: 'git-commit',
+            phaseId: phase.id,
+            inputs: { paths, statusDigest: gitStatusDigest(git) },
+            destination: transitionDestination('local', 'git-index'),
+            remote: false,
+            destructive: false
+        }),
+        operation({
+            adapter: 'git',
+            actionId: 'git.commit-reviewed',
+            mutationClass: 'git-commit',
+            phaseId: phase.id,
+            inputs: {
+                message: 'Initial Liftoff baseline',
+                branch,
+                paths
+            },
+            destination: transitionDestination('local', branch, { ref: branch }),
+            remote: false,
+            destructive: false
+        })
+    ];
+}
+async function gitPushOperations(inspection, phase, runner) {
+    const git = await inspectGitRepository(inspection.projectRoot, runner);
+    if (git.issues.length > 0) {
+        throw new Error(git.issues.join(' '));
+    }
+    if (!git.insideWorkTree || !git.head) {
+        throw new Error('A reviewed local commit is required before push.');
+    }
+    const branch = defaultBranch(inspection.state);
+    if (git.branch !== branch) {
+        throw new Error(`Expected branch ${branch}, found ${git.branch ?? 'detached'}.`);
+    }
+    if (git.status.length > 0) {
+        throw new Error(`Worktree has unreviewed changes outside governance/plans: ${git.status.map((entry) => entry.path).join(', ')}.`);
+    }
+    const remoteNames = new Set(git.remotes.map((remote) => remote.name));
+    if (!remoteNames.has('origin') || git.remotes.length !== 1) {
+        throw new Error(`Expected exactly one approved origin remote; found ${git.remotes.map((remote) => remote.name).join(', ') || 'none'}.`);
+    }
+    const remoteSha = await remoteHead(runner, inspection.projectRoot, 'origin', branch);
+    if (remoteSha && remoteSha !== git.head && !(await isAncestor(runner, inspection.projectRoot, remoteSha, git.head))) {
+        throw new Error('Remote branch is not a fast-forward target; force, reset, rebase, and non-fast-forward push are forbidden.');
+    }
+    return [
+        operation({
+            adapter: 'git',
+            actionId: remoteSha === git.head ? 'git.verify-existing-push' : 'git.push-approved-ref',
+            mutationClass: remoteSha === git.head ? 'github-read' : 'git-push',
+            phaseId: phase.id,
+            inputs: {
+                remote: 'origin',
+                branch,
+                localHead: git.head,
+                remoteHead: remoteSha,
+                statusDigest: gitStatusDigest(git)
+            },
+            destination: transitionDestination('repository', inspection.state.repository.name, {
+                repository: inspection.state.repository.name,
+                ref: `refs/heads/${branch}`
+            }),
+            remote: true,
+            destructive: false
+        })
+    ];
+}
+async function phaseOperations(inspection, phase, runner, createdAt) {
+    const statePath = activationStatePathParts();
+    const baseEvidencePath = evidencePathParts(`${phase.id}-${safeTimestamp(createdAt)}`);
+    const writeOps = (includeEvidence = true) => [
+        ...(includeEvidence ? [evidenceWriteOperation(phase, baseEvidencePath)] : []),
+        stateWriteOperation(phase)
+    ];
+    switch (phase.id) {
+        case 'seed-valid':
+            return [
+                operation({
+                    adapter: 'selected-spec-workflow',
+                    actionId: 'openspec.seed.validate',
+                    mutationClass: 'read-worktree',
+                    phaseId: phase.id,
+                    inputs: { changeName: generatedSeedChangeName(inspection.manifest) },
+                    destination: transitionDestination('local', inspection.projectRoot),
+                    remote: false,
+                    destructive: false
+                }),
+                ...writeOps()
+            ];
+        case 'seed-verified':
+            return [
+                operation({
+                    adapter: 'selected-spec-workflow',
+                    actionId: 'openspec.seed.baseline-verify',
+                    mutationClass: 'read-worktree',
+                    phaseId: phase.id,
+                    inputs: { changeName: generatedSeedChangeName(inspection.manifest) },
+                    destination: transitionDestination('local', inspection.projectRoot),
+                    remote: false,
+                    destructive: false
+                }),
+                ...writeOps()
+            ];
+        case 'seed-archived':
+            return [
+                operation({
+                    adapter: 'selected-spec-workflow',
+                    actionId: 'openspec.seed.archive',
+                    mutationClass: 'write-openspec-seed',
+                    phaseId: phase.id,
+                    inputs: { changeName: generatedSeedChangeName(inspection.manifest) },
+                    destination: transitionDestination('local', 'openspec/changes'),
+                    remote: false,
+                    destructive: false
+                }),
+                ...writeOps()
+            ];
+        case 'committed':
+            return [...await gitCommitOperations(inspection, phase, runner), ...writeOps()];
+        case 'pushed':
+            return [...await gitPushOperations(inspection, phase, runner), ...writeOps()];
+        case 'phase-0-complete':
+            return [
+                operation({
+                    adapter: 'github',
+                    actionId: 'github.phase0.discover',
+                    mutationClass: 'github-read',
+                    phaseId: phase.id,
+                    inputs: { repository: inspection.state.repository.name },
+                    destination: transitionDestination('repository', inspection.state.repository.name, {
+                        repository: inspection.state.repository.name
+                    }),
+                    remote: true,
+                    destructive: false
+                }),
+                operation({
+                    adapter: 'azure-opentofu',
+                    actionId: 'azure.phase0.discover',
+                    mutationClass: 'azure-read',
+                    phaseId: phase.id,
+                    inputs: { cloud: 'cloud' in inspection.manifest.project.workload ? inspection.manifest.project.workload.cloud : 'power-platform' },
+                    destination: transitionDestination('subscription', 'phase-0-discovered-subscription', {
+                        subscriptionId: 'phase-0-discovered-subscription'
+                    }),
+                    remote: true,
+                    destructive: false
+                }),
+                ...writeOps()
+            ];
+        case 'activation-approved': {
+            const actionId = inspection.manifest.project.specWorkflow === 'openspec'
+                ? 'openspec.governance.create-change'
+                : 'spec-kit.governance.create-change';
+            return [
+                operation({
+                    adapter: 'selected-spec-workflow',
+                    actionId,
+                    mutationClass: 'write-openspec-governance',
+                    phaseId: phase.id,
+                    inputs: { workflowKind: inspection.manifest.project.specWorkflow },
+                    destination: transitionDestination('local', 'governance change'),
+                    remote: false,
+                    destructive: false
+                }),
+                stateWriteOperation(phase)
+            ];
+        }
+        case 'credential-ready':
+            return [
+                operation({
+                    adapter: 'github',
+                    actionId: 'github.credential.verify-policy',
+                    mutationClass: 'github-read',
+                    phaseId: phase.id,
+                    inputs: { policyPathParts: credentialPolicyPathParts },
+                    destination: transitionDestination('repository', inspection.state.repository.name, {
+                        repository: inspection.state.repository.name
+                    }),
+                    remote: true,
+                    destructive: false
+                }),
+                ...writeOps()
+            ];
+        case 'provider-ready':
+            return [
+                operation({
+                    adapter: 'azure-opentofu',
+                    actionId: 'azure.provider.ensure-ready',
+                    mutationClass: 'azure-provider-register',
+                    phaseId: phase.id,
+                    inputs: { retainedCapability: true },
+                    destination: transitionDestination('subscription', 'phase-0-discovered-subscription', {
+                        subscriptionId: 'phase-0-discovered-subscription'
+                    }),
+                    remote: true,
+                    destructive: false
+                }),
+                ...writeOps()
+            ];
+        case 'state-path-selected':
+            return [
+                operation({
+                    adapter: 'azure-opentofu',
+                    actionId: 'azure.state-path.select',
+                    mutationClass: 'azure-read',
+                    phaseId: phase.id,
+                    inputs: { allowed: ['existing-private', 'bootstrap-local'] },
+                    destination: transitionDestination('subscription', 'phase-0-discovered-subscription', {
+                        subscriptionId: 'phase-0-discovered-subscription'
+                    }),
+                    remote: true,
+                    destructive: false
+                }),
+                ...writeOps()
+            ];
+        case 'existing-private-path':
+            return [
+                operation({
+                    adapter: 'azure-opentofu',
+                    actionId: 'azure.existing-private-path.verify',
+                    mutationClass: 'azure-read',
+                    phaseId: phase.id,
+                    inputs: { statePath: 'existing-private' },
+                    destination: transitionDestination('subscription', 'phase-0-discovered-subscription', {
+                        subscriptionId: 'phase-0-discovered-subscription'
+                    }),
+                    remote: true,
+                    destructive: false
+                }),
+                ...writeOps()
+            ];
+        case 'bootstrap-local':
+            return [
+                operation({
+                    adapter: 'azure-opentofu',
+                    actionId: 'azure.bootstrap-local.apply',
+                    mutationClass: 'azure-network-provision',
+                    phaseId: phase.id,
+                    inputs: { boundedLocalBootstrap: true },
+                    destination: transitionDestination('subscription', 'phase-0-discovered-subscription', {
+                        subscriptionId: 'phase-0-discovered-subscription'
+                    }),
+                    remote: true,
+                    destructive: false
+                }),
+                operation({
+                    adapter: 'github',
+                    actionId: 'github.bootstrap-local.configure',
+                    mutationClass: 'github-write',
+                    phaseId: phase.id,
+                    inputs: { repository: inspection.state.repository.name },
+                    destination: transitionDestination('repository', inspection.state.repository.name, {
+                        repository: inspection.state.repository.name
+                    }),
+                    remote: true,
+                    destructive: false
+                }),
+                ...writeOps()
+            ];
+        case 'runner-ready':
+            return [
+                operation({
+                    adapter: 'github',
+                    actionId: 'github.runner.ensure-ready',
+                    mutationClass: 'github-write',
+                    phaseId: phase.id,
+                    inputs: { restrictedRunner: true },
+                    destination: transitionDestination('repository', inspection.state.repository.name, {
+                        repository: inspection.state.repository.name
+                    }),
+                    remote: true,
+                    destructive: false
+                }),
+                ...writeOps()
+            ];
+        case 'private-backend-proof':
+            return [
+                operation({
+                    adapter: 'github',
+                    actionId: 'github.runner.backend-proof',
+                    mutationClass: 'github-read',
+                    phaseId: phase.id,
+                    inputs: { requiredConclusion: 'success' },
+                    destination: transitionDestination('repository', inspection.state.repository.name, {
+                        repository: inspection.state.repository.name
+                    }),
+                    remote: true,
+                    destructive: false
+                }),
+                ...writeOps()
+            ];
+        case 'remote-import-verified':
+            return [
+                operation({
+                    adapter: 'azure-opentofu',
+                    actionId: 'azure.remote-import.verify',
+                    mutationClass: 'azure-state-import',
+                    phaseId: phase.id,
+                    inputs: { noChangePlanRequired: true },
+                    destination: transitionDestination('subscription', 'phase-0-discovered-subscription', {
+                        subscriptionId: 'phase-0-discovered-subscription'
+                    }),
+                    remote: true,
+                    destructive: false
+                }),
+                ...writeOps()
+            ];
+        case 'remote-ready':
+            return [
+                operation({
+                    adapter: 'azure-opentofu',
+                    actionId: 'azure.remote-ready.verify',
+                    mutationClass: 'azure-read',
+                    phaseId: phase.id,
+                    inputs: { retainBootstrapStateForDays: 30 },
+                    destination: transitionDestination('subscription', 'phase-0-discovered-subscription', {
+                        subscriptionId: 'phase-0-discovered-subscription'
+                    }),
+                    remote: true,
+                    destructive: false
+                }),
+                ...writeOps()
+            ];
+        case 'application-foundation':
+            return [
+                operation({
+                    adapter: 'azure-opentofu',
+                    actionId: 'azure.application-foundation.apply',
+                    mutationClass: 'azure-resource-provision',
+                    phaseId: phase.id,
+                    inputs: { noProviderUnregisterRollback: true },
+                    destination: transitionDestination('subscription', 'phase-0-discovered-subscription', {
+                        subscriptionId: 'phase-0-discovered-subscription'
+                    }),
+                    remote: true,
+                    destructive: false
+                }),
+                ...writeOps()
+            ];
+        case 'workflow-source-ready':
+            return [
+                operation({
+                    adapter: 'local-state',
+                    actionId: 'local.workflow-source.write',
+                    mutationClass: 'write-workflows',
+                    phaseId: phase.id,
+                    inputs: { path: '.github/workflows' },
+                    destination: transitionDestination('local', '.github/workflows', {
+                        pathParts: ['.github', 'workflows']
+                    }),
+                    remote: false,
+                    destructive: false
+                }),
+                operation({
+                    adapter: 'local-state',
+                    actionId: 'local.ruleset-source.write',
+                    mutationClass: 'write-ruleset-source',
+                    phaseId: phase.id,
+                    inputs: { path: '.github/rulesets' },
+                    destination: transitionDestination('local', '.github/rulesets', {
+                        pathParts: ['.github', 'rulesets']
+                    }),
+                    remote: false,
+                    destructive: false
+                }),
+                ...writeOps()
+            ];
+        case 'dev-proof':
+            return [
+                operation({
+                    adapter: 'github',
+                    actionId: 'github.checks.dev-proof',
+                    mutationClass: 'github-read',
+                    phaseId: phase.id,
+                    inputs: { acceptedConclusions: ['success'] },
+                    destination: transitionDestination('repository', inspection.state.repository.name, {
+                        repository: inspection.state.repository.name
+                    }),
+                    remote: true,
+                    destructive: false
+                }),
+                ...writeOps()
+            ];
+        case 'staging-qualified':
+            return [
+                operation({
+                    adapter: 'github',
+                    actionId: 'github.checks.staging',
+                    mutationClass: 'github-read',
+                    phaseId: phase.id,
+                    inputs: { acceptedConclusions: ['success'] },
+                    destination: transitionDestination('repository', inspection.state.repository.name, {
+                        repository: inspection.state.repository.name
+                    }),
+                    remote: true,
+                    destructive: false
+                }),
+                ...writeOps()
+            ];
+        case 'production-rehearsed':
+            return [
+                operation({
+                    adapter: 'github',
+                    actionId: 'github.checks.production-rehearsal',
+                    mutationClass: 'github-read',
+                    phaseId: phase.id,
+                    inputs: { acceptedConclusions: ['success'] },
+                    destination: transitionDestination('repository', inspection.state.repository.name, {
+                        repository: inspection.state.repository.name
+                    }),
+                    remote: true,
+                    destructive: false
+                }),
+                ...writeOps()
+            ];
+        case 'green-red-proof':
+            return [
+                operation({
+                    adapter: 'github',
+                    actionId: 'github.checks.green-red-proof',
+                    mutationClass: 'github-read',
+                    phaseId: phase.id,
+                    inputs: { required: ['green-success', 'deliberate-red-failure'] },
+                    destination: transitionDestination('repository', inspection.state.repository.name, {
+                        repository: inspection.state.repository.name
+                    }),
+                    remote: true,
+                    destructive: false
+                }),
+                ...writeOps()
+            ];
+        case 'enforcement-approved':
+            return [stateWriteOperation(phase)];
+        case 'rulesets-applied':
+            return [
+                operation({
+                    adapter: 'github',
+                    actionId: 'github.ruleset.apply',
+                    mutationClass: 'github-ruleset-write',
+                    phaseId: phase.id,
+                    inputs: { sourceDigest: rulesetSourceDigestFromEvidence(inspection) ?? 'missing' },
+                    destination: transitionDestination('repository', inspection.state.repository.name, {
+                        repository: inspection.state.repository.name
+                    }),
+                    remote: true,
+                    destructive: false
+                }),
+                operation({
+                    adapter: 'github',
+                    actionId: 'github.ruleset.readback',
+                    mutationClass: 'github-read',
+                    phaseId: phase.id,
+                    inputs: { sourceDigest: rulesetSourceDigestFromEvidence(inspection) ?? 'missing' },
+                    destination: transitionDestination('repository', inspection.state.repository.name, {
+                        repository: inspection.state.repository.name
+                    }),
+                    remote: true,
+                    destructive: false
+                }),
+                ...writeOps()
+            ];
+        case 'live-readback':
+            return [
+                operation({
+                    adapter: 'github',
+                    actionId: 'github.ruleset.readback',
+                    mutationClass: 'github-read',
+                    phaseId: phase.id,
+                    inputs: { sourceDigest: rulesetSourceDigestFromEvidence(inspection) ?? 'missing' },
+                    destination: transitionDestination('repository', inspection.state.repository.name, {
+                        repository: inspection.state.repository.name
+                    }),
+                    remote: true,
+                    destructive: false
+                }),
+                ...writeOps()
+            ];
+        case 'bootstrap-state-disposed': {
+            const paths = disposalPathInputs(inspection.state.bootstrapState);
+            return [
+                operation({
+                    adapter: 'local-state',
+                    actionId: 'local.bootstrap-state.dispose',
+                    mutationClass: 'delete-local-state',
+                    phaseId: phase.id,
+                    inputs: paths,
+                    destination: transitionDestination('local', 'bootstrap-state', {
+                        pathParts: statePath
+                    }),
+                    remote: false,
+                    destructive: true
+                }),
+                ...writeOps()
+            ];
+        }
+    }
+}
+function disposalPathInputs(retention) {
+    return {
+        encryptedStatePathParts: retention?.encryptedStatePathParts ?? [],
+        encryptionKeyPathParts: retention?.encryptionKeyPathParts ?? []
+    };
+}
+function rulesetSourceDigestFromEvidence(inspection) {
+    const record = latestRecordWithPayload(inspection, 'workflow-source-ready');
+    if (!record || !isRecord(record.payload)) {
+        return null;
+    }
+    if (record.payload.kind !== workflowSourcePayloadKind) {
+        return null;
+    }
+    const digest = record.payload.rulesetSourceDigest;
+    return typeof digest === 'string' && /^[a-f0-9]{64}$/u.test(digest) ? digest : null;
+}
+function latestRecordWithPayload(inspection, phaseId) {
+    const records = inspection.evidence.filter((record) => record.header.phaseId === phaseId);
+    const selection = selectLatestPhaseEvidence(records, inspection.contexts[phaseId]);
+    if (!selection.selected) {
+        return null;
+    }
+    return records.find((record) => record.evidenceId === selection.selected?.evidenceId) ?? null;
+}
+function rollbackPlanForPhase(phase, completed = []) {
+    return rollbackPlanFromCompletedOperations(phase.id, phase.rollback.kind, phase.rollback.target, completed);
+}
+export function rollbackPlanFromCompletedOperations(phaseId, strategy, target, completed) {
+    const retained = [];
+    const cleanupWarnings = [];
+    const operations = [];
+    for (const op of [...completed].reverse()) {
+        if (op.mutationClass === 'azure-provider-register') {
+            retained.push(`${op.phaseId}:${op.actionId}:provider-registration`);
+            continue;
+        }
+        if (op.actionId.toLowerCase().includes('unregister')) {
+            cleanupWarnings.push(`Refused to generate provider unregister rollback for ${op.actionId}.`);
+            continue;
+        }
+        if (op.mutationClass === 'github-ruleset-write') {
+            operations.push({
+                adapter: 'github',
+                actionId: 'github.ruleset.disable',
+                mutationClass: 'github-ruleset-write',
+                phaseId,
+                inputs: { fromOperation: op.actionId, cannotExpandScope: true },
+                destination: op.destination,
+                remote: true,
+                destructive: false
+            });
+            continue;
+        }
+        if (op.mutationClass === 'azure-network-provision' || op.mutationClass === 'azure-resource-provision') {
+            operations.push({
+                adapter: 'azure-opentofu',
+                actionId: 'azure.resource.cleanup',
+                mutationClass: op.mutationClass,
+                phaseId,
+                inputs: { fromOperation: op.actionId, noProviderUnregister: true },
+                destination: op.destination,
+                remote: true,
+                destructive: true
+            });
+            continue;
+        }
+        if (op.mutationClass === 'write-local-state' || op.mutationClass === 'delete-local-state') {
+            operations.push({
+                adapter: 'local-state',
+                actionId: 'local.state.rollback',
+                mutationClass: op.mutationClass,
+                phaseId,
+                inputs: { fromOperation: op.actionId },
+                destination: op.destination,
+                remote: false,
+                destructive: op.mutationClass === 'delete-local-state'
+            });
+        }
+    }
+    return {
+        phaseId,
+        strategy,
+        target,
+        operations,
+        retained,
+        cleanupWarnings
+    };
+}
+function planDigestFor(input) {
+    return canonicalSha256({
+        phaseId: input.phase.id,
+        transitionDigest: input.transitionDigest,
+        approvalPlanDigest: input.approvalPlanDigest,
+        operations: input.operations
+    });
+}
+function stateHash(inspection) {
+    return inspection.loadedState?.contentHash ?? null;
+}
+function assertNoSecrets(plan) {
+    const scan = detectCredentialLeaks([{
+            source: 'generated-artifact',
+            label: 'governance transition plan',
+            text: canonicalJson(plan)
+        }]);
+    if (scan.status === 'compromised') {
+        throw new Error(`Governance transition plan contains credential-shaped content: ${scan.leaks.map((leak) => leak.pattern).join(', ')}.`);
+    }
+}
+export async function buildSavedTransitionPlan(input) {
+    const phaseId = input.inspection.readiness.nextReadyPhase;
+    if (!phaseId) {
+        return null;
+    }
+    const runner = input.runner ?? new NodeCommandRunner();
+    const phase = phaseById(input.inspection.graph, phaseId);
+    const createdAt = (input.now ?? new Date()).toISOString();
+    const expiresAt = new Date(Date.parse(createdAt) + planLifetimeMs).toISOString();
+    const context = input.inspection.contexts[phaseId];
+    const approvalPlan = transitionPlanForPhase(phase, input.inspection.state, context.transition, input.inspection.projectRoot);
+    const evaluation = evaluateApprovalForTransitionPlan(approvalPlan, input.inspection.approvals, {
+        now: input.now
+    });
+    const operations = await phaseOperations(input.inspection, phase, runner, createdAt);
+    const digest = planDigestFor({
+        phase,
+        transitionDigest: context.transition.transitionDigest,
+        operations,
+        approvalPlanDigest: approvalPlan.planDigest
+    });
+    const plan = validateSavedTransitionPlan({
+        schemaVersion: 1,
+        phaseId,
+        createdAt,
+        expiresAt,
+        identity: input.inspection.state.identity,
+        graphHash: input.inspection.graphHash,
+        stateHash: stateHash(input.inspection),
+        baselineDigest: context.baselineSha,
+        inputDigest: context.inputDigest,
+        transitionDigest: context.transition.transitionDigest,
+        planDigest: digest,
+        mutationClasses: phase.allowedMutations,
+        operations,
+        approval: {
+            gateKind: phase.approvalGate.kind,
+            required: phase.approvalGate.required,
+            evaluation,
+            envelopeId: evaluation.envelopeId,
+            envelopeHash: evaluation.envelopeHash
+        },
+        rollbackPlan: rollbackPlanForPhase(phase),
+        noSecrets: true
+    });
+    assertPlanOperationsAllowed(plan, phase);
+    assertNoSecrets(plan);
+    return plan;
+}
+export async function previewApplyNext(input) {
+    let plan = null;
+    const blockers = [];
+    try {
+        plan = await buildSavedTransitionPlan(input);
+    }
+    catch (error) {
+        blockers.push(errorMessage(error));
+    }
+    const nextReadyPhase = input.inspection.readiness.nextReadyPhase;
+    if (!nextReadyPhase || blockers.length > 0 || !plan) {
+        return {
+            schemaVersion: 1,
+            command: 'governance apply-next',
+            projectRoot: input.inspection.projectRoot,
+            execute: input.execute,
+            applied: false,
+            authorized: false,
+            reason: 'blocked',
+            message: blockers[0] ?? 'No phase is ready for execution.',
+            nextReadyPhase,
+            approval: plan?.approval ?? null,
+            proposedMutations: {
+                local: plan?.mutationClasses.local ?? ['none'],
+                remote: plan?.mutationClasses.remote ?? ['none'],
+                operations: plan?.operations ?? []
+            },
+            savedPlan: null,
+            noWrites: true,
+            blockers: blockers.length > 0 ? blockers : ['No phase is ready for execution.']
+        };
+    }
+    if (plan.approval.evaluation.approvalRequired) {
+        return {
+            schemaVersion: 1,
+            command: 'governance apply-next',
+            projectRoot: input.inspection.projectRoot,
+            execute: input.execute,
+            applied: false,
+            authorized: false,
+            reason: 'approval-required',
+            message: plan.approval.evaluation.reasons.join('; '),
+            nextReadyPhase,
+            approval: plan.approval,
+            proposedMutations: {
+                local: plan.mutationClasses.local,
+                remote: plan.mutationClasses.remote,
+                operations: plan.operations
+            },
+            savedPlan: null,
+            noWrites: true,
+            blockers: plan.approval.evaluation.reasons
+        };
+    }
+    return {
+        schemaVersion: 1,
+        command: 'governance apply-next',
+        projectRoot: input.inspection.projectRoot,
+        execute: input.execute,
+        applied: false,
+        authorized: true,
+        reason: input.execute ? 'execute-requested' : 'execute-required',
+        message: input.execute
+            ? 'Execution requested; the plan must be saved and revalidated before any mutation.'
+            : 'Preview only. Rerun with --execute to save this plan and execute at most one phase.',
+        nextReadyPhase,
+        approval: plan.approval,
+        proposedMutations: {
+            local: plan.mutationClasses.local,
+            remote: plan.mutationClasses.remote,
+            operations: plan.operations
+        },
+        savedPlan: null,
+        noWrites: true,
+        blockers: []
+    };
+}
+async function saveTransitionPlan(projectRoot, plan) {
+    const validated = validateSavedTransitionPlan(plan);
+    assertNoSecrets(validated);
+    const pathParts = transitionPlanPathParts(validated);
+    const existing = await readProjectFile(projectRoot, pathParts);
+    if (existing !== undefined) {
+        throw new Error(`Refusing to overwrite existing governance transition plan ${pathParts.join('/')}.`);
+    }
+    const content = `${canonicalJson(validated)}\n`;
+    await applyProjectFileTransaction(projectRoot, [{
+            type: 'write',
+            pathParts,
+            content
+        }]);
+    return { pathParts, digest: canonicalSha256(validated) };
+}
+function comparePlanFreshness(saved, fresh) {
+    if (!fresh) {
+        return ['No phase remained ready after saving the transition plan.'];
+    }
+    const issues = [];
+    if (saved.phaseId !== fresh.phaseId) {
+        issues.push(`Ready phase changed from ${saved.phaseId} to ${fresh.phaseId}.`);
+    }
+    for (const field of ['stateHash', 'baselineDigest', 'inputDigest', 'transitionDigest']) {
+        if (saved[field] !== fresh[field]) {
+            issues.push(`${field} changed after plan save.`);
+        }
+    }
+    if (canonicalSha256(saved.operations) !== canonicalSha256(fresh.operations)) {
+        issues.push('Proposed operations changed after plan save.');
+    }
+    if (saved.approval.evaluation.approvalRequired || fresh.approval.evaluation.approvalRequired) {
+        issues.push('Approval was not valid immediately before execution.');
+    }
+    return issues;
+}
+function evidenceHeaderFor(input) {
+    const context = input.inspection.contexts[input.phase.id];
+    return validateEvidenceHeader({
+        schemaVersion: input.inspection.state.identity.evidenceHeaderSchemaVersion,
+        repositoryId: input.inspection.state.repository.id,
+        identity: input.inspection.state.identity,
+        phaseGraphHash: input.inspection.state.identity.phaseGraphHash,
+        phaseId: input.phase.id,
+        phaseContractDigest: phaseContractDigests(input.inspection.graph)[input.phase.id],
+        inputDigest: input.plan.inputDigest,
+        baselineSha: input.plan.baselineDigest,
+        transition: context.transition,
+        producedAt: input.now.toISOString(),
+        producer: engineProducer,
+        result: input.result
+    });
+}
+function appendUnique(values, value) {
+    if (value === null || values.includes(value)) {
+        return [...values];
+    }
+    return [...values, value];
+}
+function nextStateForOutcome(input) {
+    const base = cloneState(input.override ?? input.inspection.state);
+    if (input.inspection.sourceOfTruth.status === 'selected' &&
+        input.inspection.sourceOfTruth.recordActiveChangeOnNextMutation) {
+        const selected = stateWithSelectedActiveChange(base, input.inspection.sourceOfTruth.selected);
+        base.activeChange = selected.activeChange;
+    }
+    const phaseState = input.resultState === 'approved' ? 'approved' : input.resultState;
+    base.phases[input.phase.id] = {
+        state: phaseState,
+        updatedAt: input.now.toISOString(),
+        evidence: input.evidenceReference
+            ? [...base.phases[input.phase.id].evidence, input.evidenceReference]
+            : base.phases[input.phase.id].evidence,
+        approvals: appendUnique(base.phases[input.phase.id].approvals, input.plan.approval.envelopeId),
+        blockers: input.blocker ? [input.blocker] : []
+    };
+    base.updatedAt = input.now.toISOString();
+    return validateUserActivationState(base);
+}
+function blockedState(input) {
+    const base = cloneState(input.inspection.state);
+    base.phases[input.phase.id] = {
+        state: 'blocked',
+        updatedAt: input.now.toISOString(),
+        evidence: base.phases[input.phase.id].evidence,
+        approvals: appendUnique(base.phases[input.phase.id].approvals, input.plan.approval.envelopeId),
+        blockers: [input.blocker]
+    };
+    base.updatedAt = input.now.toISOString();
+    return validateUserActivationState(base);
+}
+async function assertLoadedStateHash(projectRoot, expectedHash) {
+    const bytes = await readProjectFile(projectRoot, activationStatePathParts());
+    const currentHash = bytes === undefined ? null : activationStateContentHash(bytes);
+    if (currentHash !== expectedHash) {
+        throw new Error(`Activation state changed after inspection: expected ${expectedHash ?? 'absent'}, found ${currentHash ?? 'absent'}.`);
+    }
+}
+async function writeOutcomeTransaction(input) {
+    await assertLoadedStateHash(input.projectRoot, input.plan.stateHash);
+    const stateContent = `${canonicalJson(validateUserActivationState(input.nextState))}\n`;
+    const mutations = [
+        ...(input.fileMutations ?? []).map((mutation) => ({
+            ...mutation,
+            pathParts: validateArtifactPathParts([...mutation.pathParts], 'Governance transition file mutation path')
+        })),
+        ...(input.evidenceRecord && input.evidencePathParts
+            ? [{
+                    type: 'write',
+                    pathParts: [...input.evidencePathParts],
+                    content: `${canonicalJson(input.evidenceRecord)}\n`
+                }]
+            : []),
+        {
+            type: 'write',
+            pathParts: activationStatePathParts(),
+            content: stateContent
+        }
+    ];
+    if (input.evidencePathParts) {
+        const existing = await readProjectFile(input.projectRoot, [...input.evidencePathParts]);
+        if (existing !== undefined) {
+            throw new Error(`Refusing to overwrite existing governance evidence ${input.evidencePathParts.join('/')}.`);
+        }
+    }
+    await applyProjectFileTransaction(input.projectRoot, mutations);
+    return {
+        stateHash: activationStateContentHash(stateContent),
+        evidence: input.evidenceRecord && input.evidencePathParts
+            ? {
+                evidenceId: input.evidenceRecord.evidenceId,
+                pathParts: input.evidencePathParts,
+                headerDigest: evidenceHeaderDigest(input.evidenceRecord.header),
+                result: input.evidenceRecord.header.result
+            }
+            : null
+    };
+}
+async function executeGitOperations(input, operations) {
+    if (input.phase.id !== 'committed' && input.phase.id !== 'pushed') {
+        return null;
+    }
+    const completed = [];
+    for (const op of operations.filter((entry) => entry.adapter === 'git')) {
+        if (op.actionId === 'git.verify-existing-commit' || op.actionId === 'git.verify-existing-push') {
+            completed.push(op);
+            continue;
+        }
+        if (op.actionId === 'git.init') {
+            const result = await runGit(input.runner, input.inspection.projectRoot, ['init', '-b', String(op.inputs.branch)]);
+            if (!commandSucceeded(result)) {
+                return { status: 'blocked', blocker: commandFailure(result), completedOperations: completed };
+            }
+            completed.push(op);
+        }
+        else if (op.actionId === 'git.add-reviewed') {
+            const paths = Array.isArray(op.inputs.paths) ? op.inputs.paths.map(String) : [];
+            if (paths.length === 0) {
+                completed.push(op);
+                continue;
+            }
+            const result = await runGit(input.runner, input.inspection.projectRoot, ['add', '--', ...paths]);
+            if (!commandSucceeded(result)) {
+                return { status: 'blocked', blocker: commandFailure(result), completedOperations: completed };
+            }
+            completed.push(op);
+        }
+        else if (op.actionId === 'git.commit-reviewed') {
+            const message = String(op.inputs.message);
+            const result = await runGit(input.runner, input.inspection.projectRoot, ['commit', '-m', message]);
+            if (!commandSucceeded(result)) {
+                return { status: 'blocked', blocker: commandFailure(result), completedOperations: completed };
+            }
+            completed.push(op);
+        }
+        else if (op.actionId === 'git.push-approved-ref') {
+            const branch = String(op.inputs.branch);
+            const result = await runGit(input.runner, input.inspection.projectRoot, ['push', 'origin', `HEAD:refs/heads/${branch}`]);
+            if (!commandSucceeded(result)) {
+                return { status: 'blocked', blocker: commandFailure(result), completedOperations: completed };
+            }
+            completed.push(op);
+        }
+    }
+    return {
+        status: 'completed',
+        resultState: 'verified',
+        completedOperations: completed
+    };
+}
+async function executeSeedOperations(input) {
+    if (!input.phase.id.startsWith('seed-')) {
+        return null;
+    }
+    if (input.phase.id === 'seed-valid') {
+        const result = await validateGeneratedSeedForPhase(input.inspection.projectRoot, input.runner);
+        if (result.status === 'blocked') {
+            return { status: 'blocked', blocker: result.issues[0] ?? 'Seed validation failed.', completedOperations: [] };
+        }
+        return { status: 'completed', resultState: 'verified', completedOperations: input.plan.operations.filter((op) => op.actionId === 'openspec.seed.validate') };
+    }
+    if (input.phase.id === 'seed-verified') {
+        const result = await verifyGeneratedSeedBaselineForPhase(input.inspection.projectRoot, input.runner);
+        if (result.status === 'blocked') {
+            return { status: 'blocked', blocker: result.issues[0] ?? 'Seed baseline verification failed.', completedOperations: [] };
+        }
+        return {
+            status: 'completed',
+            resultState: 'verified',
+            evidencePayload: {
+                kind: 'seed-verified.v1',
+                checks: result.checks.map((check) => ({
+                    id: check.id,
+                    taskId: check.taskId,
+                    status: check.status
+                }))
+            },
+            completedOperations: input.plan.operations.filter((op) => op.actionId === 'openspec.seed.baseline-verify')
+        };
+    }
+    const result = await archiveGeneratedSeedForPhase(input.inspection.projectRoot, input.runner);
+    if (result.status === 'blocked') {
+        return { status: 'blocked', blocker: result.issues[0] ?? 'Seed archive failed.', completedOperations: [] };
+    }
+    return {
+        status: 'completed',
+        resultState: 'verified',
+        evidencePayload: {
+            kind: 'seed-archived.v1',
+            archiveSyncBehavior: result.archiveSyncBehavior ?? null
+        },
+        completedOperations: input.plan.operations.filter((op) => op.actionId === 'openspec.seed.archive')
+    };
+}
+async function discoverPhase0(input) {
+    if (input.phase.id !== 'phase-0-complete') {
+        return null;
+    }
+    const gh = await runCommand(input.runner, {
+        executable: 'gh',
+        args: ['repo', 'view', '--json', 'id,nameWithOwner,defaultBranchRef,isPrivate']
+    }, input.inspection.projectRoot);
+    if (!commandSucceeded(gh)) {
+        return {
+            status: 'blocked',
+            blocker: `Phase 0 GitHub read-only discovery failed: ${commandFailure(gh)}`,
+            completedOperations: []
+        };
+    }
+    let repo;
+    try {
+        repo = JSON.parse(gh.stdout);
+    }
+    catch (error) {
+        return {
+            status: 'blocked',
+            blocker: `Phase 0 GitHub discovery returned invalid JSON: ${errorMessage(error)}`,
+            completedOperations: []
+        };
+    }
+    if (!repo.id || !repo.nameWithOwner || !repo.defaultBranchRef?.name) {
+        return {
+            status: 'blocked',
+            blocker: 'Phase 0 GitHub discovery did not return repository id, nameWithOwner, and default branch.',
+            completedOperations: []
+        };
+    }
+    const az = await runCommand(input.runner, {
+        executable: 'az',
+        args: ['account', 'show', '--output', 'json']
+    }, input.inspection.projectRoot);
+    const azureAccount = commandSucceeded(az) ? safeJson(az.stdout) : null;
+    const git = await inspectGitRepository(input.inspection.projectRoot, input.runner);
+    const baselineDigest = canonicalSha256({
+        gitHead: git.head,
+        repositoryId: repo.id,
+        repositoryName: repo.nameWithOwner,
+        defaultBranch: repo.defaultBranchRef.name
+    });
+    const facts = {
+        repositoryId: repo.id,
+        repositoryName: repo.nameWithOwner,
+        defaultBranch: repo.defaultBranchRef.name,
+        baselineDigest,
+        privateStagingDast: false,
+        credentialRequired: false,
+        statePath: 'none',
+        approvedFacts: [
+            { id: 'repository.id', value: repo.id },
+            { id: 'repository.nameWithOwner', value: repo.nameWithOwner },
+            { id: 'repository.defaultBranch', value: repo.defaultBranchRef.name },
+            { id: 'repository.isPrivate', value: repo.isPrivate ?? null },
+            { id: 'azure.accountReadable', value: azureAccount !== null }
+        ]
+    };
+    const nextState = cloneState(input.inspection.state);
+    nextState.repository = {
+        id: facts.repositoryId,
+        name: facts.repositoryName,
+        defaultBranch: facts.defaultBranch
+    };
+    nextState.applicability = {
+        statePath: facts.statePath,
+        privateStagingDast: facts.privateStagingDast,
+        credentialRequired: facts.credentialRequired
+    };
+    return {
+        status: 'completed',
+        resultState: 'verified',
+        evidencePayload: {
+            kind: 'phase-0-discovery.v1',
+            facts: facts.approvedFacts,
+            activationCreateChangePlan: {
+                deterministic: true,
+                graphHash: input.inspection.graphHash
+            }
+        },
+        stateOverride: nextState,
+        completedOperations: input.plan.operations.filter((op) => op.actionId === 'github.phase0.discover' || op.actionId === 'azure.phase0.discover')
+    };
+}
+function safeJson(value) {
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return null;
+    }
+}
+async function executeActivationApproval(input) {
+    if (input.phase.id !== 'activation-approved') {
+        return null;
+    }
+    const state = cloneState(input.inspection.state);
+    const fileMutations = [];
+    if (input.inspection.sourceOfTruth.status === 'none') {
+        const facts = buildApprovedPhase0FactsFromState(input.inspection.manifest, input.inspection.state, input.inspection.evidence);
+        if (!facts || input.inspection.sourceOfTruth.createPlan.status !== 'ready') {
+            return {
+                status: 'blocked',
+                blocker: input.inspection.sourceOfTruth.createPlan.reason,
+                completedOperations: []
+            };
+        }
+        const writePlan = renderGovernanceChangeWritePlan(facts);
+        for (const file of writePlan.files) {
+            const existing = await readProjectFile(input.inspection.projectRoot, [...file.pathParts]);
+            if (existing !== undefined) {
+                return {
+                    status: 'blocked',
+                    blocker: `Refusing to overwrite existing governance artifact ${file.pathParts.join('/')}.`,
+                    completedOperations: []
+                };
+            }
+            fileMutations.push({
+                type: 'write',
+                pathParts: [...file.pathParts],
+                content: file.content
+            });
+        }
+        state.activeChange = {
+            id: writePlan.changeId,
+            kind: writePlan.workflowKind === 'openspec' ? 'openspec' : 'spec-kit'
+        };
+    }
+    else if (input.inspection.sourceOfTruth.status === 'selected') {
+        state.activeChange = {
+            id: input.inspection.sourceOfTruth.selected.changeId,
+            kind: input.inspection.sourceOfTruth.selected.workflowKind === 'openspec' ? 'openspec' : 'spec-kit'
+        };
+    }
+    else {
+        return {
+            status: 'blocked',
+            blocker: 'A compatible governance source of truth is required before activation approval can be recorded.',
+            completedOperations: []
+        };
+    }
+    return {
+        status: 'completed',
+        resultState: 'approved',
+        stateOverride: state,
+        fileMutations,
+        completedOperations: input.plan.operations.filter((op) => op.actionId.endsWith('governance.create-change'))
+    };
+}
+async function executeCredentialReady(input) {
+    if (input.phase.id !== 'credential-ready') {
+        return null;
+    }
+    const policy = await readProjectFile(input.inspection.projectRoot, [...credentialPolicyPathParts]);
+    if (policy === undefined) {
+        return {
+            status: 'blocked',
+            blocker: 'Credential enrollment requires a secure masked input channel or an existing selected-repository App; automated noninteractive apply cannot collect a PAT.',
+            completedOperations: []
+        };
+    }
+    const scan = detectCredentialLeaks([{
+            source: 'imported-evidence',
+            label: credentialPolicyPathParts.join('/'),
+            text: policy.toString('utf8')
+        }]);
+    if (scan.status === 'compromised') {
+        return {
+            status: 'blocked',
+            blocker: scan.guidance.join(' '),
+            completedOperations: []
+        };
+    }
+    return {
+        status: 'completed',
+        resultState: 'verified',
+        evidencePayload: {
+            kind: 'credential-ready.v1',
+            policyPathParts: credentialPolicyPathParts,
+            payloadFree: true,
+            policyDigest: canonicalSha256(policy.toString('utf8'))
+        },
+        completedOperations: input.plan.operations.filter((op) => op.actionId === 'github.credential.verify-policy')
+    };
+}
+function remoteImportRetention(input) {
+    if (input.phase.id !== 'remote-ready') {
+        return null;
+    }
+    if (input.inspection.state.applicability.statePath !== 'bootstrap-local') {
+        return {
+            status: 'completed',
+            resultState: 'verified',
+            evidencePayload: { kind: 'remote-ready.v1', retention: 'not-applicable' },
+            completedOperations: input.plan.operations.filter((op) => op.actionId === 'azure.remote-ready.verify')
+        };
+    }
+    const importRecord = latestRecordWithPayload(input.inspection, 'remote-import-verified');
+    if (!importRecord || !isRecord(importRecord.payload) || importRecord.payload.kind !== remoteImportPayloadKind) {
+        return {
+            status: 'blocked',
+            blocker: 'Remote import retention requires immutable remote-import evidence with state and key identifiers.',
+            completedOperations: []
+        };
+    }
+    const encryptedStatePathParts = pathPartLists(importRecord.payload.encryptedStatePathParts, 'encryptedStatePathParts');
+    const encryptionKeyPathParts = pathPartLists(importRecord.payload.encryptionKeyPathParts, 'encryptionKeyPathParts');
+    const retainedAt = input.now.toISOString();
+    const disposeAfter = new Date(input.now.getTime() + 30 * dayMs).toISOString();
+    const state = cloneState(input.inspection.state);
+    state.bootstrapState = {
+        status: 'retained',
+        remoteImportEvidenceId: importRecord.evidenceId,
+        remoteImportEvidenceDigest: evidenceHeaderDigest(importRecord.header),
+        retainedAt,
+        disposeAfter,
+        encryptedStatePathParts,
+        encryptionKeyPathParts
+    };
+    return {
+        status: 'completed',
+        resultState: 'retained',
+        stateOverride: state,
+        evidencePayload: {
+            kind: 'remote-ready.v1',
+            retention: state.bootstrapState
+        },
+        completedOperations: input.plan.operations.filter((op) => op.actionId === 'azure.remote-ready.verify')
+    };
+}
+function pathPartLists(value, label) {
+    if (!Array.isArray(value)) {
+        throw new Error(`${label} must be an array of path-part arrays.`);
+    }
+    return value.map((entry, index) => validateArtifactPathParts(entry, `${label}[${index}]`));
+}
+async function executeBootstrapStateDisposal(input) {
+    if (input.phase.id !== 'bootstrap-state-disposed') {
+        return null;
+    }
+    const retention = input.inspection.state.bootstrapState;
+    if (!retention || input.inspection.state.applicability.statePath !== 'bootstrap-local') {
+        return {
+            status: 'completed',
+            resultState: 'inapplicable',
+            evidencePayload: { kind: bootstrapStateDisposedPayloadKind, reason: 'no retained bootstrap state' },
+            completedOperations: []
+        };
+    }
+    if (retention.status === 'disposed') {
+        return {
+            status: 'completed',
+            resultState: 'disposed',
+            evidencePayload: { kind: bootstrapStateDisposedPayloadKind, reason: 'already disposed', deletionEvidenceId: retention.deletionEvidenceId ?? null },
+            completedOperations: []
+        };
+    }
+    if (Date.parse(retention.disposeAfter) > input.now.getTime()) {
+        return {
+            status: 'blocked',
+            blocker: `Retained bootstrap state is not disposable until ${retention.disposeAfter}.`,
+            completedOperations: []
+        };
+    }
+    const importRecord = input.inspection.evidence.find((record) => record.evidenceId === retention.remoteImportEvidenceId);
+    if (!importRecord || evidenceHeaderDigest(importRecord.header) !== retention.remoteImportEvidenceDigest) {
+        return {
+            status: 'blocked',
+            blocker: 'Destructive disposal requires the immutable remote-import evidence referenced by retained bootstrap state.',
+            completedOperations: []
+        };
+    }
+    if (!isRecord(importRecord.payload) || importRecord.payload.kind !== remoteImportPayloadKind) {
+        return {
+            status: 'blocked',
+            blocker: 'Destructive disposal requires verified remote backend and no-change evidence.',
+            completedOperations: []
+        };
+    }
+    const remoteBackendDigest = importRecord.payload.remoteBackendDigest;
+    const noChangePlanDigest = importRecord.payload.noChangePlanDigest;
+    if (typeof remoteBackendDigest !== 'string' ||
+        !/^[a-f0-9]{64}$/u.test(remoteBackendDigest) ||
+        typeof noChangePlanDigest !== 'string' ||
+        !/^[a-f0-9]{64}$/u.test(noChangePlanDigest)) {
+        return {
+            status: 'blocked',
+            blocker: 'Destructive disposal requires payload-free remote backend and no-change plan digests.',
+            completedOperations: []
+        };
+    }
+    const allPaths = [...retention.encryptedStatePathParts, ...retention.encryptionKeyPathParts]
+        .map((parts) => validateArtifactPathParts([...parts], 'Bootstrap disposal path'));
+    const incompleteCleanup = [];
+    for (const parts of allPaths) {
+        try {
+            const target = await resolveProjectPath(input.inspection.projectRoot, parts);
+            const details = await stat(target);
+            if (!details.isFile()) {
+                incompleteCleanup.push(`${parts.join('/')} is not a regular file.`);
+            }
+        }
+        catch (error) {
+            incompleteCleanup.push(`${parts.join('/')} was already absent before disposal: ${errorMessage(error)}`);
+        }
+    }
+    const state = cloneState(input.inspection.state);
+    state.bootstrapState = {
+        ...retention,
+        status: 'disposed',
+        disposedAt: input.now.toISOString(),
+        deletionEvidenceId: `${input.phase.id}-${safeTimestamp(input.now.toISOString())}`,
+        incompleteCleanup
+    };
+    return {
+        status: 'completed',
+        resultState: 'disposed',
+        stateOverride: state,
+        evidencePayload: {
+            kind: bootstrapStateDisposedPayloadKind,
+            deletedPathParts: allPaths,
+            remoteBackendDigest,
+            noChangePlanDigest,
+            incompleteCleanup,
+            payloadFree: true
+        },
+        fileMutations: allPaths.map((parts) => ({ type: 'delete', pathParts: parts })),
+        completedOperations: input.plan.operations.filter((op) => op.actionId === 'local.bootstrap-state.dispose'),
+        cleanupWarnings: incompleteCleanup
+    };
+}
+function assertGreenRedProof(input) {
+    const record = latestRecordWithPayload(input.inspection, 'green-red-proof');
+    if (!record || !isRecord(record.payload) || record.payload.kind !== greenRedPayloadKind) {
+        throw new Error('Ruleset enforcement requires current green-red-proof evidence with typed proof payload.');
+    }
+    const green = isRecord(record.payload.green) ? record.payload.green : null;
+    const red = isRecord(record.payload.deliberateRed) ? record.payload.deliberateRed : null;
+    const greenConclusion = green?.conclusion;
+    const redConclusion = red?.conclusion;
+    const badConclusions = [greenConclusion, redConclusion].filter((value) => value === 'skipped' || value === 'cancelled' || value === 'neutral');
+    if (badConclusions.length > 0) {
+        throw new Error('Skipped, cancelled, and neutral checks cannot satisfy green/red proof.');
+    }
+    if (!red || greenConclusion !== 'success' || redConclusion !== 'failure' || red.deliberate !== true) {
+        throw new Error('Ruleset enforcement requires green success and deliberate red failure proof.');
+    }
+    return record;
+}
+async function executeRulesetPhase(input) {
+    if (input.phase.id !== 'rulesets-applied' && input.phase.id !== 'live-readback') {
+        return null;
+    }
+    try {
+        assertGreenRedProof(input);
+    }
+    catch (error) {
+        return { status: 'blocked', blocker: errorMessage(error), completedOperations: [] };
+    }
+    const sourceDigest = rulesetSourceDigestFromEvidence(input.inspection);
+    if (!sourceDigest) {
+        return {
+            status: 'blocked',
+            blocker: 'Ruleset enforcement requires a saved ruleset source digest from workflow-source-ready evidence.',
+            completedOperations: []
+        };
+    }
+    const adapter = input.adapters.githubRulesets;
+    if (!adapter) {
+        return {
+            status: 'blocked',
+            blocker: 'No injected GitHub ruleset adapter is configured; refusing live ruleset calls in this execution context.',
+            completedOperations: []
+        };
+    }
+    const envelopeId = input.plan.approval.envelopeId;
+    if (input.phase.id === 'rulesets-applied' && !envelopeId) {
+        return {
+            status: 'blocked',
+            blocker: 'Ruleset enforcement requires a persisted enforcement approval envelope.',
+            completedOperations: []
+        };
+    }
+    const completed = [];
+    const write = input.phase.id === 'rulesets-applied'
+        ? await adapter.applyRuleset({
+            repository: input.inspection.state.repository.name,
+            sourceDigest,
+            approvalEnvelopeId: envelopeId ?? 'ungated-readback'
+        })
+        : await adapter.readRuleset({
+            repository: input.inspection.state.repository.name,
+            sourceDigest
+        });
+    completed.push(...input.plan.operations.filter((op) => input.phase.id === 'rulesets-applied'
+        ? op.actionId === 'github.ruleset.apply' || op.actionId === 'github.ruleset.readback'
+        : op.actionId === 'github.ruleset.readback'));
+    if (write.sourceDigest !== sourceDigest || write.readbackDigest !== sourceDigest) {
+        return {
+            status: 'blocked',
+            blocker: 'Post-write live ruleset readback did not match the saved source digest.',
+            completedOperations: completed
+        };
+    }
+    const header = evidenceHeaderFor({
+        inspection: input.inspection,
+        phase: input.phase,
+        plan: input.plan,
+        result: 'verified',
+        now: input.now
+    });
+    const liveReadback = {
+        schemaVersion: input.inspection.state.identity.evidenceHeaderSchemaVersion,
+        repositoryId: header.repositoryId,
+        identity: header.identity,
+        phaseGraphHash: header.phaseGraphHash,
+        phaseId: header.phaseId,
+        baselineSha: header.baselineSha,
+        inputDigest: header.inputDigest,
+        transition: header.transition,
+        observedAt: input.now.toISOString(),
+        provider: 'github',
+        resourceType: 'ruleset',
+        resourceId: write.resourceId,
+        sourceDigest,
+        readbackDigest: write.readbackDigest,
+        matches: true
+    };
+    return {
+        status: 'completed',
+        resultState: 'verified',
+        liveReadback: [liveReadback],
+        evidencePayload: {
+            kind: `${input.phase.id}.v1`,
+            sourceDigest,
+            resourceId: write.resourceId,
+            readbackDigest: write.readbackDigest
+        },
+        completedOperations: completed
+    };
+}
+async function executeBuiltInPhase(input) {
+    const custom = input.adapters.phases?.[input.phase.id];
+    if (custom) {
+        return await custom.execute(input);
+    }
+    for (const attempt of [
+        executeSeedOperations,
+        async (execution) => executeGitOperations(execution, execution.plan.operations),
+        discoverPhase0,
+        executeActivationApproval,
+        executeCredentialReady,
+        async (execution) => remoteImportRetention(execution),
+        executeBootstrapStateDisposal,
+        executeRulesetPhase
+    ]) {
+        const outcome = await attempt(input);
+        if (outcome) {
+            return outcome;
+        }
+    }
+    return {
+        status: 'blocked',
+        blocker: `No production adapter is configured for ${input.phase.id}; refusing success-shaped fallback.`,
+        completedOperations: []
+    };
+}
+function sourceOfTruthAllowsPhase(inspection, phaseId) {
+    if (phaseOrder(phaseId) <= phaseOrder('phase-0-complete')) {
+        return null;
+    }
+    const source = inspection.sourceOfTruth;
+    if (phaseId === 'activation-approved' && (source.status === 'none' || source.status === 'selected')) {
+        return null;
+    }
+    if (source.status === 'selected' && source.reconciliation.status === 'not-required') {
+        return null;
+    }
+    if (source.status === 'seed-blocked') {
+        return source.blockers.join('; ');
+    }
+    if (source.status === 'ambiguous' || source.status === 'incompatible') {
+        return source.blockers.join('; ');
+    }
+    if (source.status === 'none') {
+        return source.createPlan.reason;
+    }
+    return 'Active governance source of truth is not ready.';
+}
+export async function executeApplyNext(input) {
+    const runner = input.runner ?? new NodeCommandRunner();
+    const adapters = input.adapters ?? {};
+    const now = input.now ?? new Date();
+    const initialPlan = await buildSavedTransitionPlan({ inspection: input.inspection, runner, now });
+    if (!initialPlan) {
+        const preview = await previewApplyNext({ inspection: input.inspection, runner, now, execute: true });
+        return {
+            ...preview,
+            applied: false,
+            noWrites: false,
+            executedOperations: [],
+            evidence: null,
+            stateHash: null,
+            rollbackPlan: rollbackPlanFromCompletedOperations(input.inspection.readiness.nextReadyPhase ?? 'seed-valid', 'none', null, []),
+            cleanupWarnings: []
+        };
+    }
+    const phase = phaseById(input.inspection.graph, initialPlan.phaseId);
+    assertPlanOperationsAllowed(initialPlan, phase);
+    if (initialPlan.approval.evaluation.approvalRequired) {
+        const preview = await previewApplyNext({ inspection: input.inspection, runner, now, execute: true });
+        return {
+            ...preview,
+            applied: false,
+            noWrites: false,
+            executedOperations: [],
+            evidence: null,
+            stateHash: null,
+            rollbackPlan: initialPlan.rollbackPlan,
+            cleanupWarnings: []
+        };
+    }
+    const saved = await saveTransitionPlan(input.inspection.projectRoot, initialPlan);
+    const freshInspection = await input.reinspect();
+    const freshPlan = await buildSavedTransitionPlan({ inspection: freshInspection, runner, now });
+    const freshnessIssues = comparePlanFreshness(initialPlan, freshPlan);
+    if (freshnessIssues.length > 0) {
+        return {
+            schemaVersion: 1,
+            command: 'governance apply-next',
+            projectRoot: input.inspection.projectRoot,
+            execute: true,
+            applied: false,
+            authorized: false,
+            reason: 'stale-after-plan-save',
+            message: freshnessIssues.join(' '),
+            nextReadyPhase: freshInspection.readiness.nextReadyPhase,
+            approval: initialPlan.approval,
+            proposedMutations: {
+                local: initialPlan.mutationClasses.local,
+                remote: initialPlan.mutationClasses.remote,
+                operations: initialPlan.operations
+            },
+            savedPlan: saved,
+            noWrites: false,
+            blockers: freshnessIssues,
+            executedOperations: [],
+            evidence: null,
+            stateHash: null,
+            rollbackPlan: initialPlan.rollbackPlan,
+            cleanupWarnings: []
+        };
+    }
+    const sourceBlocker = sourceOfTruthAllowsPhase(freshInspection, initialPlan.phaseId);
+    if (sourceBlocker) {
+        const nextState = blockedState({ inspection: freshInspection, phase, plan: initialPlan, blocker: sourceBlocker, now });
+        const write = await writeOutcomeTransaction({
+            projectRoot: freshInspection.projectRoot,
+            plan: initialPlan,
+            nextState
+        });
+        return executionBlockedResult(freshInspection, initialPlan, saved, sourceBlocker, [], write.stateHash);
+    }
+    const outcome = await executeBuiltInPhase({
+        inspection: freshInspection,
+        plan: initialPlan,
+        phase,
+        runner,
+        adapters,
+        now
+    });
+    const completedOperations = outcome.completedOperations ?? [];
+    if (outcome.status === 'blocked') {
+        const blocker = outcome.blocker ?? `Phase ${phase.id} blocked.`;
+        const nextState = blockedState({ inspection: freshInspection, phase, plan: initialPlan, blocker, now });
+        const write = await writeOutcomeTransaction({
+            projectRoot: freshInspection.projectRoot,
+            plan: initialPlan,
+            nextState
+        });
+        return executionBlockedResult(freshInspection, initialPlan, saved, blocker, completedOperations, write.stateHash, outcome.cleanupWarnings ?? []);
+    }
+    const resultState = outcome.resultState ?? 'verified';
+    let evidenceRecord;
+    let evidenceParts;
+    let evidenceReference;
+    if (resultState !== 'approved') {
+        const evidenceId = `${phase.id}-${safeTimestamp(now.toISOString())}`;
+        const header = evidenceHeaderFor({
+            inspection: freshInspection,
+            phase,
+            plan: initialPlan,
+            result: resultState,
+            now
+        });
+        evidenceRecord = {
+            evidenceId,
+            header,
+            ...(outcome.liveReadback ? { liveReadback: outcome.liveReadback } : {}),
+            ...(outcome.evidencePayload !== undefined ? { payload: outcome.evidencePayload } : {})
+        };
+        evidenceParts = evidencePathParts(evidenceId);
+        evidenceReference = {
+            phaseId: phase.id,
+            evidenceId,
+            headerDigest: evidenceHeaderDigest(header),
+            result: header.result
+        };
+    }
+    const nextState = nextStateForOutcome({
+        inspection: freshInspection,
+        phase,
+        plan: initialPlan,
+        resultState,
+        evidenceReference,
+        override: outcome.stateOverride,
+        now
+    });
+    const write = await writeOutcomeTransaction({
+        projectRoot: freshInspection.projectRoot,
+        plan: initialPlan,
+        nextState,
+        evidenceRecord,
+        evidencePathParts: evidenceParts,
+        fileMutations: outcome.fileMutations
+    });
+    const rollbackPlan = rollbackPlanForPhase(phase, completedOperations);
+    return {
+        schemaVersion: 1,
+        command: 'governance apply-next',
+        projectRoot: freshInspection.projectRoot,
+        execute: true,
+        applied: true,
+        authorized: true,
+        reason: 'phase-executed',
+        message: `Executed one phase: ${phase.id}.`,
+        nextReadyPhase: phase.id,
+        approval: initialPlan.approval,
+        proposedMutations: {
+            local: initialPlan.mutationClasses.local,
+            remote: initialPlan.mutationClasses.remote,
+            operations: initialPlan.operations
+        },
+        savedPlan: saved,
+        noWrites: false,
+        blockers: [],
+        executedOperations: [
+            ...completedOperations,
+            ...(evidenceParts ? [evidenceWriteOperation(phase, evidenceParts)] : []),
+            stateWriteOperation(phase)
+        ],
+        evidence: write.evidence,
+        stateHash: write.stateHash,
+        rollbackPlan,
+        cleanupWarnings: [...rollbackPlan.cleanupWarnings, ...(outcome.cleanupWarnings ?? [])]
+    };
+}
+function executionBlockedResult(inspection, plan, saved, blocker, completedOperations, stateHashValue, cleanupWarnings = []) {
+    const phase = phaseById(inspection.graph, plan.phaseId);
+    const rollbackPlan = rollbackPlanForPhase(phase, completedOperations);
+    return {
+        schemaVersion: 1,
+        command: 'governance apply-next',
+        projectRoot: inspection.projectRoot,
+        execute: true,
+        applied: false,
+        authorized: false,
+        reason: 'blocked',
+        message: blocker,
+        nextReadyPhase: plan.phaseId,
+        approval: plan.approval,
+        proposedMutations: {
+            local: plan.mutationClasses.local,
+            remote: plan.mutationClasses.remote,
+            operations: plan.operations
+        },
+        savedPlan: saved,
+        noWrites: false,
+        blockers: [blocker],
+        executedOperations: [
+            ...completedOperations,
+            stateWriteOperation(phase)
+        ],
+        evidence: null,
+        stateHash: stateHashValue,
+        rollbackPlan,
+        cleanupWarnings: [...rollbackPlan.cleanupWarnings, ...cleanupWarnings]
+    };
+}
+//# sourceMappingURL=transitions.js.map