@codyswann/lisa 3.3.0 → 3.4.1

package/all/copy-overwrite/scripts/lisa-hooks/block-no-verify.sh

@@ -186,6 +186,37 @@ for i, token in enumerate(normalized_tokens):
         spec = token.split("=", 1)[1]
         if spec.split("=", 1)[0].strip().lower() == "core.hookspath":
             sys.exit(1)
+    # git accepts `--config-env <name>=<envvar>` as TWO tokens as well as one,
+    # and guarding only the `=` spelling was worse than missing the separate
+    # form outright: the trailing `core.hooksPath=.husky` then fell through to
+    # the allowlist above, which reads `.husky` as a PATH and permits it. But
+    # here it is an ENVIRONMENT VARIABLE NAME, and `env '.husky=/dev/null' git
+    # --config-env core.hooksPath=.husky` really does resolve hooksPath to
+    # /dev/null. The allowlist was being used as the bypass.
+    #
+    # Checked at the `--config-env` token, which the loop reaches first, so the
+    # refusal happens before the value token can be mistaken for a path.
+    if lowered == "--config-env" and i + 1 < len(normalized_tokens):
+        spec = normalized_tokens[i + 1]
+        if spec.split("=", 1)[0].strip().strip("'\"").lower() == "core.hookspath":
+            sys.exit(1)
+    # `GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=core.hooksPath
+    # GIT_CONFIG_VALUE_0=/dev/null git commit` sets command-scope config the
+    # same way `-c core.hooksPath=...` does — env-var-style assignments ahead of
+    # the invocation instead of a flag — so it disables every hook just as
+    # completely while matching none of the token shapes above. Upstream missed
+    # this until a downstream fork hardened its own copy against it, which is
+    # the one direction a guard must never be caught in.
+    #
+    # The index is matched as `\d+` rather than pinned to 0: git accepts any
+    # index below GIT_CONFIG_COUNT, so a single-index check is evaded by typing
+    # a 1. Refused outright, like --config-env=, because the path lives in a
+    # separate GIT_CONFIG_VALUE_<n> token that can be exported earlier,
+    # reordered, or left out entirely — there is nothing here to allowlist
+    # against.
+    key_match = re.match(r"git_config_key_\d+=(.*)$", lowered, re.DOTALL)
+    if key_match and key_match.group(1).strip().strip("'\"") == "core.hookspath":
+        sys.exit(1)
 
 sys.exit(0)
 PY

package/all/copy-overwrite/scripts/lisa-work-item.mjs

@@ -1376,7 +1376,28 @@ function validatePr(args) {
 
 function main() {
   const [command, ...args] = process.argv.slice(2);
-  if (command === "bind") return bind(args);
+  // `link` and `bind` are the same operation under two names, and the reason is
+  // the argument vector rather than the semantics.
+  //
+  // `bind` is a bash builtin that evaluates a string, so agent harnesses that
+  // scan a command for string-evaluating programs match the bare token wherever
+  // it lands — argv[0] or, as here, a subcommand three words in. Claude Code's
+  // worktree isolation does precisely that, and it refused
+  // `node scripts/lisa-work-item.mjs bind <ref>` outright: the one step Lisa
+  // documents as mandatory before any durable work became impossible to run in
+  // the isolated worktrees Lisa itself tells agents to use. Three agents hit it
+  // in a single session, each independently rediscovering the same
+  // carry-the-trailer-by-hand workaround.
+  //
+  // That guard belongs to the harness, is not Lisa's to narrow, and is doing
+  // something legitimate — so the fix is to stop standing on its toes. `link`
+  // is the spelling the docs teach and the one that works everywhere.
+  //
+  // `bind` is kept forever, not deprecated: it is written into host projects'
+  // checked-in git hooks and CI, and those copies update on their own schedule.
+  // Removing it to tidy up a name would break the very traceability gate this
+  // file exists to enforce, in repositories that had done nothing wrong.
+  if (command === "link" || command === "bind") return bind(args);
   if (command === "current")
     return console.log(JSON.stringify(readState(false), null, 2));
   if (command === "attach-branch") {
@@ -1403,7 +1424,8 @@ function main() {
   if (command === "validate-push") return validatePush(args);
   if (command === "validate-pr") return validatePr(args);
   throw new TrackingError(
-    "Usage: lisa-work-item.mjs bind|current|attach-branch|clear|prepare-commit-msg|validate-commit|validate-push|validate-pr"
+    "Usage: lisa-work-item.mjs link|current|attach-branch|clear|prepare-commit-msg|validate-commit|validate-push|validate-pr" +
+      "\n(`bind` is accepted as an alias for `link`, but some agent harnesses refuse the token `bind` in a command line.)"
   );
 }
 

package/dist/codex/scripts/block-no-verify.sh

@@ -85,16 +85,65 @@ def disables_verification(token):
         and NO_VERIFY.startswith(token)
     )
 
+# The only relocations that keep a repo's own hooks in play. Anything else —
+# including "" and /dev/null, which are simply the two most obvious members of
+# the blocked set rather than special cases — is refused.
+PERMITTED_HOOKS_PATHS = {".husky", ".githooks"}
+
+
+def is_permitted_hooks_path(value):
+    """Whether a core.hooksPath value relocates hooks rather than disabling them.
+
+    Args:
+        value: The raw core.hooksPath value as it appeared on the command line.
+
+    Returns:
+        True if the path is an established in-repo hooks directory.
+    """
+    cleaned = value.strip().strip("'\"")
+    if cleaned.startswith("./"):
+        cleaned = cleaned[2:]
+    return cleaned.rstrip("/") in PERMITTED_HOOKS_PATHS
+
+
 for i, token in enumerate(normalized_tokens):
     if disables_verification(token):
         sys.exit(1)
     if token == "HUSKY=0" or token.startswith("HUSKY_SKIP_HOOKS="):
         sys.exit(1)
-    if token.startswith("core.hooksPath="):
-        value = token.split("=", 1)[1]
-        if value in ("", "/dev/null"):
+    # Allowlist the destinations, do not denylist the disabling ones: hooks are
+    # disabled just as completely by any directory that happens to contain none
+    # (`-c core.hooksPath=/tmp/empty`), so the set that DISABLES hooks is
+    # unbounded while the set that legitimately relocates them is tiny. Matched
+    # case-insensitively because git config names are.
+    lowered = token.lower()
+    if lowered.startswith("core.hookspath="):
+        if not is_permitted_hooks_path(token.split("=", 1)[1]):
+            sys.exit(1)
+    if lowered == "core.hookspath" and i + 1 < len(normalized_tokens):
+        if not is_permitted_hooks_path(normalized_tokens[i + 1]):
+            sys.exit(1)
+    # `--config-env=core.hooksPath=SOMEVAR` reads the path out of the named env
+    # var, so it is not in the command at all and cannot be allowlisted.
+    if lowered.startswith("--config-env="):
+        spec = token.split("=", 1)[1]
+        if spec.split("=", 1)[0].strip().lower() == "core.hookspath":
+            sys.exit(1)
+    # git also accepts `--config-env <name>=<envvar>` as two tokens. Guarding
+    # only the `=` spelling let the trailing `core.hooksPath=.husky` fall
+    # through to the allowlist above, which reads `.husky` as a path — but here
+    # it names an ENVIRONMENT VARIABLE, which can hold /dev/null. Checked at the
+    # `--config-env` token, which the loop reaches first.
+    if lowered == "--config-env" and i + 1 < len(normalized_tokens):
+        spec = normalized_tokens[i + 1]
+        if spec.split("=", 1)[0].strip().strip("'\"").lower() == "core.hookspath":
             sys.exit(1)
-    if token == "core.hooksPath" and i + 1 < len(normalized_tokens) and normalized_tokens[i + 1] in ("", "/dev/null"):
+    # `GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=core.hooksPath
+    # GIT_CONFIG_VALUE_0=/dev/null git ...` sets the same command-scope config
+    # via env-var-style assignments. The index is arbitrary below
+    # GIT_CONFIG_COUNT, so it is matched as `\d+` rather than pinned to 0.
+    key_match = re.match(r"git_config_key_\d+=(.*)$", lowered, re.DOTALL)
+    if key_match and key_match.group(1).strip().strip("'\"") == "core.hookspath":
         sys.exit(1)
 
 sys.exit(0)

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAsxEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CA28NjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA4xEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CA69NjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -8,12 +8,12 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "all/copy-overwrite/scripts/lisa-enforcement-fallback.sh": "1bec5f3c284b3febdc471487ee6a23ffb72bd4e7b293f9e26b0188f32318c722",
     "all/copy-overwrite/scripts/lisa-floor-collisions.mjs": "3c7a0234b4f5609fce49e44711d2ec86af8cf7fb82b0831e4450e3347ecefe45",
     "all/copy-overwrite/scripts/lisa-hooks/block-instruction-file-edits.sh": "d47314b66d6ce85f77d6e058f861eede4462b2b0a33d54e82ff1c931167ec3f7",
-    "all/copy-overwrite/scripts/lisa-hooks/block-no-verify.sh": "031ef7a53fc49cb18665105b834b7b50ad6a43317e0821949809e877e0562ce4",
+    "all/copy-overwrite/scripts/lisa-hooks/block-no-verify.sh": "dd1aea1b9fdd0da023bf704b331b350bc14620f4364afa5001c6690fcbc940cc",
     "all/copy-overwrite/scripts/lisa-hooks/block-shell-json-parsing.sh": "90601e31603c440d8f19d213d63bfef8d18596c60f88cb6e28c93d12453c5c0c",
     "all/copy-overwrite/scripts/lisa-hooks/parity-safety-net.sh": "d9ea58150aa27e7f0aa9a4ef155ed446d30bdfc932d01c64e2b8ca211aa0de7b",
     "all/copy-overwrite/scripts/lisa-hooks/sonar-secrets.sh": "bf4132e49ba18e2f7e941520c299c15aeeacfd220e489f3d2eb8397f2048157b",
     "all/copy-overwrite/scripts/lisa-schema-validate.mjs": "9dd145c0f9dac6ed252b13d32e130dbab964da6cd357981b58541780ecb2f981",
-    "all/copy-overwrite/scripts/lisa-work-item.mjs": "e30016a49deff1c3cd3ae7951262aeb2ef3d472bce76bbbe2a177db6017c7cad",
+    "all/copy-overwrite/scripts/lisa-work-item.mjs": "fe064a2bd11200ed256fb36e203978f858fccbcaf40708496c066383345900ef",
     "all/copy-overwrite/scripts/schemas/lisa-command-envelope.v1.schema.json": "d153b7c2953a30f180e38f09e98240c63327f5196eeba9bdf545e5a1f125a879",
     "all/copy-overwrite/scripts/schemas/lisa-state-contract.v1.schema.json": "6b7afe4ffeba8aaa53871d8855172f7eacde05953b1321145218ec638ff5c1c4",
     "all/create-only/.agents/rules/README.md": "fd260fd9b2934d0d698a8098dfff07fedc071849d588e602d773666678c3d540",
@@ -324,8 +324,8 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/commands/wiki/install.md": "51392cf053c17edd549bfbaba5d19ce669dc79021aafa7cfa100324ad38de11f",
     "plugins/src/base/hooks/block-instruction-file-edits.agy.sh": "aa249cae53caeb3e0fb6d6af114e2756084f45a2896332fb063a9f20e4902125",
     "plugins/src/base/hooks/block-instruction-file-edits.sh": "d47314b66d6ce85f77d6e058f861eede4462b2b0a33d54e82ff1c931167ec3f7",
-    "plugins/src/base/hooks/block-no-verify.agy.sh": "c549f1dadd6ac3fab72c0b670524445a08bee732a05b868954a438970d4d5bcc",
-    "plugins/src/base/hooks/block-no-verify.sh": "031ef7a53fc49cb18665105b834b7b50ad6a43317e0821949809e877e0562ce4",
+    "plugins/src/base/hooks/block-no-verify.agy.sh": "81c51041f8cb47bf79692c485c4f42ac7ed0a5a830821dc514cb468bc7a06b83",
+    "plugins/src/base/hooks/block-no-verify.sh": "dd1aea1b9fdd0da023bf704b331b350bc14620f4364afa5001c6690fcbc940cc",
     "plugins/src/base/hooks/block-shell-json-parsing.agy.sh": "dc688efe382e7b8fe6f6c88bb0fde851527128cae778599559f23a93f1c9ec86",
     "plugins/src/base/hooks/block-shell-json-parsing.sh": "90601e31603c440d8f19d213d63bfef8d18596c60f88cb6e28c93d12453c5c0c",
     "plugins/src/base/hooks/cleanup-stale-worktrees.sh": "c9b2fcca1b34d6f636b5289ece11b254cbb8ee2c2bac5c2e426b6f4dcfa972f2",
@@ -361,6 +361,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/rules/eager/dependency-internalization-kit.md": "9e2cc78afffc477c14718390ed88c42f781911c51fb7c13dada497f9e956b1a3",
     "plugins/src/base/rules/eager/dependency-trust-classes.md": "43a0932a7b8d4fd075b66bfe778025d808a13d9aa61ae793e9eb2fc8a555a381",
     "plugins/src/base/rules/eager/derived-branch-plan.md": "aa88be9f1a6de7a843222585bcc1c593b993e7d5900c8a33a9f38ef8a99d25b4",
+    "plugins/src/base/rules/eager/design-source-of-truth.md": "d85886aa5832f7952bc0768871a335f33a4899ce598bb1a114feb5f300cbc7f2",
     "plugins/src/base/rules/eager/do-it-now.md": "de0c1565fa7b8a99a7f5d15af1118c3e5eb942a0d893bbb672533149fb82688e",
     "plugins/src/base/rules/eager/documentation-source-paths.md": "3a7c2a6264654a3cc44dd326441ba211a39c1c267033cc189c1c635adb84b52b",
     "plugins/src/base/rules/eager/empirical-inquiry.md": "67aa64ba3ecc4f3cd761111d2562662e0a2acf7892703b14ec83f7f7b073e670",
@@ -390,7 +391,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/rules/eager/settled-decisions.md": "f5339c81b8d29f628830e6147314cbb941b9d9e6d87c3834d8fe7adc4b46ef4c",
     "plugins/src/base/rules/eager/stale-state-claims.md": "faf5057f5910237b8d5048dbcccb73e0cd03762a8eefbeae43b5d0153104a85a",
     "plugins/src/base/rules/eager/tool-access-gate.md": "a5413a43ec353f768586e0a1cde3836db025cb5d8b80821020602995e71aa296",
-    "plugins/src/base/rules/eager/tracked-work.md": "ae5177a3ce321007dfc03f44974f25110aed578bcdf2283d5c5f12c838f82673",
+    "plugins/src/base/rules/eager/tracked-work.md": "24f04b4610eff1519d818741c6bd5ad6464a0833ef24ecb8bf6ceb35dced9a4b",
     "plugins/src/base/rules/eager/upstream-to-lisa.md": "eb8b37e789423dba78e3a77951db087c4d3f56a88478b63107ec6b9ddbf23b13",
     "plugins/src/base/rules/eager/usage-accounting.md": "b93fa782d61911579b25363e465bb1f4e9b7e4edb54465a346d52f74dffe5a97",
     "plugins/src/base/rules/eager/verification.md": "a6cc1d50c5b91080171490edce4d375f136a14790dcbb247ca8b736ad8f55cfd",
@@ -410,6 +411,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/rules/reference/dependency-internalization-kit.md": "8c8e9bddbe2165905c3919ae9dd3d131b557cf9c7eb370393dfa85827076c73b",
     "plugins/src/base/rules/reference/dependency-trust-classes.md": "82216b80d4807e0ad302d04924032cc6a7a95b26f72ea853e378572a5c31821c",
     "plugins/src/base/rules/reference/derived-branch-plan.md": "672983b5171bf6e377f3d17927fd75e45208ffa6500718c07df1d449ca00f7d0",
+    "plugins/src/base/rules/reference/design-source-of-truth.md": "38f477cb0703627ac5daf561a9a1c42bd41be6d20113aba22f30d5e47d573dcf",
     "plugins/src/base/rules/reference/do-it-now.md": "46fdcc335e115d0f387af398789f443ef8dd3ab17de5f7d95120c31f913a8fce",
     "plugins/src/base/rules/reference/documentation-source-paths.md": "555155889c9cf279865b9d8fc554bdd461c96a3ec76a5001dfeb361a71056999",
     "plugins/src/base/rules/reference/empirical-inquiry.md": "8cb166ab9eff4eb30287822a4d7843f76884d70d683d7c61d6a7ffd4ff9f7159",
@@ -439,7 +441,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/rules/reference/settled-decisions.md": "6c84f309a1f765eba1648d6ace836387bd96b924f245c16cf3629f501ef6bb18",
     "plugins/src/base/rules/reference/stale-state-claims.md": "6329e1a7629f9a12f10454c767842aecee4964df8b7bb4aebda9dde3c0959c2a",
     "plugins/src/base/rules/reference/tool-access-gate.md": "70fcd6cd92dc003a40886b1bef02540e6401f5b70ba97308d42bbbddc0206eab",
-    "plugins/src/base/rules/reference/tracked-work.md": "85fb31a5d7aad44d04592bb7feea7ad02808eeeb6950639ad452fcec1bc3c86b",
+    "plugins/src/base/rules/reference/tracked-work.md": "cc50ea131756d7e9d6d0fdbd35231894fc7d789d68c1dc0e551ae2103845db20",
     "plugins/src/base/rules/reference/upstream-to-lisa.md": "dcf07f8eba66aaf1d132bfaeff73cbf7576279822893235a3c3f8cbc4a4a3323",
     "plugins/src/base/rules/reference/usage-accounting.md": "79c00ed4a97c40de72cfccef16b6846ba668fc564354507907876489c038ab75",
     "plugins/src/base/rules/reference/verification.md": "9ae8db87b37c7700687fabd1b8632b3cddd0f1f1e4b04384c604f88f160056ed",
@@ -453,6 +455,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/scripts/automation-status-report.mjs": "520f77645c5b7cab3f69848fb5cf19e8b1d802cd1f8ce6a35aa36a0bf6a0d146",
     "plugins/src/base/scripts/automation-status-run-history.mjs": "a07f0d1af412f0d2747a9cbe82fa0edbeb8cc8dd4bdf4c51526e779090f08208",
     "plugins/src/base/scripts/cross-pollinate.mjs": "e9a536389d2581370f6c470b8a070aaae96660646efc528a7ff7fb25d324a903",
+    "plugins/src/base/scripts/design-source-gate.mjs": "2c8121404ac6dd71f74a3080561aa6daecb4f719fdd1360622511d35186bc13f",
     "plugins/src/base/scripts/doctor-report.mjs": "f183e62848ac539da56a525fe2105fc6251a49e555a01dd1bba10d9227b1a6bf",
     "plugins/src/base/scripts/install-remote-agent-aws.mjs": "5ef1c323d7cbfda8976f6fb0c24f7a8e5f5757475fd1d71c6e5bec91023cebe3",
     "plugins/src/base/scripts/plugin-sync-explain.mjs": "8592c7359ee6cdb35995a882c8bb27e7b9c404074067fd272c70013e44e04b71",
@@ -510,7 +513,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-github-write-issue/SKILL.md": "f2f9991be42b0fd98f5c3f414d96e8756485c7b56aceb20d7db7f87255cc88e6",
     "plugins/src/base/skills/lisa-github-write-prd/SKILL.md": "262f8a1bcfad4c5dd4456cfaaf1b71abf9697a0da588966e58ff491acd3c17e8",
     "plugins/src/base/skills/lisa-health/SKILL.md": "dfdb08a863e78bff42671793dcec29cfae0654db18ebf66a4aa77aeb56ddb775",
-    "plugins/src/base/skills/lisa-implement/SKILL.md": "7654a80b950e7c970af002bdd1acf5c48fcf449d06b6693ed47e5d6a9a2cfa9d",
+    "plugins/src/base/skills/lisa-implement/SKILL.md": "4f25d131a3fb6168a2bbfa9085e048f6662d6ef30f2d9d91b46884d72c427b6f",
     "plugins/src/base/skills/lisa-improve-code-complexity/SKILL.md": "24ab5b193b409db6ee6bee981a1c0a48d08991782d7846116ad01658c8bc1ae8",
     "plugins/src/base/skills/lisa-improve-harness/SKILL.md": "98ad4b896785ac51826969a0ff077ef11c51353f2a2e03444c8b38e6c0363d05",
     "plugins/src/base/skills/lisa-improve-max-lines-per-function/SKILL.md": "95c875950c9848fdaf520a18b9bbb264e33d7347be10170add768e01d9cd8e52",
@@ -589,7 +592,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-qa-clear/SKILL.md": "2a4bbe2501b159eceea289584e50bcceffae2fee5210420d6be3b403dae6d079",
     "plugins/src/base/skills/lisa-qa-fail/SKILL.md": "cf4bc2b6e3e31a7fabfba5fb9ed1218eb564b0d94113a317267371de7a2708fb",
     "plugins/src/base/skills/lisa-qa-queue/SKILL.md": "1d5f009f60004bf75b5d79bca370096ce40e1d41d585dc8afd4389f21bba84ae",
-    "plugins/src/base/skills/lisa-quality-review/SKILL.md": "17ba45f4c4b7877c0b0c9a3c1cc1cb9e18c642ead74ff7263698d8034d3241da",
+    "plugins/src/base/skills/lisa-quality-review/SKILL.md": "520437da40257686203468f39b61fbecb2f5c534faaaa488734e828f74c04825",
     "plugins/src/base/skills/lisa-queue-status/SKILL.md": "87c6d34d0511d4afd812d1af3fee80fa3b7aa47db8449760b12f2699fedc1d78",
     "plugins/src/base/skills/lisa-remote-dispatch/SKILL.md": "f3c48120a206d01db45f849ca5b61690d572abc16bc36d559a4cacc8f9422c06",
     "plugins/src/base/skills/lisa-remote-dispatch/scripts/dispatch.mjs": "475963ed64d9e72a6cbd6cbb61c8b57a419f2e1805e3ddfa76066047c590deeb",
@@ -597,7 +600,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-reproduce-bug/SKILL.md": "4d460993fac6021219ca23eee29b1b9afa7c37479dddc662b2fcfaca510edd68",
     "plugins/src/base/skills/lisa-research/SKILL.md": "9e2e7f3d02a18d9bb34f0b9e8c43d6b9b454d0f81987390839d40a84331b20f7",
     "plugins/src/base/skills/lisa-review-implementation/SKILL.md": "42134253cca50e384f36eaa085c0a1e6b8772e9f3e912a8d1231f1cd69199858",
-    "plugins/src/base/skills/lisa-review-local/SKILL.md": "66defe83565ab3633a13e69ce394de64f17f2c2bddbf046bc12c8bbd0ca57f5c",
+    "plugins/src/base/skills/lisa-review-local/SKILL.md": "348c4cae5a189e9afa9950899a5bd88674db8265d63a99b5b7a1b616e970e885",
     "plugins/src/base/skills/lisa-rework-triage/SKILL.md": "56a5549a1430ea791e5edb71144c0741f09970933fe3f7b54a76e3218b9b9042",
     "plugins/src/base/skills/lisa-root-cause-analysis/SKILL.md": "3fa14217ca36b238ebb8203d18f10eaaf98a3647f949cdada6cb9f56ddf9ed50",
     "plugins/src/base/skills/lisa-secrets-access/SKILL.md": "042c8ac3e4f299bc8e4f7210253c207c8d2e68b9ed90f6767652390975fd419a",
@@ -648,11 +651,11 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-sync-down/SKILL.md": "c32e6a4e3115ca32b7d335e90d0a73b243c6c631a2d192568423be0cb5944e84",
     "plugins/src/base/skills/lisa-task-decomposition/SKILL.md": "eb78838e1f121a7a619a841333b1adfce124dad8881853d14107512ead09d30f",
     "plugins/src/base/skills/lisa-task-triage/SKILL.md": "c6e11b6d195560e6bd7b51fede65c155567c35208801a700a26d95679b03484e",
-    "plugins/src/base/skills/lisa-tdd-implementation/SKILL.md": "366bcf52a538d4f2ac440dd2e9e6f7cf324450fd3cd03652127ab8c20f584fa9",
+    "plugins/src/base/skills/lisa-tdd-implementation/SKILL.md": "8684a31f1982ec3bcf9803ef028bf2aa7a24cefd324ca40b2ac09d07287ecacd",
     "plugins/src/base/skills/lisa-tear-down-automations/SKILL.md": "3f8215b691ce60a6efd63547b99b4d87760fe99d285f6fe153aaadd451e83731",
     "plugins/src/base/skills/lisa-test-strategy/SKILL.md": "8976e0056b65475fe69f4ed02c8d0d3ae898fd9ab5ff28bf632981a3293c9f6e",
     "plugins/src/base/skills/lisa-ticket-triage/SKILL.md": "9d29652fb897568a60da35956f452627a81e57032bbcc3c673ae20dfc8a419f5",
-    "plugins/src/base/skills/lisa-track/SKILL.md": "35a3fd978c71d40f62849f903ae0291f8b3140354e53ba498ada4ffe4cd586f3",
+    "plugins/src/base/skills/lisa-track/SKILL.md": "ff516917ef9387e96758db74372831fd9b9d28991e2a23461cf8661893f2d3b0",
     "plugins/src/base/skills/lisa-tracker-add-journey/SKILL.md": "a3da2e0350bcdebcdcc05f2d7931af868382638d3a28d09d4718f2f458d4be0a",
     "plugins/src/base/skills/lisa-tracker-build-intake/SKILL.md": "df50fb88f29eadc66c250e1d7f841472df43ba865930fbbc0bea36bba3380ec3",
     "plugins/src/base/skills/lisa-tracker-claim/SKILL.md": "481922dba26c4e62ae36193a2e1565860aecf7e344bf5c37b3a0759f42676846",
@@ -660,7 +663,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-tracker-evidence/SKILL.md": "5d844840266dcec7f7e909951de0ac7fb8c4de9b2db405427d61c1be6646a511",
     "plugins/src/base/skills/lisa-tracker-journey/SKILL.md": "65fe727adfdbcc22141ad009e89cd7d91195600377c5357d552d50ed98ecf66b",
     "plugins/src/base/skills/lisa-tracker-read/SKILL.md": "2a1047a723193ce999c0d4dc4d205a49f231c724fd812581c78fdef9e8f58b30",
-    "plugins/src/base/skills/lisa-tracker-source-artifacts/SKILL.md": "dd61d236391e4c2624c1063fb109ef01fbd5fcb9608620cd3c07c8bf6794d0ac",
+    "plugins/src/base/skills/lisa-tracker-source-artifacts/SKILL.md": "32d411ae12378c3446d798f60d006b9f9ec0bdf82b86a5f60287766a96541fb3",
     "plugins/src/base/skills/lisa-tracker-sync/SKILL.md": "fc3951ef79a250cabec5892423de14bfa3cc3b0ebadcfdfbabdec257f67b382a",
     "plugins/src/base/skills/lisa-tracker-validate/SKILL.md": "1527ee91ae0db42c2551ce579ab25e4daf9e7290df5ad3e77c618c4fd1ed8b16",
     "plugins/src/base/skills/lisa-tracker-verify/SKILL.md": "552685eb08a76100df64c33f84d2c5f78867f4074e9fa1aa34fa9f905e06da1a",
@@ -2143,6 +2146,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-agy/scripts/automation-status-report.mjs": true,
     "plugins/lisa-agy/scripts/automation-status-run-history.mjs": true,
     "plugins/lisa-agy/scripts/cross-pollinate.mjs": true,
+    "plugins/lisa-agy/scripts/design-source-gate.mjs": true,
     "plugins/lisa-agy/scripts/doctor-report.mjs": true,
     "plugins/lisa-agy/scripts/install-remote-agent-aws.mjs": true,
     "plugins/lisa-agy/scripts/plugin-sync-explain.mjs": true,
@@ -2508,6 +2512,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-copilot/rules/eager/dependency-internalization-kit.md": true,
     "plugins/lisa-copilot/rules/eager/dependency-trust-classes.md": true,
     "plugins/lisa-copilot/rules/eager/derived-branch-plan.md": true,
+    "plugins/lisa-copilot/rules/eager/design-source-of-truth.md": true,
     "plugins/lisa-copilot/rules/eager/do-it-now.md": true,
     "plugins/lisa-copilot/rules/eager/documentation-source-paths.md": true,
     "plugins/lisa-copilot/rules/eager/empirical-inquiry.md": true,
@@ -2557,6 +2562,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-copilot/rules/reference/dependency-internalization-kit.md": true,
     "plugins/lisa-copilot/rules/reference/dependency-trust-classes.md": true,
     "plugins/lisa-copilot/rules/reference/derived-branch-plan.md": true,
+    "plugins/lisa-copilot/rules/reference/design-source-of-truth.md": true,
     "plugins/lisa-copilot/rules/reference/do-it-now.md": true,
     "plugins/lisa-copilot/rules/reference/documentation-source-paths.md": true,
     "plugins/lisa-copilot/rules/reference/empirical-inquiry.md": true,
@@ -2600,6 +2606,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-copilot/scripts/automation-status-report.mjs": true,
     "plugins/lisa-copilot/scripts/automation-status-run-history.mjs": true,
     "plugins/lisa-copilot/scripts/cross-pollinate.mjs": true,
+    "plugins/lisa-copilot/scripts/design-source-gate.mjs": true,
     "plugins/lisa-copilot/scripts/doctor-report.mjs": true,
     "plugins/lisa-copilot/scripts/install-remote-agent-aws.mjs": true,
     "plugins/lisa-copilot/scripts/plugin-sync-explain.mjs": true,
@@ -2965,6 +2972,8 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-cursor/rules/dependency-trust-classes.mdc": true,
     "plugins/lisa-cursor/rules/derived-branch-plan-reference.mdc": true,
     "plugins/lisa-cursor/rules/derived-branch-plan.mdc": true,
+    "plugins/lisa-cursor/rules/design-source-of-truth-reference.mdc": true,
+    "plugins/lisa-cursor/rules/design-source-of-truth.mdc": true,
     "plugins/lisa-cursor/rules/do-it-now-reference.mdc": true,
     "plugins/lisa-cursor/rules/do-it-now.mdc": true,
     "plugins/lisa-cursor/rules/documentation-source-paths-reference.mdc": true,
@@ -3043,6 +3052,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-cursor/scripts/automation-status-report.mjs": true,
     "plugins/lisa-cursor/scripts/automation-status-run-history.mjs": true,
     "plugins/lisa-cursor/scripts/cross-pollinate.mjs": true,
+    "plugins/lisa-cursor/scripts/design-source-gate.mjs": true,
     "plugins/lisa-cursor/scripts/doctor-report.mjs": true,
     "plugins/lisa-cursor/scripts/install-remote-agent-aws.mjs": true,
     "plugins/lisa-cursor/scripts/plugin-sync-explain.mjs": true,
@@ -5484,6 +5494,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa/rules/eager/dependency-internalization-kit.md": true,
     "plugins/lisa/rules/eager/dependency-trust-classes.md": true,
     "plugins/lisa/rules/eager/derived-branch-plan.md": true,
+    "plugins/lisa/rules/eager/design-source-of-truth.md": true,
     "plugins/lisa/rules/eager/do-it-now.md": true,
     "plugins/lisa/rules/eager/documentation-source-paths.md": true,
     "plugins/lisa/rules/eager/empirical-inquiry.md": true,
@@ -5533,6 +5544,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa/rules/reference/dependency-internalization-kit.md": true,
     "plugins/lisa/rules/reference/dependency-trust-classes.md": true,
     "plugins/lisa/rules/reference/derived-branch-plan.md": true,
+    "plugins/lisa/rules/reference/design-source-of-truth.md": true,
     "plugins/lisa/rules/reference/do-it-now.md": true,
     "plugins/lisa/rules/reference/documentation-source-paths.md": true,
     "plugins/lisa/rules/reference/empirical-inquiry.md": true,
@@ -5576,6 +5588,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa/scripts/automation-status-report.mjs": true,
     "plugins/lisa/scripts/automation-status-run-history.mjs": true,
     "plugins/lisa/scripts/cross-pollinate.mjs": true,
+    "plugins/lisa/scripts/design-source-gate.mjs": true,
     "plugins/lisa/scripts/doctor-report.mjs": true,
     "plugins/lisa/scripts/install-remote-agent-aws.mjs": true,
     "plugins/lisa/scripts/plugin-sync-explain.mjs": true,
@@ -6107,6 +6120,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/src/base/rules/eager/dependency-internalization-kit.md": true,
     "plugins/src/base/rules/eager/dependency-trust-classes.md": true,
     "plugins/src/base/rules/eager/derived-branch-plan.md": true,
+    "plugins/src/base/rules/eager/design-source-of-truth.md": true,
     "plugins/src/base/rules/eager/do-it-now.md": true,
     "plugins/src/base/rules/eager/documentation-source-paths.md": true,
     "plugins/src/base/rules/eager/empirical-inquiry.md": true,
@@ -6156,6 +6170,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/src/base/rules/reference/dependency-internalization-kit.md": true,
     "plugins/src/base/rules/reference/dependency-trust-classes.md": true,
     "plugins/src/base/rules/reference/derived-branch-plan.md": true,
+    "plugins/src/base/rules/reference/design-source-of-truth.md": true,
     "plugins/src/base/rules/reference/do-it-now.md": true,
     "plugins/src/base/rules/reference/documentation-source-paths.md": true,
     "plugins/src/base/rules/reference/empirical-inquiry.md": true,
@@ -6199,6 +6214,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/src/base/scripts/automation-status-report.mjs": true,
     "plugins/src/base/scripts/automation-status-run-history.mjs": true,
     "plugins/src/base/scripts/cross-pollinate.mjs": true,
+    "plugins/src/base/scripts/design-source-gate.mjs": true,
     "plugins/src/base/scripts/doctor-report.mjs": true,
     "plugins/src/base/scripts/install-remote-agent-aws.mjs": true,
     "plugins/src/base/scripts/plugin-sync-explain.mjs": true,
@@ -7440,6 +7456,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/codex/agent-installer.test.ts": true,
     "tests/unit/codex/agent-transformer.test.ts": true,
     "tests/unit/codex/agents-md-installer.test.ts": true,
+    "tests/unit/codex/block-no-verify-codex.test.ts": true,
     "tests/unit/codex/block-suppress-directives.test.ts": true,
     "tests/unit/codex/build-byte-stable.test.ts": true,
     "tests/unit/codex/codex-edit-hooks.test.ts": true,
@@ -7786,6 +7803,10 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/strategies/dependency-ownership-parity.test.ts": true,
     "tests/unit/strategies/dependency-trust-classes-rule-pair.test.ts": true,
     "tests/unit/strategies/derived-branch-plan-contract.test.ts": true,
+    "tests/unit/strategies/design-source-gate-fixtures.ts": true,
+    "tests/unit/strategies/design-source-gate-verdict.test.ts": true,
+    "tests/unit/strategies/design-source-gate.test.ts": true,
+    "tests/unit/strategies/design-source-of-truth-rule.test.ts": true,
     "tests/unit/strategies/distributed-content-round2-contract.test.ts": true,
     "tests/unit/strategies/doctor-automation-readiness.test.ts": true,
     "tests/unit/strategies/doctor-config-readiness.test.ts": true,