@codyswann/lisa 2.286.0 → 2.286.1

package/all/create-only/.lisa/DEPENDENCY_DECISIONS.md

@@ -45,6 +45,73 @@ script without rewriting the rest of the file:
 - `_Not yet decided_` is the reserved marker for an unanswered field, so
   unfilled entries are visibly honest rather than silently empty.
 
+## The rest of the dependency-ownership layer
+
+This file is one of five parts, and it is the only one that lives in your
+project's own source. Three of the other four are still readable from here,
+because they ship inside the installed Lisa package — paths starting
+`node_modules/` below. The remaining two exist only in the Lisa project itself
+and are called out as such; do not go looking for them in this repository.
+
+**Installed in this project** (readable from your project root):
+
+- **The six trust classes** — how much scrutiny a dependency deserves, set by
+  what it can reach rather than by how famous it is. The six are: mature
+  ecosystem primitive, fast-moving standard implementation, build/development
+  tool, runtime-critical service client, thin wrapper suitable for in-house
+  ownership, and temporary/experimental dependency. Sign-off rules differ by
+  class and by moment: a **runtime-critical service client** needs a human
+  sign-off to be added and at every major upgrade; a **temporary/experimental
+  dependency** needs none to be added — moving fast is the point — but must
+  carry a written expiry date no more than one quarter out and a named exit, and
+  then needs sign-off to extend past that date or to promote it. The full
+  definitions, with the evidence each class demands, are at
+  `node_modules/@codyswann/lisa/plugins/lisa/rules/reference/dependency-trust-classes.md`.
+  Your coding agent already has these loaded, so "which trust class is this, and
+  what evidence does that class require?" is a question you can just ask it.
+
+- **The confidence-rebuild kit** — the seven things a change must prove when a
+  dependency is removed and the capability rebuilt in-house: real corpus,
+  conformance fixtures, negative fixtures, coverage as a gap detector,
+  provenance and license review, migration and update plan, and rollback or
+  replacement criteria. All seven are required; a partial kit is the finding. It
+  does **not** apply to an ordinary version bump. Full text at
+  `node_modules/@codyswann/lisa/plugins/lisa/rules/reference/dependency-internalization-kit.md`.
+
+- **The manifest-authoritative duplicate-pin policy** — a version belongs in
+  `package.json` and nowhere else; every copy of the literal in a workflow or a
+  script is a second edit site a routine bump can miss. Lisa ships a detector
+  you can run against this project:
+
+  ```bash
+  node node_modules/@codyswann/lisa/scripts/check-duplicate-versions.mjs --root . --scan .
+  ```
+
+  Be honest about what it is today: **advisory**. It is not wired into this
+  project's `package.json` scripts and it does not fail a build, so nothing runs
+  it unless you do. It also deliberately under-reports rather than over-reports,
+  so a clean run is not proof that no pin was duplicated.
+
+**Not shipped here — they exist only in the Lisa project.** Neither path below
+resolves from this repository; you would have to open Lisa's own repository to
+read them, and you do not need either one to use this file.
+
+- **A worked, filled-in example** — Lisa keeps this same file for its own
+  dependencies, written from repository evidence only, with every unanswered
+  field tracked as a ticket rather than guessed. In the Lisa project it is at
+  `.lisa/DEPENDENCY_DECISIONS.md`.
+
+- **The full operator walkthrough** — a plain-language guide to deciding whether
+  a proposed dependency change is acceptable, with a checklist for each of the
+  three shapes (adding a dependency, taking one in-house, an ordinary version
+  bump). In the Lisa project it is at
+  `wiki/playbooks/dependency-ownership-operator-guide.md`.
+
+Nothing above is enforced by a build gate. Nothing blocks a change that skips
+this file, names no trust class, or removes a dependency with no rebuild
+evidence. That is deliberate — these are review disciplines, not lint rules —
+and it is exactly why the escalations below matter.
+
 ## When to escalate
 
 Reading an entry should end in a decision. Raise these to an owner rather than

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAshEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CA0sMjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAshEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAotMjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -6559,6 +6559,12 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/fixtures/automation-status/partial-support-codex.json": true,
     "tests/fixtures/dependency-internalization-kit/dependency-internalization-ticket.md": true,
     "tests/fixtures/dependency-internalization-kit/version-bump-ticket.md": true,
+    "tests/fixtures/dependency-ownership/addition/.github/workflows/deploy.yml": true,
+    "tests/fixtures/dependency-ownership/addition/package.json": true,
+    "tests/fixtures/dependency-ownership/addition/scripts/install-payment-client.sh": true,
+    "tests/fixtures/dependency-ownership/internalization/.github/workflows/deploy.yml": true,
+    "tests/fixtures/dependency-ownership/internalization/package.json": true,
+    "tests/fixtures/dependency-ownership/internalization/scripts/verify-slugs.sh": true,
     "tests/fixtures/dependency-trust-classes/dependency-addition-ticket.md": true,
     "tests/fixtures/doctor/not-ready-missing-config.json": true,
     "tests/fixtures/doctor/readiness/all-pass-assessed.json": true,
@@ -6924,6 +6930,9 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/strategies/debrief-reroute-contract.test.ts": true,
     "tests/unit/strategies/dependency-decision-records-rule-pair.test.ts": true,
     "tests/unit/strategies/dependency-internalization-kit-rule-pair.test.ts": true,
+    "tests/unit/strategies/dependency-ownership-helpers.ts": true,
+    "tests/unit/strategies/dependency-ownership-integration.test.ts": true,
+    "tests/unit/strategies/dependency-ownership-parity.test.ts": true,
     "tests/unit/strategies/dependency-trust-classes-rule-pair.test.ts": true,
     "tests/unit/strategies/distributed-content-round2-contract.test.ts": true,
     "tests/unit/strategies/doctor-automation-readiness.test.ts": true,
@@ -7186,6 +7195,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "wiki/open-questions/lisa-open-questions.md": true,
     "wiki/playbooks/.gitkeep": true,
     "wiki/playbooks/coding-agent-parity-research.md": true,
+    "wiki/playbooks/dependency-ownership-operator-guide.md": true,
     "wiki/playbooks/lisa-workflow-playbook.md": true,
     "wiki/projects/lisa-monorepo.md": true,
     "wiki/projects/registry.md": true,