@codyswann/lisa 3.31.1 → 3.31.2

package/dist/cli/doctor-serialize-legs-contract.d.ts

@@ -1,4 +1,32 @@
 import type { DoctorCheck } from "./doctor.js";
+/**
+ * Whether the REUSABLE workflow's own `permissions:` block grants `actions`.
+ *
+ * This is the part no caller can supply. A called workflow's `permissions:`
+ * block is a ceiling that zeroes everything unlisted, so a caller's grant is
+ * discarded at the reusable-workflow boundary no matter where it is placed.
+ * While this is false, `serialize_platform_legs` cannot order anything in ANY
+ * repository, and reporting a fully configured caller as `ok` would certify a
+ * configuration measured to fail.
+ *
+ * Measured 2026-08-17 against a caller granting `actions: read` at BOTH job and
+ * workflow level: the job's own token grant showed `Contents: read` and
+ * `Metadata: read` with no Actions scope, the jobs API answered 403, and the
+ * two platform legs started two seconds apart.
+ *
+ * A constant rather than a read of the workflow file, because consumers
+ * reference the reusable workflow at `@main` and do not have a copy of it to
+ * read. `serialize-legs-callee-grant.test.ts` pins this to the actual
+ * `permissions:` block in `.github/workflows/maestro-native-e2e.yml`, so it
+ * cannot drift from what Lisa ships — flipping it and forgetting the workflow,
+ * or the reverse, fails that test.
+ *
+ * Residual limit worth naming: a consumer's `lisa doctor` comes from its
+ * installed package while the workflow it runs comes from `@main`, so a stale
+ * install can disagree with what actually runs. That is a property of `@main`
+ * refs, not of this check.
+ */
+export declare const CALLEE_GRANTS_ACTIONS_READ = false;
 /** Which of the three required parts a caller declares. */
 export interface SerializeContract {
     /** `serialize_platform_legs: true` in the `with:` block. */

package/dist/cli/doctor-serialize-legs-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-serialize-legs-contract.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-serialize-legs-contract.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/C,2DAA2D;AAC3D,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,2DAA2D;IAC3D,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,4EAA4E;IAC5E,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,iBAAiB,GAAG,SAAS,MAAM,EAAE,CAQ3E;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAEtE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC,CAqDtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAU9D"}
+{"version":3,"file":"doctor-serialize-legs-contract.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-serialize-legs-contract.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/C;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,0BAA0B,QAAQ,CAAC;AAEhD,2DAA2D;AAC3D,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,2DAA2D;IAC3D,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,4EAA4E;IAC5E,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,iBAAiB,GAAG,SAAS,MAAM,EAAE,CAQ3E;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAEtE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC,CAwEtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAU9D"}

package/dist/cli/doctor-serialize-legs-contract.js

@@ -6,6 +6,34 @@ import { readFile } from "node:fs/promises";
 import * as path from "node:path";
 import { loadYaml } from "../utils/yaml.js";
 const CHECK_NAME = "Maestro leg serialization wired?";
+/**
+ * Whether the REUSABLE workflow's own `permissions:` block grants `actions`.
+ *
+ * This is the part no caller can supply. A called workflow's `permissions:`
+ * block is a ceiling that zeroes everything unlisted, so a caller's grant is
+ * discarded at the reusable-workflow boundary no matter where it is placed.
+ * While this is false, `serialize_platform_legs` cannot order anything in ANY
+ * repository, and reporting a fully configured caller as `ok` would certify a
+ * configuration measured to fail.
+ *
+ * Measured 2026-08-17 against a caller granting `actions: read` at BOTH job and
+ * workflow level: the job's own token grant showed `Contents: read` and
+ * `Metadata: read` with no Actions scope, the jobs API answered 403, and the
+ * two platform legs started two seconds apart.
+ *
+ * A constant rather than a read of the workflow file, because consumers
+ * reference the reusable workflow at `@main` and do not have a copy of it to
+ * read. `serialize-legs-callee-grant.test.ts` pins this to the actual
+ * `permissions:` block in `.github/workflows/maestro-native-e2e.yml`, so it
+ * cannot drift from what Lisa ships — flipping it and forgetting the workflow,
+ * or the reverse, fails that test.
+ *
+ * Residual limit worth naming: a consumer's `lisa doctor` comes from its
+ * installed package while the workflow it runs comes from `@main`, so a stale
+ * install can disagree with what actually runs. That is a property of `@main`
+ * refs, not of this check.
+ */
+export const CALLEE_GRANTS_ACTIONS_READ = false;
 /**
  * Which required parts are missing from a declared opt-in.
  *
@@ -82,6 +110,21 @@ export async function checkSerializeLegsContract(targetPath) {
     }
     const missing = missingParts(contract);
     if (missing.length === 0) {
+        if (!CALLEE_GRANTS_ACTIONS_READ) {
+            return {
+                name: CHECK_NAME,
+                status: "warn",
+                detail: "serialize_platform_legs is enabled and this repository's side is " +
+                    "complete, but the ordering CANNOT work in this version of Lisa and " +
+                    "nothing here will change that. The reusable workflow's own " +
+                    "`permissions:` block omits `actions`, and a called workflow's " +
+                    "permissions are a ceiling that zeroes everything unlisted — so the " +
+                    "grant is discarded at the boundary wherever it is declared. The " +
+                    "jobs API answers 403, the ordering job logs a warning, concludes " +
+                    "`success`, and both legs start together. Nothing to fix here; " +
+                    "tracked upstream on CodySwannGT/lisa#2662",
+            };
+        }
         return {
             name: CHECK_NAME,
             status: "ok",
@@ -100,7 +143,10 @@ export async function checkSerializeLegsContract(targetPath) {
             "the suite behaves exactly as it did before the opt-in while reporting " +
             "green. `actions: read` must sit on the CALLING workflow's own " +
             "`permissions:`, not on the job: a called workflow requesting a scope " +
-            "its caller never held is a startup_failure for the entire run",
+            "its caller never held is a startup_failure for the entire run. " +
+            "Completing these parts is necessary but NOT sufficient today — see " +
+            "CodySwannGT/lisa#2662, which tracks the reusable workflow's own " +
+            "permissions ceiling discarding the grant",
     };
 }
 /**

package/dist/cli/doctor-serialize-legs-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-serialize-legs-contract.js","sourceRoot":"","sources":["../../src/cli/doctor-serialize-legs-contract.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAG5C,MAAM,UAAU,GAAG,kCAAkC,CAAC;AAYtD;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,QAA2B;IACtD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,4BAA4B;QAC1D,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,8BAA8B;KACjE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA2B;IAC3D,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,UAAkB;IAElB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CACxB,UAAU,EACV,SAAS,EACT,WAAW,EACX,iBAAiB,CAClB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAEvE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,2CAA2C;SACpD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,IAAI;YACZ,MAAM,EACJ,sEAAsE;gBACtE,gCAAgC;SACnC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,IAAI;YACZ,MAAM,EACJ,mEAAmE;gBACnE,0CAA0C;SAC7C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,MAAM;QACd,MAAM,EACJ,0CAA0C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG;YAClE,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,gBAAgB;YACtD,kEAAkE;YAClE,qEAAqE;YACrE,yEAAyE;YACzE,wEAAwE;YACxE,gEAAgE;YAChE,uEAAuE;YACvE,+DAA+D;KAClE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,WAAW,GAAG,MAAM;SACvB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SAC5C,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;QACL,OAAO,EAAE,kCAAkC,CAAC,IAAI,CAAC,WAAW,CAAC;QAC7D,aAAa,EAAE,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC;QACpD,iBAAiB,EAAE,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,sBAAsB,CAAC,MAAc,EAAE,WAAmB;IACjE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAEnB,CAAC;QACT,MAAM,WAAW,GAAG,GAAG,EAAE,WAAW,CAAC;QACrC,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,WAAW,KAAK,UAAU,IAAI,WAAW,KAAK,WAAW,CAAC;QACnE,CAAC;QACD,OAAO,WAAW,EAAE,OAAO,KAAK,MAAM,IAAI,WAAW,EAAE,OAAO,KAAK,OAAO,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC"}
+{"version":3,"file":"doctor-serialize-legs-contract.js","sourceRoot":"","sources":["../../src/cli/doctor-serialize-legs-contract.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAG5C,MAAM,UAAU,GAAG,kCAAkC,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAYhD;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,QAA2B;IACtD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,4BAA4B;QAC1D,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,8BAA8B;KACjE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA2B;IAC3D,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,UAAkB;IAElB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CACxB,UAAU,EACV,SAAS,EACT,WAAW,EACX,iBAAiB,CAClB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAEvE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,2CAA2C;SACpD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,IAAI;YACZ,MAAM,EACJ,sEAAsE;gBACtE,gCAAgC;SACnC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,0BAA0B,EAAE,CAAC;YAChC,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,MAAM;gBACd,MAAM,EACJ,mEAAmE;oBACnE,qEAAqE;oBACrE,6DAA6D;oBAC7D,gEAAgE;oBAChE,qEAAqE;oBACrE,kEAAkE;oBAClE,mEAAmE;oBACnE,gEAAgE;oBAChE,2CAA2C;aAC9C,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,IAAI;YACZ,MAAM,EACJ,mEAAmE;gBACnE,0CAA0C;SAC7C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,MAAM;QACd,MAAM,EACJ,0CAA0C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG;YAClE,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,gBAAgB;YACtD,kEAAkE;YAClE,qEAAqE;YACrE,yEAAyE;YACzE,wEAAwE;YACxE,gEAAgE;YAChE,uEAAuE;YACvE,iEAAiE;YACjE,qEAAqE;YACrE,kEAAkE;YAClE,0CAA0C;KAC7C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,WAAW,GAAG,MAAM;SACvB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SAC5C,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;QACL,OAAO,EAAE,kCAAkC,CAAC,IAAI,CAAC,WAAW,CAAC;QAC7D,aAAa,EAAE,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC;QACpD,iBAAiB,EAAE,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,sBAAsB,CAAC,MAAc,EAAE,WAAmB;IACjE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAEnB,CAAC;QACT,MAAM,WAAW,GAAG,GAAG,EAAE,WAAW,CAAC;QACrC,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,WAAW,KAAK,UAAU,IAAI,WAAW,KAAK,WAAW,CAAC;QACnE,CAAC;QACD,OAAO,WAAW,EAAE,OAAO,KAAK,MAAM,IAAI,WAAW,EAAE,OAAO,KAAK,OAAO,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC"}

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA00EpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAirOjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA00EpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAkrOjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -7562,6 +7562,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/cli/merge-learnings-cmd.test.ts": true,
     "tests/unit/cli/parse-refresh-templates.test.ts": true,
     "tests/unit/cli/prompts.test.ts": true,
+    "tests/unit/cli/serialize-legs-callee-grant.test.ts": true,
     "tests/unit/cli/setup-project.test.ts": true,
     "tests/unit/cli/setup-wiki.test.ts": true,
     "tests/unit/cli/shared-options.test.ts": true,