@codyswann/lisa 2.300.13 → 2.301.1

package/cdk/create-only/.github/workflows/ci.yml

@@ -133,6 +133,11 @@ jobs:
     # Reference to the quality checks workflow
     permissions:
       contents: read
+      # work_item_traceability reads the tracker issue to verify the PR
+      # backlink. A reusable workflow can only DOWNGRADE the caller's
+      # grant, so without issues:read that job cannot enforce anything.
+      issues: read
+      pull-requests: read
     uses: CodySwannGT/lisa/.github/workflows/quality.yml@main
     with:
       node_version: '22.21.1'
@@ -143,3 +148,9 @@ jobs:
       GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
       FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
       MAESTRO_API_KEY: ${{ secrets.MAESTRO_API_KEY }}
+      # Only the configured tracker's credentials are used. tracker:
+      # github needs none of these; jira/linear cannot verify the PR
+      # backlink without them and report not-enforceable instead.
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+      JIRA_LOGIN: ${{ secrets.JIRA_LOGIN }}
+      LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}

package/dist/core/upstream-evidence-manifest.js

@@ -23,7 +23,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "cdk/copy-overwrite/tsconfig.json": "bd960df819bb1ce01163ac4b28721eea3f07d482f6c454cfea9a8dc90191033a",
     "cdk/copy-overwrite/vitest.cdk.ts": "aea238d214b7eb4c532cebe5bf732dc30b9fd04d938a215bd34a5ec2eff17046",
     "cdk/copy-overwrite/vitest.config.ts": "ce14179d4ab31011bb012ee1669af7d86b5189bdf2934e0bd9dd666a30e3d01e",
-    "cdk/create-only/.github/workflows/ci.yml": "04cca8fbcb7a5c6da1aeb2b2d00d7a328d15618e4252f1d9dd495052d264d0f5",
+    "cdk/create-only/.github/workflows/ci.yml": "dc384ef9bd46af723cafd8d140f6d58d2630cfa8a7b07104254d8ecd4a556636",
     "cdk/create-only/.github/workflows/deploy.yml": "2746e78fb0fbe7b23b30bbcb0f83171e16f6804fd467b3d41d3c69970572af3f",
     "cdk/create-only/cdk.json": "f89030d8fe145a1dbabd59d89ddee4e16984f222d737f7fcf6b778d911e9fe40",
     "cdk/create-only/tsconfig.local.json": "d26253827e21fd7c41d30565fe3d339675f119e00bb24c5713a01f57ccd06602",
@@ -73,8 +73,8 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "expo/copy-overwrite/tsconfig.eslint.json": "375bb2ee8185e4a57d703e078ad57188f6d45b03b0fcbb16ef049fcf9b14c44b",
     "expo/copy-overwrite/tsconfig.expo.json": "55f3dfe80496f03152d40d364c5a9cabf3fdce3adc8cebea48ba5257d77b7aa9",
     "expo/copy-overwrite/tsconfig.json": "c92e2c2c109e8794ee351f634361ef46297f5a0cd606aaf5c19911da836df307",
-    "expo/create-only/.github/workflows/ci.yml": "3ade267cca43e33c68e56b8c4f5d821ed03f642e5a11aa8b70b79e76ec41b96f",
-    "expo/create-only/.github/workflows/deploy.yml": "0978b1f4e19e1ff66bb8cdd037d36a3751d4e917db7ceb5bcf100fad36768516",
+    "expo/create-only/.github/workflows/ci.yml": "bf75c9d3b4f4a2cb24c2214d9fc27a9cb2247a6694b0cf02c40032b4d3e87cd9",
+    "expo/create-only/.github/workflows/deploy.yml": "49a1ae719c1a917f7fee2fc9ef405397308d01b56d75d94a7d03e3dfadd4dce7",
     "expo/create-only/.github/workflows/maestro-e2e.yml": "444367a8cefaa81b484bc6eff5923c34177e10f6a67cbf1befec00c9d0d1d36b",
     "expo/create-only/.zap/baseline.conf": "ab18d74ba5270dd5d795e740cd6b1292bb78dc36c79a20c1e7b752d14c0c55f5",
     "expo/create-only/babel.config.js": "faaf96f0d43c724a240a7892584de54ae384eee9ef9d76430d081f37d9f92924",
@@ -97,7 +97,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "harper-fabric/copy-contents/.prettierignore": "478c782f4c5611187e21584dfd5522e37fc636c5eb03394fea3db45321c6712c",
     "harper-fabric/copy-contents/gitignore": "d091c40fd0ea3068491f1be0d6510090ae872ca95d0d058ef4595d6492d13897",
     "harper-fabric/copy-overwrite/.github/dependabot.yml": "e28fde0d906478b3fb7d6b7fc16f7fc5a4a0a20d8160f547f2b4be97c90578b7",
-    "harper-fabric/copy-overwrite/.github/workflows/ci.yml": "6823d87b989f1fbeb2f471552a041f5c9476e67ece8f6ec7ba75e97738afe2f9",
+    "harper-fabric/copy-overwrite/.github/workflows/ci.yml": "d8227671ebec99255c2adac8ef76ec29cdfa5b8f4c56fe376a37dab08accc0cc",
     "harper-fabric/copy-overwrite/ast-grep/rules/harper/no-early-return-in-search-loop.yml": "c25106e1d4ee3566c70824ba4ecbc2ee0345014008aedb4fac56d0be23029264",
     "harper-fabric/copy-overwrite/ast-grep/rules/harper/no-empty-conditions-with-sort.yml": "d735e92ea25a4d8fbac8b45e06d73baf8b7cf0b38068623663b928dd6850e26e",
     "harper-fabric/copy-overwrite/ast-grep/rules/harper/no-full-table-scan.yml": "00f49de6372a3a2825e9e38b6d2d86ac1580e28c1e2e8c8fa07bee0cfe2ac0aa",
@@ -147,8 +147,8 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "nestjs/create-only/.github/k6/thresholds/normal.json": "1842cf0b617380ce641781589b4084b03aac1beeb4803a696b3ae6329710ad44",
     "nestjs/create-only/.github/k6/thresholds/relaxed.json": "350c18b2c588fd628db8a6e82fc5c0b3ffc8a09f1c89b64d1f530350bc64a9ca",
     "nestjs/create-only/.github/k6/thresholds/strict.json": "e121ec72de4596b95c013a8c71f03653bcdf057cf7f8d1fec6f0e13c1381867f",
-    "nestjs/create-only/.github/workflows/ci.yml": "8db7de7f2e3eb2a1605539849a346b55281cfcd9951526f9d5a1757a210da3c6",
-    "nestjs/create-only/.github/workflows/deploy.yml": "78abfa87639cb7506418dd34387963a0557614933d823e6fa0413395166b945b",
+    "nestjs/create-only/.github/workflows/ci.yml": "0985668e6d0478f1993bed8ccd398601d8e73376afd8775e1269ae129418152e",
+    "nestjs/create-only/.github/workflows/deploy.yml": "d1b91b1de805c58602764f9041e3c9755682509d8d1de5c2ee1f0ada96665dca",
     "nestjs/create-only/.zap/baseline.conf": "a7cd559b014555ef2efe7a6ce129384ec376ce4d66d5bc3ae9e2f3f883172c4d",
     "nestjs/create-only/scripts/zap-baseline.sh": "de3a66a780076f98d5c6306c03b5decac8afbc9ff37583e5e6463c56f3399e3e",
     "nestjs/create-only/tsconfig.local.json": "0b720ddad0d18f52dadf33bdc4a0aec0eb65c506bc8ebb692f880bdf31d1011d",
@@ -169,7 +169,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "oxlint/typescript.json": "c7352af5d92a97da1386edfbff873f284c932f5413dce87c4af27520097389aa",
     "phaser/copy-contents/.prettierignore": "3bd2e016bd4bd23f76d186a4a4ba72f47719b9aa1df5d3352ad5719d93e0bf49",
     "phaser/copy-contents/gitignore": "4b8d1a5817d35f64f5d4859f9184ebe2e1dc42e63f8e9269fff233e2ec258d6c",
-    "phaser/copy-overwrite/.github/workflows/ci.yml": "02b7fa8ceb9950b72d000fa1688177e747ef549d1b49d2cb4b1db97ec94a3a61",
+    "phaser/copy-overwrite/.github/workflows/ci.yml": "7b037b5961569a09e8407e6b9bf9a91377208f76bc309680870c2b56ff2f4813",
     "phaser/copy-overwrite/.husky/pre-push.verify": "fef6694c2fde6178f46c62936d2b19515adce4fc8ac694ea66d8342aa1474ee7",
     "phaser/copy-overwrite/ast-grep/rule-tests/.gitkeep": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
     "phaser/copy-overwrite/ast-grep/rules/phaser/no-canvas-renderer.yml": "bd0994bbb8f8e6bde2a1a581fb2cb8aa011d91822dabf4366f500359069726b3",
@@ -889,7 +889,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "rails/copy-overwrite/scripts/threshold-ratchet-compare.mjs": "4535a145c5c5cbee13bdf970bc91d390a264043604e607288cdd6bf28de56192",
     "rails/copy-overwrite/scripts/threshold-ratchet-families.mjs": "db14245ed89b483912af287bdee917a7a921dc21bb29b49be37fc799c05c413f",
     "rails/copy-overwrite/sgconfig.yml": "0ffe058c791d4d323f98104cf78c763bb0356d88739042060ceb86b6b1cb78d7",
-    "rails/create-only/.github/workflows/ci.yml": "599805266a47b5c0039145a11df225d4db6c59d35b2ecc582a44d55ab7f4b1f0",
+    "rails/create-only/.github/workflows/ci.yml": "ad53014bdd6cf15bfadfaef7740b6094c3c7bd044f9d176c4938154da983529d",
     "rails/create-only/.github/workflows/claude-code-review-response.yml": "bfbe3127c4941c35886d324d439ae0302fbccd74a11cb4decf05a21195efa0e9",
     "rails/create-only/.github/workflows/claude-nightly-code-complexity.yml": "3943137c81ed212d7d3f35f7d7f6242a984fda43ed29a5f565ab5c2923d92606",
     "rails/create-only/.github/workflows/claude-nightly-test-coverage.yml": "f7f2eeb05ddd18e196c4b292c0a846e765ed8b67ddeacfc6b19c3d676d91e459",
@@ -911,7 +911,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "rails/create-only/spec/rails_helper.rb": "aa94dcec9eea6d238c7210ca9ee88ba009061f1ba59bd042eaf09b8f98582689",
     "rails/create-only/spec/spec_helper.rb": "4308dcddf2ee1b65986ff206a0feac62c8e3a1cae842b115fd2945b7563ed9cd",
     "rails/deletions.json": "eeadf9a2b1677913199a235091a8d6190477f3e2a5fd598d62cf658cb59a8099",
-    "rails/github-rulesets/quality-checks.json": "ea42f2bb938881bc6ec129e7300a2b824313951031d4720f46e944c4dfe1a9da",
+    "rails/github-rulesets/quality-checks.json": "0ec1c366589edbaa6b8f45f940cef3ada5ed7b1a956d98d3fa6034b0f78fbc7c",
     "rails/merge/.claude/settings.json": "9c49f8c7c453f8749c90def3e22d412c3345c533d24b30dc7745ffa052ad6fa1",
     "scripts/build-plugins.sh": "d26321ea10bc3ed8cf096f900622cb4cf7a37117fabf9730f0fe5c9d949582fc",
     "scripts/check-duplicate-versions.mjs": "84d97e94eb834522848ddce951bb54ae9da1e4be252e2c51fed0c01c4f4d6b72",
@@ -1014,7 +1014,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "typescript/copy-overwrite/vitest.config.ts": "da92f06cc3ce68462c6f2f3d95adb1b1464591ce383a24e3334dc986e0c1e0fb",
     "typescript/create-only/.github/workflows/auto-update-pr-branches-dispatch.yml": "347f8a3830efdc3ad701fae0858994f4e45df8100844e91948b017b98115a28c",
     "typescript/create-only/.github/workflows/auto-update-pr-branches.yml": "cf185555bcbe8e9957333abcae2e0c20e00875f8d867f70134efbd2a5c974ee5",
-    "typescript/create-only/.github/workflows/ci.yml": "d8c7f65e408a21e344b3a518ddf088d5ada4b08eb24d6b2cfa38ec6755ca8b5a",
+    "typescript/create-only/.github/workflows/ci.yml": "dac98b7ab5a7397461e459b2553101bfdc6451d28b42f3b0115056b62cfb8b1d",
     "typescript/create-only/.github/workflows/claude-ci-auto-fix.yml": "a9155c10d0c28eba0f77ec5bc2a2d99b0eeb5d499218aac81948d3f27e6aa4fb",
     "typescript/create-only/.github/workflows/claude-code-review-response.yml": "68bc8b53c2d4c58ab49b176796d27214415608fe94130e1f465c0bd41a100443",
     "typescript/create-only/.github/workflows/claude-deploy-auto-fix.yml": "5e0f7282b1b97a308bc5b95f6a4ef784d4dfbd02f3126bf9254fbf4576606daf",
@@ -1035,7 +1035,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "typescript/create-only/vitest.config.local.ts": "476738b351114a0efbcd3ae4ce1cf016307b55ee41ed8e87c35e28e4639d98f5",
     "typescript/create-only/vitest.thresholds.json": "ce04fe30ad6139f734dbc56d92a801c11cfd86a0d9e49c06c1c2d0a137beeffd",
     "typescript/deletions.json": "fe5f44b7a02148eacc429782e948b1c4aee302d1d56524cc16adec5489bbc308",
-    "typescript/github-rulesets/quality-checks.json": "89b9e09267cdb65865728d0e873de9c1225b8ca796e67f06fa8b72ccf6d4515e",
+    "typescript/github-rulesets/quality-checks.json": "d92599b203071b99b8fac1422b8493d2546138961ef04ba98176bc400af60945",
     "typescript/merge/.claude/settings.json": "834e6456cae81f45073bbbb08bf731fef043efb30cae2658cb4a59f17e66d165",
     "typescript/merge/.oxlintrc.json": "4debc093acfd263eb81ae15894073ebf098513204f45f40b83fb8fa5353fa1f8",
     "typescript/package-lisa/package.lisa.json": "bdd1766c2f327290207874b04fd3a577a8188bb57c2fd77d482bb7d6ecf17355",

package/expo/create-only/.github/workflows/ci.yml

@@ -30,6 +30,11 @@ jobs:
     # Reference to the quality checks workflow
     permissions:
       contents: read
+      # work_item_traceability reads the tracker issue to verify the PR
+      # backlink. A reusable workflow can only DOWNGRADE the caller's
+      # grant, so without issues:read that job cannot enforce anything.
+      issues: read
+      pull-requests: read
     uses: CodySwannGT/lisa/.github/workflows/quality.yml@main
     with:
       node_version: '22.21.1'
@@ -47,6 +52,12 @@ jobs:
       GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
       FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
       MAESTRO_API_KEY: ${{ secrets.MAESTRO_API_KEY }}
+      # Only the configured tracker's credentials are used. tracker:
+      # github needs none of these; jira/linear cannot verify the PR
+      # backlink without them and report not-enforceable instead.
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+      JIRA_LOGIN: ${{ secrets.JIRA_LOGIN }}
+      LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
   lighthouse:
     name: 💡 Lighthouse CI
     needs: [quality]

package/expo/create-only/.github/workflows/deploy.yml

@@ -92,6 +92,7 @@ jobs:
     needs: [determine_environment]
     permissions:
       contents: write
+      issues: read
       pull-requests: read
     with:
       environment: ${{ needs.determine_environment.outputs.environment }}

package/harper-fabric/copy-overwrite/.github/workflows/ci.yml

@@ -12,6 +12,11 @@ jobs:
     name: 🔍 Quality Checks
     permissions:
       contents: read
+      # work_item_traceability reads the tracker issue to verify the PR
+      # backlink. A reusable workflow can only DOWNGRADE the caller's
+      # grant, so without issues:read that job cannot enforce anything.
+      issues: read
+      pull-requests: read
     uses: CodySwannGT/lisa/.github/workflows/quality.yml@main
     with:
       node_version: '22.21.1'
@@ -23,3 +28,9 @@ jobs:
       GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
       FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
       MAESTRO_API_KEY: ${{ secrets.MAESTRO_API_KEY }}
+      # Only the configured tracker's credentials are used. tracker:
+      # github needs none of these; jira/linear cannot verify the PR
+      # backlink without them and report not-enforceable instead.
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+      JIRA_LOGIN: ${{ secrets.JIRA_LOGIN }}
+      LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}

package/nestjs/create-only/.github/workflows/ci.yml

@@ -14,6 +14,11 @@ jobs:
     # Reference to the quality checks workflow
     permissions:
       contents: read
+      # work_item_traceability reads the tracker issue to verify the PR
+      # backlink. A reusable workflow can only DOWNGRADE the caller's
+      # grant, so without issues:read that job cannot enforce anything.
+      issues: read
+      pull-requests: read
     uses: CodySwannGT/lisa/.github/workflows/quality.yml@main
     with:
       node_version: '22.21.1'
@@ -25,6 +30,12 @@ jobs:
       GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
       FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
       MAESTRO_API_KEY: ${{ secrets.MAESTRO_API_KEY }}
+      # Only the configured tracker's credentials are used. tracker:
+      # github needs none of these; jira/linear cannot verify the PR
+      # backlink without them and report not-enforceable instead.
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+      JIRA_LOGIN: ${{ secrets.JIRA_LOGIN }}
+      LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
 
   zap:
     name: 🕷️ ZAP Baseline Scan

package/nestjs/create-only/.github/workflows/deploy.yml

@@ -85,6 +85,7 @@ jobs:
     needs: [determine_environment]
     permissions:
       contents: write
+      issues: read
       pull-requests: read
     with:
       environment: ${{ needs.determine_environment.outputs.environment }}

package/package.json

@@ -115,7 +115,7 @@
     "brace-expansion": ">=5.0.8"
   },
   "name": "@codyswann/lisa",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/phaser/copy-overwrite/.github/workflows/ci.yml

@@ -15,6 +15,11 @@ jobs:
     name: 🔍 Quality Checks
     permissions:
       contents: read
+      # work_item_traceability reads the tracker issue to verify the PR
+      # backlink. A reusable workflow can only DOWNGRADE the caller's
+      # grant, so without issues:read that job cannot enforce anything.
+      issues: read
+      pull-requests: read
     uses: CodySwannGT/lisa/.github/workflows/quality.yml@main
     with:
       node_version: '22.21.1'
@@ -29,3 +34,9 @@ jobs:
       GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
       FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
       MAESTRO_API_KEY: ${{ secrets.MAESTRO_API_KEY }}
+      # Only the configured tracker's credentials are used. tracker:
+      # github needs none of these; jira/linear cannot verify the PR
+      # backlink without them and report not-enforceable instead.
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+      JIRA_LOGIN: ${{ secrets.JIRA_LOGIN }}
+      LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.300.13",
+  "version": "2.301.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/rails/create-only/.github/workflows/ci.yml

@@ -20,6 +20,10 @@ jobs:
       contents: read
       checks: write
       pull-requests: write
+      # work_item_traceability reads the tracker issue to verify the PR
+      # backlink. A reusable workflow can only DOWNGRADE the caller's
+      # grant, so without issues:read that job cannot enforce anything.
+      issues: read
     uses: CodySwannGT/lisa/.github/workflows/quality-rails.yml@main
     # Rails projects default to PostgreSQL. For a MySQL app, uncomment:
     # with:
@@ -27,3 +31,9 @@ jobs:
     secrets:
       GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
       FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
+      # Only the configured tracker's credentials are used. tracker:
+      # github needs none of these; jira/linear cannot verify the PR
+      # backlink without them and report not-enforceable instead.
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+      JIRA_LOGIN: ${{ secrets.JIRA_LOGIN }}
+      LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}

package/rails/github-rulesets/quality-checks.json

@@ -43,6 +43,10 @@
           {
             "context": "Quality Checks / Security",
             "integration_id": 15368
+          },
+          {
+            "context": "Quality Checks / 🔗 Work-Item Traceability",
+            "integration_id": 15368
           }
         ]
       }

package/typescript/create-only/.github/workflows/ci.yml

@@ -14,6 +14,10 @@ jobs:
     permissions:
       contents: read
       pull-requests: read
+      # work_item_traceability reads the tracker issue to verify the PR
+      # backlink. A reusable workflow can only DOWNGRADE the caller's
+      # grant, so without issues:read that job cannot enforce anything.
+      issues: read
     uses: CodySwannGT/lisa/.github/workflows/quality.yml@main
     with:
       node_version: '22.21.1'
@@ -25,3 +29,9 @@ jobs:
       GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
       FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
       MAESTRO_API_KEY: ${{ secrets.MAESTRO_API_KEY }}
+      # Only the configured tracker's credentials are used. tracker:
+      # github needs none of these; jira/linear cannot verify the PR
+      # backlink without them and report not-enforceable instead.
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+      JIRA_LOGIN: ${{ secrets.JIRA_LOGIN }}
+      LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}

package/typescript/github-rulesets/quality-checks.json

@@ -59,6 +59,10 @@
           {
             "context": "🔍 Quality Checks / 🧪 Run Integration Tests",
             "integration_id": 15368
+          },
+          {
+            "context": "🔍 Quality Checks / 🔗 Work-Item Traceability",
+            "integration_id": 15368
           }
         ]
       }