@codyswann/lisa 2.300.7 → 2.300.8

package/dist/core/upstream-evidence-manifest.js

@@ -299,10 +299,10 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/hooks/parity-safety-net.sh": "062c69eea85157f1e941ec3626d8912aa9f182af6ccdbe19687588a6074db5ce",
     "plugins/src/base/hooks/setup-jira-cli.sh": "a675f6b17ce7f0d6b9fb7daeba6d2bc59bcb48ef79b034076ea73b2b1e72ee09",
     "plugins/src/base/hooks/shell-write-nudge.sh": "69839af423f8792b1e52c71097316c3264425553031627c0a2f9409a9d5becd0",
-    "plugins/src/base/hooks/threshold-ratchet-compare.mjs": "8bc4b379d7057b2fecf9cb35820c39efad0a65df7df49073786f996cc2a74810",
-    "plugins/src/base/hooks/threshold-ratchet-families.mjs": "fee19c88c89eed5a2949dea42c4a4c794f04aabf0e36c71cdda70ffaaf2b17c9",
-    "plugins/src/base/hooks/threshold-ratchet.mjs": "6da00221189ed0f8a2938f15e02bcc2633d44f5f05489979fbb94202bc45a6d4",
-    "plugins/src/base/hooks/threshold-ratchet.sh": "6186849d72eb98a73fc574e6c8e3773288e2aeadc7a30e07b21b9ab51de6e9f5",
+    "plugins/src/base/hooks/threshold-ratchet-compare.mjs": "4535a145c5c5cbee13bdf970bc91d390a264043604e607288cdd6bf28de56192",
+    "plugins/src/base/hooks/threshold-ratchet-families.mjs": "db14245ed89b483912af287bdee917a7a921dc21bb29b49be37fc799c05c413f",
+    "plugins/src/base/hooks/threshold-ratchet.mjs": "04f660131bf50864239eb09cbf4d9555e53921254f6ab45ff2b85c173e160901",
+    "plugins/src/base/hooks/threshold-ratchet.sh": "b86f4d0b554e44fd119ad8a8920cd0ba6c9dbe779f7ee219d381cf0629453990",
     "plugins/src/base/hooks/ticket-sync-reminder.sh": "212f80bcdfd9e3ec2254987c5a7186d1d2d38065b330ddcdc631f76df7c4a6c0",
     "plugins/src/base/hooks/track-plan-sessions.sh": "8bc47dcad3aed628df0c9efbe7b6f3df87635b94b0c54c71e0bd52eceace563a",
     "plugins/src/base/rules/eager/automation-runbook-contract.md": "b9b4f4d82b366959e90451a2b425ac116953ac074ab6a192dc3909ec8a2be1d6",
@@ -884,10 +884,10 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "rails/copy-overwrite/ast-grep/utils/.gitkeep": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
     "rails/copy-overwrite/config/initializers/version.rb": "fa664a84f407877b5ddbd3709a2352b30e4dc6fbce538a8503bad6c52448dc86",
     "rails/copy-overwrite/lefthook.yml": "28bb382b9171a04fb92ebafc1f1522b8639f5edc4fcffcc6940e7fba3460fb4e",
-    "rails/copy-overwrite/scripts/check-threshold-ratchet.mjs": "6da00221189ed0f8a2938f15e02bcc2633d44f5f05489979fbb94202bc45a6d4",
+    "rails/copy-overwrite/scripts/check-threshold-ratchet.mjs": "04f660131bf50864239eb09cbf4d9555e53921254f6ab45ff2b85c173e160901",
     "rails/copy-overwrite/scripts/lisa-clean-git-env.sh": "e7121a0ee9e1bf7c01cd2ab55f563dd6d9ab75990739bb6ddf571a513efa10e9",
-    "rails/copy-overwrite/scripts/threshold-ratchet-compare.mjs": "8bc4b379d7057b2fecf9cb35820c39efad0a65df7df49073786f996cc2a74810",
-    "rails/copy-overwrite/scripts/threshold-ratchet-families.mjs": "fee19c88c89eed5a2949dea42c4a4c794f04aabf0e36c71cdda70ffaaf2b17c9",
+    "rails/copy-overwrite/scripts/threshold-ratchet-compare.mjs": "4535a145c5c5cbee13bdf970bc91d390a264043604e607288cdd6bf28de56192",
+    "rails/copy-overwrite/scripts/threshold-ratchet-families.mjs": "db14245ed89b483912af287bdee917a7a921dc21bb29b49be37fc799c05c413f",
     "rails/copy-overwrite/sgconfig.yml": "0ffe058c791d4d323f98104cf78c763bb0356d88739042060ceb86b6b1cb78d7",
     "rails/create-only/.github/workflows/ci.yml": "599805266a47b5c0039145a11df225d4db6c59d35b2ecc582a44d55ab7f4b1f0",
     "rails/create-only/.github/workflows/claude-code-review-response.yml": "bfbe3127c4941c35886d324d439ae0302fbccd74a11cb4decf05a21195efa0e9",
@@ -1003,11 +1003,11 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "typescript/copy-overwrite/eslint.ignore.config.json": "54739e51ce09c314fe01d8a3919e6db5d48cbfb63dcba957f8aca6eba6229a9b",
     "typescript/copy-overwrite/eslint.slow.config.ts": "f66d04381940936544931d7f20ffd4e43c38b8a907d56ffa101e2236371d8c94",
     "typescript/copy-overwrite/knip.json": "6eb93d705a2d645332fbae1dd42cf2d48f85978ebc265451a53790912f277d12",
-    "typescript/copy-overwrite/scripts/check-threshold-ratchet.mjs": "6da00221189ed0f8a2938f15e02bcc2633d44f5f05489979fbb94202bc45a6d4",
+    "typescript/copy-overwrite/scripts/check-threshold-ratchet.mjs": "04f660131bf50864239eb09cbf4d9555e53921254f6ab45ff2b85c173e160901",
     "typescript/copy-overwrite/scripts/check-verification-coverage.mjs": "3c1d27d0668fc66a18cb014f2b607878f0a88c178a773fbe964b8e46b19e86d6",
     "typescript/copy-overwrite/scripts/lisa-mutation.mjs": "7d8d24dea151ef2178807046e97aea7ebfadd9c88eb50347feb7bb4bb190227d",
-    "typescript/copy-overwrite/scripts/threshold-ratchet-compare.mjs": "8bc4b379d7057b2fecf9cb35820c39efad0a65df7df49073786f996cc2a74810",
-    "typescript/copy-overwrite/scripts/threshold-ratchet-families.mjs": "fee19c88c89eed5a2949dea42c4a4c794f04aabf0e36c71cdda70ffaaf2b17c9",
+    "typescript/copy-overwrite/scripts/threshold-ratchet-compare.mjs": "4535a145c5c5cbee13bdf970bc91d390a264043604e607288cdd6bf28de56192",
+    "typescript/copy-overwrite/scripts/threshold-ratchet-families.mjs": "db14245ed89b483912af287bdee917a7a921dc21bb29b49be37fc799c05c413f",
     "typescript/copy-overwrite/sgconfig.yml": "0ffe058c791d4d323f98104cf78c763bb0356d88739042060ceb86b6b1cb78d7",
     "typescript/copy-overwrite/tsconfig.eslint.json": "8a8ae5e201b18887b8eeda5eb569747221695524d4193ea03b4338b97b7fa642",
     "typescript/copy-overwrite/tsconfig.json": "8f4257fcd2cfd4b23e83e0fdd4908d41ee8f1ae75bb95d632e653a0ac13d58e4",

package/package.json

@@ -115,7 +115,7 @@
     "brace-expansion": ">=5.0.8"
   },
   "name": "@codyswann/lisa",
-  "version": "2.300.7",
+  "version": "2.300.8",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.300.7",
+  "version": "2.300.8",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.300.7",
+  "version": "2.300.8",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/threshold-ratchet-compare.mjs

@@ -8,7 +8,6 @@
  */
 import {
   extractAllowEntries,
-  extractExemptionEntries,
   extractK6Constraints,
   extractNumericLeaves,
   extractRubocopThresholds,
@@ -20,7 +19,7 @@ import {
 
 /** Finding type: a numeric bound or boolean gate moved the weakening way. */
 const TYPE_WEAKENED = "weakened";
-/** Finding type: an exemption entry was added (Tier 3). */
+/** Finding type: a gate-shrinking exemption was added (Tier 3). */
 const TYPE_EXEMPTION_ADDED = "exemption-added";
 /** Family kind for .lisa.config.json (the thresholdRatchet.allow carrier). */
 const KIND_ALLOW_LIST = "allow-list";
@@ -160,29 +159,6 @@ function compareK6(relPath, base, current) {
   return findings;
 }
 
-/**
- * Compare an exemption-list pair (audit ignore files): report added entries.
- * @param {string} relPath Repo-relative path
- * @param {unknown} base Parsed baseline list
- * @param {unknown} current Parsed current list
- * @returns {Finding[]} One finding per newly added ignore entry
- */
-function compareExemptions(relPath, base, current) {
-  const baseEntries = extractExemptionEntries(base);
-  const findings = [];
-  for (const entry of extractExemptionEntries(current)) {
-    if (!baseEntries.has(entry)) {
-      findings.push({
-        file: relPath,
-        key: entry,
-        type: TYPE_EXEMPTION_ADDED,
-        message: `${relPath}: new security-audit ignore entry "${entry}" — ignoring a finding weakens the gate and needs a human's sign-off.`,
-      });
-    }
-  }
-  return findings;
-}
-
 /**
  * Compare .lisa.config.json allow lists: report added exception entries so a
  * change can never grant itself an exception.
@@ -258,8 +234,6 @@ export function compareFile(relPath, baselineText, currentText) {
       return compareStryker(relPath, base, current);
     case "k6":
       return compareK6(relPath, base, current);
-    case "exemption-list":
-      return compareExemptions(relPath, base, current);
     case KIND_ALLOW_LIST:
       return compareAllowList(relPath, base, current);
     default:

package/plugins/lisa/hooks/threshold-ratchet-families.mjs

@@ -48,11 +48,6 @@ export const FAMILIES = [
     match: /(^|\/)\.github\/k6\/thresholds\/[^/]+\.json$/,
     kind: "k6",
   },
-  {
-    id: "audit-ignore",
-    match: /(^|\/)audit\.ignore\.(config|local)\.json$/,
-    kind: "exemption-list",
-  },
   {
     id: "lisa-config",
     match: /(^|\/)\.lisa\.config\.json$/,
@@ -251,35 +246,6 @@ export function extractK6Constraints(conf) {
   return { numeric, booleans };
 }
 
-/**
- * Flatten an exemption file (audit ignore list) into a set of entry tokens.
- * Arrays contribute their string items; objects contribute their keys.
- * @param {unknown} conf Parsed JSON
- * @returns {Set<string>} One token per exemption entry
- */
-export function extractExemptionEntries(conf) {
-  const out = new Set();
-  if (Array.isArray(conf)) {
-    for (const item of conf) {
-      if (typeof item === "string") out.add(item);
-      else if (item && typeof item === "object") out.add(JSON.stringify(item));
-    }
-  } else if (conf && typeof conf === "object") {
-    for (const [key, value] of Object.entries(conf)) {
-      if (Array.isArray(value)) {
-        for (const item of value) {
-          out.add(
-            `${key}:${typeof item === "string" ? item : JSON.stringify(item)}`
-          );
-        }
-      } else {
-        out.add(key);
-      }
-    }
-  }
-  return out;
-}
-
 /**
  * Extract thresholdRatchet.allow entries from parsed .lisa.config.json.
  * @param {unknown} config Parsed config (may be undefined)

package/plugins/lisa/hooks/threshold-ratchet.mjs

@@ -12,8 +12,11 @@
  * Tier 1 — designed tunables: vitest/jest/simplecov/e2e thresholds
  * (minimums) and eslint/rubocop thresholds (maximums). Tier 2 — stryker's
  * break score and k6 expression bounds. Tier 3 — exemption additions
- * (audit-ignore entries, stryker mutate exclusions, thresholdRatchet.allow
- * entries) which weaken a gate without touching a number.
+ * (stryker mutate exclusions, thresholdRatchet.allow entries) which weaken
+ * a gate without touching a number. Audit ignore lists are deliberately NOT
+ * watched: the security-audit-handling ladder authorizes agents to add
+ * documented entries autonomously, and doctor readiness (B5) audits that
+ * every entry carries a written decision.
  *
  * Human override: `.lisa.config.json` → `thresholdRatchet.allow` entries
  * ({ file, key, reason }). Honored ONLY from the baseline side (HEAD /

package/plugins/lisa/hooks/threshold-ratchet.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # PostToolUse hook for Edit|Write|NotebookEdit|Bash: the threshold ratchet.
 # Quality thresholds (coverage minimums, complexity maximums, mutation break
-# score, e2e route floors, k6 bounds, audit-ignore lists) may tighten but never
+# score, e2e route floors, k6 bounds) may tighten but never
 # weaken. The deterministic comparator lives in threshold-ratchet.mjs and is
 # shared with the pre-commit (husky/lefthook --staged) and CI (--base) layers,
 # so this hook is fast feedback — not the only line of defense.

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.300.7",
+  "version": "2.300.8",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.300.7",
+  "version": "2.300.8",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.300.7",
+  "version": "2.300.8",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.300.7",
+  "version": "2.300.8",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.300.7",
+  "version": "2.300.8",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.300.7",
+  "version": "2.300.8",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.300.7",
+  "version": "2.300.8",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/threshold-ratchet-compare.mjs

@@ -8,7 +8,6 @@
  */
 import {
   extractAllowEntries,
-  extractExemptionEntries,
   extractK6Constraints,
   extractNumericLeaves,
   extractRubocopThresholds,
@@ -20,7 +19,7 @@ import {
 
 /** Finding type: a numeric bound or boolean gate moved the weakening way. */
 const TYPE_WEAKENED = "weakened";
-/** Finding type: an exemption entry was added (Tier 3). */
+/** Finding type: a gate-shrinking exemption was added (Tier 3). */
 const TYPE_EXEMPTION_ADDED = "exemption-added";
 /** Family kind for .lisa.config.json (the thresholdRatchet.allow carrier). */
 const KIND_ALLOW_LIST = "allow-list";
@@ -160,29 +159,6 @@ function compareK6(relPath, base, current) {
   return findings;
 }
 
-/**
- * Compare an exemption-list pair (audit ignore files): report added entries.
- * @param {string} relPath Repo-relative path
- * @param {unknown} base Parsed baseline list
- * @param {unknown} current Parsed current list
- * @returns {Finding[]} One finding per newly added ignore entry
- */
-function compareExemptions(relPath, base, current) {
-  const baseEntries = extractExemptionEntries(base);
-  const findings = [];
-  for (const entry of extractExemptionEntries(current)) {
-    if (!baseEntries.has(entry)) {
-      findings.push({
-        file: relPath,
-        key: entry,
-        type: TYPE_EXEMPTION_ADDED,
-        message: `${relPath}: new security-audit ignore entry "${entry}" — ignoring a finding weakens the gate and needs a human's sign-off.`,
-      });
-    }
-  }
-  return findings;
-}
-
 /**
  * Compare .lisa.config.json allow lists: report added exception entries so a
  * change can never grant itself an exception.
@@ -258,8 +234,6 @@ export function compareFile(relPath, baselineText, currentText) {
       return compareStryker(relPath, base, current);
     case "k6":
       return compareK6(relPath, base, current);
-    case "exemption-list":
-      return compareExemptions(relPath, base, current);
     case KIND_ALLOW_LIST:
       return compareAllowList(relPath, base, current);
     default:

package/plugins/lisa-copilot/hooks/threshold-ratchet-families.mjs

@@ -48,11 +48,6 @@ export const FAMILIES = [
     match: /(^|\/)\.github\/k6\/thresholds\/[^/]+\.json$/,
     kind: "k6",
   },
-  {
-    id: "audit-ignore",
-    match: /(^|\/)audit\.ignore\.(config|local)\.json$/,
-    kind: "exemption-list",
-  },
   {
     id: "lisa-config",
     match: /(^|\/)\.lisa\.config\.json$/,
@@ -251,35 +246,6 @@ export function extractK6Constraints(conf) {
   return { numeric, booleans };
 }
 
-/**
- * Flatten an exemption file (audit ignore list) into a set of entry tokens.
- * Arrays contribute their string items; objects contribute their keys.
- * @param {unknown} conf Parsed JSON
- * @returns {Set<string>} One token per exemption entry
- */
-export function extractExemptionEntries(conf) {
-  const out = new Set();
-  if (Array.isArray(conf)) {
-    for (const item of conf) {
-      if (typeof item === "string") out.add(item);
-      else if (item && typeof item === "object") out.add(JSON.stringify(item));
-    }
-  } else if (conf && typeof conf === "object") {
-    for (const [key, value] of Object.entries(conf)) {
-      if (Array.isArray(value)) {
-        for (const item of value) {
-          out.add(
-            `${key}:${typeof item === "string" ? item : JSON.stringify(item)}`
-          );
-        }
-      } else {
-        out.add(key);
-      }
-    }
-  }
-  return out;
-}
-
 /**
  * Extract thresholdRatchet.allow entries from parsed .lisa.config.json.
  * @param {unknown} config Parsed config (may be undefined)

package/plugins/lisa-copilot/hooks/threshold-ratchet.mjs

@@ -12,8 +12,11 @@
  * Tier 1 — designed tunables: vitest/jest/simplecov/e2e thresholds
  * (minimums) and eslint/rubocop thresholds (maximums). Tier 2 — stryker's
  * break score and k6 expression bounds. Tier 3 — exemption additions
- * (audit-ignore entries, stryker mutate exclusions, thresholdRatchet.allow
- * entries) which weaken a gate without touching a number.
+ * (stryker mutate exclusions, thresholdRatchet.allow entries) which weaken
+ * a gate without touching a number. Audit ignore lists are deliberately NOT
+ * watched: the security-audit-handling ladder authorizes agents to add
+ * documented entries autonomously, and doctor readiness (B5) audits that
+ * every entry carries a written decision.
  *
  * Human override: `.lisa.config.json` → `thresholdRatchet.allow` entries
  * ({ file, key, reason }). Honored ONLY from the baseline side (HEAD /

package/plugins/lisa-copilot/hooks/threshold-ratchet.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # PostToolUse hook for Edit|Write|NotebookEdit|Bash: the threshold ratchet.
 # Quality thresholds (coverage minimums, complexity maximums, mutation break
-# score, e2e route floors, k6 bounds, audit-ignore lists) may tighten but never
+# score, e2e route floors, k6 bounds) may tighten but never
 # weaken. The deterministic comparator lives in threshold-ratchet.mjs and is
 # shared with the pre-commit (husky/lefthook --staged) and CI (--base) layers,
 # so this hook is fast feedback — not the only line of defense.

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.300.7",
+  "version": "2.300.8",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/hooks/threshold-ratchet-compare.mjs

@@ -8,7 +8,6 @@
  */
 import {
   extractAllowEntries,
-  extractExemptionEntries,
   extractK6Constraints,
   extractNumericLeaves,
   extractRubocopThresholds,
@@ -20,7 +19,7 @@ import {
 
 /** Finding type: a numeric bound or boolean gate moved the weakening way. */
 const TYPE_WEAKENED = "weakened";
-/** Finding type: an exemption entry was added (Tier 3). */
+/** Finding type: a gate-shrinking exemption was added (Tier 3). */
 const TYPE_EXEMPTION_ADDED = "exemption-added";
 /** Family kind for .lisa.config.json (the thresholdRatchet.allow carrier). */
 const KIND_ALLOW_LIST = "allow-list";
@@ -160,29 +159,6 @@ function compareK6(relPath, base, current) {
   return findings;
 }
 
-/**
- * Compare an exemption-list pair (audit ignore files): report added entries.
- * @param {string} relPath Repo-relative path
- * @param {unknown} base Parsed baseline list
- * @param {unknown} current Parsed current list
- * @returns {Finding[]} One finding per newly added ignore entry
- */
-function compareExemptions(relPath, base, current) {
-  const baseEntries = extractExemptionEntries(base);
-  const findings = [];
-  for (const entry of extractExemptionEntries(current)) {
-    if (!baseEntries.has(entry)) {
-      findings.push({
-        file: relPath,
-        key: entry,
-        type: TYPE_EXEMPTION_ADDED,
-        message: `${relPath}: new security-audit ignore entry "${entry}" — ignoring a finding weakens the gate and needs a human's sign-off.`,
-      });
-    }
-  }
-  return findings;
-}
-
 /**
  * Compare .lisa.config.json allow lists: report added exception entries so a
  * change can never grant itself an exception.
@@ -258,8 +234,6 @@ export function compareFile(relPath, baselineText, currentText) {
       return compareStryker(relPath, base, current);
     case "k6":
       return compareK6(relPath, base, current);
-    case "exemption-list":
-      return compareExemptions(relPath, base, current);
     case KIND_ALLOW_LIST:
       return compareAllowList(relPath, base, current);
     default:

package/plugins/lisa-cursor/hooks/threshold-ratchet-families.mjs

@@ -48,11 +48,6 @@ export const FAMILIES = [
     match: /(^|\/)\.github\/k6\/thresholds\/[^/]+\.json$/,
     kind: "k6",
   },
-  {
-    id: "audit-ignore",
-    match: /(^|\/)audit\.ignore\.(config|local)\.json$/,
-    kind: "exemption-list",
-  },
   {
     id: "lisa-config",
     match: /(^|\/)\.lisa\.config\.json$/,
@@ -251,35 +246,6 @@ export function extractK6Constraints(conf) {
   return { numeric, booleans };
 }
 
-/**
- * Flatten an exemption file (audit ignore list) into a set of entry tokens.
- * Arrays contribute their string items; objects contribute their keys.
- * @param {unknown} conf Parsed JSON
- * @returns {Set<string>} One token per exemption entry
- */
-export function extractExemptionEntries(conf) {
-  const out = new Set();
-  if (Array.isArray(conf)) {
-    for (const item of conf) {
-      if (typeof item === "string") out.add(item);
-      else if (item && typeof item === "object") out.add(JSON.stringify(item));
-    }
-  } else if (conf && typeof conf === "object") {
-    for (const [key, value] of Object.entries(conf)) {
-      if (Array.isArray(value)) {
-        for (const item of value) {
-          out.add(
-            `${key}:${typeof item === "string" ? item : JSON.stringify(item)}`
-          );
-        }
-      } else {
-        out.add(key);
-      }
-    }
-  }
-  return out;
-}
-
 /**
  * Extract thresholdRatchet.allow entries from parsed .lisa.config.json.
  * @param {unknown} config Parsed config (may be undefined)

package/plugins/lisa-cursor/hooks/threshold-ratchet.mjs

@@ -12,8 +12,11 @@
  * Tier 1 — designed tunables: vitest/jest/simplecov/e2e thresholds
  * (minimums) and eslint/rubocop thresholds (maximums). Tier 2 — stryker's
  * break score and k6 expression bounds. Tier 3 — exemption additions
- * (audit-ignore entries, stryker mutate exclusions, thresholdRatchet.allow
- * entries) which weaken a gate without touching a number.
+ * (stryker mutate exclusions, thresholdRatchet.allow entries) which weaken
+ * a gate without touching a number. Audit ignore lists are deliberately NOT
+ * watched: the security-audit-handling ladder authorizes agents to add
+ * documented entries autonomously, and doctor readiness (B5) audits that
+ * every entry carries a written decision.
  *
  * Human override: `.lisa.config.json` → `thresholdRatchet.allow` entries
  * ({ file, key, reason }). Honored ONLY from the baseline side (HEAD /

package/plugins/lisa-cursor/hooks/threshold-ratchet.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # PostToolUse hook for Edit|Write|NotebookEdit|Bash: the threshold ratchet.
 # Quality thresholds (coverage minimums, complexity maximums, mutation break
-# score, e2e route floors, k6 bounds, audit-ignore lists) may tighten but never
+# score, e2e route floors, k6 bounds) may tighten but never
 # weaken. The deterministic comparator lives in threshold-ratchet.mjs and is
 # shared with the pre-commit (husky/lefthook --staged) and CI (--base) layers,
 # so this hook is fast feedback — not the only line of defense.

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.300.7",
+  "version": "2.300.8",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.300.7",
+  "version": "2.300.8",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.300.7",
+  "version": "2.300.8",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.300.7",
+  "version": "2.300.8",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.300.7",
+  "version": "2.300.8",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.300.7",
+  "version": "2.300.8",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.300.7",
+  "version": "2.300.8",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.300.7",
+  "version": "2.300.8",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.300.7",
+  "version": "2.300.8",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.300.7",
+  "version": "2.300.8",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.300.7",
+  "version": "2.300.8",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.300.7",
+  "version": "2.300.8",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"