@codyswann/lisa 3.11.8 → 3.12.0

package/dist/migrations/ensure-quality-caller-scopes.d.ts

@@ -9,11 +9,24 @@ import type { Migration, MigrationContext, MigrationResult } from "./migration.i
  * backstop runs but reports not-enforceable forever. This migration closes that
  * gap in place.
  *
- * Deliberately conservative, because it edits a file the host owns:
+ * A caller with NO `permissions:` block is the BROKEN shape, not the safe one.
+ * It was previously skipped on the premise that the repo default is "typically
+ * permissive"; measurement disproved that (#2476). On two private consumers a
+ * block-less caller job received `contents: read` + `metadata: read`, so
+ * `gh pr view` and `gh issue view` both failed and the gate could never pass —
+ * while a sibling repo whose caller granted the two read scopes ran the real
+ * validation. Those repos can never self-heal through the copy strategies
+ * either, because `.github/workflows/ci.yml` is create-only. So this migration
+ * now writes the block when it is absent.
  *
- * - Patches an EXISTING `permissions:` block only. A caller with no block
- *   inherits the repo default (typically permissive, so already sufficient);
- *   inventing a block there would RESTRICT scopes the called jobs may rely on.
+ * Still deliberately conservative, because it edits a file the host owns:
+ *
+ * - Grants read-only scopes for `quality.yml`, whose 32 jobs were audited to
+ *   need no write scope (#1769), so an invented block cannot cost a job access
+ *   it uses today. `quality-rails.yml` declares `checks: write` and
+ *   `pull-requests: write` at the workflow level, and a caller granting less
+ *   than the called workflow declares is a startup_failure for the whole run
+ *   (#2049) — so a rails caller is granted those levels, never `read`.
  * - Never downgrades: a scope already granted at `write` is left alone.
  * - Never rewrites `secrets: inherit` into an explicit map — that is the host's
  *   choice and converting it changes what the called workflow receives.

package/dist/migrations/ensure-quality-caller-scopes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ensure-quality-caller-scopes.d.ts","sourceRoot":"","sources":["../../src/migrations/ensure-quality-caller-scopes.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAqIlC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,kCAAmC,YAAW,SAAS;IAClE,QAAQ,CAAC,IAAI,kCAAkC;IAC/C,QAAQ,CAAC,WAAW,kHAC6F;IAEjH;;;;OAIG;YACW,IAAI;IA4DlB;;;;OAIG;IACG,OAAO,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAKtD;;;;OAIG;IACG,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;CAmE7D"}
+{"version":3,"file":"ensure-quality-caller-scopes.d.ts","sourceRoot":"","sources":["../../src/migrations/ensure-quality-caller-scopes.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAiLlC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,qBAAa,kCAAmC,YAAW,SAAS;IAClE,QAAQ,CAAC,IAAI,kCAAkC;IAC/C,QAAQ,CAAC,WAAW,kHAC6F;IAEjH;;;;OAIG;YACW,IAAI;IAgElB;;;;OAIG;IACG,OAAO,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAKtD;;;;OAIG;IACG,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;CAmF7D"}

package/dist/migrations/ensure-quality-caller-scopes.js

@@ -10,8 +10,36 @@ const CONFIG_FILE = ".lisa.config.json";
 const CALLER_USES = /^ {4}uses:\s*CodySwannGT\/lisa\/\.github\/workflows\/quality(?:-rails)?\.yml@/u;
 /** A job key inside `jobs:` — two-space indent, no value on the line. */
 const JOB_KEY = /^ {2}\S[^:]*:\s*$/u;
-/** Scopes the work_item_traceability job needs from the caller's token. */
-const REQUIRED_SCOPES = ["issues", "pull-requests"];
+/** Distinguishes the rails reusable workflow from the standard one. */
+const RAILS_CALLER = /quality-rails\.yml@/u;
+/**
+ * Scopes the caller must grant, per reusable workflow.
+ *
+ * `contents: read` is the floor both workflows declare. `issues: read` and
+ * `pull-requests: read` are what work_item_traceability's `gh issue view` and
+ * `gh pr view` need, and a reusable workflow may only DOWNGRADE the caller's
+ * grant — so if the caller does not hold them, that job can never enforce
+ * anything.
+ *
+ * quality-rails.yml additionally declares `checks: write` and
+ * `pull-requests: write` at the workflow level. A called workflow that requests
+ * more than the caller granted is a startup_failure for the ENTIRE run (#2049),
+ * so a rails caller must be granted at least those levels — writing
+ * `pull-requests: read` there would take the whole workflow down.
+ */
+const SCOPES_BY_WORKFLOW = {
+    standard: [
+        ["contents", "read"],
+        ["issues", "read"],
+        ["pull-requests", "read"],
+    ],
+    rails: [
+        ["contents", "read"],
+        ["checks", "write"],
+        ["issues", "read"],
+        ["pull-requests", "write"],
+    ],
+};
 /** Tracker credentials, by the `tracker` value that actually needs them. */
 const TRACKER_SECRETS = {
     jira: ["JIRA_API_TOKEN", "JIRA_LOGIN"],
@@ -39,6 +67,7 @@ function findCallerJob(lines) {
     return {
         start: start < 0 ? 0 : start,
         end: after < 0 ? lines.length : after,
+        usesAt,
     };
 }
 /**
@@ -88,6 +117,14 @@ async function readTracker(projectDir) {
         return null;
     }
 }
+/**
+ * Render the scope lines of a caller `permissions:` block.
+ * @param scopes - Scope/level pairs to render
+ * @returns Indented YAML lines
+ */
+function scopeLines(scopes) {
+    return scopes.map(([name, level]) => `      ${name}: ${level}`);
+}
 /**
  * Migration: grant the reusable quality workflow's caller the token scopes the
  * work-item traceability backstop needs, and map the tracker credentials it
@@ -98,11 +135,24 @@ async function readTracker(projectDir) {
  * backstop runs but reports not-enforceable forever. This migration closes that
  * gap in place.
  *
- * Deliberately conservative, because it edits a file the host owns:
+ * A caller with NO `permissions:` block is the BROKEN shape, not the safe one.
+ * It was previously skipped on the premise that the repo default is "typically
+ * permissive"; measurement disproved that (#2476). On two private consumers a
+ * block-less caller job received `contents: read` + `metadata: read`, so
+ * `gh pr view` and `gh issue view` both failed and the gate could never pass —
+ * while a sibling repo whose caller granted the two read scopes ran the real
+ * validation. Those repos can never self-heal through the copy strategies
+ * either, because `.github/workflows/ci.yml` is create-only. So this migration
+ * now writes the block when it is absent.
+ *
+ * Still deliberately conservative, because it edits a file the host owns:
  *
- * - Patches an EXISTING `permissions:` block only. A caller with no block
- *   inherits the repo default (typically permissive, so already sufficient);
- *   inventing a block there would RESTRICT scopes the called jobs may rely on.
+ * - Grants read-only scopes for `quality.yml`, whose 32 jobs were audited to
+ *   need no write scope (#1769), so an invented block cannot cost a job access
+ *   it uses today. `quality-rails.yml` declares `checks: write` and
+ *   `pull-requests: write` at the workflow level, and a caller granting less
+ *   than the called workflow declares is a startup_failure for the whole run
+ *   (#2049) — so a rails caller is granted those levels, never `read`.
  * - Never downgrades: a scope already granted at `write` is left alone.
  * - Never rewrites `secrets: inherit` into an explicit map — that is the host's
  *   choice and converting it changes what the called workflow receives.
@@ -135,6 +185,7 @@ export class EnsureQualityCallerScopesMigration {
         const job = findCallerJob(lines);
         if (!job)
             return { ...empty, text, lines };
+        const required = SCOPES_BY_WORKFLOW[RAILS_CALLER.test(lines[job.usesAt]) ? "rails" : "standard"];
         const permissions = findBlock(lines, "permissions", job);
         const granted = new Set(permissions
             ? lines
@@ -142,9 +193,9 @@ export class EnsureQualityCallerScopesMigration {
                 .map(line => line.trim().split(":")[0]?.trim())
                 .filter((key) => Boolean(key))
             : []);
-        const missingScopes = permissions
-            ? REQUIRED_SCOPES.filter(scope => !granted.has(scope))
-            : [];
+        // With no block at all NOTHING is granted, so the whole set is missing —
+        // that is the case this migration exists to repair.
+        const missingScopes = required.filter(([name]) => !granted.has(name));
         const tracker = await readTracker(ctx.projectDir);
         const wanted = (tracker ? TRACKER_SECRETS[tracker] : undefined) ?? [];
         const secrets = findBlock(lines, "secrets", job);
@@ -192,12 +243,26 @@ export class EnsureQualityCallerScopesMigration {
         // Apply insertions bottom-up so each earlier index stays valid against the
         // array the previous step produced.
         const insertions = [
-            plan.permissions && plan.missingScopes.length > 0
-                ? {
-                    at: plan.permissions.end,
-                    text: plan.missingScopes.map(scope => `      ${scope}: read`),
-                }
-                : null,
+            plan.missingScopes.length === 0
+                ? null
+                : plan.permissions
+                    ? {
+                        at: plan.permissions.end,
+                        text: scopeLines(plan.missingScopes),
+                    }
+                    : {
+                        // No block: write a whole one immediately above `uses:`, which is
+                        // the one key a caller job always has.
+                        at: plan.job.usesAt,
+                        text: [
+                            "    # A reusable workflow may only DOWNGRADE the caller's grant, so the",
+                            "    # work-item traceability job can enforce nothing the caller does not",
+                            "    # hold. With no block here the job received contents+metadata read",
+                            "    # only, and its `gh pr view` / `gh issue view` calls failed (#2476).",
+                            "    permissions:",
+                            ...scopeLines(plan.missingScopes),
+                        ],
+                    },
             plan.secrets && plan.missingSecrets.length > 0
                 ? {
                     at: plan.secrets.end,
@@ -214,7 +279,9 @@ export class EnsureQualityCallerScopesMigration {
         ], plan.lines);
         const parts = [
             plan.missingScopes.length > 0
-                ? `permissions (${plan.missingScopes.join(", ")})`
+                ? `permissions (${plan.missingScopes
+                    .map(([name, level]) => `${name}: ${level}`)
+                    .join(", ")})`
                 : null,
             plan.missingSecrets.length > 0
                 ? `tracker secrets (${plan.missingSecrets.join(", ")})`

package/dist/migrations/ensure-quality-caller-scopes.js.map

@@ -1 +1 @@
-{"version":3,"file":"ensure-quality-caller-scopes.js","sourceRoot":"","sources":["../../src/migrations/ensure-quality-caller-scopes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAOhC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;AAC5D,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC;;;GAGG;AACH,MAAM,WAAW,GACf,gFAAgF,CAAC;AAEnF,yEAAyE;AACzE,MAAM,OAAO,GAAG,oBAAoB,CAAC;AAErC,2EAA2E;AAC3E,MAAM,eAAe,GAAsB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;AAEvE,4EAA4E;AAC5E,MAAM,eAAe,GAAgD;IACnE,IAAI,EAAE,CAAC,gBAAgB,EAAE,YAAY,CAAC;IACtC,MAAM,EAAE,CAAC,gBAAgB,CAAC;CAC3B,CAAC;AAYF;;;;;;;;;GASG;AACH,SAAS,aAAa,CACpB,KAAwB;IAExB,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5B,mDAAmD;IACnD,MAAM,KAAK,GAAG,KAAK;SAChB,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC;SACpB,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,OAAO;QACL,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;QAC5B,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;KACtC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,SAAS,CAChB,KAAwB,EACxB,GAAW,EACX,KAAqC;IAErC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAC5B,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CACV,CAAC,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,CACtE,CAAC;IACF,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,WAAW,GAAI,KAAK,CAAC,MAAM,CAAY;SAC1C,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC;SAC3B,IAAI,EAAE,CAAC;IACV,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAC9B,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CACV,CAAC,GAAG,MAAM;QACV,CAAC,GAAG,KAAK,CAAC,GAAG;QACb,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAClB,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAC7B,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClD,uEAAuE;IACvE,4BAA4B;IAC5B,MAAM,GAAG,GAAG,KAAK;SACd,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC;SACxB,MAAM,CACL,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,EAC7D,MAAM,GAAG,CAAC,CACX,CAAC;IACJ,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CAAC,UAAkB;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;QACvE,MAAM,OAAO,GAAa,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC,OAAO,CAAC;QAC5E,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO;YAC3C,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE;YACvB,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAaD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,kCAAkC;IACpC,IAAI,GAAG,8BAA8B,CAAC;IACtC,WAAW,GAClB,8GAA8G,CAAC;IAEjH;;;;OAIG;IACK,KAAK,CAAC,IAAI,CAAC,GAAqB;QACtC,MAAM,KAAK,GAAS;YAClB,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,EAAE;YACT,GAAG,EAAE,IAAI;YACT,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,EAAE;YACjB,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,EAAE;SACnB,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAE3C,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,WAAW;YACT,CAAC,CAAC,KAAK;iBACF,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC;iBAC9C,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;iBAC9C,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjD,CAAC,CAAC,EAAE,CACP,CAAC;QACF,MAAM,aAAa,GAAG,WAAW;YAC/B,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACtD,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACtE,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACjD,0EAA0E;QAC1E,4CAA4C;QAC5C,MAAM,YAAY,GAAG,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,KAAK,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,YAAY;YACzB,CAAC,CAAC,IAAI,GAAG,CACL,KAAK;iBACF,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC;iBACtC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;iBAC9C,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAChD;YACH,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC;QACtB,MAAM,cAAc,GAAG,YAAY;YACjC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC9C,CAAC,CAAC,EAAE,CAAC;QAEP,OAAO;YACL,IAAI;YACJ,KAAK;YACL,GAAG;YACH,WAAW;YACX,aAAa;YACb,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YACtC,cAAc;SACf,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,GAAqB;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,GAAqB;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC7C,CAAC;QAED,2EAA2E;QAC3E,oCAAoC;QACpC,MAAM,UAAU,GAAG;YACjB,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;gBAC/C,CAAC,CAAC;oBACE,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG;oBACxB,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,KAAK,QAAQ,CAAC;iBAC9D;gBACH,CAAC,CAAC,IAAI;YACR,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;gBAC5C,CAAC,CAAC;oBACE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;oBACpB,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAC3B,MAAM,CAAC,EAAE,CAAC,SAAS,MAAM,kBAAkB,MAAM,KAAK,CACvD;iBACF;gBACH,CAAC,CAAC,IAAI;SACT;aACE,MAAM,CACL,CAAC,KAAK,EAA2C,EAAE,CAAC,KAAK,KAAK,IAAI,CACnE;aACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QAE/B,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAC7B,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;YACd,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;YACzB,GAAG,KAAK,CAAC,IAAI;YACb,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;SACvB,EACD,IAAI,CAAC,KAAK,CACX,CAAC;QAEF,MAAM,KAAK,GAAG;YACZ,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;gBAC3B,CAAC,CAAC,gBAAgB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAClD,CAAC,CAAC,IAAI;YACR,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;gBAC5B,CAAC,CAAC,oBAAoB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBACvD,CAAC,CAAC,IAAI;SACT,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,iCAAiC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAEvE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,OAAO,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/D,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,SAAS;gBACjB,YAAY,EAAE,CAAC,OAAO,CAAC;gBACvB,OAAO;aACR,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,SAAS;YACjB,YAAY,EAAE,CAAC,OAAO,CAAC;YACvB,OAAO;SACR,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"ensure-quality-caller-scopes.js","sourceRoot":"","sources":["../../src/migrations/ensure-quality-caller-scopes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAOhC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;AAC5D,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC;;;GAGG;AACH,MAAM,WAAW,GACf,gFAAgF,CAAC;AAEnF,yEAAyE;AACzE,MAAM,OAAO,GAAG,oBAAoB,CAAC;AAErC,uEAAuE;AACvE,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAK5C;;;;;;;;;;;;;;GAcG;AACH,MAAM,kBAAkB,GAEpB;IACF,QAAQ,EAAE;QACR,CAAC,UAAU,EAAE,MAAM,CAAC;QACpB,CAAC,QAAQ,EAAE,MAAM,CAAC;QAClB,CAAC,eAAe,EAAE,MAAM,CAAC;KAC1B;IACD,KAAK,EAAE;QACL,CAAC,UAAU,EAAE,MAAM,CAAC;QACpB,CAAC,QAAQ,EAAE,OAAO,CAAC;QACnB,CAAC,QAAQ,EAAE,MAAM,CAAC;QAClB,CAAC,eAAe,EAAE,OAAO,CAAC;KAC3B;CACF,CAAC;AAEF,4EAA4E;AAC5E,MAAM,eAAe,GAAgD;IACnE,IAAI,EAAE,CAAC,gBAAgB,EAAE,YAAY,CAAC;IACtC,MAAM,EAAE,CAAC,gBAAgB,CAAC;CAC3B,CAAC;AAYF;;;;;;;;;GASG;AACH,SAAS,aAAa,CACpB,KAAwB;IAExB,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5B,mDAAmD;IACnD,MAAM,KAAK,GAAG,KAAK;SAChB,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC;SACpB,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,OAAO;QACL,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;QAC5B,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;QACrC,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,SAAS,CAChB,KAAwB,EACxB,GAAW,EACX,KAAqC;IAErC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAC5B,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CACV,CAAC,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,CACtE,CAAC;IACF,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,WAAW,GAAI,KAAK,CAAC,MAAM,CAAY;SAC1C,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC;SAC3B,IAAI,EAAE,CAAC;IACV,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAC9B,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CACV,CAAC,GAAG,MAAM;QACV,CAAC,GAAG,KAAK,CAAC,GAAG;QACb,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAClB,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAC7B,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClD,uEAAuE;IACvE,4BAA4B;IAC5B,MAAM,GAAG,GAAG,KAAK;SACd,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC;SACxB,MAAM,CACL,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,EAC7D,MAAM,GAAG,CAAC,CACX,CAAC;IACJ,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CAAC,UAAkB;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;QACvE,MAAM,OAAO,GAAa,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC,OAAO,CAAC;QAC5E,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO;YAC3C,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE;YACvB,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAaD;;;;GAIG;AACH,SAAS,UAAU,CAAC,MAAwB;IAC1C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,OAAO,kCAAkC;IACpC,IAAI,GAAG,8BAA8B,CAAC;IACtC,WAAW,GAClB,8GAA8G,CAAC;IAEjH;;;;OAIG;IACK,KAAK,CAAC,IAAI,CAAC,GAAqB;QACtC,MAAM,KAAK,GAAS;YAClB,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,EAAE;YACT,GAAG,EAAE,IAAI;YACT,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,EAAE;YACjB,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,EAAE;SACnB,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAE3C,MAAM,QAAQ,GACZ,kBAAkB,CAChB,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CACtE,CAAC;QACJ,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,WAAW;YACT,CAAC,CAAC,KAAK;iBACF,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC;iBAC9C,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;iBAC9C,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjD,CAAC,CAAC,EAAE,CACP,CAAC;QACF,yEAAyE;QACzE,oDAAoD;QACpD,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAEtE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACtE,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACjD,0EAA0E;QAC1E,4CAA4C;QAC5C,MAAM,YAAY,GAAG,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,KAAK,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,YAAY;YACzB,CAAC,CAAC,IAAI,GAAG,CACL,KAAK;iBACF,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC;iBACtC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;iBAC9C,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAChD;YACH,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC;QACtB,MAAM,cAAc,GAAG,YAAY;YACjC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC9C,CAAC,CAAC,EAAE,CAAC;QAEP,OAAO;YACL,IAAI;YACJ,KAAK;YACL,GAAG;YACH,WAAW;YACX,aAAa;YACb,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YACtC,cAAc;SACf,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,GAAqB;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,GAAqB;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC7C,CAAC;QAED,2EAA2E;QAC3E,oCAAoC;QACpC,MAAM,UAAU,GAAG;YACjB,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;gBAC7B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,IAAI,CAAC,WAAW;oBAChB,CAAC,CAAC;wBACE,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG;wBACxB,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC;qBACrC;oBACH,CAAC,CAAC;wBACE,kEAAkE;wBAClE,uCAAuC;wBACvC,EAAE,EAAG,IAAI,CAAC,GAA0B,CAAC,MAAM;wBAC3C,IAAI,EAAE;4BACJ,yEAAyE;4BACzE,0EAA0E;4BAC1E,wEAAwE;4BACxE,0EAA0E;4BAC1E,kBAAkB;4BAClB,GAAG,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC;yBAClC;qBACF;YACP,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;gBAC5C,CAAC,CAAC;oBACE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;oBACpB,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAC3B,MAAM,CAAC,EAAE,CAAC,SAAS,MAAM,kBAAkB,MAAM,KAAK,CACvD;iBACF;gBACH,CAAC,CAAC,IAAI;SACT;aACE,MAAM,CACL,CAAC,KAAK,EAA2C,EAAE,CAAC,KAAK,KAAK,IAAI,CACnE;aACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QAE/B,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAC7B,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;YACd,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;YACzB,GAAG,KAAK,CAAC,IAAI;YACb,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;SACvB,EACD,IAAI,CAAC,KAAK,CACX,CAAC;QAEF,MAAM,KAAK,GAAG;YACZ,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;gBAC3B,CAAC,CAAC,gBAAgB,IAAI,CAAC,aAAa;qBAC/B,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC;qBAC3C,IAAI,CAAC,IAAI,CAAC,GAAG;gBAClB,CAAC,CAAC,IAAI;YACR,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;gBAC5B,CAAC,CAAC,oBAAoB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBACvD,CAAC,CAAC,IAAI;SACT,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,iCAAiC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAEvE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,OAAO,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/D,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,SAAS;gBACjB,YAAY,EAAE,CAAC,OAAO,CAAC;gBACvB,OAAO;aACR,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,SAAS;YACjB,YAAY,EAAE,CAAC,OAAO,CAAC;YACvB,OAAO;SACR,CAAC;IACJ,CAAC;CACF"}

package/package.json

@@ -122,7 +122,7 @@
     }
   },
   "name": "@codyswann/lisa",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/rules/eager/reset-seed-coverage.md

@@ -45,4 +45,6 @@ A project with no state contract yet is not exempt: the first work item touching
 
 Every reset, seed, verify, inventory, and classification adapter answers the **same interface** — one validated JSON result on stdout, exit 0 only when the operation both completed **and** verified, `--dry-run` mandatory before anything destructive, and a requested stage always re-checked against server-resolved identity rather than trusted. The envelope is specified in the reference body and is what makes "every repo answers the same question the same way" checkable instead of aspirational.
 
+**The production arm of this is executable, not advisory.** `scripts/lisa-destructive-guard.mjs` ships to every adopter and is wired into the envelope itself: a destructive run against a production-resolved — or unresolvable — environment has **no representable success envelope**, so it can never exit 0, and there is no parameter, field, or environment variable anywhere in the guard that changes the answer. A dry run is not an exemption, and `--dry-run` is the default rather than an opt-in. Read this as what it is: a check at the one interface every adapter passes through, which an adapter that misreports its own environment still defeats. The end state is a destructive capability that is **not deployed to production at all** — non-existence beats refusal — and that design, with the failure modes it must still close, is recorded in `docs/design/reset-production-absence.md`.
+
 Full contract (state-contract schema, check semantics, detectors, envelope schema, enforcement patterns, bootstrap procedure): [reference/reset-seed-coverage.md](../reference/reset-seed-coverage.md).

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/rules/eager/reset-seed-coverage.md

@@ -45,4 +45,6 @@ A project with no state contract yet is not exempt: the first work item touching
 
 Every reset, seed, verify, inventory, and classification adapter answers the **same interface** — one validated JSON result on stdout, exit 0 only when the operation both completed **and** verified, `--dry-run` mandatory before anything destructive, and a requested stage always re-checked against server-resolved identity rather than trusted. The envelope is specified in the reference body and is what makes "every repo answers the same question the same way" checkable instead of aspirational.
 
+**The production arm of this is executable, not advisory.** `scripts/lisa-destructive-guard.mjs` ships to every adopter and is wired into the envelope itself: a destructive run against a production-resolved — or unresolvable — environment has **no representable success envelope**, so it can never exit 0, and there is no parameter, field, or environment variable anywhere in the guard that changes the answer. A dry run is not an exemption, and `--dry-run` is the default rather than an opt-in. Read this as what it is: a check at the one interface every adapter passes through, which an adapter that misreports its own environment still defeats. The end state is a destructive capability that is **not deployed to production at all** — non-existence beats refusal — and that design, with the failure modes it must still close, is recorded in `docs/design/reset-production-absence.md`.
+
 Full contract (state-contract schema, check semantics, detectors, envelope schema, enforcement patterns, bootstrap procedure): [reference/reset-seed-coverage.md](../reference/reset-seed-coverage.md).

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/rules/reset-seed-coverage.mdc

@@ -50,4 +50,6 @@ A project with no state contract yet is not exempt: the first work item touching
 
 Every reset, seed, verify, inventory, and classification adapter answers the **same interface** — one validated JSON result on stdout, exit 0 only when the operation both completed **and** verified, `--dry-run` mandatory before anything destructive, and a requested stage always re-checked against server-resolved identity rather than trusted. The envelope is specified in the reference body and is what makes "every repo answers the same question the same way" checkable instead of aspirational.
 
+**The production arm of this is executable, not advisory.** `scripts/lisa-destructive-guard.mjs` ships to every adopter and is wired into the envelope itself: a destructive run against a production-resolved — or unresolvable — environment has **no representable success envelope**, so it can never exit 0, and there is no parameter, field, or environment variable anywhere in the guard that changes the answer. A dry run is not an exemption, and `--dry-run` is the default rather than an opt-in. Read this as what it is: a check at the one interface every adapter passes through, which an adapter that misreports its own environment still defeats. The end state is a destructive capability that is **not deployed to production at all** — non-existence beats refusal — and that design, with the failure modes it must still close, is recorded in `docs/design/reset-production-absence.md`.
+
 Full contract (state-contract schema, check semantics, detectors, envelope schema, enforcement patterns, bootstrap procedure): [reference/reset-seed-coverage.md](reset-seed-coverage-reference.mdc).

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.11.8",
+  "version": "3.12.0",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"