@codyswann/lisa 2.24.0 → 2.25.1

package/plugins/lisa-wiki/skills/lisa-wiki-connector-confluence/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: lisa-wiki-connector-confluence
+description: Produce sanitized Confluence source notes for lisa-wiki ingest via the Atlassian MCP. Use only when lisa-wiki-ingest routes to the confluence connector. Read-only; tenant-guarded.
+---
+
+# lisa-wiki-connector-confluence
+
+Skill-driven connector (Atlassian MCP). Writes ONLY source notes under `wiki/sources/confluence/` and
+emits a proposed cursor; the kernel does the rest.
+
+## Flow
+1. Confirm `connectors.confluence.enabled` and `sideEffects: read-only-ingest`.
+2. **Tenant guard:** verify the Atlassian connection matches `connectors.confluence.tenantGuard`
+   (same site/cloudId discipline as jira). Abort on mismatch.
+3. **Window:** read `wiki/state/confluence/*.json`. First run → configured window; incremental →
+   pages updated since the cursor. Scope to the configured spaces.
+4. **Fetch (read-only)** page content + metadata via the Atlassian MCP. Never edit Confluence.
+5. **Write source notes** under `wiki/sources/confluence/<YYYY-MM-DD>-confluence-ingest.md` with
+   frontmatter and citations (`Source: <space>/<page>`). Redact secrets; honor retention/sensitivity.
+6. **Emit run metadata** (proposed cursor, counts) to the handoff file; return to `lisa-wiki-ingest`.
+
+## Rules
+- Abort on tenant mismatch; do not invent pages/decisions; weak evidence → open-questions.
+- Disabled if the Atlassian MCP is absent (`scripts/mcp-doctor.mjs`).
+- Writes only source notes + handoff meta; the kernel advances state.

package/plugins/lisa-wiki/skills/lisa-wiki-connector-docs/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: lisa-wiki-connector-docs
+description: Ingest a local document (PDF, DOCX, Markdown, text) into a sanitized source note for lisa-wiki ingest. Use only when lisa-wiki-ingest routes to the docs connector (a file-path input). Uses available local converters; no heavy bundled dependency.
+---
+
+# lisa-wiki-connector-docs
+
+Skill-driven connector. Converts a local document to markdown using whatever converter is available,
+writes a source note, and hands off; the kernel does the rest.
+
+## Converters (no bundled heavy dependency)
+- **Markdown / text**: ingest directly.
+- **PDF**: `pdftotext` (Poppler) if available, else `pandoc`.
+- **DOCX**: `pandoc` if available, else `textutil` (macOS).
+If no suitable converter is installed, **skip that source and record a `docs` doctor finding** (the
+file could not be converted) so the user can install a converter — a targeted `/ingest <file>` reports
+the skip rather than pretending success. Missing converters are connector-specific, never a
+plugin-install blocker.
+
+## Flow
+1. Confirm `connectors.docs.enabled` and `sideEffects: read-only-ingest`.
+2. Resolve the input file; pick the converter by extension; convert to markdown (read-only).
+3. Write a source note under `wiki/sources/docs/<YYYY-MM-DD>-<slug>.md` with frontmatter
+   (`type: source`, dates, `source_system: docs`, original filename) and the converted, reader-safe
+   text. Redact secrets; honor `sourceRetention`/`sensitivity`.
+4. Emit run metadata (source-note path) to the handoff file; return to `lisa-wiki-ingest`.
+
+## Rules
+- Read-only on the source document; never modify the original.
+- Writes only the source note + handoff meta; the kernel advances state.

package/plugins/lisa-wiki/skills/lisa-wiki-connector-git/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: lisa-wiki-connector-git
+description: Produce sanitized git/PR-history source notes for lisa-wiki ingest. Use only when lisa-wiki-ingest routes to the git connector (self repo or a registered project). Read-only — never checks out, fetches, or mutates the target repo.
+---
+
+# lisa-wiki-connector-git
+
+A universal, deterministic connector backed by `scripts/ingest-git.mjs`. It writes ONLY a source note
+under `wiki/sources/git/` (or a per-project path) and emits a proposed cursor; the kernel performs
+synthesis/index/log/verify/state/PR.
+
+## Flow
+1. Confirm `connectors.git` is enabled and `read-only-ingest`.
+2. For the self repo (and each registered project under `projects/`), run:
+   ```
+   node "${PLUGIN_ROOT}/scripts/ingest-git.mjs" --repo <path> --slug <name> \
+     --config wiki/lisa-wiki.config.json --source-dir wiki/sources/git \
+     --state wiki/state/git/<slug>.json --emit-meta wiki/state/handoff/git-<slug>-<runId>.json
+   ```
+3. Hand the emitted source-note paths + proposed cursor back to `lisa-wiki-ingest`.
+
+## Rules
+- Read-only: only `git log`/`rev-parse`/`gh pr list` against the repo; never checkout/fetch/reset/pull.
+- In wrapper/standalone mode, the registered child repos are read-only inputs and are never staged.
+- Writes only its source note + handoff meta; the kernel advances `wiki/state/git/<slug>.json`.

package/plugins/lisa-wiki/skills/lisa-wiki-connector-jira/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: lisa-wiki-connector-jira
+description: Produce sanitized JIRA source notes for lisa-wiki ingest via the Atlassian MCP. Use only when lisa-wiki-ingest routes to the jira connector. Read-only; tenant-guarded.
+---
+
+# lisa-wiki-connector-jira
+
+Skill-driven connector (Atlassian MCP). Writes ONLY source notes under `wiki/sources/jira/` and emits
+a proposed cursor; the kernel does synthesis/index/log/verify/state/PR.
+
+## Flow
+1. Confirm `connectors.jira.enabled` and `sideEffects: read-only-ingest`.
+2. **Tenant guard:** verify the active Atlassian connection resolves to
+   `connectors.jira.tenantGuard.site` / `cloudId`. If it resolves to a different account/tenant,
+   **abort** (do not ingest) — this is the cross-tenant contamination guard.
+3. **Window:** read `wiki/state/jira/*.json`. First run → last 4 months (or configured window);
+   incremental → issues `updated >=` the cursor watermark. Scope to `connectors.jira.projects[]`.
+4. **Fetch (read-only)** via the Atlassian MCP (JQL search + issue read). Never write to JIRA.
+5. **Write source notes** under `wiki/sources/jira/<YYYY-MM-DD>-jira-ingest.md` — reader-safe, with
+   frontmatter (`type: source`, dates, `source_system: jira`) and citations (`Source: <issue key>`).
+   Redact secrets; honor `sourceRetention`/`sensitivity`.
+6. **Emit run metadata** (proposed cursor: latest `updated` watermark, counts) to the handoff file,
+   then return to `lisa-wiki-ingest`.
+
+## Rules
+- Abort on tenant mismatch; never invent issues/PRs/people; weak evidence → open-questions.
+- If the Atlassian MCP is absent, the connector is disabled (see `scripts/mcp-doctor.mjs`).
+- Writes only source notes + handoff meta; the kernel advances state.

package/plugins/lisa-wiki/skills/lisa-wiki-connector-memory/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: lisa-wiki-connector-memory
+description: Ingest the agent's PROJECT-SCOPED memory into a sanitized source note. Use only when lisa-wiki-ingest routes to the memory connector. NEVER ingests global or unrelated memory — global Codex memory and the Chronicle store are refused.
+---
+
+# lisa-wiki-connector-memory
+
+A universal connector backed by `scripts/ingest-memory.mjs`. **Project-scoped only.**
+
+## Resolve the memory directory (then pass it explicitly)
+- **Claude**: per-project memory at `~/.claude/projects/<encoded-project-path>/memory/` — inherently
+  project-scoped; always eligible.
+- **Codex**: eligible ONLY if a project-scoped memory store exists (e.g. a per-project `CODEX_HOME`).
+  The global `~/.codex/memories/` and the Chronicle store are **never** ingested (the script
+  hard-refuses them).
+
+## Flow
+```
+node "${PLUGIN_ROOT}/scripts/ingest-memory.mjs" --memory-dir <project-scoped-dir> \
+  --config wiki/lisa-wiki.config.json --source-dir wiki/sources/memory \
+  --state wiki/state/memory/memory.json --emit-meta wiki/state/handoff/memory-<runId>.json
+```
+Hand the source note + proposed cursor back to `lisa-wiki-ingest`.
+
+## Rules
+- Secrets are redacted; sensitivity is at least `internal`.
+- If no project-scoped memory exists, ingest nothing rather than reaching for global memory.
+- Writes only its source note + handoff meta; the kernel advances state.

package/plugins/lisa-wiki/skills/lisa-wiki-connector-notion/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: lisa-wiki-connector-notion
+description: Produce sanitized Notion source notes for lisa-wiki ingest via the Notion MCP. Use only when lisa-wiki-ingest routes to the notion connector. Read-only; teamspace-guarded.
+---
+
+# lisa-wiki-connector-notion
+
+Skill-driven connector (Notion MCP). Writes ONLY source notes under `wiki/sources/notion/` and emits a
+proposed cursor; the kernel does the rest.
+
+## Flow
+1. Confirm `connectors.notion.enabled` and `sideEffects: read-only-ingest`.
+2. **Tenant guard:** verify the Notion connection resolves to
+   `connectors.notion.tenantGuard.teamspace` / `teamspaceId`. Abort on a different workspace/teamspace.
+3. **Window:** read `wiki/state/notion/*.json`. First run → configured window; incremental → pages
+   edited since the cursor.
+4. **Fetch (read-only)** via the Notion MCP. Never edit Notion.
+5. **Write source notes** under `wiki/sources/notion/<YYYY-MM-DD>-notion-ingest.md` with frontmatter
+   and citations (`Source: <notion page>`). Redact secrets; honor retention/sensitivity.
+6. **Emit run metadata** (proposed cursor, counts) to the handoff file; return to `lisa-wiki-ingest`.
+
+## Rules
+- Abort on teamspace mismatch; do not invent pages; weak evidence → open-questions.
+- Disabled if the Notion MCP is absent (`scripts/mcp-doctor.mjs`).
+- Writes only source notes + handoff meta; the kernel advances state.

package/plugins/lisa-wiki/skills/lisa-wiki-connector-roles/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: lisa-wiki-connector-roles
+description: Ingest the wiki's own digital-staff roster (config.staff[] + wiki/staff/*) into a sanitized source note. Use only when lisa-wiki-ingest routes to the roles connector. Does not run any subagent.
+---
+
+# lisa-wiki-connector-roles
+
+A universal, deterministic connector backed by `scripts/ingest-roles.mjs`. It captures the roster so
+the wiki documents its own digital staff.
+
+## Flow
+```
+node "${PLUGIN_ROOT}/scripts/ingest-roles.mjs" --config wiki/lisa-wiki.config.json \
+  --wiki wiki --source-dir wiki/sources/roles \
+  --state wiki/state/roles/roles.json --emit-meta wiki/state/handoff/roles-<runId>.json
+```
+Hand the source note + proposed cursor back to `lisa-wiki-ingest`.
+
+## Rules
+- Reads `config.staff[]` and `wiki/staff/*.md` only; never invokes/schedules the role subagents
+  (that is out of scope — see lisa-wiki-add-role).
+- Writes only its source note + handoff meta; the kernel advances state.

package/plugins/lisa-wiki/skills/lisa-wiki-connector-slack/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: lisa-wiki-connector-slack
+description: Ingest a Slack channel into sanitized source notes via a user token. Use only when lisa-wiki-ingest routes to the slack connector AND the run carries explicit external-write intent (Slack OAuth opens a browser and stores a token file). Centralized stdlib-Python scripts; secrets are redacted.
+---
+
+# lisa-wiki-connector-slack
+
+The centralized Slack connector backed by `scripts/slack_oauth_user.py` (one-time OAuth) and
+`scripts/ingest_slack_channel.py` (ingest). These are the stdlib-Python scripts previously duplicated
+verbatim across projects, now shipped once by the plugin.
+
+## Side effects — `external-write`
+Slack OAuth opens a browser and writes a user-token file to a local secrets path. The slack connector
+is therefore `external-write`: it runs ONLY with config opt-in **and** explicit per-run intent, is
+skipped during an unattended full ingest, and its PR never auto-merges.
+
+## Flow
+1. One-time auth (explicit): `python3 "${PLUGIN_ROOT}/scripts/slack_oauth_user.py"` — stores a
+   `xoxp-` user token under an ignored secrets path. The token file is never committed.
+2. Ingest: `python3 "${PLUGIN_ROOT}/scripts/ingest_slack_channel.py" --channel <id-or-name> \
+   --config wiki/lisa-wiki.config.json --emit-meta wiki/state/handoff/slack-<runId>.json` — verifies
+   the Slack tenant against config, then writes sanitized source notes under `wiki/sources/slack/`
+   (tokens/keys redacted) and emits a **proposed** cursor to the handoff file.
+3. Hand the source notes + handoff meta back to `lisa-wiki-ingest` (the kernel advances final state
+   after verification).
+
+## Rules
+- Verify the Slack team/tenant matches config before ingesting.
+- Token/OAuth artifacts stay in `.gitignore` and are never committed.
+- Writes only Slack source notes; the kernel performs synthesis/index/log/verify/PR.

package/plugins/lisa-wiki/skills/lisa-wiki-connector-web/SKILL.md

@@ -0,0 +1,23 @@
+---
+name: lisa-wiki-connector-web
+description: Ingest a public URL into a sanitized source note for lisa-wiki ingest (via WebFetch). Use only when lisa-wiki-ingest routes to the web connector (a URL input). Read-only.
+---
+
+# lisa-wiki-connector-web
+
+Skill-driven connector. Fetches a public URL (WebFetch / equivalent), reduces it to a reader-safe
+source note, and hands off; the kernel does synthesis/index/log/verify/state/PR.
+
+## Flow
+1. Confirm `connectors.web.enabled` and `sideEffects: read-only-ingest`.
+2. Fetch the URL read-only (WebFetch). Do not follow suspicious cross-host redirects without care.
+3. Write a source note under `wiki/sources/web/<YYYY-MM-DD>-<slug>.md` with frontmatter
+   (`type: source`, dates, `source_system: web`, the URL) and a faithful, reader-safe summary +
+   key excerpts. Redact secrets; honor `sourceRetention` (e.g. `external-pointer-only` keeps just the
+   URL + minimal note).
+4. Emit run metadata (the source-note path) to the handoff file; return to `lisa-wiki-ingest`.
+
+## Rules
+- Read-only; never submit forms or trigger actions on the page.
+- Do not invent content not present on the page; weak/uncertain material → open-questions.
+- Writes only the source note + handoff meta; the kernel advances state.

package/plugins/lisa-wiki/skills/lisa-wiki-doctor/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: lisa-wiki-doctor
+description: Verify that a wiki is correctly set up and (after migration) fully functional. Runs the deterministic checks plus functional smoke tests, writes a doctor report, and returns an overall verdict. Use as the final gate of /migrate, after /setup, or anytime to confirm wiki health. A repo is not "migrated" until its doctor verdict is READY.
+---
+
+# lisa-wiki-doctor
+
+The post-migration / post-setup verification checklist. Orchestrates the deterministic scripts and
+functional smoke tests, then writes `wiki/state/migration/doctor-report.json` and prints the blocking
+items.
+
+## Verdict
+Each item is `PASS | WARN | FAIL | SKIP`; overall is `READY | READY_WITH_WARNINGS | NOT_READY`. In
+hard-enforcement mode (`--migration` after phase 5) `WARN` on structure/integrity items is not
+allowed; earlier phases allow documented legacy warnings. Build checks (group G) are Lisa/release-only
+and `SKIP` in downstream repos.
+
+## Checklist
+- **A. Structure & config** (deterministic): `validate-config.mjs` + structure-manifest conformance;
+  required files present; `schemaVersion` set and rendered `kernelVersion` matches the installed
+  plugin; README mode recorded (never implicit `stub`).
+- **B. Integrity & safety** (deterministic): `lint-wiki.mjs` + `diff-guard.mjs`; index/log coverage;
+  state-order invariant; no broken/orphan links; secret/tenant/contamination/sensitivity scans;
+  memory sources project-scoped only (no global Codex memory / Chronicle).
+- **C. No-loss / parity**: pre/post manifest maps every legacy page/doc/command/ingest-path/role;
+  nothing dropped; docs absorption idempotent with zero dangling links; old README ingested before
+  rewrite; no leftover project-local machinery except generated overlays + role agents.
+- **D. Runtime surfaces** (both runtimes): canonical commands resolve on Claude; `$lisa-wiki-*` on
+  Codex; each `config.staff[]` role has its doc page + both subagents; MCP doctor passes or connector
+  cleanly disabled; external-write connectors skipped unless explicit intent.
+- **E. Functional smoke** (skill-orchestrated): targeted ingest of a small fixture exercises the full
+  ordered pipeline (in the migration branch or dry/scratch mode — **no extra PR**); `/query` returns
+  a cited answer; `/lint` clean (or expected phase warnings); `/onboard-me` completes read-mostly with
+  no PII; bare `/ingest --dry-run` lists non-external-write sources; `/doctor` rerun is idempotent.
+- **F. Mode-specific**: embedded self-ingest at HEAD; wrapper child-docs ingested-not-moved and not
+  staged; standalone/subdir path resolution; no-PR mode does not require PR creation.
+- **G. Git / CI / distribution** (deterministic): clean working tree (only intended changes); no
+  secrets/OAuth committed; PR/auto-merge policy honored; CI validator green if `--with-ci`; (Lisa
+  only) `bun run build:plugins` builds both artifacts and `check:plugins` passes.
+
+## Notes
+- Deterministic items are run by `scripts/verify-migration.mjs` (which emits the JSON report); this
+  skill adds the functional smoke tests and interprets phase-allowed warnings.
+- Read-mostly: the smoke tests must not open an extra PR or perform external writes.
+
+## Related
+`lisa-wiki-migrate`, `lisa-wiki-lint`, `lisa-wiki-setup`.

package/plugins/lisa-wiki/skills/lisa-wiki-ingest/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: lisa-wiki-ingest
+description: Ingest source material into the LLM Wiki. With an argument (URL, file path, or prompt) it ingests that one source; with no argument it runs a full ingest across every enabled non-external-write source. Routes to the right connector, then runs the ordered pipeline (source note → synthesis → index → log → verify → state → commit/PR). Use whenever new knowledge should enter the wiki.
+---
+
+# lisa-wiki-ingest
+
+The single entry point for getting knowledge into the wiki. It is a **router**: it never reimplements
+synthesis per source — it selects a connector to produce a sanitized source note, then the kernel
+performs the shared, ordered pipeline.
+
+## Modes
+- **Targeted:** `/ingest <url|file|prompt>` — ingest one source. Classify the input and pick the
+  matching connector.
+- **Full:** `/ingest` (no argument, or "do a full ingest") — iterate **every enabled connector whose
+  side-effect policy permits unattended ingest**: self + other registered projects' git/PR history,
+  project-scoped memory, roles, plus read-only registered sources (notion, jira, confluence,
+  quickbooks, …). `external-write` connectors (Slack OAuth, CRM writeback) are **skipped unless the
+  run includes explicit external-write intent**.
+- **Dry run:** `/ingest --dry-run` — list the sources a full ingest would run; perform no writes.
+
+## The ordered pipeline (per source) — never reorder
+1. **Connector** validates (tenant guard + auth), reads its state cursor (first-run vs incremental),
+   fetches read-only, and writes a sanitized **source note** under `wiki/sources/<system>/` plus run
+   metadata. A connector writes *only* its source note + metadata — never synthesis/index/log/state.
+2. **Synthesis** (kernel): distill durable knowledge into the appropriate category pages, with
+   citations back to the source note. Weak/uncertain material → `wiki/open-questions/`, never asserted.
+3. **Index**: update `wiki/index.md`.
+4. **Log**: append a `wiki/log.md` entry (fixed operation vocabulary).
+5. **Verify**: `git diff --check`, secret/tenant/contamination scans, touched-file guard.
+6. **State**: advance the connector's `wiki/state/<system>/*.json` cursor — only now, after 1–5 pass.
+7. **Commit/PR**: per `config.git` policy. `external-write` runs and sensitive content never auto-merge.
+
+## Rules
+- Source-note-before-synthesis; state advanced **only** after verification.
+- Project-scoped only; memory ingestion never touches global/Codex-global stores.
+- Respect `sourceRetention` and `sensitivity`; do not invent facts.
+- Connector execution and the connector contract are detailed in the connector skills (M2+); this
+  router defines and enforces the ordering and side-effect rules above.
+
+## Related
+`lisa-wiki-add-ingest` (scaffold a custom front-door that chains here), `lisa-wiki-query`,
+`lisa-wiki-lint`, `lisa-wiki-doctor`.

package/plugins/lisa-wiki/skills/lisa-wiki-lint/SKILL.md

@@ -0,0 +1,32 @@
+---
+name: lisa-wiki-lint
+description: Health-check the LLM Wiki. Reports orphan pages, contradictions, stale claims, broken internal links, missing index/log coverage, structure-manifest violations, and secret/tenant leaks. Use periodically or before hardening a wiki. Read-only — it reports findings, it does not fix them.
+---
+
+# lisa-wiki-lint
+
+Run the wiki's integrity checks and report findings by severity. Lint is **read-only**: it diagnoses,
+it does not repair (use `/ingest`, `/setup`, or `/migrate` to fix).
+
+## What it checks (deterministic core via `scripts/lint-wiki.mjs`)
+- **Frontmatter** present/valid where required (per `schema/page-frontmatter.schema.json`).
+- **Index coverage**: every page appears in `wiki/index.md`; no index rows point at missing pages.
+- **Log coverage**: material changes have `wiki/log.md` entries.
+- **Links**: no broken internal links; no orphan pages (unreferenced and unlinked).
+- **State ordering**: no state cursor advanced without its source notes + synthesis + index + log.
+- **Structure**: files conform to `schema/wiki-structure.schema.json` (canonical locations).
+- **Safety**: secret patterns, tenant/contamination terms, stray binaries, child-repo contents
+  staged in wrapper mode.
+
+## What it checks (LLM-assisted)
+- **Contradictions** between claims; **stale** claims (older than the configured staleness window);
+  **coverage gaps** vs the wiki's stated `purpose`.
+
+## Output
+A report grouped by severity, with each item marked `PASS | WARN | FAIL`. During phased migration,
+legacy issues are reported as `WARN`; in hard-enforcement mode structural/integrity issues are `FAIL`.
+Read-only: lint prints the report and does not modify the wiki (it does not write a `LINT` log entry).
+
+## Related
+`lisa-wiki-doctor` (broader post-migration verification that runs lint among other checks),
+`lisa-wiki-ingest`, `lisa-wiki-setup`.

package/plugins/lisa-wiki/skills/lisa-wiki-migrate/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: lisa-wiki-migrate
+description: Migrate an existing, hand-rolled wiki implementation onto the lisa-wiki kernel — phased and compatibility-first, with a strict no-loss guarantee. Use when adopting lisa-wiki in a repo that already has its own wiki/, ingest skills, docs, or roles. Renaming things into the canonical shape is fine; losing functionality or data is not. Ends by running /doctor.
+---
+
+# lisa-wiki-migrate
+
+Move a repo's bespoke wiki onto the kernel without breaking it or producing one giant diff. Each
+phase is a reviewable change; nothing legacy is deleted until its replacement is parity-checked.
+
+## Migration invariant — rename, never lose
+Any unique command, ingest path, or role is migrated **as though created via** `/add-ingest`
+(front-door skill) or `/add-role` (subagent); wiki-ingest aliases (`*-wiki-ingest`, custom `/ingest`
+routers, …) are renamed to the canonical `/ingest`. **Loss of functionality or data is not
+acceptable** — for each migrated artifact, run the old path and the new path and diff the output
+before deleting the old one.
+
+## Phases (per repo; one reviewable change each)
+- **0 — Inventory.** Profile the repo: mode, root, categories, frontmatter coverage, log/index
+  format, source dirs, state files, connectors, runtime surfaces, MCP config, scripts, PR policy.
+  Write a pre/post manifest mapping every legacy page, source note, doc, command, ingest path, role.
+- **1 — Adopt kernel (no content rewrite).** Add `wiki/lisa-wiki.config.json`, render the contract
+  snapshot, add `wiki/state/README.md`, run validators in **warning** mode.
+- **1b — Documentation absorption & structure.** `scripts/absorb-docs.mjs` moves the host repo's own
+  docs (`docs/`, `specs/`, top-level docs) into `wiki/documentation/`, ingests them, and conforms to
+  the structure manifest; `scripts/rewrite-refs.mjs` rewrites every internal link/citation/index
+  entry (zero dangling links). Keep-in-place files stay at conventional paths. **Ask** the README
+  mode (default `rich`; `stub` only on explicit choice). Wrapper mode moves only host docs, never
+  child-project docs. Idempotent (source fingerprints); parity-checked.
+- **2 — Runtime consolidation.** Replace duplicated local wiki skills with the plugin's; bespoke ones
+  become `/add-ingest` front-doors or `/add-role` subagents. Claude commands become facades.
+- **3 — Connector consolidation.** Centralize shared connectors (e.g. Slack); keep org-specific ones
+  as contrib/overlay.
+- **4 — Normalize by touch.** New/touched pages get frontmatter; new logs use the canonical table;
+  legacy stays parseable until deliberately migrated.
+- **5 — Hard enforcement.** Flip validators to hard-fail (and enable CI) once the baseline is clean.
+
+## Finish
+Run `lisa-wiki-doctor --migration`. The repo is not considered migrated until the verdict is `READY`
+(or a human-approved `READY_WITH_WARNINGS`). Roll back by reverting the migration change.
+
+## Related
+`lisa-wiki-doctor`, `lisa-wiki-setup`, `lisa-wiki-add-ingest`, `lisa-wiki-add-role`.

package/plugins/lisa-wiki/skills/lisa-wiki-onboard-me/SKILL.md

@@ -0,0 +1,33 @@
+---
+name: lisa-wiki-onboard-me
+description: Onboard a user to the project via its LLM Wiki. Interviews the user about themselves in relation to the project, captures that to project-scoped memory only, then gives a guided tour of what the project is and sample questions they can ask. Use when someone is new to the project or asks to be onboarded. Read-mostly — it does not open PRs or write PII into the wiki.
+---
+
+# lisa-wiki-onboard-me
+
+Bidirectional onboarding: learn who the user is *in relation to this project*, then teach them what
+the project is and how to use the wiki. The minimal project README points here.
+
+## Workflow
+1. **Interview** (brief): the user's role, goals, and what they intend to do in this project.
+2. **Capture** to **project-scoped memory only** — Claude's per-project memory; on Codex only if a
+   project-scoped memory store exists. If none exists, keep it session-local. **Never** write the
+   capture into global memory and **never** commit PII into the wiki.
+3. **Tour:** summarize the project from `wiki/start-here.md` + the wiki's `purpose`, show the folder
+   map (categories), and point at the key entry pages.
+4. **Sample questions:** offer a handful of `/query` prompts tuned to the user's role to get them
+   productive immediately.
+
+## Modes
+- Default: **read-mostly, no PR.**
+- `--save-memory`: persist the capture to project-scoped memory.
+- `--write-audience-note`: write a sanitized, **non-PII** audience/role note into the wiki via the
+  normal PR flow — only when `onboarding.allowAudienceNote: true` in config.
+
+## Rules
+- Project-scoped only; global Codex memory and the Chronicle store are never used.
+- Do not auto-create a staff role; offer `/add-role` only if the user is taking on a durable project
+  function (not merely onboarding).
+
+## Related
+`lisa-wiki-query`, `lisa-wiki-usage`, `lisa-wiki-add-role`.

package/plugins/lisa-wiki/skills/lisa-wiki-query/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: lisa-wiki-query
+description: Answer a question from the LLM Wiki with citations. Reads the index, drills into relevant pages, and synthesizes a cited answer. Read-only by default; only files new synthesis back into the wiki when the user explicitly asks. Use when someone asks a question the wiki should be able to answer, or wants to explore what the wiki knows.
+---
+
+# lisa-wiki-query
+
+Answer from the wiki, with citations, without changing it (by default).
+
+## Workflow
+1. Read `wiki/index.md` to locate candidate pages; consult `wiki/start-here.md` for orientation.
+2. Drill into the relevant synthesis pages and their cited source notes.
+3. Synthesize an answer. **Every claim cites its wiki page and/or source note.** If the wiki does not
+   support an answer, say so plainly rather than inventing one; suggest an `/ingest` that would fill
+   the gap. Only record the gap in `wiki/open-questions/` if the user explicitly asks (that is a
+   writeback — see step 4); never write it silently.
+4. **Writeback (opt-in only):** if — and only if — the user explicitly asks to persist new synthesis
+   discovered during the query, route it through the ingest pipeline so provenance/index/log/state
+   stay consistent, and log it as a `QUERY` operation. Never write back silently.
+
+## Rules
+- **Read-only by default.** No page edits, index/log changes, state advancement, or PRs unless the
+  user explicitly requests writeback.
+- Prefer the wiki's own content over outside knowledge; distinguish wiki-sourced facts from your own
+  reasoning.
+- Surface contradictions or stale claims you encounter as `/lint`-style findings rather than
+  silently picking one.
+
+## Related
+`lisa-wiki-ingest`, `lisa-wiki-lint`, `lisa-wiki-usage`.

package/plugins/lisa-wiki/skills/lisa-wiki-setup/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: lisa-wiki-setup
+description: Scaffold, repair, verify, or upgrade a project's LLM Wiki from its config. Use when setting up the wiki in a new repo, fixing a broken/incomplete structure, or upgrading to a newer kernel version. Asks the wiki's purpose and README mode, renders the contract snapshot, scaffolds the canonical folders, and seeds the staff roster. Idempotent and non-destructive.
+---
+
+# lisa-wiki-setup
+
+Bring a repo's `wiki/` into conformance with the canonical structure from
+`wiki/lisa-wiki.config.json`. Safe to re-run: it creates what is missing and repairs drift, but
+never overwrites human-authored content.
+
+## When to use
+- First-time setup of the wiki in a repo.
+- Repairing a wiki that fails `/doctor` structural checks.
+- Upgrading after a new `lisa-wiki` release (`--upgrade`): re-render the contract snapshot and run a
+  compatibility report before writing.
+- `--with-ci`: also install the optional GitHub Action validator (`ci/lisa-wiki-validate.yml`).
+
+## Workflow
+1. **Config.** Read `wiki/lisa-wiki.config.json`, or create it interactively. Ask for: `org`,
+   `displayName`, **`purpose`** (one paragraph — what this wiki is for), `mode`
+   (`embedded|wrapper|standalone|subdir`), `categories`, source layout, connectors, sensitivity,
+   `sourceRetention`, and the **README mode** (`rich` default | `stub` | `preserve` — always ask;
+   never select `stub` implicitly). Validate with `scripts/validate-config.mjs`.
+2. **Structure.** Scaffold the canonical tree per `schema/wiki-structure.schema.json`:
+   `wiki/{index.md, log.md, start-here.md, schema/, sources/, state/, staff/, <category dirs>}`.
+   Create only what is missing.
+3. **Contract.** Render `wiki/schema/llm-wiki-contract.md` from the plugin templates + config via
+   `scripts/render-contract.mjs`, stamping the `kernelVersion`. This snapshot keeps the wiki
+   self-describing without the plugin installed.
+4. **Pointers.** Ensure `AGENTS.md` / `CLAUDE.md` point at the contract + plugin (thin pointers only).
+5. **Staff.** For each `config.staff[]` entry, generate the role's `wiki/staff/<role>.md` page and its
+   dual-runtime subagents by delegating to `lisa-wiki-add-role` (running the subagents is out of scope).
+6. **README.** Apply the chosen README mode (ingest the old README first; `rich` keeps install/usage +
+   adds the onboarding line; `stub` is the minimal pointer; `preserve` leaves it).
+7. **Verify.** Run `lisa-wiki-doctor` and report the verdict + any blocking items.
+
+## Rules
+- Idempotent; re-running produces no spurious changes.
+- Never overwrite human content; only create/repair structure and the rendered snapshot. The README is
+  rewritten only after its old content has been ingested, and only per the chosen `readme.mode`.
+- Project-scoped only; never stage secrets/OAuth artifacts; honor `mode` safety (wrapper/standalone).
+
+## Related
+`lisa-wiki-add-role`, `lisa-wiki-doctor`, `lisa-wiki-migrate`, `lisa-wiki-usage`.

package/plugins/lisa-wiki/skills/lisa-wiki-usage/SKILL.md

@@ -0,0 +1,50 @@
+---
+name: lisa-wiki-usage
+description: Explain how to browse, query, and contribute to this project's LLM Wiki. Use when a user asks how the wiki works, where knowledge lives, how to find something, or how to add to it — the read/navigation path, not an ingestion or write workflow.
+---
+
+# lisa-wiki-usage
+
+Orient a human or agent to the project's LLM Wiki and point them at the right entry points and
+canonical commands. This skill is **read-only guidance** — it never writes wiki pages, advances
+state, or opens PRs.
+
+## What the wiki is
+
+A git-native markdown knowledge base under `wiki/`, maintained by the `lisa-wiki` plugin. It follows
+the three-layer model: immutable **raw sources** (`wiki/sources/`), the LLM-owned **synthesis** layer
+(category directories like `concepts/`, `entities/`, `architecture/`, …), and the **schema** that
+governs it (`wiki/schema/llm-wiki-contract.md`, rendered from the project's `wiki/lisa-wiki.config.json`).
+
+## Entry points (read these first)
+
+1. `wiki/start-here.md` — orientation and the wiki's stated purpose.
+2. `wiki/index.md` — the navigation map of every page (grouped by category).
+3. `wiki/schema/llm-wiki-contract.md` — the rules this wiki follows.
+4. `wiki/log.md` — the append-only history of every ingestion/maintenance operation.
+
+## How to do things
+
+On **Claude** these are slash commands; on **Codex** invoke the same skills from the app slash list
+(e.g. `$lisa-wiki-query`).
+
+- **Find or answer something:** `/query "<your question>"` (Codex: `$lisa-wiki-query`) — read-only by
+  default; returns a cited answer drawn from the wiki. Or browse `wiki/index.md` manually.
+- **Get oriented as a new user:** `/onboard-me` (Codex: `$lisa-wiki-onboard-me`) — a guided tour plus
+  sample questions tuned to your role.
+- **Add knowledge:** `/ingest <url|file|prompt>` (Codex: `$lisa-wiki-ingest`) for a single source, or
+  `/ingest` with no argument for a full ingest across all enabled **non-external-write** sources
+  (external-write sources like Slack OAuth require explicit intent). Do not hand-edit synthesis pages
+  to add facts — route them through `/ingest` so provenance, the index, and the log stay consistent.
+- **Check the wiki's health:** `/lint` (Codex: `$lisa-wiki-lint`) — orphans, contradictions, stale
+  claims, broken links.
+
+## Citations & trust
+
+Every synthesized claim should cite a source note (e.g. `Source: wiki/sources/<system>/<note>.md`).
+If you find an uncited or contradictory claim, that is a `/lint` finding — surface it rather than
+trusting it. Weak or unverified material belongs in `wiki/open-questions/`, not stated as fact.
+
+## Related skills
+
+`lisa-wiki-ingest`, `lisa-wiki-query`, `lisa-wiki-lint`, `lisa-wiki-onboard-me`, `lisa-wiki-setup`.

package/plugins/lisa-wiki/templates/agents/role-agent.claude.md

@@ -0,0 +1,16 @@
+---
+name: {{id}}
+description: {{roleDescription}}
+---
+
+You are **{{role}}** for {{org}} — the domain expert for {{expertise}}.
+
+Your knowledge lives in this project's LLM Wiki under: {{ownedPaths}}.
+
+Operating rules:
+- **Query the wiki first.** It is your source of truth — do not rely on stale or outside memory.
+  Use the `lisa-wiki-query` skill (`/query`) before answering.
+- **Contribute via ingestion.** Add new knowledge with `lisa-wiki-ingest` (`/ingest`) so provenance,
+  the index, the log, and state stay consistent. Never hand-edit synthesis pages to add facts.
+- **Stay in your lane.** Work within your owned domain; defer other domains to their roles.
+- **Respect sensitivity ({{sensitivity}})** and never expose secrets or out-of-scope material.

package/plugins/lisa-wiki/templates/agents/role-agent.codex.toml

@@ -0,0 +1,15 @@
+name = "{{id}}"
+description = "{{roleDescription}}"
+developer_instructions = """
+You are {{role}} for {{org}} — the domain expert for {{expertise}}.
+
+Your knowledge lives in this project's LLM Wiki under: {{ownedPaths}}.
+
+Operating rules:
+- Query the wiki first (use the lisa-wiki-query skill); it is your source of truth — do not rely on
+  stale or outside memory.
+- Contribute new knowledge via the lisa-wiki-ingest skill so provenance, index, log, and state stay
+  consistent; never hand-edit synthesis pages to add facts.
+- Stay within your owned domain; defer other domains to their roles.
+- Respect sensitivity ({{sensitivity}}); never expose secrets or out-of-scope material.
+"""

package/plugins/lisa-wiki/templates/index.md

@@ -0,0 +1,17 @@
+# {{displayName}} — Index
+
+> The navigation map of this wiki. Maintained on every ingestion. One table per category;
+> rows are `| Page | Summary | Updated |`. Read this first when looking for anything.
+
+## Orientation
+| Page | Summary | Updated |
+|---|---|---|
+| [start-here](start-here.md) | Orientation and the wiki's purpose | {{generatedDate}} |
+| [LLM Wiki Contract](schema/llm-wiki-contract.md) | The rules this wiki follows | {{generatedDate}} |
+
+<!-- Category sections (concepts, entities, …) are added/maintained by ingestion. -->
+
+## Sources
+| Source notes | Latest |
+|---|---|
+| `sources/` | (none yet) |