@codyswann/lisa 2.216.0 → 2.217.1

package/plugins/src/base/skills/lisa-prd-ticket-coverage/SKILL.md

@@ -96,6 +96,21 @@ PRD item id  →  [ticket keys that cover it]
 
 Matching rules (in priority order):
 
+0. **Declared trace (deterministic — preferred)**: tickets created after
+   requirement traceability landed carry a `Source Requirement` section
+   (verbatim requirement quotes + register `R-ids`), and the PRD's
+   `## Tickets` section carries the same ids in its `lisa:gw … reqs=`
+   tokens. When present, the declared trace IS the mapping — match the
+   quoted text against the extracted atomic items (match on the verbatim
+   quote, not the `R-id`: ids are per-generation and may have shifted if
+   the PRD was re-planned; quotes are the durable anchor). A declared
+   trace is definitive: do not second-guess it with keyword inference,
+   but DO flag a declared quote that no longer appears anywhere in the
+   PRD (the requirement was edited or removed — surface it as a drift
+   finding, not silently). The derived-work form ("Derived work
+   supporting R3, R7") counts as a trace to the named requirements.
+   Fall back to rules 1–4 only for tickets with no Source Requirement
+   section (created before traceability existed).
 1. **Direct quote / strong keyword overlap**: the ticket's summary or AC explicitly names the PRD item's keywords. High confidence.
 2. **Domain match**: PRD item describes a UI affordance ("Tasks widget") and a ticket scopes that affordance (`[CU-2.1] Tasks widget — empty state`). Medium-high confidence.
 3. **Scope inheritance**: PRD item is a sub-detail of a parent (e.g. an AC under a user story); the ticket covers the parent user story. Medium confidence — flag for review if no more specific ticket exists.
@@ -107,6 +122,8 @@ Items with **zero** matching tickets are coverage gaps.
 
 For each created ticket, identify any tickets whose scope_signals do NOT trace back to a PRD item, AND are not justifiable as standard infrastructure tasks (e.g. `X.0 Setup` stories for data model / migrations are typically infrastructure scaffolding, not scope creep).
 
+With declared traces this becomes precise: a ticket whose `Source Requirement` section is absent (on a post-traceability ticket set), or whose declared quotes match nothing in the PRD, is an orphan — the strongest scope-creep signal available. A ticket using the derived-work form is by definition not scope creep; it declares which requirements it supports.
+
 Scope creep is informational, not blocking — but worth surfacing because it usually indicates the agent invented work.
 
 ### Phase 5 — Determine verdict

package/typescript/copy-overwrite/.github/GITHUB_ACTIONS.md

@@ -183,7 +183,7 @@ Fixer of last resort for red CI on unattended branches: Claude analyzes error lo
 - Falls back to a non-frozen dependency install when the lockfile itself is broken, so Claude can repair and commit the lockfile
 - When no fix can be produced, files a deduplicated ticket in the tracker declared in `.lisa.config.json` (`tracker`: jira | github | linear) with a title that says whether Claude ran at all
 - Skips environment branches (`main`, `staging`, `dev`) and auto-fix branches (prevents infinite loops); failing checks on an auto-fix PR escalate to a ticket instead of re-entering
-- Requires `secrets: inherit` in the caller so tracker credentials (`JIRA_API_TOKEN` / `LINEAR_API_KEY`) reach the issue dispatcher
+- Requires the caller to map `JIRA_API_TOKEN` / `LINEAR_API_KEY` (and `PAT`) explicitly in its `secrets:` block so tracker credentials reach the issue dispatcher — least-privilege by design; `secrets: inherit` also works mechanically but hands the chain every repo secret and trips SonarCloud security gates
 
 ### Claude Code Review Response (`claude-code-review-response.yml`)
 

package/typescript/create-only/.github/workflows/claude-ci-auto-fix.yml

@@ -25,9 +25,17 @@ jobs:
       head_branch: ${{ github.event.workflow_run.head_branch }}
       run_id: ${{ github.event.workflow_run.id }}
       package_manager: 'bun'
-    # `secrets: inherit` (not an explicit mapping) is load-bearing: the
-    # reusable workflow forwards secrets to the issue dispatcher, which needs
-    # JIRA_API_TOKEN / LINEAR_API_KEY to file failure tickets in the tracker
-    # declared in .lisa.config.json. An explicit CLAUDE_CODE_OAUTH_TOKEN-only
-    # mapping silently strands those tickets in GitHub Issues.
-    secrets: inherit
+    # Least-privilege mapping — exactly the secrets the auto-fix chain uses.
+    # The tracker tokens are load-bearing: the reusable workflow forwards them
+    # to the failure-issue dispatcher, which needs JIRA_API_TOKEN /
+    # LINEAR_API_KEY to file tickets in the tracker declared in
+    # .lisa.config.json. A CLAUDE_CODE_OAUTH_TOKEN-only mapping silently
+    # strands those tickets in GitHub Issues. Unset secrets pass as empty —
+    # safe on repos that don't use that tracker. (`secrets: inherit` would
+    # also work but hands the chain every repo secret and trips
+    # SonarCloud/security-scanner gates.)
+    secrets:
+      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+      PAT: ${{ secrets.PAT }}
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+      LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}

package/typescript/create-only/.github/workflows/claude-deploy-auto-fix.yml

@@ -25,7 +25,14 @@ jobs:
       head_branch: ${{ github.event.workflow_run.head_branch }}
       run_id: ${{ github.event.workflow_run.id }}
       package_manager: 'bun'
-    # `secrets: inherit` (not an explicit mapping) is load-bearing: the
-    # reusable workflow needs tracker credentials (JIRA_API_TOKEN /
-    # LINEAR_API_KEY) to reach the tracker declared in .lisa.config.json.
-    secrets: inherit
+    # Least-privilege mapping — exactly the secrets the deploy-fix chain
+    # uses. The tracker tokens are load-bearing: the reusable workflow needs
+    # JIRA_API_TOKEN / LINEAR_API_KEY to reach the tracker declared in
+    # .lisa.config.json. Unset secrets pass as empty. (`secrets: inherit`
+    # would also work but hands the chain every repo secret and trips
+    # SonarCloud/security-scanner gates.)
+    secrets:
+      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+      PAT: ${{ secrets.PAT }}
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+      LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}