@codyswann/lisa 2.258.4 → 2.259.1

package/cdk/create-only/.github/workflows/ci.yml

@@ -131,6 +131,8 @@ jobs:
     name: 🔍 Quality Checks
     needs: [determine_environment, cdk-checks] # Ensure CDK checks pass first
     # Reference to the quality checks workflow
+    permissions:
+      contents: read
     uses: CodySwannGT/lisa/.github/workflows/quality.yml@main
     with:
       node_version: '22.21.1'

package/dist/core/learnings.d.ts

@@ -1,5 +1,6 @@
 export * from "./learnings-contract.js";
 export * from "./learnings-projection.js";
 export * from "./learnings-writer.js";
+export * from "./upstream-attribution-body.js";
 export { DEFAULT_PROJECT_LEARNINGS_FILE, DEFAULT_PROJECT_RULES_FILE, PROJECT_LEARNINGS_FILENAME, readProjectConfig, resolveLegacyProjectLearningsFile, resolveProjectLearningsFile, resolveProjectRulesFile, type LearningsConfig, type ProjectConfig, } from "./project-config.js";
 //# sourceMappingURL=learnings.d.ts.map

package/dist/core/learnings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"learnings.d.ts","sourceRoot":"","sources":["../../src/core/learnings.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAC1B,0BAA0B,EAC1B,iBAAiB,EACjB,iCAAiC,EACjC,2BAA2B,EAC3B,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"learnings.d.ts","sourceRoot":"","sources":["../../src/core/learnings.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,gCAAgC,CAAC;AAC/C,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAC1B,0BAA0B,EAC1B,iBAAiB,EACjB,iCAAiC,EACjC,2BAA2B,EAC3B,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC"}

package/dist/core/learnings.js

@@ -1,5 +1,6 @@
 export * from "./learnings-contract.js";
 export * from "./learnings-projection.js";
 export * from "./learnings-writer.js";
+export * from "./upstream-attribution-body.js";
 export { DEFAULT_PROJECT_LEARNINGS_FILE, DEFAULT_PROJECT_RULES_FILE, PROJECT_LEARNINGS_FILENAME, readProjectConfig, resolveLegacyProjectLearningsFile, resolveProjectLearningsFile, resolveProjectRulesFile, } from "./project-config.js";
 //# sourceMappingURL=learnings.js.map

package/dist/core/learnings.js.map

@@ -1 +1 @@
-{"version":3,"file":"learnings.js","sourceRoot":"","sources":["../../src/core/learnings.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAC1B,0BAA0B,EAC1B,iBAAiB,EACjB,iCAAiC,EACjC,2BAA2B,EAC3B,uBAAuB,GAGxB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"learnings.js","sourceRoot":"","sources":["../../src/core/learnings.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,gCAAgC,CAAC;AAC/C,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAC1B,0BAA0B,EAC1B,iBAAiB,EACjB,iCAAiC,EACjC,2BAA2B,EAC3B,uBAAuB,GAGxB,MAAM,qBAAqB,CAAC"}

package/dist/core/upstream-attribution-body.d.ts

@@ -0,0 +1,31 @@
+/** Allowlist-only body builder for public upstream Lisa attribution filings. */
+/** Lisa-owned excerpt that is safe to quote in the public upstream issue. */
+export type UpstreamAttributionExcerpt = {
+    readonly surface: string;
+    readonly text: string;
+};
+/** Typed allowlist accepted by the public upstream attribution body builder. */
+export type UpstreamAttributionBodyInput = {
+    readonly markerKey: string;
+    readonly failureClass: string;
+    readonly lisaSurface: string;
+    readonly operatorImpact: string;
+    readonly harnessFault: string;
+    readonly requestedChange: string;
+    readonly affectedProject: string;
+    readonly hostIssueUrl: string;
+    readonly attributionEvidence: readonly string[];
+    readonly lisaOwnedExcerpts: readonly UpstreamAttributionExcerpt[];
+    readonly upstreamRefs: readonly string[];
+};
+/**
+ * Build the public upstream issue body from enumerated fields only.
+ *
+ * Unknown fields are rejected instead of ignored so callers cannot smuggle
+ * host-project prose into a world-readable Lisa issue body.
+ *
+ * @param input - Candidate body data from the handoff-upstream flow
+ * @returns Markdown body safe to pass to the upstream GitHub issue writer
+ */
+export declare function buildUpstreamAttributionIssueBody(input: unknown): string;
+//# sourceMappingURL=upstream-attribution-body.d.ts.map

package/dist/core/upstream-attribution-body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-attribution-body.d.ts","sourceRoot":"","sources":["../../src/core/upstream-attribution-body.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAEhF,6EAA6E;AAC7E,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,gFAAgF;AAChF,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,iBAAiB,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAClE,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C,CAAC;AAsNF;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CA+BxE"}

package/dist/core/upstream-attribution-body.js

@@ -0,0 +1,170 @@
+/** Allowlist-only body builder for public upstream Lisa attribution filings. */
+const INPUT_KEYS = [
+    "markerKey",
+    "failureClass",
+    "lisaSurface",
+    "operatorImpact",
+    "harnessFault",
+    "requestedChange",
+    "affectedProject",
+    "hostIssueUrl",
+    "attributionEvidence",
+    "lisaOwnedExcerpts",
+    "upstreamRefs",
+];
+const EXCERPT_KEYS = ["surface", "text"];
+const SIMPLE_BLOCKED_PATTERNS = [
+    /AKIA[\dA-Z]{16}/u,
+    /gh[pousr]_\w{20,}/u,
+    /xox[baprs]-[\w-]{20,}/u,
+];
+const isPlainRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const assertKnownKeys = (value, allowed, label) => {
+    const unknownKeys = Object.keys(value).filter(key => !allowed.includes(key));
+    if (unknownKeys.length > 0) {
+        throw new Error(`${label} contains non-allowlisted field(s): ${unknownKeys.join(", ")}`);
+    }
+};
+const requireString = (value, key) => {
+    const field = value[key];
+    if (typeof field !== "string" || field.trim().length === 0) {
+        throw new Error(`upstream attribution field ${key} must be a non-empty string`);
+    }
+    if (matchesBlockedShape(field)) {
+        throw new Error(`upstream attribution field ${key} matched a blocked shape`);
+    }
+    return field.trim();
+};
+const requireStringArray = (value, key) => {
+    const field = value[key];
+    if (!Array.isArray(field) || field.length === 0) {
+        throw new Error(`upstream attribution field ${key} must be a non-empty array`);
+    }
+    return field.map((item, index) => {
+        if (typeof item !== "string" || item.trim().length === 0) {
+            throw new Error(`upstream attribution field ${key}[${index}] must be a non-empty string`);
+        }
+        if (matchesBlockedShape(item)) {
+            throw new Error(`upstream attribution field ${key}[${index}] matched a blocked shape`);
+        }
+        return item.trim();
+    });
+};
+const requireExcerpts = (value) => {
+    const field = value.lisaOwnedExcerpts;
+    if (!Array.isArray(field) || field.length === 0) {
+        throw new Error("upstream attribution field lisaOwnedExcerpts must be a non-empty array");
+    }
+    return field.map((item, index) => {
+        if (!isPlainRecord(item)) {
+            throw new Error(`upstream attribution field lisaOwnedExcerpts[${index}] must be an object`);
+        }
+        assertKnownKeys(item, EXCERPT_KEYS, `lisaOwnedExcerpts[${index}]`);
+        const surface = requireExcerptString(item, "surface", index);
+        const text = requireExcerptString(item, "text", index);
+        return { surface, text };
+    });
+};
+const requireExcerptString = (value, key, index) => {
+    const field = value[key];
+    if (typeof field !== "string" || field.trim().length === 0) {
+        throw new Error(`upstream attribution field lisaOwnedExcerpts[${index}].${key} must be a non-empty string`);
+    }
+    if (matchesBlockedShape(field)) {
+        throw new Error(`upstream attribution field lisaOwnedExcerpts[${index}].${key} matched a blocked shape`);
+    }
+    return field.trim();
+};
+const bulletList = (items) => items.map(item => `- ${item}`).join("\n");
+const excerptList = (items) => items
+    .map(item => `- ${item.surface}\n\n  \`\`\`text\n  ${item.text}\n  \`\`\``)
+    .join("\n");
+const hasHighEntropyAssignment = (value) => value.split(/\s+/u).some(token => {
+    const [_key, fieldValue] = token.split("=", 2);
+    if (fieldValue === undefined || fieldValue.length < 16) {
+        return false;
+    }
+    return /[A-Za-z]/u.test(fieldValue) && /\d/u.test(fieldValue);
+});
+const hasEmailLikeToken = (value) => value.split(/\s+/u).some(token => {
+    const atIndex = token.indexOf("@");
+    const dotIndex = token.lastIndexOf(".");
+    return atIndex > 0 && dotIndex > atIndex + 1 && dotIndex < token.length - 1;
+});
+const matchesBlockedShape = (value) => SIMPLE_BLOCKED_PATTERNS.some(pattern => pattern.test(value)) ||
+    hasEmailLikeToken(value) ||
+    hasHighEntropyAssignment(value);
+const parseBodyInput = (input) => {
+    if (!isPlainRecord(input)) {
+        throw new Error("upstream attribution body input must be an object");
+    }
+    const unknownKeys = Object.keys(input).filter(key => !INPUT_KEYS.includes(key));
+    if (unknownKeys.length > 0) {
+        throw new Error(`upstream attribution body input contains non-allowlisted field(s): ${unknownKeys.join(", ")}`);
+    }
+    const markerKey = requireString(input, "markerKey");
+    const failureClass = requireString(input, "failureClass");
+    const lisaSurface = requireString(input, "lisaSurface");
+    const operatorImpact = requireString(input, "operatorImpact");
+    const harnessFault = requireString(input, "harnessFault");
+    const requestedChange = requireString(input, "requestedChange");
+    const affectedProject = requireString(input, "affectedProject");
+    const hostIssueUrl = requireString(input, "hostIssueUrl");
+    const attributionEvidence = requireStringArray(input, "attributionEvidence");
+    const upstreamRefs = requireStringArray(input, "upstreamRefs");
+    const lisaOwnedExcerpts = requireExcerpts(input);
+    return {
+        markerKey,
+        failureClass,
+        lisaSurface,
+        operatorImpact,
+        harnessFault,
+        requestedChange,
+        affectedProject,
+        hostIssueUrl,
+        attributionEvidence,
+        lisaOwnedExcerpts,
+        upstreamRefs,
+    };
+};
+/**
+ * Build the public upstream issue body from enumerated fields only.
+ *
+ * Unknown fields are rejected instead of ignored so callers cannot smuggle
+ * host-project prose into a world-readable Lisa issue body.
+ *
+ * @param input - Candidate body data from the handoff-upstream flow
+ * @returns Markdown body safe to pass to the upstream GitHub issue writer
+ */
+export function buildUpstreamAttributionIssueBody(input) {
+    const bodyInput = parseBodyInput(input);
+    return [
+        `<!-- [lisa-upstream-attribution] key=${bodyInput.markerKey} -->`,
+        "",
+        "## Operator impact",
+        bodyInput.operatorImpact,
+        "",
+        "## Harness fault",
+        bodyInput.harnessFault,
+        "",
+        "## Requested Lisa change",
+        bodyInput.requestedChange,
+        "",
+        "## Redacted evidence chain",
+        `- Failure class: ${bodyInput.failureClass}`,
+        `- Lisa surface: ${bodyInput.lisaSurface}`,
+        `- Affected project: ${bodyInput.affectedProject}`,
+        `- Host-project issue: ${bodyInput.hostIssueUrl}`,
+        "- Reproduction: REDACTED host values only; see linked host issue for private context.",
+        "",
+        "## Attribution evidence",
+        bulletList(bodyInput.attributionEvidence),
+        "",
+        "## Lisa-owned excerpts",
+        excerptList(bodyInput.lisaOwnedExcerpts),
+        "",
+        "## Upstream references",
+        bulletList(bodyInput.upstreamRefs),
+    ].join("\n");
+}
+//# sourceMappingURL=upstream-attribution-body.js.map

package/dist/core/upstream-attribution-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-attribution-body.js","sourceRoot":"","sources":["../../src/core/upstream-attribution-body.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAuBhF,MAAM,UAAU,GAAG;IACjB,WAAW;IACX,cAAc;IACd,aAAa;IACb,gBAAgB;IAChB,cAAc;IACd,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,qBAAqB;IACrB,mBAAmB;IACnB,cAAc;CACN,CAAC;AAEX,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,MAAM,CAAU,CAAC;AAElD,MAAM,uBAAuB,GAAG;IAC9B,kBAAkB;IAClB,oBAAoB;IACpB,wBAAwB;CAChB,CAAC;AAEX,MAAM,aAAa,GAAG,CAAC,KAAc,EAAoC,EAAE,CACzE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEvE,MAAM,eAAe,GAAG,CACtB,KAA8B,EAC9B,OAA0B,EAC1B,KAAa,EACP,EAAE;IACR,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,uCAAuC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxE,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CACpB,KAA8B,EAC9B,GAAuC,EAC/B,EAAE;IACV,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAEzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,8BAA8B,GAAG,6BAA6B,CAC/D,CAAC;IACJ,CAAC;IAED,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,8BAA8B,GAAG,0BAA0B,CAC5D,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CACzB,KAA8B,EAC9B,GAAuC,EACpB,EAAE;IACrB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAEzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,8BAA8B,GAAG,4BAA4B,CAC9D,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,8BAA8B,GAAG,IAAI,KAAK,8BAA8B,CACzE,CAAC;QACJ,CAAC;QAED,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,8BAA8B,GAAG,IAAI,KAAK,2BAA2B,CACtE,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CACtB,KAA8B,EACS,EAAE;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAEtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC/B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,qBAAqB,CAC3E,CAAC;QACJ,CAAC;QAED,eAAe,CAAC,IAAI,EAAE,YAAY,EAAE,qBAAqB,KAAK,GAAG,CAAC,CAAC;QAEnE,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAEvD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAC3B,KAA8B,EAC9B,GAAqC,EACrC,KAAa,EACL,EAAE;IACV,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAEzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,KAAK,GAAG,6BAA6B,CAC3F,CAAC;IACJ,CAAC;IAED,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,KAAK,GAAG,0BAA0B,CACxF,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,KAAwB,EAAU,EAAE,CACtD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAE5C,MAAM,WAAW,GAAG,CAAC,KAA4C,EAAU,EAAE,CAC3E,KAAK;KACF,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,uBAAuB,IAAI,CAAC,IAAI,YAAY,CAAC;KAC1E,IAAI,CAAC,IAAI,CAAC,CAAC;AAEhB,MAAM,wBAAwB,GAAG,CAAC,KAAa,EAAW,EAAE,CAC1D,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;IAC/B,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAE/C,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC;AAEL,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAW,EAAE,CACnD,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;IAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAExC,OAAO,OAAO,GAAG,CAAC,IAAI,QAAQ,GAAG,OAAO,GAAG,CAAC,IAAI,QAAQ,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9E,CAAC,CAAC,CAAC;AAEL,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAAW,EAAE,CACrD,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,iBAAiB,CAAC,KAAK,CAAC;IACxB,wBAAwB,CAAC,KAAK,CAAC,CAAC;AAElC,MAAM,cAAc,GAAG,CAAC,KAAc,EAAgC,EAAE;IACtE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAC3C,GAAG,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAkC,CAAC,CAChE,CAAC;IAEF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,sEAAsE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/F,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,aAAa,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,aAAa,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAChE,MAAM,eAAe,GAAG,aAAa,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC1D,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAG,kBAAkB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAEjD,OAAO;QACL,SAAS;QACT,YAAY;QACZ,WAAW;QACX,cAAc;QACd,YAAY;QACZ,eAAe;QACf,eAAe;QACf,YAAY;QACZ,mBAAmB;QACnB,iBAAiB;QACjB,YAAY;KACb,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAAC,KAAc;IAC9D,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAExC,OAAO;QACL,wCAAwC,SAAS,CAAC,SAAS,MAAM;QACjE,EAAE;QACF,oBAAoB;QACpB,SAAS,CAAC,cAAc;QACxB,EAAE;QACF,kBAAkB;QAClB,SAAS,CAAC,YAAY;QACtB,EAAE;QACF,0BAA0B;QAC1B,SAAS,CAAC,eAAe;QACzB,EAAE;QACF,4BAA4B;QAC5B,oBAAoB,SAAS,CAAC,YAAY,EAAE;QAC5C,mBAAmB,SAAS,CAAC,WAAW,EAAE;QAC1C,uBAAuB,SAAS,CAAC,eAAe,EAAE;QAClD,yBAAyB,SAAS,CAAC,YAAY,EAAE;QACjD,uFAAuF;QACvF,EAAE;QACF,yBAAyB;QACzB,UAAU,CAAC,SAAS,CAAC,mBAAmB,CAAC;QACzC,EAAE;QACF,wBAAwB;QACxB,WAAW,CAAC,SAAS,CAAC,iBAAiB,CAAC;QACxC,EAAE;QACF,wBAAwB;QACxB,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC;KACnC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/expo/create-only/.github/workflows/ci.yml

@@ -28,6 +28,8 @@ jobs:
   quality:
     name: 🔍 Quality Checks
     # Reference to the quality checks workflow
+    permissions:
+      contents: read
     uses: CodySwannGT/lisa/.github/workflows/quality.yml@main
     with:
       node_version: '22.21.1'

package/harper-fabric/copy-overwrite/.github/workflows/ci.yml

@@ -10,6 +10,8 @@ on:
 jobs:
   quality:
     name: 🔍 Quality Checks
+    permissions:
+      contents: read
     uses: CodySwannGT/lisa/.github/workflows/quality.yml@main
     with:
       node_version: '22.21.1'

package/nestjs/create-only/.github/workflows/ci.yml

@@ -12,6 +12,8 @@ jobs:
   quality:
     name: 🔍 Quality Checks
     # Reference to the quality checks workflow
+    permissions:
+      contents: read
     uses: CodySwannGT/lisa/.github/workflows/quality.yml@main
     with:
       node_version: '22.21.1'

package/package.json

@@ -102,7 +102,7 @@
     "form-data": ">=4.0.6"
   },
   "name": "@codyswann/lisa",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/phaser/copy-overwrite/.github/workflows/ci.yml

@@ -13,6 +13,8 @@ on:
 jobs:
   quality:
     name: 🔍 Quality Checks
+    permissions:
+      contents: read
     uses: CodySwannGT/lisa/.github/workflows/quality.yml@main
     with:
       node_version: '22.21.1'

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-persist-learning/SKILL.md

@@ -102,6 +102,7 @@ This disposition completes the SLL-5 loop (#1583): on a Lisa-attributed failure
    - Never paste host environment values, tokens/credentials, connection strings, API keys, PII (names, emails, customer data), or proprietary host code/payloads.
    - The evidence chain names the Lisa surface and the failure class — never project payloads. When host context is essential to understand the failure, LINK the host-project issue instead of quoting it.
    - Before filing or commenting, scan the drafted body for common secret shapes — `key=value` pairs with high-entropy values, token prefixes (`AKIA`, `ghp_`, `xox`), email addresses — and strip on match. When in doubt, leave it out: a thinner upstream ticket is recoverable; a leaked secret is not.
+   - Compose the public upstream issue body through the executable allowlist builder, never by free-form prose assembly. Import `buildUpstreamAttributionIssueBody` from `@codyswann/lisa/learnings` and pass only its typed fields: marker key, Lisa surface, failure class, operator impact, harness fault, requested Lisa change, affected project name, host issue link, Lisa-owned excerpts, attribution evidence, and upstream refs. Non-allowlisted fields must reject before filing; do not "drop" unknown host context silently. The deny-list scan above remains a backstop after the builder returns.
 
 6. **Dedupe by marker, then file or update.** The upstream marker is:
 
@@ -111,7 +112,7 @@ This disposition completes the SLL-5 loop (#1583): on a Lisa-attributed failure
 
    Resolve the upstream repo from `.lisa.config.json` `hardening.upstreamRepo` (default `CodySwannGT/lisa`). Search **all issue states** for an existing issue carrying the marker — a closed marker-bearing ticket still owns this root cause, and searching only open issues would mint a duplicate the moment the original closes. Match on the **MARKER, never the title** — with the same eventual-consistency guard as above (`gh issue list -R <upstream> --state all --search '"<marker>" in:body' --json number,state,url`, and when the search index returns nothing, also `gh issue list -R <upstream> --state all --json number,state,body` and grep the bodies for the marker before concluding no ticket exists).
 
-   - **No existing ticket** → file via `lisa-github-write-issue` targeting the upstream repo, following the `lisa-rework-triage` "Filing upstream" discipline: a three-audience description (what failed for the operator, what the harness did wrong, what to change), the redacted evidence chain (Lisa-owned text only, per step 5: defect → Lisa surface → attribution evidence → redacted reproduction), the affected project named, and the `self-hardening` label. The body carries **exactly one** dedupe marker; **never write a markerless body** — it permanently breaks all future dedupe.
+   - **No existing ticket** → file via `lisa-github-write-issue` targeting the upstream repo, following the `lisa-rework-triage` "Filing upstream" discipline. The body must be the exact output of `buildUpstreamAttributionIssueBody`, which provides the three-audience description (what failed for the operator, what the harness did wrong, what to change), the redacted evidence chain (Lisa-owned text only, per step 5: defect → Lisa surface → attribution evidence → redacted reproduction), the affected project name/link, and **exactly one** dedupe marker. Apply the `self-hardening` label. **Never write a markerless body** — it permanently breaks all future dedupe.
    - **Existing ticket (open or closed)** → this is a repeat encounter: comment the new occurrence on the existing issue with this project's evidence, marker-deduped per occurrence via `<!-- [lisa-upstream-attribution-occurrence] key=<fingerprint> -->` so re-runs never duplicate the occurrence comment. Never open a second issue, and never match on the title — evidence compounds on one ticket. When the match is **CLOSED**, still comment the occurrence there and reference it in the local trace instead of filing a duplicate; do not reopen it yourself — recurrence evidence on a closed ticket signals the shipped fix may not cover this case, and reopening is the upstream maintainer's call.
 
 7. **Leave the local trace — a note, never a rule.** Post one follow-up comment on the triggering issue linking the upstream ticket:

package/plugins/lisa/skills/lisa-persist-learning/SKILL.md

@@ -102,6 +102,7 @@ This disposition completes the SLL-5 loop (#1583): on a Lisa-attributed failure
    - Never paste host environment values, tokens/credentials, connection strings, API keys, PII (names, emails, customer data), or proprietary host code/payloads.
    - The evidence chain names the Lisa surface and the failure class — never project payloads. When host context is essential to understand the failure, LINK the host-project issue instead of quoting it.
    - Before filing or commenting, scan the drafted body for common secret shapes — `key=value` pairs with high-entropy values, token prefixes (`AKIA`, `ghp_`, `xox`), email addresses — and strip on match. When in doubt, leave it out: a thinner upstream ticket is recoverable; a leaked secret is not.
+   - Compose the public upstream issue body through the executable allowlist builder, never by free-form prose assembly. Import `buildUpstreamAttributionIssueBody` from `@codyswann/lisa/learnings` and pass only its typed fields: marker key, Lisa surface, failure class, operator impact, harness fault, requested Lisa change, affected project name, host issue link, Lisa-owned excerpts, attribution evidence, and upstream refs. Non-allowlisted fields must reject before filing; do not "drop" unknown host context silently. The deny-list scan above remains a backstop after the builder returns.
 
 6. **Dedupe by marker, then file or update.** The upstream marker is:
 
@@ -111,7 +112,7 @@ This disposition completes the SLL-5 loop (#1583): on a Lisa-attributed failure
 
    Resolve the upstream repo from `.lisa.config.json` `hardening.upstreamRepo` (default `CodySwannGT/lisa`). Search **all issue states** for an existing issue carrying the marker — a closed marker-bearing ticket still owns this root cause, and searching only open issues would mint a duplicate the moment the original closes. Match on the **MARKER, never the title** — with the same eventual-consistency guard as above (`gh issue list -R <upstream> --state all --search '"<marker>" in:body' --json number,state,url`, and when the search index returns nothing, also `gh issue list -R <upstream> --state all --json number,state,body` and grep the bodies for the marker before concluding no ticket exists).
 
-   - **No existing ticket** → file via `lisa-github-write-issue` targeting the upstream repo, following the `lisa-rework-triage` "Filing upstream" discipline: a three-audience description (what failed for the operator, what the harness did wrong, what to change), the redacted evidence chain (Lisa-owned text only, per step 5: defect → Lisa surface → attribution evidence → redacted reproduction), the affected project named, and the `self-hardening` label. The body carries **exactly one** dedupe marker; **never write a markerless body** — it permanently breaks all future dedupe.
+   - **No existing ticket** → file via `lisa-github-write-issue` targeting the upstream repo, following the `lisa-rework-triage` "Filing upstream" discipline. The body must be the exact output of `buildUpstreamAttributionIssueBody`, which provides the three-audience description (what failed for the operator, what the harness did wrong, what to change), the redacted evidence chain (Lisa-owned text only, per step 5: defect → Lisa surface → attribution evidence → redacted reproduction), the affected project name/link, and **exactly one** dedupe marker. Apply the `self-hardening` label. **Never write a markerless body** — it permanently breaks all future dedupe.
    - **Existing ticket (open or closed)** → this is a repeat encounter: comment the new occurrence on the existing issue with this project's evidence, marker-deduped per occurrence via `<!-- [lisa-upstream-attribution-occurrence] key=<fingerprint> -->` so re-runs never duplicate the occurrence comment. Never open a second issue, and never match on the title — evidence compounds on one ticket. When the match is **CLOSED**, still comment the occurrence there and reference it in the local trace instead of filing a duplicate; do not reopen it yourself — recurrence evidence on a closed ticket signals the shipped fix may not cover this case, and reopening is the upstream maintainer's call.
 
 7. **Leave the local trace — a note, never a rule.** Post one follow-up comment on the triggering issue linking the upstream ticket:

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-persist-learning/SKILL.md

@@ -102,6 +102,7 @@ This disposition completes the SLL-5 loop (#1583): on a Lisa-attributed failure
    - Never paste host environment values, tokens/credentials, connection strings, API keys, PII (names, emails, customer data), or proprietary host code/payloads.
    - The evidence chain names the Lisa surface and the failure class — never project payloads. When host context is essential to understand the failure, LINK the host-project issue instead of quoting it.
    - Before filing or commenting, scan the drafted body for common secret shapes — `key=value` pairs with high-entropy values, token prefixes (`AKIA`, `ghp_`, `xox`), email addresses — and strip on match. When in doubt, leave it out: a thinner upstream ticket is recoverable; a leaked secret is not.
+   - Compose the public upstream issue body through the executable allowlist builder, never by free-form prose assembly. Import `buildUpstreamAttributionIssueBody` from `@codyswann/lisa/learnings` and pass only its typed fields: marker key, Lisa surface, failure class, operator impact, harness fault, requested Lisa change, affected project name, host issue link, Lisa-owned excerpts, attribution evidence, and upstream refs. Non-allowlisted fields must reject before filing; do not "drop" unknown host context silently. The deny-list scan above remains a backstop after the builder returns.
 
 6. **Dedupe by marker, then file or update.** The upstream marker is:
 
@@ -111,7 +112,7 @@ This disposition completes the SLL-5 loop (#1583): on a Lisa-attributed failure
 
    Resolve the upstream repo from `.lisa.config.json` `hardening.upstreamRepo` (default `CodySwannGT/lisa`). Search **all issue states** for an existing issue carrying the marker — a closed marker-bearing ticket still owns this root cause, and searching only open issues would mint a duplicate the moment the original closes. Match on the **MARKER, never the title** — with the same eventual-consistency guard as above (`gh issue list -R <upstream> --state all --search '"<marker>" in:body' --json number,state,url`, and when the search index returns nothing, also `gh issue list -R <upstream> --state all --json number,state,body` and grep the bodies for the marker before concluding no ticket exists).
 
-   - **No existing ticket** → file via `lisa-github-write-issue` targeting the upstream repo, following the `lisa-rework-triage` "Filing upstream" discipline: a three-audience description (what failed for the operator, what the harness did wrong, what to change), the redacted evidence chain (Lisa-owned text only, per step 5: defect → Lisa surface → attribution evidence → redacted reproduction), the affected project named, and the `self-hardening` label. The body carries **exactly one** dedupe marker; **never write a markerless body** — it permanently breaks all future dedupe.
+   - **No existing ticket** → file via `lisa-github-write-issue` targeting the upstream repo, following the `lisa-rework-triage` "Filing upstream" discipline. The body must be the exact output of `buildUpstreamAttributionIssueBody`, which provides the three-audience description (what failed for the operator, what the harness did wrong, what to change), the redacted evidence chain (Lisa-owned text only, per step 5: defect → Lisa surface → attribution evidence → redacted reproduction), the affected project name/link, and **exactly one** dedupe marker. Apply the `self-hardening` label. **Never write a markerless body** — it permanently breaks all future dedupe.
    - **Existing ticket (open or closed)** → this is a repeat encounter: comment the new occurrence on the existing issue with this project's evidence, marker-deduped per occurrence via `<!-- [lisa-upstream-attribution-occurrence] key=<fingerprint> -->` so re-runs never duplicate the occurrence comment. Never open a second issue, and never match on the title — evidence compounds on one ticket. When the match is **CLOSED**, still comment the occurrence there and reference it in the local trace instead of filing a duplicate; do not reopen it yourself — recurrence evidence on a closed ticket signals the shipped fix may not cover this case, and reopening is the upstream maintainer's call.
 
 7. **Leave the local trace — a note, never a rule.** Post one follow-up comment on the triggering issue linking the upstream ticket:

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/skills/lisa-persist-learning/SKILL.md

@@ -102,6 +102,7 @@ This disposition completes the SLL-5 loop (#1583): on a Lisa-attributed failure
    - Never paste host environment values, tokens/credentials, connection strings, API keys, PII (names, emails, customer data), or proprietary host code/payloads.
    - The evidence chain names the Lisa surface and the failure class — never project payloads. When host context is essential to understand the failure, LINK the host-project issue instead of quoting it.
    - Before filing or commenting, scan the drafted body for common secret shapes — `key=value` pairs with high-entropy values, token prefixes (`AKIA`, `ghp_`, `xox`), email addresses — and strip on match. When in doubt, leave it out: a thinner upstream ticket is recoverable; a leaked secret is not.
+   - Compose the public upstream issue body through the executable allowlist builder, never by free-form prose assembly. Import `buildUpstreamAttributionIssueBody` from `@codyswann/lisa/learnings` and pass only its typed fields: marker key, Lisa surface, failure class, operator impact, harness fault, requested Lisa change, affected project name, host issue link, Lisa-owned excerpts, attribution evidence, and upstream refs. Non-allowlisted fields must reject before filing; do not "drop" unknown host context silently. The deny-list scan above remains a backstop after the builder returns.
 
 6. **Dedupe by marker, then file or update.** The upstream marker is:
 
@@ -111,7 +112,7 @@ This disposition completes the SLL-5 loop (#1583): on a Lisa-attributed failure
 
    Resolve the upstream repo from `.lisa.config.json` `hardening.upstreamRepo` (default `CodySwannGT/lisa`). Search **all issue states** for an existing issue carrying the marker — a closed marker-bearing ticket still owns this root cause, and searching only open issues would mint a duplicate the moment the original closes. Match on the **MARKER, never the title** — with the same eventual-consistency guard as above (`gh issue list -R <upstream> --state all --search '"<marker>" in:body' --json number,state,url`, and when the search index returns nothing, also `gh issue list -R <upstream> --state all --json number,state,body` and grep the bodies for the marker before concluding no ticket exists).
 
-   - **No existing ticket** → file via `lisa-github-write-issue` targeting the upstream repo, following the `lisa-rework-triage` "Filing upstream" discipline: a three-audience description (what failed for the operator, what the harness did wrong, what to change), the redacted evidence chain (Lisa-owned text only, per step 5: defect → Lisa surface → attribution evidence → redacted reproduction), the affected project named, and the `self-hardening` label. The body carries **exactly one** dedupe marker; **never write a markerless body** — it permanently breaks all future dedupe.
+   - **No existing ticket** → file via `lisa-github-write-issue` targeting the upstream repo, following the `lisa-rework-triage` "Filing upstream" discipline. The body must be the exact output of `buildUpstreamAttributionIssueBody`, which provides the three-audience description (what failed for the operator, what the harness did wrong, what to change), the redacted evidence chain (Lisa-owned text only, per step 5: defect → Lisa surface → attribution evidence → redacted reproduction), the affected project name/link, and **exactly one** dedupe marker. Apply the `self-hardening` label. **Never write a markerless body** — it permanently breaks all future dedupe.
    - **Existing ticket (open or closed)** → this is a repeat encounter: comment the new occurrence on the existing issue with this project's evidence, marker-deduped per occurrence via `<!-- [lisa-upstream-attribution-occurrence] key=<fingerprint> -->` so re-runs never duplicate the occurrence comment. Never open a second issue, and never match on the title — evidence compounds on one ticket. When the match is **CLOSED**, still comment the occurrence there and reference it in the local trace instead of filing a duplicate; do not reopen it yourself — recurrence evidence on a closed ticket signals the shipped fix may not cover this case, and reopening is the upstream maintainer's call.
 
 7. **Leave the local trace — a note, never a rule.** Post one follow-up comment on the triggering issue linking the upstream ticket:

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/skills/lisa-persist-learning/SKILL.md

@@ -102,6 +102,7 @@ This disposition completes the SLL-5 loop (#1583): on a Lisa-attributed failure
    - Never paste host environment values, tokens/credentials, connection strings, API keys, PII (names, emails, customer data), or proprietary host code/payloads.
    - The evidence chain names the Lisa surface and the failure class — never project payloads. When host context is essential to understand the failure, LINK the host-project issue instead of quoting it.
    - Before filing or commenting, scan the drafted body for common secret shapes — `key=value` pairs with high-entropy values, token prefixes (`AKIA`, `ghp_`, `xox`), email addresses — and strip on match. When in doubt, leave it out: a thinner upstream ticket is recoverable; a leaked secret is not.
+   - Compose the public upstream issue body through the executable allowlist builder, never by free-form prose assembly. Import `buildUpstreamAttributionIssueBody` from `@codyswann/lisa/learnings` and pass only its typed fields: marker key, Lisa surface, failure class, operator impact, harness fault, requested Lisa change, affected project name, host issue link, Lisa-owned excerpts, attribution evidence, and upstream refs. Non-allowlisted fields must reject before filing; do not "drop" unknown host context silently. The deny-list scan above remains a backstop after the builder returns.
 
 6. **Dedupe by marker, then file or update.** The upstream marker is:
 
@@ -111,7 +112,7 @@ This disposition completes the SLL-5 loop (#1583): on a Lisa-attributed failure
 
    Resolve the upstream repo from `.lisa.config.json` `hardening.upstreamRepo` (default `CodySwannGT/lisa`). Search **all issue states** for an existing issue carrying the marker — a closed marker-bearing ticket still owns this root cause, and searching only open issues would mint a duplicate the moment the original closes. Match on the **MARKER, never the title** — with the same eventual-consistency guard as above (`gh issue list -R <upstream> --state all --search '"<marker>" in:body' --json number,state,url`, and when the search index returns nothing, also `gh issue list -R <upstream> --state all --json number,state,body` and grep the bodies for the marker before concluding no ticket exists).
 
-   - **No existing ticket** → file via `lisa-github-write-issue` targeting the upstream repo, following the `lisa-rework-triage` "Filing upstream" discipline: a three-audience description (what failed for the operator, what the harness did wrong, what to change), the redacted evidence chain (Lisa-owned text only, per step 5: defect → Lisa surface → attribution evidence → redacted reproduction), the affected project named, and the `self-hardening` label. The body carries **exactly one** dedupe marker; **never write a markerless body** — it permanently breaks all future dedupe.
+   - **No existing ticket** → file via `lisa-github-write-issue` targeting the upstream repo, following the `lisa-rework-triage` "Filing upstream" discipline. The body must be the exact output of `buildUpstreamAttributionIssueBody`, which provides the three-audience description (what failed for the operator, what the harness did wrong, what to change), the redacted evidence chain (Lisa-owned text only, per step 5: defect → Lisa surface → attribution evidence → redacted reproduction), the affected project name/link, and **exactly one** dedupe marker. Apply the `self-hardening` label. **Never write a markerless body** — it permanently breaks all future dedupe.
    - **Existing ticket (open or closed)** → this is a repeat encounter: comment the new occurrence on the existing issue with this project's evidence, marker-deduped per occurrence via `<!-- [lisa-upstream-attribution-occurrence] key=<fingerprint> -->` so re-runs never duplicate the occurrence comment. Never open a second issue, and never match on the title — evidence compounds on one ticket. When the match is **CLOSED**, still comment the occurrence there and reference it in the local trace instead of filing a duplicate; do not reopen it yourself — recurrence evidence on a closed ticket signals the shipped fix may not cover this case, and reopening is the upstream maintainer's call.
 
 7. **Leave the local trace — a note, never a rule.** Post one follow-up comment on the triggering issue linking the upstream ticket:

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.258.4",
+  "version": "2.259.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/skills/lisa-persist-learning/SKILL.md

@@ -102,6 +102,7 @@ This disposition completes the SLL-5 loop (#1583): on a Lisa-attributed failure
    - Never paste host environment values, tokens/credentials, connection strings, API keys, PII (names, emails, customer data), or proprietary host code/payloads.
    - The evidence chain names the Lisa surface and the failure class — never project payloads. When host context is essential to understand the failure, LINK the host-project issue instead of quoting it.
    - Before filing or commenting, scan the drafted body for common secret shapes — `key=value` pairs with high-entropy values, token prefixes (`AKIA`, `ghp_`, `xox`), email addresses — and strip on match. When in doubt, leave it out: a thinner upstream ticket is recoverable; a leaked secret is not.
+   - Compose the public upstream issue body through the executable allowlist builder, never by free-form prose assembly. Import `buildUpstreamAttributionIssueBody` from `@codyswann/lisa/learnings` and pass only its typed fields: marker key, Lisa surface, failure class, operator impact, harness fault, requested Lisa change, affected project name, host issue link, Lisa-owned excerpts, attribution evidence, and upstream refs. Non-allowlisted fields must reject before filing; do not "drop" unknown host context silently. The deny-list scan above remains a backstop after the builder returns.
 
 6. **Dedupe by marker, then file or update.** The upstream marker is:
 
@@ -111,7 +112,7 @@ This disposition completes the SLL-5 loop (#1583): on a Lisa-attributed failure
 
    Resolve the upstream repo from `.lisa.config.json` `hardening.upstreamRepo` (default `CodySwannGT/lisa`). Search **all issue states** for an existing issue carrying the marker — a closed marker-bearing ticket still owns this root cause, and searching only open issues would mint a duplicate the moment the original closes. Match on the **MARKER, never the title** — with the same eventual-consistency guard as above (`gh issue list -R <upstream> --state all --search '"<marker>" in:body' --json number,state,url`, and when the search index returns nothing, also `gh issue list -R <upstream> --state all --json number,state,body` and grep the bodies for the marker before concluding no ticket exists).
 
-   - **No existing ticket** → file via `lisa-github-write-issue` targeting the upstream repo, following the `lisa-rework-triage` "Filing upstream" discipline: a three-audience description (what failed for the operator, what the harness did wrong, what to change), the redacted evidence chain (Lisa-owned text only, per step 5: defect → Lisa surface → attribution evidence → redacted reproduction), the affected project named, and the `self-hardening` label. The body carries **exactly one** dedupe marker; **never write a markerless body** — it permanently breaks all future dedupe.
+   - **No existing ticket** → file via `lisa-github-write-issue` targeting the upstream repo, following the `lisa-rework-triage` "Filing upstream" discipline. The body must be the exact output of `buildUpstreamAttributionIssueBody`, which provides the three-audience description (what failed for the operator, what the harness did wrong, what to change), the redacted evidence chain (Lisa-owned text only, per step 5: defect → Lisa surface → attribution evidence → redacted reproduction), the affected project name/link, and **exactly one** dedupe marker. Apply the `self-hardening` label. **Never write a markerless body** — it permanently breaks all future dedupe.
    - **Existing ticket (open or closed)** → this is a repeat encounter: comment the new occurrence on the existing issue with this project's evidence, marker-deduped per occurrence via `<!-- [lisa-upstream-attribution-occurrence] key=<fingerprint> -->` so re-runs never duplicate the occurrence comment. Never open a second issue, and never match on the title — evidence compounds on one ticket. When the match is **CLOSED**, still comment the occurrence there and reference it in the local trace instead of filing a duplicate; do not reopen it yourself — recurrence evidence on a closed ticket signals the shipped fix may not cover this case, and reopening is the upstream maintainer's call.
 
 7. **Leave the local trace — a note, never a rule.** Post one follow-up comment on the triggering issue linking the upstream ticket: