@codyswann/lisa 3.14.4 → 3.14.6

package/plugins/lisa/skills/lisa-github-build-intake/SKILL.md

@@ -168,6 +168,60 @@ gh label list --repo <org>/<repo> --json name \
 
 If none of the configured role labels exist on the repo → label convention not adopted, surface a setup error and exit. If the role labels exist but none are `$READY` on any open issue matching the resolved assignee filter (or any open issue when the filter is empty) → genuinely empty queue, exit cleanly with `"No GitHub issues labeled $READY. Nothing to do."`
 
+#### 2b. Lifecycle-label trust resolution (bot-authored labels are not signals)
+
+**A `status:*` label is only a lifecycle signal if a trustworthy actor applied it.** Third-party GitHub Apps write labels through the same API humans do, and at least one — `coderabbitai[bot]` — stamps `status:*` on issues seconds after filing. Measured on CodySwannGT/lisa#2460–#2540: seven of eight bot-applied lifecycle labels landed 26–118s after creation. Those labels are guesses wearing the costume of the intake contract, and they break the queue in **both** directions:
+
+- a bot-applied **`$CLAIMED`** makes an unworked issue look like somebody's active work, so no cycle picks it up and no human re-examines it (#2470 sat unworked for a day this way);
+- a bot-applied **`$READY`** puts an issue into the build queue that no human ever flipped ready (#2538), inverting the gate the ready role exists to be.
+
+Before treating any candidate's lifecycle labels as meaningful, resolve which ones are trustworthy:
+
+```bash
+TRUST_DIR=$(mktemp -d)
+trap 'rm -rf "$TRUST_DIR"' EXIT
+
+gh api "repos/<org>/<repo>/issues/<n>" > "$TRUST_DIR/issue.json"
+
+# --paginate emits ONE ARRAY PER PAGE. Reading `$t[0]` would pass only page one,
+# silently dropping later label events — the newest of which is exactly the
+# application this classifier keys on. --slurp + `add` flattens all pages.
+gh api "repos/<org>/<repo>/issues/<n>/timeline?per_page=100" --paginate --slurp \
+  > "$TRUST_DIR/pages.json"
+jq 'add // []' "$TRUST_DIR/pages.json" > "$TRUST_DIR/timeline.json"
+
+# Resolve config the SAME way `read_role` does: the local file overrides the
+# global one key by key. Reading only `.lisa.config.json` would resolve a stale
+# terminal `done` label for any project that overrides it locally, and
+# `lisa-repair-intake` WRITES on the drift direction that mistake produces.
+# Both files are optional — a missing one must not abort the cycle.
+jq -s '(.[0] // {}) * (.[1] // {})' \
+  <(cat .lisa.config.json 2>/dev/null || echo '{}') \
+  <(cat .lisa.config.local.json 2>/dev/null || echo '{}') \
+  > "$TRUST_DIR/config.json"
+
+jq -n --slurpfile i "$TRUST_DIR/issue.json" \
+      --slurpfile t "$TRUST_DIR/timeline.json" \
+      --slurpfile c "$TRUST_DIR/config.json" \
+      '{issue: $i[0], timeline: $t[0], config: $c[0]}' \
+  > "$TRUST_DIR/input.json"
+
+node "${CLAUDE_PLUGIN_ROOT}/scripts/lifecycle-label-trust.mjs" < "$TRUST_DIR/input.json"
+```
+
+The temp directory is **per invocation**. Fixed `/tmp/lisa-*.json` paths let two concurrent intake cycles interleave one issue's metadata with another's timeline, which yields a confident verdict about an item that was never examined.
+
+The classifier returns `trusted`, `untrusted`, `unknownProvenance`, and a per-label `evaluated` list carrying the actor and the latency behind each decision. **Use `trusted` wherever this skill would otherwise read the raw label set**, and specifically:
+
+- a candidate whose `$READY` is **untrusted** is **not claimable** — skip it and leave it for a human to flip genuinely ready; report it in the summary rather than dispatching it;
+- a candidate whose `$CLAIMED` is **untrusted** is **not claimed** — if its `$READY` is trusted it stays a normal candidate, exactly as if the bot label were absent.
+
+**Never unlabel to correct this.** The bot re-applies its label on each subsequent review event, so reverting produces a label-flap loop that is worse than the defect. The guard is that intake stops *believing* the label; it writes nothing. Distrust is idempotent and cannot race.
+
+A label whose provenance cannot be established (applied at creation, which GitHub records no `labeled` event for) is trusted but listed in `unknownProvenance` — failing closed there would ignore the human `status:ready` that opens the queue. Report that list; do not silently drop it.
+
+Lifecycle membership is decided by the **`status:` prefix**, never by a pinned member list. The live family has drifted 7 → 6 members, and a literal set breaks silently: an unrecognised member simply fails to match, so the guard would report clean on exactly the case it stopped covering.
+
 ### Phase 3 — Process the first eligible ready issue
 
 #### 3a.0 Repo-scope gate (claim only current-repo issues)

package/plugins/lisa/skills/lisa-repair-intake/SKILL.md

@@ -560,6 +560,101 @@ native-open / active / unresolved:
 4. Post a compact `[lisa-repair-intake]` note only when the native close-out changed state or when
    an actionable setup error must be surfaced. Do not spam already-closed terminal items.
 
+### Lifecycle label contradicts native state — walk BOTH directions
+
+A lifecycle label can lie in two ways, and historically only one of them had an owner:
+
+| label | native state | owned by |
+|---|---|---|
+| terminal `done` role | still open / active | the `Build terminal-open` section above |
+| non-terminal role (`ready`, `claimed`, `blocked`, or any other `status:` member) | closed / completed | **nothing, until now** |
+
+A pass that walks one direction leaves the other accumulating silently. Measured on the Linear TUN
+board: **TUN-556 and TUN-503 both carry a terminal `status:done` while still natively open in
+`On Dev`** — invisible to intake and indistinguishable from handled, exactly like a bot-applied
+`status:in-progress` on GitHub.
+
+Resolve both directions in one pass with the shipped detector, which always reports
+`directionsWalked` covering both, so a "clean" verdict is an assertion that both were examined.
+
+**Build the classifier input inside this cycle. Never consume a temp file another skill wrote.**
+repair-intake runs as its own cycle, so borrowing `lisa-github-build-intake`'s scratch file fails
+two ways: absent, the redirect fails and `set -e` aborts the whole cycle; stale from an earlier run
+on a *different* item, the resolver classifies that other item and this section reports `drifts: []`
+while `directionsWalked` still claims both directions were walked. That is precisely the
+silent-clean verdict this section promises cannot happen.
+
+```bash
+TRUST_DIR=$(mktemp -d)
+trap 'rm -rf "$TRUST_DIR"' EXIT
+
+gh api "repos/<org>/<repo>/issues/<n>" > "$TRUST_DIR/issue.json"
+
+# --paginate emits ONE ARRAY PER PAGE; --slurp + `add` flattens all of them so a
+# label event on page two is not silently dropped.
+gh api "repos/<org>/<repo>/issues/<n>/timeline?per_page=100" --paginate --slurp \
+  > "$TRUST_DIR/pages.json"
+jq 'add // []' "$TRUST_DIR/pages.json" > "$TRUST_DIR/timeline.json"
+
+# Same resolution `read_role` uses: local overrides global, both optional.
+# Resolving a stale terminal `done` here would make the true terminal label look
+# like `open-label-closed-state` — and that direction WRITES.
+jq -s '(.[0] // {}) * (.[1] // {})' \
+  <(cat .lisa.config.json 2>/dev/null || echo '{}') \
+  <(cat .lisa.config.local.json 2>/dev/null || echo '{}') \
+  > "$TRUST_DIR/config.json"
+
+jq -n --slurpfile i "$TRUST_DIR/issue.json" \
+      --slurpfile t "$TRUST_DIR/timeline.json" \
+      --slurpfile c "$TRUST_DIR/config.json" \
+      '{issue: $i[0], timeline: $t[0], config: $c[0]}' \
+  > "$TRUST_DIR/input.json"
+
+node "${CLAUDE_PLUGIN_ROOT}/scripts/lifecycle-label-trust.mjs" < "$TRUST_DIR/input.json"
+```
+
+**Untrusted labels are excluded from `drifts` before any repair runs** — the classifier does this
+itself, so repair must **never act on a label the classifier refused to believe**. Without it, a
+bot-applied label on a natively closed item would be advanced to the terminal `done` role by the
+`open-label-closed-state` repair, laundering the exact input the guard rejected into a real write.
+The `excluded` array reports what was held back; surface it, do not repair it.
+
+1. **`terminal-label-open-state`** → hand to the `Build terminal-open → native close` section above.
+   Do not restate its rules; the terminality test lives there (intermediate env rungs like
+   `status:on-dev` / `status:on-stg` are **not** terminal).
+2. **`open-label-closed-state`** → the previously unowned direction. The item is natively closed or
+   completed while still wearing a non-terminal lifecycle role. Advance the label to the env-resolved
+   terminal `done` role and post one idempotent `[lisa-repair-intake]` note. This is a write on
+   **Lisa's own** lifecycle surface, not a contest with another writer.
+   Apply the leaf/container check from the **Lifecycle ownership guard** section *before* this
+   branch: repair-intake owns container repair, so a natively-closed `ready` **leaf** is skipped
+   here and left to the build lane rather than claimed by this pass.
+3. **Vendor caveat — Linear.** On Linear the lifecycle surface is the native workflow **state**, not a
+   `status:*` label (see `config-resolution`). A `status:*` label there is leftover cruft that no
+   repair direction reads, which is precisely why TUN-556 and TUN-503 rotted. Treat Linear's native
+   state as authoritative and remove the contradicting stale label; never move the state to match a
+   label.
+
+Membership in the lifecycle namespace is decided by the **`status:` prefix**, never a pinned member
+list — the live family has drifted 7 → 6 members, and a literal set fails silently by simply not
+matching the member it stopped covering.
+
+### Bot-authored lifecycle label → distrust, never revert (read-only)
+
+`status:*` labels written by a **bot** actor within the plausibility window of the item's creation are
+not lifecycle signals — see `lisa-github-build-intake` Phase 2b for the measurement and the
+classifier. Report them here so an operator can see how much of the board is wearing a label nobody
+chose:
+
+- list each item alongside the untrusted label, the bot login, and the latency, from the classifier's
+  `untrusted` array;
+- list `unknownProvenance` labels separately — trusted, but unattributable;
+- **do not unlabel and do not relabel.** The bot re-applies on each subsequent review event, so a
+  reverting reconciler produces a label-flap loop that is worse than the defect. Repair happens by
+  intake declining to *believe* the label, which is idempotent and writes nothing.
+
+This class is deliberately **read-only** and never counts toward the repair cap's actionable work.
+
 ### Build parent rollup reconciliation (intermediate-env or terminal close-out)
 
 For each parent/container item (an Epic, a Linear Project, or any item — of any type — with open child work),

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.14.4",
+  "version": "3.14.6",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/scripts/lifecycle-label-trust.mjs

@@ -0,0 +1,494 @@
+#!/usr/bin/env node
+/**
+ * Lifecycle-label trust resolution — the read-side guard for #2539.
+ *
+ * ## The defect
+ *
+ * `coderabbitai[bot]` stamps a `status:*` label on issues seconds after they are
+ * filed. Measured across CodySwannGT/lisa#2460–#2540, seven of eight bot-applied
+ * lifecycle labels landed 26–118s after creation — far too fast to be a real
+ * claim. An issue wearing a bot-applied `status:in-progress` is invisible to
+ * build-intake (it is not the `ready` role) AND looks handled to a human, so
+ * nothing re-examines it. A MISSING lifecycle label is recoverable; a WRONG one
+ * is silent in both directions at once.
+ *
+ * ## Why this guard reads instead of writes
+ *
+ * The label is applied by a webhook after the fact, so no pre-tool check on this
+ * machine has anything to intercept — the write never passes through us. The two
+ * remaining options were a reconciler that reverts the label, and this: intake
+ * refusing to BELIEVE the label. The reconciler was rejected because the bot
+ * re-applies on every subsequent review event, so reverting produces a label-flap
+ * loop that is worse than the disease. Distrust is idempotent, cannot race, and
+ * writes nothing — nothing in this module mutates a tracker.
+ *
+ * ## Why actor alone is not enough
+ *
+ * #2470 (false claim, 27s) and #2494 (real, 3001s) were BOTH applied by
+ * `coderabbitai[bot]`. Rejecting every bot-authored lifecycle label would
+ * discard the true one; rejecting every fast label would discard the human
+ * `status:ready` applied at filing time, which is the queue's entry signal.
+ * Distrust therefore requires BOTH conditions: a bot actor AND a latency below
+ * the plausibility window.
+ *
+ * ## Why the member set is never hardcoded
+ *
+ * The live `status:*` family has drifted 7 → 6 members. A pinned literal breaks
+ * silently — an unrecognised member simply fails to match, so the guard reports
+ * clean on exactly the case it stopped covering. Membership is decided by the
+ * `status:` PREFIX and terminality is resolved from live config.
+ */
+
+/** Lifecycle labels are identified by this prefix, never by a pinned set. */
+export const LIFECYCLE_LABEL_PREFIX = "status:";
+
+/**
+ * Fallback terminal label used only when config supplies no `done` role.
+ *
+ * This module ships standalone into host projects and cannot import Lisa's
+ * TypeScript `BUILD_LABEL_DEFAULTS`, so the literal is repeated here — but it is
+ * NOT free to drift: `lifecycle-label-trust.test.ts` asserts it stays equal to
+ * `BUILD_LABEL_DEFAULTS.done.production` in `src/sync/lifecycle-defaults.ts`.
+ * This is a fallback only; a configured project resolves the value live.
+ */
+export const DEFAULT_TERMINAL_LIFECYCLE_LABEL = "status:done";
+
+/**
+ * Seconds below which a BOT-applied lifecycle label is not believable as a claim.
+ *
+ * Calibrated against measurement, not taste: the observed false bot claims
+ * clustered at 26–118s, while the one corroborated bot label landed at 3001s.
+ * 300s sits an order of magnitude above the noise and an order of magnitude
+ * below the real signal, so neither edge is close to the boundary.
+ */
+export const IMPLAUSIBLE_CLAIM_WINDOW_SECONDS = 300;
+
+/**
+ * Both directions a lifecycle label can contradict native state.
+ *
+ * Emitted on every drift result so a repair pass cannot walk one direction and
+ * silently leave the other accumulating — the asymmetry that let TUN-556 and
+ * TUN-503 sit on a terminal `status:done` while still natively open.
+ */
+export const LIFECYCLE_DRIFT_DIRECTIONS = [
+  "terminal-label-open-state",
+  "open-label-closed-state",
+];
+
+/**
+ * @typedef {{ readonly login?: string, readonly type?: string }} Actor
+ *
+ * @typedef {{
+ *   readonly event?: string
+ *   readonly label?: { readonly name?: string }
+ *   readonly actor?: Actor | null
+ *   readonly created_at?: string
+ * }} TimelineEvent
+ *
+ * @typedef {{
+ *   readonly label: string
+ *   readonly actor: string | null
+ *   readonly latencySeconds: number | null
+ *   readonly reason: string
+ *   readonly trusted: boolean
+ * }} EvaluatedLabel
+ */
+
+/**
+ * Is this label part of the lifecycle namespace?
+ *
+ * Prefix-only by design — see the module preamble on set drift. `status:` with
+ * no member is still lifecycle-namespaced and must not fall through as taxonomy.
+ *
+ * @param {unknown} name
+ * @returns {boolean}
+ */
+export function isLifecycleLabel(name) {
+  if (typeof name !== "string") {
+    return false;
+  }
+  return name.trim().toLowerCase().startsWith(LIFECYCLE_LABEL_PREFIX);
+}
+
+/**
+ * Is this timeline actor a bot?
+ *
+ * Checks GitHub's first-class `type` discriminator first, then falls back to the
+ * `[bot]` login suffix so an actor payload lacking `type` is still classified.
+ * A missing actor is NOT a bot: unattributable is handled separately, and
+ * guessing "bot" there would silently drop legitimate labels.
+ *
+ * @param {Actor | null | undefined} actor
+ * @returns {boolean}
+ */
+export function isBotActor(actor) {
+  if (!actor || typeof actor !== "object") {
+    return false;
+  }
+  if (typeof actor.type === "string" && actor.type.toLowerCase() === "bot") {
+    return true;
+  }
+  return (
+    typeof actor.login === "string" &&
+    actor.login.trim().toLowerCase().endsWith("[bot]")
+  );
+}
+
+/**
+ * Resolve which of an item's lifecycle labels intake is entitled to believe.
+ *
+ * Read-only and total: every lifecycle label on the item lands in exactly one of
+ * `trusted` or `untrusted`, and `evaluated` carries the reasoning for all of
+ * them so a distrust decision is auditable rather than invisible.
+ *
+ * Provenance that cannot be established (a label applied at creation, which
+ * GitHub records no `labeled` event for) is TRUSTED but reported in
+ * `unknownProvenance`. Failing closed there would make intake ignore the
+ * human `status:ready` that opens the queue, stalling every project — so the
+ * blind spot is surfaced rather than guessed at. Supplying `issueAuthor` closes
+ * it, by attributing creation-time labels to whoever filed the item.
+ *
+ * @param {{
+ *   readonly labels?: readonly (string | { readonly name?: string })[]
+ *   readonly timeline?: readonly TimelineEvent[]
+ *   readonly issueCreatedAt?: string
+ *   readonly issueAuthor?: Actor | null
+ *   readonly windowSeconds?: number
+ * }} input
+ * @returns {{
+ *   readonly trusted: readonly string[]
+ *   readonly untrusted: readonly Omit<EvaluatedLabel, "trusted">[]
+ *   readonly unknownProvenance: readonly string[]
+ *   readonly evaluated: readonly EvaluatedLabel[]
+ *   readonly hasUntrustedLifecycleLabels: boolean
+ * }}
+ */
+export function resolveTrustedLifecycleLabels(input = {}) {
+  const windowSeconds = normalizeWindow(input.windowSeconds);
+  const createdAtMs = parseTimestamp(input.issueCreatedAt);
+  const lifecycleLabels = normalizeLabelNames(input.labels).filter(
+    isLifecycleLabel
+  );
+  const latestApplication = indexLatestLabelApplications(input.timeline);
+
+  const evaluated = lifecycleLabels.map(label =>
+    evaluateLabel({
+      label,
+      application: latestApplication.get(label.trim().toLowerCase()),
+      createdAtMs,
+      issueAuthor: input.issueAuthor,
+      windowSeconds,
+    })
+  );
+
+  return {
+    trusted: evaluated.filter(entry => entry.trusted).map(entry => entry.label),
+    untrusted: evaluated
+      .filter(entry => !entry.trusted)
+      .map(({ trusted: _trusted, ...rest }) => rest),
+    unknownProvenance: evaluated
+      .filter(entry => entry.reason === "provenance-unknown")
+      .map(entry => entry.label),
+    evaluated,
+    hasUntrustedLifecycleLabels: evaluated.some(entry => !entry.trusted),
+  };
+}
+
+/**
+ * The lifecycle labels that mean "this work is finished", read from live config.
+ *
+ * Only the PRODUCTION rung of the `done` role is terminal. `status:on-dev` and
+ * `status:on-stg` are shipped-somewhere, not finished, and closing on them would
+ * retire work that still has environments to clear.
+ *
+ * @param {unknown} config a parsed `.lisa.config.json`-shaped object
+ * @returns {readonly string[]}
+ */
+export function terminalLifecycleLabels(config) {
+  const done = readPath(config, ["github", "labels", "build", "done"]);
+
+  if (typeof done === "string" && done.trim().length > 0) {
+    return [done.trim()];
+  }
+  const production = readPath(done, ["production"]);
+  if (typeof production === "string" && production.trim().length > 0) {
+    return [production.trim()];
+  }
+  return [DEFAULT_TERMINAL_LIFECYCLE_LABEL];
+}
+
+/**
+ * Detect lifecycle labels that contradict native state, in BOTH directions.
+ *
+ * `directionsWalked` is always the full direction list, so a caller reporting
+ * "clean" is asserting it looked at both — the failure mode refinement #1 of
+ * issue #2539 describes, where only the auto-complete direction was ever
+ * repaired and the reverse rotted unobserved.
+ *
+ * `excludeLabels` removes labels from consideration entirely. Callers MUST pass
+ * the untrusted set here: `open-label-closed-state` is a repair direction that
+ * WRITES (it advances the label to the terminal `done` role), so without this a
+ * bot-applied label the classifier just refused to believe would still drive a
+ * real label write — the guard would launder the very input it rejected.
+ *
+ * @param {{
+ *   readonly labels?: readonly (string | { readonly name?: string })[]
+ *   readonly state?: string
+ *   readonly terminalLabels?: readonly string[]
+ *   readonly excludeLabels?: readonly string[]
+ * }} input
+ * @returns {{
+ *   readonly drifts: readonly { direction: string, label: string }[]
+ *   readonly directionsWalked: readonly string[]
+ *   readonly excluded: readonly string[]
+ * }}
+ */
+export function detectLifecycleDrift(input = {}) {
+  const terminal = new Set(
+    (input.terminalLabels ?? terminalLifecycleLabels(undefined)).map(label =>
+      String(label).trim().toLowerCase()
+    )
+  );
+  const excluded = new Set(
+    (Array.isArray(input.excludeLabels) ? input.excludeLabels : []).map(label =>
+      String(label).trim().toLowerCase()
+    )
+  );
+  const closed =
+    String(input.state ?? "")
+      .trim()
+      .toLowerCase() === "closed";
+  const allLifecycleLabels = normalizeLabelNames(input.labels).filter(
+    isLifecycleLabel
+  );
+  const skipped = allLifecycleLabels.filter(label =>
+    excluded.has(label.trim().toLowerCase())
+  );
+  const lifecycleLabels = allLifecycleLabels.filter(
+    label => !excluded.has(label.trim().toLowerCase())
+  );
+
+  const drifts = lifecycleLabels.flatMap(label => {
+    const isTerminal = terminal.has(label.trim().toLowerCase());
+    if (isTerminal && !closed) {
+      return [{ direction: "terminal-label-open-state", label }];
+    }
+    if (!isTerminal && closed) {
+      return [{ direction: "open-label-closed-state", label }];
+    }
+    return [];
+  });
+
+  return {
+    drifts,
+    directionsWalked: LIFECYCLE_DRIFT_DIRECTIONS,
+    excluded: skipped,
+  };
+}
+
+/**
+ * Classify one lifecycle label against its most recent application.
+ *
+ * @param {{
+ *   label: string
+ *   application?: { actor?: Actor | null, createdAtMs: number | null }
+ *   createdAtMs: number | null
+ *   issueAuthor?: Actor | null
+ *   windowSeconds: number
+ * }} params
+ * @returns {EvaluatedLabel}
+ */
+function evaluateLabel(params) {
+  const { label, application, createdAtMs, issueAuthor, windowSeconds } =
+    params;
+
+  const actor = application ? application.actor : issueAuthor;
+  const hasProvenance = Boolean(application) || Boolean(issueAuthor);
+
+  if (!hasProvenance) {
+    return {
+      label,
+      actor: null,
+      latencySeconds: null,
+      reason: "provenance-unknown",
+      trusted: true,
+    };
+  }
+
+  const login = typeof actor?.login === "string" ? actor.login : null;
+
+  if (!isBotActor(actor)) {
+    return {
+      label,
+      actor: login,
+      latencySeconds: latencySeconds(createdAtMs, application),
+      reason: "human-actor",
+      trusted: true,
+    };
+  }
+
+  const latency = latencySeconds(createdAtMs, application);
+  const implausible = latency === null || latency < windowSeconds;
+
+  return {
+    label,
+    actor: login,
+    latencySeconds: latency,
+    reason: implausible
+      ? "bot-actor-implausible-latency"
+      : "bot-actor-plausible-latency",
+    trusted: !implausible,
+  };
+}
+
+/**
+ * Seconds between item creation and the label application.
+ *
+ * A creation-time label (no timeline event) is latency 0 by construction.
+ *
+ * @param {number | null} createdAtMs
+ * @param {{ createdAtMs: number | null } | undefined} application
+ * @returns {number | null}
+ */
+function latencySeconds(createdAtMs, application) {
+  if (createdAtMs === null) {
+    return null;
+  }
+  if (!application) {
+    return 0;
+  }
+  if (application.createdAtMs === null) {
+    return null;
+  }
+  return Math.max(
+    0,
+    Math.round((application.createdAtMs - createdAtMs) / 1000)
+  );
+}
+
+/**
+ * Map each lifecycle label to its MOST RECENT `labeled` event.
+ *
+ * Most-recent, not first: a human who removes the bot's label and re-applies it
+ * has made a genuine claim, and keying on the first application would keep
+ * distrusting a label the human now owns.
+ *
+ * @param {readonly TimelineEvent[] | undefined} timeline
+ * @returns {Map<string, { actor?: Actor | null, createdAtMs: number | null }>}
+ */
+function indexLatestLabelApplications(timeline) {
+  const index = new Map();
+
+  for (const event of Array.isArray(timeline) ? timeline : []) {
+    if (event?.event !== "labeled") {
+      continue;
+    }
+    const name = event.label?.name;
+    if (typeof name !== "string" || name.trim().length === 0) {
+      continue;
+    }
+    const key = name.trim().toLowerCase();
+    const createdAtMs = parseTimestamp(event.created_at);
+    const existing = index.get(key);
+    if (
+      existing &&
+      existing.createdAtMs !== null &&
+      createdAtMs !== null &&
+      existing.createdAtMs > createdAtMs
+    ) {
+      continue;
+    }
+    index.set(key, { actor: event.actor ?? null, createdAtMs });
+  }
+
+  return index;
+}
+
+/**
+ * @param {readonly (string | { readonly name?: string })[] | undefined} labels
+ * @returns {readonly string[]}
+ */
+function normalizeLabelNames(labels) {
+  return (Array.isArray(labels) ? labels : [])
+    .map(label => (typeof label === "string" ? label : label?.name))
+    .filter(name => typeof name === "string" && name.trim().length > 0);
+}
+
+/**
+ * @param {unknown} value
+ * @returns {number | null}
+ */
+function parseTimestamp(value) {
+  if (typeof value !== "string") {
+    return null;
+  }
+  const parsed = Date.parse(value);
+  return Number.isNaN(parsed) ? null : parsed;
+}
+
+/**
+ * @param {unknown} value
+ * @returns {number}
+ */
+function normalizeWindow(value) {
+  return Number.isFinite(value) && value >= 0
+    ? Number(value)
+    : IMPLAUSIBLE_CLAIM_WINDOW_SECONDS;
+}
+
+/**
+ * @param {unknown} source
+ * @param {readonly string[]} keys
+ * @returns {unknown}
+ */
+function readPath(source, keys) {
+  return keys.reduce(
+    (current, key) =>
+      current && typeof current === "object" ? current[key] : undefined,
+    source
+  );
+}
+
+/**
+ * CLI: read a `{ issue, timeline, config }` payload on stdin, print the verdict.
+ *
+ * Exits 0 even when untrusted labels are found. This is a classifier, not a
+ * gate: callers run it inside `set -e` intake bash and branch on the JSON, and a
+ * non-zero exit would abort the scan on the very issues it exists to rescue.
+ *
+ * @returns {Promise<void>}
+ */
+async function main() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(chunk);
+  }
+  const payload = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
+  const issue = payload.issue ?? {};
+
+  const trust = resolveTrustedLifecycleLabels({
+    labels: issue.labels,
+    timeline: payload.timeline,
+    issueCreatedAt: issue.created_at ?? issue.createdAt,
+    issueAuthor: issue.user ?? issue.author,
+    windowSeconds: payload.windowSeconds,
+  });
+  // Untrusted labels are excluded here rather than at the call site: the
+  // `open-label-closed-state` direction WRITES, so a caller that forgot to pass
+  // them would launder a label the classifier just rejected into a real write.
+  const drift = detectLifecycleDrift({
+    labels: issue.labels,
+    state: issue.state,
+    terminalLabels: terminalLifecycleLabels(payload.config),
+    excludeLabels: trust.untrusted.map(entry => entry.label),
+  });
+
+  process.stdout.write(`${JSON.stringify({ ...trust, ...drift }, null, 2)}\n`);
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  main().catch(error => {
+    process.stderr.write(`${error.message}\n`);
+    process.exitCode = 1;
+  });
+}