@codyswann/lisa 2.305.4 → 2.305.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/core/upstream-evidence-manifest.js +1 -1
- package/package.json +1 -1
- package/plugins/lisa/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-agy/plugin.json +1 -1
- package/plugins/lisa-cdk/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-cdk/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-cdk-agy/plugin.json +1 -1
- package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-expo/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-expo/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-expo-agy/plugin.json +1 -1
- package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric-agy/plugin.json +1 -1
- package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs-agy/plugin.json +1 -1
- package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw-agy/plugin.json +1 -1
- package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser-agy/plugin.json +1 -1
- package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-rails/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-rails/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-rails-agy/plugin.json +1 -1
- package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript-agy/plugin.json +1 -1
- package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki-agy/plugin.json +1 -1
- package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json +1 -1
- package/ui/index.html +201 -7
|
@@ -1044,7 +1044,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
|
|
|
1044
1044
|
"typescript/merge/.oxlintrc.json": "4debc093acfd263eb81ae15894073ebf098513204f45f40b83fb8fa5353fa1f8",
|
|
1045
1045
|
"typescript/package-lisa/package.lisa.json": "bdd1766c2f327290207874b04fd3a577a8188bb57c2fd77d482bb7d6ecf17355",
|
|
1046
1046
|
"ui/README.md": "deeb35e767ea5dd2883268835ea3ad21cbad9fa63ec8d8ff5e200f0e2a7d2751",
|
|
1047
|
-
"ui/index.html": "
|
|
1047
|
+
"ui/index.html": "a7c6efca5ec19cbd193381f8be53dbec92ac1240fe92a5340c9ed384370e4bef",
|
|
1048
1048
|
});
|
|
1049
1049
|
/** Exact paths tracked by the public Lisa repository at generation time. */
|
|
1050
1050
|
export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
|
package/package.json
CHANGED
|
@@ -115,7 +115,7 @@
|
|
|
115
115
|
"brace-expansion": ">=5.0.8"
|
|
116
116
|
},
|
|
117
117
|
"name": "@codyswann/lisa",
|
|
118
|
-
"version": "2.305.
|
|
118
|
+
"version": "2.305.5",
|
|
119
119
|
"description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
|
|
120
120
|
"main": "dist/index.js",
|
|
121
121
|
"exports": {
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.305.
|
|
3
|
+
"version": "2.305.5",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.305.
|
|
3
|
+
"version": "2.305.5",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.305.
|
|
3
|
+
"version": "2.305.5",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.305.
|
|
3
|
+
"version": "2.305.5",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.305.
|
|
3
|
+
"version": "2.305.5",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
package/ui/index.html
CHANGED
|
@@ -5227,7 +5227,7 @@
|
|
|
5227
5227
|
],
|
|
5228
5228
|
},
|
|
5229
5229
|
{
|
|
5230
|
-
label: "The agent's program (AC8.2–8.3 · AC4.5)",
|
|
5230
|
+
label: "The agent's program (AC8.2–8.3 · AC4.5 · P9–P10)",
|
|
5231
5231
|
note: "Prompts, skills and models are the factory's own source code and runtime. This group asks whether that layer is under change control — or improvised per run.",
|
|
5232
5232
|
items: [
|
|
5233
5233
|
{
|
|
@@ -5270,6 +5270,24 @@
|
|
|
5270
5270
|
"None",
|
|
5271
5271
|
],
|
|
5272
5272
|
},
|
|
5273
|
+
{
|
|
5274
|
+
q: "Do agent-program and model qualifications report repeated-run distributions?",
|
|
5275
|
+
help: "TASC P9, P10, AC8.2 and AC8.3. A single lucky run does not qualify a prompt, model or effort-level change. The evidence names the condition tested, number of repetitions, and distribution of outcomes.",
|
|
5276
|
+
kind: "select",
|
|
5277
|
+
options: [
|
|
5278
|
+
"Repeated runs — distribution reported",
|
|
5279
|
+
"Some repeats, summarized informally",
|
|
5280
|
+
"One passing run",
|
|
5281
|
+
"Vendor benchmark only",
|
|
5282
|
+
],
|
|
5283
|
+
via: [
|
|
5284
|
+
"Evaluation harness",
|
|
5285
|
+
"Canary work items",
|
|
5286
|
+
"Golden task suite",
|
|
5287
|
+
"In-house analysis",
|
|
5288
|
+
"None",
|
|
5289
|
+
],
|
|
5290
|
+
},
|
|
5273
5291
|
{
|
|
5274
5292
|
q: "When an agent makes a mistake, what stops the next agent repeating it?",
|
|
5275
5293
|
help: "TASC AC4.5 — the self-learning loop. Mistakes and drift are captured with provenance, pass a skeptical gate, and get promoted upstream into lint rules, hooks, gates and skills. A lesson that stays prose is one the next agent never reads; recurrence of a captured mistake means the loop failed.",
|
|
@@ -5366,7 +5384,7 @@
|
|
|
5366
5384
|
],
|
|
5367
5385
|
},
|
|
5368
5386
|
{
|
|
5369
|
-
label: "Correctness gates (SI1–SI3 · SI8 · AC5.4)",
|
|
5387
|
+
label: "Correctness gates (SI1–SI3 · SI8–SI9 · AC5.4)",
|
|
5370
5388
|
items: [
|
|
5371
5389
|
{
|
|
5372
5390
|
q: "Is unit behaviour proven on every change?",
|
|
@@ -5419,6 +5437,23 @@
|
|
|
5419
5437
|
options: ["Yes — gates merges", "Yes — nightly only", "No"],
|
|
5420
5438
|
value: "Yes — nightly only",
|
|
5421
5439
|
},
|
|
5440
|
+
{
|
|
5441
|
+
q: "Do escaped defects become replayable efficacy tests?",
|
|
5442
|
+
help: "TASC SI3. A production failure that disappears into a fix note does not improve the test suite. The defect should replay in automation, or carry an accepted-risk exception explaining why replay is infeasible.",
|
|
5443
|
+
kind: "select",
|
|
5444
|
+
options: [
|
|
5445
|
+
"Always replayed or risk-accepted",
|
|
5446
|
+
"Sometimes replayed",
|
|
5447
|
+
"Fixed without replay",
|
|
5448
|
+
],
|
|
5449
|
+
via: [
|
|
5450
|
+
"Mutation testing",
|
|
5451
|
+
"Regression harness",
|
|
5452
|
+
"Incident replay suite",
|
|
5453
|
+
"In-house",
|
|
5454
|
+
"None",
|
|
5455
|
+
],
|
|
5456
|
+
},
|
|
5422
5457
|
{
|
|
5423
5458
|
q: "Is the system load-tested against SLOs before release?",
|
|
5424
5459
|
help: "TASC SI8. Functional correctness without performance is insufficient — an endpoint returning correct data in 30 seconds fails a 200ms SLO. Stress, spike, or soak per the risk of the change; no service surface is a valid answer.",
|
|
@@ -5441,6 +5476,24 @@
|
|
|
5441
5476
|
"None",
|
|
5442
5477
|
],
|
|
5443
5478
|
},
|
|
5479
|
+
{
|
|
5480
|
+
q: "Are generated tests and synthetic user findings measured before intake?",
|
|
5481
|
+
help: "TASC SI9 and AC4.6. Generative testing is a finding source, not an oracle. Its prompts or seeds, target selection, rejection stage, false-positive rate and regression-promotion path are part of the control.",
|
|
5482
|
+
kind: "select",
|
|
5483
|
+
options: [
|
|
5484
|
+
"Measured source with rejection stage",
|
|
5485
|
+
"Generated findings reviewed ad-hoc",
|
|
5486
|
+
"Generated findings enter intake directly",
|
|
5487
|
+
"No generative testing",
|
|
5488
|
+
],
|
|
5489
|
+
via: [
|
|
5490
|
+
"Property-based tests",
|
|
5491
|
+
"Fuzzing",
|
|
5492
|
+
"Agent exploratory tests",
|
|
5493
|
+
"Synthetic users",
|
|
5494
|
+
"None",
|
|
5495
|
+
],
|
|
5496
|
+
},
|
|
5444
5497
|
{
|
|
5445
5498
|
q: "Can a quality threshold be quietly lowered?",
|
|
5446
5499
|
help: "The ratchet: thresholds may only tighten, and loosening one requires its own reviewed change. A bar anyone can edit downward in passing is a suggestion, not a bar — and an agent under pressure to go green will find it.",
|
|
@@ -5550,7 +5603,7 @@
|
|
|
5550
5603
|
],
|
|
5551
5604
|
},
|
|
5552
5605
|
{
|
|
5553
|
-
label: "Agent attack surface (AC3)",
|
|
5606
|
+
label: "Agent attack surface (AC3 · §7)",
|
|
5554
5607
|
note: "The group above secures the code; this one secures the agent. Inbound, the risk is untrusted content steering it; outbound, exfiltration — which is governed by the egress lock and credential gateway you answered earlier.",
|
|
5555
5608
|
items: [
|
|
5556
5609
|
{
|
|
@@ -5644,6 +5697,16 @@
|
|
|
5644
5697
|
"No persistent memory",
|
|
5645
5698
|
],
|
|
5646
5699
|
},
|
|
5700
|
+
{
|
|
5701
|
+
q: "Does the threat model cover agent misreporting and fabricated evidence?",
|
|
5702
|
+
help: "TASC AC3.1 and §7. The agent can be wrong about what it tested, where it ran, or whether it had access. Evidence fabrication and self-serving harness selection belong in the threat model explicitly.",
|
|
5703
|
+
kind: "select",
|
|
5704
|
+
options: [
|
|
5705
|
+
"Explicit threat class with controls",
|
|
5706
|
+
"Mentioned but not controlled",
|
|
5707
|
+
"Not covered",
|
|
5708
|
+
],
|
|
5709
|
+
},
|
|
5647
5710
|
{
|
|
5648
5711
|
q: "If an agent escapes its sandbox, what can it reach?",
|
|
5649
5712
|
help: "The joint test of everything above: scoped credentials, the egress lock and the gateway together decide whether a compromised runtime is an incident or a catastrophe.",
|
|
@@ -5820,6 +5883,23 @@
|
|
|
5820
5883
|
"Findings are advisory",
|
|
5821
5884
|
],
|
|
5822
5885
|
},
|
|
5886
|
+
{
|
|
5887
|
+
q: "What happens when review capacity is saturated?",
|
|
5888
|
+
help: "TASC AC8.1. A reviewer queue is a control with capacity. The system needs a timeout and escalation path; it must not merge through known unadjudicated findings because the reviewer is backed up.",
|
|
5889
|
+
kind: "select",
|
|
5890
|
+
options: [
|
|
5891
|
+
"Queue limit + timeout + escalation",
|
|
5892
|
+
"Waits indefinitely",
|
|
5893
|
+
"Merges after CI is green",
|
|
5894
|
+
],
|
|
5895
|
+
via: [
|
|
5896
|
+
"CodeRabbit / review bot",
|
|
5897
|
+
"GitHub review rules",
|
|
5898
|
+
"Human review queue",
|
|
5899
|
+
"In-house reviewer",
|
|
5900
|
+
"None",
|
|
5901
|
+
],
|
|
5902
|
+
},
|
|
5823
5903
|
{
|
|
5824
5904
|
q: "When a gate rejects agent output, what happens?",
|
|
5825
5905
|
help: "TASC AC8.1. The published ideal is regenerate-from-spec — a hand-patched artifact has mixed provenance nobody can cleanly attribute. Agents iterating on their own output is the common middle ground; humans quietly patching agent work is the provenance leak.",
|
|
@@ -5855,7 +5935,7 @@
|
|
|
5855
5935
|
],
|
|
5856
5936
|
},
|
|
5857
5937
|
{
|
|
5858
|
-
label: "Ship & rollback (AC8.5 · AC7.2)",
|
|
5938
|
+
label: "Ship & rollback (AC8.5 · AC7.2 · AC4.8)",
|
|
5859
5939
|
note: "Change management — the human-shaped hole. In a human SDLC a person approved the deploy and reverted the bad one; every row here is that person's named replacement.",
|
|
5860
5940
|
items: [
|
|
5861
5941
|
{
|
|
@@ -5916,10 +5996,28 @@
|
|
|
5916
5996
|
"None",
|
|
5917
5997
|
],
|
|
5918
5998
|
},
|
|
5999
|
+
{
|
|
6000
|
+
q: "What evidence promotes a canary or staged rollout?",
|
|
6001
|
+
help: "TASC AC8.5. Promotion should depend on observed production or production-like signals inside declared thresholds, not the deploying agent saying the release looks healthy.",
|
|
6002
|
+
kind: "select",
|
|
6003
|
+
options: [
|
|
6004
|
+
"Observed signals within thresholds",
|
|
6005
|
+
"Manual spot-check",
|
|
6006
|
+
"Agent assertion",
|
|
6007
|
+
"No staged promotion",
|
|
6008
|
+
],
|
|
6009
|
+
via: [
|
|
6010
|
+
"SLO dashboard",
|
|
6011
|
+
"Error budget checks",
|
|
6012
|
+
"Feature flag metrics",
|
|
6013
|
+
"Synthetic monitors",
|
|
6014
|
+
"None",
|
|
6015
|
+
],
|
|
6016
|
+
},
|
|
5919
6017
|
],
|
|
5920
6018
|
},
|
|
5921
6019
|
{
|
|
5922
|
-
label: "Verify & acceptance (SI5–SI6)",
|
|
6020
|
+
label: "Verify & acceptance (SI5–SI6 · §7)",
|
|
5923
6021
|
note: "Processing integrity: green CI proves the tests passed, not that the product works. Something has to use it.",
|
|
5924
6022
|
items: [
|
|
5925
6023
|
{
|
|
@@ -5938,6 +6036,23 @@
|
|
|
5938
6036
|
kind: "select",
|
|
5939
6037
|
options: ["Every PRD, before it closes", "Sometimes", "No"],
|
|
5940
6038
|
},
|
|
6039
|
+
{
|
|
6040
|
+
q: "Who adjudicates evidence produced by the ADS itself?",
|
|
6041
|
+
help: "TASC §7. A video, trace or report from a harness the agent selected or built is asserted evidence until an independent actor confirms it exercised the claimed path.",
|
|
6042
|
+
kind: "select",
|
|
6043
|
+
options: [
|
|
6044
|
+
"Independent actor adjudicates",
|
|
6045
|
+
"Authoring agent self-adjudicates",
|
|
6046
|
+
"No adjudication",
|
|
6047
|
+
],
|
|
6048
|
+
via: [
|
|
6049
|
+
"Separate verifier agent",
|
|
6050
|
+
"CI artifact policy",
|
|
6051
|
+
"Human verifier",
|
|
6052
|
+
"Immutable evidence store",
|
|
6053
|
+
"None",
|
|
6054
|
+
],
|
|
6055
|
+
},
|
|
5941
6056
|
{
|
|
5942
6057
|
q: "Does each passing verification become a regression test?",
|
|
5943
6058
|
help: "Without codifying, UAT proves the present and protects nothing about the future.",
|
|
@@ -5951,7 +6066,7 @@
|
|
|
5951
6066
|
],
|
|
5952
6067
|
},
|
|
5953
6068
|
{
|
|
5954
|
-
label: "Observe (AC4)",
|
|
6069
|
+
label: "Observe (AC4.1 · AC4.3–AC4.7)",
|
|
5955
6070
|
items: [
|
|
5956
6071
|
{
|
|
5957
6072
|
q: "What captures production errors?",
|
|
@@ -5991,6 +6106,40 @@
|
|
|
5991
6106
|
"Dashboards only",
|
|
5992
6107
|
],
|
|
5993
6108
|
},
|
|
6109
|
+
{
|
|
6110
|
+
q: "Do user-reported problems enter the same signal pipeline?",
|
|
6111
|
+
help: "TASC AC4.1 and AC4.4. A user report is a first-class monitoring signal, and disagreement between user pain and quiet telemetry is itself an instrumentation gap.",
|
|
6112
|
+
kind: "select",
|
|
6113
|
+
options: [
|
|
6114
|
+
"Yes — routed through validated intake",
|
|
6115
|
+
"Humans triage separately",
|
|
6116
|
+
"Not connected",
|
|
6117
|
+
],
|
|
6118
|
+
via: [
|
|
6119
|
+
"Support inbox",
|
|
6120
|
+
"GitHub issues",
|
|
6121
|
+
"Zendesk / Intercom",
|
|
6122
|
+
"PostHog feedback",
|
|
6123
|
+
"None",
|
|
6124
|
+
],
|
|
6125
|
+
},
|
|
6126
|
+
{
|
|
6127
|
+
q: "Are finding sources measured for false positives or rejection rate?",
|
|
6128
|
+
help: "TASC AC4.6. A sensor, audit loop, review agent or test generator that files work without a measured rejection stage is an uncalibrated source of churn.",
|
|
6129
|
+
kind: "select",
|
|
6130
|
+
options: [
|
|
6131
|
+
"Measured over a defined window",
|
|
6132
|
+
"Sampled occasionally",
|
|
6133
|
+
"Not measured",
|
|
6134
|
+
],
|
|
6135
|
+
via: [
|
|
6136
|
+
"Triage labels",
|
|
6137
|
+
"Adjudication queue",
|
|
6138
|
+
"Review analytics",
|
|
6139
|
+
"In-house metrics",
|
|
6140
|
+
"None",
|
|
6141
|
+
],
|
|
6142
|
+
},
|
|
5994
6143
|
{
|
|
5995
6144
|
q: "What tells you what users actually do?",
|
|
5996
6145
|
help: "Product analytics is the richest Research input there is — it routes usage patterns back to the Research gate as PRD material.",
|
|
@@ -6004,6 +6153,23 @@
|
|
|
6004
6153
|
"None",
|
|
6005
6154
|
],
|
|
6006
6155
|
},
|
|
6156
|
+
{
|
|
6157
|
+
q: "Are cost and governance metrics reconciled against an independent source?",
|
|
6158
|
+
help: "TASC AC1.6 and AC4.7. Agent-reported spend, autonomy rate, pass rate, false-positive rate and coverage-like numbers need numerator, denominator, window, exclusions and a source-of-record check before they drive decisions.",
|
|
6159
|
+
kind: "select",
|
|
6160
|
+
options: [
|
|
6161
|
+
"Reconciled with source of record",
|
|
6162
|
+
"Metric definition only",
|
|
6163
|
+
"Agent-reported only",
|
|
6164
|
+
],
|
|
6165
|
+
via: [
|
|
6166
|
+
"Provider billing",
|
|
6167
|
+
"Telemetry warehouse",
|
|
6168
|
+
"CI history",
|
|
6169
|
+
"Tracker history",
|
|
6170
|
+
"None",
|
|
6171
|
+
],
|
|
6172
|
+
},
|
|
6007
6173
|
],
|
|
6008
6174
|
},
|
|
6009
6175
|
{
|
|
@@ -6045,6 +6211,23 @@
|
|
|
6045
6211
|
"None",
|
|
6046
6212
|
],
|
|
6047
6213
|
},
|
|
6214
|
+
{
|
|
6215
|
+
q: "Do monitoring findings close on root cause instead of symptom silence?",
|
|
6216
|
+
help: "TASC AC4.8. Closing because the alert stopped is not enough; closure needs a root-cause correction or accepted-risk record, and recurrence after closure is a control failure.",
|
|
6217
|
+
kind: "select",
|
|
6218
|
+
options: [
|
|
6219
|
+
"Root-cause or accepted-risk closure",
|
|
6220
|
+
"Closed when alert clears",
|
|
6221
|
+
"Closed manually without rule",
|
|
6222
|
+
],
|
|
6223
|
+
via: [
|
|
6224
|
+
"Incident review",
|
|
6225
|
+
"Problem-management ticket",
|
|
6226
|
+
"Runbook checklist",
|
|
6227
|
+
"In-house workflow",
|
|
6228
|
+
"None",
|
|
6229
|
+
],
|
|
6230
|
+
},
|
|
6048
6231
|
{
|
|
6049
6232
|
q: "When the pipeline itself cannot proceed, does it escalate?",
|
|
6050
6233
|
help: "The recovery-required outcome: a decision-ready packet naming the broken capability, not a generic failure alert — and never a silent stall.",
|
|
@@ -6086,7 +6269,8 @@
|
|
|
6086
6269
|
],
|
|
6087
6270
|
},
|
|
6088
6271
|
{
|
|
6089
|
-
label:
|
|
6272
|
+
label:
|
|
6273
|
+
"Governance & accountability (AC1.2 · AC1.6 · AC5.6 · AC9.1 · DP)",
|
|
6090
6274
|
note: "The audit-trail cluster: everything a human used to vouch for by being in the room.",
|
|
6091
6275
|
items: [
|
|
6092
6276
|
{
|
|
@@ -6194,6 +6378,16 @@
|
|
|
6194
6378
|
"Not retained",
|
|
6195
6379
|
],
|
|
6196
6380
|
},
|
|
6381
|
+
{
|
|
6382
|
+
q: "Are instruction-level residual risks reviewed before promotion?",
|
|
6383
|
+
help: "TASC AC5.6. A prompt, skill, hook or workflow edit can broaden tool authority, weaken rejection behavior or lower evidence standards. Those residual risks need review and disposition like code risk.",
|
|
6384
|
+
kind: "select",
|
|
6385
|
+
options: [
|
|
6386
|
+
"Reviewed and tracked to disposition",
|
|
6387
|
+
"Mentioned in PR text",
|
|
6388
|
+
"Not reviewed",
|
|
6389
|
+
],
|
|
6390
|
+
},
|
|
6197
6391
|
],
|
|
6198
6392
|
},
|
|
6199
6393
|
],
|