@codyswann/lisa 2.226.0 → 2.226.2

package/package.json

@@ -102,7 +102,7 @@
     "form-data": ">=4.0.6"
   },
   "name": "@codyswann/lisa",
-  "version": "2.226.0",
+  "version": "2.226.2",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.226.0",
+  "version": "2.226.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.226.0",
+  "version": "2.226.2",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/scripts/install-remote-agent-aws.mjs

@@ -98,9 +98,17 @@ function installCopilotAdapter(project) {
   );
   mkdirSync(path.dirname(workflowPath), { recursive: true });
   const marker = "Lisa remote AWS bootstrap";
+  const secretEnvironment =
+    "          LISA_AWS_BOOTSTRAP_JSON: ${{ secrets.LISA_AWS_BOOTSTRAP_JSON }}";
+  const checkoutStep = [
+    "      - uses: actions/checkout@v4",
+    "        with:",
+    "          persist-credentials: false",
+  ].join("\n");
   const step = [
     `      - name: ${marker}`,
     "        env:",
+    secretEnvironment,
     "          LISA_REMOTE_AGENT: copilot",
     `        run: ${INSTALL_COMMAND}`,
   ].join("\n");
@@ -118,7 +126,7 @@ function installCopilotAdapter(project) {
         "    permissions:",
         "      contents: read",
         "    steps:",
-        "      - uses: actions/checkout@v4",
+        checkoutStep,
         step,
         "",
       ].join("\n")
@@ -127,7 +135,6 @@ function installCopilotAdapter(project) {
   }
 
   const current = readFileSync(workflowPath, "utf8");
-  if (current.includes(marker)) return path.relative(project, workflowPath);
   const lines = current.split("\n");
   const jobIndex = lines.findIndex(line =>
     /^\s{2}copilot-setup-steps:\s*$/.test(line)
@@ -146,10 +153,95 @@ function installCopilotAdapter(project) {
       "Existing copilot-setup-steps.yml must contain jobs.copilot-setup-steps.steps before Lisa can merge the AWS bootstrap step"
     );
   }
-  const additions = current.includes("actions/checkout@")
-    ? [step]
-    : ["      - uses: actions/checkout@v4", step];
-  lines.splice(stepsIndex + 1, 0, ...additions);
+
+  let changed = false;
+  const checkoutIndex = lines.findIndex(
+    (line, index) =>
+      index > stepsIndex &&
+      (jobEndIndex < 0 || index < jobEndIndex) &&
+      /^\s{6}-\s+uses:\s+actions\/checkout@/.test(line)
+  );
+  if (checkoutIndex >= 0) {
+    const nextStepIndex = lines.findIndex(
+      (line, index) => index > checkoutIndex && /^\s{6}-\s/.test(line)
+    );
+    const checkoutEnd = nextStepIndex < 0 ? lines.length : nextStepIndex;
+    const withIndex = lines.findIndex(
+      (line, index) =>
+        index > checkoutIndex &&
+        index < checkoutEnd &&
+        /^\s{8}with:\s*$/.test(line)
+    );
+    const persistenceIndex = lines.findIndex(
+      (line, index) =>
+        index > checkoutIndex &&
+        index < checkoutEnd &&
+        /^\s{10}persist-credentials:\s*/.test(line)
+    );
+    if (persistenceIndex >= 0) {
+      if (lines[persistenceIndex] !== "          persist-credentials: false") {
+        lines[persistenceIndex] = "          persist-credentials: false";
+        changed = true;
+      }
+    } else if (withIndex >= 0) {
+      lines.splice(withIndex + 1, 0, "          persist-credentials: false");
+      changed = true;
+    } else {
+      lines.splice(
+        checkoutIndex + 1,
+        0,
+        "        with:",
+        "          persist-credentials: false"
+      );
+      changed = true;
+    }
+  }
+
+  const markerIndex = lines.findIndex(line => line.includes(marker));
+  if (markerIndex >= 0) {
+    const nextStepIndex = lines.findIndex(
+      (line, index) => index > markerIndex && /^\s{6}-\s/.test(line)
+    );
+    const managedStepEnd = nextStepIndex < 0 ? lines.length : nextStepIndex;
+    const managedStep = lines.slice(markerIndex, managedStepEnd);
+    if (!managedStep.includes(secretEnvironment)) {
+      const environmentIndex = lines.findIndex(
+        (line, index) =>
+          index > markerIndex &&
+          index < managedStepEnd &&
+          /^\s{8}env:\s*$/.test(line)
+      );
+      if (environmentIndex < 0) {
+        throw new Error(
+          "Existing Lisa remote AWS bootstrap step must contain an env block"
+        );
+      }
+      lines.splice(environmentIndex + 1, 0, secretEnvironment);
+      changed = true;
+    }
+    if (checkoutIndex < 0) {
+      lines.splice(stepsIndex + 1, 0, ...checkoutStep.split("\n"));
+      changed = true;
+    }
+    if (changed) writeFileSync(workflowPath, lines.join("\n"));
+    return path.relative(project, workflowPath);
+  }
+  const additions = checkoutIndex >= 0 ? [step] : [checkoutStep, step];
+  const nextCheckoutStepIndex = lines.findIndex(
+    (line, index) => index > checkoutIndex && /^\s{6}-\s/.test(line)
+  );
+  const updatedJobEndIndex = lines.findIndex(
+    (line, index) => index > jobIndex && /^\s{2}\S[^:]*:\s*$/.test(line)
+  );
+  const additionIndex =
+    checkoutIndex < 0
+      ? stepsIndex + 1
+      : nextCheckoutStepIndex >= 0
+        ? nextCheckoutStepIndex
+        : updatedJobEndIndex >= 0
+          ? updatedJobEndIndex
+          : lines.length;
+  lines.splice(additionIndex, 0, ...additions);
   writeFileSync(workflowPath, lines.join("\n"));
   return path.relative(project, workflowPath);
 }
@@ -161,13 +253,20 @@ function writeGuide(project, platform, secretName) {
     guidePath,
     `# Remote coding-agent AWS access
 
+## Context
+
 This repository uses Lisa's vendor-neutral AWS bootstrap. Configure the complete
 Secrets Manager SecretString as the secret \`LISA_AWS_BOOTSTRAP_JSON\`; do not
 split it into \`AWS_ACCESS_KEY_ID\` and \`AWS_SECRET_ACCESS_KEY\` environment
 variables. The setup script writes a named source profile whose only permission
 is \`sts:AssumeRole\`, then creates automatically refreshed role profiles.
 
-## Runtime configuration
+## Goal
+
+Give supported remote coding agents renewable, least-privilege AWS CLI access
+without borrowing a developer identity or granting direct production repair.
+
+## Changes
 
 | Runtime | Setup |
 |---|---|
@@ -180,7 +279,7 @@ is \`sts:AssumeRole\`, then creates automatically refreshed role profiles.
 
 Generated for: \`${platform}\`.
 
-## Profiles
+## Implementation
 
 The bootstrap bundle defines the available profile names. \`dev\` is the
 default when present. Select another account explicitly, for example:
@@ -193,8 +292,6 @@ aws --profile production cloudformation describe-stacks
 Production and shared profiles are observer-only. Production repair remains a
 human-driven local-workstation operation.
 
-## Administrator rollout
-
 After the infrastructure pipeline deploys the remote-agent IAM stacks, retrieve
 the complete bundle from the shared account. Do not extract or distribute its
 individual access-key fields:
@@ -210,6 +307,8 @@ Store that exact output as the masked secret \`LISA_AWS_BOOTSTRAP_JSON\` on each
 remote-agent platform. Run the setup command and require its live
 \`sts:GetCallerIdentity\` check to pass before considering the platform ready.
 
+## Notes
+
 Rotate by replacing the bootstrap IAM access key through infrastructure and
 then updating this one secret on every configured platform. Disabling or
 deleting the bootstrap user immediately prevents new role sessions.

package/plugins/lisa/scripts/remote-agent-aws-setup.sh

@@ -14,6 +14,7 @@ set -euo pipefail
 umask 077
 
 BOOTSTRAP_PROFILE="lisa-remote-agent-bootstrap"
+AWS_CLI_VERSION="2.36.2"
 
 fail() {
   echo "remote-agent-aws-setup: $*" >&2
@@ -35,17 +36,17 @@ as_root() {
 }
 
 install_base_tools() {
-  need curl && need unzip && need jq && return 0
+  need curl && need unzip && need jq && need gpg && return 0
 
   if need apt-get; then
     as_root apt-get update -y
-    as_root apt-get install -y curl unzip jq
+    as_root apt-get install -y curl unzip jq gnupg
   elif need dnf; then
-    as_root dnf install -y curl unzip jq
+    as_root dnf install -y curl unzip jq gnupg2
   elif need yum; then
-    as_root yum install -y curl unzip jq
+    as_root yum install -y curl unzip jq gnupg2
   else
-    fail "install curl, unzip, and jq in the remote image before running this script"
+    fail "install curl, unzip, jq, and gpg in the remote image before running this script"
   fi
 }
 
@@ -62,9 +63,49 @@ install_aws_cli() {
 
   temporary_directory="$(mktemp -d)"
   trap 'rm -rf "${temporary_directory:-}"' EXIT
+  local installer_url
+  installer_url="https://awscli.amazonaws.com/awscli-exe-linux-${aws_architecture}-${AWS_CLI_VERSION}.zip"
   curl -fsSL \
-    "https://awscli.amazonaws.com/awscli-exe-linux-${aws_architecture}.zip" \
+    "$installer_url" \
     -o "$temporary_directory/awscliv2.zip"
+  curl -fsSL "$installer_url.sig" -o "$temporary_directory/awscliv2.sig"
+  cat >"$temporary_directory/aws-cli-public-key.asc" <<'AWS_CLI_PUBLIC_KEY'
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBF2Cr7UBEADJZHcgusOJl7ENSyumXh85z0TRV0xJorM2B/JL0kHOyigQluUG
+ZMLhENaG0bYatdrKP+3H91lvK050pXwnO/R7fB/FSTouki4ciIx5OuLlnJZIxSzx
+PqGl0mkxImLNbGWoi6Lto0LYxqHN2iQtzlwTVmq9733zd3XfcXrZ3+LblHAgEt5G
+TfNxEKJ8soPLyWmwDH6HWCnjZ/aIQRBTIQ05uVeEoYxSh6wOai7ss/KveoSNBbYz
+gbdzoqI2Y8cgH2nbfgp3DSasaLZEdCSsIsK1u05CinE7k2qZ7KgKAUIcT/cR/grk
+C6VwsnDU0OUCideXcQ8WeHutqvgZH1JgKDbznoIzeQHJD238GEu+eKhRHcz8/jeG
+94zkcgJOz3KbZGYMiTh277Fvj9zzvZsbMBCedV1BTg3TqgvdX4bdkhf5cH+7NtWO
+lrFj6UwAsGukBTAOxC0l/dnSmZhJ7Z1KmEWilro/gOrjtOxqRQutlIqG22TaqoPG
+fYVN+en3Zwbt97kcgZDwqbuykNt64oZWc4XKCa3mprEGC3IbJTBFqglXmZ7l9ywG
+EEUJYOlb2XrSuPWml39beWdKM8kzr1OjnlOm6+lpTRCBfo0wa9F8YZRhHPAkwKkX
+XDeOGpWRj4ohOx0d2GWkyV5xyN14p2tQOCdOODmz80yUTgRpPVQUtOEhXQARAQAB
+tCFBV1MgQ0xJIFRlYW0gPGF3cy1jbGlAYW1hem9uLmNvbT6JAlQEEwEIAD4CGwMF
+CwkIBwIGFQoJCAsCBBYCAwECHgECF4AWIQT7Xbd/1cEYuAURraimMQrMRnJHXAUC
+akV0ygUJDqP4lQAKCRCmMQrMRnJHXFHjD/9eyZLYcKuQOlLvtqSDtUBiEZf6ZZjM
+i3ygYH8rJNtuToUH+HvSpe819urJCquXhDrlK6N+aqW0hCLtNABJG/vsafIgvIYJ
+hSGgpgtNnQyMV1jViRWqPjbouw8OkYKBThUfT1i2Y+wn58ifs6ODBCmTexWtXspA
+Si+Gt49xDOW0APmbOPnI+a4HJW6tVEo6MWS0WjzpiBayR3d1A4pt4YrPfSdDgpLo
+h2SLQqlRqvvVZJaWBjhkErNFpfsBA06sDcPEOb0G8LBUbR4WOcdvhe5LubJbZuxC
+AG9kNPCVeQP1ixwjgjXKysaxeQ6rv0VzIQgRp6tLVLWhy6AKDNvLjFSsmXZ1Wl08
+Y/RlOHXlzLuQMRE6sR1wOdRxc9TsrNWTGiBK65cvSWOy03JeBkQQ8pesqltiyxI9
+U21kkgiXtTSKNGfKK8pO27D81YANhRqPK7iTp6kuFiY2WtOg90KTMNlIT+Ff85Y2
+b1rHj6Z0SrCkJujhWk3IBPic/wJgz01LEc/OAdUPlby90RJZcIBhSlWhT7mXnXIO
+c0HWlNQrns2s3CTyYwZSiSlYe9ApeLwhjDo8NhbFuCAy61l6O5UsR4AfZxx/rGKv
+2wFb1/RN/P4gNe6vmxZAPjR0AQcwD3tc2McimOLr/22kmPz8IH3I0X7WoSFr0Biz
+E91G7bb0hOb/cA==
+=knv7
+-----END PGP PUBLIC KEY BLOCK-----
+AWS_CLI_PUBLIC_KEY
+  mkdir -m 700 "$temporary_directory/gnupg"
+  gpg --batch --homedir "$temporary_directory/gnupg" \
+    --import "$temporary_directory/aws-cli-public-key.asc" >/dev/null 2>&1
+  gpg --batch --homedir "$temporary_directory/gnupg" \
+    --verify "$temporary_directory/awscliv2.sig" \
+    "$temporary_directory/awscliv2.zip"
   unzip -q "$temporary_directory/awscliv2.zip" -d "$temporary_directory"
   as_root "$temporary_directory/aws/install" \
     --install-dir /usr/local/aws-cli \
@@ -73,6 +114,27 @@ install_aws_cli() {
   trap - EXIT
 }
 
+remove_profile_setting() {
+  local credentials_file profile setting temporary_file
+  credentials_file="$1"
+  profile="$2"
+  setting="$3"
+  [ -f "$credentials_file" ] || return 0
+
+  temporary_file="$(mktemp "${credentials_file}.XXXXXX")"
+  awk -v profile="$profile" -v setting="$setting" '
+    /^\[[^]]+\][[:space:]]*$/ {
+      section = $0
+      sub(/^\[/, "", section)
+      sub(/\][[:space:]]*$/, "", section)
+      in_profile = section == profile
+    }
+    !(in_profile && $0 ~ "^[[:space:]]*" setting "[[:space:]]*=") { print }
+  ' "$credentials_file" >"$temporary_file"
+  chmod 600 "$temporary_file"
+  mv "$temporary_file" "$credentials_file"
+}
+
 sanitize_session_name() {
   local candidate
   candidate="$(printf '%s' "${LISA_REMOTE_AGENT:-remote-agent}" \
@@ -113,22 +175,30 @@ profiles_json="$(printf '%s' "$bootstrap_json" | jq -c '
   end
 ')"
 
-printf '%s' "$profiles_json" | jq -e '
+printf '%s' "$profiles_json" | jq -e --arg bootstrap_profile "$BOOTSTRAP_PROFILE" '
   type == "object" and length > 0 and
   all(to_entries[];
+    (.key != $bootstrap_profile) and
     (.key | test("^[A-Za-z0-9_-]+$")) and
     (.value.roleArn | type == "string" and startswith("arn:aws:iam::")) and
     (.value.region | type == "string" and length > 0)
   )
 ' >/dev/null || fail "bootstrap profiles must map safe names to roleArn and region"
 
-mkdir -p "$HOME/.aws"
+credentials_file="${AWS_SHARED_CREDENTIALS_FILE:-$HOME/.aws/credentials}"
+config_file="${AWS_CONFIG_FILE:-$HOME/.aws/config}"
+mkdir -p "$HOME/.aws" "$(dirname "$credentials_file")" "$(dirname "$config_file")"
 chmod 700 "$HOME/.aws"
 
 aws configure set aws_access_key_id "$access_key_id" --profile "$BOOTSTRAP_PROFILE"
 aws configure set aws_secret_access_key "$secret_access_key" --profile "$BOOTSTRAP_PROFILE"
 if [ -n "$session_token" ]; then
   aws configure set aws_session_token "$session_token" --profile "$BOOTSTRAP_PROFILE"
+else
+  remove_profile_setting \
+    "$credentials_file" \
+    "$BOOTSTRAP_PROFILE" \
+    "aws_session_token"
 fi
 
 session_name="$(sanitize_session_name)"
@@ -153,7 +223,7 @@ aws configure set external_id "$external_id" --profile default
 aws configure set role_session_name "$session_name" --profile default
 aws configure set region "$default_region" --profile default
 
-chmod 600 "$HOME/.aws/credentials" "$HOME/.aws/config"
+chmod 600 "$credentials_file" "$config_file"
 
 if [ "${LISA_AWS_SKIP_VERIFY:-0}" != "1" ]; then
   AWS_PAGER="" aws sts get-caller-identity --profile "$default_profile" >/dev/null

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.226.0",
+  "version": "2.226.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/scripts/install-remote-agent-aws.mjs

@@ -98,9 +98,17 @@ function installCopilotAdapter(project) {
   );
   mkdirSync(path.dirname(workflowPath), { recursive: true });
   const marker = "Lisa remote AWS bootstrap";
+  const secretEnvironment =
+    "          LISA_AWS_BOOTSTRAP_JSON: ${{ secrets.LISA_AWS_BOOTSTRAP_JSON }}";
+  const checkoutStep = [
+    "      - uses: actions/checkout@v4",
+    "        with:",
+    "          persist-credentials: false",
+  ].join("\n");
   const step = [
     `      - name: ${marker}`,
     "        env:",
+    secretEnvironment,
     "          LISA_REMOTE_AGENT: copilot",
     `        run: ${INSTALL_COMMAND}`,
   ].join("\n");
@@ -118,7 +126,7 @@ function installCopilotAdapter(project) {
         "    permissions:",
         "      contents: read",
         "    steps:",
-        "      - uses: actions/checkout@v4",
+        checkoutStep,
         step,
         "",
       ].join("\n")
@@ -127,7 +135,6 @@ function installCopilotAdapter(project) {
   }
 
   const current = readFileSync(workflowPath, "utf8");
-  if (current.includes(marker)) return path.relative(project, workflowPath);
   const lines = current.split("\n");
   const jobIndex = lines.findIndex(line =>
     /^\s{2}copilot-setup-steps:\s*$/.test(line)
@@ -146,10 +153,95 @@ function installCopilotAdapter(project) {
       "Existing copilot-setup-steps.yml must contain jobs.copilot-setup-steps.steps before Lisa can merge the AWS bootstrap step"
     );
   }
-  const additions = current.includes("actions/checkout@")
-    ? [step]
-    : ["      - uses: actions/checkout@v4", step];
-  lines.splice(stepsIndex + 1, 0, ...additions);
+
+  let changed = false;
+  const checkoutIndex = lines.findIndex(
+    (line, index) =>
+      index > stepsIndex &&
+      (jobEndIndex < 0 || index < jobEndIndex) &&
+      /^\s{6}-\s+uses:\s+actions\/checkout@/.test(line)
+  );
+  if (checkoutIndex >= 0) {
+    const nextStepIndex = lines.findIndex(
+      (line, index) => index > checkoutIndex && /^\s{6}-\s/.test(line)
+    );
+    const checkoutEnd = nextStepIndex < 0 ? lines.length : nextStepIndex;
+    const withIndex = lines.findIndex(
+      (line, index) =>
+        index > checkoutIndex &&
+        index < checkoutEnd &&
+        /^\s{8}with:\s*$/.test(line)
+    );
+    const persistenceIndex = lines.findIndex(
+      (line, index) =>
+        index > checkoutIndex &&
+        index < checkoutEnd &&
+        /^\s{10}persist-credentials:\s*/.test(line)
+    );
+    if (persistenceIndex >= 0) {
+      if (lines[persistenceIndex] !== "          persist-credentials: false") {
+        lines[persistenceIndex] = "          persist-credentials: false";
+        changed = true;
+      }
+    } else if (withIndex >= 0) {
+      lines.splice(withIndex + 1, 0, "          persist-credentials: false");
+      changed = true;
+    } else {
+      lines.splice(
+        checkoutIndex + 1,
+        0,
+        "        with:",
+        "          persist-credentials: false"
+      );
+      changed = true;
+    }
+  }
+
+  const markerIndex = lines.findIndex(line => line.includes(marker));
+  if (markerIndex >= 0) {
+    const nextStepIndex = lines.findIndex(
+      (line, index) => index > markerIndex && /^\s{6}-\s/.test(line)
+    );
+    const managedStepEnd = nextStepIndex < 0 ? lines.length : nextStepIndex;
+    const managedStep = lines.slice(markerIndex, managedStepEnd);
+    if (!managedStep.includes(secretEnvironment)) {
+      const environmentIndex = lines.findIndex(
+        (line, index) =>
+          index > markerIndex &&
+          index < managedStepEnd &&
+          /^\s{8}env:\s*$/.test(line)
+      );
+      if (environmentIndex < 0) {
+        throw new Error(
+          "Existing Lisa remote AWS bootstrap step must contain an env block"
+        );
+      }
+      lines.splice(environmentIndex + 1, 0, secretEnvironment);
+      changed = true;
+    }
+    if (checkoutIndex < 0) {
+      lines.splice(stepsIndex + 1, 0, ...checkoutStep.split("\n"));
+      changed = true;
+    }
+    if (changed) writeFileSync(workflowPath, lines.join("\n"));
+    return path.relative(project, workflowPath);
+  }
+  const additions = checkoutIndex >= 0 ? [step] : [checkoutStep, step];
+  const nextCheckoutStepIndex = lines.findIndex(
+    (line, index) => index > checkoutIndex && /^\s{6}-\s/.test(line)
+  );
+  const updatedJobEndIndex = lines.findIndex(
+    (line, index) => index > jobIndex && /^\s{2}\S[^:]*:\s*$/.test(line)
+  );
+  const additionIndex =
+    checkoutIndex < 0
+      ? stepsIndex + 1
+      : nextCheckoutStepIndex >= 0
+        ? nextCheckoutStepIndex
+        : updatedJobEndIndex >= 0
+          ? updatedJobEndIndex
+          : lines.length;
+  lines.splice(additionIndex, 0, ...additions);
   writeFileSync(workflowPath, lines.join("\n"));
   return path.relative(project, workflowPath);
 }
@@ -161,13 +253,20 @@ function writeGuide(project, platform, secretName) {
     guidePath,
     `# Remote coding-agent AWS access
 
+## Context
+
 This repository uses Lisa's vendor-neutral AWS bootstrap. Configure the complete
 Secrets Manager SecretString as the secret \`LISA_AWS_BOOTSTRAP_JSON\`; do not
 split it into \`AWS_ACCESS_KEY_ID\` and \`AWS_SECRET_ACCESS_KEY\` environment
 variables. The setup script writes a named source profile whose only permission
 is \`sts:AssumeRole\`, then creates automatically refreshed role profiles.
 
-## Runtime configuration
+## Goal
+
+Give supported remote coding agents renewable, least-privilege AWS CLI access
+without borrowing a developer identity or granting direct production repair.
+
+## Changes
 
 | Runtime | Setup |
 |---|---|
@@ -180,7 +279,7 @@ is \`sts:AssumeRole\`, then creates automatically refreshed role profiles.
 
 Generated for: \`${platform}\`.
 
-## Profiles
+## Implementation
 
 The bootstrap bundle defines the available profile names. \`dev\` is the
 default when present. Select another account explicitly, for example:
@@ -193,8 +292,6 @@ aws --profile production cloudformation describe-stacks
 Production and shared profiles are observer-only. Production repair remains a
 human-driven local-workstation operation.
 
-## Administrator rollout
-
 After the infrastructure pipeline deploys the remote-agent IAM stacks, retrieve
 the complete bundle from the shared account. Do not extract or distribute its
 individual access-key fields:
@@ -210,6 +307,8 @@ Store that exact output as the masked secret \`LISA_AWS_BOOTSTRAP_JSON\` on each
 remote-agent platform. Run the setup command and require its live
 \`sts:GetCallerIdentity\` check to pass before considering the platform ready.
 
+## Notes
+
 Rotate by replacing the bootstrap IAM access key through infrastructure and
 then updating this one secret on every configured platform. Disabling or
 deleting the bootstrap user immediately prevents new role sessions.