@codyswann/lisa 2.223.2 → 2.224.0

package/all/copy-contents/gitignore

@@ -208,6 +208,9 @@ expo-env.d.ts
 
 .lisa.config.local.json
 .lisa/jira-cli/
+# Transient verification verdict used by Lisa's completion gate. Durable
+# verification evidence belongs under evidence/<ticket>/ and remains trackable.
+.lisa/verification-status.json
 
 # Lisa-generated project Codex overlay. Keep host-owned config.toml and
 # hooks.json visible so projects can commit their own merged configuration.

package/package.json

@@ -102,7 +102,7 @@
     "form-data": ">=4.0.6"
   },
   "name": "@codyswann/lisa",
-  "version": "2.223.2",
+  "version": "2.224.0",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.223.2",
+  "version": "2.224.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.223.2",
+  "version": "2.224.0",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-github-build-intake/SKILL.md

@@ -10,7 +10,13 @@ allowed-tools: ["Skill", "Bash"]
 
 1. A GitHub `org/repo` token (e.g., `acme/frontend-v2`).
 2. A full GitHub repo URL (e.g., `https://github.com/acme/frontend-v2`).
-3. The literal token `github` — falls back to `.lisa.config.json` (`github.org` / `github.repo`).
+3. The literal token `github` (or an omitted repo) — resolves merged config
+   `github.queueRepo`, falling back to the identity `github.org/github.repo`.
+
+An explicit `org/repo` token or GitHub URL always wins. `github.queueRepo` may be canonical
+`owner/repo` or a short repo name normalized to `github.org`. It changes only the scanned queue;
+the Phase 3a.0 `repo:<current>` gate still resolves the code repository from `repo` /
+`github.repo` / the git remote.
 
 Run one build-intake cycle. The first eligible issue in the configured `ready` build label is claimed, built via the `github-agent` workflow run in-session (Phase 3c, culminating in `lisa-implement`), relabeled to the configured `done` label (env-aware — see Workflow resolution), then the cycle exits. Remaining ready issues stay queued for later scheduler invocations.
 
@@ -133,7 +139,10 @@ A "transition" means: remove the old role label and add the new one, in two `gh
 1. Parse `$ARGUMENTS`:
    - `org/repo` token → use as-is.
    - GitHub URL → extract `org` and `repo`.
-   - Literal `github` → resolve from `.lisa.config.json` (`github.org`, `github.repo`); error if not set.
+   - Literal `github` or omitted repo → resolve local then global `github.queueRepo`, falling back
+     to `github.org/github.repo`; normalize a short `queueRepo` to `github.org`; error if the
+     resulting identity/queue cannot be resolved.
+   - Never replace current-repo identity with the queue repo. An umbrella queue is only a scan target.
 2. Confirm `gh auth status` succeeds.
 3. Confirm the repo is reachable: `gh repo view <org>/<repo> --json name --jq '.name'`.
 
@@ -405,7 +414,8 @@ Total PRs opened: <n>
 | Variable | Default | Purpose |
 |----------|---------|---------|
 | `.lisa.config.json` `github.org` | (from `$ARGUMENTS`) | GitHub org for the default queue |
-| `.lisa.config.json` `github.repo` | (from `$ARGUMENTS`) | GitHub repo for the default queue |
+| `.lisa.config.json` `github.repo` | (from `$ARGUMENTS`) | Current code-repo identity and `repo:<current>` scope |
+| `.lisa.config.json` `github.queueRepo` | `github.org/github.repo` | Default GitHub scan repo when no explicit repo/URL is passed |
 | `.lisa.config.json` `github.labels.build.ready` | `status:ready` | The label that signals "human says this is buildable" |
 | `.lisa.config.json` `github.labels.build.claimed` | `status:in-progress` | The label set on pickup |
 | `.lisa.config.json` `github.labels.build.done` | env-keyed map or string | The label set after a successful build; env-aware |

package/plugins/lisa/.codex-plugin/skills/lisa-intake/SKILL.md

@@ -6,7 +6,10 @@ allowed-tools: ["Skill", "Bash", "mcp__claude_ai_Notion__notion-fetch", "mcp__cl
 
 # Intake: $ARGUMENTS
 
-Run one intake cycle against the queue identified by `$ARGUMENTS`. Scans for `Status = Ready`, claims the first eligible item, dispatches it to the appropriate single-item lifecycle skill, then exits. Remaining Ready items are left for later scheduler invocations.
+Run one intake cycle against the queue identified by `$ARGUMENTS`, or by merged GitHub config when
+the repo argument is omitted and a GitHub source/tracker default is resolvable. Scan for
+`Status = Ready`, claim the first eligible item, dispatch it to the appropriate single-item
+lifecycle skill, then exit. Remaining Ready items are left for later scheduler invocations.
 
 For build-queue runs, Intake also accepts an optional `assignee=<vendor-user-id-or-login>` filter.
 Resolution order is:
@@ -22,7 +25,9 @@ as part of this filter.
 
 ## Confirmation policy
 
-Do NOT ask the caller whether to proceed. Once invoked with a queue, run the cycle to completion. The caller (a human at the CLI or a scheduled cron) has already authorized the run by invoking the skill; re-prompting defeats the purpose of a background batch.
+Do NOT ask the caller whether to proceed. Once invoked, resolve the explicit or config-backed queue
+and run the cycle to completion. The caller (a human at the CLI or a scheduled cron) has already
+authorized the run by invoking the skill; re-prompting defeats the purpose of a background batch.
 
 Specifically forbidden:
 
@@ -33,7 +38,8 @@ Specifically forbidden:
 
 The only legitimate reasons to stop early:
 
-- Missing required input (no queue argument, missing project configuration). Surface the missing value and exit.
+- Missing required input (no queue argument **and** no resolvable GitHub default, or missing project
+  configuration). Surface the missing value and exit.
 - The queue itself is misconfigured (Status property missing expected values, JIRA workflow can't reach required transitions). Surface and exit.
 - Empty `Ready` set. Exit cleanly with the idle-case message.
 
@@ -70,7 +76,7 @@ Detect the queue type from `$ARGUMENTS` and route:
 | A full JQL filter (e.g. `project = SE AND component = "frontend"`) | Work queue (JIRA, narrowed) | Invoke `lisa-jira-build-intake` with the JQL |
 | A GitHub **repository** URL or `org/repo` token (e.g. `https://github.com/acme/product-prds` or `acme/product-prds`) when used for **PRDs** | PRD queue (GitHub) | Invoke `lisa-github-prd-intake` (which queries `gh issue list --label prd-ready`, claims the first eligible PRD by relabeling to `prd-in-review`, runs the dry-run validate → branch → write pipeline, then exits). PRD discovery is independent of the destination tracker — the resulting tickets land wherever `.lisa.config.json` `tracker` says. |
 | A GitHub **repository** URL or `org/repo` token when `tracker = github` is configured (build-queue mode) | Work queue (GitHub) | Invoke `lisa-tracker-build-intake` which dispatches to `lisa-github-build-intake` (which queries `gh issue list --label status:ready`, optionally narrows by the resolved assignee filter, claims the first eligible issue via `status:in-progress`, runs `lisa-implement`, relabels to `status:on-dev` on success, then exits). |
-| The literal token `github` | Defaults to `.lisa.config.json` `github.org` / `github.repo`. Routes by **the `intake_mode` flag** in `$ARGUMENTS` (`prd` or `build`); if the flag is absent, prefer the PRD queue when both label namespaces are present, otherwise pick whichever exists. | Invoke the matching skill (`lisa-github-prd-intake` or `lisa-tracker-build-intake`). |
+| The literal token `github` or omitted GitHub repo when merged config resolves a GitHub source/tracker and identity | Routes by **the `intake_mode` flag** in `$ARGUMENTS` (`prd` or `build`). Build mode defaults to merged `github.queueRepo`, then identity `github.org/github.repo`; PRD mode keeps its existing identity source. If the flag is absent, prefer the PRD queue when both label namespaces are present, otherwise pick whichever exists. | Invoke the matching skill (`lisa-github-prd-intake` or `lisa-tracker-build-intake`). |
 
 Disambiguation rules:
 
@@ -80,7 +86,13 @@ Disambiguation rules:
 - A `linear.app` URL → Linear queue. If the path is `/<workspace>` only or `/<workspace>/team/<KEY>/...`, route here. If the path includes `/project/<slug>-<id>` it's a single-PRD URL — direct the caller to `lisa-plan` instead, this skill is batch-only.
 - The literal token `linear` (case-insensitive) → Linear queue, default workspace from `linear.workspace` in `.lisa.config.json`.
 - A `github.com` URL or an `<org>/<repo>` token → GitHub queue. The PRD-vs-build dispatch is determined by which label namespace the repo currently uses: PRD-side (`prd-ready`) → `lisa-github-prd-intake`; build-side (`status:ready` and `tracker = github` in `.lisa.config.json`) → `lisa-tracker-build-intake`. If both namespaces are present, prefer the PRD queue unless `$ARGUMENTS` includes `intake_mode=build`. If the URL points at a single issue (`https://github.com/<org>/<repo>/issues/<n>`), this skill is batch-only — direct the caller to `lisa-plan` (for a single PRD issue) or `lisa-implement` (for a single build issue).
-- The literal token `github` (case-insensitive) → GitHub queue, default repo from `.lisa.config.json` `github.org` / `github.repo`.
+- A GitHub URL or `owner/repo` token is an explicit queue and always wins. The literal token
+  `github` (case-insensitive), or an omitted repo when merged config resolves a GitHub source/tracker
+  and identity, resolves local then global `github.queueRepo`, then identity
+  `github.org/github.repo` **for build dispatch**. Normalize a short queueRepo to `github.org`. PRD
+  dispatch remains on the configured GitHub PRD source. Without an explicit queue or resolvable
+  GitHub default, stop with the missing-input error. Do not use the build queue repo as current-repo
+  identity for `repo:<name>` scoping.
 - A bare alphanumeric token that matches the JIRA project key regex (uppercase letters / digits / hyphen, ≤10 chars — typically the value of `jira.project` in `.lisa.config.json`) is treated as a JIRA project key by default. A token that does not match the regex is treated as a Confluence space key. If it does not resolve as a Confluence space key either, attempt to resolve as a Linear team key via `lisa-linear-access operation: list-teams({query})` before giving up. The only time to stop and ask is when the token resolves to more than one of {JIRA project, Confluence space, Linear team, GitHub `org/repo`} simultaneously — in that overlap the user must disambiguate which queue to scan.
 - An `<org>/<repo>` token (slash-separated, both halves are GitHub-name-shaped) → GitHub queue.
 - A string starting with `project = ` or containing JQL operators (`AND`, `OR`, `=`, `!=`, `~`, etc.) → JQL filter.

package/plugins/lisa/.codex-plugin/skills/lisa-queue-status/SKILL.md

@@ -58,11 +58,14 @@ Render the report in **grouped sections** so operators can scan it top-down with
 For each inspected queue, report:
 
 1. The queue source or tracker Lisa resolved.
-2. Lifecycle counts using the repo's configured role names.
-3. Whether the queue appears `IDLE`, `HEALTHY`, `ATTENTION_NEEDED`, or `MISCONFIGURED`.
-4. Whether the lifecycle namespace appears adopted versus absent.
-5. The oldest or most actionable blocked, in-review, claimed, shipped, or similar stuck items Lisa can surface without mutating work.
-6. A concise remediation hint when attention is needed.
+2. For GitHub, both `Identity repo: <owner/repo>` and `Queue repo: <owner/repo>`, even when equal.
+3. Lifecycle counts using the repo's configured role names. GitHub umbrella-queue build counts
+   must be scoped to `repo:<currentRepo>` from the repo-scoping ladder; the queue repo is never
+   current-repo identity.
+4. Whether the queue appears `IDLE`, `HEALTHY`, `ATTENTION_NEEDED`, or `MISCONFIGURED`.
+5. Whether the lifecycle namespace appears adopted versus absent.
+6. The oldest or most actionable blocked, in-review, claimed, shipped, or similar stuck items Lisa can surface without mutating work.
+7. A concise remediation hint when attention is needed.
 
 The report should stay terminal-first and immediately actionable: observable queue facts first, then the smallest useful next step.
 
@@ -92,6 +95,11 @@ Queue sections should stay visually grouped. Do not interleave PRD and build fac
 ## Runtime and vendor expectations
 
 - Reuse the same config-resolution defaults and queue-routing rules that `intake` and `repair-intake` use.
+- For GitHub, resolve an explicit repo/URL first, then merged `github.queueRepo`, then
+  `github.org/github.repo`; accept a short queueRepo by normalizing it to `github.org`.
+- Pass the contract's `currentRepo` into `readGithubBuildQueueSnapshot`; lifecycle counts include
+  only `repo:<current>` work. Report its `unscopedCount` / `unscopedCandidates` separately because
+  intake still needs to determine and stamp unlabeled work; exclude sibling-only issues.
 - Work from the current repo's `.lisa.config.json` instead of hardcoding one vendor's lifecycle names.
 - Support the vendor families already served by Lisa intake: GitHub, Linear, JIRA, Notion, and Confluence.
 - If a queue cannot be resolved or its lifecycle namespace has not been adopted, report that explicitly as `MISCONFIGURED` rather than pretending the queue is empty.

package/plugins/lisa/.codex-plugin/skills/lisa-repair-intake/SKILL.md

@@ -6,7 +6,8 @@ allowed-tools: ["Skill", "Bash", "Read", "Write", "Edit"]
 
 # Repair Intake: $ARGUMENTS
 
-Run one batch-**repair** cycle against the queue identified by `$ARGUMENTS`. Where `lisa-intake`
+Run one batch-**repair** cycle against the queue identified by `$ARGUMENTS`, or by merged GitHub
+config when the queue is omitted and a GitHub source/tracker default is resolvable. Where `lisa-intake`
 scans the `ready` role and moves work *forward*, repair-intake scans the **stuck and
 close-out** roles and moves work *unstuck* or *fully closed*:
 
@@ -73,22 +74,24 @@ lifecycle state with provider-native closure and rollup state.
 ## Public contract
 
 ```text
-/lisa:repair-intake <queue> [intake_mode=prd|build|both] [stale_after=2h] [max_candidates=100] [force=true]
+/lisa:repair-intake [<queue>] [intake_mode=prd|build|both] [build_queue=owner/repo] [stale_after=2h] [max_candidates=100] [force=true]
 ```
 
 | Token | Meaning | Default |
 |-------|---------|---------|
-| `<queue>` | Same queue identifier `lisa-intake` accepts (see Source dispatch). Required. | — |
+| `<queue>` | Same queue identifier `lisa-intake` accepts (see Source dispatch). Optional only when merged config resolves a GitHub source/tracker and identity; otherwise required. | merged GitHub default when resolvable |
 | `intake_mode` | `prd` \| `build` \| `both`. Only meaningful for a GitHub `org/repo` (or bare `github`) that hosts both PRD and build label namespaces. `both` is unique to repair — a repair sweep usefully covers both lifecycles in one schedule. Absent → `both` when both namespaces exist, else whichever lifecycle exists. | `both` for dual GitHub queues; otherwise infer |
+| `build_queue` | GitHub build scan target used with literal `github`, especially `intake_mode=both`. Explicit `owner/repo` or URL for a build-only invocation wins over this token; otherwise this wins over `github.queueRepo`. It never redirects the PRD scan. | `github.queueRepo`, then `github.org/github.repo` |
 | `stale_after` | How long since the last state-changing transition into the in-progress role, or since the last human / PR-side forward-progress activity, before an in-progress item counts as stalled. Automation self-comments do not reset this clock. Accepts `24h`, `90m`, `2d`, or `0` (treat any in-progress item as stalled — manual recovery, also the only way to resume work on a provider that exposes no reliable timestamp). Overrides config. | `2h` |
 | `max_candidates` | Cap on how many stuck/close-out candidates to enumerate and evaluate. Repair every materially actionable candidate within this bounded set, then stop. Overrides config. | `100` |
 | `force` | `true` bypasses the loop-prevention backoff window (so a manual re-run re-attempts items even if their fingerprint is unchanged). It does **not** change the staleness rule — use `stale_after=0` for that. | `false` |
 
 ## Confirmation policy
 
-Do NOT ask the caller whether to proceed. Once invoked with a queue, run the cycle to
-completion. The caller (a human at the CLI or a scheduled cron) has already authorized the run
-by invoking the skill; re-prompting defeats the purpose of a background repair sweep.
+Do NOT ask the caller whether to proceed. Once invoked, resolve the explicit or config-backed
+queue and run the cycle to completion. The caller (a human at the CLI or a scheduled cron) has
+already authorized the run by invoking the skill; re-prompting defeats the purpose of a
+background repair sweep.
 
 Specifically forbidden:
 
@@ -105,8 +108,8 @@ Specifically forbidden:
 
 The only legitimate reasons to stop early:
 
-- Missing required input (no queue argument, missing project configuration). Surface the
-  missing value and exit.
+- Missing required input (no queue argument **and** no resolvable GitHub default, or missing
+  project configuration). Surface the missing value and exit.
 - The queue itself is misconfigured (Status property missing expected values, JIRA workflow
   can't reach required transitions). Surface and exit.
 - No stuck/close-out candidates, or none actionable this cycle. Exit cleanly with the idle-case
@@ -142,7 +145,7 @@ claim-and-advance). The essentials, inlined here so this skill is self-complete:
 | GitHub **repo** URL / `org/repo` (PRD namespace) | PRD (GitHub) | source=github | `in_review`, `blocked`, terminal/open PRDs, missing PRD child links, all-terminal generated-work rollups |
 | GitHub **repo** URL / `org/repo` with `tracker = github` (build namespace) | Build (GitHub) | tracker=github | `claimed`, `blocked`, terminal/open issues, parent rollups (intermediate-env + all-terminal), stale-`ready` containers |
 | GitHub **repo** URL / `org/repo` with an open issue missing configured lifecycle labels | GitHub label normalization | per classified lifecycle | add configured `prd.ready` or build `ready` |
-| Literal `github` | GitHub; route by `intake_mode` (`prd` / `build` / `both`) | per lifecycle | per lifecycle above, plus GitHub ready-label normalization |
+| Literal `github` or omitted GitHub repo when merged config resolves a GitHub source/tracker and identity | GitHub; PRD scans identity, build scans `build_queue` → merged `github.queueRepo` → identity; `both` runs those two lane-specific targets | per lifecycle | per lifecycle above, plus GitHub ready-label normalization |
 | JIRA project key or full JQL | Build (JIRA) | tracker=jira | `claimed`, `blocked`, terminal/closure verification, parent rollups (intermediate-env + all-terminal), stale-`ready` containers |
 
 Disambiguation (same as `lisa-intake`): a `notion.so`/`notion.site` URL → Notion; an Atlassian
@@ -153,6 +156,17 @@ token / literal `github` → GitHub; a bare token matching the JIRA project-key
 URL is out of scope** — this skill is batch-only; repair one item by hand via `lisa-implement`
 (build) or by re-running `lisa:<source>-to-tracker` (PRD).
 
+For GitHub `intake_mode=build` (a build-only invocation), an explicit URL or `owner/repo` wins;
+otherwise resolve `build_queue`, then local/global `github.queueRepo`, falling back to
+`github.org/github.repo`. For `intake_mode=both`, the primary `<queue>` is the PRD identity/source
+repo and `build_queue` controls the build lane, falling back through `github.queueRepo` to identity.
+A short queueRepo is normalized to `github.org`. Thus `both` is a bounded split scan: PRD candidates
+at the primary identity queue, build candidates at the resolved build queue, combined into one
+summary. Never apply both lifecycle namespaces to the umbrella repo merely because
+`github.queueRepo` is set. Repository identity remains distinct and continues to drive
+`repo:<current>` filtering, writes, and automation names. If neither an explicit queue nor a
+resolvable merged GitHub default exists, stop with the missing-input error.
+
 Role names for every vendor are resolved from `.lisa.config.json` per the `config-resolution`
 rule — never hardcode status/label strings. The relevant repair roles:
 
@@ -968,7 +982,7 @@ bucket and show compact refs plus counts.
 /schedule "every 2 hours" /lisa:repair-intake https://linear.app/acme
 /schedule "every 2 hours" /lisa:repair-intake acme/product-prds
 /schedule "every 2 hours" /lisa:repair-intake acme/frontend-v2 intake_mode=build
-/schedule "every 2 hours" /lisa:repair-intake github intake_mode=both
+/schedule "every 2 hours" /lisa:repair-intake acme/frontend intake_mode=both build_queue=acme/planning
 /schedule "every 4 hours" /lisa:repair-intake SE stale_after=12h
 /lisa:repair-intake SE stale_after=0 force=true        # manual: treat all in-progress as stalled, ignore backoff
 ```

package/plugins/lisa/.codex-plugin/skills/lisa-setup-automations/SKILL.md

@@ -59,9 +59,9 @@ report the exact conflicting path(s).
 
 | Automation | Command it runs | Cadence |
 |---|---|---|
-| **intake-repair** | `/lisa:repair-intake <queue>` | every **60 minutes** |
-| **intake-prd** | `/lisa:intake <PRD queue>` (e.g. `github intake_mode=prd`) | every **60 minutes** |
-| **intake-tickets** | `/lisa:intake <build queue>` (e.g. `github intake_mode=build`) | every **10 minutes** |
+| **intake-repair** | `/lisa:repair-intake <resolved repair queue>` (GitHub self-host example: `acme/frontend intake_mode=both build_queue=acme/planning`) | every **60 minutes** |
+| **intake-prd** | `/lisa:intake <PRD queue>` (e.g. `acme/frontend intake_mode=prd`) | every **60 minutes** |
+| **intake-tickets** | `/lisa:intake <build queue>` (e.g. `acme/planning intake_mode=build`) | every **10 minutes** |
 | **exploratory-bugs** | `/lisa-<stack>:exploratory-qa ready=<auto-start-tickets>` | **once a day** |
 | **exploratory-prds** | `/lisa:project-ideation prd_ready=<auto-start-prds>` | **once a day** |
 | **monitor** | `/lisa:monitor` | **once a day** |
@@ -75,10 +75,15 @@ lifecycle when the PRD queue has capacity," not "always create a new ready PRD."
 `/lisa:queue-status`; if pressure exists, the cycle should report the blocking role/ref and the
 smallest next action, usually `/lisa:intake <PRD queue>`, without invoking research or writing a PRD.
 
-**Queue resolution.** Resolve the intake/repair queue from `.lisa.config.json` — `source` for the
-PRD queue, `tracker` for the build queue (for the common GitHub case these are `github
-intake_mode=prd` and `github intake_mode=build`, matching how the existing Lisa intake automations
-are written).
+**Queue resolution.** Resolve the intake/repair queue from merged config — `source` for the PRD
+queue, `tracker` for the build queue. For GitHub, the PRD command uses canonical identity
+`github.org/github.repo`; the build command resolves `github.queueRepo` and falls back to that
+identity. Keep automation naming tied to the identity repo. Bake every resolved `owner/repo` into
+the scheduled commands (for example `/lisa:intake acme/frontend intake_mode=prd`,
+`/lisa:intake acme/planning intake_mode=build`, and
+`/lisa:repair-intake acme/frontend intake_mode=both build_queue=acme/planning`) so a later
+config/read-context failure cannot silently redirect the cron. A short queueRepo is normalized to
+`github.org` before writing the automation.
 
 **Naming + scope (so teardown is precise).** Name each automation with the stable prefix
 `lisa-auto-<project>-` (e.g. `lisa-auto-<project>-intake-tickets`), where `<project>` identifies this

package/plugins/lisa/.codex-plugin/skills/lisa-setup-github/SKILL.md

@@ -79,6 +79,23 @@ gh repo view "$ORG/$REPO" --json name,viewerPermission \
 
 If permission is `READ` / `TRIAGE`, stop — lisa cannot create labels or issues. Surface and exit.
 
+### Step 2b — Choose the queue repository
+
+When GitHub is selected as the destination tracker, initialize the choice from an existing
+`github.queueRepo`, or `$ORG/$REPO` when absent, then ask whether the build backlog lives there, in
+the identity repo, or in another umbrella/planning repo. If the user gives an umbrella repo, accept a short name by normalizing it to `$ORG/<name>` or accept a full
+`owner/repo`, then verify it is reachable and the authenticated identity can manage the lifecycle
+labels Lisa needs:
+
+```bash
+gh repo view "$QUEUE_ORG/$QUEUE_REPO" --json name,viewerPermission \
+  --jq 'if (.viewerPermission | IN("ADMIN","MAINTAIN","WRITE")) then "ok" else error("insufficient permission: \(.viewerPermission)") end'
+```
+
+Store `github.queueRepo` only when the canonical queue `owner/repo` differs from `$ORG/$REPO`.
+This choice changes queue scans, not repository identity: `github.repo`, `repo:<current>` claim
+scoping, issue destinations, and automation naming remain tied to the identity/tracker repo.
+
 ### Step 3 — Scaffold the lifecycle label namespaces
 
 Read role → label mappings with the same default-fallback ladder the intake skills use, so the labels created here exactly match what they look for. Only the namespaces selected in Step 0 are scaffolded.
@@ -92,12 +109,13 @@ read_role() {  # $1=namespace (build|prd) $2=role $3=default
 }
 
 # Idempotent label creator: create if missing, leave untouched if present.
+# LABEL_ORG/LABEL_REPO select the repo for the namespace being scaffolded.
 ensure_label() {  # $1=name $2=hex-color $3=description
   local name="$1" color="$2" desc="$3"
-  if gh label list --repo "$ORG/$REPO" --limit 200 --json name --jq '.[].name' | grep -qxF "$name"; then
+  if gh label list --repo "$LABEL_ORG/$LABEL_REPO" --limit 200 --json name --jq '.[].name' | grep -qxF "$name"; then
     echo "  = $name (exists)"
   else
-    gh label create "$name" --repo "$ORG/$REPO" --color "$color" --description "$desc" \
+    gh label create "$name" --repo "$LABEL_ORG/$LABEL_REPO" --color "$color" --description "$desc" \
       && echo "  + $name (created)"
   fi
 }
@@ -108,6 +126,8 @@ ensure_label() {  # $1=name $2=hex-color $3=description
 Defaults from `config-resolution`. The `done` role is **env-keyed** — create all three by default; a project whose terminal state is env-independent can later collapse `github.labels.build.done` to a single string.
 
 ```bash
+LABEL_ORG="$QUEUE_ORG"
+LABEL_REPO="$QUEUE_REPO"
 ensure_label "$(read_role build ready    status:ready)"        FBCA04 "Ready for build (human signal)"
 ensure_label "$(read_role build claimed  status:in-progress)"  0E8A16 "Build in progress (agent owns)"
 ensure_label "$(read_role build blocked  status:blocked)"      D93F0B "Blocked — human attention required"
@@ -119,6 +139,8 @@ ensure_label "$(read_role build done.production status:done)"   0E8A16 "Shipped
 #### 3b. PRD-lifecycle labels (only if GitHub is the PRD source)
 
 ```bash
+LABEL_ORG="$ORG"
+LABEL_REPO="$REPO"
 ensure_label "$(read_role prd draft     prd-draft)"            C5DEF5 "PRD in progress (product owns)"
 ensure_label "$(read_role prd ready     prd-ready)"            FBCA04 "PRD ready for ticketing"
 ensure_label "$(read_role prd in_review prd-in-review)"        5319E7 "Claude is reviewing this PRD"
@@ -145,6 +167,19 @@ jq --arg org "$ORG" --arg repo "$REPO" \
    '.github = ((.github // {}) | .org = $org | .repo = $repo)' \
    .lisa.config.json > .lisa.config.json.tmp && mv .lisa.config.json.tmp .lisa.config.json
 
+# Queue repo is canonical owner/repo and omitted for the identity/default case.
+# A source-only setup rerun preserves any existing build-queue choice.
+if [ "$GITHUB_TRACKER_SELECTED" = "true" ]; then
+  if [ "$QUEUE_ORG/$QUEUE_REPO" = "$ORG/$REPO" ]; then
+    jq 'del(.github.queueRepo)' .lisa.config.json > .lisa.config.json.tmp \
+      && mv .lisa.config.json.tmp .lisa.config.json
+  else
+    jq --arg queue "$QUEUE_ORG/$QUEUE_REPO" '.github.queueRepo = $queue' \
+      .lisa.config.json > .lisa.config.json.tmp \
+      && mv .lisa.config.json.tmp .lisa.config.json
+  fi
+fi
+
 # Conditionally write label overrides (only roles the user mapped to non-default names).
 # $LABEL_OVERRIDES_JSON is e.g. {"build":{"ready":"ready-for-dev"}} — {} if all defaults.
 if [ -n "$LABEL_OVERRIDES_JSON" ] && [ "$LABEL_OVERRIDES_JSON" != "{}" ]; then
@@ -198,8 +233,24 @@ Both are project-wide switches that change every downstream skill's default —
 
 ```bash
 jq -e '.github.org and .github.repo' .lisa.config.json >/dev/null
+EFFECTIVE_ORG=$(jq -r '.github.org // empty' .lisa.config.local.json 2>/dev/null)
+EFFECTIVE_ORG=${EFFECTIVE_ORG:-$(jq -r '.github.org' .lisa.config.json)}
+EFFECTIVE_REPO=$(jq -r '.github.repo // empty' .lisa.config.local.json 2>/dev/null)
+EFFECTIVE_REPO=${EFFECTIVE_REPO:-$(jq -r '.github.repo' .lisa.config.json)}
+QUEUE_VALUE=$(jq -r '.github.queueRepo // empty' .lisa.config.local.json 2>/dev/null)
+QUEUE_VALUE=${QUEUE_VALUE:-$(jq -r '.github.queueRepo // empty' .lisa.config.json)}
+if [ -z "$QUEUE_VALUE" ]; then
+  QUEUE_REF="$EFFECTIVE_ORG/$EFFECTIVE_REPO"
+elif [[ "$QUEUE_VALUE" == */* ]]; then
+  QUEUE_REF="$QUEUE_VALUE"
+else
+  QUEUE_REF="$EFFECTIVE_ORG/$QUEUE_VALUE"
+fi
+gh repo view "$QUEUE_REF" --json nameWithOwner --jq .nameWithOwner
 gh label list --repo "$ORG/$REPO" --limit 200 --json name --jq '.[].name' \
-  | grep -E 'status:|prd-' || true   # show the scaffolded namespaces
+  | grep -E 'prd-' || true
+gh label list --repo "$QUEUE_REF" --limit 200 --json name --jq '.[].name' \
+  | grep -E 'status:' || true
 ```
 
 If `github.projects.v2` is configured, setup verification MUST also run the shared Project utility in

package/plugins/lisa/rules/reference/config-resolution.md

@@ -272,6 +272,7 @@ Each vendor section is **conditionally required**: required only when that vendo
 |-------|---------------|-------|
 | `github.org` | `tracker = "github"` or `source = "github"` or any `github-*` skill is invoked | GitHub organization or user name. |
 | `github.repo` | same as above | GitHub repository name. |
+| `github.queueRepo` | no | Optional GitHub **build** queue repository, distinct from this repo's identity and PRD source. Store the canonical `owner/repo`. A short repo name is accepted at runtime and normalized to `github.org`. Explicit GitHub repo/URL arguments always win; otherwise GitHub build intake, build repair, build queue status, and scheduled ticket commands use this value, falling back to `github.org/github.repo` when absent. This never changes `repo:<name>` scoping, PRD intake, or automation naming, which remain tied to `repo` / `github.repo`. |
 | `github.projects.v2.owner.kind` | GitHub Project coordination is enabled | Owner type for the shared ProjectV2. Supported values are `organization` and `user`. |
 | `github.projects.v2.owner.slug` | GitHub Project coordination is enabled | Owner login for the shared ProjectV2. In v1 it MUST match the tracked repository namespace (`github.org`); cross-namespace coordination is rejected. |
 | `github.projects.v2.number` | GitHub Project coordination is enabled | Human-facing ProjectV2 number from the GitHub UI / URL. Later utilities resolve the opaque node id from this owner + number pair. |
@@ -285,6 +286,13 @@ Each vendor section is **conditionally required**: required only when that vendo
 
 When `tracker = "github"` AND `source = "github"` (self-host), both reads and writes hit the same GitHub repo. Label namespaces are kept separate so the two flows don't collide — see "Self-host edge case" below.
 
+When `github.queueRepo` points at an umbrella repository, build-queue **scans** happen there while the
+current repository's identity remains `github.org/github.repo`. Resolve a GitHub queue in this
+order for a build-mode scan: explicit `owner/repo` or GitHub URL argument, merged-config `github.queueRepo`, then
+`github.org/github.repo`. Queue status must show both identity and queue; build counts and claims
+remain filtered to `repo:<github.repo>`. Setup writes the canonical `owner/repo` form and omits the
+key when the queue is the identity repo.
+
 `github.projects.v2` is optional. When absent, GitHub issue / PR writes remain repository-local exactly as they work today. When present, the shared Project is a coordination view layered on top of real issues and pull requests; it does not replace lifecycle labels, comments, dependencies, or native issue / PR state as Lisa's durable source of truth.
 
 When `github.projects.v2` is present, later setup/doctor and writer preflight validation MUST read the referenced Project's owner + access level before any membership write depends on it. The validation contract is:

package/plugins/lisa/scripts/automation-status-expected-fleet.mjs

@@ -10,6 +10,7 @@
 
 import {
   resolveBuildQueueArgument,
+  resolveGithubQueueRepoRef,
   resolveGithubRepoRef,
   resolvePrdQueueArgument,
   resolvePrdSource,
@@ -119,9 +120,32 @@ export function resolveExpectedAutomationFleet(input = {}) {
 
   const tracker = config.tracker;
   const source = resolvePrdSource(config);
-  const prdQueue = resolvePrdQueueArgument(config, source);
-  const buildQueue = resolveBuildQueueArgument(config, tracker);
-  const repairQueue = resolveRepairQueueArgument(config, source, tracker);
+  const explicitGithubIdentity = `${identity.owner}/${identity.repo}`;
+  const githubQueue =
+    tracker === "github"
+      ? resolveGithubQueueRepoRef(config, {
+          gitRemoteUrl: input.gitRemoteUrl,
+        })
+      : null;
+  const explicitGithubQueue = githubQueue
+    ? `${githubQueue.owner}/${githubQueue.repo}`
+    : undefined;
+  const prdQueue =
+    source === "github"
+      ? `${explicitGithubIdentity} intake_mode=prd`
+      : resolvePrdQueueArgument(config, source);
+  const buildQueue = resolveBuildQueueArgument(config, tracker, {
+    explicitQueue: tracker === "github" ? explicitGithubQueue : undefined,
+    gitRemoteUrl: input.gitRemoteUrl,
+  });
+  const repairQueue = resolveRepairQueueArgument(
+    config,
+    source,
+    tracker,
+    explicitGithubIdentity,
+    explicitGithubQueue,
+    buildQueue
+  );
 
   const expected = [
     createExpectedEntry(
@@ -237,10 +261,17 @@ function createUnsupportedEntry(identity, id, reason) {
  * @param {string | undefined} tracker
  * @returns {string}
  */
-function resolveRepairQueueArgument(config, source, tracker) {
+function resolveRepairQueueArgument(
+  config,
+  source,
+  tracker,
+  explicitGithubIdentity,
+  explicitGithubQueue,
+  resolvedBuildQueue
+) {
   if (tracker === "github" && source === "github") {
     requireGithubRepo(config);
-    return "github intake_mode=both";
+    return `${explicitGithubIdentity} intake_mode=both build_queue=${explicitGithubQueue}`;
   }
 
   if (tracker === "linear" && source === "linear") {
@@ -260,13 +291,12 @@ function resolveRepairQueueArgument(config, source, tracker) {
 
   if (tracker === "github" && source === undefined) {
     requireGithubRepo(config);
-    return "github intake_mode=both";
+    return `${explicitGithubIdentity} intake_mode=both build_queue=${explicitGithubQueue}`;
   }
 
-  const buildQueue = resolveBuildQueueArgument(config, tracker);
-  return buildQueue.includes("intake_mode=")
-    ? buildQueue
-    : `${buildQueue} intake_mode=build`;
+  return resolvedBuildQueue.includes("intake_mode=")
+    ? resolvedBuildQueue
+    : `${resolvedBuildQueue} intake_mode=build`;
 }
 
 /**

package/plugins/lisa/scripts/queue-contract-resolution.mjs

@@ -173,12 +173,17 @@ export function resolvePrdQueueArgument(
  */
 export function resolveBuildQueueArgument(
   config = {},
-  tracker = resolveBuildTracker(config)
+  tracker = resolveBuildTracker(config),
+  options = {}
 ) {
   switch (tracker) {
-    case "github":
-      requireGithubRepo(config);
+    case "github": {
+      const queue = resolveGithubQueueRepoRef(config, options);
+      if (options.explicitQueue || config.github?.queueRepo) {
+        return `${queue.owner}/${queue.repo} intake_mode=build`;
+      }
       return "github intake_mode=build";
+    }
     case "linear":
       requireLinearWorkspace(config);
       return "linear";
@@ -340,6 +345,14 @@ export function resolveQueueContract(input = {}) {
   const source = resolvePrdSource(config);
   const tracker = resolveBuildTracker(config);
 
+  const githubIdentity = resolveGithubRepoRef(config, input.gitRemoteUrl);
+  const githubQueue =
+    tracker === "github"
+      ? resolveGithubQueueRepoRef(config, {
+          gitRemoteUrl: input.gitRemoteUrl,
+        })
+      : null;
+
   return {
     currentRepo: resolveCurrentRepo(input),
     source,
@@ -349,7 +362,15 @@ export function resolveQueueContract(input = {}) {
       ...resolvePrdLifecycleRoles(config, source),
     },
     buildQueue: {
-      argument: resolveBuildQueueArgument(config, tracker),
+      argument: resolveBuildQueueArgument(config, tracker, {
+        gitRemoteUrl: input.gitRemoteUrl,
+      }),
+      ...(tracker === "github"
+        ? {
+            identityRepo: `${githubIdentity.owner}/${githubIdentity.repo}`,
+            queueRepo: `${githubQueue.owner}/${githubQueue.repo}`,
+          }
+        : {}),
       ...resolveBuildLifecycleRoles(config, tracker),
     },
   };
@@ -408,6 +429,54 @@ export function resolveGithubRepoRef(config = {}, gitRemoteUrl) {
   return null;
 }
 
+/**
+ * Resolve the GitHub queue without changing the repository identity used
+ * for automation names and `repo:<name>` claim scoping. An explicit invocation
+ * target wins, followed by `github.queueRepo`, then the identity repo.
+ *
+ * `github.queueRepo` may be a short repo name (normalized to the identity
+ * owner) or an `owner/repo` reference. Cross-owner queues therefore remain
+ * explicit while the common same-organization umbrella layout stays concise.
+ *
+ * @param {Record<string, any>} config
+ * @param {{ readonly explicitQueue?: string, readonly gitRemoteUrl?: string }} [options]
+ * @returns {{ readonly owner: string, readonly repo: string }}
+ */
+export function resolveGithubQueueRepoRef(config = {}, options = {}) {
+  const identity = resolveGithubRepoRef(config, options.gitRemoteUrl);
+  if (!identity) {
+    throw new Error(
+      "Unable to resolve the GitHub repository identity: github.org/github.repo or a GitHub origin remote is required."
+    );
+  }
+
+  const configured = options.explicitQueue ?? config.github?.queueRepo;
+  if (configured === undefined || configured === null || configured === "") {
+    return identity;
+  }
+  if (typeof configured !== "string") {
+    throw new Error(
+      "Unable to resolve the GitHub queue: github.queueRepo must be a repo name or owner/repo."
+    );
+  }
+
+  const value = configured
+    .trim()
+    .replace(/^https:\/\/github\.com\//i, "")
+    .replace(/\.git$/i, "");
+  const parts = value.split("/").filter(Boolean);
+  if (parts.length === 1) {
+    return { owner: identity.owner, repo: parts[0] };
+  }
+  if (parts.length === 2) {
+    return { owner: parts[0], repo: parts[1] };
+  }
+
+  throw new Error(
+    "Unable to resolve the GitHub queue: github.queueRepo must be a repo name or owner/repo."
+  );
+}
+
 /**
  * @param {string | undefined} gitRemoteUrl
  * @returns {string | null}