@codyswann/lisa 2.300.12 → 2.301.0

package/cdk/create-only/.github/workflows/ci.yml

@@ -133,6 +133,11 @@ jobs:
     # Reference to the quality checks workflow
     permissions:
       contents: read
+      # work_item_traceability reads the tracker issue to verify the PR
+      # backlink. A reusable workflow can only DOWNGRADE the caller's
+      # grant, so without issues:read that job cannot enforce anything.
+      issues: read
+      pull-requests: read
     uses: CodySwannGT/lisa/.github/workflows/quality.yml@main
     with:
       node_version: '22.21.1'
@@ -143,3 +148,9 @@ jobs:
       GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
       FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
       MAESTRO_API_KEY: ${{ secrets.MAESTRO_API_KEY }}
+      # Only the configured tracker's credentials are used. tracker:
+      # github needs none of these; jira/linear cannot verify the PR
+      # backlink without them and report not-enforceable instead.
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+      JIRA_LOGIN: ${{ secrets.JIRA_LOGIN }}
+      LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}

package/dist/cli/doctor-readiness-delivery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-readiness-delivery.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-delivery.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EACL,KAAK,cAAc,EAEpB,MAAM,iCAAiC,CAAC;AAGzC,+EAA+E;AAC/E,eAAO,MAAM,+BAA+B,uBAAuB,CAAC;AA8PpE;;;;;;;;;GASG;AACH,wBAAsB,gCAAgC,CACpD,IAAI,EAAE,MAAM,EACZ,eAAe,CAAC,EAAE,SAAS,cAAc,EAAE,GAC1C,OAAO,CAAC,wBAAwB,CAAC,CAoBnC"}
+{"version":3,"file":"doctor-readiness-delivery.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-delivery.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EACL,KAAK,cAAc,EAEpB,MAAM,iCAAiC,CAAC;AAGzC,+EAA+E;AAC/E,eAAO,MAAM,+BAA+B,uBAAuB,CAAC;AA0UpE;;;;;;;;;GASG;AACH,wBAAsB,gCAAgC,CACpD,IAAI,EAAE,MAAM,EACZ,eAAe,CAAC,EAAE,SAAS,cAAc,EAAE,GAC1C,OAAO,CAAC,wBAAwB,CAAC,CAoBnC"}

package/dist/cli/doctor-readiness-delivery.js

@@ -53,29 +53,101 @@ function summarizeReleasePaths(workflows, defaultBranches) {
     };
 }
 /**
- * Read the local production branch hint Lisa writes into project config. This
- * stays offline and best-effort: unreadable or unusual config falls back to the
- * built-in `main`/`master` defaults in the release-path assessor.
+ * Resolve the repository's local `.git` directory. Worktrees store this as a
+ * pointer file, while ordinary checkouts use a directory.
  * @param root - Project root to inspect
- * @returns Configured default-like branch names
+ * @returns The resolved git directory path, or null when it cannot be read
  */
-async function configuredDefaultBranches(root) {
+async function localGitDir(root) {
+    const dotGit = path.join(root, ".git");
+    try {
+        const marker = await readFile(dotGit, "utf8");
+        const trimmed = marker.trim();
+        const prefix = "gitdir:";
+        if (!trimmed.toLowerCase().startsWith(prefix)) {
+            return null;
+        }
+        const target = trimmed.slice(prefix.length).trim();
+        return path.isAbsolute(target) ? target : path.resolve(root, target);
+    }
+    catch (error) {
+        return error.code === "EISDIR" ? dotGit : null;
+    }
+}
+/**
+ * Resolve where shared refs live for a gitdir. Linked worktrees keep refs in
+ * the common directory named by `commondir`; ordinary repositories do not.
+ * @param gitDir - The resolved `.git` or per-worktree gitdir
+ * @returns The directory that owns shared refs
+ */
+async function commonGitDir(gitDir) {
+    try {
+        const raw = await readFile(path.join(gitDir, "commondir"), "utf8");
+        const target = raw.trim();
+        return path.isAbsolute(target) ? target : path.resolve(gitDir, target);
+    }
+    catch {
+        return gitDir;
+    }
+}
+/**
+ * Read the default branch cached by git's local `origin/HEAD` symbolic ref.
+ * This is best-effort and does not fetch; if the ref is absent, callers fall
+ * back to Lisa config and built-in branch names.
+ * @param root - Project root to inspect
+ * @returns The local remote-default branch name when available
+ */
+async function gitDefaultBranch(root) {
+    const gitDir = await localGitDir(root);
+    if (!gitDir) {
+        return null;
+    }
+    const refsGitDir = await commonGitDir(gitDir);
+    try {
+        const raw = await readFile(path.join(refsGitDir, "refs", "remotes", "origin", "HEAD"), "utf8");
+        const trimmed = raw.trim();
+        const prefix = "ref: refs/remotes/origin/";
+        return trimmed.startsWith(prefix) ? trimmed.slice(prefix.length) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Read Lisa's configured production branch hint.
+ * @param root - Project root to inspect
+ * @returns A one-item branch list, or empty when no hint exists
+ */
+async function configDefaultBranches(root) {
     try {
         const raw = await readFile(path.join(root, ".lisa.config.json"), "utf8");
         const parsed = JSON.parse(raw);
         if (!isJsonObject(parsed) || !isJsonObject(parsed.deploy)) {
             return [];
         }
-        const branches = parsed.deploy.branches;
-        if (!isJsonObject(branches)) {
-            return [];
-        }
-        return typeof branches.production === "string" ? [branches.production] : [];
+        const deployBranches = parsed.deploy.branches;
+        return isJsonObject(deployBranches) &&
+            typeof deployBranches.production === "string"
+            ? [deployBranches.production]
+            : [];
     }
     catch {
         return [];
     }
 }
+/**
+ * Read local default-branch hints Lisa can establish offline. This stays
+ * best-effort: unreadable or unusual config/git metadata falls back to the
+ * built-in `main`/`master` defaults in the release-path assessor.
+ * @param root - Project root to inspect
+ * @returns Configured default-like branch names
+ */
+async function configuredDefaultBranches(root) {
+    const configBranches = await configDefaultBranches(root);
+    const gitBranch = await gitDefaultBranch(root);
+    const branches = gitBranch ? [...configBranches, gitBranch] : configBranches;
+    return [...new Set(branches.map(branch => branch.trim()).filter(Boolean))];
+}
 /**
  * Build the B2 finding from its evidence lines.
  * @param violations - Evidence lines

package/dist/cli/doctor-readiness-delivery.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-readiness-delivery.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAEL,wBAAwB,GACzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAEL,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAEpE,gFAAgF;AAChF,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,+EAA+E;AAC/E,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAUnC;;;;;GAKG;AACH,SAAS,qBAAqB,CAC5B,SAAoC,EACpC,eAAmC;IAEnC,MAAM,QAAQ,GAAkC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAC3E,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAC1B,kBAAkB,CAAC,QAAQ,EAAE,GAAG,EAAE,eAAe,CAAC,CACnD,CACF,CAAC;IACF,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CACrC,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CACvD;QACD,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CACrC,OAAO,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CACtD;QACD,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM;QACvE,gBAAgB,EAAE,QAAQ,CAAC,MAAM;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,yBAAyB,CACtC,IAAY;IAEZ,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1D,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QACxC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CACrB,UAA6B;IAE7B,OAAO;QACL,OAAO,EAAE,kBAAkB;QAC3B,kBAAkB,EAChB,2EAA2E;QAC7E,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAChC,gBAAgB,EACd,wEAAwE;YACxE,uEAAuE;YACvE,iDAAiD;QACnD,eAAe,EACb,yEAAyE;YACzE,6BAA6B,gBAAgB,6BAA6B;YAC1E,kCAAkC;QACpC,mBAAmB,EAAE;YACnB,yEAAyE;gBACvE,4CAA4C;SAC/C;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,UAA6B;IAE7B,OAAO;QACL,OAAO,EAAE,qBAAqB;QAC9B,kBAAkB,EAChB,wEAAwE;QAC1E,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAChC,gBAAgB,EACd,0EAA0E;YAC1E,2DAA2D;QAC7D,eAAe,EACb,2EAA2E;YAC3E,2EAA2E;YAC3E,wBAAwB;QAC1B,mBAAmB,EAAE;YACnB,yEAAyE;gBACvE,6BAA6B;SAChC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CACvB,OAA0B,EAC1B,WAA+B;IAE/B,OAAO;QACL,EAAE,EAAE,+BAA+B;QACnC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YAC3C,GAAG,qBAAqB,CAAC,WAAW,CAAC,aAAa,CAAC;SACpD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAClB,OAA2B,EAC3B,SAAoC,EACpC,WAA+B;IAE/B,OAAO;QACL,EAAE,EAAE,+BAA+B;QACnC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,QAAQ,EACN,aAAa,OAAO,CAAC,gBAAgB,6BAA6B;oBAClE,GAAG,SAAS,CAAC,MAAM,gDAAgD;oBACnE,+CAA+C,gBAAgB,MAAM;oBACrE,kEAAkE;oBAClE,oBAAoB;gBACtB,OAAO,EAAE,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;aACrD;YACD,GAAG,qBAAqB,CAAC,WAAW,CAAC,aAAa,CAAC;SACpD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CACtB,OAA2B,EAC3B,WAA+B;IAE/B,OAAO;QACL,EAAE,EAAE,+BAA+B;QACnC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;gBAC/B,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBACtC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;gBACnC,CAAC,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;gBAC7C,CAAC,CAAC,EAAE,CAAC;YACP,0EAA0E;YAC1E,0EAA0E;YAC1E,mEAAmE;YACnE,GAAG,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC;YAC5C,GAAG,qBAAqB,CAAC,WAAW,CAAC,aAAa,CAAC;SACpD;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB;IACxB,OAAO;QACL,EAAE,EAAE,+BAA+B;QACnC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,MAAM,EACJ,kEAAkE;oBAClE,6DAA6D;oBAC7D,kDAAkD;gBACpD,IAAI,EAAE,IAAI;aACX;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAC1B,SAAoC,EACpC,WAA+B;IAE/B,OAAO;QACL,EAAE,EAAE,+BAA+B;QACnC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,MAAM,EACJ,eAAe,SAAS,CAAC,MAAM,+BAA+B;oBAC9D,mEAAmE;oBACnE,gEAAgE;oBAChE,6CAA6C;gBAC/C,IAAI,EAAE,IAAI;aACX;YACD,GAAG,qBAAqB,CAAC,WAAW,CAAC,aAAa,CAAC;SACpD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,IAAY,EACZ,eAA2C;IAE3C,MAAM,SAAS,GAAG,eAAe,IAAI,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,iBAAiB,EAAE,CAAC;IAC7B,CAAC;IACD,MAAM,OAAO,GAAG,qBAAqB,CACnC,SAAS,EACT,MAAM,yBAAyB,CAAC,IAAI,CAAC,CACtC,CAAC;IACF,MAAM,WAAW,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvE,OAAO,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,mBAAmB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;AACtD,CAAC"}
+{"version":3,"file":"doctor-readiness-delivery.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAEL,wBAAwB,GACzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAEL,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAEpE,gFAAgF;AAChF,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,+EAA+E;AAC/E,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAUnC;;;;;GAKG;AACH,SAAS,qBAAqB,CAC5B,SAAoC,EACpC,eAAmC;IAEnC,MAAM,QAAQ,GAAkC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAC3E,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAC1B,kBAAkB,CAAC,QAAQ,EAAE,GAAG,EAAE,eAAe,CAAC,CACnD,CACF,CAAC;IACF,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CACrC,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CACvD;QACD,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CACrC,OAAO,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CACtD;QACD,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM;QACvE,gBAAgB,EAAE,QAAQ,CAAC,MAAM;KAClC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,WAAW,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CAAC,MAAc;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CACxB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,EAC1D,MAAM,CACP,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,2BAA2B,CAAC;QAC3C,OAAO,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAAC,IAAY;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1D,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC9C,OAAO,YAAY,CAAC,cAAc,CAAC;YACjC,OAAO,cAAc,CAAC,UAAU,KAAK,QAAQ;YAC7C,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC;YAC7B,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,yBAAyB,CACtC,IAAY;IAEZ,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;IAC7E,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CACrB,UAA6B;IAE7B,OAAO;QACL,OAAO,EAAE,kBAAkB;QAC3B,kBAAkB,EAChB,2EAA2E;QAC7E,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAChC,gBAAgB,EACd,wEAAwE;YACxE,uEAAuE;YACvE,iDAAiD;QACnD,eAAe,EACb,yEAAyE;YACzE,6BAA6B,gBAAgB,6BAA6B;YAC1E,kCAAkC;QACpC,mBAAmB,EAAE;YACnB,yEAAyE;gBACvE,4CAA4C;SAC/C;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,UAA6B;IAE7B,OAAO;QACL,OAAO,EAAE,qBAAqB;QAC9B,kBAAkB,EAChB,wEAAwE;QAC1E,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAChC,gBAAgB,EACd,0EAA0E;YAC1E,2DAA2D;QAC7D,eAAe,EACb,2EAA2E;YAC3E,2EAA2E;YAC3E,wBAAwB;QAC1B,mBAAmB,EAAE;YACnB,yEAAyE;gBACvE,6BAA6B;SAChC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CACvB,OAA0B,EAC1B,WAA+B;IAE/B,OAAO;QACL,EAAE,EAAE,+BAA+B;QACnC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YAC3C,GAAG,qBAAqB,CAAC,WAAW,CAAC,aAAa,CAAC;SACpD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAClB,OAA2B,EAC3B,SAAoC,EACpC,WAA+B;IAE/B,OAAO;QACL,EAAE,EAAE,+BAA+B;QACnC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,QAAQ,EACN,aAAa,OAAO,CAAC,gBAAgB,6BAA6B;oBAClE,GAAG,SAAS,CAAC,MAAM,gDAAgD;oBACnE,+CAA+C,gBAAgB,MAAM;oBACrE,kEAAkE;oBAClE,oBAAoB;gBACtB,OAAO,EAAE,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;aACrD;YACD,GAAG,qBAAqB,CAAC,WAAW,CAAC,aAAa,CAAC;SACpD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CACtB,OAA2B,EAC3B,WAA+B;IAE/B,OAAO;QACL,EAAE,EAAE,+BAA+B;QACnC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;gBAC/B,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBACtC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;gBACnC,CAAC,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;gBAC7C,CAAC,CAAC,EAAE,CAAC;YACP,0EAA0E;YAC1E,0EAA0E;YAC1E,mEAAmE;YACnE,GAAG,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC;YAC5C,GAAG,qBAAqB,CAAC,WAAW,CAAC,aAAa,CAAC;SACpD;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB;IACxB,OAAO;QACL,EAAE,EAAE,+BAA+B;QACnC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,MAAM,EACJ,kEAAkE;oBAClE,6DAA6D;oBAC7D,kDAAkD;gBACpD,IAAI,EAAE,IAAI;aACX;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAC1B,SAAoC,EACpC,WAA+B;IAE/B,OAAO;QACL,EAAE,EAAE,+BAA+B;QACnC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,MAAM,EACJ,eAAe,SAAS,CAAC,MAAM,+BAA+B;oBAC9D,mEAAmE;oBACnE,gEAAgE;oBAChE,6CAA6C;gBAC/C,IAAI,EAAE,IAAI;aACX;YACD,GAAG,qBAAqB,CAAC,WAAW,CAAC,aAAa,CAAC;SACpD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,IAAY,EACZ,eAA2C;IAE3C,MAAM,SAAS,GAAG,eAAe,IAAI,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,iBAAiB,EAAE,CAAC;IAC7B,CAAC;IACD,MAAM,OAAO,GAAG,qBAAqB,CACnC,SAAS,EACT,MAAM,yBAAyB,CAAC,IAAI,CAAC,CACtC,CAAC;IACF,MAAM,WAAW,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvE,OAAO,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,mBAAmB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;AACtD,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -23,7 +23,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "cdk/copy-overwrite/tsconfig.json": "bd960df819bb1ce01163ac4b28721eea3f07d482f6c454cfea9a8dc90191033a",
     "cdk/copy-overwrite/vitest.cdk.ts": "aea238d214b7eb4c532cebe5bf732dc30b9fd04d938a215bd34a5ec2eff17046",
     "cdk/copy-overwrite/vitest.config.ts": "ce14179d4ab31011bb012ee1669af7d86b5189bdf2934e0bd9dd666a30e3d01e",
-    "cdk/create-only/.github/workflows/ci.yml": "04cca8fbcb7a5c6da1aeb2b2d00d7a328d15618e4252f1d9dd495052d264d0f5",
+    "cdk/create-only/.github/workflows/ci.yml": "dc384ef9bd46af723cafd8d140f6d58d2630cfa8a7b07104254d8ecd4a556636",
     "cdk/create-only/.github/workflows/deploy.yml": "2746e78fb0fbe7b23b30bbcb0f83171e16f6804fd467b3d41d3c69970572af3f",
     "cdk/create-only/cdk.json": "f89030d8fe145a1dbabd59d89ddee4e16984f222d737f7fcf6b778d911e9fe40",
     "cdk/create-only/tsconfig.local.json": "d26253827e21fd7c41d30565fe3d339675f119e00bb24c5713a01f57ccd06602",
@@ -73,7 +73,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "expo/copy-overwrite/tsconfig.eslint.json": "375bb2ee8185e4a57d703e078ad57188f6d45b03b0fcbb16ef049fcf9b14c44b",
     "expo/copy-overwrite/tsconfig.expo.json": "55f3dfe80496f03152d40d364c5a9cabf3fdce3adc8cebea48ba5257d77b7aa9",
     "expo/copy-overwrite/tsconfig.json": "c92e2c2c109e8794ee351f634361ef46297f5a0cd606aaf5c19911da836df307",
-    "expo/create-only/.github/workflows/ci.yml": "3ade267cca43e33c68e56b8c4f5d821ed03f642e5a11aa8b70b79e76ec41b96f",
+    "expo/create-only/.github/workflows/ci.yml": "bf75c9d3b4f4a2cb24c2214d9fc27a9cb2247a6694b0cf02c40032b4d3e87cd9",
     "expo/create-only/.github/workflows/deploy.yml": "0978b1f4e19e1ff66bb8cdd037d36a3751d4e917db7ceb5bcf100fad36768516",
     "expo/create-only/.github/workflows/maestro-e2e.yml": "444367a8cefaa81b484bc6eff5923c34177e10f6a67cbf1befec00c9d0d1d36b",
     "expo/create-only/.zap/baseline.conf": "ab18d74ba5270dd5d795e740cd6b1292bb78dc36c79a20c1e7b752d14c0c55f5",
@@ -97,7 +97,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "harper-fabric/copy-contents/.prettierignore": "478c782f4c5611187e21584dfd5522e37fc636c5eb03394fea3db45321c6712c",
     "harper-fabric/copy-contents/gitignore": "d091c40fd0ea3068491f1be0d6510090ae872ca95d0d058ef4595d6492d13897",
     "harper-fabric/copy-overwrite/.github/dependabot.yml": "e28fde0d906478b3fb7d6b7fc16f7fc5a4a0a20d8160f547f2b4be97c90578b7",
-    "harper-fabric/copy-overwrite/.github/workflows/ci.yml": "6823d87b989f1fbeb2f471552a041f5c9476e67ece8f6ec7ba75e97738afe2f9",
+    "harper-fabric/copy-overwrite/.github/workflows/ci.yml": "d8227671ebec99255c2adac8ef76ec29cdfa5b8f4c56fe376a37dab08accc0cc",
     "harper-fabric/copy-overwrite/ast-grep/rules/harper/no-early-return-in-search-loop.yml": "c25106e1d4ee3566c70824ba4ecbc2ee0345014008aedb4fac56d0be23029264",
     "harper-fabric/copy-overwrite/ast-grep/rules/harper/no-empty-conditions-with-sort.yml": "d735e92ea25a4d8fbac8b45e06d73baf8b7cf0b38068623663b928dd6850e26e",
     "harper-fabric/copy-overwrite/ast-grep/rules/harper/no-full-table-scan.yml": "00f49de6372a3a2825e9e38b6d2d86ac1580e28c1e2e8c8fa07bee0cfe2ac0aa",
@@ -147,7 +147,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "nestjs/create-only/.github/k6/thresholds/normal.json": "1842cf0b617380ce641781589b4084b03aac1beeb4803a696b3ae6329710ad44",
     "nestjs/create-only/.github/k6/thresholds/relaxed.json": "350c18b2c588fd628db8a6e82fc5c0b3ffc8a09f1c89b64d1f530350bc64a9ca",
     "nestjs/create-only/.github/k6/thresholds/strict.json": "e121ec72de4596b95c013a8c71f03653bcdf057cf7f8d1fec6f0e13c1381867f",
-    "nestjs/create-only/.github/workflows/ci.yml": "8db7de7f2e3eb2a1605539849a346b55281cfcd9951526f9d5a1757a210da3c6",
+    "nestjs/create-only/.github/workflows/ci.yml": "0985668e6d0478f1993bed8ccd398601d8e73376afd8775e1269ae129418152e",
     "nestjs/create-only/.github/workflows/deploy.yml": "78abfa87639cb7506418dd34387963a0557614933d823e6fa0413395166b945b",
     "nestjs/create-only/.zap/baseline.conf": "a7cd559b014555ef2efe7a6ce129384ec376ce4d66d5bc3ae9e2f3f883172c4d",
     "nestjs/create-only/scripts/zap-baseline.sh": "de3a66a780076f98d5c6306c03b5decac8afbc9ff37583e5e6463c56f3399e3e",
@@ -169,7 +169,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "oxlint/typescript.json": "c7352af5d92a97da1386edfbff873f284c932f5413dce87c4af27520097389aa",
     "phaser/copy-contents/.prettierignore": "3bd2e016bd4bd23f76d186a4a4ba72f47719b9aa1df5d3352ad5719d93e0bf49",
     "phaser/copy-contents/gitignore": "4b8d1a5817d35f64f5d4859f9184ebe2e1dc42e63f8e9269fff233e2ec258d6c",
-    "phaser/copy-overwrite/.github/workflows/ci.yml": "02b7fa8ceb9950b72d000fa1688177e747ef549d1b49d2cb4b1db97ec94a3a61",
+    "phaser/copy-overwrite/.github/workflows/ci.yml": "7b037b5961569a09e8407e6b9bf9a91377208f76bc309680870c2b56ff2f4813",
     "phaser/copy-overwrite/.husky/pre-push.verify": "fef6694c2fde6178f46c62936d2b19515adce4fc8ac694ea66d8342aa1474ee7",
     "phaser/copy-overwrite/ast-grep/rule-tests/.gitkeep": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
     "phaser/copy-overwrite/ast-grep/rules/phaser/no-canvas-renderer.yml": "bd0994bbb8f8e6bde2a1a581fb2cb8aa011d91822dabf4366f500359069726b3",
@@ -889,7 +889,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "rails/copy-overwrite/scripts/threshold-ratchet-compare.mjs": "4535a145c5c5cbee13bdf970bc91d390a264043604e607288cdd6bf28de56192",
     "rails/copy-overwrite/scripts/threshold-ratchet-families.mjs": "db14245ed89b483912af287bdee917a7a921dc21bb29b49be37fc799c05c413f",
     "rails/copy-overwrite/sgconfig.yml": "0ffe058c791d4d323f98104cf78c763bb0356d88739042060ceb86b6b1cb78d7",
-    "rails/create-only/.github/workflows/ci.yml": "599805266a47b5c0039145a11df225d4db6c59d35b2ecc582a44d55ab7f4b1f0",
+    "rails/create-only/.github/workflows/ci.yml": "ad53014bdd6cf15bfadfaef7740b6094c3c7bd044f9d176c4938154da983529d",
     "rails/create-only/.github/workflows/claude-code-review-response.yml": "bfbe3127c4941c35886d324d439ae0302fbccd74a11cb4decf05a21195efa0e9",
     "rails/create-only/.github/workflows/claude-nightly-code-complexity.yml": "3943137c81ed212d7d3f35f7d7f6242a984fda43ed29a5f565ab5c2923d92606",
     "rails/create-only/.github/workflows/claude-nightly-test-coverage.yml": "f7f2eeb05ddd18e196c4b292c0a846e765ed8b67ddeacfc6b19c3d676d91e459",
@@ -911,7 +911,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "rails/create-only/spec/rails_helper.rb": "aa94dcec9eea6d238c7210ca9ee88ba009061f1ba59bd042eaf09b8f98582689",
     "rails/create-only/spec/spec_helper.rb": "4308dcddf2ee1b65986ff206a0feac62c8e3a1cae842b115fd2945b7563ed9cd",
     "rails/deletions.json": "eeadf9a2b1677913199a235091a8d6190477f3e2a5fd598d62cf658cb59a8099",
-    "rails/github-rulesets/quality-checks.json": "ea42f2bb938881bc6ec129e7300a2b824313951031d4720f46e944c4dfe1a9da",
+    "rails/github-rulesets/quality-checks.json": "0ec1c366589edbaa6b8f45f940cef3ada5ed7b1a956d98d3fa6034b0f78fbc7c",
     "rails/merge/.claude/settings.json": "9c49f8c7c453f8749c90def3e22d412c3345c533d24b30dc7745ffa052ad6fa1",
     "scripts/build-plugins.sh": "d26321ea10bc3ed8cf096f900622cb4cf7a37117fabf9730f0fe5c9d949582fc",
     "scripts/check-duplicate-versions.mjs": "84d97e94eb834522848ddce951bb54ae9da1e4be252e2c51fed0c01c4f4d6b72",
@@ -1014,7 +1014,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "typescript/copy-overwrite/vitest.config.ts": "da92f06cc3ce68462c6f2f3d95adb1b1464591ce383a24e3334dc986e0c1e0fb",
     "typescript/create-only/.github/workflows/auto-update-pr-branches-dispatch.yml": "347f8a3830efdc3ad701fae0858994f4e45df8100844e91948b017b98115a28c",
     "typescript/create-only/.github/workflows/auto-update-pr-branches.yml": "cf185555bcbe8e9957333abcae2e0c20e00875f8d867f70134efbd2a5c974ee5",
-    "typescript/create-only/.github/workflows/ci.yml": "d8c7f65e408a21e344b3a518ddf088d5ada4b08eb24d6b2cfa38ec6755ca8b5a",
+    "typescript/create-only/.github/workflows/ci.yml": "dac98b7ab5a7397461e459b2553101bfdc6451d28b42f3b0115056b62cfb8b1d",
     "typescript/create-only/.github/workflows/claude-ci-auto-fix.yml": "a9155c10d0c28eba0f77ec5bc2a2d99b0eeb5d499218aac81948d3f27e6aa4fb",
     "typescript/create-only/.github/workflows/claude-code-review-response.yml": "68bc8b53c2d4c58ab49b176796d27214415608fe94130e1f465c0bd41a100443",
     "typescript/create-only/.github/workflows/claude-deploy-auto-fix.yml": "5e0f7282b1b97a308bc5b95f6a4ef784d4dfbd02f3126bf9254fbf4576606daf",
@@ -1035,7 +1035,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "typescript/create-only/vitest.config.local.ts": "476738b351114a0efbcd3ae4ce1cf016307b55ee41ed8e87c35e28e4639d98f5",
     "typescript/create-only/vitest.thresholds.json": "ce04fe30ad6139f734dbc56d92a801c11cfd86a0d9e49c06c1c2d0a137beeffd",
     "typescript/deletions.json": "fe5f44b7a02148eacc429782e948b1c4aee302d1d56524cc16adec5489bbc308",
-    "typescript/github-rulesets/quality-checks.json": "89b9e09267cdb65865728d0e873de9c1225b8ca796e67f06fa8b72ccf6d4515e",
+    "typescript/github-rulesets/quality-checks.json": "d92599b203071b99b8fac1422b8493d2546138961ef04ba98176bc400af60945",
     "typescript/merge/.claude/settings.json": "834e6456cae81f45073bbbb08bf731fef043efb30cae2658cb4a59f17e66d165",
     "typescript/merge/.oxlintrc.json": "4debc093acfd263eb81ae15894073ebf098513204f45f40b83fb8fa5353fa1f8",
     "typescript/package-lisa/package.lisa.json": "bdd1766c2f327290207874b04fd3a577a8188bb57c2fd77d482bb7d6ecf17355",

package/expo/create-only/.github/workflows/ci.yml

@@ -30,6 +30,11 @@ jobs:
     # Reference to the quality checks workflow
     permissions:
       contents: read
+      # work_item_traceability reads the tracker issue to verify the PR
+      # backlink. A reusable workflow can only DOWNGRADE the caller's
+      # grant, so without issues:read that job cannot enforce anything.
+      issues: read
+      pull-requests: read
     uses: CodySwannGT/lisa/.github/workflows/quality.yml@main
     with:
       node_version: '22.21.1'
@@ -47,6 +52,12 @@ jobs:
       GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
       FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
       MAESTRO_API_KEY: ${{ secrets.MAESTRO_API_KEY }}
+      # Only the configured tracker's credentials are used. tracker:
+      # github needs none of these; jira/linear cannot verify the PR
+      # backlink without them and report not-enforceable instead.
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+      JIRA_LOGIN: ${{ secrets.JIRA_LOGIN }}
+      LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
   lighthouse:
     name: 💡 Lighthouse CI
     needs: [quality]

package/harper-fabric/copy-overwrite/.github/workflows/ci.yml

@@ -12,6 +12,11 @@ jobs:
     name: 🔍 Quality Checks
     permissions:
       contents: read
+      # work_item_traceability reads the tracker issue to verify the PR
+      # backlink. A reusable workflow can only DOWNGRADE the caller's
+      # grant, so without issues:read that job cannot enforce anything.
+      issues: read
+      pull-requests: read
     uses: CodySwannGT/lisa/.github/workflows/quality.yml@main
     with:
       node_version: '22.21.1'
@@ -23,3 +28,9 @@ jobs:
       GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
       FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
       MAESTRO_API_KEY: ${{ secrets.MAESTRO_API_KEY }}
+      # Only the configured tracker's credentials are used. tracker:
+      # github needs none of these; jira/linear cannot verify the PR
+      # backlink without them and report not-enforceable instead.
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+      JIRA_LOGIN: ${{ secrets.JIRA_LOGIN }}
+      LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}

package/nestjs/create-only/.github/workflows/ci.yml

@@ -14,6 +14,11 @@ jobs:
     # Reference to the quality checks workflow
     permissions:
       contents: read
+      # work_item_traceability reads the tracker issue to verify the PR
+      # backlink. A reusable workflow can only DOWNGRADE the caller's
+      # grant, so without issues:read that job cannot enforce anything.
+      issues: read
+      pull-requests: read
     uses: CodySwannGT/lisa/.github/workflows/quality.yml@main
     with:
       node_version: '22.21.1'
@@ -25,6 +30,12 @@ jobs:
       GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
       FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
       MAESTRO_API_KEY: ${{ secrets.MAESTRO_API_KEY }}
+      # Only the configured tracker's credentials are used. tracker:
+      # github needs none of these; jira/linear cannot verify the PR
+      # backlink without them and report not-enforceable instead.
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+      JIRA_LOGIN: ${{ secrets.JIRA_LOGIN }}
+      LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
 
   zap:
     name: 🕷️ ZAP Baseline Scan

package/package.json

@@ -115,7 +115,7 @@
     "brace-expansion": ">=5.0.8"
   },
   "name": "@codyswann/lisa",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/phaser/copy-overwrite/.github/workflows/ci.yml

@@ -15,6 +15,11 @@ jobs:
     name: 🔍 Quality Checks
     permissions:
       contents: read
+      # work_item_traceability reads the tracker issue to verify the PR
+      # backlink. A reusable workflow can only DOWNGRADE the caller's
+      # grant, so without issues:read that job cannot enforce anything.
+      issues: read
+      pull-requests: read
     uses: CodySwannGT/lisa/.github/workflows/quality.yml@main
     with:
       node_version: '22.21.1'
@@ -29,3 +34,9 @@ jobs:
       GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
       FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
       MAESTRO_API_KEY: ${{ secrets.MAESTRO_API_KEY }}
+      # Only the configured tracker's credentials are used. tracker:
+      # github needs none of these; jira/linear cannot verify the PR
+      # backlink without them and report not-enforceable instead.
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+      JIRA_LOGIN: ${{ secrets.JIRA_LOGIN }}
+      LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.300.12",
+  "version": "2.301.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/rails/create-only/.github/workflows/ci.yml

@@ -20,6 +20,10 @@ jobs:
       contents: read
       checks: write
       pull-requests: write
+      # work_item_traceability reads the tracker issue to verify the PR
+      # backlink. A reusable workflow can only DOWNGRADE the caller's
+      # grant, so without issues:read that job cannot enforce anything.
+      issues: read
     uses: CodySwannGT/lisa/.github/workflows/quality-rails.yml@main
     # Rails projects default to PostgreSQL. For a MySQL app, uncomment:
     # with:
@@ -27,3 +31,9 @@ jobs:
     secrets:
       GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
       FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
+      # Only the configured tracker's credentials are used. tracker:
+      # github needs none of these; jira/linear cannot verify the PR
+      # backlink without them and report not-enforceable instead.
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+      JIRA_LOGIN: ${{ secrets.JIRA_LOGIN }}
+      LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}

package/rails/github-rulesets/quality-checks.json

@@ -43,6 +43,10 @@
           {
             "context": "Quality Checks / Security",
             "integration_id": 15368
+          },
+          {
+            "context": "Quality Checks / 🔗 Work-Item Traceability",
+            "integration_id": 15368
           }
         ]
       }

package/typescript/create-only/.github/workflows/ci.yml

@@ -14,6 +14,10 @@ jobs:
     permissions:
       contents: read
       pull-requests: read
+      # work_item_traceability reads the tracker issue to verify the PR
+      # backlink. A reusable workflow can only DOWNGRADE the caller's
+      # grant, so without issues:read that job cannot enforce anything.
+      issues: read
     uses: CodySwannGT/lisa/.github/workflows/quality.yml@main
     with:
       node_version: '22.21.1'
@@ -25,3 +29,9 @@ jobs:
       GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
       FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
       MAESTRO_API_KEY: ${{ secrets.MAESTRO_API_KEY }}
+      # Only the configured tracker's credentials are used. tracker:
+      # github needs none of these; jira/linear cannot verify the PR
+      # backlink without them and report not-enforceable instead.
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+      JIRA_LOGIN: ${{ secrets.JIRA_LOGIN }}
+      LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}

package/typescript/github-rulesets/quality-checks.json

@@ -59,6 +59,10 @@
           {
             "context": "🔍 Quality Checks / 🧪 Run Integration Tests",
             "integration_id": 15368
+          },
+          {
+            "context": "🔍 Quality Checks / 🔗 Work-Item Traceability",
+            "integration_id": 15368
           }
         ]
       }