@codyswann/lisa 2.341.0 → 2.341.2

package/README.md

@@ -69,6 +69,101 @@ native Playwright/Maestro regression authority.
 
 ## Getting started
 
+Setup has three layers, and conflating them is the usual mistake:
+
+```
+vault  →  machine  →  each repo  →  each other surface
+```
+
+Two commands do the machine-and-surface work, and **neither needs a checkout** —
+that matters, because the surfaces most in need of setup are the ones with no
+repository attached.
+
+| Command | Answers | Scope |
+| --- | --- | --- |
+| `workstation` | what binaries does this machine have | once per machine |
+| `environment <surface>` | which tenant, and where do its credentials go | once per machine, and once per other surface |
+
+`environment` runs where Lisa can execute and prints what to paste where it
+cannot:
+
+```
+environment local        prepares this machine
+environment container    an image definition and a run command
+environment claude-web   text for the Claude environment dialog
+environment codex-cloud  text for the Codex environment settings
+```
+
+### 1. The vault, once per tenant
+
+Create the secrets, then a **machine account** granted only the projects agents
+may read — that grant is what scopes every headless session. Annotate a secret's
+note with `tool: <name>` where a CLI is implied (`sonar`, `aws`, `gh`); a session
+with no checkout installs exactly what the notes name, and the whole catalogue
+if they name nothing.
+
+Issue each place its own access token, at the moment you set that place up. One
+token shared across five places makes any compromise a five-place outage, and
+makes every access in the audit log anonymous.
+
+### 2. The machine
+
+```bash
+npx -y @codyswann/lisa@latest workstation --install --provider=bitwarden
+exec $SHELL -l                                   # ~/.local/bin on PATH
+npx -y @codyswann/lisa@latest environment local --tenant=<name>
+```
+
+Node is the only prerequisite. `workstation` is the one entry point that works
+before any agent or repository exists — invoking a *skill* needs an installed
+agent, and Lisa is a devDependency so it needs a clone; both are what this
+creates.
+
+`environment local` prompts for the token, stores it in the OS keychain (a
+`0600` file where there is no keychain), materializes the credentials, and
+installs the per-environment AWS profiles. **Re-run it to rotate** — it is not
+an installer, so it will not reinstall six coding agents to replace one token.
+
+`--tenant` is required because every namespace is a directory: guessing would
+put one tenant's credentials where another tenant's sessions read.
+
+Then authenticate the things that are *you* rather than the machine account —
+`gh auth login`, `aws configure sso`, and each agent's own login.
+
+### 3. Each repository
+
+```bash
+git clone … && cd …
+npx -y @codyswann/lisa@latest apply    # lint, hooks, workflows, agent surfaces
+bun install                            # postinstall installs the agent plugins
+npx -y @codyswann/lisa@latest sync     # then set secrets.namespace
+```
+
+A repository only needs to say *which tenant it belongs to*. The credentials are
+already on the machine.
+
+Brownfield repositories then converge — see below.
+
+### 4. Each other surface
+
+Cloud environments are account-scoped and shared across every repository, so
+this is once per environment rather than once per repository:
+
+```bash
+npx -y @codyswann/lisa@latest environment claude-web --tenant=<name>
+```
+
+Paste what it prints. Give that environment its **own** access token: those
+dialogs store values in plain text, readable by everyone who can use the
+environment.
+
+A repository becomes usable *from* a cloud surface with
+`lisa remote-env --install`, which writes two entrypoints to commit. They are
+inert locally — a container that has just cloned the repository has never seen
+the plugin they came from, so they have to be part of the clone.
+
+---
+
 Install Lisa as a development dependency in each project that uses it:
 
 ```bash

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAwqEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CA6uNjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAwqEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAgvNjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -208,7 +208,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/agents/jira-build-intake.md": "51397c08fe09380f53bd630fb81ff28905a532ea71336a424e944c28a0c2db55",
     "plugins/src/base/agents/learner.md": "50582e72b11eeb6b085845f2e32c31a6dcedd0439ca566bb1cca228dd1a45fee",
     "plugins/src/base/agents/learning-judge.md": "28618c3e20a0f790e4d254a9c8118645774233f19e3042b3cfeddf4ffbaf783a",
-    "plugins/src/base/agents/learnings-synthesizer.md": "186ea8a1baa66443eb73dcefb93aa8a767e3d600618de6359a09a0413f1f52c0",
+    "plugins/src/base/agents/learnings-synthesizer.md": "7926a941d735866683a536a54b23578a7f04252cb662c6bdb4892e655006c65f",
     "plugins/src/base/agents/linear-agent.md": "d55664da47505d702d9bbbb96f9f98930d871acc5fc2972d35e1ae143f2dbde7",
     "plugins/src/base/agents/linear-build-intake.md": "1dbc43b74857a1f6d99394a206a510d95c0875946fa6f4d94f90706cbd29e7b4",
     "plugins/src/base/agents/linear-prd-intake.md": "28c4ee9f2ebbb4f089dd54bb4633063b48ea8099327a0bf2923825d83c3fe07c",
@@ -374,13 +374,13 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/rules/reference/falsifiable-checks.md": "89015d3c21b38de5f6d871ef6d97f64820d0068cf93c5c3ab58927f65741944f",
     "plugins/src/base/rules/reference/history-audit.md": "20a46390f71fadda499c61193d430c3d53df49b55a4cefa50a112f82fa4b05ef",
     "plugins/src/base/rules/reference/integration-access-layer.md": "8b0a0fc0e63492efce79c58a0fc1f112748b17ad59383cfdb9c25300b29a2c8b",
-    "plugins/src/base/rules/reference/intent-routing.md": "cc3f77c7b394645b89e0bf388a0db50544a2986af61d7a5646f4ef278e94d817",
+    "plugins/src/base/rules/reference/intent-routing.md": "a72c40b529efb2f5a52ad0d1f51ae31e9ba3c5fa7eab4e414d1af9862531c6a8",
     "plugins/src/base/rules/reference/leaf-only-lifecycle.md": "3d6d531fdca61a348fa1dd1bdb4c28fe66c85fb955238ef668a78cce4a36a7a1",
     "plugins/src/base/rules/reference/observability-audit.md": "98cf4c849baf0801bd2c46a90e7a072196649d506fbda577cc5c4019d2194551",
     "plugins/src/base/rules/reference/prd-definition-of-ready.md": "041a8f3c9b703b3921acc30fe92acfb9e2ab43da04cf019c102ebca98b2f4ba3",
     "plugins/src/base/rules/reference/prd-lifecycle-rollup.md": "f539e7b43918e173dd7491a139be078815d26098f992cd7fc86cd05878c90b9b",
     "plugins/src/base/rules/reference/pre-flight-autofill.md": "e61b745bb1ddfbe24634246588c13e4e78c25b50817e5e8ff02e1a9681ad1130",
-    "plugins/src/base/rules/reference/project-learnings.md": "0326d553d6cb9b997c6cb865635f72ec8b7d5026565f788f46bff0e912748e85",
+    "plugins/src/base/rules/reference/project-learnings.md": "a51e3317020436e2d0a3a686e82a7d9989dabfa1c1727bac048feca4a7a16dad",
     "plugins/src/base/rules/reference/promotion-contract.md": "472416b82eda5431c8e5467d6093fe9da79efa7eb836e79c77b75ef77ee194a4",
     "plugins/src/base/rules/reference/readiness-rubric.md": "6b09f171166a7fc8e85f6e2deea68f42d89a554767bc91e8eed08d1e08501672",
     "plugins/src/base/rules/reference/rejection-detection.md": "afa1f187feabf4ef275c8d7e085452c76c5276356fe58d67a5360ed420a62873",
@@ -429,8 +429,8 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-confluence-to-tracker/SKILL.md": "373a545a19013306c68625f0b6cb01d9fdf36966f8a0539f63f02adcb70a7f7e",
     "plugins/src/base/skills/lisa-confluence-write-prd/SKILL.md": "29fce0dce5f3d1b9cbe8705c8fc002e5885675e1807cf948b166aef88ddfd73a",
     "plugins/src/base/skills/lisa-cross-pollinate/SKILL.md": "d1d33a149cab2de0d0b4c7ddc6bb2f67f43a097e5f551f642b1cb076747a5a05",
-    "plugins/src/base/skills/lisa-debrief-apply/SKILL.md": "90c5f01994bb0f8e71947e8a2f765ccf9a6aa3da47b8d7b8e2022150ef89c2b2",
-    "plugins/src/base/skills/lisa-debrief/SKILL.md": "47e4cda36b07994ff47ab15fb04a17dd6b0c310ad804f9cae9d69637edaaa72a",
+    "plugins/src/base/skills/lisa-debrief-apply/SKILL.md": "e69dc81bccd44e9c165b021dfb6e250e1b3560f109e49a5559a2f972edfb81da",
+    "plugins/src/base/skills/lisa-debrief/SKILL.md": "71a06d24e290648db45efb77349bd320337dfaa1bd42274b3ea5d86e04019aff",
     "plugins/src/base/skills/lisa-delivery-effectiveness/SKILL.md": "21bc55fa0e86a9694bd22269fd089dbfae0c54c199262f46a4955447acea0f35",
     "plugins/src/base/skills/lisa-detect-tooling/SKILL.md": "4ef9b5004e13beb46cac5ae994c24d91c3715363771e3d89c32b0610408fc887",
     "plugins/src/base/skills/lisa-detect-tooling/scripts/commands.mjs": "e28bd61fdde4a336b56ae3395423026943a5816015719d31d04f0d5a0ab50eec",
@@ -461,7 +461,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-github-write-issue/SKILL.md": "ee54b3d14cc5dd3a68a8c36590102dd02f49334c9493ad52fa8c7f35157073b1",
     "plugins/src/base/skills/lisa-github-write-prd/SKILL.md": "262f8a1bcfad4c5dd4456cfaaf1b71abf9697a0da588966e58ff491acd3c17e8",
     "plugins/src/base/skills/lisa-health/SKILL.md": "dfdb08a863e78bff42671793dcec29cfae0654db18ebf66a4aa77aeb56ddb775",
-    "plugins/src/base/skills/lisa-implement/SKILL.md": "e68a85d24bea73fed811c6f5a131f5503a7f11f3aaaa7a4a7ad27423ca37f373",
+    "plugins/src/base/skills/lisa-implement/SKILL.md": "6ebd3411ecfa6bfab75cdb8e5c45734d44711d1c1f70fce3fa421bf05ccc5ac5",
     "plugins/src/base/skills/lisa-improve-code-complexity/SKILL.md": "24ab5b193b409db6ee6bee981a1c0a48d08991782d7846116ad01658c8bc1ae8",
     "plugins/src/base/skills/lisa-improve-harness/SKILL.md": "bafda5d2f9b86c48cd16bf0015528fdf5891675221d662fdc533aaad66aad669",
     "plugins/src/base/skills/lisa-improve-max-lines-per-function/SKILL.md": "95c875950c9848fdaf520a18b9bbb264e33d7347be10170add768e01d9cd8e52",
@@ -581,7 +581,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-setup-local-env/scripts/local-env.mjs": "bff68aa66d6d4cd7cb9d0e39be691c6daa232edb097f8a601815432a32cca6a6",
     "plugins/src/base/skills/lisa-setup-notion/SKILL.md": "f5a1e9290789fd1c33675168d30461fb24a11c98a433ef777c1f536bc2f905ef",
     "plugins/src/base/skills/lisa-setup-remote-aws/SKILL.md": "80fbf157f9c562c033886c25a99b37356602edd9e61cd2d492f339769ddcf97e",
-    "plugins/src/base/skills/lisa-setup-remote-env/SKILL.md": "79c5572dfa4c5d37b1fcfbc75a38ca7d1d708258cca761ec946fb7070bc727f4",
+    "plugins/src/base/skills/lisa-setup-remote-env/SKILL.md": "7aa1f616440cb262e47881e8b37b701ebd11ad1ea619412aa04c33324770904c",
     "plugins/src/base/skills/lisa-setup-remote-env/assets/session-start.sh": "cb63d08b14ab7aa2d405e6770e0cf7db5d6588ae1dcb924ea6224b026fcff496",
     "plugins/src/base/skills/lisa-setup-remote-env/assets/setup.sh": "c30d98a5645f033fc1d3a723043691b9ad997ae5666df539ff6aa19c563431b2",
     "plugins/src/base/skills/lisa-setup-remote-env/scripts/environment.mjs": "3b9be11691d81a896fc779c37fb6d69e8e7222f95e23f84aa03d4e590f9d9108",
@@ -621,7 +621,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-verification-lifecycle/SKILL.md": "93c5a31e51a7eb7924a2e019660f94d0de60c88247846bb545f291e5d48f5a72",
     "plugins/src/base/skills/lisa-verify-prd/SKILL.md": "fd4dc76c42c1083f5223e650f6c25d53694138860ebcb02588689f6eb6d0b416",
     "plugins/src/base/skills/lisa-verify-workflow-change/SKILL.md": "d89740a4dc350a9ac0d26b1b955bf74f009775b60ee0275df3f9a50fe8be3048",
-    "plugins/src/base/skills/lisa-verify/SKILL.md": "bd97bd5965c05eafff25fcfeabe0fa7e763f96d5dcab8bf959a78679696c33f1",
+    "plugins/src/base/skills/lisa-verify/SKILL.md": "b303be2e2ed31c6a9a85564adbc451d9651fb2283f8c44732f51838c3a56fb8b",
     "plugins/src/base/skills/lisa-wiki-install/SKILL.md": "9689e5080dfdeffcebd230a5c1cb1ae7b173172a060a603634058f91ca71c17b",
     "plugins/src/cdk/commands/setup/aws.md": "b393a8181d783dad43a94510d3206ea7a0d9090bf3f84d595273e64bb40e1d8d",
     "plugins/src/cdk/skills/setup-aws-accounts/SKILL.md": "a2eee104aecc34716137661f6f47c6e18105b3eadae84fddd29cbaf6ed756874",
@@ -7315,6 +7315,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/core/upstream-attribution-file-safety.test.ts": true,
     "tests/unit/core/upstream-attribution-integrity.test.ts": true,
     "tests/unit/detection/detectors.test.ts": true,
+    "tests/unit/docs/onboarding-walkthrough.test.ts": true,
     "tests/unit/governance-contracts.test.ts": true,
     "tests/unit/health/agentic.test.ts": true,
     "tests/unit/health/consumer.test.ts": true,
@@ -7515,6 +7516,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/strategies/copy-contents.test.ts": true,
     "tests/unit/strategies/copy-overwrite.test.ts": true,
     "tests/unit/strategies/create-only.test.ts": true,
+    "tests/unit/strategies/debrief-destination-hints.test.ts": true,
     "tests/unit/strategies/debrief-reroute-contract.test.ts": true,
     "tests/unit/strategies/dependency-decision-records-rule-pair.test.ts": true,
     "tests/unit/strategies/dependency-internalization-kit-rule-pair.test.ts": true,
@@ -7634,6 +7636,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/strategies/usage-accounting-table-normalization-contract.test.ts": true,
     "tests/unit/strategies/usage-accounting-writer-preservation.test.ts": true,
     "tests/unit/strategies/usage-pricing-config-resolution.test.ts": true,
+    "tests/unit/strategies/verify-flow-surface-parity.test.ts": true,
     "tests/unit/strategies/verify-prd-guard-logic.test.ts": true,
     "tests/unit/strategies/verify-prd-idempotency.test.ts": true,
     "tests/unit/strategies/verify-prd-scaffold.test.ts": true,