@codyswann/lisa 2.345.0 → 2.346.0

package/all/copy-overwrite/scripts/schemas/lisa-state-contract.v1.schema.json

@@ -0,0 +1,191 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://lisa.codyswann.dev/schemas/lisa-state-contract.v1.schema.json",
+  "title": "Lisa state contract (v1)",
+  "description": "Per-project declaration of every persistent entity and the reset policy that governs it. Governed by the reset-seed-coverage rule. The check compares a runtime inventory against this document and fails closed on any entity the document does not classify.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "contractVersion", "mode", "owner"],
+  "properties": {
+    "schemaVersion": {
+      "const": "lisa-state-contract-v1",
+      "description": "Pinned schema version. A bump is a deliberate migration."
+    },
+    "contractVersion": {
+      "type": "string",
+      "minLength": 1,
+      "description": "The project's own version for its declared state. Bump whenever a policy or ownership predicate changes, so evidence from one run cannot be read as evidence for a different contract."
+    },
+    "mode": {
+      "enum": ["contract", "declared-noop"],
+      "description": "contract = this project holds persistent state and classifies it below. declared-noop = this project holds no persistent state; the check verifies that claim against the repository rather than trusting it."
+    },
+    "owner": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Team or role that answers questions about this file. Not an individual's personal account."
+    },
+    "noop": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["reason", "owner", "capabilityManifest"],
+      "description": "Required when mode is declared-noop. A bare exit 0 is indistinguishable from a successful destructive run and never satisfies the contract.",
+      "properties": {
+        "reason": { "type": "string", "minLength": 1 },
+        "owner": { "type": "string", "minLength": 1 },
+        "capabilityManifest": { "type": "string", "minLength": 1 }
+      }
+    },
+    "environments": {
+      "type": "array",
+      "description": "Environments a reset may target. Each names how the environment identity is resolved server-side; a caller-supplied stage is only a request checked against it.",
+      "items": {
+        "type": "object",
+        "additionalProperties": true,
+        "required": ["name", "identitySource"],
+        "properties": {
+          "name": { "type": "string", "minLength": 1 },
+          "identitySource": { "type": "string", "minLength": 1 },
+          "resetAllowed": { "type": "boolean" }
+        }
+      }
+    },
+    "fixtureIdentity": {
+      "type": "object",
+      "additionalProperties": true,
+      "required": ["description"],
+      "description": "How fixture-owned records are recognized. The ownership predicate the entire safety model rests on: a reserved id shape, a reserved account or namespace, or a marker attribute.",
+      "properties": {
+        "description": { "type": "string", "minLength": 1 },
+        "idPattern": { "type": "string", "minLength": 1 },
+        "reservedPrincipals": { "type": "array", "items": { "type": "string" } }
+      }
+    },
+    "detection": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Tuning for the subtraction detectors. Detectors are a staleness signal, never the safety boundary.",
+      "properties": {
+        "sources": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 },
+          "description": "Extra repository paths to scan for declared entities (migrations, schema files, model definitions)."
+        },
+        "ignore": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 },
+          "description": "Entity names the detectors may find but that are not real persistent entities (framework bookkeeping, examples in docs)."
+        }
+      }
+    },
+    "entities": {
+      "type": "array",
+      "description": "One entry per persistent entity. Rows are only one kind of state: identity-provider objects, object-storage prefixes, search indexes, queues, caches, derived views, scheduled jobs and outbound side effects all belong here too.",
+      "items": {
+        "type": "object",
+        "additionalProperties": true,
+        "required": ["id", "kind", "policy", "reason", "owner"],
+        "properties": {
+          "id": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Stable, fully qualified identifier: namespace/schema plus name."
+          },
+          "kind": {
+            "type": "string",
+            "minLength": 1,
+            "description": "The project's own vocabulary for what sort of state this is (table, view, materialized-view, identity-group, object-prefix, search-index, queue, cache-namespace, scheduled-job, external-record, ...)."
+          },
+          "policy": {
+            "enum": [
+              "fixture-owned",
+              "preserve",
+              "derived-rebuild",
+              "forbidden"
+            ],
+            "description": "fixture-owned = the reset may delete records it owns. preserve = untouched. derived-rebuild = recomputed from sources. forbidden = the reset must be structurally unable to touch it."
+          },
+          "reason": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Why this policy, in one sentence a reviewer can check. Classify by provenance (who writes it, can anything put it back), never by an emptiness observation."
+          },
+          "owner": { "type": "string", "minLength": 1 },
+          "ownership": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Required for fixture-owned: the predicate identifying which records the reset may delete. Never 'everything in this entity'."
+          },
+          "sweptBy": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Required for fixture-owned: the routine that actually removes them. A fixture-owned entity nothing sweeps is the leak this contract exists to catch."
+          },
+          "rebuiltFrom": { "type": "string", "minLength": 1 },
+          "rebuiltBy": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Required for derived-rebuild: the routine that recomputes it, and proves convergence."
+          },
+          "enforcedBy": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Required for forbidden: a control OUTSIDE the reset process — a least-privilege role, a revoked grant, a separate credential boundary, a constraint. 'The script does not touch it' is not an enforcement."
+          },
+          "retiredAt": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Set when the entity no longer exists. A classified entity absent from the inventory is stale and fails unless retired with a date."
+          }
+        }
+      }
+    },
+    "assurances": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "The required properties of the reset, each pointing at the evidence that proves it. A declaration with no evidence pointer fails the check.",
+      "properties": {
+        "preserves-non-fixture-data": { "$ref": "#/$defs/assurance" },
+        "rejects-reserved-id-collision": { "$ref": "#/$defs/assurance" },
+        "rejects-foreign-references": { "$ref": "#/$defs/assurance" },
+        "requires-write-acknowledgment": { "$ref": "#/$defs/assurance" },
+        "converges-on-second-apply": { "$ref": "#/$defs/assurance" },
+        "verifies-exact-counts": { "$ref": "#/$defs/assurance" },
+        "production-fails-closed": { "$ref": "#/$defs/assurance" },
+        "guard-at-the-choke-point": { "$ref": "#/$defs/assurance" },
+        "enumerates-before-mutating": { "$ref": "#/$defs/assurance" }
+      }
+    },
+    "waivers": {
+      "type": "array",
+      "description": "Dated IOUs for entities that genuinely cannot be classified yet. A waived entity is treated as preserve for safety and stays a visible finding; it never counts as classified.",
+      "items": {
+        "type": "object",
+        "additionalProperties": true,
+        "required": ["id", "reason", "owner", "ticket", "recordedAt"],
+        "properties": {
+          "id": { "type": "string", "minLength": 1 },
+          "reason": { "type": "string", "minLength": 1 },
+          "owner": { "type": "string", "minLength": 1 },
+          "ticket": { "type": "string", "minLength": 1 },
+          "recordedAt": { "type": "string", "minLength": 1 }
+        }
+      }
+    }
+  },
+  "$defs": {
+    "assurance": {
+      "type": "object",
+      "additionalProperties": true,
+      "required": ["evidence"],
+      "properties": {
+        "evidence": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Pointer to the test, guard, role, or grant that proves this property."
+        },
+        "note": { "type": "string", "minLength": 1 }
+      }
+    }
+  }
+}

package/all/create-only/state/README.md

@@ -0,0 +1,41 @@
+# State contract
+
+`state-contract.json` is this project's declaration of every persistent entity and the reset policy
+that governs it, required by Lisa's `reset-seed-coverage` rule.
+
+Copy `state-contract.example.json` to `state-contract.json` and fill it in. Until that file exists,
+the state-classification check reports `not-adopted` — adoption is an explicit act, so no repo
+silently passes a gate it never wired.
+
+```bash
+node scripts/check-state-classification.mjs
+```
+
+Schema: `scripts/schemas/lisa-state-contract.v1.schema.json`.
+
+## The two things the template cannot do for you
+
+**Classify by provenance, not by observation.** "The table looked empty" is not evidence it is
+unused. Row-count statistics are approximations, and a table nobody has analyzed reports rows it
+holds. Ask who writes it and whether anything can put it back. Prefer `preserve` when unsure — an
+over-preserved entity leaks; an over-cleared one destroys.
+
+**Include state that is not rows.** Identity-provider objects, object-storage prefixes, search
+indexes, queues and dead-letter backlogs, caches with a persistence tier, derived and materialized
+views, runtime-created jobs, and outbound side effects all belong in `entities`. Leaked test state is
+most expensive exactly where nobody thought to look.
+
+## The four policies
+
+| Policy | Meaning |
+|---|---|
+| `fixture-owned` | The reset may delete records it owns here. Requires an `ownership` predicate and a `sweptBy` routine — an entity the suite creates but nothing removes is the leak this contract exists to catch. |
+| `preserve` | Left untouched. Catalog, reference data, anything a migration seeds, anything belonging to someone real. |
+| `derived-rebuild` | Recomputed from its sources after the reset, then proven converged. |
+| `forbidden` | The reset must be structurally unable to touch it. Requires `enforcedBy` naming a control outside the reset process — a role, a revoked grant, a credential boundary. "The script does not touch it" is not an enforcement. |
+
+## No persistent state at all?
+
+Set `"mode": "declared-noop"` and fill in the `noop` block (reason, owner, capability-manifest
+reference) instead of `entities`. The check verifies that claim against the repository rather than
+trusting it: a repo showing persistence signals may not declare a reset noop.

package/all/create-only/state/state-contract.example.json

@@ -0,0 +1,46 @@
+{
+  "schemaVersion": "lisa-state-contract-v1",
+  "contractVersion": "REPLACE-ME-state-v1",
+  "mode": "contract",
+  "owner": "REPLACE-ME-team-or-role",
+  "environments": [
+    {
+      "name": "dev",
+      "identitySource": "REPLACE-ME: how the environment identity is resolved SERVER-SIDE. A caller-supplied --stage, URL or public build-time variable is a request to check against this, never the answer.",
+      "resetAllowed": true
+    },
+    {
+      "name": "production",
+      "identitySource": "REPLACE-ME",
+      "resetAllowed": false
+    }
+  ],
+  "fixtureIdentity": {
+    "description": "REPLACE-ME: how a fixture-owned record is recognized. Everything the reset may delete must match this; anything else belongs to someone real.",
+    "idPattern": "REPLACE-ME-or-remove",
+    "reservedPrincipals": []
+  },
+  "entities": [
+    {
+      "id": "REPLACE-ME.example_table",
+      "kind": "table",
+      "policy": "fixture-owned",
+      "reason": "REPLACE-ME: one sentence a reviewer can check.",
+      "owner": "REPLACE-ME",
+      "ownership": "REPLACE-ME: the predicate identifying records the reset may delete. Never 'everything in this entity'.",
+      "sweptBy": "REPLACE-ME: the routine that actually removes them. A fixture-owned entity nothing sweeps is the leak this contract exists to catch."
+    }
+  ],
+  "assurances": {
+    "preserves-non-fixture-data": { "evidence": "REPLACE-ME: test or role" },
+    "rejects-reserved-id-collision": { "evidence": "REPLACE-ME" },
+    "rejects-foreign-references": { "evidence": "REPLACE-ME" },
+    "requires-write-acknowledgment": { "evidence": "REPLACE-ME" },
+    "converges-on-second-apply": { "evidence": "REPLACE-ME" },
+    "verifies-exact-counts": { "evidence": "REPLACE-ME" },
+    "production-fails-closed": { "evidence": "REPLACE-ME" },
+    "guard-at-the-choke-point": { "evidence": "REPLACE-ME" },
+    "enumerates-before-mutating": { "evidence": "REPLACE-ME" }
+  },
+  "waivers": []
+}

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA4qEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CA+vNjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgsEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAoyNjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -3,6 +3,8 @@
 export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "all/copy-contents/.gitattributes": "9d3831007e681186a3673e1037ef3fc82980cab2fc04e27c0868e562912c9e9f",
     "all/copy-contents/gitignore": "2dbf7fd2f2020fc7824c432342002d9ca3ebb57b2872e761b14e942b23479a11",
+    "all/copy-overwrite/scripts/check-state-classification.mjs": "94dc98e0bbfcf8d43cba035d4805a1c5d61a3a0db88faa791e8e06e34e741f46",
+    "all/copy-overwrite/scripts/lisa-command-envelope.mjs": "2011331056b1c86bd181649713a395dbfd2768f9fcd7e37b521d6ad2a9318ea9",
     "all/copy-overwrite/scripts/lisa-enforcement-fallback.sh": "1bec5f3c284b3febdc471487ee6a23ffb72bd4e7b293f9e26b0188f32318c722",
     "all/copy-overwrite/scripts/lisa-floor-collisions.mjs": "3c7a0234b4f5609fce49e44711d2ec86af8cf7fb82b0831e4450e3347ecefe45",
     "all/copy-overwrite/scripts/lisa-hooks/block-instruction-file-edits.sh": "850cfc23852eb752114ae1e938a1c7bcf34bc50c85d3aaca0c02311cc8c0ef70",
@@ -10,11 +12,16 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "all/copy-overwrite/scripts/lisa-hooks/block-shell-json-parsing.sh": "1934a15e154fda3c2a40979a5cd6225661b14fe7bc77328a69ce499bea85dba7",
     "all/copy-overwrite/scripts/lisa-hooks/parity-safety-net.sh": "d9ea58150aa27e7f0aa9a4ef155ed446d30bdfc932d01c64e2b8ca211aa0de7b",
     "all/copy-overwrite/scripts/lisa-hooks/sonar-secrets.sh": "bf4132e49ba18e2f7e941520c299c15aeeacfd220e489f3d2eb8397f2048157b",
+    "all/copy-overwrite/scripts/lisa-schema-validate.mjs": "9dd145c0f9dac6ed252b13d32e130dbab964da6cd357981b58541780ecb2f981",
     "all/copy-overwrite/scripts/lisa-work-item.mjs": "e30016a49deff1c3cd3ae7951262aeb2ef3d472bce76bbbe2a177db6017c7cad",
+    "all/copy-overwrite/scripts/schemas/lisa-command-envelope.v1.schema.json": "d153b7c2953a30f180e38f09e98240c63327f5196eeba9bdf545e5a1f125a879",
+    "all/copy-overwrite/scripts/schemas/lisa-state-contract.v1.schema.json": "6b7afe4ffeba8aaa53871d8855172f7eacde05953b1321145218ec638ff5c1c4",
     "all/create-only/.claude/rules/PROJECT_RULES.md": "6e1c7923ad2a15356babc60c97e7f97be728d790af285b6a7cd7d1b4d39cd97f",
     "all/create-only/.lisaignore": "3c9827e7e98daa46510b5357cd6dd9406da1821e64cc46d2eea9f311cd6d06b9",
     "all/create-only/scripts/remote-agent-aws-setup.sh": "12d2204d34195ad4f81082e90a25dbbf7d2493debcc50c1cd37b32dc4648fc17",
     "all/create-only/specs/.keep": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    "all/create-only/state/README.md": "6e36aaa9dab171d7d4d6351042e7ddc44ec834bb7f140bbb70b83972c3181fe3",
+    "all/create-only/state/state-contract.example.json": "e7fd3cdc25b42c85a7e4d0e199d92b1442222f02cb9921b34334fb724625a6c2",
     "all/deletions.json": "31af98085a56dd96d34d4b3cb42956e068fb492df7b1dd781987408c1b4b2ea3",
     "all/github-rulesets/base.json": "58b9606f185cdca8b17218829aac333b7d8c08f0f2b4f86d7e360f7be1de4787",
     "all/github-rulesets/prevent-delete.json": "e4fb26390a8bfee34b27be5b369f376a1a9a00b797fd8d3ce51cb71facb826a4",
@@ -349,6 +356,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/rules/eager/rejection-detection.md": "e0a8e74f9b4eec378f7cc62072153b1a968af0e5e7a1af9473ab476d41c30211",
     "plugins/src/base/rules/eager/repo-scope-split.md": "a1702d6d0e9d80abc118b7c32a97ba9a988b195d86363b2d7a35e71752d9bd2e",
     "plugins/src/base/rules/eager/report-actionability.md": "7c4d5b2bea93b7cd5bb8694fa7c06f4ca8f94a19eb17832f1ccc5354b0207163",
+    "plugins/src/base/rules/eager/reset-seed-coverage.md": "d028c8709d7d3a05b2f9bb8209a0d6bf1aef99e88d5e7d7132909e8d0d4c19d9",
     "plugins/src/base/rules/eager/security-audit-handling.md": "1f6effe92be66736a0c9fab634c5fdd6ad1e789865faa67bb783c67ddb4ad490",
     "plugins/src/base/rules/eager/settled-decisions.md": "f5339c81b8d29f628830e6147314cbb941b9d9e6d87c3834d8fe7adc4b46ef4c",
     "plugins/src/base/rules/eager/stale-state-claims.md": "faf5057f5910237b8d5048dbcccb73e0cd03762a8eefbeae43b5d0153104a85a",
@@ -388,6 +396,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/rules/reference/rejection-detection.md": "afa1f187feabf4ef275c8d7e085452c76c5276356fe58d67a5360ed420a62873",
     "plugins/src/base/rules/reference/repo-scope-split.md": "5df96b7a41a9c4102fd1f703f5ebf0f4dd86a07f142eb9b10088459c3d264ae6",
     "plugins/src/base/rules/reference/report-actionability.md": "42fa86bb189467c7bc7ee64f6ebccd3926bb2aaf512ee5a498c232025b8a364b",
+    "plugins/src/base/rules/reference/reset-seed-coverage.md": "741c49e0544aecfa2c4aadf6a36ef496a1a5d974f71962ae8e33cc625651f0c2",
     "plugins/src/base/rules/reference/security-audit-handling.md": "9633e11ac89af26444a272449f36fe03f26e61fab40ca16a0ab50464725f7d8c",
     "plugins/src/base/rules/reference/settled-decisions.md": "6c84f309a1f765eba1648d6ace836387bd96b924f245c16cf3629f501ef6bb18",
     "plugins/src/base/rules/reference/stale-state-claims.md": "6329e1a7629f9a12f10454c767842aecee4964df8b7bb4aebda9dde3c0959c2a",
@@ -415,7 +424,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/scripts/queue-status-build-readers.mjs": "1e05181dc8fbe2a4f0c04ce73fdfe1c3a7fc1777cb66e95d7e9a593559c8ca27",
     "plugins/src/base/scripts/queue-status-prd-readers.mjs": "32b4366fc292062c869793aeaf5b006ff400df5da09ee510f862e15d59a77770",
     "plugins/src/base/scripts/remote-agent-aws-setup.sh": "e3fc922d9b868e0f5a72c7a16a4c32e4a1b3f5278b7c8563648e4f05c49072c5",
-    "plugins/src/base/skills/lisa-acceptance-criteria/SKILL.md": "b8d10032c8187178720ba4101e6fd79f353a2cfbc4cdba48710f1bb3b092dd92",
+    "plugins/src/base/skills/lisa-acceptance-criteria/SKILL.md": "ddcb4f10b092f27bbff67782cc4472c3a3c8b8fa08507ee67ca5d1ea4f0f1a20",
     "plugins/src/base/skills/lisa-agent-design-best-practices/SKILL.md": "2c487df59f54682d744e71f78a2bccccf9e3a6510705b4ff6be7edfa4be2d43b",
     "plugins/src/base/skills/lisa-agent-ready/SKILL.md": "13f2e0f50287a04ed9a036ef1c547563b5f6f6325b2b35f6746d46a5ed4d15df",
     "plugins/src/base/skills/lisa-analyze-claude-remote/SKILL.md": "a5863836b8fa9d67825d048e1c2fc086d3df95de33cf110129488959b83cb4b5",
@@ -426,7 +435,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-bug-triage/SKILL.md": "bd5bae508a8f344d8b5cb46cfddcb178ff8368ca77936f9e2c63058e05f61af4",
     "plugins/src/base/skills/lisa-capability-drift/SKILL.md": "9ef86e6caab6eaea87f6d32e67a77061ce8cccf09467bc5c36ee13a77a7f0199",
     "plugins/src/base/skills/lisa-codebase-research/SKILL.md": "77dbc2d7e86e5027df486294de315bb539a2ece84bd4b38e47ccc108f8c2875e",
-    "plugins/src/base/skills/lisa-codify-verification/SKILL.md": "7a067555415a50594a2eeeeeb113135a9b709374d2456c82e2aae561c8f17fd8",
+    "plugins/src/base/skills/lisa-codify-verification/SKILL.md": "72467a7fb8143ec5061db13df90d51d31da638535f5df4d4b9b655f37deb96a3",
     "plugins/src/base/skills/lisa-confluence-prd-intake/SKILL.md": "a6a099abeb32940d44da7e9a6a62c3519f64efa85294c4b996789fa4fba97461",
     "plugins/src/base/skills/lisa-confluence-to-tracker/SKILL.md": "373a545a19013306c68625f0b6cb01d9fdf36966f8a0539f63f02adcb70a7f7e",
     "plugins/src/base/skills/lisa-confluence-write-prd/SKILL.md": "29fce0dce5f3d1b9cbe8705c8fc002e5885675e1807cf948b166aef88ddfd73a",
@@ -463,7 +472,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-github-write-issue/SKILL.md": "ee54b3d14cc5dd3a68a8c36590102dd02f49334c9493ad52fa8c7f35157073b1",
     "plugins/src/base/skills/lisa-github-write-prd/SKILL.md": "262f8a1bcfad4c5dd4456cfaaf1b71abf9697a0da588966e58ff491acd3c17e8",
     "plugins/src/base/skills/lisa-health/SKILL.md": "dfdb08a863e78bff42671793dcec29cfae0654db18ebf66a4aa77aeb56ddb775",
-    "plugins/src/base/skills/lisa-implement/SKILL.md": "f0b044b931463faa4c7b59d1f94192e28d660c26812c9937c4d42cfd849c99b5",
+    "plugins/src/base/skills/lisa-implement/SKILL.md": "594e48a89a2f4707531009a637fb9ddaabee14f133664c1e3a2c92a41a793c94",
     "plugins/src/base/skills/lisa-improve-code-complexity/SKILL.md": "24ab5b193b409db6ee6bee981a1c0a48d08991782d7846116ad01658c8bc1ae8",
     "plugins/src/base/skills/lisa-improve-harness/SKILL.md": "bafda5d2f9b86c48cd16bf0015528fdf5891675221d662fdc533aaad66aad669",
     "plugins/src/base/skills/lisa-improve-max-lines-per-function/SKILL.md": "95c875950c9848fdaf520a18b9bbb264e33d7347be10170add768e01d9cd8e52",
@@ -517,9 +526,9 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-parity-code-review/SKILL.md": "5805254747c4ed9081fd514236f06e078be86d41694bf74b480bf7592cd58c1f",
     "plugins/src/base/skills/lisa-parity-code-simplifier/SKILL.md": "c721ae772e73abff633c43d93267066afac188e911a77322fbb102db673849d7",
     "plugins/src/base/skills/lisa-parity-coderabbit/SKILL.md": "ae882837d43741293d1b639c4516331fa6124fa1f5da234a74ecb31c5d7e52cd",
-    "plugins/src/base/skills/lisa-parity-safety-net-rules/SKILL.md": "35c4c9f5e77f73a0e33e2ec01a70198eeb6bf521ec793983c9e633cbcab7b69b",
-    "plugins/src/base/skills/lisa-parity-sentry-sdk-setup/SKILL.md": "610890385568ae097b2a48c9d20e42104a1bf5a3ba06223a89086ef385542e3b",
-    "plugins/src/base/skills/lisa-parity-sentry-seer/SKILL.md": "d060d3171529cc228368e640d0ab813a79ec18440921602e7c720d53fdcabb67",
+    "plugins/src/base/skills/lisa-parity-safety-net-rules/SKILL.md": "f240857de2f14938009ddd212c56601269fd9e1aec33a766cd09da5bea5656e0",
+    "plugins/src/base/skills/lisa-parity-sentry-sdk-setup/SKILL.md": "edb513a9d29b3faeccce71d92596e12bc1f35e44fe3af1349bd7bd473fee98af",
+    "plugins/src/base/skills/lisa-parity-sentry-seer/SKILL.md": "ec09515906a55e98ac0f619f048f14c4a16db74c1cd5744dda0cdfa42ce7fed6",
     "plugins/src/base/skills/lisa-parity-skill-creator/SKILL.md": "616e0493f75fe92c18137548d7c86a91a9b04d9844ca76fa3f14156e3e7814e5",
     "plugins/src/base/skills/lisa-performance-review/SKILL.md": "351542c256e54940e6d672a70606b8414425c6435ae6f026841bcc02f9fce9c4",
     "plugins/src/base/skills/lisa-persist-learning/SKILL.md": "41ffd8a415c6b1b98952061760e54837f3d6e6ea046e4d1c122dd53878af84de",
@@ -548,7 +557,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-remote-dispatch/scripts/dispatch.mjs": "475963ed64d9e72a6cbd6cbb61c8b57a419f2e1805e3ddfa76066047c590deeb",
     "plugins/src/base/skills/lisa-repair-intake/SKILL.md": "1c07ec9e422f5bf6a624b63cc8c032894203d22642e77a2c51fc7209024b175a",
     "plugins/src/base/skills/lisa-reproduce-bug/SKILL.md": "4d460993fac6021219ca23eee29b1b9afa7c37479dddc662b2fcfaca510edd68",
-    "plugins/src/base/skills/lisa-research/SKILL.md": "b2c9c45ab3e455cdddd0375d25f6fb6171a9aa29cbbf793092b55dbd06c14c32",
+    "plugins/src/base/skills/lisa-research/SKILL.md": "9e2e7f3d02a18d9bb34f0b9e8c43d6b9b454d0f81987390839d40a84331b20f7",
     "plugins/src/base/skills/lisa-review-implementation/SKILL.md": "42134253cca50e384f36eaa085c0a1e6b8772e9f3e912a8d1231f1cd69199858",
     "plugins/src/base/skills/lisa-review-local/SKILL.md": "66defe83565ab3633a13e69ce394de64f17f2c2bddbf046bc12c8bbd0ca57f5c",
     "plugins/src/base/skills/lisa-rework-triage/SKILL.md": "3389740fc0f162be0b684625424e716a0a3e4c99c8cdb4317ec82dcfcf7b57c7",
@@ -598,11 +607,11 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-sonarcloud-access/SKILL.md": "031acb01195ae59010a65335da98d46a1d6080e749823d6f6d157938d9e96648",
     "plugins/src/base/skills/lisa-spec-conformance/SKILL.md": "50e79afcfabf16d36273325aabb58571c9a0e1cafe7a2865e2da10c6d46571eb",
     "plugins/src/base/skills/lisa-sync-down/SKILL.md": "c32e6a4e3115ca32b7d335e90d0a73b243c6c631a2d192568423be0cb5944e84",
-    "plugins/src/base/skills/lisa-task-decomposition/SKILL.md": "14327dc9f2a9cf9b30d744e9fe446f22aabcb53c39a484f82a2e6df63e1c1ce4",
+    "plugins/src/base/skills/lisa-task-decomposition/SKILL.md": "eb78838e1f121a7a619a841333b1adfce124dad8881853d14107512ead09d30f",
     "plugins/src/base/skills/lisa-task-triage/SKILL.md": "c6e11b6d195560e6bd7b51fede65c155567c35208801a700a26d95679b03484e",
     "plugins/src/base/skills/lisa-tdd-implementation/SKILL.md": "366bcf52a538d4f2ac440dd2e9e6f7cf324450fd3cd03652127ab8c20f584fa9",
     "plugins/src/base/skills/lisa-tear-down-automations/SKILL.md": "3f8215b691ce60a6efd63547b99b4d87760fe99d285f6fe153aaadd451e83731",
-    "plugins/src/base/skills/lisa-test-strategy/SKILL.md": "b7af17adb5cbc73988b59c58e0219fc780315b071a3de00d0aa60d5c97b92074",
+    "plugins/src/base/skills/lisa-test-strategy/SKILL.md": "8976e0056b65475fe69f4ed02c8d0d3ae898fd9ab5ff28bf632981a3293c9f6e",
     "plugins/src/base/skills/lisa-ticket-triage/SKILL.md": "9d29652fb897568a60da35956f452627a81e57032bbcc3c673ae20dfc8a419f5",
     "plugins/src/base/skills/lisa-track/SKILL.md": "35a3fd978c71d40f62849f903ae0291f8b3140354e53ba498ada4ffe4cd586f3",
     "plugins/src/base/skills/lisa-tracker-add-journey/SKILL.md": "a3da2e0350bcdebcdcc05f2d7931af868382638d3a28d09d4718f2f458d4be0a",
@@ -620,10 +629,10 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-usage-accounting/SKILL.md": "838da4ca08fb6e6a4bc14b6cb5446be93c4565f468f169a1ec68435d275d1ef8",
     "plugins/src/base/skills/lisa-use-the-product/SKILL.md": "ab3f3ab475b7c97c3409f502b80d688816b1ff4b8e3dfeec7715d93ca41e3fa0",
     "plugins/src/base/skills/lisa-validate-tracker-mapping/SKILL.md": "ab45fdc00294c4ca9698093cb294a2aaf39a73d714fe1aa6ad686c6c34e157ba",
-    "plugins/src/base/skills/lisa-verification-lifecycle/SKILL.md": "281878b204a832a81dcd4623cb54f1c8a824c719c57cc41ece5644a29f2dabd4",
+    "plugins/src/base/skills/lisa-verification-lifecycle/SKILL.md": "3fbcb619281a91f229e4564549b7f7d0ea68e7fd2d874820515846f8cbd6e0e7",
     "plugins/src/base/skills/lisa-verify-prd/SKILL.md": "fd4dc76c42c1083f5223e650f6c25d53694138860ebcb02588689f6eb6d0b416",
     "plugins/src/base/skills/lisa-verify-workflow-change/SKILL.md": "d89740a4dc350a9ac0d26b1b955bf74f009775b60ee0275df3f9a50fe8be3048",
-    "plugins/src/base/skills/lisa-verify/SKILL.md": "cce2312336121d2daab3504ad8455e9c012b8700f4fdeac9f3072fa072973b5b",
+    "plugins/src/base/skills/lisa-verify/SKILL.md": "f8650c75b17df54159e243d3443ef2098a1be2407887689e1501fe575bf54ca4",
     "plugins/src/base/skills/lisa-wiki-install/SKILL.md": "9689e5080dfdeffcebd230a5c1cb1ae7b173172a060a603634058f91ca71c17b",
     "plugins/src/cdk/commands/setup/aws.md": "b393a8181d783dad43a94510d3206ea7a0d9090bf3f84d595273e64bb40e1d8d",
     "plugins/src/cdk/skills/setup-aws-accounts/SKILL.md": "a2eee104aecc34716137661f6f47c6e18105b3eadae84fddd29cbaf6ed756874",
@@ -728,7 +737,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/expo/skills/native-data-fetching/references/expo-router-loaders.md": "dfae6f4d7116370d05f1423672cbafa1077ed338d1d5736dafc7a41439281dbe",
     "plugins/src/expo/skills/ops-browser-uat/SKILL.md": "d24a96ed6ea3eeb3b1a89f73a15a8da82f8aeea6dba76b142a2f4973e50395f6",
     "plugins/src/expo/skills/ops-check-logs/SKILL.md": "a5c53b0389be769f7096807c66774fac6f816c6786967536e92741eefa1ef193",
-    "plugins/src/expo/skills/ops-db-ops/SKILL.md": "d5ebe2fef35fc4efbd4f28ae8283cf0afdfb998df40849ae411def666ea77366",
+    "plugins/src/expo/skills/ops-db-ops/SKILL.md": "a94ad3b9b757e738bfef9959dbf7acde087ccfd15f6531e81bc685d878ed1d04",
     "plugins/src/expo/skills/ops-deploy/SKILL.md": "287264d7589bd6d40449c3c11c32ce649be58e020726e365a7ce586a8ea69e43",
     "plugins/src/expo/skills/ops-monitor-errors/SKILL.md": "06fb960a925c1a9ddd078450fa4c22748cb71d63ba4491d5692b6417ec0d45cb",
     "plugins/src/expo/skills/ops-performance/SKILL.md": "a799b52a80208a246c94b951da207839f694eefbdfc33cb562143457f5c588a7",
@@ -984,6 +993,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "scripts/check-plugins-sync.sh": "3a99cbff0e8ec5e7c944690eae003a6d51b51c85436d77bd37faea4d553728af",
     "scripts/check-rules-pairing.sh": "4d4a0d9e8d36794a22020f419c879d7336b1c5bfe883acdcc826d26764560c7a",
     "scripts/check-security-floors.mjs": "0060a0f65885b54fc93bd3885ca249cbb1ac822c52813817aae640bc1303827b",
+    "scripts/check-state-classification.mjs": "26baaa85c0758fa41f1f66257f7d3a31ea4dd5cf17a9c0acaa3e89caaaf6265a",
     "scripts/claude-remote-setup.sh": "0e33accf8aa057c70497f01c38bef9f9f3801d649272f583578d89201b242655",
     "scripts/clean-dist.mjs": "04970d768464acbf96ebeb77c16a6a3b3da56c744eef0da64c573c6152ee0dc7",
     "scripts/cleanup-amplify-branches.sh": "eb9db90b07818dd156dd48d04b6350a10b39be8ffe0267d72cc13705c8eb5350",
@@ -1259,6 +1269,8 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "README.md": true,
     "all/copy-contents/.gitattributes": true,
     "all/copy-contents/gitignore": true,
+    "all/copy-overwrite/scripts/check-state-classification.mjs": true,
+    "all/copy-overwrite/scripts/lisa-command-envelope.mjs": true,
     "all/copy-overwrite/scripts/lisa-enforcement-fallback.sh": true,
     "all/copy-overwrite/scripts/lisa-floor-collisions.mjs": true,
     "all/copy-overwrite/scripts/lisa-hooks/block-instruction-file-edits.sh": true,
@@ -1266,11 +1278,16 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "all/copy-overwrite/scripts/lisa-hooks/block-shell-json-parsing.sh": true,
     "all/copy-overwrite/scripts/lisa-hooks/parity-safety-net.sh": true,
     "all/copy-overwrite/scripts/lisa-hooks/sonar-secrets.sh": true,
+    "all/copy-overwrite/scripts/lisa-schema-validate.mjs": true,
     "all/copy-overwrite/scripts/lisa-work-item.mjs": true,
+    "all/copy-overwrite/scripts/schemas/lisa-command-envelope.v1.schema.json": true,
+    "all/copy-overwrite/scripts/schemas/lisa-state-contract.v1.schema.json": true,
     "all/create-only/.claude/rules/PROJECT_RULES.md": true,
     "all/create-only/.lisaignore": true,
     "all/create-only/scripts/remote-agent-aws-setup.sh": true,
     "all/create-only/specs/.keep": true,
+    "all/create-only/state/README.md": true,
+    "all/create-only/state/state-contract.example.json": true,
     "all/deletions.json": true,
     "all/github-rulesets/base.json": true,
     "all/github-rulesets/prevent-delete.json": true,
@@ -2435,6 +2452,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-copilot/rules/eager/rejection-detection.md": true,
     "plugins/lisa-copilot/rules/eager/repo-scope-split.md": true,
     "plugins/lisa-copilot/rules/eager/report-actionability.md": true,
+    "plugins/lisa-copilot/rules/eager/reset-seed-coverage.md": true,
     "plugins/lisa-copilot/rules/eager/security-audit-handling.md": true,
     "plugins/lisa-copilot/rules/eager/settled-decisions.md": true,
     "plugins/lisa-copilot/rules/eager/stale-state-claims.md": true,
@@ -2474,6 +2492,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-copilot/rules/reference/rejection-detection.md": true,
     "plugins/lisa-copilot/rules/reference/repo-scope-split.md": true,
     "plugins/lisa-copilot/rules/reference/report-actionability.md": true,
+    "plugins/lisa-copilot/rules/reference/reset-seed-coverage.md": true,
     "plugins/lisa-copilot/rules/reference/security-audit-handling.md": true,
     "plugins/lisa-copilot/rules/reference/settled-decisions.md": true,
     "plugins/lisa-copilot/rules/reference/stale-state-claims.md": true,
@@ -2886,6 +2905,8 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-cursor/rules/repo-scope-split.mdc": true,
     "plugins/lisa-cursor/rules/report-actionability-reference.mdc": true,
     "plugins/lisa-cursor/rules/report-actionability.mdc": true,
+    "plugins/lisa-cursor/rules/reset-seed-coverage-reference.mdc": true,
+    "plugins/lisa-cursor/rules/reset-seed-coverage.mdc": true,
     "plugins/lisa-cursor/rules/security-audit-handling-reference.mdc": true,
     "plugins/lisa-cursor/rules/security-audit-handling.mdc": true,
     "plugins/lisa-cursor/rules/settled-decisions-reference.mdc": true,
@@ -5368,6 +5389,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa/rules/eager/rejection-detection.md": true,
     "plugins/lisa/rules/eager/repo-scope-split.md": true,
     "plugins/lisa/rules/eager/report-actionability.md": true,
+    "plugins/lisa/rules/eager/reset-seed-coverage.md": true,
     "plugins/lisa/rules/eager/security-audit-handling.md": true,
     "plugins/lisa/rules/eager/settled-decisions.md": true,
     "plugins/lisa/rules/eager/stale-state-claims.md": true,
@@ -5407,6 +5429,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa/rules/reference/rejection-detection.md": true,
     "plugins/lisa/rules/reference/repo-scope-split.md": true,
     "plugins/lisa/rules/reference/report-actionability.md": true,
+    "plugins/lisa/rules/reference/reset-seed-coverage.md": true,
     "plugins/lisa/rules/reference/security-audit-handling.md": true,
     "plugins/lisa/rules/reference/settled-decisions.md": true,
     "plugins/lisa/rules/reference/stale-state-claims.md": true,
@@ -5970,6 +5993,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/src/base/rules/eager/rejection-detection.md": true,
     "plugins/src/base/rules/eager/repo-scope-split.md": true,
     "plugins/src/base/rules/eager/report-actionability.md": true,
+    "plugins/src/base/rules/eager/reset-seed-coverage.md": true,
     "plugins/src/base/rules/eager/security-audit-handling.md": true,
     "plugins/src/base/rules/eager/settled-decisions.md": true,
     "plugins/src/base/rules/eager/stale-state-claims.md": true,
@@ -6009,6 +6033,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/src/base/rules/reference/rejection-detection.md": true,
     "plugins/src/base/rules/reference/repo-scope-split.md": true,
     "plugins/src/base/rules/reference/report-actionability.md": true,
+    "plugins/src/base/rules/reference/reset-seed-coverage.md": true,
     "plugins/src/base/rules/reference/security-audit-handling.md": true,
     "plugins/src/base/rules/reference/settled-decisions.md": true,
     "plugins/src/base/rules/reference/stale-state-claims.md": true,
@@ -6675,6 +6700,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "scripts/check-plugins-sync.sh": true,
     "scripts/check-rules-pairing.sh": true,
     "scripts/check-security-floors.mjs": true,
+    "scripts/check-state-classification.mjs": true,
     "scripts/claude-remote-setup.sh": true,
     "scripts/clean-dist.mjs": true,
     "scripts/cleanup-amplify-branches.sh": true,
@@ -7034,6 +7060,9 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/utils/postinstall-trampoline.ts": true,
     "src/utils/usage-accounting-rollup.ts": true,
     "src/utils/usage-accounting.ts": true,
+    "state/demo-project/README.md": true,
+    "state/demo-project/state/inventory.json": true,
+    "state/demo-project/state/state-contract.json": true,
     "tests/e2e/fixtures/ui-live-status-server.ts": true,
     "tests/e2e/ui-automations-scheduler.spec.ts": true,
     "tests/e2e/ui-ci-quality-jobs.spec.ts": true,
@@ -7100,6 +7129,21 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/fixtures/queue-status-prd-readers/github.json": true,
     "tests/fixtures/queue-status-prd-readers/linear.json": true,
     "tests/fixtures/queue-status-prd-readers/notion.json": true,
+    "tests/fixtures/state-contract/adopter/migrations/0001_initial.sql": true,
+    "tests/fixtures/state-contract/adopter/state/inventory.json": true,
+    "tests/fixtures/state-contract/adopter/state/state-contract.json": true,
+    "tests/fixtures/state-contract/inventory-incomplete/migrations/0001_initial.sql": true,
+    "tests/fixtures/state-contract/inventory-incomplete/state/inventory.json": true,
+    "tests/fixtures/state-contract/inventory-incomplete/state/state-contract.json": true,
+    "tests/fixtures/state-contract/leaked-notes/state/inventory.json": true,
+    "tests/fixtures/state-contract/leaked-notes/state/state-contract.json": true,
+    "tests/fixtures/state-contract/noop-contradicted/migrations/0001_initial.sql": true,
+    "tests/fixtures/state-contract/noop-contradicted/state/state-contract.json": true,
+    "tests/fixtures/state-contract/noop-valid/state/state-contract.json": true,
+    "tests/fixtures/state-contract/stale-classification/state/inventory.json": true,
+    "tests/fixtures/state-contract/stale-classification/state/state-contract.json": true,
+    "tests/fixtures/state-contract/unswept-fixture/state/inventory.json": true,
+    "tests/fixtures/state-contract/unswept-fixture/state/state-contract.json": true,
     "tests/fixtures/verification/artifact_mismatch.json": true,
     "tests/fixtures/verification/evidence_digest_mismatch.json": true,
     "tests/fixtures/verification/evidence_kind_mismatch.json": true,
@@ -7405,6 +7449,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/scripts/check-learnings-budget-helpers.ts": true,
     "tests/unit/scripts/check-learnings-budget.test.ts": true,
     "tests/unit/scripts/codex-hook-filter.test.ts": true,
+    "tests/unit/scripts/command-envelope.test.ts": true,
     "tests/unit/scripts/cross-pollinate.test.ts": true,
     "tests/unit/scripts/cursor-artifact-helpers.ts": true,
     "tests/unit/scripts/detect-stale-workflow-inputs-helpers.ts": true,
@@ -7430,6 +7475,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/scripts/plugin-sync-workflow.test.ts": true,
     "tests/unit/scripts/security-floors.test.ts": true,
     "tests/unit/scripts/setup-jira-cli-config.test.ts": true,
+    "tests/unit/scripts/state-classification.test.ts": true,
     "tests/unit/scripts/threshold-ratchet-gates.test.ts": true,
     "tests/unit/scripts/threshold-ratchet-wiring.test.ts": true,
     "tests/unit/scripts/threshold-ratchet.test.ts": true,
@@ -7634,6 +7680,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/strategies/remote-agent-aws-setup.test.ts": true,
     "tests/unit/strategies/repair-intake-contract.test.ts": true,
     "tests/unit/strategies/repo-scope-claim.test.ts": true,
+    "tests/unit/strategies/reset-seed-coverage-rule.test.ts": true,
     "tests/unit/strategies/rework-triage-skill.test.ts": true,
     "tests/unit/strategies/security-two-bucket-contract.test.ts": true,
     "tests/unit/strategies/setup-automations-readiness-warning.test.ts": true,