@codyswann/lisa 3.31.2 → 3.31.4

package/dist/migrations/ensure-lisa-postinstall.d.ts

@@ -38,7 +38,7 @@ export declare const LISA_INVOCATION = "[ -n \"$CI\" ] || LISA_BOOTSTRAP=1 node
  * Any TypeScript/Node project (expo, nestjs, cdk, npm-package, plain typescript) with a
  * custom postinstall (`patch-package && ...`) that never invokes Lisa will not apply
  * template updates automatically on `bun install` / `npm install`. Evidence: frontend-v2
- * (expo) and propswap/frontend (typescript-only) both needed this chained invocation.
+ * (expo) and acmeorga/frontend (typescript-only) both needed this chained invocation.
  * This migration prepends the standard Lisa invocation so template updates apply
  * automatically on install. Rails-only projects are skipped (no Node postinstall).
  */

package/dist/migrations/ensure-lisa-postinstall.js

@@ -103,7 +103,7 @@ function hasNodePostinstallType(detectedTypes) {
  * Any TypeScript/Node project (expo, nestjs, cdk, npm-package, plain typescript) with a
  * custom postinstall (`patch-package && ...`) that never invokes Lisa will not apply
  * template updates automatically on `bun install` / `npm install`. Evidence: frontend-v2
- * (expo) and propswap/frontend (typescript-only) both needed this chained invocation.
+ * (expo) and acmeorga/frontend (typescript-only) both needed this chained invocation.
  * This migration prepends the standard Lisa invocation so template updates apply
  * automatically on install. Rails-only projects are skipped (no Node postinstall).
  */

package/dist/strategies/copy-overwrite.d.ts

@@ -37,7 +37,7 @@ export declare class CopyOverwriteStrategy implements ICopyStrategy {
      *
      * That refresh is unconditional only where Lisa can prove the installed copy
      * is behind. "Differs from mine" is not that proof — it is equally consistent
-     * with the host being *ahead*, which is how `propswapllc/frontend` had a guard
+     * with the host being *ahead*, which is how `acmeorga/frontend` had a guard
      * they had hardened themselves silently replaced by a weaker upstream one. So
      * a Lisa-owned artifact is now classified before it is replaced, and anything
      * short of proof that it is stale leaves the host's copy alone with an

package/dist/strategies/copy-overwrite.js

@@ -78,7 +78,7 @@ export class CopyOverwriteStrategy {
      *
      * That refresh is unconditional only where Lisa can prove the installed copy
      * is behind. "Differs from mine" is not that proof — it is equally consistent
-     * with the host being *ahead*, which is how `propswapllc/frontend` had a guard
+     * with the host being *ahead*, which is how `acmeorga/frontend` had a guard
      * they had hardened themselves silently replaced by a weaker upstream one. So
      * a Lisa-owned artifact is now classified before it is replaced, and anything
      * short of proof that it is stale leaves the host's copy alone with an

package/dist/utils/yaml.js

@@ -10,7 +10,7 @@
  * instantiated — before any Lisa code runs — so the whole CLI is dead,
  * including `lisa doctor`. Lisa declares js-yaml `^4.3.1` for itself, but a
  * host project's `overrides`/`resolutions` collapse Lisa's nested copy onto
- * whatever the host pinned, which is exactly how geminisportsai/frontend-v2
+ * whatever the host pinned, which is exactly how acmeorgb/frontend-v2
  * ended up running Lisa against js-yaml 5 (CodySwannGT/lisa#2467).
  *
  * A namespace import links against any module shape, so the incompatibility

package/eslint-plugin-code-organization/README.md

@@ -1,6 +1,6 @@
 # eslint-plugin-code-organization
 
-ESLint plugin to enforce code organization standards for the PropSwap frontend application.
+ESLint plugin to enforce code organization standards for the AcmeOrgA frontend application.
 
 ## Rules
 

package/expo/copy-overwrite/scripts/classify-maestro-failures.mjs

@@ -29,7 +29,7 @@
  * about the product. When the preamble fails, the flow reds having tested
  * nothing — and it reds on an assertion naming a preamble gate, not the
  * feature, so a reader scoring the run by flow name counts it as a product
- * regression. Upstreamed from TunnlAI/frontend, where proof runs 6
+ * regression. Upstreamed from AcmeOrgD/frontend, where proof runs 6
  * (31424664541) and 7 (31446155638) lost four flows each that way; run 6's
  * Android arm was written up as a possible product regression and every one of
  * those flows came back green in run 7 with no code addressing them.

package/package.json

@@ -131,7 +131,7 @@
     "ws": ">=8.21.0"
   },
   "name": "@codyswann/lisa",
-  "version": "3.31.2",
+  "version": "3.31.4",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.31.2",
+  "version": "3.31.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.31.2",
+  "version": "3.31.4",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-detect-tooling/SKILL.md

@@ -57,7 +57,7 @@ Discovery only works if "what does this run" can be answered from shell text wit
 
 **`$( )` restarts the quoting context.** In `"$(printf '%s' "$JSON" | node -e '…')"`, quotes inside the substitution pair among themselves. A flat scanner falls out of phase on the first one and starts reporting the payload's own string literals.
 
-Against Lisa and the three TunnlAI repositories, what survives is `gitleaks`, `jq`, `gtimeout` and `eas` — every one a real, undeclared invocation, with no false positives.
+Against Lisa and the three AcmeOrgD repositories, what survives is `gitleaks`, `jq`, `gtimeout` and `eas` — every one a real, undeclared invocation, with no false positives.
 
 ## What it will not do
 

package/plugins/lisa/.codex-plugin/skills/lisa-drive-pr-to-merge/SKILL.md

@@ -162,7 +162,7 @@ ends in between — turns exhausted, job timeout, or you concluding the work whi
 checks are still pending — the latch stays off and nothing restores it. The PR is
 left WORSE OFF THAN IF THIS SKILL HAD NEVER RUN: it has lost the mechanism that
 merges it while no agent is watching, and the run reports success. Measured on
-`gunnertech/frontend#282`, the latch went off 14s before the fix commit and the
+`acmeorgc/frontend#282`, the latch went off 14s before the fix commit and the
 PR sat 26 minutes after going green, against ~3 minutes for PRs this skill never
 touched.
 
@@ -364,7 +364,7 @@ Ancestry proves your code is *in* the merged branch; it does **not** prove
 anything deployed. GitHub can **suppress the `on: push` event for a merge commit
 created by auto-merge or a bot token** (`GITHUB_TOKEN`), so the deploy workflow
 fires **zero** runs — no run, not even a `startup_failure` — while the ancestry
-check above stays green. Incident of record: TunnlAI/frontend **TUN-186** (PR #67)
+check above stays green. Incident of record: AcmeOrgD/frontend **TUN-186** (PR #67)
 merged to `dev` via auto-merge; the merge commit `1b3f836` produced **no**
 `deploy.yml` run, and only the next human push `d1fe18c` (which carries `1b3f836`
 as an ancestor) actually shipped it. **Never report shipped on ancestry alone.**
@@ -423,7 +423,7 @@ of section 2 are diagnose-only).
 
 Linear's GitHub integration completes a linked Issue on merge to **any** branch
 — branch-name linkage alone triggers it, even when the PR body carries only the
-non-closing `Linear: <ID>` reference form (incident of record: TunnlAI backend
+non-closing `Linear: <ID>` reference form (incident of record: AcmeOrgD backend
 PR #207 merged to `dev`; TUN-256 auto-completed and had to be manually
 reverted). Run this step **as soon as the PR reports `MERGED`**, before the
 deploy-run verification above can terminate the flow — a `blocked:deploy`

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/SKILL.md

@@ -239,7 +239,7 @@ An org secret defaults to `--visibility private`. `all` reaches public repositor
 ```json
 "propagating": [
   "LINEAR_API_KEY",
-  { "name": "NPM_TOKEN", "targets": ["TunnlAI", "TunnlAI/wiki"] }
+  { "name": "NPM_TOKEN", "targets": ["AcmeOrgD", "AcmeOrgD/wiki"] }
 ]
 ```
 

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/materialize-secrets.mjs

@@ -248,8 +248,8 @@ export function installAwsProfiles(bundle, options = {}) {
   // Refuse to write a profile name the operator already uses outside our block.
   //
   // AWS does not error on a duplicate `[profile x]` — it resolves one and
-  // ignores the other. So writing `tunnl-dev` next to an operator's existing SSO
-  // `tunnl-dev` would silently run some calls as the wrong identity, which is
+  // ignores the other. So writing `acmeorgd-dev` next to an operator's existing SSO
+  // `acmeorgd-dev` would silently run some calls as the wrong identity, which is
   // worse than either winning outright. Merging protects their sections from
   // being deleted; this protects them from being shadowed.
   //

package/plugins/lisa/.codex-plugin/skills/lisa-setup-notion/SKILL.md

@@ -51,7 +51,7 @@ Print instructions for the user:
 
 The user picks a stable identifier for this workspace. Two options:
 
-- **Workspace name** (human-readable, e.g., `Gemini Sports`). Easy to recognize, can be ambiguous if a workspace is renamed in Notion. Recommended.
+- **Workspace name** (human-readable, e.g., `AcmeOrgB`). Easy to recognize, can be ambiguous if a workspace is renamed in Notion. Recommended.
 - **Workspace UUID** (returned by Notion's API). Stable but opaque.
 
 Default to the workspace name. After the user stores the token (Step 4), Step 5's `/users/me` call surfaces the actual `bot.workspace_name`; if it differs from what the user typed (capitalization, trailing whitespace), prompt to confirm.
@@ -60,7 +60,7 @@ Default to the workspace name. After the user stores the token (Step 4), Step 5'
 WORKSPACE=$(jq -r '.notion.workspaceId // empty' .lisa.config.json 2>/dev/null)
 if [ -z "$WORKSPACE" ]; then
   # Prompt the user — accept any non-empty string. They pick the slug; we just store it.
-  read -p "Workspace identifier (any stable slug, e.g. 'gemini-sports'): " WORKSPACE
+  read -p "Workspace identifier (any stable slug, e.g. 'acme-org-b'): " WORKSPACE
 fi
 ```
 

package/plugins/lisa/rules/reference/claim-time-guards.md

@@ -1,6 +1,6 @@
 # Claim-Time Guards
 
-Two guards that run when build-intake claims a ready item. Both come from geminisportsai's hand-rolled `sprint-loop` and both address failures actually observed there — an item built twice because it had already shipped, and a loop burning cycles re-attempting an item that was never going to succeed.
+Two guards that run when build-intake claims a ready item. Both come from acmeorgb's hand-rolled `sprint-loop` and both address failures actually observed there — an item built twice because it had already shipped, and a loop burning cycles re-attempting an item that was never going to succeed.
 
 It is a **single vendor-neutral contract** consumed by all three build-intake skills (`lisa-github-build-intake`, `lisa-jira-build-intake`, `lisa-linear-build-intake`). Each arm cites this slug in its claim step rather than growing its own copy, exactly as the arms cite `leaf-only-lifecycle`, `repo-scope-split`, `rejection-detection`, and `claim-archaeology`. One slug is what keeps a guard that fires on GitHub from being absent on Linear.
 

package/plugins/lisa/skills/lisa-detect-tooling/SKILL.md

@@ -57,7 +57,7 @@ Discovery only works if "what does this run" can be answered from shell text wit
 
 **`$( )` restarts the quoting context.** In `"$(printf '%s' "$JSON" | node -e '…')"`, quotes inside the substitution pair among themselves. A flat scanner falls out of phase on the first one and starts reporting the payload's own string literals.
 
-Against Lisa and the three TunnlAI repositories, what survives is `gitleaks`, `jq`, `gtimeout` and `eas` — every one a real, undeclared invocation, with no false positives.
+Against Lisa and the three AcmeOrgD repositories, what survives is `gitleaks`, `jq`, `gtimeout` and `eas` — every one a real, undeclared invocation, with no false positives.
 
 ## What it will not do
 

package/plugins/lisa/skills/lisa-drive-pr-to-merge/SKILL.md

@@ -162,7 +162,7 @@ ends in between — turns exhausted, job timeout, or you concluding the work whi
 checks are still pending — the latch stays off and nothing restores it. The PR is
 left WORSE OFF THAN IF THIS SKILL HAD NEVER RUN: it has lost the mechanism that
 merges it while no agent is watching, and the run reports success. Measured on
-`gunnertech/frontend#282`, the latch went off 14s before the fix commit and the
+`acmeorgc/frontend#282`, the latch went off 14s before the fix commit and the
 PR sat 26 minutes after going green, against ~3 minutes for PRs this skill never
 touched.
 
@@ -364,7 +364,7 @@ Ancestry proves your code is *in* the merged branch; it does **not** prove
 anything deployed. GitHub can **suppress the `on: push` event for a merge commit
 created by auto-merge or a bot token** (`GITHUB_TOKEN`), so the deploy workflow
 fires **zero** runs — no run, not even a `startup_failure` — while the ancestry
-check above stays green. Incident of record: TunnlAI/frontend **TUN-186** (PR #67)
+check above stays green. Incident of record: AcmeOrgD/frontend **TUN-186** (PR #67)
 merged to `dev` via auto-merge; the merge commit `1b3f836` produced **no**
 `deploy.yml` run, and only the next human push `d1fe18c` (which carries `1b3f836`
 as an ancestor) actually shipped it. **Never report shipped on ancestry alone.**
@@ -423,7 +423,7 @@ of section 2 are diagnose-only).
 
 Linear's GitHub integration completes a linked Issue on merge to **any** branch
 — branch-name linkage alone triggers it, even when the PR body carries only the
-non-closing `Linear: <ID>` reference form (incident of record: TunnlAI backend
+non-closing `Linear: <ID>` reference form (incident of record: AcmeOrgD backend
 PR #207 merged to `dev`; TUN-256 auto-completed and had to be manually
 reverted). Run this step **as soon as the PR reports `MERGED`**, before the
 deploy-run verification above can terminate the flow — a `blocked:deploy`

package/plugins/lisa/skills/lisa-secrets-access/SKILL.md

@@ -239,7 +239,7 @@ An org secret defaults to `--visibility private`. `all` reaches public repositor
 ```json
 "propagating": [
   "LINEAR_API_KEY",
-  { "name": "NPM_TOKEN", "targets": ["TunnlAI", "TunnlAI/wiki"] }
+  { "name": "NPM_TOKEN", "targets": ["AcmeOrgD", "AcmeOrgD/wiki"] }
 ]
 ```
 

package/plugins/lisa/skills/lisa-secrets-access/scripts/materialize-secrets.mjs

@@ -248,8 +248,8 @@ export function installAwsProfiles(bundle, options = {}) {
   // Refuse to write a profile name the operator already uses outside our block.
   //
   // AWS does not error on a duplicate `[profile x]` — it resolves one and
-  // ignores the other. So writing `tunnl-dev` next to an operator's existing SSO
-  // `tunnl-dev` would silently run some calls as the wrong identity, which is
+  // ignores the other. So writing `acmeorgd-dev` next to an operator's existing SSO
+  // `acmeorgd-dev` would silently run some calls as the wrong identity, which is
   // worse than either winning outright. Merging protects their sections from
   // being deleted; this protects them from being shadowed.
   //

package/plugins/lisa/skills/lisa-setup-notion/SKILL.md

@@ -51,7 +51,7 @@ Print instructions for the user:
 
 The user picks a stable identifier for this workspace. Two options:
 
-- **Workspace name** (human-readable, e.g., `Gemini Sports`). Easy to recognize, can be ambiguous if a workspace is renamed in Notion. Recommended.
+- **Workspace name** (human-readable, e.g., `AcmeOrgB`). Easy to recognize, can be ambiguous if a workspace is renamed in Notion. Recommended.
 - **Workspace UUID** (returned by Notion's API). Stable but opaque.
 
 Default to the workspace name. After the user stores the token (Step 4), Step 5's `/users/me` call surfaces the actual `bot.workspace_name`; if it differs from what the user typed (capitalization, trailing whitespace), prompt to confirm.
@@ -60,7 +60,7 @@ Default to the workspace name. After the user stores the token (Step 4), Step 5'
 WORKSPACE=$(jq -r '.notion.workspaceId // empty' .lisa.config.json 2>/dev/null)
 if [ -z "$WORKSPACE" ]; then
   # Prompt the user — accept any non-empty string. They pick the slug; we just store it.
-  read -p "Workspace identifier (any stable slug, e.g. 'gemini-sports'): " WORKSPACE
+  read -p "Workspace identifier (any stable slug, e.g. 'acme-org-b'): " WORKSPACE
 fi
 ```
 

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.31.2",
+  "version": "3.31.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-detect-tooling/SKILL.md

@@ -57,7 +57,7 @@ Discovery only works if "what does this run" can be answered from shell text wit
 
 **`$( )` restarts the quoting context.** In `"$(printf '%s' "$JSON" | node -e '…')"`, quotes inside the substitution pair among themselves. A flat scanner falls out of phase on the first one and starts reporting the payload's own string literals.
 
-Against Lisa and the three TunnlAI repositories, what survives is `gitleaks`, `jq`, `gtimeout` and `eas` — every one a real, undeclared invocation, with no false positives.
+Against Lisa and the three AcmeOrgD repositories, what survives is `gitleaks`, `jq`, `gtimeout` and `eas` — every one a real, undeclared invocation, with no false positives.
 
 ## What it will not do
 

package/plugins/lisa-agy/skills/lisa-drive-pr-to-merge/SKILL.md

@@ -162,7 +162,7 @@ ends in between — turns exhausted, job timeout, or you concluding the work whi
 checks are still pending — the latch stays off and nothing restores it. The PR is
 left WORSE OFF THAN IF THIS SKILL HAD NEVER RUN: it has lost the mechanism that
 merges it while no agent is watching, and the run reports success. Measured on
-`gunnertech/frontend#282`, the latch went off 14s before the fix commit and the
+`acmeorgc/frontend#282`, the latch went off 14s before the fix commit and the
 PR sat 26 minutes after going green, against ~3 minutes for PRs this skill never
 touched.
 
@@ -364,7 +364,7 @@ Ancestry proves your code is *in* the merged branch; it does **not** prove
 anything deployed. GitHub can **suppress the `on: push` event for a merge commit
 created by auto-merge or a bot token** (`GITHUB_TOKEN`), so the deploy workflow
 fires **zero** runs — no run, not even a `startup_failure` — while the ancestry
-check above stays green. Incident of record: TunnlAI/frontend **TUN-186** (PR #67)
+check above stays green. Incident of record: AcmeOrgD/frontend **TUN-186** (PR #67)
 merged to `dev` via auto-merge; the merge commit `1b3f836` produced **no**
 `deploy.yml` run, and only the next human push `d1fe18c` (which carries `1b3f836`
 as an ancestor) actually shipped it. **Never report shipped on ancestry alone.**
@@ -423,7 +423,7 @@ of section 2 are diagnose-only).
 
 Linear's GitHub integration completes a linked Issue on merge to **any** branch
 — branch-name linkage alone triggers it, even when the PR body carries only the
-non-closing `Linear: <ID>` reference form (incident of record: TunnlAI backend
+non-closing `Linear: <ID>` reference form (incident of record: AcmeOrgD backend
 PR #207 merged to `dev`; TUN-256 auto-completed and had to be manually
 reverted). Run this step **as soon as the PR reports `MERGED`**, before the
 deploy-run verification above can terminate the flow — a `blocked:deploy`

package/plugins/lisa-agy/skills/lisa-secrets-access/SKILL.md

@@ -239,7 +239,7 @@ An org secret defaults to `--visibility private`. `all` reaches public repositor
 ```json
 "propagating": [
   "LINEAR_API_KEY",
-  { "name": "NPM_TOKEN", "targets": ["TunnlAI", "TunnlAI/wiki"] }
+  { "name": "NPM_TOKEN", "targets": ["AcmeOrgD", "AcmeOrgD/wiki"] }
 ]
 ```
 

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/materialize-secrets.mjs

@@ -248,8 +248,8 @@ export function installAwsProfiles(bundle, options = {}) {
   // Refuse to write a profile name the operator already uses outside our block.
   //
   // AWS does not error on a duplicate `[profile x]` — it resolves one and
-  // ignores the other. So writing `tunnl-dev` next to an operator's existing SSO
-  // `tunnl-dev` would silently run some calls as the wrong identity, which is
+  // ignores the other. So writing `acmeorgd-dev` next to an operator's existing SSO
+  // `acmeorgd-dev` would silently run some calls as the wrong identity, which is
   // worse than either winning outright. Merging protects their sections from
   // being deleted; this protects them from being shadowed.
   //

package/plugins/lisa-agy/skills/lisa-setup-notion/SKILL.md

@@ -51,7 +51,7 @@ Print instructions for the user:
 
 The user picks a stable identifier for this workspace. Two options:
 
-- **Workspace name** (human-readable, e.g., `Gemini Sports`). Easy to recognize, can be ambiguous if a workspace is renamed in Notion. Recommended.
+- **Workspace name** (human-readable, e.g., `AcmeOrgB`). Easy to recognize, can be ambiguous if a workspace is renamed in Notion. Recommended.
 - **Workspace UUID** (returned by Notion's API). Stable but opaque.
 
 Default to the workspace name. After the user stores the token (Step 4), Step 5's `/users/me` call surfaces the actual `bot.workspace_name`; if it differs from what the user typed (capitalization, trailing whitespace), prompt to confirm.
@@ -60,7 +60,7 @@ Default to the workspace name. After the user stores the token (Step 4), Step 5'
 WORKSPACE=$(jq -r '.notion.workspaceId // empty' .lisa.config.json 2>/dev/null)
 if [ -z "$WORKSPACE" ]; then
   # Prompt the user — accept any non-empty string. They pick the slug; we just store it.
-  read -p "Workspace identifier (any stable slug, e.g. 'gemini-sports'): " WORKSPACE
+  read -p "Workspace identifier (any stable slug, e.g. 'acme-org-b'): " WORKSPACE
 fi
 ```
 

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.31.2",
+  "version": "3.31.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.31.2",
+  "version": "3.31.4",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.31.2",
+  "version": "3.31.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.31.2",
+  "version": "3.31.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.31.2",
+  "version": "3.31.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.31.2",
+  "version": "3.31.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/rules/reference/claim-time-guards.md

@@ -1,6 +1,6 @@
 # Claim-Time Guards
 
-Two guards that run when build-intake claims a ready item. Both come from geminisportsai's hand-rolled `sprint-loop` and both address failures actually observed there — an item built twice because it had already shipped, and a loop burning cycles re-attempting an item that was never going to succeed.
+Two guards that run when build-intake claims a ready item. Both come from acmeorgb's hand-rolled `sprint-loop` and both address failures actually observed there — an item built twice because it had already shipped, and a loop burning cycles re-attempting an item that was never going to succeed.
 
 It is a **single vendor-neutral contract** consumed by all three build-intake skills (`lisa-github-build-intake`, `lisa-jira-build-intake`, `lisa-linear-build-intake`). Each arm cites this slug in its claim step rather than growing its own copy, exactly as the arms cite `leaf-only-lifecycle`, `repo-scope-split`, `rejection-detection`, and `claim-archaeology`. One slug is what keeps a guard that fires on GitHub from being absent on Linear.
 

package/plugins/lisa-copilot/skills/lisa-detect-tooling/SKILL.md

@@ -57,7 +57,7 @@ Discovery only works if "what does this run" can be answered from shell text wit
 
 **`$( )` restarts the quoting context.** In `"$(printf '%s' "$JSON" | node -e '…')"`, quotes inside the substitution pair among themselves. A flat scanner falls out of phase on the first one and starts reporting the payload's own string literals.
 
-Against Lisa and the three TunnlAI repositories, what survives is `gitleaks`, `jq`, `gtimeout` and `eas` — every one a real, undeclared invocation, with no false positives.
+Against Lisa and the three AcmeOrgD repositories, what survives is `gitleaks`, `jq`, `gtimeout` and `eas` — every one a real, undeclared invocation, with no false positives.
 
 ## What it will not do
 

package/plugins/lisa-copilot/skills/lisa-drive-pr-to-merge/SKILL.md

@@ -162,7 +162,7 @@ ends in between — turns exhausted, job timeout, or you concluding the work whi
 checks are still pending — the latch stays off and nothing restores it. The PR is
 left WORSE OFF THAN IF THIS SKILL HAD NEVER RUN: it has lost the mechanism that
 merges it while no agent is watching, and the run reports success. Measured on
-`gunnertech/frontend#282`, the latch went off 14s before the fix commit and the
+`acmeorgc/frontend#282`, the latch went off 14s before the fix commit and the
 PR sat 26 minutes after going green, against ~3 minutes for PRs this skill never
 touched.
 
@@ -364,7 +364,7 @@ Ancestry proves your code is *in* the merged branch; it does **not** prove
 anything deployed. GitHub can **suppress the `on: push` event for a merge commit
 created by auto-merge or a bot token** (`GITHUB_TOKEN`), so the deploy workflow
 fires **zero** runs — no run, not even a `startup_failure` — while the ancestry
-check above stays green. Incident of record: TunnlAI/frontend **TUN-186** (PR #67)
+check above stays green. Incident of record: AcmeOrgD/frontend **TUN-186** (PR #67)
 merged to `dev` via auto-merge; the merge commit `1b3f836` produced **no**
 `deploy.yml` run, and only the next human push `d1fe18c` (which carries `1b3f836`
 as an ancestor) actually shipped it. **Never report shipped on ancestry alone.**
@@ -423,7 +423,7 @@ of section 2 are diagnose-only).
 
 Linear's GitHub integration completes a linked Issue on merge to **any** branch
 — branch-name linkage alone triggers it, even when the PR body carries only the
-non-closing `Linear: <ID>` reference form (incident of record: TunnlAI backend
+non-closing `Linear: <ID>` reference form (incident of record: AcmeOrgD backend
 PR #207 merged to `dev`; TUN-256 auto-completed and had to be manually
 reverted). Run this step **as soon as the PR reports `MERGED`**, before the
 deploy-run verification above can terminate the flow — a `blocked:deploy`

package/plugins/lisa-copilot/skills/lisa-secrets-access/SKILL.md

@@ -239,7 +239,7 @@ An org secret defaults to `--visibility private`. `all` reaches public repositor
 ```json
 "propagating": [
   "LINEAR_API_KEY",
-  { "name": "NPM_TOKEN", "targets": ["TunnlAI", "TunnlAI/wiki"] }
+  { "name": "NPM_TOKEN", "targets": ["AcmeOrgD", "AcmeOrgD/wiki"] }
 ]
 ```
 

package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/materialize-secrets.mjs

@@ -248,8 +248,8 @@ export function installAwsProfiles(bundle, options = {}) {
   // Refuse to write a profile name the operator already uses outside our block.
   //
   // AWS does not error on a duplicate `[profile x]` — it resolves one and
-  // ignores the other. So writing `tunnl-dev` next to an operator's existing SSO
-  // `tunnl-dev` would silently run some calls as the wrong identity, which is
+  // ignores the other. So writing `acmeorgd-dev` next to an operator's existing SSO
+  // `acmeorgd-dev` would silently run some calls as the wrong identity, which is
   // worse than either winning outright. Merging protects their sections from
   // being deleted; this protects them from being shadowed.
   //

package/plugins/lisa-copilot/skills/lisa-setup-notion/SKILL.md

@@ -51,7 +51,7 @@ Print instructions for the user:
 
 The user picks a stable identifier for this workspace. Two options:
 
-- **Workspace name** (human-readable, e.g., `Gemini Sports`). Easy to recognize, can be ambiguous if a workspace is renamed in Notion. Recommended.
+- **Workspace name** (human-readable, e.g., `AcmeOrgB`). Easy to recognize, can be ambiguous if a workspace is renamed in Notion. Recommended.
 - **Workspace UUID** (returned by Notion's API). Stable but opaque.
 
 Default to the workspace name. After the user stores the token (Step 4), Step 5's `/users/me` call surfaces the actual `bot.workspace_name`; if it differs from what the user typed (capitalization, trailing whitespace), prompt to confirm.
@@ -60,7 +60,7 @@ Default to the workspace name. After the user stores the token (Step 4), Step 5'
 WORKSPACE=$(jq -r '.notion.workspaceId // empty' .lisa.config.json 2>/dev/null)
 if [ -z "$WORKSPACE" ]; then
   # Prompt the user — accept any non-empty string. They pick the slug; we just store it.
-  read -p "Workspace identifier (any stable slug, e.g. 'gemini-sports'): " WORKSPACE
+  read -p "Workspace identifier (any stable slug, e.g. 'acme-org-b'): " WORKSPACE
 fi
 ```
 

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.31.2",
+  "version": "3.31.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/rules/claim-time-guards-reference.mdc

@@ -5,7 +5,7 @@ alwaysApply: false
 
 # Claim-Time Guards
 
-Two guards that run when build-intake claims a ready item. Both come from geminisportsai's hand-rolled `sprint-loop` and both address failures actually observed there — an item built twice because it had already shipped, and a loop burning cycles re-attempting an item that was never going to succeed.
+Two guards that run when build-intake claims a ready item. Both come from acmeorgb's hand-rolled `sprint-loop` and both address failures actually observed there — an item built twice because it had already shipped, and a loop burning cycles re-attempting an item that was never going to succeed.
 
 It is a **single vendor-neutral contract** consumed by all three build-intake skills (`lisa-github-build-intake`, `lisa-jira-build-intake`, `lisa-linear-build-intake`). Each arm cites this slug in its claim step rather than growing its own copy, exactly as the arms cite `leaf-only-lifecycle`, `repo-scope-split`, `rejection-detection`, and `claim-archaeology`. One slug is what keeps a guard that fires on GitHub from being absent on Linear.
 

package/plugins/lisa-cursor/skills/lisa-detect-tooling/SKILL.md

@@ -57,7 +57,7 @@ Discovery only works if "what does this run" can be answered from shell text wit
 
 **`$( )` restarts the quoting context.** In `"$(printf '%s' "$JSON" | node -e '…')"`, quotes inside the substitution pair among themselves. A flat scanner falls out of phase on the first one and starts reporting the payload's own string literals.
 
-Against Lisa and the three TunnlAI repositories, what survives is `gitleaks`, `jq`, `gtimeout` and `eas` — every one a real, undeclared invocation, with no false positives.
+Against Lisa and the three AcmeOrgD repositories, what survives is `gitleaks`, `jq`, `gtimeout` and `eas` — every one a real, undeclared invocation, with no false positives.
 
 ## What it will not do
 

package/plugins/lisa-cursor/skills/lisa-drive-pr-to-merge/SKILL.md

@@ -162,7 +162,7 @@ ends in between — turns exhausted, job timeout, or you concluding the work whi
 checks are still pending — the latch stays off and nothing restores it. The PR is
 left WORSE OFF THAN IF THIS SKILL HAD NEVER RUN: it has lost the mechanism that
 merges it while no agent is watching, and the run reports success. Measured on
-`gunnertech/frontend#282`, the latch went off 14s before the fix commit and the
+`acmeorgc/frontend#282`, the latch went off 14s before the fix commit and the
 PR sat 26 minutes after going green, against ~3 minutes for PRs this skill never
 touched.
 
@@ -364,7 +364,7 @@ Ancestry proves your code is *in* the merged branch; it does **not** prove
 anything deployed. GitHub can **suppress the `on: push` event for a merge commit
 created by auto-merge or a bot token** (`GITHUB_TOKEN`), so the deploy workflow
 fires **zero** runs — no run, not even a `startup_failure` — while the ancestry
-check above stays green. Incident of record: TunnlAI/frontend **TUN-186** (PR #67)
+check above stays green. Incident of record: AcmeOrgD/frontend **TUN-186** (PR #67)
 merged to `dev` via auto-merge; the merge commit `1b3f836` produced **no**
 `deploy.yml` run, and only the next human push `d1fe18c` (which carries `1b3f836`
 as an ancestor) actually shipped it. **Never report shipped on ancestry alone.**
@@ -423,7 +423,7 @@ of section 2 are diagnose-only).
 
 Linear's GitHub integration completes a linked Issue on merge to **any** branch
 — branch-name linkage alone triggers it, even when the PR body carries only the
-non-closing `Linear: <ID>` reference form (incident of record: TunnlAI backend
+non-closing `Linear: <ID>` reference form (incident of record: AcmeOrgD backend
 PR #207 merged to `dev`; TUN-256 auto-completed and had to be manually
 reverted). Run this step **as soon as the PR reports `MERGED`**, before the
 deploy-run verification above can terminate the flow — a `blocked:deploy`

package/plugins/lisa-cursor/skills/lisa-secrets-access/SKILL.md

@@ -239,7 +239,7 @@ An org secret defaults to `--visibility private`. `all` reaches public repositor
 ```json
 "propagating": [
   "LINEAR_API_KEY",
-  { "name": "NPM_TOKEN", "targets": ["TunnlAI", "TunnlAI/wiki"] }
+  { "name": "NPM_TOKEN", "targets": ["AcmeOrgD", "AcmeOrgD/wiki"] }
 ]
 ```
 

package/plugins/lisa-cursor/skills/lisa-secrets-access/scripts/materialize-secrets.mjs

@@ -248,8 +248,8 @@ export function installAwsProfiles(bundle, options = {}) {
   // Refuse to write a profile name the operator already uses outside our block.
   //
   // AWS does not error on a duplicate `[profile x]` — it resolves one and
-  // ignores the other. So writing `tunnl-dev` next to an operator's existing SSO
-  // `tunnl-dev` would silently run some calls as the wrong identity, which is
+  // ignores the other. So writing `acmeorgd-dev` next to an operator's existing SSO
+  // `acmeorgd-dev` would silently run some calls as the wrong identity, which is
   // worse than either winning outright. Merging protects their sections from
   // being deleted; this protects them from being shadowed.
   //

package/plugins/lisa-cursor/skills/lisa-setup-notion/SKILL.md

@@ -51,7 +51,7 @@ Print instructions for the user:
 
 The user picks a stable identifier for this workspace. Two options:
 
-- **Workspace name** (human-readable, e.g., `Gemini Sports`). Easy to recognize, can be ambiguous if a workspace is renamed in Notion. Recommended.
+- **Workspace name** (human-readable, e.g., `AcmeOrgB`). Easy to recognize, can be ambiguous if a workspace is renamed in Notion. Recommended.
 - **Workspace UUID** (returned by Notion's API). Stable but opaque.
 
 Default to the workspace name. After the user stores the token (Step 4), Step 5's `/users/me` call surfaces the actual `bot.workspace_name`; if it differs from what the user typed (capitalization, trailing whitespace), prompt to confirm.
@@ -60,7 +60,7 @@ Default to the workspace name. After the user stores the token (Step 4), Step 5'
 WORKSPACE=$(jq -r '.notion.workspaceId // empty' .lisa.config.json 2>/dev/null)
 if [ -z "$WORKSPACE" ]; then
   # Prompt the user — accept any non-empty string. They pick the slug; we just store it.
-  read -p "Workspace identifier (any stable slug, e.g. 'gemini-sports'): " WORKSPACE
+  read -p "Workspace identifier (any stable slug, e.g. 'acme-org-b'): " WORKSPACE
 fi
 ```