@codyswann/lisa 2.199.0 → 2.201.0

package/dist/sync/registry.js

@@ -0,0 +1,207 @@
+const WHEN_TRACKER_JIRA = "tracker=jira";
+const WHEN_TRACKER_GITHUB = "tracker=github";
+const WHEN_SOURCE_GITHUB = "source=github";
+const WHEN_TRACKER_LINEAR = "tracker=linear";
+const WHEN_SOURCE_LINEAR = "source=linear";
+const WHEN_SOURCE_NOTION = "source=notion";
+const COVERAGE_DEFAULTS = {
+    global: { statements: 70, branches: 70, functions: 70, lines: 70 },
+};
+const BUILD_LABEL_DEFAULTS = {
+    ready: "status:ready",
+    claimed: "status:in-progress",
+    blocked: "status:blocked",
+    human_needed: "human-needed",
+    done: {
+        dev: "status:on-dev",
+        staging: "status:on-stg",
+        production: "status:done",
+    },
+};
+const PRD_LABEL_DEFAULTS = {
+    draft: "prd-draft",
+    ready: "prd-ready",
+    in_review: "prd-in-review",
+    blocked: "prd-blocked",
+    ticketed: "prd-ticketed",
+    shipped: "prd-shipped",
+    verified: "prd-verified",
+    sentinel: "prd-intake-feedback",
+};
+/**
+ * All settings `lisa sync` manages. Local-only keys (`atlassian.email`,
+ * `intake.assignee`, `jira.verified_workflow_hash`, secret paths) are
+ * deliberately absent — sync never populates the committed file with values
+ * that belong in `.lisa.config.local.json`.
+ */
+export const SYNC_REGISTRY = [
+    {
+        key: "harness",
+        defaultValue: "claude",
+        description: "Target coding-agent harness(es)",
+    },
+    {
+        key: "quality.testCoverage",
+        defaultValue: COVERAGE_DEFAULTS,
+        artifacts: [
+            { file: "vitest.thresholds.json", pointer: "" },
+            { file: "jest.thresholds.json", pointer: "" },
+        ],
+        description: "Test coverage floors (statements/branches/functions/lines)",
+    },
+    {
+        key: "quality.lintBudgets",
+        defaultValue: {
+            cognitiveComplexity: 10,
+            maxLines: 300,
+            maxLinesPerFunction: 75,
+        },
+        artifacts: [{ file: "eslint.thresholds.json", pointer: "" }],
+        description: "Lint complexity and size budgets",
+    },
+    {
+        key: "quality.mutation.gate",
+        defaultValue: { enabled: false, since: "main" },
+        artifacts: [{ file: "mutation.gate.json", pointer: "" }],
+        description: "Diff-only mutation testing gate",
+    },
+    {
+        key: "quality.mutation.strykerThresholds",
+        defaultValue: { high: 80, low: 60, break: 60 },
+        artifacts: [{ file: "stryker.conf.json", pointer: "thresholds" }],
+        description: "Stryker mutation-score thresholds",
+    },
+    {
+        key: "intake.repair",
+        defaultValue: { staleAfterHours: 2, maxCandidates: 100 },
+        description: "Repair-intake stall window and candidate cap",
+    },
+    {
+        key: "monitor",
+        defaultValue: {
+            maxCandidates: 20,
+            gapTiers: "core",
+            backoffHours: 24,
+            // Provider-neutral threshold names: the audit spans Sentry, CloudWatch,
+            // X-Ray, and future providers, so no key is prefixed with a vendor. The
+            // lisa-monitor skill still reads the legacy sentryMinEvents24h /
+            // xrayFaultRatePct keys — renaming those (config-resolution.md + skill)
+            // is a tracked follow-up; see ui/README.md.
+            thresholds: {
+                minEvents24h: 1,
+                errorRateSpikeMultiplier: 2,
+                p95LatencyMs: 1000,
+                faultRatePct: 5,
+            },
+        },
+        description: "Observability audit caps and alert thresholds",
+    },
+    {
+        key: "jira.workflow",
+        defaultValue: {
+            ready: "Ready",
+            claimed: "In Progress",
+            review: "Code Review",
+            blocked: "Blocked",
+            done: { dev: "On Dev", staging: "On Stg", production: "Done" },
+        },
+        relevantWhen: ["jira", WHEN_TRACKER_JIRA],
+        description: "JIRA workflow status names per lifecycle role",
+    },
+    {
+        key: "jira.labels",
+        defaultValue: { human_needed: "Human Needed" },
+        relevantWhen: ["jira", WHEN_TRACKER_JIRA],
+        description: "JIRA marker labels",
+    },
+    {
+        key: "github.labels",
+        defaultValue: { build: BUILD_LABEL_DEFAULTS, prd: PRD_LABEL_DEFAULTS },
+        relevantWhen: ["github", WHEN_TRACKER_GITHUB, WHEN_SOURCE_GITHUB],
+        description: "GitHub build and PRD lifecycle labels",
+    },
+    {
+        key: "linear.labels",
+        defaultValue: {
+            build: { ...BUILD_LABEL_DEFAULTS, review: "status:code-review" },
+            prd: PRD_LABEL_DEFAULTS,
+        },
+        relevantWhen: ["linear", WHEN_TRACKER_LINEAR, WHEN_SOURCE_LINEAR],
+        description: "Linear build and PRD lifecycle labels",
+    },
+    {
+        key: "notion.statusProperty",
+        defaultValue: "Status",
+        relevantWhen: ["notion", WHEN_SOURCE_NOTION],
+        description: "Notion database property that drives the PRD lifecycle",
+    },
+    {
+        key: "notion.values",
+        defaultValue: {
+            draft: "Draft",
+            ready: "Ready",
+            in_review: "In Review",
+            blocked: "Blocked",
+            ticketed: "Ticketed",
+            shipped: "Shipped",
+            verified: "Verified",
+        },
+        relevantWhen: ["notion", WHEN_SOURCE_NOTION],
+        description: "Notion status option names per lifecycle role",
+    },
+    {
+        key: "wiki.ttlSeconds",
+        defaultValue: 300,
+        relevantWhen: ["wiki"],
+        description: "Remote wiki mirror refresh TTL",
+    },
+];
+/**
+ * Keys sync can never default: they identify external systems and must come
+ * from a human (via the matching `/lisa:setup:*` skill). Sync reports them
+ * when missing instead of inventing values.
+ */
+export const REQUIRED_KEYS = [
+    { key: "tracker", setupHint: "/lisa:setup:jira | github | linear" },
+    {
+        key: "jira.project",
+        relevantWhen: [WHEN_TRACKER_JIRA],
+        setupHint: "/lisa:setup:jira",
+    },
+    {
+        key: "atlassian.cloudId",
+        relevantWhen: [WHEN_TRACKER_JIRA, "source=confluence"],
+        setupHint: "/lisa:setup:atlassian",
+    },
+    {
+        key: "github.org",
+        relevantWhen: [WHEN_TRACKER_GITHUB, WHEN_SOURCE_GITHUB],
+        setupHint: "/lisa:setup:github",
+    },
+    {
+        key: "github.repo",
+        relevantWhen: [WHEN_TRACKER_GITHUB, WHEN_SOURCE_GITHUB],
+        setupHint: "/lisa:setup:github",
+    },
+    {
+        key: "linear.workspace",
+        relevantWhen: [WHEN_TRACKER_LINEAR, WHEN_SOURCE_LINEAR],
+        setupHint: "/lisa:setup:linear",
+    },
+    {
+        key: "linear.teamKey",
+        relevantWhen: [WHEN_TRACKER_LINEAR],
+        setupHint: "/lisa:setup:linear",
+    },
+    {
+        key: "notion.workspaceId",
+        relevantWhen: [WHEN_SOURCE_NOTION],
+        setupHint: "/lisa:setup:notion",
+    },
+    {
+        key: "notion.prdDatabaseId",
+        relevantWhen: [WHEN_SOURCE_NOTION],
+        setupHint: "/lisa:setup:notion",
+    },
+];
+//# sourceMappingURL=registry.js.map

package/dist/sync/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/sync/registry.ts"],"names":[],"mappings":"AAsDA,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAE3C,MAAM,iBAAiB,GAAc;IACnC,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;CACnE,CAAC;AAEF,MAAM,oBAAoB,GAAG;IAC3B,KAAK,EAAE,cAAc;IACrB,OAAO,EAAE,oBAAoB;IAC7B,OAAO,EAAE,gBAAgB;IACzB,YAAY,EAAE,cAAc;IAC5B,IAAI,EAAE;QACJ,GAAG,EAAE,eAAe;QACpB,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,aAAa;KAC1B;CACO,CAAC;AAEX,MAAM,kBAAkB,GAAc;IACpC,KAAK,EAAE,WAAW;IAClB,KAAK,EAAE,WAAW;IAClB,SAAS,EAAE,eAAe;IAC1B,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,qBAAqB;CAChC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAA6B;IACrD;QACE,GAAG,EAAE,SAAS;QACd,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,YAAY,EAAE,iBAAiB;QAC/B,SAAS,EAAE;YACT,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,EAAE;YAC/C,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,EAAE;SAC9C;QACD,WAAW,EAAE,4DAA4D;KAC1E;IACD;QACE,GAAG,EAAE,qBAAqB;QAC1B,YAAY,EAAE;YACZ,mBAAmB,EAAE,EAAE;YACvB,QAAQ,EAAE,GAAG;YACb,mBAAmB,EAAE,EAAE;SACxB;QACD,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC5D,WAAW,EAAE,kCAAkC;KAChD;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE;QAC/C,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACxD,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,oCAAoC;QACzC,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAC9C,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QACjE,WAAW,EAAE,mCAAmC;KACjD;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE;QACxD,WAAW,EAAE,8CAA8C;KAC5D;IACD;QACE,GAAG,EAAE,SAAS;QACd,YAAY,EAAE;YACZ,aAAa,EAAE,EAAE;YACjB,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,EAAE;YAChB,wEAAwE;YACxE,wEAAwE;YACxE,iEAAiE;YACjE,wEAAwE;YACxE,4CAA4C;YAC5C,UAAU,EAAE;gBACV,YAAY,EAAE,CAAC;gBACf,wBAAwB,EAAE,CAAC;gBAC3B,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,CAAC;aAChB;SACF;QACD,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE;SAC/D;QACD,YAAY,EAAE,CAAC,MAAM,EAAE,iBAAiB,CAAC;QACzC,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,aAAa;QAClB,YAAY,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE;QAC9C,YAAY,EAAE,CAAC,MAAM,EAAE,iBAAiB,CAAC;QACzC,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE;QACtE,YAAY,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;QACjE,WAAW,EAAE,uCAAuC;KACrD;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE,GAAG,oBAAoB,EAAE,MAAM,EAAE,oBAAoB,EAAE;YAChE,GAAG,EAAE,kBAAkB;SACxB;QACD,YAAY,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;QACjE,WAAW,EAAE,uCAAuC;KACrD;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,YAAY,EAAE,QAAQ;QACtB,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QAC5C,WAAW,EAAE,wDAAwD;KACtE;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,OAAO;YACd,SAAS,EAAE,WAAW;YACtB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,UAAU;SACrB;QACD,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QAC5C,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,YAAY,EAAE,GAAG;QACjB,YAAY,EAAE,CAAC,MAAM,CAAC;QACtB,WAAW,EAAE,gCAAgC;KAC9C;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,oCAAoC,EAAE;IACnE;QACE,GAAG,EAAE,cAAc;QACnB,YAAY,EAAE,CAAC,iBAAiB,CAAC;QACjC,SAAS,EAAE,kBAAkB;KAC9B;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,YAAY,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;QACtD,SAAS,EAAE,uBAAuB;KACnC;IACD;QACE,GAAG,EAAE,YAAY;QACjB,YAAY,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACvD,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,aAAa;QAClB,YAAY,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACvD,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,YAAY,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACvD,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,gBAAgB;QACrB,YAAY,EAAE,CAAC,mBAAmB,CAAC;QACnC,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,YAAY,EAAE,CAAC,kBAAkB,CAAC;QAClC,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,YAAY,EAAE,CAAC,kBAAkB,CAAC;QAClC,SAAS,EAAE,oBAAoB;KAChC;CACF,CAAC"}

package/package.json

@@ -49,6 +49,7 @@
   ],
   "files": [
     "dist",
+    "ui",
     "all",
     "typescript",
     "npm-package",
@@ -94,7 +95,7 @@
     "ws": ">=8.20.1"
   },
   "name": "@codyswann/lisa",
-  "version": "2.199.0",
+  "version": "2.201.0",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.199.0",
+  "version": "2.201.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.199.0",
+  "version": "2.201.0",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-doctor/SKILL.md

@@ -291,6 +291,62 @@ without turning the base doctor into a second `lisa-wiki-doctor`.
    - Never require a wiki plugin surface when `wiki/` is absent.
    - Never let wiki-specific checks downgrade unrelated non-wiki repositories.
 
+### Upstream Lisa change-history diagnosis
+
+A failing or warning check has two possible causes: the project drifted, or **Lisa itself changed
+upstream** since this project last updated. Doctor must distinguish them instead of blaming the
+project by default. Whenever findings need explanation — and always before proposing repairs —
+pull Lisa's own git history and read what actually changed:
+
+1. **Resolve the version window.** Determine the project's installed Lisa version (the
+   `@codyswann/lisa` entry in `package.json`/lockfile, or the plugin version stamp on the active
+   runtime) and the latest published version (`npm view @codyswann/lisa version`, or the update
+   check's cached result).
+2. **Pull the upstream history for that window** (read-only; no clone required when `gh` is
+   available):
+
+   ```bash
+   gh api "repos/CodySwannGT/lisa/compare/v<installed>...v<latest>" \
+     --paginate --slurp \
+     --jq '{total_commits: .[0].total_commits, files: [.[0].files[]?.filename], commits: [.[].commits[]? | .commit.message | split("\n")[0]]}'
+   ```
+
+   `--paginate` fetches every page of commits, and `--slurp` gathers those pages into a single
+   array before `--jq` runs — without `--slurp`, `--jq` applies per page and prints one JSON object
+   per page instead of one merged result. `total_commits` and `files` only need the first page
+   (files are capped at 300 and not repeated on later pages); `commits` flattens across all pages.
+
+   The compare endpoint paginates commits (250 without `--paginate`) and only lists changed files
+   on the first page, capped at 300 total — a large version window can silently drop commits or
+   files. If `total_commits` or the file count looks truncated, re-run with the
+   `application/vnd.github.diff` accept header (`gh api ... -H "Accept: application/vnd.github.diff"`)
+   to pull the full patch text, or fall back to the shallow-clone `git log` below. When completeness
+   still can't be established, say so in the finding and mark it `WARN` rather than attributing
+   drift with unverified confidence.
+
+   Fallbacks, in order: `gh api repos/CodySwannGT/lisa/commits?path=<template-path>` for a
+   path-scoped view — note this endpoint has no way to bound results to the `v<installed>..v<latest>`
+   window, so treat its output as best-effort context only, not authoritative attribution; a shallow
+   clone (`git clone --filter=blob:none --no-checkout` then `git log v<installed>..v<latest> --
+   <paths>`), which *is* bounded to the window and should be preferred for definitive attribution; or
+   the local marketplace/plugin cache checkout when the runtime has one. If none are reachable, or
+   only the unbounded path-scoped fallback is reachable, report the gap as a `WARN`-level
+   observability note — never fail the audit because history was unavailable or incomplete.
+3. **Scope the reading to what the finding touches.** Filter the commit list to the paths that
+   generate the failing surface: the detected stacks' template dirs (`typescript/`, `expo/`, …),
+   `plugins/src/base/` for skills/hooks/rules, `scripts/` for governance scripts, and the shipped
+   config factories (`src/configs/`). A finding about a lint rule failure reads the lint-config
+   commits, not the whole log.
+4. **Attribute the finding.** When the upstream history shows Lisa changed the contract (a
+   tightened lint rule, a renamed check context, a new required config key), say so in `Observed:`
+   with the commit subject/version, and let `Remediation:` point at the sanctioned adoption path
+   (e.g. `lisa update` + re-apply, a documented config opt-out) rather than hand-editing managed
+   files. When history shows no relevant upstream change, the project drifted — remediate on the
+   project side.
+
+This history pull is part of doctor's read-only contract: it reads Lisa's repository, never writes
+to it, and repair suggestions stay suggestions.
+
 ## Output contract
 
 The final report must:

package/plugins/lisa/skills/lisa-doctor/SKILL.md

@@ -291,6 +291,62 @@ without turning the base doctor into a second `lisa-wiki-doctor`.
    - Never require a wiki plugin surface when `wiki/` is absent.
    - Never let wiki-specific checks downgrade unrelated non-wiki repositories.
 
+### Upstream Lisa change-history diagnosis
+
+A failing or warning check has two possible causes: the project drifted, or **Lisa itself changed
+upstream** since this project last updated. Doctor must distinguish them instead of blaming the
+project by default. Whenever findings need explanation — and always before proposing repairs —
+pull Lisa's own git history and read what actually changed:
+
+1. **Resolve the version window.** Determine the project's installed Lisa version (the
+   `@codyswann/lisa` entry in `package.json`/lockfile, or the plugin version stamp on the active
+   runtime) and the latest published version (`npm view @codyswann/lisa version`, or the update
+   check's cached result).
+2. **Pull the upstream history for that window** (read-only; no clone required when `gh` is
+   available):
+
+   ```bash
+   gh api "repos/CodySwannGT/lisa/compare/v<installed>...v<latest>" \
+     --paginate --slurp \
+     --jq '{total_commits: .[0].total_commits, files: [.[0].files[]?.filename], commits: [.[].commits[]? | .commit.message | split("\n")[0]]}'
+   ```
+
+   `--paginate` fetches every page of commits, and `--slurp` gathers those pages into a single
+   array before `--jq` runs — without `--slurp`, `--jq` applies per page and prints one JSON object
+   per page instead of one merged result. `total_commits` and `files` only need the first page
+   (files are capped at 300 and not repeated on later pages); `commits` flattens across all pages.
+
+   The compare endpoint paginates commits (250 without `--paginate`) and only lists changed files
+   on the first page, capped at 300 total — a large version window can silently drop commits or
+   files. If `total_commits` or the file count looks truncated, re-run with the
+   `application/vnd.github.diff` accept header (`gh api ... -H "Accept: application/vnd.github.diff"`)
+   to pull the full patch text, or fall back to the shallow-clone `git log` below. When completeness
+   still can't be established, say so in the finding and mark it `WARN` rather than attributing
+   drift with unverified confidence.
+
+   Fallbacks, in order: `gh api repos/CodySwannGT/lisa/commits?path=<template-path>` for a
+   path-scoped view — note this endpoint has no way to bound results to the `v<installed>..v<latest>`
+   window, so treat its output as best-effort context only, not authoritative attribution; a shallow
+   clone (`git clone --filter=blob:none --no-checkout` then `git log v<installed>..v<latest> --
+   <paths>`), which *is* bounded to the window and should be preferred for definitive attribution; or
+   the local marketplace/plugin cache checkout when the runtime has one. If none are reachable, or
+   only the unbounded path-scoped fallback is reachable, report the gap as a `WARN`-level
+   observability note — never fail the audit because history was unavailable or incomplete.
+3. **Scope the reading to what the finding touches.** Filter the commit list to the paths that
+   generate the failing surface: the detected stacks' template dirs (`typescript/`, `expo/`, …),
+   `plugins/src/base/` for skills/hooks/rules, `scripts/` for governance scripts, and the shipped
+   config factories (`src/configs/`). A finding about a lint rule failure reads the lint-config
+   commits, not the whole log.
+4. **Attribute the finding.** When the upstream history shows Lisa changed the contract (a
+   tightened lint rule, a renamed check context, a new required config key), say so in `Observed:`
+   with the commit subject/version, and let `Remediation:` point at the sanctioned adoption path
+   (e.g. `lisa update` + re-apply, a documented config opt-out) rather than hand-editing managed
+   files. When history shows no relevant upstream change, the project drifted — remediate on the
+   project side.
+
+This history pull is part of doctor's read-only contract: it reads Lisa's repository, never writes
+to it, and repair suggestions stay suggestions.
+
 ## Output contract
 
 The final report must:

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.199.0",
+  "version": "2.201.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-doctor/SKILL.md

@@ -291,6 +291,62 @@ without turning the base doctor into a second `lisa-wiki-doctor`.
    - Never require a wiki plugin surface when `wiki/` is absent.
    - Never let wiki-specific checks downgrade unrelated non-wiki repositories.
 
+### Upstream Lisa change-history diagnosis
+
+A failing or warning check has two possible causes: the project drifted, or **Lisa itself changed
+upstream** since this project last updated. Doctor must distinguish them instead of blaming the
+project by default. Whenever findings need explanation — and always before proposing repairs —
+pull Lisa's own git history and read what actually changed:
+
+1. **Resolve the version window.** Determine the project's installed Lisa version (the
+   `@codyswann/lisa` entry in `package.json`/lockfile, or the plugin version stamp on the active
+   runtime) and the latest published version (`npm view @codyswann/lisa version`, or the update
+   check's cached result).
+2. **Pull the upstream history for that window** (read-only; no clone required when `gh` is
+   available):
+
+   ```bash
+   gh api "repos/CodySwannGT/lisa/compare/v<installed>...v<latest>" \
+     --paginate --slurp \
+     --jq '{total_commits: .[0].total_commits, files: [.[0].files[]?.filename], commits: [.[].commits[]? | .commit.message | split("\n")[0]]}'
+   ```
+
+   `--paginate` fetches every page of commits, and `--slurp` gathers those pages into a single
+   array before `--jq` runs — without `--slurp`, `--jq` applies per page and prints one JSON object
+   per page instead of one merged result. `total_commits` and `files` only need the first page
+   (files are capped at 300 and not repeated on later pages); `commits` flattens across all pages.
+
+   The compare endpoint paginates commits (250 without `--paginate`) and only lists changed files
+   on the first page, capped at 300 total — a large version window can silently drop commits or
+   files. If `total_commits` or the file count looks truncated, re-run with the
+   `application/vnd.github.diff` accept header (`gh api ... -H "Accept: application/vnd.github.diff"`)
+   to pull the full patch text, or fall back to the shallow-clone `git log` below. When completeness
+   still can't be established, say so in the finding and mark it `WARN` rather than attributing
+   drift with unverified confidence.
+
+   Fallbacks, in order: `gh api repos/CodySwannGT/lisa/commits?path=<template-path>` for a
+   path-scoped view — note this endpoint has no way to bound results to the `v<installed>..v<latest>`
+   window, so treat its output as best-effort context only, not authoritative attribution; a shallow
+   clone (`git clone --filter=blob:none --no-checkout` then `git log v<installed>..v<latest> --
+   <paths>`), which *is* bounded to the window and should be preferred for definitive attribution; or
+   the local marketplace/plugin cache checkout when the runtime has one. If none are reachable, or
+   only the unbounded path-scoped fallback is reachable, report the gap as a `WARN`-level
+   observability note — never fail the audit because history was unavailable or incomplete.
+3. **Scope the reading to what the finding touches.** Filter the commit list to the paths that
+   generate the failing surface: the detected stacks' template dirs (`typescript/`, `expo/`, …),
+   `plugins/src/base/` for skills/hooks/rules, `scripts/` for governance scripts, and the shipped
+   config factories (`src/configs/`). A finding about a lint rule failure reads the lint-config
+   commits, not the whole log.
+4. **Attribute the finding.** When the upstream history shows Lisa changed the contract (a
+   tightened lint rule, a renamed check context, a new required config key), say so in `Observed:`
+   with the commit subject/version, and let `Remediation:` point at the sanctioned adoption path
+   (e.g. `lisa update` + re-apply, a documented config opt-out) rather than hand-editing managed
+   files. When history shows no relevant upstream change, the project drifted — remediate on the
+   project side.
+
+This history pull is part of doctor's read-only contract: it reads Lisa's repository, never writes
+to it, and repair suggestions stay suggestions.
+
 ## Output contract
 
 The final report must:

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.199.0",
+  "version": "2.201.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.199.0",
+  "version": "2.201.0",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.199.0",
+  "version": "2.201.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.199.0",
+  "version": "2.201.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.199.0",
+  "version": "2.201.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.199.0",
+  "version": "2.201.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/skills/lisa-doctor/SKILL.md

@@ -291,6 +291,62 @@ without turning the base doctor into a second `lisa-wiki-doctor`.
    - Never require a wiki plugin surface when `wiki/` is absent.
    - Never let wiki-specific checks downgrade unrelated non-wiki repositories.
 
+### Upstream Lisa change-history diagnosis
+
+A failing or warning check has two possible causes: the project drifted, or **Lisa itself changed
+upstream** since this project last updated. Doctor must distinguish them instead of blaming the
+project by default. Whenever findings need explanation — and always before proposing repairs —
+pull Lisa's own git history and read what actually changed:
+
+1. **Resolve the version window.** Determine the project's installed Lisa version (the
+   `@codyswann/lisa` entry in `package.json`/lockfile, or the plugin version stamp on the active
+   runtime) and the latest published version (`npm view @codyswann/lisa version`, or the update
+   check's cached result).
+2. **Pull the upstream history for that window** (read-only; no clone required when `gh` is
+   available):
+
+   ```bash
+   gh api "repos/CodySwannGT/lisa/compare/v<installed>...v<latest>" \
+     --paginate --slurp \
+     --jq '{total_commits: .[0].total_commits, files: [.[0].files[]?.filename], commits: [.[].commits[]? | .commit.message | split("\n")[0]]}'
+   ```
+
+   `--paginate` fetches every page of commits, and `--slurp` gathers those pages into a single
+   array before `--jq` runs — without `--slurp`, `--jq` applies per page and prints one JSON object
+   per page instead of one merged result. `total_commits` and `files` only need the first page
+   (files are capped at 300 and not repeated on later pages); `commits` flattens across all pages.
+
+   The compare endpoint paginates commits (250 without `--paginate`) and only lists changed files
+   on the first page, capped at 300 total — a large version window can silently drop commits or
+   files. If `total_commits` or the file count looks truncated, re-run with the
+   `application/vnd.github.diff` accept header (`gh api ... -H "Accept: application/vnd.github.diff"`)
+   to pull the full patch text, or fall back to the shallow-clone `git log` below. When completeness
+   still can't be established, say so in the finding and mark it `WARN` rather than attributing
+   drift with unverified confidence.
+
+   Fallbacks, in order: `gh api repos/CodySwannGT/lisa/commits?path=<template-path>` for a
+   path-scoped view — note this endpoint has no way to bound results to the `v<installed>..v<latest>`
+   window, so treat its output as best-effort context only, not authoritative attribution; a shallow
+   clone (`git clone --filter=blob:none --no-checkout` then `git log v<installed>..v<latest> --
+   <paths>`), which *is* bounded to the window and should be preferred for definitive attribution; or
+   the local marketplace/plugin cache checkout when the runtime has one. If none are reachable, or
+   only the unbounded path-scoped fallback is reachable, report the gap as a `WARN`-level
+   observability note — never fail the audit because history was unavailable or incomplete.
+3. **Scope the reading to what the finding touches.** Filter the commit list to the paths that
+   generate the failing surface: the detected stacks' template dirs (`typescript/`, `expo/`, …),
+   `plugins/src/base/` for skills/hooks/rules, `scripts/` for governance scripts, and the shipped
+   config factories (`src/configs/`). A finding about a lint rule failure reads the lint-config
+   commits, not the whole log.
+4. **Attribute the finding.** When the upstream history shows Lisa changed the contract (a
+   tightened lint rule, a renamed check context, a new required config key), say so in `Observed:`
+   with the commit subject/version, and let `Remediation:` point at the sanctioned adoption path
+   (e.g. `lisa update` + re-apply, a documented config opt-out) rather than hand-editing managed
+   files. When history shows no relevant upstream change, the project drifted — remediate on the
+   project side.
+
+This history pull is part of doctor's read-only contract: it reads Lisa's repository, never writes
+to it, and repair suggestions stay suggestions.
+
 ## Output contract
 
 The final report must:

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.199.0",
+  "version": "2.201.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/skills/lisa-doctor/SKILL.md

@@ -291,6 +291,62 @@ without turning the base doctor into a second `lisa-wiki-doctor`.
    - Never require a wiki plugin surface when `wiki/` is absent.
    - Never let wiki-specific checks downgrade unrelated non-wiki repositories.
 
+### Upstream Lisa change-history diagnosis
+
+A failing or warning check has two possible causes: the project drifted, or **Lisa itself changed
+upstream** since this project last updated. Doctor must distinguish them instead of blaming the
+project by default. Whenever findings need explanation — and always before proposing repairs —
+pull Lisa's own git history and read what actually changed:
+
+1. **Resolve the version window.** Determine the project's installed Lisa version (the
+   `@codyswann/lisa` entry in `package.json`/lockfile, or the plugin version stamp on the active
+   runtime) and the latest published version (`npm view @codyswann/lisa version`, or the update
+   check's cached result).
+2. **Pull the upstream history for that window** (read-only; no clone required when `gh` is
+   available):
+
+   ```bash
+   gh api "repos/CodySwannGT/lisa/compare/v<installed>...v<latest>" \
+     --paginate --slurp \
+     --jq '{total_commits: .[0].total_commits, files: [.[0].files[]?.filename], commits: [.[].commits[]? | .commit.message | split("\n")[0]]}'
+   ```
+
+   `--paginate` fetches every page of commits, and `--slurp` gathers those pages into a single
+   array before `--jq` runs — without `--slurp`, `--jq` applies per page and prints one JSON object
+   per page instead of one merged result. `total_commits` and `files` only need the first page
+   (files are capped at 300 and not repeated on later pages); `commits` flattens across all pages.
+
+   The compare endpoint paginates commits (250 without `--paginate`) and only lists changed files
+   on the first page, capped at 300 total — a large version window can silently drop commits or
+   files. If `total_commits` or the file count looks truncated, re-run with the
+   `application/vnd.github.diff` accept header (`gh api ... -H "Accept: application/vnd.github.diff"`)
+   to pull the full patch text, or fall back to the shallow-clone `git log` below. When completeness
+   still can't be established, say so in the finding and mark it `WARN` rather than attributing
+   drift with unverified confidence.
+
+   Fallbacks, in order: `gh api repos/CodySwannGT/lisa/commits?path=<template-path>` for a
+   path-scoped view — note this endpoint has no way to bound results to the `v<installed>..v<latest>`
+   window, so treat its output as best-effort context only, not authoritative attribution; a shallow
+   clone (`git clone --filter=blob:none --no-checkout` then `git log v<installed>..v<latest> --
+   <paths>`), which *is* bounded to the window and should be preferred for definitive attribution; or
+   the local marketplace/plugin cache checkout when the runtime has one. If none are reachable, or
+   only the unbounded path-scoped fallback is reachable, report the gap as a `WARN`-level
+   observability note — never fail the audit because history was unavailable or incomplete.
+3. **Scope the reading to what the finding touches.** Filter the commit list to the paths that
+   generate the failing surface: the detected stacks' template dirs (`typescript/`, `expo/`, …),
+   `plugins/src/base/` for skills/hooks/rules, `scripts/` for governance scripts, and the shipped
+   config factories (`src/configs/`). A finding about a lint rule failure reads the lint-config
+   commits, not the whole log.
+4. **Attribute the finding.** When the upstream history shows Lisa changed the contract (a
+   tightened lint rule, a renamed check context, a new required config key), say so in `Observed:`
+   with the commit subject/version, and let `Remediation:` point at the sanctioned adoption path
+   (e.g. `lisa update` + re-apply, a documented config opt-out) rather than hand-editing managed
+   files. When history shows no relevant upstream change, the project drifted — remediate on the
+   project side.
+
+This history pull is part of doctor's read-only contract: it reads Lisa's repository, never writes
+to it, and repair suggestions stay suggestions.
+
 ## Output contract
 
 The final report must:

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.199.0",
+  "version": "2.201.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"