@codyswann/lisa 3.26.1 → 3.26.3

package/all/copy-overwrite/scripts/check-state-classification.mjs

@@ -560,6 +560,37 @@ export function run(options = {}) {
     };
   }
 
+  // Parsed is not the same as shaped. `readJsonFile` proves only that the bytes
+  // were JSON, and `compareInventory` reads `inventory.entities` — so `null`
+  // throws a TypeError on property access and the CLI dies with a stack trace
+  // instead of emitting an `invalid` envelope, while an array or a string
+  // silently yields zero entities and every declared entity reads as
+  // unconfirmed. A wrong-shaped inventory must be reported as invalid, not
+  // mistaken for an empty one.
+  const inventoryValue = inventoryRead.value;
+  if (
+    inventoryValue === null ||
+    typeof inventoryValue !== "object" ||
+    Array.isArray(inventoryValue) ||
+    !Array.isArray(inventoryValue.entities)
+  ) {
+    return {
+      findings: [
+        {
+          code: "invalid-inventory",
+          subject: path.relative(root, inventoryPath),
+          message:
+            "parsed as JSON but is not an inventory: expected an object with an `entities` array. Regenerate it with the project's `state:inventory` adapter.",
+          severity: "error",
+        },
+      ],
+      envelope: envelopeFor("invalid", {
+        contractVersion: contract.contractVersion,
+        reason: `runtime inventory at ${path.relative(root, inventoryPath)} parsed but has the wrong shape — an inventory that cannot be read is not an empty inventory.`,
+      }),
+    };
+  }
+
   const verdict = compareInventory({
     contract,
     inventory: inventoryRead.value,

package/all/copy-overwrite/scripts/lisa-gates.mjs

@@ -63,6 +63,8 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 
+import { invokedAsScript } from "./lib/invoked-as-script.mjs";
+
 /** Enforcement levels a moment may carry. */
 export const LEVELS = ["required", "optional", "off"];
 
@@ -1307,7 +1309,14 @@ function main() {
   );
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+// Realpath both sides rather than comparing URL strings. A raw comparison
+// answers "no" through a symlinked checkout, a git worktree, or a /tmp path on
+// macOS — all three of which this fleet runs in — so the module would load, run
+// nothing, and exit 0. For THIS file that is the worst possible silence: the
+// quality workflow pipes its output into a resolver that reads empty input as
+// `[]`, reports `configured=false` for every job, and runs the fallback. The
+// whole gate registry would be bypassed with nothing reporting it.
+if (invokedAsScript(import.meta.url)) {
   try {
     main();
   } catch (err) {

package/all/copy-overwrite/scripts/lisa-hooks/block-managed-file-edits.sh

@@ -14,20 +14,29 @@
 # would stop agents editing files they are supposed to own, which is worse than
 # the problem being solved.
 #
-# WITHIN copy-overwrite there are two populations with OPPOSITE consequences,
-# and an earlier version of this guard described only one of them:
+# The name `copy-overwrite` is misleading, and two successive versions of this
+# guard got the consequence wrong by trusting it. MEASURED, by mutating four
+# files in a scratch project and running a real `lisa apply` against them:
 #
-#   hash-tracked guards (the `.mjs` scripts, listed in the Lisa-owned ledger)
-#     — an edit classifies as `host-modified` and `lisa apply` PRESERVES it.
-#       The file silently forks and stops receiving upstream fixes while looking
-#       current. Nothing is deleted; that is what makes it hard to notice.
-#   everything else (`.json` configs and friends)
-#     — replaced wholesale on the next apply, which runs on every install.
-#       The edit vanishes.
+#   scripts/lisa-gates.mjs   (ledger-tracked)  → SURVIVED
+#   .lintstagedrc.json       (untracked, JSON) → SURVIVED
+#   .prettierignore          (untracked, text) → SURVIVED
+#   .yamllint                (untracked, text) → SURVIVED
 #
-# The refusal branches on ledger membership so it states the consequence that
-# actually applies, rather than describing both and leaving the reader to work
-# out which they are in.
+#   Summary line: `Overwritten: 0 files` / `Out of date: 3 files (managed
+#   templates changed; NOT updated)`.
+#
+# copy-overwrite overwrites an UNMODIFIED copy — it refreshes. It does not
+# overwrite a host-edited one, in any population tested. So the harm is the same
+# for both, and it is not deletion:
+#
+#   THE FILE SILENTLY FORKS. It keeps looking current while every upstream fix
+#   stops reaching it. Nothing is lost, which is exactly what makes it invisible.
+#
+# Ledger membership changes the MESSAGE apply prints, not the outcome — tracked
+# files get a provenance verdict naming the fork and offering
+# `lisa-guard-capabilities:`; untracked ones get a bare "Out of date" warning.
+# The refusal branches on that so the reader sees the words apply will use.
 #
 # Measured, not hypothetical. Nothing enforced this, so downstream copies were
 # edited and then silently diverged: `classify-maestro-failures.mjs` reached
@@ -177,12 +186,12 @@ managed_source() {
 
 # Whether a destination is a ledger-tracked Lisa-owned guard.
 #
-# The two populations behind this guard have OPPOSITE consequences, so the
-# refusal has to know which one it is looking at rather than describing both and
-# leaving the reader to guess. A guard in the content-hash ledger classifies as
-# `host-modified` once edited and `lisa apply` PRESERVES it; anything else is
-# replaced wholesale. Both are bad, for different reasons, and the right next
-# step differs too.
+# Both populations are PRESERVED once edited (measured — see the header). What
+# membership changes is what apply prints and what the escape hatch is: a tracked
+# guard gets a provenance verdict and can declare `lisa-guard-capabilities:`,
+# while an untracked template gets a bare "Out of date" line and `.lisaignore`.
+# The refusal quotes the words the reader will actually see, so it has to know
+# which side it is on.
 ledger_tracked() {
   local rel="$1"
   local ledger="$package_root/dist/core/lisa-owned-hash-ledger.js"
@@ -196,15 +205,21 @@ refuse() {
   local rel="$3"
   local consequence
   if ledger_tracked "$rel"; then
-    consequence="This is a Lisa-owned guard, tracked by content hash. \`lisa apply\`
-will PRESERVE your edit rather than overwrite it — and that is the trap. The
-file silently forks: it keeps looking current while every upstream fix stops
-reaching it. One repository in this fleet is carrying 243 lines of divergence
-nobody knew about, in a guard that had quietly stopped receiving fixes."
+    consequence="\`lisa apply\` will KEEP your edit — this is a Lisa-owned guard,
+and apply says so: \"its contents match no Lisa release, so Lisa cannot tell
+whether it is out of date or deliberately stronger. Kept yours.\"
+
+That is the trap. Nothing is deleted; the file silently FORKS. It keeps looking
+current while every upstream fix stops reaching it. One repository in this fleet
+carries 243 lines of divergence nobody knew about, in a guard that had quietly
+stopped receiving fixes."
   else
-    consequence="This template is not hash-tracked, so \`lisa apply\` REPLACES it
-wholesale — and apply runs on every \`bun install\`. Your edit survives until the
-next install and then vanishes, with nothing reporting that it had."
+    consequence="\`lisa apply\` will KEEP your edit and report the file as
+\"Out of date, not updated\" on every run from now on.
+
+That is the trap. Nothing is deleted; the file silently FORKS, stops receiving
+upstream changes, and adds a permanent warning line that the next person learns
+to scroll past."
   fi
   cat >&2 <<EOF
 BLOCKED: refusing to write \`$target\`.
@@ -231,20 +246,21 @@ WHERE IT GOES INSTEAD — take the first one that fits:
    shipped file.
 
 4. This project has deliberately FORKED this file and means to keep its own
-   version. What to do depends on which population it is, and \`.lisaignore\` is
-   the WRONG answer for a hash-tracked guard:
+   version. Apply already preserves the edit either way, so what is left to
+   choose is whether the fork stays VISIBLE. Keeping it visible is the point:
 
-   - **A Lisa-owned guard (hash-tracked).** Do NOT add it to \`.lisaignore\`. The
-     ledger already preserves your version, so ignoring it buys nothing — and it
-     silences the standoff \`lisa doctor\` reports on every run, replacing a true
-     warning with the line "Enforcement guards match the installed Lisa
+   - **A Lisa-owned guard (hash-tracked).** Do NOT add it to \`.lisaignore\`.
+     Apply preserves your version regardless, so ignoring it buys nothing — and
+     it silences the standoff \`lisa doctor\` reports on every run, replacing a
+     true warning with the line "Enforcement guards match the installed Lisa
      version", which is then false. A visible, resolvable fork becomes a silent
-     permanent one. Keep the warning and resolve the fork: upstream what is
-     general, or accept the standoff knowingly. To make this one edit, use the
-     override below.
-   - **Any other template.** \`.lisaignore\` is the right answer. Nothing else
-     preserves it, and the entry declares the divergence where the next person
-     can see it.
+     permanent one. Instead declare what your version defends with a
+     \`lisa-guard-capabilities:\` line; apply then classifies it \`host-ahead\`
+     and says so by name, rather than reporting that it cannot tell.
+   - **Any other template.** \`.lisaignore\` records the divergence where the
+     next person can see it and stops the recurring "Out of date" line. It does
+     not preserve the file — apply already does — so use it to DECLARE a fork
+     you have decided on, never to quiet one you have not.
 
 5. You believe this file should not be Lisa-managed at all. That is a real
    argument and it belongs upstream, not in a local edit that will be erased.

package/dist/core/lisa-owned-hash-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA6UjC,CAAC"}
+{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAiVjC,CAAC"}

package/dist/core/lisa-owned-hash-ledger.js

@@ -111,6 +111,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
     "scripts/check-skipped-required-checks.mjs": Object.freeze([
         "0a8b14790f38e00e5abfc665d3e3d2c29e0a139a2a22c4a65e0c08547b42fb7f",
         "1bcd3f065465731df4eb02b93b73a0162d287e365ed1a396138d97d71d403b31",
+        "444210c8fbfca1d3e6ae0e180fe95752e10152610ad349ffea377136f4ae8cf7",
         "48d3fa3043e144bcf52feb0e20db887d75c7ebda3b1fa708fe93f6554f6bec78",
         "5af5f112ba258c4874a65c72c8bed12165e75e4df407265eb46ee9c89c4e0e53",
         "86de31fbda9dd26a938bf30846c5fc70744cf199df7d475a35f3f25dbc0f7c2f",
@@ -120,6 +121,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
     ]),
     "scripts/check-state-classification.mjs": Object.freeze([
         "94dc98e0bbfcf8d43cba035d4805a1c5d61a3a0db88faa791e8e06e34e741f46",
+        "96599f9cf25d7d96afc82a92c477ca851e3fa1f918a06a5b81a29dd1b0039f38",
         "ac539349c86a7b5b0083ec0e6aaf0eb4c3e40fbd4dc31511c6460a2bad7af9a5",
         "b218927f64a3db4f37762b60014e29d85a46899f4a0d17fcecc7782ce48bc499",
     ]),
@@ -193,6 +195,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "79b646d543b541c096d79526fa09dbda3408667ba1a99ee833f94668b181433b",
         "7d89a49da89895a3e377702d0049e1dbcc7ea666dcfa3749874f0986db31ee1a",
         "9195c267d98f2fa8071fc0bd2d5623a7ab82f82d136bdb23061f89a2c1db6efe",
+        "98652623c7451d05e48239e1678ad7977a323eaf7ff5ca4b4f3bbc0798396859",
         "bba52f26e70e0dc399a8ed8ea9cbd3885a18f08401b28bd18871a1af4fbca375",
         "cc4270e365f53c60a5eefb58a8ac8e22be184c0821fcdcc8fe67bcfc1df5e3dd",
         "dbca450e5a17133841ab015e71808feb028996f8297fda362dbeca4f07af2352",
@@ -219,6 +222,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "133acf329582c5d4df9deb6a297df13216993c1bfec0b7df0663c69a1e2bb0db",
         "18aebaef5ea9bf6af220dc9beef80a5cfb37282c6a53047783b4cc96d8daa4e3",
         "3882bd338e65b9db9e97aa9e70426f0f7a0d191539df51636e1a5e93a2501137",
+        "92e0ff52fcb29bc112ddcf1c3d85432032596572a84f3c5806a5b0c286ae55b3",
         "c1b2abf324269c0248136500eb37d7c43559552f152a7c5d07a23c219fdc70b2",
     ]),
     "scripts/lisa-hooks/block-no-verify.sh": Object.freeze([

package/dist/core/lisa-owned-hash-ledger.js.map

@@ -1 +1 @@
-{"version":3,"file":"lisa-owned-hash-ledger.js","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,6EAA6E;AAE7E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAE/B,MAAM,CAAC,MAAM,CAAC;IAChB,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,+BAA+B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC7C,kEAAkE;KACnE,CAAC;IACF,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC;QACrC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC;QACvC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gCAAgC,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gCAAgC,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,sCAAsC,EAAE,MAAM,CAAC,MAAM,CAAC;QACpD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,2CAA2C,EAAE,MAAM,CAAC,MAAM,CAAC;QACzD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wCAAwC,EAAE,MAAM,CAAC,MAAM,CAAC;QACtD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,qCAAqC,EAAE,MAAM,CAAC,MAAM,CAAC;QACnD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,yCAAyC,EAAE,MAAM,CAAC,MAAM,CAAC;QACvD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,uCAAuC,EAAE,MAAM,CAAC,MAAM,CAAC;QACrD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,+BAA+B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC7C,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,oCAAoC,EAAE,MAAM,CAAC,MAAM,CAAC;QAClD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,sCAAsC,EAAE,MAAM,CAAC,MAAM,CAAC;QACpD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,iDAAiD,EAAE,MAAM,CAAC,MAAM,CAAC;QAC/D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,oDAAoD,EAAE,MAAM,CAAC,MAAM,CAAC;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gDAAgD,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,uCAAuC,EAAE,MAAM,CAAC,MAAM,CAAC;QACrD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gDAAgD,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,yCAAyC,EAAE,MAAM,CAAC,MAAM,CAAC;QACvD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,qCAAqC,EAAE,MAAM,CAAC,MAAM,CAAC;QACnD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,2BAA2B,EAAE,MAAM,CAAC,MAAM,CAAC;QACzC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,kCAAkC,EAAE,MAAM,CAAC,MAAM,CAAC;QAChD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1C,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wCAAwC,EAAE,MAAM,CAAC,MAAM,CAAC;QACtD,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,sDAAsD,EAAE,MAAM,CAAC,MAAM,CAAC;QACpE,kEAAkE;KACnE,CAAC;IACF,oDAAoD,EAAE,MAAM,CAAC,MAAM,CAAC;QAClE,kEAAkE;KACnE,CAAC;IACF,uCAAuC,EAAE,MAAM,CAAC,MAAM,CAAC;QACrD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wCAAwC,EAAE,MAAM,CAAC,MAAM,CAAC;QACtD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;CACH,CAAC,CAAC;AACH,sEAAsE"}
+{"version":3,"file":"lisa-owned-hash-ledger.js","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,6EAA6E;AAE7E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAE/B,MAAM,CAAC,MAAM,CAAC;IAChB,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,+BAA+B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC7C,kEAAkE;KACnE,CAAC;IACF,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC;QACrC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC;QACvC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gCAAgC,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gCAAgC,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,sCAAsC,EAAE,MAAM,CAAC,MAAM,CAAC;QACpD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,2CAA2C,EAAE,MAAM,CAAC,MAAM,CAAC;QACzD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wCAAwC,EAAE,MAAM,CAAC,MAAM,CAAC;QACtD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,qCAAqC,EAAE,MAAM,CAAC,MAAM,CAAC;QACnD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,yCAAyC,EAAE,MAAM,CAAC,MAAM,CAAC;QACvD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,uCAAuC,EAAE,MAAM,CAAC,MAAM,CAAC;QACrD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,+BAA+B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC7C,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,oCAAoC,EAAE,MAAM,CAAC,MAAM,CAAC;QAClD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,sCAAsC,EAAE,MAAM,CAAC,MAAM,CAAC;QACpD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,iDAAiD,EAAE,MAAM,CAAC,MAAM,CAAC;QAC/D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,oDAAoD,EAAE,MAAM,CAAC,MAAM,CAAC;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gDAAgD,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,uCAAuC,EAAE,MAAM,CAAC,MAAM,CAAC;QACrD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gDAAgD,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,yCAAyC,EAAE,MAAM,CAAC,MAAM,CAAC;QACvD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,qCAAqC,EAAE,MAAM,CAAC,MAAM,CAAC;QACnD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,2BAA2B,EAAE,MAAM,CAAC,MAAM,CAAC;QACzC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,kCAAkC,EAAE,MAAM,CAAC,MAAM,CAAC;QAChD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1C,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wCAAwC,EAAE,MAAM,CAAC,MAAM,CAAC;QACtD,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,sDAAsD,EAAE,MAAM,CAAC,MAAM,CAAC;QACpE,kEAAkE;KACnE,CAAC;IACF,oDAAoD,EAAE,MAAM,CAAC,MAAM,CAAC;QAClE,kEAAkE;KACnE,CAAC;IACF,uCAAuC,EAAE,MAAM,CAAC,MAAM,CAAC;QACrD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wCAAwC,EAAE,MAAM,CAAC,MAAM,CAAC;QACtD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;CACH,CAAC,CAAC;AACH,sEAAsE"}

package/dist/core/upstream-evidence-manifest.js

@@ -3,16 +3,16 @@
 export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "all/copy-contents/.gitattributes": "9d3831007e681186a3673e1037ef3fc82980cab2fc04e27c0868e562912c9e9f",
     "all/copy-contents/gitignore": "8104ccd32d7e6137cae706511c5037d11d6b6045b8e2a9bb7b3a48a81c053cfa",
-    "all/copy-overwrite/scripts/check-state-classification.mjs": "b218927f64a3db4f37762b60014e29d85a46899f4a0d17fcecc7782ce48bc499",
+    "all/copy-overwrite/scripts/check-state-classification.mjs": "96599f9cf25d7d96afc82a92c477ca851e3fa1f918a06a5b81a29dd1b0039f38",
     "all/copy-overwrite/scripts/lib/invoked-as-script.mjs": "fbb9b88fc85a3e22f21af39e1c17acf67ff83fc6b5a6cdc8081bde333c48faa7",
     "all/copy-overwrite/scripts/lisa-command-envelope.mjs": "014a94647efc636cbce961364a82f03c1f3c1e54a55e9d21508fded88dce49c4",
     "all/copy-overwrite/scripts/lisa-destructive-guard.mjs": "f0f3c43bbb6d1e389135b0205a051e64891e539d4272df2a87841ee82a8b7a55",
     "all/copy-overwrite/scripts/lisa-enforcement-fallback.sh": "aafd027c4b6092da15d0389f9e8dcedbd9105e9083057e2da39f78fd5f72e0df",
     "all/copy-overwrite/scripts/lisa-floor-collisions.mjs": "2d11968f6852ab745cba939de03c6d6cb5f413975d2cfc8fc447bdd0b218e91a",
-    "all/copy-overwrite/scripts/lisa-gates.mjs": "bba52f26e70e0dc399a8ed8ea9cbd3885a18f08401b28bd18871a1af4fbca375",
+    "all/copy-overwrite/scripts/lisa-gates.mjs": "98652623c7451d05e48239e1678ad7977a323eaf7ff5ca4b4f3bbc0798396859",
     "all/copy-overwrite/scripts/lisa-hooks/block-direct-issue-create.sh": "8d1f04ef5c5da9db9190e22b37a435e118e39d6e7deafc5402b4593c8e9db2b2",
     "all/copy-overwrite/scripts/lisa-hooks/block-instruction-file-edits.sh": "3e709e1ec8a5843c00684bc477ad32ddab2c5fdb11f71d5aeec0c49609eaf025",
-    "all/copy-overwrite/scripts/lisa-hooks/block-managed-file-edits.sh": "c1b2abf324269c0248136500eb37d7c43559552f152a7c5d07a23c219fdc70b2",
+    "all/copy-overwrite/scripts/lisa-hooks/block-managed-file-edits.sh": "92e0ff52fcb29bc112ddcf1c3d85432032596572a84f3c5806a5b0c286ae55b3",
     "all/copy-overwrite/scripts/lisa-hooks/block-no-verify.sh": "83a8b8108654086afb6a6f23a8f09f9f041eb2cd4094c5531fa7ab1f75e873dc",
     "all/copy-overwrite/scripts/lisa-hooks/block-shell-json-parsing.sh": "234cb82cc9033bd04940a553d4ddc95b078e585e41777d6529d887676edc40b1",
     "all/copy-overwrite/scripts/lisa-hooks/parity-safety-net.sh": "1d4fbe135f1bb4e861d286a6512ed201d4522250dfe3f9eba6584bc5ff166a95",
@@ -339,7 +339,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/hooks/block-direct-issue-create.sh": "22184f1dd1b96e818741bd4ae659446299535d7ce594817155edebac4172a7ba",
     "plugins/src/base/hooks/block-instruction-file-edits.agy.sh": "aa249cae53caeb3e0fb6d6af114e2756084f45a2896332fb063a9f20e4902125",
     "plugins/src/base/hooks/block-instruction-file-edits.sh": "d47314b66d6ce85f77d6e058f861eede4462b2b0a33d54e82ff1c931167ec3f7",
-    "plugins/src/base/hooks/block-managed-file-edits.sh": "c363505f94d3716e51972bbff33845b0bf41c92b4e909288d02b2d7c3e87fa61",
+    "plugins/src/base/hooks/block-managed-file-edits.sh": "b0156d4b4e7fe3b28c6d0798db67af62b7fbc8247e6f1cc5092adf4c94e417af",
     "plugins/src/base/hooks/block-no-verify.agy.sh": "81c51041f8cb47bf79692c485c4f42ac7ed0a5a830821dc514cb468bc7a06b83",
     "plugins/src/base/hooks/block-no-verify.sh": "3ff7255f395a9552366faaac34d383f4c95fecfb39882cd1d57854356422fe61",
     "plugins/src/base/hooks/block-shell-json-parsing.agy.sh": "dc688efe382e7b8fe6f6c88bb0fde851527128cae778599559f23a93f1c9ec86",
@@ -488,7 +488,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-agent-ready/SKILL.md": "f65e5e866bc476ba2b40e4fb29e6754bdd5824e1f0706f28d4f2beb2af0faf53",
     "plugins/src/base/skills/lisa-analyze-claude-remote/SKILL.md": "a5863836b8fa9d67825d048e1c2fc086d3df95de33cf110129488959b83cb4b5",
     "plugins/src/base/skills/lisa-atlassian-access/SKILL.md": "6366ccce961217d1c7bcac4dad9c2293ee4dcc395b27c142a3b59c62f00b685c",
-    "plugins/src/base/skills/lisa-atlassian-access/scripts/markdown-to-adf.mjs": "538e5a3d91482b9e2a055e133b7c1fcf809be51d4ae72a10776aaeeb8df4832a",
+    "plugins/src/base/skills/lisa-atlassian-access/scripts/markdown-to-adf.mjs": "8ea94fa2b3fbe860cee365a6dd935a0f7ef9e749a2ab59c8b8dfc1838cdb0d37",
     "plugins/src/base/skills/lisa-attribute-failure/SKILL.md": "5d737b9fda916f02aaf13b208316cd54995d83aa06d27ba5daa19b6ebed6b4d9",
     "plugins/src/base/skills/lisa-automation-status/SKILL.md": "595b57feb3aa13b8a1a32691a25fc0c1b91f689e06745b4582d540c1d34a3b83",
     "plugins/src/base/skills/lisa-bug-triage/SKILL.md": "bd5bae508a8f344d8b5cb46cfddcb178ff8368ca77936f9e2c63058e05f61af4",
@@ -504,7 +504,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-delivery-effectiveness/SKILL.md": "21bc55fa0e86a9694bd22269fd089dbfae0c54c199262f46a4955447acea0f35",
     "plugins/src/base/skills/lisa-detect-tooling/SKILL.md": "4ef9b5004e13beb46cac5ae994c24d91c3715363771e3d89c32b0610408fc887",
     "plugins/src/base/skills/lisa-detect-tooling/scripts/commands.mjs": "e28bd61fdde4a336b56ae3395423026943a5816015719d31d04f0d5a0ab50eec",
-    "plugins/src/base/skills/lisa-detect-tooling/scripts/detect-tooling.mjs": "9d06590e6b99cce33e5fb10bd5b9e7515318133e3635368ef47162abc123bdfa",
+    "plugins/src/base/skills/lisa-detect-tooling/scripts/detect-tooling.mjs": "3a79e0a09112268c2bfe51575355c10c2fa5305fdac6629cada2028ab3f07a00",
     "plugins/src/base/skills/lisa-doctor/SKILL.md": "f015bd91a615fa22b8e9f2bcb89a8bbce4a3f7d4fd977bfe94970e8d21d640d8",
     "plugins/src/base/skills/lisa-drive-pr-to-merge/SKILL.md": "bbf4f08502f0f860a18e1a374998ed276931708c7c092f078837c98f7e25ac9a",
     "plugins/src/base/skills/lisa-epic-triage/SKILL.md": "d02760411249bddbd396f283191fe3e82bb7b95bf9393a19a7025dc5a57c3ab7",
@@ -614,7 +614,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-quality-review/SKILL.md": "520437da40257686203468f39b61fbecb2f5c534faaaa488734e828f74c04825",
     "plugins/src/base/skills/lisa-queue-status/SKILL.md": "87c6d34d0511d4afd812d1af3fee80fa3b7aa47db8449760b12f2699fedc1d78",
     "plugins/src/base/skills/lisa-remote-dispatch/SKILL.md": "f3c48120a206d01db45f849ca5b61690d572abc16bc36d559a4cacc8f9422c06",
-    "plugins/src/base/skills/lisa-remote-dispatch/scripts/dispatch.mjs": "475963ed64d9e72a6cbd6cbb61c8b57a419f2e1805e3ddfa76066047c590deeb",
+    "plugins/src/base/skills/lisa-remote-dispatch/scripts/dispatch.mjs": "3cf5802d8154ea8ec6c531db6d54c37dd38ab2573e3a0cb38fdfef535150b933",
     "plugins/src/base/skills/lisa-repair-intake/SKILL.md": "b9cc5064f24eead0c2f446951eb098a31b8e34c1d5e78929112d0685a6ce9de9",
     "plugins/src/base/skills/lisa-reproduce-bug/SKILL.md": "4d460993fac6021219ca23eee29b1b9afa7c37479dddc662b2fcfaca510edd68",
     "plugins/src/base/skills/lisa-research/SKILL.md": "9e2e7f3d02a18d9bb34f0b9e8c43d6b9b454d0f81987390839d40a84331b20f7",
@@ -625,28 +625,28 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-secrets-access/SKILL.md": "32790da3a954eb16fbd47114f6b239d7eec7b16d1490de2d0dd461234d974c11",
     "plugins/src/base/skills/lisa-secrets-access/scripts/aws-bootstrap.mjs": "a06c212d45442a0a2daaefda1a7255e299f82704ca3637243b778d8268a5ce65",
     "plugins/src/base/skills/lisa-secrets-access/scripts/bootstrap-store.mjs": "8dd5ca2c99394ead696093dd10caf664ce2609d39fb8d8ae8f4d4f236dbddbe6",
-    "plugins/src/base/skills/lisa-secrets-access/scripts/doctor-secrets.mjs": "5e3b936279d663ad714f0c699af1cd8f487b1212657cd4ad30dbe563d8dee9f8",
+    "plugins/src/base/skills/lisa-secrets-access/scripts/doctor-secrets.mjs": "71fd7a3f26d7e4424bb8ef80caaaa3db136595a5b9e620a32084a00521277ba3",
     "plugins/src/base/skills/lisa-secrets-access/scripts/envfile.mjs": "be4e38ce85f9268b52b29dbde264ecd8d50973c2b63a15410336234a921d9644",
-    "plugins/src/base/skills/lisa-secrets-access/scripts/inspect-vault.mjs": "ce48f609f1434d75d00422ab3251f327233596ccac46d5f6437523b435dda164",
-    "plugins/src/base/skills/lisa-secrets-access/scripts/materialize-secrets.mjs": "694f2660df23871d470701d1fb9fc7e24fcf7be137d9c275059ae7f7383340e9",
+    "plugins/src/base/skills/lisa-secrets-access/scripts/inspect-vault.mjs": "d2841042eda0f0c50f995ccc34e09e25aced0abbf3a96bce52a9f604e4009520",
+    "plugins/src/base/skills/lisa-secrets-access/scripts/materialize-secrets.mjs": "ebfd1bad8cd6ff85b746c2d69393997e7a6793b4cb2b9695efb2033bd3420ae6",
     "plugins/src/base/skills/lisa-secrets-access/scripts/note-format.mjs": "09bd6904bc84a5a93a32499ac94db5ec7728db68908a661698445ef5e6974f3e",
     "plugins/src/base/skills/lisa-secrets-access/scripts/preflight-secrets.mjs": "f6c6f87bb309d755fb715abcf5f7f1802d3ed7375a0d052118c547c3c46d5e37",
     "plugins/src/base/skills/lisa-secrets-access/scripts/prompt-secret.mjs": "22b28bcdf49b9b0fcd1b15639e031655efacc028b74d48d57e2275f3e1557508",
     "plugins/src/base/skills/lisa-secrets-access/scripts/providers.mjs": "f295709e2d14267db89d03d7d61cec9611897d816d5b31eed4b397b9c52d54af",
-    "plugins/src/base/skills/lisa-secrets-access/scripts/read-secret-note.mjs": "1471d2108058f3059e242f9c71208c99fdbc212bde32de34b798eaa9a27ffbcc",
-    "plugins/src/base/skills/lisa-secrets-access/scripts/resolve-secret.mjs": "75ae143c971a7d442d513f2458ac64322d2394dec77ec806af82f39c5ed815be",
-    "plugins/src/base/skills/lisa-secrets-access/scripts/rotate-secret.mjs": "546dc1c2f279cee6db56c0f55c01aabae0c316842f32d3219c5af6d638936a9c",
+    "plugins/src/base/skills/lisa-secrets-access/scripts/read-secret-note.mjs": "735434e25bf1db9f2f7eb3d5ede8361cba01b922d65931393bd36e6f96531654",
+    "plugins/src/base/skills/lisa-secrets-access/scripts/resolve-secret.mjs": "4170220c95f410072f3871f58938b7575684254480d0645e3dbb1535cf09d7a7",
+    "plugins/src/base/skills/lisa-secrets-access/scripts/rotate-secret.mjs": "adada60f766760395858c69ef784654e9e096943485ed237c395c8fc2ca8e20f",
     "plugins/src/base/skills/lisa-secrets-access/scripts/routing-floor.mjs": "fa1bdeda4e38bbd149f993ab0288f11b7ba6f2a3b9bf91a5918de7356e21f786",
     "plugins/src/base/skills/lisa-secrets-access/scripts/surfaces.mjs": "945957bbb54d184a07703cf727844f0838810d33dd385b068934b571252934e6",
-    "plugins/src/base/skills/lisa-secrets-access/scripts/sync-secret-to-ci.mjs": "4887a65b7589a47c7da3b5ed04907bfcb9773289c0dd3597c69a35ba239f14d9",
+    "plugins/src/base/skills/lisa-secrets-access/scripts/sync-secret-to-ci.mjs": "563ab35320a0ba58269ac3dd81155ffe3a299f6835210073e6fc9012ab436f41",
     "plugins/src/base/skills/lisa-secrets-access/scripts/tools-from-notes.mjs": "360f740cac081151491428043b04fec2f5db6f3ba36394f7378af312396d53ca",
-    "plugins/src/base/skills/lisa-secrets-access/scripts/validate-config.mjs": "b521aa3e3e4049d2c40f81382c28b8d81ecad9221d147d3be8c94a444ae518a5",
+    "plugins/src/base/skills/lisa-secrets-access/scripts/validate-config.mjs": "85c5ec348e0f38128f44f3207fcbc047952ae88f48adf81b7879c24b1a66cbf0",
     "plugins/src/base/skills/lisa-security-review/SKILL.md": "5a980eaf5efc4fcce66e75521ec5b1eda143a5b0d36e7157234a705dac94e3f5",
     "plugins/src/base/skills/lisa-security-zap-scan/SKILL.md": "a5189442dbf970cc49fd089ab03c386c8a205b856e09501f6ad1966321e7e4b5",
     "plugins/src/base/skills/lisa-sentry-access/SKILL.md": "e8ea8e6e4288385202f88b04e258b6d86f304a05d6dc118ebde6e88a7e8b5f44",
     "plugins/src/base/skills/lisa-setup-atlassian/SKILL.md": "4fa7f9a83a9998951528c8ffffa930c61b5c316b510356a3e7a90ccb9d5ca123",
     "plugins/src/base/skills/lisa-setup-automations/SKILL.md": "4bf86639bca29641686fd124d7d4b6c177775063930a309e2c33f808e33d505f",
-    "plugins/src/base/skills/lisa-setup-automations/scripts/generate-workflow.mjs": "f639c3f174378f0068b9c9d56e59b356c6da988730a1390c61e4348b4a4073ac",
+    "plugins/src/base/skills/lisa-setup-automations/scripts/generate-workflow.mjs": "c13e287c8beb6f847b03c93298b8a3fb211e65ce897e63692933377f8c4303f1",
     "plugins/src/base/skills/lisa-setup-confluence/SKILL.md": "e92d762dbdaeae671c3e52dfe8e10d40a10b606b5e050589181a3898649faedc",
     "plugins/src/base/skills/lisa-setup-github-repo/SKILL.md": "b9b223a5ffad2f88e3fde5831b60fea9bdc2c981750c49d03bb046d43772a0d3",
     "plugins/src/base/skills/lisa-setup-github/SKILL.md": "75435e81130abd21c678d302b7a220da95a19868d122ca93168278628b200666",
@@ -654,7 +654,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-setup-kane/SKILL.md": "fe50024a4f896af01716f2435f57227b1f8de61803e80bf3e3c3247ec179b103",
     "plugins/src/base/skills/lisa-setup-linear/SKILL.md": "8813f9374f0d485c1ca1d2b2549e990dee1b232e82487c85caec972c47cceb64",
     "plugins/src/base/skills/lisa-setup-local-env/SKILL.md": "4d4b8c92e3616256f5f689fbe433f09c31d39c623508bc4ec0d8c1770caddf22",
-    "plugins/src/base/skills/lisa-setup-local-env/scripts/local-env.mjs": "bff68aa66d6d4cd7cb9d0e39be691c6daa232edb097f8a601815432a32cca6a6",
+    "plugins/src/base/skills/lisa-setup-local-env/scripts/local-env.mjs": "6f3713451139d9d4fd8eed8f11f49e472667394c4f9a7cae63897b7702115687",
     "plugins/src/base/skills/lisa-setup-notion/SKILL.md": "a00121623871aa7578281779214d2a8ed871c7dfba19937f80374e76d6aa2b7f",
     "plugins/src/base/skills/lisa-setup-remote-aws/SKILL.md": "80fbf157f9c562c033886c25a99b37356602edd9e61cd2d492f339769ddcf97e",
     "plugins/src/base/skills/lisa-setup-remote-env/SKILL.md": "7aa1f616440cb262e47881e8b37b701ebd11ad1ea619412aa04c33324770904c",
@@ -662,10 +662,10 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-setup-remote-env/assets/setup.sh": "c30d98a5645f033fc1d3a723043691b9ad997ae5666df539ff6aa19c563431b2",
     "plugins/src/base/skills/lisa-setup-remote-env/scripts/environment.mjs": "3b9be11691d81a896fc779c37fb6d69e8e7222f95e23f84aa03d4e590f9d9108",
     "plugins/src/base/skills/lisa-setup-remote-env/scripts/preflight-tools.mjs": "eb8ee672fbfdb0ab41dde5f17337dae59912f18eafa6f15a05fd203906d16352",
-    "plugins/src/base/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs": "b4b831f8900360bbb36922edcddaef6bbe4b3730cb21cf0a365d76b914bcbe4e",
+    "plugins/src/base/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs": "c34250b56a158f3876a4134b92210b2b7ed1f26261901840928ef9fa3ce87789",
     "plugins/src/base/skills/lisa-setup-remote-env/scripts/tool-floor.mjs": "8bf279a2b198c7a6d4163420ec73f871fb9c9cb70d7c87d852026bc5dbf97091",
     "plugins/src/base/skills/lisa-setup-remote-env/scripts/toolchain.mjs": "496de5aed034692fee421dc3a1fbad9f85ed9e1d0c83a1080f781a486d0274e6",
-    "plugins/src/base/skills/lisa-setup-remote-env/scripts/verify-remote-env.mjs": "362ff4a8196cbdcac3633e7d41437b0e8f966eb628924c8dba64646dd1e671c1",
+    "plugins/src/base/skills/lisa-setup-remote-env/scripts/verify-remote-env.mjs": "97f83b16a0ee5fc84c3b793afce24602b9fd0f67ae89501f424eae804eaead12",
     "plugins/src/base/skills/lisa-setup-sonar/SKILL.md": "b18e07ae942f75aad5730c0535840ef5f7115072f1b6cc62afac83196b28d6a3",
     "plugins/src/base/skills/lisa-setup-workstation/SKILL.md": "e57e64083c292f0402b704eeb647244be0f33ab17394a688bce57a1efd59f169",
     "plugins/src/base/skills/lisa-setup-workstation/scripts/catalogue.mjs": "eb0b8ec8a5d4fd81402dcbf40e6ccb55eb5e0c960f11aa928e45b99de43fabbc",
@@ -1071,10 +1071,10 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "scripts/fix-namespace-test-assertions.mjs": "bfed6f27753660b38457c3f0a032a6c866691666d2d5d61fc10c3fb2f4f4f412",
     "scripts/fix-test-assertions-pass2.mjs": "baca043a291120ff52ce61c06397206dc21ca3bef9c23a5975b9c1f896d963c7",
     "scripts/fix-test-assertions.mjs": "59b5e8cc31e7c7323d20bd180f2ae97c08a9685758483b6fe00ba77317a845f2",
-    "scripts/generate-agy-plugin-artifacts.mjs": "61aef7c20d92839a394f459f3012eb0b4e73d93ff56fa512b0244c68d96c72b4",
+    "scripts/generate-agy-plugin-artifacts.mjs": "55328577509da3bb47c5a775ecbac6063a94b4ba52adf71d3de9322600a336c3",
     "scripts/generate-codex-plugin-artifacts.mjs": "1d1a362afb8dba408741a3eed9fe583296f6bcb048608979f73f359cd609c03d",
-    "scripts/generate-copilot-plugin-artifacts.mjs": "70d283eed7cb7c1351d13cf0497f06dec175562c5918921c404393a76f11278f",
-    "scripts/generate-cursor-plugin-artifacts.mjs": "d8806197a723f0c2b50a8155ffc5b6f0abc30c68dc2385cb80b0dd066d061231",
+    "scripts/generate-copilot-plugin-artifacts.mjs": "2e5ce9a9f7390149bd3c24374960a51bda35afd1332cd2ad82a34bc0d50b8f50",
+    "scripts/generate-cursor-plugin-artifacts.mjs": "19cadeae80428a932d9f7a6d36eba4f14e95761ede26ab773ca26bfbeaa9252e",
     "scripts/generate-lisa-owned-hash-ledger.mjs": "4e7a6dd9325fff77faec49c1dcbf8a8cfeb987052eeed89885deb4f7b0a107bc",
     "scripts/generate-upstream-evidence-manifest.mjs": "e1f0485918ab8a2206e8200f297acb495400f321bed5d31d3f60f8da11d8fdc6",
     "scripts/github-status-check.sh": "c6a4a13ff5cf689fcbd7a6aca718f9e7d46d54ccb6687f662b055c1ca20e792f",
@@ -1153,7 +1153,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "typescript/copy-overwrite/eslint.slow.config.ts": "9f0efef2d1012e21a1d5e03eb98634bfeb459e3427147d75ad6905acbbab8466",
     "typescript/copy-overwrite/knip.json": "6eb93d705a2d645332fbae1dd42cf2d48f85978ebc265451a53790912f277d12",
     "typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs": "5f47f02563671a25ad14dc69210f1f52e9141e0e53a27bafce52d41899aa9d21",
-    "typescript/copy-overwrite/scripts/check-skipped-required-checks.mjs": "5af5f112ba258c4874a65c72c8bed12165e75e4df407265eb46ee9c89c4e0e53",
+    "typescript/copy-overwrite/scripts/check-skipped-required-checks.mjs": "444210c8fbfca1d3e6ae0e180fe95752e10152610ad349ffea377136f4ae8cf7",
     "typescript/copy-overwrite/scripts/check-threshold-ratchet.mjs": "6bcf8b88b1d5ade1aa7c7902ba12af1df7b0b13d4e69c49a24f76a92474c93ec",
     "typescript/copy-overwrite/scripts/check-verification-coverage.mjs": "0cddac03366644cdc99cc239e74520ac420d475b461a40a21728e43756872b07",
     "typescript/copy-overwrite/scripts/lib/invoked-as-script.mjs": "fbb9b88fc85a3e22f21af39e1c17acf67ff83fc6b5a6cdc8081bde333c48faa7",

package/package.json

@@ -129,7 +129,7 @@
     }
   },
   "name": "@codyswann/lisa",
-  "version": "3.26.1",
+  "version": "3.26.3",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.26.1",
+  "version": "3.26.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.26.1",
+  "version": "3.26.3",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-atlassian-access/scripts/markdown-to-adf.mjs

@@ -202,7 +202,29 @@ function parseInline(text) {
   return nodes.length > 0 ? nodes : [{ type: "text", text: "" }];
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+/**
+ * Whether this module is the one node was asked to run.
+ *
+ * Both sides are realpath'd: a raw URL comparison answers "no" through a
+ * symlinked checkout, a git worktree, or a /tmp path on macOS, so the module
+ * loads, runs nothing and exits 0 — a silent no-op that reads as success.
+ *
+ * A local copy rather than an import: plugin payload scripts ship standalone,
+ * with no `lib/` sibling to import from once installed.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
+if (invokedAsScript(import.meta.url)) {
   let input = "";
   process.stdin.setEncoding("utf8");
   process.stdin.on("data", chunk => {

package/plugins/lisa/.codex-plugin/skills/lisa-detect-tooling/scripts/detect-tooling.mjs

@@ -22,7 +22,14 @@
  * @module detect-tooling
  */
 
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import {
+  existsSync,
+  readFileSync,
+  readdirSync,
+  statSync,
+  realpathSync,
+} from "node:fs";
+import { fileURLToPath } from "node:url";
 import { join } from "node:path";
 
 import { commandsIn } from "./commands.mjs";
@@ -583,7 +590,29 @@ export function proposedEntries(proposal) {
   };
 }
 
-if (process.argv[1] && import.meta.url === `file://${process.argv[1]}`) {
+/**
+ * Whether this module is the one node was asked to run.
+ *
+ * Both sides are realpath'd: a raw URL comparison answers "no" through a
+ * symlinked checkout, a git worktree, or a /tmp path on macOS, so the module
+ * loads, runs nothing and exits 0 — a silent no-op that reads as success.
+ *
+ * A local copy rather than an import: plugin payload scripts ship standalone,
+ * with no `lib/` sibling to import from once installed.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
+if (invokedAsScript(import.meta.url)) {
   const proposals = detectTooling();
   if (process.argv.includes("--json")) {
     console.log(JSON.stringify(proposals, null, 2));

package/plugins/lisa/.codex-plugin/skills/lisa-remote-dispatch/scripts/dispatch.mjs

@@ -20,7 +20,13 @@
  */
 
 import { execFileSync } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+  realpathSync,
+} from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -495,7 +501,29 @@ async function main() {
   console.log(`recorded in ${LEDGER}; not polling — this process is done.`);
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+/**
+ * Whether this module is the one node was asked to run.
+ *
+ * Both sides are realpath'd: a raw URL comparison answers "no" through a
+ * symlinked checkout, a git worktree, or a /tmp path on macOS, so the module
+ * loads, runs nothing and exits 0 — a silent no-op that reads as success.
+ *
+ * A local copy rather than an import: plugin payload scripts ship standalone,
+ * with no `lib/` sibling to import from once installed.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
+if (invokedAsScript(import.meta.url)) {
   // Awaited rather than called bare: one dispatch path is async, so a synchronous
   // try/catch would let a rejection escape as an unhandled rejection and exit 0 —
   // reporting dispatched work that was never accepted.

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/doctor-secrets.mjs

@@ -18,6 +18,8 @@
  */
 
 import { createHash } from "node:crypto";
+import { fileURLToPath } from "node:url";
+import { realpathSync } from "node:fs";
 
 import { validateNote } from "./note-format.mjs";
 import { fetchAll, fetchRotatable } from "./providers.mjs";
@@ -239,7 +241,29 @@ function main() {
   if (errors) throw new Error(`${errors} secrets configuration error(s)`);
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+/**
+ * Whether this module is the one node was asked to run.
+ *
+ * Both sides are realpath'd: a raw URL comparison answers "no" through a
+ * symlinked checkout, a git worktree, or a /tmp path on macOS, so the module
+ * loads, runs nothing and exits 0 — a silent no-op that reads as success.
+ *
+ * A local copy rather than an import: plugin payload scripts ship standalone,
+ * with no `lib/` sibling to import from once installed.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
+if (invokedAsScript(import.meta.url)) {
   try {
     main();
   } catch (err) {