@codyswann/lisa 2.300.7 → 2.300.9

package/dist/cli/doctor-readiness-domain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-readiness-domain.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-domain.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EACL,KAAK,cAAc,EAIpB,MAAM,iCAAiC,CAAC;AAEzC,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,qBAAqB,CAAC;AAqMhE;;;;;;;;;;GAUG;AACH,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,MAAM,EACZ,eAAe,CAAC,EAAE,SAAS,cAAc,EAAE,GAC1C,OAAO,CAAC,wBAAwB,CAAC,CA0BnC"}
+{"version":3,"file":"doctor-readiness-domain.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-domain.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EACL,KAAK,cAAc,EAIpB,MAAM,iCAAiC,CAAC;AAEzC,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,qBAAqB,CAAC;AAuNhE;;;;;;;;;;GAUG;AACH,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,MAAM,EACZ,eAAe,CAAC,EAAE,SAAS,cAAc,EAAE,GAC1C,OAAO,CAAC,wBAAwB,CAAC,CA2BnC"}

package/dist/cli/doctor-readiness-domain.js

@@ -35,6 +35,11 @@ export const DOMAIN_OWNERSHIP_DIMENSION_ID = "domain-ownership";
 const DOMAIN_BLOCKER_ID = "B1";
 /** Most destructive commands quoted in one finding before summarizing. */
 const MAX_EVIDENCE_COMMANDS = 10;
+/** Shared tail for SKIP reasons that cannot establish domain ownership offline. */
+const DOMAIN_OWNERSHIP_OFFLINE_TAIL = "Whether this repository's business rules, glossary, and danger zones are " +
+    "genuinely owned and written down cannot be established by reading files " +
+    "offline — that needs the agent-ready domain phase — so domain ownership is " +
+    "not established either way.";
 /**
  * Commands that irreversibly destroy stored data. Every entry is a whole
  * operation, not a keyword: `rm -rf` is deliberately absent because build
@@ -139,27 +144,27 @@ function domainFinding(scan) {
  * operator can tell "nothing to report" from "never looked".
  * @param inspected - How many workflow files were read
  * @param runbook - Whether a runbook is checked in
+ * @param recoverableDestructiveOps - Ungated destructive commands cleared by a runbook
  * @returns The SKIP reason
  */
-function skipReason(inspected, runbook) {
+function skipReason(inspected, runbook, recoverableDestructiveOps) {
     if (inspected === 0) {
         return ("No GitHub Actions workflow files were found under `.github/workflows/`, " +
             "so no irreversible data-destroying operations could be assessed from " +
             "workflow declarations (recovery runbook " +
-            `${runbook ? "present" : "absent"}). Whether this ` +
-            "repository's business rules, glossary, and danger zones are genuinely " +
-            "owned and written down cannot be established by reading files offline — " +
-            "that needs the agent-ready domain phase — so domain ownership is not " +
-            "established either way.");
+            `${runbook ? "present" : "absent"}). ${DOMAIN_OWNERSHIP_OFFLINE_TAIL}`);
+    }
+    if (runbook && recoverableDestructiveOps > 0) {
+        return (`Read ${inspected} workflow file(s) and found ` +
+            `${recoverableDestructiveOps} irreversible data-destroying operation(s) ` +
+            "that this file alone proves can run unattended and ungated, but the " +
+            "repository checks in a recovery runbook, so the no-way-back half of B1 " +
+            `is not established (recovery runbook present). ${DOMAIN_OWNERSHIP_OFFLINE_TAIL}`);
     }
     return (`Read ${inspected} workflow file(s) for irreversible data-destroying ` +
         "operations and found none that this file alone proves runs unattended, " +
         `ungated, and with no way back (recovery runbook ` +
-        `${runbook ? "present" : "absent"}). Whether this ` +
-        "repository's business rules, glossary, and danger zones are genuinely " +
-        "owned and written down cannot be established by reading files offline — " +
-        "that needs the agent-ready domain phase — so domain ownership is not " +
-        "established either way.");
+        `${runbook ? "present" : "absent"}). ${DOMAIN_OWNERSHIP_OFFLINE_TAIL}`);
 }
 /**
  * Build the SKIP record, carrying every guarded destructive operation as an
@@ -169,14 +174,18 @@ function skipReason(inspected, runbook) {
  * @param scan - The destructive-operation scan
  * @param inspected - How many workflow files were read
  * @param runbook - Whether a runbook is checked in
+ * @param recoverableDestructiveOps - Ungated destructive commands cleared by a runbook
  * @returns The SKIP dimension record
  */
-function skipRecord(guarded, scan, inspected, runbook) {
+function skipRecord(guarded, scan, inspected, runbook, recoverableDestructiveOps = 0) {
     return {
         id: DOMAIN_OWNERSHIP_DIMENSION_ID,
         status: "SKIP",
         findings: [
-            { reason: skipReason(inspected, runbook), skip: true },
+            {
+                reason: skipReason(inspected, runbook, recoverableDestructiveOps),
+                skip: true,
+            },
             ...informationalFindings([
                 ...guarded.map(entry => `\`${entry.workflow}\` job \`${entry.jobId}\` runs a destructive ` +
                     `operation (\`${entry.command}\`) behind a gate, beside its own ` +
@@ -208,7 +217,7 @@ export async function assessDomainOwnershipDimension(root, parsedWorkflows) {
     // B1 for the whole repository — the blocker asks for BOTH halves at once.
     const recoverable = await hasCheckedInRunbook(root);
     if (scan.ungated.length === 0 || recoverable) {
-        return skipRecord(recoverable ? [...scan.gated, ...scan.ungated] : scan.gated, scan, workflows.length, recoverable);
+        return skipRecord(recoverable ? [...scan.gated, ...scan.ungated] : scan.gated, scan, workflows.length, recoverable, recoverable ? scan.ungated.length : 0);
     }
     return {
         id: DOMAIN_OWNERSHIP_DIMENSION_ID,

package/dist/cli/doctor-readiness-domain.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-readiness-domain.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EAEd,YAAY,GAEb,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAGL,wBAAwB,GAEzB,MAAM,iCAAiC,CAAC;AAEzC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAEhE,0EAA0E;AAC1E,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,0EAA0E;AAC1E,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,qBAAqB,GAAsB;IAC/C,6BAA6B;IAC7B,6CAA6C;IAC7C,kCAAkC;IAClC,wCAAwC;IACxC,uCAAuC;IACvC,yBAAyB;IACzB,+CAA+C;IAC/C,sBAAsB;IACtB,oBAAoB;IACpB,mBAAmB;IACnB,sBAAsB;IACtB,sCAAsC;IACtC,kCAAkC;IAClC,mCAAmC;IACnC,2EAA2E;CAC5E,CAAC;AAEF,8EAA8E;AAC9E,MAAM,iBAAiB,GAAsB;IAC3C,aAAa;IACb,eAAe;IACf,YAAY;IACZ,cAAc;IACd,qBAAqB;CACtB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,SAAS,YAAY,CACnB,OAAe,EACf,GAAsB,EACtB,IAAwB;IAExB,OAAO,CACL,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5D,CAAC,cAAc,CAAC,GAAG,OAAO,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC,CACvD,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CACvB,SAAyB,EACzB,GAAsB,EACtB,IAAwB;IAExB,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,SAAS,GAAG,CAAC,EAAE,8DAA8D;QAC7E,+BAA+B,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB;QAC7E,yEAAyE;QACzE,oCAAoC,CACrC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,GAAsB;IAC5C,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3B,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CACxE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAmB;IACxC,OAAO;QACL,OAAO,EAAE,iBAAiB;QAC1B,kBAAkB,EAChB,yEAAyE;YACzE,wBAAwB;QAC1B,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC;QAC/D,gBAAgB,EACd,0EAA0E;YAC1E,sEAAsE;YACtE,gDAAgD;QAClD,eAAe,EACb,uEAAuE;YACvE,uEAAuE;YACvE,gEAAgE;QAClE,mBAAmB,EAAE;YACnB,wEAAwE;gBACtE,wDAAwD;SAC3D;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,SAAiB,EAAE,OAAgB;IACrD,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,CACL,0EAA0E;YAC1E,uEAAuE;YACvE,0CAA0C;YAC1C,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,kBAAkB;YACnD,wEAAwE;YACxE,0EAA0E;YAC1E,uEAAuE;YACvE,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IACD,OAAO,CACL,QAAQ,SAAS,qDAAqD;QACtE,yEAAyE;QACzE,kDAAkD;QAClD,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,kBAAkB;QACnD,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,yBAAyB,CAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,UAAU,CACjB,OAAkC,EAClC,IAAmB,EACnB,SAAiB,EACjB,OAAgB;IAEhB,OAAO;QACL,EAAE,EAAE,6BAA6B;QACjC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR,EAAE,MAAM,EAAE,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YACtD,GAAG,qBAAqB,CAAC;gBACvB,GAAG,OAAO,CAAC,GAAG,CACZ,KAAK,CAAC,EAAE,CACN,KAAK,KAAK,CAAC,QAAQ,YAAY,KAAK,CAAC,KAAK,wBAAwB;oBAClE,gBAAgB,KAAK,CAAC,OAAO,oCAAoC;oBACjE,mEAAmE;oBACnE,+CAA+C,CAClD;gBACD,GAAG,IAAI,CAAC,UAAU;aACnB,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,IAAY,EACZ,eAA2C;IAE3C,MAAM,SAAS,GACb,eAAe,IAAI,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,YAAY,EAAE;QACjD,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,gBAAgB;KACjC,CAAC,CAAC;IACH,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC;QAC7C,OAAO,UAAU,CACf,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAC3D,IAAI,EACJ,SAAS,CAAC,MAAM,EAChB,WAAW,CACZ,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,6BAA6B;QACjC,4EAA4E;QAC5E,yEAAyE;QACzE,6EAA6E;QAC7E,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;KAC3E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"doctor-readiness-domain.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EAEd,YAAY,GAEb,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAGL,wBAAwB,GAEzB,MAAM,iCAAiC,CAAC;AAEzC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAEhE,0EAA0E;AAC1E,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,0EAA0E;AAC1E,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC,mFAAmF;AACnF,MAAM,6BAA6B,GACjC,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,6BAA6B,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,qBAAqB,GAAsB;IAC/C,6BAA6B;IAC7B,6CAA6C;IAC7C,kCAAkC;IAClC,wCAAwC;IACxC,uCAAuC;IACvC,yBAAyB;IACzB,+CAA+C;IAC/C,sBAAsB;IACtB,oBAAoB;IACpB,mBAAmB;IACnB,sBAAsB;IACtB,sCAAsC;IACtC,kCAAkC;IAClC,mCAAmC;IACnC,2EAA2E;CAC5E,CAAC;AAEF,8EAA8E;AAC9E,MAAM,iBAAiB,GAAsB;IAC3C,aAAa;IACb,eAAe;IACf,YAAY;IACZ,cAAc;IACd,qBAAqB;CACtB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,SAAS,YAAY,CACnB,OAAe,EACf,GAAsB,EACtB,IAAwB;IAExB,OAAO,CACL,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5D,CAAC,cAAc,CAAC,GAAG,OAAO,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC,CACvD,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CACvB,SAAyB,EACzB,GAAsB,EACtB,IAAwB;IAExB,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,SAAS,GAAG,CAAC,EAAE,8DAA8D;QAC7E,+BAA+B,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB;QAC7E,yEAAyE;QACzE,oCAAoC,CACrC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,GAAsB;IAC5C,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3B,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CACxE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAmB;IACxC,OAAO;QACL,OAAO,EAAE,iBAAiB;QAC1B,kBAAkB,EAChB,yEAAyE;YACzE,wBAAwB;QAC1B,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC;QAC/D,gBAAgB,EACd,0EAA0E;YAC1E,sEAAsE;YACtE,gDAAgD;QAClD,eAAe,EACb,uEAAuE;YACvE,uEAAuE;YACvE,gEAAgE;QAClE,mBAAmB,EAAE;YACnB,wEAAwE;gBACtE,wDAAwD;SAC3D;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CACjB,SAAiB,EACjB,OAAgB,EAChB,yBAAiC;IAEjC,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,CACL,0EAA0E;YAC1E,uEAAuE;YACvE,0CAA0C;YAC1C,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,MAAM,6BAA6B,EAAE,CACvE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,IAAI,yBAAyB,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,CACL,QAAQ,SAAS,8BAA8B;YAC/C,GAAG,yBAAyB,6CAA6C;YACzE,sEAAsE;YACtE,yEAAyE;YACzE,kDAAkD,6BAA6B,EAAE,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,CACL,QAAQ,SAAS,qDAAqD;QACtE,yEAAyE;QACzE,kDAAkD;QAClD,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,MAAM,6BAA6B,EAAE,CACvE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,UAAU,CACjB,OAAkC,EAClC,IAAmB,EACnB,SAAiB,EACjB,OAAgB,EAChB,yBAAyB,GAAG,CAAC;IAE7B,OAAO;QACL,EAAE,EAAE,6BAA6B;QACjC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,MAAM,EAAE,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,yBAAyB,CAAC;gBACjE,IAAI,EAAE,IAAI;aACX;YACD,GAAG,qBAAqB,CAAC;gBACvB,GAAG,OAAO,CAAC,GAAG,CACZ,KAAK,CAAC,EAAE,CACN,KAAK,KAAK,CAAC,QAAQ,YAAY,KAAK,CAAC,KAAK,wBAAwB;oBAClE,gBAAgB,KAAK,CAAC,OAAO,oCAAoC;oBACjE,mEAAmE;oBACnE,+CAA+C,CAClD;gBACD,GAAG,IAAI,CAAC,UAAU;aACnB,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,IAAY,EACZ,eAA2C;IAE3C,MAAM,SAAS,GACb,eAAe,IAAI,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,YAAY,EAAE;QACjD,SAAS,EAAE,cAAc;QACzB,cAAc,EAAE,gBAAgB;KACjC,CAAC,CAAC;IACH,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC;QAC7C,OAAO,UAAU,CACf,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAC3D,IAAI,EACJ,SAAS,CAAC,MAAM,EAChB,WAAW,EACX,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CACtC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,6BAA6B;QACjC,4EAA4E;QAC5E,yEAAyE;QACzE,6EAA6E;QAC7E,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;KAC3E,CAAC;AACJ,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -299,10 +299,10 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/hooks/parity-safety-net.sh": "062c69eea85157f1e941ec3626d8912aa9f182af6ccdbe19687588a6074db5ce",
     "plugins/src/base/hooks/setup-jira-cli.sh": "a675f6b17ce7f0d6b9fb7daeba6d2bc59bcb48ef79b034076ea73b2b1e72ee09",
     "plugins/src/base/hooks/shell-write-nudge.sh": "69839af423f8792b1e52c71097316c3264425553031627c0a2f9409a9d5becd0",
-    "plugins/src/base/hooks/threshold-ratchet-compare.mjs": "8bc4b379d7057b2fecf9cb35820c39efad0a65df7df49073786f996cc2a74810",
-    "plugins/src/base/hooks/threshold-ratchet-families.mjs": "fee19c88c89eed5a2949dea42c4a4c794f04aabf0e36c71cdda70ffaaf2b17c9",
-    "plugins/src/base/hooks/threshold-ratchet.mjs": "6da00221189ed0f8a2938f15e02bcc2633d44f5f05489979fbb94202bc45a6d4",
-    "plugins/src/base/hooks/threshold-ratchet.sh": "6186849d72eb98a73fc574e6c8e3773288e2aeadc7a30e07b21b9ab51de6e9f5",
+    "plugins/src/base/hooks/threshold-ratchet-compare.mjs": "4535a145c5c5cbee13bdf970bc91d390a264043604e607288cdd6bf28de56192",
+    "plugins/src/base/hooks/threshold-ratchet-families.mjs": "db14245ed89b483912af287bdee917a7a921dc21bb29b49be37fc799c05c413f",
+    "plugins/src/base/hooks/threshold-ratchet.mjs": "04f660131bf50864239eb09cbf4d9555e53921254f6ab45ff2b85c173e160901",
+    "plugins/src/base/hooks/threshold-ratchet.sh": "b86f4d0b554e44fd119ad8a8920cd0ba6c9dbe779f7ee219d381cf0629453990",
     "plugins/src/base/hooks/ticket-sync-reminder.sh": "212f80bcdfd9e3ec2254987c5a7186d1d2d38065b330ddcdc631f76df7c4a6c0",
     "plugins/src/base/hooks/track-plan-sessions.sh": "8bc47dcad3aed628df0c9efbe7b6f3df87635b94b0c54c71e0bd52eceace563a",
     "plugins/src/base/rules/eager/automation-runbook-contract.md": "b9b4f4d82b366959e90451a2b425ac116953ac074ab6a192dc3909ec8a2be1d6",
@@ -884,10 +884,10 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "rails/copy-overwrite/ast-grep/utils/.gitkeep": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
     "rails/copy-overwrite/config/initializers/version.rb": "fa664a84f407877b5ddbd3709a2352b30e4dc6fbce538a8503bad6c52448dc86",
     "rails/copy-overwrite/lefthook.yml": "28bb382b9171a04fb92ebafc1f1522b8639f5edc4fcffcc6940e7fba3460fb4e",
-    "rails/copy-overwrite/scripts/check-threshold-ratchet.mjs": "6da00221189ed0f8a2938f15e02bcc2633d44f5f05489979fbb94202bc45a6d4",
+    "rails/copy-overwrite/scripts/check-threshold-ratchet.mjs": "04f660131bf50864239eb09cbf4d9555e53921254f6ab45ff2b85c173e160901",
     "rails/copy-overwrite/scripts/lisa-clean-git-env.sh": "e7121a0ee9e1bf7c01cd2ab55f563dd6d9ab75990739bb6ddf571a513efa10e9",
-    "rails/copy-overwrite/scripts/threshold-ratchet-compare.mjs": "8bc4b379d7057b2fecf9cb35820c39efad0a65df7df49073786f996cc2a74810",
-    "rails/copy-overwrite/scripts/threshold-ratchet-families.mjs": "fee19c88c89eed5a2949dea42c4a4c794f04aabf0e36c71cdda70ffaaf2b17c9",
+    "rails/copy-overwrite/scripts/threshold-ratchet-compare.mjs": "4535a145c5c5cbee13bdf970bc91d390a264043604e607288cdd6bf28de56192",
+    "rails/copy-overwrite/scripts/threshold-ratchet-families.mjs": "db14245ed89b483912af287bdee917a7a921dc21bb29b49be37fc799c05c413f",
     "rails/copy-overwrite/sgconfig.yml": "0ffe058c791d4d323f98104cf78c763bb0356d88739042060ceb86b6b1cb78d7",
     "rails/create-only/.github/workflows/ci.yml": "599805266a47b5c0039145a11df225d4db6c59d35b2ecc582a44d55ab7f4b1f0",
     "rails/create-only/.github/workflows/claude-code-review-response.yml": "bfbe3127c4941c35886d324d439ae0302fbccd74a11cb4decf05a21195efa0e9",
@@ -1003,11 +1003,11 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "typescript/copy-overwrite/eslint.ignore.config.json": "54739e51ce09c314fe01d8a3919e6db5d48cbfb63dcba957f8aca6eba6229a9b",
     "typescript/copy-overwrite/eslint.slow.config.ts": "f66d04381940936544931d7f20ffd4e43c38b8a907d56ffa101e2236371d8c94",
     "typescript/copy-overwrite/knip.json": "6eb93d705a2d645332fbae1dd42cf2d48f85978ebc265451a53790912f277d12",
-    "typescript/copy-overwrite/scripts/check-threshold-ratchet.mjs": "6da00221189ed0f8a2938f15e02bcc2633d44f5f05489979fbb94202bc45a6d4",
+    "typescript/copy-overwrite/scripts/check-threshold-ratchet.mjs": "04f660131bf50864239eb09cbf4d9555e53921254f6ab45ff2b85c173e160901",
     "typescript/copy-overwrite/scripts/check-verification-coverage.mjs": "3c1d27d0668fc66a18cb014f2b607878f0a88c178a773fbe964b8e46b19e86d6",
     "typescript/copy-overwrite/scripts/lisa-mutation.mjs": "7d8d24dea151ef2178807046e97aea7ebfadd9c88eb50347feb7bb4bb190227d",
-    "typescript/copy-overwrite/scripts/threshold-ratchet-compare.mjs": "8bc4b379d7057b2fecf9cb35820c39efad0a65df7df49073786f996cc2a74810",
-    "typescript/copy-overwrite/scripts/threshold-ratchet-families.mjs": "fee19c88c89eed5a2949dea42c4a4c794f04aabf0e36c71cdda70ffaaf2b17c9",
+    "typescript/copy-overwrite/scripts/threshold-ratchet-compare.mjs": "4535a145c5c5cbee13bdf970bc91d390a264043604e607288cdd6bf28de56192",
+    "typescript/copy-overwrite/scripts/threshold-ratchet-families.mjs": "db14245ed89b483912af287bdee917a7a921dc21bb29b49be37fc799c05c413f",
     "typescript/copy-overwrite/sgconfig.yml": "0ffe058c791d4d323f98104cf78c763bb0356d88739042060ceb86b6b1cb78d7",
     "typescript/copy-overwrite/tsconfig.eslint.json": "8a8ae5e201b18887b8eeda5eb569747221695524d4193ea03b4338b97b7fa642",
     "typescript/copy-overwrite/tsconfig.json": "8f4257fcd2cfd4b23e83e0fdd4908d41ee8f1ae75bb95d632e653a0ac13d58e4",

package/package.json

@@ -115,7 +115,7 @@
     "brace-expansion": ">=5.0.8"
   },
   "name": "@codyswann/lisa",
-  "version": "2.300.7",
+  "version": "2.300.9",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.300.7",
+  "version": "2.300.9",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.300.7",
+  "version": "2.300.9",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/threshold-ratchet-compare.mjs

@@ -8,7 +8,6 @@
  */
 import {
   extractAllowEntries,
-  extractExemptionEntries,
   extractK6Constraints,
   extractNumericLeaves,
   extractRubocopThresholds,
@@ -20,7 +19,7 @@ import {
 
 /** Finding type: a numeric bound or boolean gate moved the weakening way. */
 const TYPE_WEAKENED = "weakened";
-/** Finding type: an exemption entry was added (Tier 3). */
+/** Finding type: a gate-shrinking exemption was added (Tier 3). */
 const TYPE_EXEMPTION_ADDED = "exemption-added";
 /** Family kind for .lisa.config.json (the thresholdRatchet.allow carrier). */
 const KIND_ALLOW_LIST = "allow-list";
@@ -160,29 +159,6 @@ function compareK6(relPath, base, current) {
   return findings;
 }
 
-/**
- * Compare an exemption-list pair (audit ignore files): report added entries.
- * @param {string} relPath Repo-relative path
- * @param {unknown} base Parsed baseline list
- * @param {unknown} current Parsed current list
- * @returns {Finding[]} One finding per newly added ignore entry
- */
-function compareExemptions(relPath, base, current) {
-  const baseEntries = extractExemptionEntries(base);
-  const findings = [];
-  for (const entry of extractExemptionEntries(current)) {
-    if (!baseEntries.has(entry)) {
-      findings.push({
-        file: relPath,
-        key: entry,
-        type: TYPE_EXEMPTION_ADDED,
-        message: `${relPath}: new security-audit ignore entry "${entry}" — ignoring a finding weakens the gate and needs a human's sign-off.`,
-      });
-    }
-  }
-  return findings;
-}
-
 /**
  * Compare .lisa.config.json allow lists: report added exception entries so a
  * change can never grant itself an exception.
@@ -258,8 +234,6 @@ export function compareFile(relPath, baselineText, currentText) {
       return compareStryker(relPath, base, current);
     case "k6":
       return compareK6(relPath, base, current);
-    case "exemption-list":
-      return compareExemptions(relPath, base, current);
     case KIND_ALLOW_LIST:
       return compareAllowList(relPath, base, current);
     default:

package/plugins/lisa/hooks/threshold-ratchet-families.mjs

@@ -48,11 +48,6 @@ export const FAMILIES = [
     match: /(^|\/)\.github\/k6\/thresholds\/[^/]+\.json$/,
     kind: "k6",
   },
-  {
-    id: "audit-ignore",
-    match: /(^|\/)audit\.ignore\.(config|local)\.json$/,
-    kind: "exemption-list",
-  },
   {
     id: "lisa-config",
     match: /(^|\/)\.lisa\.config\.json$/,
@@ -251,35 +246,6 @@ export function extractK6Constraints(conf) {
   return { numeric, booleans };
 }
 
-/**
- * Flatten an exemption file (audit ignore list) into a set of entry tokens.
- * Arrays contribute their string items; objects contribute their keys.
- * @param {unknown} conf Parsed JSON
- * @returns {Set<string>} One token per exemption entry
- */
-export function extractExemptionEntries(conf) {
-  const out = new Set();
-  if (Array.isArray(conf)) {
-    for (const item of conf) {
-      if (typeof item === "string") out.add(item);
-      else if (item && typeof item === "object") out.add(JSON.stringify(item));
-    }
-  } else if (conf && typeof conf === "object") {
-    for (const [key, value] of Object.entries(conf)) {
-      if (Array.isArray(value)) {
-        for (const item of value) {
-          out.add(
-            `${key}:${typeof item === "string" ? item : JSON.stringify(item)}`
-          );
-        }
-      } else {
-        out.add(key);
-      }
-    }
-  }
-  return out;
-}
-
 /**
  * Extract thresholdRatchet.allow entries from parsed .lisa.config.json.
  * @param {unknown} config Parsed config (may be undefined)

package/plugins/lisa/hooks/threshold-ratchet.mjs

@@ -12,8 +12,11 @@
  * Tier 1 — designed tunables: vitest/jest/simplecov/e2e thresholds
  * (minimums) and eslint/rubocop thresholds (maximums). Tier 2 — stryker's
  * break score and k6 expression bounds. Tier 3 — exemption additions
- * (audit-ignore entries, stryker mutate exclusions, thresholdRatchet.allow
- * entries) which weaken a gate without touching a number.
+ * (stryker mutate exclusions, thresholdRatchet.allow entries) which weaken
+ * a gate without touching a number. Audit ignore lists are deliberately NOT
+ * watched: the security-audit-handling ladder authorizes agents to add
+ * documented entries autonomously, and doctor readiness (B5) audits that
+ * every entry carries a written decision.
  *
  * Human override: `.lisa.config.json` → `thresholdRatchet.allow` entries
  * ({ file, key, reason }). Honored ONLY from the baseline side (HEAD /

package/plugins/lisa/hooks/threshold-ratchet.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # PostToolUse hook for Edit|Write|NotebookEdit|Bash: the threshold ratchet.
 # Quality thresholds (coverage minimums, complexity maximums, mutation break
-# score, e2e route floors, k6 bounds, audit-ignore lists) may tighten but never
+# score, e2e route floors, k6 bounds) may tighten but never
 # weaken. The deterministic comparator lives in threshold-ratchet.mjs and is
 # shared with the pre-commit (husky/lefthook --staged) and CI (--base) layers,
 # so this hook is fast feedback — not the only line of defense.

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.300.7",
+  "version": "2.300.9",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.300.7",
+  "version": "2.300.9",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.300.7",
+  "version": "2.300.9",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.300.7",
+  "version": "2.300.9",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.300.7",
+  "version": "2.300.9",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.300.7",
+  "version": "2.300.9",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.300.7",
+  "version": "2.300.9",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/threshold-ratchet-compare.mjs

@@ -8,7 +8,6 @@
  */
 import {
   extractAllowEntries,
-  extractExemptionEntries,
   extractK6Constraints,
   extractNumericLeaves,
   extractRubocopThresholds,
@@ -20,7 +19,7 @@ import {
 
 /** Finding type: a numeric bound or boolean gate moved the weakening way. */
 const TYPE_WEAKENED = "weakened";
-/** Finding type: an exemption entry was added (Tier 3). */
+/** Finding type: a gate-shrinking exemption was added (Tier 3). */
 const TYPE_EXEMPTION_ADDED = "exemption-added";
 /** Family kind for .lisa.config.json (the thresholdRatchet.allow carrier). */
 const KIND_ALLOW_LIST = "allow-list";
@@ -160,29 +159,6 @@ function compareK6(relPath, base, current) {
   return findings;
 }
 
-/**
- * Compare an exemption-list pair (audit ignore files): report added entries.
- * @param {string} relPath Repo-relative path
- * @param {unknown} base Parsed baseline list
- * @param {unknown} current Parsed current list
- * @returns {Finding[]} One finding per newly added ignore entry
- */
-function compareExemptions(relPath, base, current) {
-  const baseEntries = extractExemptionEntries(base);
-  const findings = [];
-  for (const entry of extractExemptionEntries(current)) {
-    if (!baseEntries.has(entry)) {
-      findings.push({
-        file: relPath,
-        key: entry,
-        type: TYPE_EXEMPTION_ADDED,
-        message: `${relPath}: new security-audit ignore entry "${entry}" — ignoring a finding weakens the gate and needs a human's sign-off.`,
-      });
-    }
-  }
-  return findings;
-}
-
 /**
  * Compare .lisa.config.json allow lists: report added exception entries so a
  * change can never grant itself an exception.
@@ -258,8 +234,6 @@ export function compareFile(relPath, baselineText, currentText) {
       return compareStryker(relPath, base, current);
     case "k6":
       return compareK6(relPath, base, current);
-    case "exemption-list":
-      return compareExemptions(relPath, base, current);
     case KIND_ALLOW_LIST:
       return compareAllowList(relPath, base, current);
     default:

package/plugins/lisa-copilot/hooks/threshold-ratchet-families.mjs

@@ -48,11 +48,6 @@ export const FAMILIES = [
     match: /(^|\/)\.github\/k6\/thresholds\/[^/]+\.json$/,
     kind: "k6",
   },
-  {
-    id: "audit-ignore",
-    match: /(^|\/)audit\.ignore\.(config|local)\.json$/,
-    kind: "exemption-list",
-  },
   {
     id: "lisa-config",
     match: /(^|\/)\.lisa\.config\.json$/,
@@ -251,35 +246,6 @@ export function extractK6Constraints(conf) {
   return { numeric, booleans };
 }
 
-/**
- * Flatten an exemption file (audit ignore list) into a set of entry tokens.
- * Arrays contribute their string items; objects contribute their keys.
- * @param {unknown} conf Parsed JSON
- * @returns {Set<string>} One token per exemption entry
- */
-export function extractExemptionEntries(conf) {
-  const out = new Set();
-  if (Array.isArray(conf)) {
-    for (const item of conf) {
-      if (typeof item === "string") out.add(item);
-      else if (item && typeof item === "object") out.add(JSON.stringify(item));
-    }
-  } else if (conf && typeof conf === "object") {
-    for (const [key, value] of Object.entries(conf)) {
-      if (Array.isArray(value)) {
-        for (const item of value) {
-          out.add(
-            `${key}:${typeof item === "string" ? item : JSON.stringify(item)}`
-          );
-        }
-      } else {
-        out.add(key);
-      }
-    }
-  }
-  return out;
-}
-
 /**
  * Extract thresholdRatchet.allow entries from parsed .lisa.config.json.
  * @param {unknown} config Parsed config (may be undefined)

package/plugins/lisa-copilot/hooks/threshold-ratchet.mjs

@@ -12,8 +12,11 @@
  * Tier 1 — designed tunables: vitest/jest/simplecov/e2e thresholds
  * (minimums) and eslint/rubocop thresholds (maximums). Tier 2 — stryker's
  * break score and k6 expression bounds. Tier 3 — exemption additions
- * (audit-ignore entries, stryker mutate exclusions, thresholdRatchet.allow
- * entries) which weaken a gate without touching a number.
+ * (stryker mutate exclusions, thresholdRatchet.allow entries) which weaken
+ * a gate without touching a number. Audit ignore lists are deliberately NOT
+ * watched: the security-audit-handling ladder authorizes agents to add
+ * documented entries autonomously, and doctor readiness (B5) audits that
+ * every entry carries a written decision.
  *
  * Human override: `.lisa.config.json` → `thresholdRatchet.allow` entries
  * ({ file, key, reason }). Honored ONLY from the baseline side (HEAD /

package/plugins/lisa-copilot/hooks/threshold-ratchet.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # PostToolUse hook for Edit|Write|NotebookEdit|Bash: the threshold ratchet.
 # Quality thresholds (coverage minimums, complexity maximums, mutation break
-# score, e2e route floors, k6 bounds, audit-ignore lists) may tighten but never
+# score, e2e route floors, k6 bounds) may tighten but never
 # weaken. The deterministic comparator lives in threshold-ratchet.mjs and is
 # shared with the pre-commit (husky/lefthook --staged) and CI (--base) layers,
 # so this hook is fast feedback — not the only line of defense.

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.300.7",
+  "version": "2.300.9",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/hooks/threshold-ratchet-compare.mjs

@@ -8,7 +8,6 @@
  */
 import {
   extractAllowEntries,
-  extractExemptionEntries,
   extractK6Constraints,
   extractNumericLeaves,
   extractRubocopThresholds,
@@ -20,7 +19,7 @@ import {
 
 /** Finding type: a numeric bound or boolean gate moved the weakening way. */
 const TYPE_WEAKENED = "weakened";
-/** Finding type: an exemption entry was added (Tier 3). */
+/** Finding type: a gate-shrinking exemption was added (Tier 3). */
 const TYPE_EXEMPTION_ADDED = "exemption-added";
 /** Family kind for .lisa.config.json (the thresholdRatchet.allow carrier). */
 const KIND_ALLOW_LIST = "allow-list";
@@ -160,29 +159,6 @@ function compareK6(relPath, base, current) {
   return findings;
 }
 
-/**
- * Compare an exemption-list pair (audit ignore files): report added entries.
- * @param {string} relPath Repo-relative path
- * @param {unknown} base Parsed baseline list
- * @param {unknown} current Parsed current list
- * @returns {Finding[]} One finding per newly added ignore entry
- */
-function compareExemptions(relPath, base, current) {
-  const baseEntries = extractExemptionEntries(base);
-  const findings = [];
-  for (const entry of extractExemptionEntries(current)) {
-    if (!baseEntries.has(entry)) {
-      findings.push({
-        file: relPath,
-        key: entry,
-        type: TYPE_EXEMPTION_ADDED,
-        message: `${relPath}: new security-audit ignore entry "${entry}" — ignoring a finding weakens the gate and needs a human's sign-off.`,
-      });
-    }
-  }
-  return findings;
-}
-
 /**
  * Compare .lisa.config.json allow lists: report added exception entries so a
  * change can never grant itself an exception.
@@ -258,8 +234,6 @@ export function compareFile(relPath, baselineText, currentText) {
       return compareStryker(relPath, base, current);
     case "k6":
       return compareK6(relPath, base, current);
-    case "exemption-list":
-      return compareExemptions(relPath, base, current);
     case KIND_ALLOW_LIST:
       return compareAllowList(relPath, base, current);
     default:

package/plugins/lisa-cursor/hooks/threshold-ratchet-families.mjs

@@ -48,11 +48,6 @@ export const FAMILIES = [
     match: /(^|\/)\.github\/k6\/thresholds\/[^/]+\.json$/,
     kind: "k6",
   },
-  {
-    id: "audit-ignore",
-    match: /(^|\/)audit\.ignore\.(config|local)\.json$/,
-    kind: "exemption-list",
-  },
   {
     id: "lisa-config",
     match: /(^|\/)\.lisa\.config\.json$/,
@@ -251,35 +246,6 @@ export function extractK6Constraints(conf) {
   return { numeric, booleans };
 }
 
-/**
- * Flatten an exemption file (audit ignore list) into a set of entry tokens.
- * Arrays contribute their string items; objects contribute their keys.
- * @param {unknown} conf Parsed JSON
- * @returns {Set<string>} One token per exemption entry
- */
-export function extractExemptionEntries(conf) {
-  const out = new Set();
-  if (Array.isArray(conf)) {
-    for (const item of conf) {
-      if (typeof item === "string") out.add(item);
-      else if (item && typeof item === "object") out.add(JSON.stringify(item));
-    }
-  } else if (conf && typeof conf === "object") {
-    for (const [key, value] of Object.entries(conf)) {
-      if (Array.isArray(value)) {
-        for (const item of value) {
-          out.add(
-            `${key}:${typeof item === "string" ? item : JSON.stringify(item)}`
-          );
-        }
-      } else {
-        out.add(key);
-      }
-    }
-  }
-  return out;
-}
-
 /**
  * Extract thresholdRatchet.allow entries from parsed .lisa.config.json.
  * @param {unknown} config Parsed config (may be undefined)

package/plugins/lisa-cursor/hooks/threshold-ratchet.mjs

@@ -12,8 +12,11 @@
  * Tier 1 — designed tunables: vitest/jest/simplecov/e2e thresholds
  * (minimums) and eslint/rubocop thresholds (maximums). Tier 2 — stryker's
  * break score and k6 expression bounds. Tier 3 — exemption additions
- * (audit-ignore entries, stryker mutate exclusions, thresholdRatchet.allow
- * entries) which weaken a gate without touching a number.
+ * (stryker mutate exclusions, thresholdRatchet.allow entries) which weaken
+ * a gate without touching a number. Audit ignore lists are deliberately NOT
+ * watched: the security-audit-handling ladder authorizes agents to add
+ * documented entries autonomously, and doctor readiness (B5) audits that
+ * every entry carries a written decision.
  *
  * Human override: `.lisa.config.json` → `thresholdRatchet.allow` entries
  * ({ file, key, reason }). Honored ONLY from the baseline side (HEAD /