@codyswann/lisa 3.4.0 → 3.5.0

package/expo/copy-overwrite/scripts/bdd/report.mjs

@@ -18,6 +18,7 @@
  */
 import {
   REPORT_SCHEMA_VERSION,
+  byCodeUnit,
   runnersByPlatform,
   trackerUrl,
 } from "./contract.mjs";
@@ -73,19 +74,24 @@ function buildTestInventory(discovery, contract) {
  * required here" and "everything required here is covered" are different
  * claims, and printing the second for the first is how a platform with no
  * obligations comes to look fully covered.
+ *
+ * `percentage` is ROUNDED FOR DISPLAY and `exact` is not. Only `exact` is ever
+ * compared against a floor: 2000 of 2001 obligations is 99.95002%, which
+ * rounds to 100.0, and a genuinely-below-floor platform reporting `ok: true`
+ * because of a display convention is the same class of false headline this
+ * whole report is built to prevent.
  * @param {readonly object[]} subset - Obligations to count.
  * @param {ReadonlySet<string>} coveredKeys - Keys with an aligned mapping.
- * @returns {object} Covered/total/percentage.
+ * @returns {object} Covered/total/percentage/exact.
  */
 function summarize(subset, coveredKeys) {
   const covered = subset.filter(item => coveredKeys.has(item.key)).length;
+  const exact = subset.length === 0 ? null : (covered / subset.length) * 100;
   return {
     covered,
     total: subset.length,
-    percentage:
-      subset.length === 0
-        ? null
-        : Number(((covered / subset.length) * 100).toFixed(1)),
+    percentage: exact === null ? null : Number(exact.toFixed(1)),
+    exact,
   };
 }
 
@@ -212,7 +218,7 @@ export function buildExecution(mappings, runs) {
     notRunTests: outcomes
       .filter(item => item.result === null)
       .map(item => `${item.runner} ${item.file} :: ${item.evidence}`)
-      .sort(),
+      .sort(byCodeUnit),
   };
 }
 
@@ -268,18 +274,23 @@ function classifyFloor(declared) {
  */
 export function evaluateFloor(contract, byPlatform, platforms) {
   const floors = contract.coverageFloor ?? {};
-  const entries = [...platforms].sort().map(platform => {
+  const entries = [...platforms].sort(byCodeUnit).map(platform => {
     const declared = classifyFloor(floors[platform]);
     // A platform with no obligations reports `null`, not 100. It cannot clear
     // a positive floor by having nothing to measure.
     const actual = byPlatform[platform]?.percentage ?? null;
+    // The UNROUNDED value decides. `actual` above is the display figure and is
+    // kept only so the report and the operator message agree with the rest of
+    // the traceability block.
+    const exact = byPlatform[platform]?.exact ?? null;
     return [
       platform,
       {
         floor: declared.value,
         state: declared.state,
         actual,
-        ok: isFloorMet(declared, actual),
+        exact,
+        ok: isFloorMet(declared, exact),
       },
     ];
   });
@@ -302,7 +313,7 @@ export function evaluateFloor(contract, byPlatform, platforms) {
  * disable enforcement. An unset floor has nothing to clear here; the enforced
  * mode reports its absence separately.
  * @param {{state: string, value: number|null}} declared - The classified floor.
- * @param {number|null} actual - Measured percentage, or null when there are no obligations.
+ * @param {number|null} actual - Measured UNROUNDED percentage, or null when there are no obligations.
  * @returns {boolean} Whether the floor is satisfied.
  */
 function isFloorMet(declared, actual) {
@@ -338,7 +349,10 @@ export function buildTrackerIndex(scenarios, trackers) {
       scenario => scenario.trackers.length === 0
     ).length,
     tags: [...tags.values()]
-      .map(entry => ({ ...entry, scenarios: [...entry.scenarios].sort() }))
+      .map(entry => ({
+        ...entry,
+        scenarios: [...entry.scenarios].sort(byCodeUnit),
+      }))
       .sort((a, b) => a.tag.localeCompare(b.tag)),
   };
 }
@@ -366,7 +380,7 @@ export function buildReport({
   const obligations = declared.filter(item => !waivedKeys.has(item.key));
   const coveredKeys = coverageKeys(scenarios, contract, unresolved);
   const byPlatform = Object.fromEntries(
-    [...platforms].sort().map(platform => [
+    [...platforms].sort(byCodeUnit).map(platform => [
       platform,
       summarize(
         obligations.filter(item => item.platform === platform),
@@ -460,7 +474,7 @@ function countScenarios(scenarios) {
 function byRunnerSummary(contract, obligations, coveredKeys) {
   return Object.fromEntries(
     Object.keys(contract.runnerPlatforms ?? {})
-      .sort()
+      .sort(byCodeUnit)
       .map(runner => [
         runner,
         summarize(

package/expo/copy-overwrite/scripts/bdd/validate.mjs

@@ -9,7 +9,7 @@
  */
 import * as fs from "node:fs";
 
-import { runnersByPlatform } from "./contract.mjs";
+import { byCodeUnit, runnersByPlatform } from "./contract.mjs";
 import { resolveInsideRepo } from "./parse.mjs";
 
 /**
@@ -43,7 +43,7 @@ export function validateScenarios(scenarios, platforms) {
       defects.push(
         defect(
           "scenario-platform",
-          `${at} declares no platform; expected one of ${[...platforms].sort().join(", ") || "(none configured)"}`
+          `${at} declares no platform; expected one of ${[...platforms].sort(byCodeUnit).join(", ") || "(none configured)"}`
         )
       );
     }

package/expo/copy-overwrite/scripts/bdd/waivers.mjs

@@ -22,10 +22,16 @@ const REQUIRED_FIELDS = [
 ];
 
 /** ISO calendar date, the only accepted date shape. */
-const ISO_DATE = /^\d{4}-\d{2}-\d{2}$/;
+export const ISO_DATE = /^\d{4}-\d{2}-\d{2}$/;
 
 /**
  * Validate every waiver in the coverage map.
+ *
+ * The evaluation date is validated FIRST and reported as a defect of its own.
+ * Expiry is a lexical `<` comparison against an ISO date, and every comparison
+ * with a non-date string is false — so an unusable `BDD_TODAY` did not merely
+ * skip the expiry check, it silently passed EVERY expired waiver in the repo.
+ * A date the gate cannot read is a finding, never a free pass.
  * @param {object} input - Scenarios, contract, and the evaluation date.
  * @returns {object[]} Defects found.
  */
@@ -34,7 +40,15 @@ export function validateWaivers({ scenarios, contract, today }) {
   const platformRunners = runnersByPlatform(contract.runnerPlatforms);
   const mapped = mappedKeys(contract);
   const seen = new Set();
-  const defects = [];
+  const usableToday = typeof today === "string" && ISO_DATE.test(today);
+  const defects = usableToday
+    ? []
+    : [
+        defect(
+          "waiver-metadata",
+          `the evaluation date ${JSON.stringify(today ?? null)} is not an ISO date (YYYY-MM-DD), so no waiver expiry could be evaluated. Set BDD_TODAY to a calendar date or leave it unset.`
+        ),
+      ];
   for (const [index, waiver] of (contract.platformWaivers ?? []).entries()) {
     const at = `coverage-map.platformWaivers[${index}] ${waiver.scenario ?? "(no scenario)"}`;
     const scenario = byId.get(waiver.scenario);
@@ -43,7 +57,7 @@ export function validateWaivers({ scenarios, contract, today }) {
       defects.push(blocking);
       continue;
     }
-    defects.push(...metadataDefects(waiver, at, today));
+    defects.push(...metadataDefects(waiver, at, usableToday ? today : null));
     defects.push(...runnerDefects(waiver, platformRunners, at));
     defects.push(...platformDefects(waiver, scenario, { mapped, seen }, at));
   }
@@ -96,7 +110,7 @@ function blockingError(waiver, scenario, at) {
  * waiver — the time-box is what stops an IOU from becoming permanent.
  * @param {object} waiver - Raw waiver entry.
  * @param {string} at - Location label.
- * @param {string} today - ISO date the run is evaluated against.
+ * @param {string|null} today - ISO date the run is evaluated against, or null when unusable.
  * @returns {object[]} Defects found.
  */
 function metadataDefects(waiver, at, today) {
@@ -125,6 +139,7 @@ function metadataDefects(waiver, at, today) {
     );
   }
   if (
+    today !== null &&
     waiver.expiresAt &&
     ISO_DATE.test(waiver.expiresAt) &&
     waiver.expiresAt < today

package/expo/copy-overwrite/scripts/bdd-matrix.mjs

@@ -20,7 +20,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
-import { declaredPlatforms, trackerUrl } from "./bdd/contract.mjs";
+import { byCodeUnit, declaredPlatforms, trackerUrl } from "./bdd/contract.mjs";
 import { loadScenarios } from "./bdd/parse.mjs";
 import { indexResults } from "./bdd/report.mjs";
 import { loadExecutionResults } from "./check-bdd-coverage.mjs";
@@ -128,7 +128,7 @@ export function renderMatrix(root, resultFiles) {
   const results = indexResults(execution.runs);
   const byScenario = mappingsByScenario(contract);
   const waived = waivedKeys(contract);
-  const runners = Object.keys(contract.runnerPlatforms ?? {}).sort();
+  const runners = Object.keys(contract.runnerPlatforms ?? {}).sort(byCodeUnit);
   const byFeature = new Map();
   for (const scenario of scenarios) {
     byFeature.set(scenario.feature, [

package/expo/copy-overwrite/scripts/check-bdd-coverage.mjs

@@ -77,7 +77,7 @@ import {
   validateScenarios,
   validateTrackerTags,
 } from "./bdd/validate.mjs";
-import { validateWaivers } from "./bdd/waivers.mjs";
+import { ISO_DATE, validateWaivers } from "./bdd/waivers.mjs";
 
 const PACKAGE_ROOT = path.resolve(
   path.dirname(fileURLToPath(import.meta.url)),
@@ -178,6 +178,17 @@ export function validateAdoption(contract, mode, today) {
  */
 function bootstrapDefects(adoption, today) {
   const defects = [];
+  if (!ISO_DATE.test(String(today))) {
+    // The expiry is a lexical comparison against an ISO date, and every
+    // comparison with a non-date is false — so an unreadable evaluation date
+    // would make the time-box unreachable and bootstrap permanent.
+    defects.push(
+      defect(
+        "bootstrap-metadata",
+        `the evaluation date ${JSON.stringify(today ?? null)} is not an ISO date (YYYY-MM-DD), so the bootstrap expiry could not be evaluated`
+      )
+    );
+  }
   if (!adoption.owner) {
     defects.push(
       defect(
@@ -193,14 +204,14 @@ function bootstrapDefects(adoption, today) {
         "bootstrap requires adoption.expiresAt (an ISO date); a bootstrap with no time-box never ends"
       )
     );
-  } else if (!/^\d{4}-\d{2}-\d{2}$/.test(adoption.expiresAt)) {
+  } else if (!ISO_DATE.test(adoption.expiresAt)) {
     defects.push(
       defect(
         "bootstrap-metadata",
         "adoption.expiresAt must be an ISO date (YYYY-MM-DD)"
       )
     );
-  } else if (adoption.expiresAt < today) {
+  } else if (ISO_DATE.test(String(today)) && adoption.expiresAt < today) {
     defects.push(
       defect(
         "bootstrap-expired",
@@ -278,7 +289,7 @@ function validateAll({
       ...defects,
       defect(
         "baseline",
-        `base revision ${options.baseSha} is not readable, so the non-regression checks could not run. A gate that cannot compare against a base does not get to report that nothing regressed.`
+        `base revision ${options.baseSha} is not readable${baseline.error ? ` (${baseline.error})` : ""}, so the non-regression checks could not run. A gate that cannot compare against a base does not get to report that nothing regressed.`
       ),
     ];
   }
@@ -343,16 +354,16 @@ function floorIntegrityDefects(report) {
 
 /**
  * Defects that only exist in enforced mode, where absence must fail.
- * @param {object} input - Contract, scenarios, report, and platforms.
+ *
+ * The platform vocabulary is deliberately NOT a parameter: every platform this
+ * function cares about already reaches it through `report.floor`, which was
+ * built from that same vocabulary. It used to be passed and discarded behind a
+ * `void`, which reads as "unused for now" and hides whether an intended check
+ * was ever written.
+ * @param {object} input - Contract, scenarios, report, and discovery.
  * @returns {object[]} Defects found.
  */
-function enforcedDefects({
-  contract,
-  scenarios,
-  report,
-  platforms,
-  discovery,
-}) {
+function enforcedDefects({ contract, scenarios, report, discovery }) {
   const defects = [];
   if (scenarios.length === 0) {
     defects.push(
@@ -392,15 +403,28 @@ function enforcedDefects({
       defects.push(
         defect(
           "floor-regression",
-          `${platform} traceability coverage ${value.actual}% is below its committed floor of ${value.floor}%`
+          `${platform} traceability coverage ${measured(value)}% is below its committed floor of ${value.floor}%`
         )
       );
     }
   }
-  void platforms;
   return defects;
 }
 
+/**
+ * The measured percentage, printed at enough precision to explain the verdict.
+ *
+ * The floor is decided on the unrounded value, so a platform sitting at
+ * 99.95% must not be told it failed at "100%" — a message that contradicts
+ * its own finding is how an operator concludes the gate is broken.
+ * @param {{actual: number|null, exact: number|null}} value - A floor entry.
+ * @returns {string} The percentage to print.
+ */
+function measured(value) {
+  if (value.exact === null) return String(value.actual);
+  return String(Number(value.exact.toFixed(4)));
+}
+
 /**
  * Evaluate the gate.
  * @param {string} root - Repo root.
@@ -452,7 +476,7 @@ export function run(root, options) {
       discovery,
     }),
     ...(mode === "enforced"
-      ? enforcedDefects({ contract, scenarios, report, platforms, discovery })
+      ? enforcedDefects({ contract, scenarios, report, discovery })
       : []),
   ];
   return result({ mode, defects, report, contract });
@@ -689,6 +713,14 @@ async function main() {
  * When the shared module is absent the same object is emitted unvalidated
  * rather than nothing: a gate that produces no result is indistinguishable
  * from one that passed.
+ *
+ * When the shared module is present but REFUSES the envelope — a schema this
+ * gate's fields no longer satisfy, or a half-copied `scripts/` directory whose
+ * schema document never arrived — that refusal is caught rather than thrown.
+ * An uncaught rejection here produced no envelope at all and a Node-supplied
+ * exit code, which is the one outcome this function exists to rule out. The
+ * fields are emitted with `status: "invalid"`, so the run is machine-readable,
+ * operator-readable, and NONZERO.
  * @param {object} input - The gate run, CLI options, and files written.
  * @returns {Promise<object>} The envelope.
  */
@@ -708,7 +740,17 @@ async function sealEnvelope({ gateRun, options, filesWritten }) {
     );
     return { schemaVersion: "lisa-command-envelope-v1", ...fields };
   }
-  return shared.buildEnvelope(fields);
+  try {
+    return shared.buildEnvelope(fields);
+  } catch (error) {
+    console.error(`[bdd-coverage] ${error.message}`);
+    return {
+      schemaVersion: "lisa-command-envelope-v1",
+      ...fields,
+      status: "invalid",
+      reason: `the result could not be sealed into a valid command envelope: ${error.message}`,
+    };
+  }
 }
 
 /**

package/expo/create-only/.github/required-checks.json

@@ -1,10 +1,15 @@
 {
   "_readme": [
     "See typescript/create-only/.github/required-checks.json in Lisa for the full rationale. In short: GitHub counts a SKIPPED required status check as SATISFIED, so a `skip_jobs` token that silences a required context makes the merge gate decorative.",
-    "This expo seed declares the three tokens the shipped ci.yml skips. Every one of them is currently NOT ruleset-required, so nothing here is a false green — but the declaration exists so that the day one of them BECOMES required, the guard says so instead of the gate quietly going hollow.",
-    "Transcribe `required_contexts` byte for byte from your ruleset and keep it current with `--remote`.",
-    "The nightly-gate context is listed because Lisa ships expo/github-rulesets/nightly-e2e-health.json requiring it on dev. No skip_jobs token silences it today, so nothing is a false green — it is here so that the day one does, the guard says so instead of staying quiet."
+    "This seed declares the three tokens the shipped ci.yml skips, so that the day one of them is required the guard can say so instead of the gate quietly going hollow. The `ruleset_required: false` on each is a DEFAULT, not a measurement — it is only meaningful once you have transcribed `required_contexts` from your own ruleset, which is what stamping `baseline_fetched_at` asserts.",
+    "⚠️ `required_contexts` SHIPS EMPTY AND UNSTAMPED ON PURPOSE. Lisa cannot know what YOUR ruleset requires, and an earlier version of this seed shipped a guess that was measured WRONG (#2476): it claimed `🔗 Work-Item Traceability` was required when no ruleset required it, and omitted six contexts that were. Until `ruleset.baseline_fetched_at` carries the date you transcribed the real list, the guard reports NOT CHECKED rather than answering from fiction.",
+    "To arm it: gh api repos/OWNER/NAME/rulesets --jq '.[] | \"\\\\(.id) \\\\(.name)\"' to find the ids, then gh api repos/OWNER/NAME/rulesets/ID --jq '.rules[] | select(.type==\"required_status_checks\") | .parameters.required_status_checks[].context' for the contexts. Paste them into `required_contexts` BYTE FOR BYTE, fill in `ruleset.repo` / `ruleset.ids`, and set `baseline_fetched_at` to today.",
+    "A transcription expires after 90 days, because a ruleset can be edited with no signal in this repository. The shipped `.github/workflows/required-checks-drift.yml` runs `--remote` weekly to catch that; `--remote` reads the ruleset live and so answers even when the cache is untrusted.",
+    "Lisa's quality.yml runs the offline arm on every pull request. This seed ships `\"enforcement\": \"warn\"`, which downgrades findings AND the NOT-CHECKED refusal to reports so a fresh install does not go red on arrival. Delete the key once you have transcribed the list — then it blocks.",
+    "`skip_jobs` is matched as an exact comma-delimited token and GitHub Actions expression syntax has no string-replace, so write the list with no spaces: `skip_jobs: 'a,b'`, never `skip_jobs: 'a, b'`. A spaced token matches nothing and the job runs — reported as `whitespace_in_skip_token`.",
+    "`_example_required_contexts` below is a STARTING POINT FOR TYPING, never read by the guard. Verify every line against your own ruleset before promoting any of it."
   ],
+  "enforcement": "warn",
   "ruleset": {
     "repo": "",
     "ids": [],
@@ -14,7 +19,8 @@
     ".github/workflows/ci.yml"
   ],
   "exemption_ticket_pattern": "^[A-Z][A-Z0-9]+-\\d+$",
-  "required_contexts": [
+  "required_contexts": [],
+  "_example_required_contexts": [
     "🔍 Quality Checks / 🧹 Lint",
     "🔍 Quality Checks / 🔍 Type Check",
     "🔍 Quality Checks / 🏗️ Build",

package/expo/merge/.oxlintrc.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./node_modules/oxlint/configuration_schema.json",
-  "extends": ["./node_modules/@codyswann/lisa/oxlint/expo.json"],
+  "extends": ["./.lisa/lisa-oxlint/expo.json"],
   "ignorePatterns": [
     "build/**",
     "dist/**",

package/harper-fabric/merge/.oxlintrc.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./node_modules/oxlint/configuration_schema.json",
-  "extends": ["./node_modules/@codyswann/lisa/oxlint/harper-fabric.json"],
+  "extends": ["./.lisa/lisa-oxlint/harper-fabric.json"],
   "ignorePatterns": [
     "build/**",
     "dist/**",

package/nestjs/create-only/.github/required-checks.json

@@ -0,0 +1,57 @@
+{
+  "_readme": [
+    "See typescript/create-only/.github/required-checks.json in Lisa for the full rationale. In short: GitHub counts a SKIPPED required status check as SATISFIED, so a `skip_jobs` token that silences a required context makes the merge gate decorative.",
+    "This seed declares the three tokens the shipped ci.yml skips, so that the day one of them is required the guard can say so instead of the gate quietly going hollow. The `ruleset_required: false` on each is a DEFAULT, not a measurement — it is only meaningful once you have transcribed `required_contexts` from your own ruleset, which is what stamping `baseline_fetched_at` asserts.",
+    "⚠️ `required_contexts` SHIPS EMPTY AND UNSTAMPED ON PURPOSE. Lisa cannot know what YOUR ruleset requires, and an earlier version of this seed shipped a guess that was measured WRONG (#2476): it claimed `🔗 Work-Item Traceability` was required when no ruleset required it, and omitted six contexts that were. Until `ruleset.baseline_fetched_at` carries the date you transcribed the real list, the guard reports NOT CHECKED rather than answering from fiction.",
+    "To arm it: gh api repos/OWNER/NAME/rulesets --jq '.[] | \"\\\\(.id) \\\\(.name)\"' to find the ids, then gh api repos/OWNER/NAME/rulesets/ID --jq '.rules[] | select(.type==\"required_status_checks\") | .parameters.required_status_checks[].context' for the contexts. Paste them into `required_contexts` BYTE FOR BYTE, fill in `ruleset.repo` / `ruleset.ids`, and set `baseline_fetched_at` to today.",
+    "A transcription expires after 90 days, because a ruleset can be edited with no signal in this repository. The shipped `.github/workflows/required-checks-drift.yml` runs `--remote` weekly to catch that; `--remote` reads the ruleset live and so answers even when the cache is untrusted.",
+    "Lisa's quality.yml runs the offline arm on every pull request. This seed ships `\"enforcement\": \"warn\"`, which downgrades findings AND the NOT-CHECKED refusal to reports so a fresh install does not go red on arrival. Delete the key once you have transcribed the list — then it blocks.",
+    "`skip_jobs` is matched as an exact comma-delimited token and GitHub Actions expression syntax has no string-replace, so write the list with no spaces: `skip_jobs: 'a,b'`, never `skip_jobs: 'a, b'`. A spaced token matches nothing and the job runs — reported as `whitespace_in_skip_token`.",
+    "`_example_required_contexts` below is a STARTING POINT FOR TYPING, never read by the guard. Verify every line against your own ruleset before promoting any of it."
+  ],
+  "enforcement": "warn",
+  "ruleset": {
+    "repo": "",
+    "ids": [],
+    "baseline_fetched_at": ""
+  },
+  "workflows": [
+    ".github/workflows/ci.yml"
+  ],
+  "exemption_ticket_pattern": "^[A-Z][A-Z0-9]+-\\d+$",
+  "required_contexts": [],
+  "_example_required_contexts": [
+    "🔍 Quality Checks / 🧹 Lint",
+    "🔍 Quality Checks / 🔍 Type Check",
+    "🔍 Quality Checks / 🏗️ Build",
+    "🔍 Quality Checks / 📐 Check Formatting",
+    "🔍 Quality Checks / 🔒 Security Scan",
+    "🔍 Quality Checks / 🧪 Run Unit Tests",
+    "🔍 Quality Checks / 🧪 Run Integration Tests",
+    "🔍 Quality Checks / 🔗 Work-Item Traceability"
+  ],
+  "skip_job_declarations": {
+    "test:e2e": {
+      "suppressed_contexts": [
+        "🔍 Quality Checks / 🧪 Run E2E Tests"
+      ],
+      "ruleset_required": false,
+      "reason": "A NestJS API's end-to-end suite needs a database and a booted app, which the shipped ci.yml does not provision. Lisa's quality callee guards each job on script existence, so un-skipping it without that scaffolding would produce a run that succeeds having tested nothing — a worse false green than the skip. Not a required context, so skipping removes a check rather than faking one."
+    },
+    "playwright_e2e": {
+      "suppressed_contexts": [
+        "🔍 Quality Checks / 🎭 Playwright Shard Setup",
+        "🔍 Quality Checks / 🎭 Playwright E2E Tests"
+      ],
+      "ruleset_required": false,
+      "reason": "Note this ONE token silences TWO jobs — the mapping is not a mechanical transform, which is why this file is a reviewed snapshot rather than something derived. Neither is a required context: a headless API has no browser surface for Playwright to drive."
+    },
+    "zap_baseline": {
+      "suppressed_contexts": [
+        "🔍 Quality Checks / 🕷️ OWASP ZAP Baseline"
+      ],
+      "ruleset_required": false,
+      "reason": "The shipped ci.yml runs ZAP as its own `zap` job against a deployed target after quality passes, not inside the quality callee. Not a required context."
+    }
+  }
+}

package/nestjs/merge/.oxlintrc.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./node_modules/oxlint/configuration_schema.json",
-  "extends": ["./node_modules/@codyswann/lisa/oxlint/nestjs.json"],
+  "extends": ["./.lisa/lisa-oxlint/nestjs.json"],
   "ignorePatterns": [
     "build/**",
     "dist/**",

package/package.json

@@ -120,7 +120,7 @@
     }
   },
   "name": "@codyswann/lisa",
-  "version": "3.4.0",
+  "version": "3.5.0",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/phaser/merge/.oxlintrc.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./node_modules/oxlint/configuration_schema.json",
-  "extends": ["./node_modules/@codyswann/lisa/oxlint/phaser.json"],
+  "extends": ["./.lisa/lisa-oxlint/phaser.json"],
   "ignorePatterns": [
     "build/**",
     "dist/**",

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.4.0",
+  "version": "3.5.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.4.0",
+  "version": "3.5.0",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-atlassian-access/SKILL.md

@@ -69,6 +69,13 @@ read_atlassian_token() {
   # Legacy fallback: the OS keychain written by the guided /lisa:setup:atlassian
   # flow, for projects that have not adopted a credentials provider. Reached only
   # when the chokepoint is absent or has no entry.
+  #
+  # This rung is REMOVED ON 2026-11-01 — a dated migration ramp, not a standing
+  # exemption (see credential-substrate-precedence, "Legacy OS-keychain fallback
+  # — removal date"). A keychain entry is machine-local ambient state no headless
+  # surface can reach, so a project resting on it has no working tier 1 in cron,
+  # CI, or a cloud session. Re-run /lisa:setup:atlassian before that date to
+  # store ATLASSIAN_API_TOKEN through the chokepoint instead.
   case "$(uname -s)" in
     Darwin)  security find-generic-password -s lisa-atlassian -a "$email" -w 2>/dev/null ;;
     Linux)   command -v secret-tool >/dev/null && secret-tool lookup service lisa-atlassian account "$email" 2>/dev/null ;;

package/plugins/lisa/.codex-plugin/skills/lisa-implement/SKILL.md

@@ -64,7 +64,7 @@ The input-resolver invokes `lisa-track $ARGUMENTS` and owns its complete resolve
 - **Bind before durable work:** only after the verified claim, run:
 
   ```bash
-  node scripts/lisa-work-item.mjs bind <canonical-ref>
+  node scripts/lisa-work-item.mjs link <canonical-ref>
   ```
 
   Require a successful readback of that worktree-local binding. On detached HEAD, `branch: null` is the expected pending binding; after branch creation the mandatory `attach-branch` step below must replace it before any commit. Tracker or binding failure stops the flow; never continue untracked.

package/plugins/lisa/.codex-plugin/skills/lisa-jam-access/SKILL.md

@@ -39,20 +39,55 @@ headlessly — which is why it leads. The CLI tier uses:
 ```bash
 curl -fsSL https://native.jam.dev/install | bash
 export PATH="$HOME/.local/bin:$PATH"
-printf '%s' "$JAM_PAT" | jam auth login --token
+
+# Resolve the PAT through the chokepoint before giving up on the environment.
+# `$JAM_PAT` is the documented fallback, not the only rung: without this, a
+# project that keeps its credentials in Bitwarden, Doppler, or AWS has no tier 1
+# path at all and silently resolves through the interactive MCP — the exact
+# divergence `credential-substrate-precedence` exists to remove.
+read_jam_pat() {
+  [ -n "${JAM_PAT:-}" ] && { echo "$JAM_PAT"; return; }
+  local resolver
+  for resolver in .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs \
+                  .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs; do
+    if [ -f "$resolver" ]; then
+      local via_lisa
+      via_lisa=$(node "$resolver" get JAM_PAT 2>/dev/null) \
+        && [ -n "$via_lisa" ] && { echo "$via_lisa"; return; }
+      break
+    fi
+  done
+  return 1
+}
+
+# Piped, never written to disk and never passed as an argv token: a PAT on a
+# command line is readable from the process table by every user on the host.
+read_jam_pat | jam auth login --token
 jam skills install
 ```
 
 If neither tier works, fail with:
 
 ```text
-Error: no Jam access substrate available. Authenticate the Jam MCP or set JAM_PAT.
+Error: no Jam access substrate available. Authenticate the Jam MCP, set JAM_PAT, or store JAM_PAT in this project's secrets provider.
 ```
 
+## Mutation boundary
+
+Every operation in the Invocation Contract is **read-only** — fetching a trace,
+a recording, or a bug report. So the `credential-substrate-precedence` guarded
+fallback for mutating operations (write, read back, assert the tenant from the
+response, roll back on mismatch) is not engaged here, and a failed tier is
+simply skipped. A future operation that mutates Jam state — commenting on or
+deleting a Jam — is a write and MUST reconcile by read-back before any retry.
+
 ## Invariants
 
 - Tier order is `credential-substrate-precedence`: `JAM_PAT` CLI first, Jam MCP as
   a preserved first-class fallback. Do not retry a failed tier blindly.
+- The PAT is resolved through `lisa-secrets-access`, with the bare `JAM_PAT`
+  environment variable as the documented fallback. Never read a second
+  credential store directly.
 - Never commit a Jam PAT into `.mcp.json` or any generated setup artifact.
 - Headless Jam access requires `native.jam.dev` for the installer and
   `api.jam.dev` for CLI/API calls in any custom remote network allowlist.

package/plugins/lisa/.codex-plugin/skills/lisa-notion-access/SKILL.md

@@ -70,6 +70,13 @@ read_notion_token() {
   # Legacy fallback: the OS keychain written by the guided /lisa:setup:notion
   # flow, for projects that have not adopted a credentials provider. Reached only
   # when the chokepoint is absent or has no entry.
+  #
+  # This rung is REMOVED ON 2026-11-01 — a dated migration ramp, not a standing
+  # exemption (see credential-substrate-precedence, "Legacy OS-keychain fallback
+  # — removal date"). A keychain entry is machine-local ambient state no headless
+  # surface can reach, so a project resting on it has no working tier 1 in cron,
+  # CI, or a cloud session. Re-run /lisa:setup:notion before that date to store
+  # NOTION_API_TOKEN through the chokepoint instead.
   case "$(uname -s)" in
     Darwin)  security find-generic-password -s lisa-notion -a "$workspace" -w 2>/dev/null ;;
     Linux)   command -v secret-tool >/dev/null && \