@codyswann/lisa 3.23.1 → 3.24.0

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.23.1",
+  "version": "3.24.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/hooks/block-managed-file-edits.sh

@@ -0,0 +1,171 @@
+#!/usr/bin/env bash
+# PreToolUse hook: refuse agent writes to files Lisa overwrites on every apply.
+#
+# Lisa ships templates in three modes, and only one of them destroys host edits:
+#
+#   copy-overwrite — replaced wholesale on every `lisa apply`. An edit here is
+#                    gone at the next `bun install`, silently.
+#   copy-contents  — Lisa APPENDS its lines; host content survives.
+#   create-only    — skipped when the file exists; the host owns it outright.
+#
+# So this guard covers copy-overwrite and nothing else. Blocking the other two
+# would stop agents editing files they are supposed to own, which is worse than
+# the problem being solved.
+#
+# Measured, not hypothetical. Nothing enforced this, so downstream copies were
+# edited and then silently diverged: `classify-maestro-failures.mjs` reached
+# 36,061 bytes in one fleet repo against 29,586 shipped, and five gate files in
+# another stopped receiving upstream fixes — one over roughly 138 bytes of
+# cosmetic change. The edits were made in good faith; nothing told anyone the
+# file was not theirs.
+#
+# ## Why the path, not a banner comment
+#
+# 103 of Lisa's 145 copy-overwrite files carry a "managed by Lisa" header, and
+# the other 42 CANNOT: 30 are `.json` (no comment syntax), 8 are `.gitkeep` /
+# `.keep` placeholders, and the rest are bare-value files like `.nvmrc`. A guard
+# keyed on the banner would miss every one of them, so this resolves the path
+# against the installed package instead and covers all 145 regardless of format.
+#
+# Blocked signatures:
+#   1. Write / Edit / MultiEdit / NotebookEdit whose target resolves to a
+#      copy-overwrite template in the installed Lisa package;
+#   2. Bash output redirection (`>`, `>>`, `>|`), `tee`, or `sed -i` aimed at
+#      one. Reads never fire.
+#
+# Exemptions (allowed):
+#   - `LISA_ALLOW_MANAGED_FILE_WRITE` set — the operator's explicit override,
+#     named in the refusal;
+#   - paths under `node_modules/` or `dist/` — vendored copies, not the host's;
+#   - the Lisa source repository itself, where these files are the originals and
+#     editing them is the entire point.
+set -euo pipefail
+
+input="$(cat)"
+
+command -v jq >/dev/null 2>&1 || exit 0
+
+# The operator's override, checked first so it is always the cheapest way out.
+if [ -n "${LISA_ALLOW_MANAGED_FILE_WRITE:-}" ]; then
+  exit 0
+fi
+
+tool_name="$(printf '%s' "$input" | jq -r '.tool_name // empty')"
+[ -n "$tool_name" ] || exit 0
+
+project_root="${CLAUDE_PROJECT_DIR:-$PWD}"
+package_root="$project_root/node_modules/@codyswann/lisa"
+
+# No installed Lisa means nothing to classify against. Silent, because a project
+# that has not installed Lisa is not doing anything wrong.
+[ -d "$package_root" ] || exit 0
+
+# In Lisa's own repository these files ARE the originals. Blocking here would
+# make the templates uneditable by the only agents that should edit them.
+if [ -f "$project_root/package.json" ] &&
+  grep -q '"name": *"@codyswann/lisa"' "$project_root/package.json" 2>/dev/null; then
+  exit 0
+fi
+
+# Whether a host-relative path is shipped as a copy-overwrite template.
+#
+# A few stat calls rather than an enumeration: the same relative path is probed
+# under each stack's copy-overwrite tree, so cost does not grow with the 145
+# templates.
+managed_source() {
+  local candidate="$1"
+  case "$candidate" in
+    */node_modules/* | node_modules/* | */dist/* | dist/*) return 1 ;;
+  esac
+  # Normalise to a project-relative path so an absolute target still matches.
+  local rel="${candidate#"$project_root"/}"
+  rel="${rel#./}"
+  [ -n "$rel" ] || return 1
+  local stack
+  for stack in "$package_root"/*/copy-overwrite; do
+    [ -d "$stack" ] || continue
+    if [ -e "$stack/$rel" ]; then
+      printf '%s' "${stack#"$package_root"/}/$rel"
+      return 0
+    fi
+  done
+  return 1
+}
+
+refuse() {
+  local target="$1"
+  local source="$2"
+  cat >&2 <<EOF
+BLOCKED: refusing to write \`$target\`.
+
+WHY: this file is Lisa-managed. It is shipped as a **copy-overwrite** template
+(\`$source\` in the installed package) and is replaced wholesale on every
+\`lisa apply\` — which runs on every \`bun install\`. Your edit would survive
+until the next install and then vanish, with nothing reporting that it had.
+
+That is not hypothetical: downstream copies edited this way diverged silently
+until they stopped receiving upstream fixes entirely.
+
+WHERE IT GOES INSTEAD — take the first one that fits:
+
+1. The change should apply everywhere. Edit the template upstream in Lisa and
+   release it — \`/lisa:cross-pollinate\`, or an issue on CodySwannGT/lisa.
+   That is the only edit that survives an install.
+
+2. Only this project needs to differ. Look for the local escape hatch beside the
+   file — Lisa ships \`.local\` variants for the configs that support one
+   (\`eslint.config.local.ts\`, \`tsconfig.local.json\`, \`audit.ignore.local.json\`,
+   and others). Those are yours and are never overwritten.
+
+3. The behaviour is configurable rather than hardcoded. Check \`.lisa.config.json\`
+   — the \`gates\` block in particular decides which checks run and what command
+   proves each one, so a project can substitute its own task without touching a
+   shipped file.
+
+4. You believe this file should not be Lisa-managed at all. That is a real
+   argument and it belongs upstream, not in a local edit that will be erased.
+
+If a human explicitly asked for this edit, they can re-run with
+\`LISA_ALLOW_MANAGED_FILE_WRITE=1\` set, which bypasses this guard.
+EOF
+  exit 2
+}
+
+case "$tool_name" in
+  Write | Edit | MultiEdit | NotebookEdit | Update)
+    paths="$(printf '%s' "$input" | jq -r '
+      [ .tool_input.file_path?,
+        .tool_input.path?,
+        .tool_input.notebook_path?,
+        (.tool_input.edits? // [] | .[].file_path?)
+      ] | map(select(. != null and . != "")) | .[]' 2>/dev/null || true)"
+    while IFS= read -r candidate; do
+      [ -n "$candidate" ] || continue
+      if source_path="$(managed_source "$candidate")"; then
+        refuse "$candidate" "$source_path"
+      fi
+    done <<EOF
+$paths
+EOF
+    ;;
+  Bash)
+    command_str="$(printf '%s' "$input" | jq -r '.tool_input.command // empty')"
+    [ -n "$command_str" ] || exit 0
+    # Write signatures only. A bare mention is a read and stays allowed — the
+    # path has to be the target of a redirection, a tee, or an in-place sed.
+    # `>>?\|?` covers `>`, `>>`, and the noclobber override `>|`.
+    while IFS= read -r token; do
+      [ -n "$token" ] || continue
+      if source_path="$(managed_source "$token")"; then
+        refuse "$token" "$source_path"
+      fi
+    done <<EOF
+$(printf '%s' "$command_str" |
+  grep -Eo ">>?\|?[[:space:]]*['\"]?[^ |;&'\"]+|tee([[:space:]]+-[a-zA-Z]+)*[[:space:]]+['\"]?[^ |;&'\"]+|sed[[:space:]]+[^|;&]*-i[^|;&]*[[:space:]]['\"]?[^ |;&'\"]+" 2>/dev/null |
+  sed -E "s/^(>>?\|?|tee([[:space:]]+-[a-zA-Z]+)*|sed[[:space:]]+[^|;&]*-i[^|;&]*)[[:space:]]*//" |
+  tr -d "\"'" || true)
+EOF
+    ;;
+esac
+
+exit 0

package/plugins/src/base/rules/reference/config-resolution.md

@@ -611,8 +611,8 @@ cannot: the relative rank of environments. `deploy.branches` is an unordered map
 so without `deploy.order` the rank of a custom env name (`preprod`, `qa`, …) is
 unknowable.
 
-The back-sync GitHub Action (`reusable-claude-sync-down-branches.yml`) consumes
-`deploy.order` to derive its source → target chain. It walks the order from the
+The Lisa back-sync flow consumes `deploy.order` to derive its source → target
+chain. It walks the order from the
 **highest** environment **down**, mapping each env's branch to the next-lower
 env's branch:
 

package/plugins/src/base/skills/lisa-doctor/SKILL.md

@@ -119,11 +119,9 @@ this order:
      single distinct branch, so there is nothing to back-sync, the chain is the empty no-op, and
      `deploy.order` is not required. Do not WARN.
    - `WARN` when `deploy.branches` resolves to **more than one distinct** branch but `deploy.order`
-     is absent. Config-driven back-sync (`reusable-claude-sync-down-branches.yml`) cannot derive a
-     source→target chain without the env ranking; the repo must either add `deploy.order`
-     (low→high, e.g. `["dev","staging","production"]`) or pass an explicit `chain` in its
-     `claude-sync-down-branches.yml` wrapper. WARN not FAIL because the explicit-chain override is
-     a valid configuration.
+     is absent. Config-driven back-sync cannot derive a source→target chain without the env
+     ranking; the repo must add `deploy.order` (low→high, e.g.
+     `["dev","staging","production"]`).
    - `FAIL` when `deploy.order` is present but its env-name set does not exactly match the keys of
      `deploy.branches` (every env in one must appear in the other). A mismatch silently breaks the
      derived chain.

package/plugins/src/base/skills/lisa-drive-pr-to-merge/SKILL.md

@@ -58,9 +58,9 @@ Use plain `gh` + `git` so Claude and Codex execute identically.
 
 ## 0. Take the babysitter lease
 
-This skill is the branch's owner while it runs. Declare that ownership so the
-CI auto-fix workflow (`reusable-claude-ci-auto-fix.yml`) stands down instead of
-pushing competing fixes to the same branch (the single-writer rule):
+This skill is the branch's owner while it runs. Declare that ownership so any CI
+repair automation stands down instead of pushing competing fixes to the same
+branch (the single-writer rule):
 
 ```bash
 gh label create "lisa:babysitter-on-duty" \

package/plugins/src/base/skills/lisa-sync-down/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: lisa-sync-down
-description: This skill should be used to run a back-sync of an environment branch DOWN the deploy chain on demand — propagating merges (e.g. hotfixes) from a higher environment to every lower one. Given a source environment name or branch (e.g. `production`), it derives the source→target chain from `.lisa.config.json` `deploy.order` + `deploy.branches` (the same chain the `claude-sync-down-branches.yml` GitHub Action uses on PR merge), then for each downward hop creates a sync branch, merges, resolves conflicts, opens or updates a PR, and enables auto-merge. Runnable by a developer locally or by GitHub Actions.
+description: This skill should be used to run a back-sync of an environment branch DOWN the deploy chain on demand — propagating merges (e.g. hotfixes) from a higher environment to every lower one. Given a source environment name or branch (e.g. `production`), it derives the source→target chain from `.lisa.config.json` `deploy.order` + `deploy.branches`, then for each downward hop creates a sync branch, merges, resolves conflicts, opens or updates a PR, and enables auto-merge. Runnable by a developer locally or by CI.
 allowed-tools: ["Bash", "Read", "Edit", "Write", "Grep", "Glob"]
 ---
 
@@ -8,9 +8,7 @@ allowed-tools: ["Bash", "Read", "Edit", "Write", "Grep", "Glob"]
 
 Back-sync a source environment branch DOWN the deploy chain, one hop at a time,
 all the way to the lowest environment. This is the on-demand, manual-or-CI
-counterpart to the `claude-sync-down-branches.yml` GitHub Action, which runs the
-same logic automatically when a PR is merged. Both derive their chain from the
-same config, so a manual run and an automatic run behave identically.
+entrypoint for applying the config-derived sync chain.
 
 Argument (`$ARGUMENTS`): the **source** to start syncing from. Accepts:
 
@@ -156,16 +154,11 @@ needs human conflict resolution.
 ## Invocation
 
 - **Developer:** `/lisa:sync-down production` (or a branch: `/lisa:sync-down main`).
-- **GitHub Actions:** the PR-merge path is already covered by
-  `claude-sync-down-branches.yml`. For an on-demand CI run, invoke this skill from a
-  `workflow_dispatch` job via `anthropics/claude-code-action` with the prompt
-  `/lisa:sync-down <env>` and `CLAUDE_CODE_OAUTH_TOKEN` — the same identity the
-  Action uses so the resulting PRs trigger downstream CI.
-
-## Relationship to the GitHub Action
-
-This skill and `reusable-claude-sync-down-branches.yml` are deliberately
-equivalent: same config-derived chain, same merge/conflict strategy, same
-deterministic sync-branch naming, same auto-merge behavior. The Action is the
-automatic (PR-merged) trigger; this skill is the manual/dispatch trigger. Keep
-their chain-derivation and conflict-resolution rules in sync when either changes.
+- **CI:** invoke this skill from the runtime-native automation surface with
+  `/lisa:sync-down <env>` when an automatic sync is required.
+
+## Contract
+
+This skill is the source of truth for back-sync behavior: config-derived chain,
+merge/conflict strategy, deterministic sync-branch naming, and auto-merge
+behavior all live here.

package/rails/deletions.json

@@ -9,6 +9,11 @@
     ".claude/skills/plan-lower-code-complexity",
     ".claude/skills/plan-reduce-max-lines",
     ".claude/skills/plan-reduce-max-lines-per-function",
-    ".claude/rules/rails-conventions.md"
+    ".claude/rules/rails-conventions.md",
+    ".github/workflows/claude-code-review-response.yml",
+    ".github/workflows/claude-nightly-code-complexity.yml",
+    ".github/workflows/claude-nightly-test-coverage.yml",
+    ".github/workflows/claude-nightly-test-improvement.yml",
+    ".github/workflows/claude-sync-down-branches.yml"
   ]
 }

package/scripts/build-plugins.sh

@@ -121,7 +121,8 @@ if [ -d "$SRC_DIR/base/hooks" ]; then
   mkdir -p "$HOST_GUARD_DIR"
 fi
 for guard in block-no-verify parity-safety-net block-shell-json-parsing \
-  block-instruction-file-edits block-direct-issue-create; do
+  block-instruction-file-edits block-direct-issue-create \
+  block-managed-file-edits; do
   if [ -f "$SRC_DIR/base/hooks/$guard.sh" ]; then
     materialize "$SRC_DIR/base/hooks/$guard.sh" "$HOST_GUARD_DIR/$guard.sh"
     chmod +x "$HOST_GUARD_DIR/$guard.sh"

package/scripts/detect-stale-workflow-inputs.mjs

@@ -2,14 +2,14 @@
 /**
  * Deterministic detector for stale reusable-workflow inputs (issue #1423).
  *
- * Context: a caller workflow (e.g. a consumer repo's `.github/workflows/claude.yml`)
+ * Context: a caller workflow (e.g. a consumer repo's `.github/workflows/example-agent.yml`)
  * invokes one of Lisa's reusable workflows via `uses: <owner>/<repo>/.github/workflows/
  * reusable-*.yml@<ref>` and passes a `with:` block. GitHub hard-fails the run at
  * startup if that `with:` block names an input the reusable workflow's
  * `workflow_call.inputs` no longer declares (e.g. an early-generation caller still
- * passing `package_manager`, which `reusable-claude.yml` never declared). Because
- * `claude.yml` is a create-only file Lisa never overwrites, an affected repo can
- * never self-heal — the drift has to be found and reported (or migrated) instead.
+ * passing `package_manager`, which `reusable-example.yml` never declared). Because
+ * create-only workflow callers are never overwritten, an affected repo cannot
+ * self-heal — the drift has to be found and reported (or migrated) instead.
  *
  * This script scans every workflow file directly under a project's
  * `.github/workflows/` for such callers, resolves each referenced reusable
@@ -17,8 +17,8 @@
  * `.github/workflows/`, the source of truth for the current contract), and reports
  * any caller `with:` key absent from the declared set as `stale`.
  *
- * It is intentionally NOT a general YAML parser — like `migrate-deploy-order.sh`,
- * it does targeted, indentation-aware line scanning of the two shapes it cares
+ * It is intentionally NOT a general YAML parser. It does targeted,
+ * indentation-aware line scanning of the two shapes it cares
  * about (`uses:` + sibling `with:`, and `workflow_call: inputs:`). That is
  * sufficient for Lisa-authored workflow files, which have a stable, predictable
  * structure, and keeps the detector dependency-free (Node built-ins only, no
@@ -91,7 +91,7 @@ function isDirectory(target) {
  * @param {string} contractsRoot - directory holding the current reusable
  *   workflow files (basename-addressed).
  * @param {string} reusableFile - basename of the referenced reusable
- *   workflow file (e.g. `reusable-claude.yml`).
+ *   workflow file (e.g. `reusable-example.yml`).
  * @returns {string[] | null} declared inputs, or `null` if the contract file
  *   isn't present under `contractsRoot` (unresolvable, not necessarily stale).
  */

package/scripts/generate-upstream-evidence-manifest.mjs

@@ -104,6 +104,7 @@ const tracked = execFileSync("git", ["ls-files", "-z"], {
 const explicitlyIncluded = ["scripts/generate-upstream-evidence-manifest.mjs"];
 const publicSurfaceMembers = [...new Set([...tracked, ...explicitlyIncluded])]
   .filter(file => file !== "src/core/upstream-evidence-manifest.ts")
+  .filter(file => existsSync(path.join(repoRoot, file)))
   .filter(file => {
     const segments = file.split("/");
     const basename = segments.at(-1) ?? "";

package/scripts/lisa-enforcement-fallback.sh

@@ -67,7 +67,8 @@ repo_root="${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null)}"
 # `plugins/` directory to fall back on.
 status=0
 for guard in block-no-verify parity-safety-net block-shell-json-parsing \
-  block-instruction-file-edits block-direct-issue-create; do
+  block-instruction-file-edits block-direct-issue-create \
+  block-managed-file-edits; do
   script=""
   for candidate in \
     "$repo_root/scripts/lisa-hooks/$guard.sh" \

package/scripts/verify-health-deterministic-built.mjs

@@ -278,7 +278,7 @@ try {
     "offline starter inspection remains an explicit warning"
   );
 
-  const callerPath = path.join(project, ".github", "workflows", "claude.yml");
+  const callerPath = path.join(project, ".github", "workflows", "ci.yml");
   const callerOriginal = await readFile(callerPath, "utf8");
   await writeFile(
     callerPath,

package/typescript/deletions.json

@@ -33,7 +33,20 @@
     ".github/workflows/reusable-claude-nightly-code-complexity.yml",
     ".github/workflows/reusable-claude-nightly-test-coverage.yml",
     ".github/workflows/reusable-claude-nightly-test-improvement.yml",
-    ".github/workflows/load-test.yml"
+    ".github/workflows/load-test.yml",
+    ".github/workflows/claude-ci-auto-fix.yml",
+    ".github/workflows/claude-code-review-response.yml",
+    ".github/workflows/claude-deploy-auto-fix.yml",
+    ".github/workflows/claude-nightly-code-complexity.yml",
+    ".github/workflows/claude-nightly-test-coverage.yml",
+    ".github/workflows/claude-nightly-test-improvement.yml",
+    ".github/workflows/claude-sync-down-branches.yml",
+    ".github/workflows/claude.yml",
+    ".github/workflows/reusable-claude-sync-down-branches.yml",
+    ".github/workflows/reusable-claude-nightly-code-complexity-rails.yml",
+    ".github/workflows/reusable-claude-nightly-jira-triage.yml",
+    ".github/workflows/reusable-claude-nightly-test-coverage-rails.yml",
+    ".github/workflows/reusable-claude-nightly-test-improvement-rails.yml"
   ],
   "keep": []
 }