@codyswann/lisa 2.285.1 → 2.286.1

package/all/create-only/.lisa/DEPENDENCY_DECISIONS.md

@@ -45,6 +45,73 @@ script without rewriting the rest of the file:
 - `_Not yet decided_` is the reserved marker for an unanswered field, so
   unfilled entries are visibly honest rather than silently empty.
 
+## The rest of the dependency-ownership layer
+
+This file is one of five parts, and it is the only one that lives in your
+project's own source. Three of the other four are still readable from here,
+because they ship inside the installed Lisa package — paths starting
+`node_modules/` below. The remaining two exist only in the Lisa project itself
+and are called out as such; do not go looking for them in this repository.
+
+**Installed in this project** (readable from your project root):
+
+- **The six trust classes** — how much scrutiny a dependency deserves, set by
+  what it can reach rather than by how famous it is. The six are: mature
+  ecosystem primitive, fast-moving standard implementation, build/development
+  tool, runtime-critical service client, thin wrapper suitable for in-house
+  ownership, and temporary/experimental dependency. Sign-off rules differ by
+  class and by moment: a **runtime-critical service client** needs a human
+  sign-off to be added and at every major upgrade; a **temporary/experimental
+  dependency** needs none to be added — moving fast is the point — but must
+  carry a written expiry date no more than one quarter out and a named exit, and
+  then needs sign-off to extend past that date or to promote it. The full
+  definitions, with the evidence each class demands, are at
+  `node_modules/@codyswann/lisa/plugins/lisa/rules/reference/dependency-trust-classes.md`.
+  Your coding agent already has these loaded, so "which trust class is this, and
+  what evidence does that class require?" is a question you can just ask it.
+
+- **The confidence-rebuild kit** — the seven things a change must prove when a
+  dependency is removed and the capability rebuilt in-house: real corpus,
+  conformance fixtures, negative fixtures, coverage as a gap detector,
+  provenance and license review, migration and update plan, and rollback or
+  replacement criteria. All seven are required; a partial kit is the finding. It
+  does **not** apply to an ordinary version bump. Full text at
+  `node_modules/@codyswann/lisa/plugins/lisa/rules/reference/dependency-internalization-kit.md`.
+
+- **The manifest-authoritative duplicate-pin policy** — a version belongs in
+  `package.json` and nowhere else; every copy of the literal in a workflow or a
+  script is a second edit site a routine bump can miss. Lisa ships a detector
+  you can run against this project:
+
+  ```bash
+  node node_modules/@codyswann/lisa/scripts/check-duplicate-versions.mjs --root . --scan .
+  ```
+
+  Be honest about what it is today: **advisory**. It is not wired into this
+  project's `package.json` scripts and it does not fail a build, so nothing runs
+  it unless you do. It also deliberately under-reports rather than over-reports,
+  so a clean run is not proof that no pin was duplicated.
+
+**Not shipped here — they exist only in the Lisa project.** Neither path below
+resolves from this repository; you would have to open Lisa's own repository to
+read them, and you do not need either one to use this file.
+
+- **A worked, filled-in example** — Lisa keeps this same file for its own
+  dependencies, written from repository evidence only, with every unanswered
+  field tracked as a ticket rather than guessed. In the Lisa project it is at
+  `.lisa/DEPENDENCY_DECISIONS.md`.
+
+- **The full operator walkthrough** — a plain-language guide to deciding whether
+  a proposed dependency change is acceptable, with a checklist for each of the
+  three shapes (adding a dependency, taking one in-house, an ordinary version
+  bump). In the Lisa project it is at
+  `wiki/playbooks/dependency-ownership-operator-guide.md`.
+
+Nothing above is enforced by a build gate. Nothing blocks a change that skips
+this file, names no trust class, or removes a dependency with no rebuild
+evidence. That is deliberate — these are review disciplines, not lint rules —
+and it is exactly why the escalations below matter.
+
 ## When to escalate
 
 Reading an entry should end in a decision. Raise these to an owner rather than

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkhEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CA+rMjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAshEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAotMjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -311,6 +311,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/rules/eager/config-resolution.md": "2689c1f47903a5f6c84677fbfd2f1f148096faf122b7498b21d3b0f2345c6c87",
     "plugins/src/base/rules/eager/convergent-review.md": "ba4ba53863ef99be353c07c01195fa4ae2923ef2b2a5ad4427072802c260d208",
     "plugins/src/base/rules/eager/dependency-decision-records.md": "e22888f107906992e863fca50f26c2c4b124da7132535cacfac71e4f3085728f",
+    "plugins/src/base/rules/eager/dependency-internalization-kit.md": "9e2cc78afffc477c14718390ed88c42f781911c51fb7c13dada497f9e956b1a3",
     "plugins/src/base/rules/eager/dependency-trust-classes.md": "43a0932a7b8d4fd075b66bfe778025d808a13d9aa61ae793e9eb2fc8a555a381",
     "plugins/src/base/rules/eager/documentation-source-paths.md": "3a7c2a6264654a3cc44dd326441ba211a39c1c267033cc189c1c635adb84b52b",
     "plugins/src/base/rules/eager/empirical-inquiry.md": "60d77a67cc0d3b6a0aad0ab8fe6de5dff0127b2a6c63fa46b021b7a711eb07d6",
@@ -342,6 +343,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/rules/reference/config-resolution.md": "071b2c91f3b661ee493ea6f37d78f0fdea8004b4e4e7b5e94dcf232df7eceda7",
     "plugins/src/base/rules/reference/convergent-review.md": "788a9d4dc2af7a928c3ccbb4d53a92856bb3544941ce512cfe38068d6b35850d",
     "plugins/src/base/rules/reference/dependency-decision-records.md": "84f9fb8fa0a606307e828ec355ccbf2258beeeb88795dd113abe9bb2c37db39f",
+    "plugins/src/base/rules/reference/dependency-internalization-kit.md": "8c8e9bddbe2165905c3919ae9dd3d131b557cf9c7eb370393dfa85827076c73b",
     "plugins/src/base/rules/reference/dependency-trust-classes.md": "82216b80d4807e0ad302d04924032cc6a7a95b26f72ea853e378572a5c31821c",
     "plugins/src/base/rules/reference/documentation-source-paths.md": "555155889c9cf279865b9d8fc554bdd461c96a3ec76a5001dfeb361a71056999",
     "plugins/src/base/rules/reference/empirical-inquiry.md": "85f4552aa4c561677de40fd01bc6cccf5dbcf13865647db9df819d11f3cc3389",
@@ -528,7 +530,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-sonarcloud-access/SKILL.md": "924b6f54e38bf000625fcbecef828e78f7b4a401c36a5353b7c22ff12d530d5c",
     "plugins/src/base/skills/lisa-spec-conformance/SKILL.md": "3bcaf6d3b47917d00732542e30a8a302c3e293a9957faf79cac5b1d75cc538a2",
     "plugins/src/base/skills/lisa-sync-down/SKILL.md": "c32e6a4e3115ca32b7d335e90d0a73b243c6c631a2d192568423be0cb5944e84",
-    "plugins/src/base/skills/lisa-task-decomposition/SKILL.md": "b8f44d501e38a8ebd3c9b566b983d3e97f1292d28688ff1d42ec2c582abebf93",
+    "plugins/src/base/skills/lisa-task-decomposition/SKILL.md": "d4c8bd6b36d827e609178e5192270a21bb392aa825a902f61e33a9fe73cda10c",
     "plugins/src/base/skills/lisa-task-triage/SKILL.md": "c6e11b6d195560e6bd7b51fede65c155567c35208801a700a26d95679b03484e",
     "plugins/src/base/skills/lisa-tdd-implementation/SKILL.md": "390bc00b47c29f2bacd99ba4b4b5ba0d9177f04047a8edd662640693efe71825",
     "plugins/src/base/skills/lisa-tear-down-automations/SKILL.md": "3f8215b691ce60a6efd63547b99b4d87760fe99d285f6fe153aaadd451e83731",
@@ -2269,6 +2271,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-copilot/rules/eager/config-resolution.md": true,
     "plugins/lisa-copilot/rules/eager/convergent-review.md": true,
     "plugins/lisa-copilot/rules/eager/dependency-decision-records.md": true,
+    "plugins/lisa-copilot/rules/eager/dependency-internalization-kit.md": true,
     "plugins/lisa-copilot/rules/eager/dependency-trust-classes.md": true,
     "plugins/lisa-copilot/rules/eager/documentation-source-paths.md": true,
     "plugins/lisa-copilot/rules/eager/empirical-inquiry.md": true,
@@ -2300,6 +2303,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-copilot/rules/reference/config-resolution.md": true,
     "plugins/lisa-copilot/rules/reference/convergent-review.md": true,
     "plugins/lisa-copilot/rules/reference/dependency-decision-records.md": true,
+    "plugins/lisa-copilot/rules/reference/dependency-internalization-kit.md": true,
     "plugins/lisa-copilot/rules/reference/dependency-trust-classes.md": true,
     "plugins/lisa-copilot/rules/reference/documentation-source-paths.md": true,
     "plugins/lisa-copilot/rules/reference/empirical-inquiry.md": true,
@@ -2638,6 +2642,8 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-cursor/rules/convergent-review.mdc": true,
     "plugins/lisa-cursor/rules/dependency-decision-records-reference.mdc": true,
     "plugins/lisa-cursor/rules/dependency-decision-records.mdc": true,
+    "plugins/lisa-cursor/rules/dependency-internalization-kit-reference.mdc": true,
+    "plugins/lisa-cursor/rules/dependency-internalization-kit.mdc": true,
     "plugins/lisa-cursor/rules/dependency-trust-classes-reference.mdc": true,
     "plugins/lisa-cursor/rules/dependency-trust-classes.mdc": true,
     "plugins/lisa-cursor/rules/documentation-source-paths-reference.mdc": true,
@@ -5014,6 +5020,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa/rules/eager/config-resolution.md": true,
     "plugins/lisa/rules/eager/convergent-review.md": true,
     "plugins/lisa/rules/eager/dependency-decision-records.md": true,
+    "plugins/lisa/rules/eager/dependency-internalization-kit.md": true,
     "plugins/lisa/rules/eager/dependency-trust-classes.md": true,
     "plugins/lisa/rules/eager/documentation-source-paths.md": true,
     "plugins/lisa/rules/eager/empirical-inquiry.md": true,
@@ -5045,6 +5052,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa/rules/reference/config-resolution.md": true,
     "plugins/lisa/rules/reference/convergent-review.md": true,
     "plugins/lisa/rules/reference/dependency-decision-records.md": true,
+    "plugins/lisa/rules/reference/dependency-internalization-kit.md": true,
     "plugins/lisa/rules/reference/dependency-trust-classes.md": true,
     "plugins/lisa/rules/reference/documentation-source-paths.md": true,
     "plugins/lisa/rules/reference/empirical-inquiry.md": true,
@@ -5544,6 +5552,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/src/base/rules/eager/config-resolution.md": true,
     "plugins/src/base/rules/eager/convergent-review.md": true,
     "plugins/src/base/rules/eager/dependency-decision-records.md": true,
+    "plugins/src/base/rules/eager/dependency-internalization-kit.md": true,
     "plugins/src/base/rules/eager/dependency-trust-classes.md": true,
     "plugins/src/base/rules/eager/documentation-source-paths.md": true,
     "plugins/src/base/rules/eager/empirical-inquiry.md": true,
@@ -5575,6 +5584,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/src/base/rules/reference/config-resolution.md": true,
     "plugins/src/base/rules/reference/convergent-review.md": true,
     "plugins/src/base/rules/reference/dependency-decision-records.md": true,
+    "plugins/src/base/rules/reference/dependency-internalization-kit.md": true,
     "plugins/src/base/rules/reference/dependency-trust-classes.md": true,
     "plugins/src/base/rules/reference/documentation-source-paths.md": true,
     "plugins/src/base/rules/reference/empirical-inquiry.md": true,
@@ -6547,6 +6557,14 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/e2e/ui-version-status.spec.ts": true,
     "tests/fixtures/automation-status/attention-needed-codex.json": true,
     "tests/fixtures/automation-status/partial-support-codex.json": true,
+    "tests/fixtures/dependency-internalization-kit/dependency-internalization-ticket.md": true,
+    "tests/fixtures/dependency-internalization-kit/version-bump-ticket.md": true,
+    "tests/fixtures/dependency-ownership/addition/.github/workflows/deploy.yml": true,
+    "tests/fixtures/dependency-ownership/addition/package.json": true,
+    "tests/fixtures/dependency-ownership/addition/scripts/install-payment-client.sh": true,
+    "tests/fixtures/dependency-ownership/internalization/.github/workflows/deploy.yml": true,
+    "tests/fixtures/dependency-ownership/internalization/package.json": true,
+    "tests/fixtures/dependency-ownership/internalization/scripts/verify-slugs.sh": true,
     "tests/fixtures/dependency-trust-classes/dependency-addition-ticket.md": true,
     "tests/fixtures/doctor/not-ready-missing-config.json": true,
     "tests/fixtures/doctor/readiness/all-pass-assessed.json": true,
@@ -6911,6 +6929,10 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/strategies/create-only.test.ts": true,
     "tests/unit/strategies/debrief-reroute-contract.test.ts": true,
     "tests/unit/strategies/dependency-decision-records-rule-pair.test.ts": true,
+    "tests/unit/strategies/dependency-internalization-kit-rule-pair.test.ts": true,
+    "tests/unit/strategies/dependency-ownership-helpers.ts": true,
+    "tests/unit/strategies/dependency-ownership-integration.test.ts": true,
+    "tests/unit/strategies/dependency-ownership-parity.test.ts": true,
     "tests/unit/strategies/dependency-trust-classes-rule-pair.test.ts": true,
     "tests/unit/strategies/distributed-content-round2-contract.test.ts": true,
     "tests/unit/strategies/doctor-automation-readiness.test.ts": true,
@@ -7173,6 +7195,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "wiki/open-questions/lisa-open-questions.md": true,
     "wiki/playbooks/.gitkeep": true,
     "wiki/playbooks/coding-agent-parity-research.md": true,
+    "wiki/playbooks/dependency-ownership-operator-guide.md": true,
     "wiki/playbooks/lisa-workflow-playbook.md": true,
     "wiki/projects/lisa-monorepo.md": true,
     "wiki/projects/registry.md": true,