@codyswann/lisa 3.41.1 → 3.43.0

package/expo/create-only/.github/workflows/playwright-e2e.yml

@@ -5,20 +5,24 @@ name: 🎭 Playwright Web E2E
 
 # Standalone Playwright suite — the web counterpart to maestro-e2e.yml.
 #
-# WHY THIS EXISTS. Playwright used to ride inside ci.yml as the
-# `playwright_e2e` job of Lisa's reusable quality.yml. That coupled the
-# heaviest and flakiest suite in the project to the lint/typecheck/unit gate:
-# one workflow, one concurrency group, one cadence, and a red Playwright shard
-# blocking a pull request that only changed a type. Splitting it out gives it
-# its own cadence, its own concurrency, one target environment, and a
-# dedicated red/green signal a nightly gate can read.
+# WHY THIS EXISTS. Playwright used to ride inside ci.yml as the `playwright_e2e`
+# job of Lisa's reusable quality.yml. That coupled the heaviest and flakiest
+# suite in the project to the lint/typecheck/unit gate: one workflow, one
+# concurrency group, one cadence, and a red Playwright shard blocking a pull
+# request that only changed a type.
 #
-# ── BEFORE THIS FILE DOES ANYTHING, DECLARE THE GATE ───────────────────────
+# It now calls a DEDICATED reusable workflow. The previous shape of this file
+# called quality.yml and passed `skip_jobs` naming the two dozen jobs it did not
+# want — an inversion that went stale silently, because a job added to
+# quality.yml was absent from this hand-maintained list and therefore RAN on a
+# nightly whose whole point is that it runs one suite. That list is gone.
+#
+# ── DECLARING THE GATE ─────────────────────────────────────────────────────
 #
 # This workflow resolves the `e2e-browser` gate at the `continuous:development`
-# moment. Until `.lisa.config.json` declares it, quality.yml runs its BUILT-IN
-# Playwright path here (sharded `npx playwright test`), which is a reasonable
-# default but is not a decision anybody recorded. To make it one:
+# moment. Until `.lisa.config.json` declares it, Lisa runs its BUILT-IN
+# Playwright path (sharded `npx playwright test`), which is a reasonable default
+# but is not a decision anybody recorded. To make it one:
 #
 #   {
 #     "gates": {
@@ -27,29 +31,21 @@ name: 🎭 Playwright Web E2E
 #     }
 #   }
 #
-# `runner` is optional and defaults to `<package_manager> run`. The gate's task
-# is `test:e2e`, so the project needs that script in package.json — Lisa
-# resolves the PROPERTY ("browser journeys pass end to end"), never the tool.
+# The gate's task is `test:e2e`, so the project needs that script in
+# package.json — Lisa resolves the PROPERTY ("browser journeys pass end to
+# end"), never the tool.
 #
 # TWO THINGS THAT ARE NOT INTERCHANGEABLE:
 #
 #   * OMITTING the declaration and declaring it `off` are different. `off` is a
 #     recorded decision and drops the required context. Omitting it leaves
 #     Lisa's built-in path running. Neither is "no gate".
-#   * DECLARING IT WITH NO SUITE is refused, not greened. quality.yml fails the
-#     job when `e2e-browser` resolves and there is no playwright.config.ts,
-#     because a browser gate over an absent suite reports green having run
-#     nothing and is indistinguishable on the pull-request page from one that
-#     ran. If this project has no Playwright specs, DELETE THIS FILE rather
-#     than declaring the gate against it.
-#
-# ── SHARDING ───────────────────────────────────────────────────────────────
-#
-# `playwright_shards` splits Lisa's BUILT-IN invocation across N runners. It
-# does not apply once `e2e-browser` resolves to a task: Lisa cannot append
-# `--shard` to a command whose shape it does not know, and the `--` passthrough
-# differs between npm, yarn and bun. A declared gate runs on one runner. Shard
-# inside the project's own `test:e2e` script if the suite needs it.
+#   * DECLARING IT WITH NO SUITE is refused, not greened. The job fails when
+#     `e2e-browser` resolves and there is no playwright.config.ts, because a
+#     browser gate over an absent suite reports green having run nothing and is
+#     indistinguishable on the pull-request page from one that ran. If this
+#     project has no Playwright specs, DELETE THIS FILE rather than declaring
+#     the gate against it.
 
 on:
   schedule:
@@ -61,14 +57,40 @@ on:
     - cron: '0 7 * * *'
   workflow_dispatch:
 
-# Deliberately no `pull_request` trigger. This suite is too slow to gate a
-# pull request, and adding one here would also collide with ci.yml: two
-# workflows must not report the same check name, and the identity is the
-# JOB name, not the workflow's. A reusable call reports as
-# `<caller job name> / <callee job name>`, so the job below reports as
-# `🎭 Playwright Web E2E / 🎭 Playwright E2E Tests`. Keep ci.yml's
-# `skip_jobs` naming `playwright_e2e` so this workflow is the only place the
-# suite runs.
+# Deliberately no `pull_request` trigger. This suite is too slow to gate a pull
+# request, and adding one here would also collide with ci.yml: two workflows
+# must not report the same check name, and the identity is the JOB name, not the
+# workflow's.
+#
+# ── THE COLLISION IS STILL LIVE, AND THIS NOTE IS THE ONLY DEFENCE ─────────
+#
+# quality.yml STILL CONTAINS its own copy of the Playwright jobs. Removing them
+# there is a breaking change for every already-installed caller tracking `@main`,
+# so it happens only once consumers have migrated to the dedicated workflow this
+# file now calls. Until that removal lands, a project that runs quality.yml
+# WITHOUT suppressing the suite runs it in two places and reports the same check
+# name from both.
+#
+# SUPPRESS IT WITH THE GATE, NOT WITH `skip_jobs`. `skip_jobs` is being retired
+# in favour of gate levels, and the gate already controls this suite completely
+# inside quality.yml — `off` reaches the "e2e-browser declared off" path and
+# neither the built-in run nor the declared task executes. So declare it off at
+# the moment ci.yml runs at:
+#
+#   {
+#     "gates": {
+#       "e2e-browser": {
+#         "pull-request": "off",
+#         "continuous:development": "required"
+#       }
+#     }
+#   }
+#
+# One declaration, both cadences, and each is a recorded decision rather than an
+# inferred one. Declaring `off` also drops the required context, which is the
+# visible way to stop requiring a check — as opposed to a job that silently
+# stops running. Nothing inside this file can enforce it; the only defence is
+# that whoever seeds it knows.
 
 permissions:
   contents: read
@@ -93,49 +115,44 @@ concurrency:
 jobs:
   playwright:
     name: 🎭 Playwright Web E2E
-    uses: CodySwannGT/lisa/.github/workflows/quality.yml@main
+    uses: CodySwannGT/lisa/.github/workflows/playwright-e2e.yml@main
     with:
       node_version: '22.21.1'
       package_manager: 'bun'
-      # The moment this workflow's cadence corresponds to. It is what makes
-      # the `.lisa.config.json` declaration above readable from here — a gate
-      # declared at `pull-request` is invisible at this moment, and vice
-      # versa, so a nightly suite and a per-change suite cannot be turned on
-      # by the same line of config by accident.
+      # The moment this workflow's cadence corresponds to. It is what makes the
+      # `.lisa.config.json` declaration above readable from here — a gate
+      # declared at `pull-request` is invisible at this moment, and vice versa,
+      # so a nightly suite and a per-change suite cannot be turned on by the
+      # same line of config by accident.
       moment: 'continuous:development'
-      # Everything except `playwright_e2e`.
-      #
-      # THIS INVERSION IS A KNOWN-BAD SHAPE, carried because it is currently
-      # the only one that works. quality.yml gates most jobs on `skip_jobs`
-      # rather than on the moment, so a single-suite caller has to name the
-      # two dozen jobs it does NOT want. It is exact-token matched against
-      # `,{0},` — comma-delimited with NO SPACES, so `lint, lint_slow`
-      # silently skips nothing beyond `lint`.
-      #
-      # IT GOES STALE SILENTLY, and that is the cost. A job added to
-      # quality.yml is absent from this list and therefore RUNS here, on a
-      # nightly whose whole point is that it runs one suite. Measured while
-      # writing this file: the hand-maintained list in the first project to
-      # adopt this shape was already missing five keys that exist today
-      # (`bdd_coverage`, `state_classification`, `environment_reset`,
-      # `environment_reseed`, `skipped_required_checks`). Re-derive it from
-      # quality.yml when adding a suite, do not extend it from memory.
-      skip_jobs: 'bdd_coverage,build,dead_code,e2e_coverage,environment_reseed,environment_reset,floor_collisions,format,learnings_budget,license_compliance,lint,lint_slow,maestro_e2e,npm_security_scan,secret_scanning,sg_scan,skipped_required_checks,snyk,sonarcloud,state_classification,test:e2e,test:integration,test:mutation,test:unit,test_node_suites,threshold_ratchet,typecheck,work_item_traceability,zap_baseline'
-      # Cross-run mutex on whatever this suite shares with the OTHER suites
-      # that touch the same backend. Deliberately DISTINCT from this
-      # workflow's own top-level `concurrency` group above — a shared group
-      # between a parent run and the child run it is waiting on deadlocks.
-      # Join maestro-e2e.yml to the same group if the two suites share test
-      # accounts or fixtures.
+      # Cross-run mutex on whatever this suite shares with the OTHER suites that
+      # touch the same backend. Deliberately DISTINCT from this workflow's own
+      # top-level `concurrency` group above — a shared group between a parent
+      # run and the child run it is waiting on deadlocks. Join maestro-e2e.yml
+      # to the same group if the two suites share test accounts or fixtures.
       concurrency_group: 'e2e-shared-development'
-      # Applies only while `e2e-browser` is undeclared — see the SHARDING note
-      # at the top of this file.
+      # Return the environment to a known state BEFORE the suite, rather than
+      # cleaning up after it. Cleanup-after is best-effort: it does not run when
+      # a runner dies, is cancelled, or is evicted, so the next night starts
+      # against whatever the last failure left behind.
+      #
+      # The named verbs must exist as `environment:reset` / `environment:reseed`
+      # scripts. A verb named here that the project does not declare FAILS the
+      # run rather than skipping — a suite against an environment nobody
+      # prepared reports green while proving nothing. Clear this input to opt
+      # out; that is a visible decision, which a silent skip is not.
+      prepare_environment: 'development'
+      prepare_verbs: 'reset,reseed'
+      # Applies only while `e2e-browser` is undeclared: Lisa cannot append
+      # `--shard` to a command whose shape it does not know, and the `--`
+      # passthrough differs between npm, yarn and bun. A declared gate runs on
+      # one runner; shard inside the project's own `test:e2e` script instead.
       playwright_shards: 2
-      # Leave false unless the cache key has been checked against this
-      # project's layout. Lisa's key is a fingerprint of build inputs, and a
-      # key that misses the project's source directories freezes: `expo export`
-      # then serves stale transforms and every source change silently tests old
-      # code. A green suite over the previous commit is the worst failure this
+      # Leave false unless the cache key has been checked against this project's
+      # layout. Lisa's key is a fingerprint of build inputs, and a key that
+      # misses the project's source directories freezes: `expo export` then
+      # serves stale transforms and every source change silently tests old code.
+      # A green suite over the previous commit is the worst failure this
       # workflow has.
       cache_build: false
       # Runs before the web export, in the job that runs the suite. Bake the
@@ -145,7 +162,7 @@ jobs:
       #
       # Use `printf '\n%s\n'` rather than `echo >>`: the committed .env.<mode>
       # files do not end in a trailing newline, so a bare append concatenates
-      # onto the last variable's value — corrupting it AND silently dropping
-      # the line being added.
+      # onto the last variable's value — corrupting it AND silently dropping the
+      # line being added.
       playwright_setup_command: |
         cp .env.development .env.local

package/package.json

@@ -132,7 +132,7 @@
     "ws": ">=8.21.0"
   },
   "name": "@codyswann/lisa",
-  "version": "3.41.1",
+  "version": "3.43.0",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.41.1",
+  "version": "3.43.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.41.1",
+  "version": "3.43.0",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-drive-pr-to-merge/SKILL.md

@@ -470,6 +470,56 @@ matching Phase 4b's safe default. The full procedure is `lisa-linear-sync`
 Phase 4b; when the caller's flow already runs a `pr-merged` sync for this
 merge, confirming that sync ran satisfies this step.
 
+### d. Complete the work item
+
+Run this once the PR reports `MERGED` and the ancestry check has passed:
+
+```
+node scripts/lisa-work-item.mjs complete --ref <work-item>
+```
+
+resolving the script the usual three ways (installed package, host `scripts/`,
+this repo's own tree).
+
+**This step exists because the previous arrangement did not work, measured.**
+The instruction to move a work item to its terminal role lived in
+`lisa-git-submit-pr`, in a section reached *after* that skill delegates the
+entire merge loop to this one. So the skill that observes the merge was never
+told to close anything, and the skill that was told had already handed off. The
+result: **27 of 27** open items carrying the claimed role in this repository had
+a merged pull request — the claimed lane reported 27 things in flight when the
+real number was one.
+
+Three properties make the command safe to run unconditionally:
+
+1. **The terminal role is RESOLVED, never assumed.** `lifecycleContract` reads
+   `github.labels.build.done` (or the Jira/Linear equivalent), which is
+   environment-aware — a repository whose target is `dev` has a different
+   terminal role than one merging to production, and a hardcoded label would
+   apply the wrong one while looking correct in the repository it was written
+   in.
+2. **It refuses without evidence.** Completion requires a merged pull request in
+   the same repository. A command that closes whatever it is pointed at is a way
+   to make unfinished work disappear, and the closure is indistinguishable from
+   a real one afterwards. Cross-repository references do not count: a downstream
+   consumer's PR mentioning an upstream issue is not evidence the upstream issue
+   shipped.
+3. **It is idempotent**, so re-running after a retry converges rather than
+   accumulating.
+
+It also removes the claimed role rather than only adding the terminal one.
+Leaving both produces exactly the drift this step exists to end — an item that
+is closed *and* still reports as in progress.
+
+If the command refuses, do not close by hand. A refusal means the evidence is
+not there, and a lifecycle step performed by hand is one nothing can verify
+happened.
+
+**The backstop, for the ones that still slip:** `lisa-work-item.mjs sweep`
+reports every claimed item that already has a merged pull request, and
+`--apply` completes them. Reporting is the default deliberately — a sweep that
+closes things as a side effect of being run is not one anyone runs twice.
+
 ## 4. Terminal states
 
 Loop until one of:

package/plugins/lisa/skills/lisa-drive-pr-to-merge/SKILL.md

@@ -470,6 +470,56 @@ matching Phase 4b's safe default. The full procedure is `lisa-linear-sync`
 Phase 4b; when the caller's flow already runs a `pr-merged` sync for this
 merge, confirming that sync ran satisfies this step.
 
+### d. Complete the work item
+
+Run this once the PR reports `MERGED` and the ancestry check has passed:
+
+```
+node scripts/lisa-work-item.mjs complete --ref <work-item>
+```
+
+resolving the script the usual three ways (installed package, host `scripts/`,
+this repo's own tree).
+
+**This step exists because the previous arrangement did not work, measured.**
+The instruction to move a work item to its terminal role lived in
+`lisa-git-submit-pr`, in a section reached *after* that skill delegates the
+entire merge loop to this one. So the skill that observes the merge was never
+told to close anything, and the skill that was told had already handed off. The
+result: **27 of 27** open items carrying the claimed role in this repository had
+a merged pull request — the claimed lane reported 27 things in flight when the
+real number was one.
+
+Three properties make the command safe to run unconditionally:
+
+1. **The terminal role is RESOLVED, never assumed.** `lifecycleContract` reads
+   `github.labels.build.done` (or the Jira/Linear equivalent), which is
+   environment-aware — a repository whose target is `dev` has a different
+   terminal role than one merging to production, and a hardcoded label would
+   apply the wrong one while looking correct in the repository it was written
+   in.
+2. **It refuses without evidence.** Completion requires a merged pull request in
+   the same repository. A command that closes whatever it is pointed at is a way
+   to make unfinished work disappear, and the closure is indistinguishable from
+   a real one afterwards. Cross-repository references do not count: a downstream
+   consumer's PR mentioning an upstream issue is not evidence the upstream issue
+   shipped.
+3. **It is idempotent**, so re-running after a retry converges rather than
+   accumulating.
+
+It also removes the claimed role rather than only adding the terminal one.
+Leaving both produces exactly the drift this step exists to end — an item that
+is closed *and* still reports as in progress.
+
+If the command refuses, do not close by hand. A refusal means the evidence is
+not there, and a lifecycle step performed by hand is one nothing can verify
+happened.
+
+**The backstop, for the ones that still slip:** `lisa-work-item.mjs sweep`
+reports every claimed item that already has a merged pull request, and
+`--apply` completes them. Reporting is the default deliberately — a sweep that
+closes things as a side effect of being run is not one anyone runs twice.
+
 ## 4. Terminal states
 
 Loop until one of:

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.41.1",
+  "version": "3.43.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-drive-pr-to-merge/SKILL.md

@@ -470,6 +470,56 @@ matching Phase 4b's safe default. The full procedure is `lisa-linear-sync`
 Phase 4b; when the caller's flow already runs a `pr-merged` sync for this
 merge, confirming that sync ran satisfies this step.
 
+### d. Complete the work item
+
+Run this once the PR reports `MERGED` and the ancestry check has passed:
+
+```
+node scripts/lisa-work-item.mjs complete --ref <work-item>
+```
+
+resolving the script the usual three ways (installed package, host `scripts/`,
+this repo's own tree).
+
+**This step exists because the previous arrangement did not work, measured.**
+The instruction to move a work item to its terminal role lived in
+`lisa-git-submit-pr`, in a section reached *after* that skill delegates the
+entire merge loop to this one. So the skill that observes the merge was never
+told to close anything, and the skill that was told had already handed off. The
+result: **27 of 27** open items carrying the claimed role in this repository had
+a merged pull request — the claimed lane reported 27 things in flight when the
+real number was one.
+
+Three properties make the command safe to run unconditionally:
+
+1. **The terminal role is RESOLVED, never assumed.** `lifecycleContract` reads
+   `github.labels.build.done` (or the Jira/Linear equivalent), which is
+   environment-aware — a repository whose target is `dev` has a different
+   terminal role than one merging to production, and a hardcoded label would
+   apply the wrong one while looking correct in the repository it was written
+   in.
+2. **It refuses without evidence.** Completion requires a merged pull request in
+   the same repository. A command that closes whatever it is pointed at is a way
+   to make unfinished work disappear, and the closure is indistinguishable from
+   a real one afterwards. Cross-repository references do not count: a downstream
+   consumer's PR mentioning an upstream issue is not evidence the upstream issue
+   shipped.
+3. **It is idempotent**, so re-running after a retry converges rather than
+   accumulating.
+
+It also removes the claimed role rather than only adding the terminal one.
+Leaving both produces exactly the drift this step exists to end — an item that
+is closed *and* still reports as in progress.
+
+If the command refuses, do not close by hand. A refusal means the evidence is
+not there, and a lifecycle step performed by hand is one nothing can verify
+happened.
+
+**The backstop, for the ones that still slip:** `lisa-work-item.mjs sweep`
+reports every claimed item that already has a merged pull request, and
+`--apply` completes them. Reporting is the default deliberately — a sweep that
+closes things as a side effect of being run is not one anyone runs twice.
+
 ## 4. Terminal states
 
 Loop until one of:

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.41.1",
+  "version": "3.43.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.41.1",
+  "version": "3.43.0",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.41.1",
+  "version": "3.43.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.41.1",
+  "version": "3.43.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.41.1",
+  "version": "3.43.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.41.1",
+  "version": "3.43.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/skills/lisa-drive-pr-to-merge/SKILL.md

@@ -470,6 +470,56 @@ matching Phase 4b's safe default. The full procedure is `lisa-linear-sync`
 Phase 4b; when the caller's flow already runs a `pr-merged` sync for this
 merge, confirming that sync ran satisfies this step.
 
+### d. Complete the work item
+
+Run this once the PR reports `MERGED` and the ancestry check has passed:
+
+```
+node scripts/lisa-work-item.mjs complete --ref <work-item>
+```
+
+resolving the script the usual three ways (installed package, host `scripts/`,
+this repo's own tree).
+
+**This step exists because the previous arrangement did not work, measured.**
+The instruction to move a work item to its terminal role lived in
+`lisa-git-submit-pr`, in a section reached *after* that skill delegates the
+entire merge loop to this one. So the skill that observes the merge was never
+told to close anything, and the skill that was told had already handed off. The
+result: **27 of 27** open items carrying the claimed role in this repository had
+a merged pull request — the claimed lane reported 27 things in flight when the
+real number was one.
+
+Three properties make the command safe to run unconditionally:
+
+1. **The terminal role is RESOLVED, never assumed.** `lifecycleContract` reads
+   `github.labels.build.done` (or the Jira/Linear equivalent), which is
+   environment-aware — a repository whose target is `dev` has a different
+   terminal role than one merging to production, and a hardcoded label would
+   apply the wrong one while looking correct in the repository it was written
+   in.
+2. **It refuses without evidence.** Completion requires a merged pull request in
+   the same repository. A command that closes whatever it is pointed at is a way
+   to make unfinished work disappear, and the closure is indistinguishable from
+   a real one afterwards. Cross-repository references do not count: a downstream
+   consumer's PR mentioning an upstream issue is not evidence the upstream issue
+   shipped.
+3. **It is idempotent**, so re-running after a retry converges rather than
+   accumulating.
+
+It also removes the claimed role rather than only adding the terminal one.
+Leaving both produces exactly the drift this step exists to end — an item that
+is closed *and* still reports as in progress.
+
+If the command refuses, do not close by hand. A refusal means the evidence is
+not there, and a lifecycle step performed by hand is one nothing can verify
+happened.
+
+**The backstop, for the ones that still slip:** `lisa-work-item.mjs sweep`
+reports every claimed item that already has a merged pull request, and
+`--apply` completes them. Reporting is the default deliberately — a sweep that
+closes things as a side effect of being run is not one anyone runs twice.
+
 ## 4. Terminal states
 
 Loop until one of:

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.41.1",
+  "version": "3.43.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/skills/lisa-drive-pr-to-merge/SKILL.md

@@ -470,6 +470,56 @@ matching Phase 4b's safe default. The full procedure is `lisa-linear-sync`
 Phase 4b; when the caller's flow already runs a `pr-merged` sync for this
 merge, confirming that sync ran satisfies this step.
 
+### d. Complete the work item
+
+Run this once the PR reports `MERGED` and the ancestry check has passed:
+
+```
+node scripts/lisa-work-item.mjs complete --ref <work-item>
+```
+
+resolving the script the usual three ways (installed package, host `scripts/`,
+this repo's own tree).
+
+**This step exists because the previous arrangement did not work, measured.**
+The instruction to move a work item to its terminal role lived in
+`lisa-git-submit-pr`, in a section reached *after* that skill delegates the
+entire merge loop to this one. So the skill that observes the merge was never
+told to close anything, and the skill that was told had already handed off. The
+result: **27 of 27** open items carrying the claimed role in this repository had
+a merged pull request — the claimed lane reported 27 things in flight when the
+real number was one.
+
+Three properties make the command safe to run unconditionally:
+
+1. **The terminal role is RESOLVED, never assumed.** `lifecycleContract` reads
+   `github.labels.build.done` (or the Jira/Linear equivalent), which is
+   environment-aware — a repository whose target is `dev` has a different
+   terminal role than one merging to production, and a hardcoded label would
+   apply the wrong one while looking correct in the repository it was written
+   in.
+2. **It refuses without evidence.** Completion requires a merged pull request in
+   the same repository. A command that closes whatever it is pointed at is a way
+   to make unfinished work disappear, and the closure is indistinguishable from
+   a real one afterwards. Cross-repository references do not count: a downstream
+   consumer's PR mentioning an upstream issue is not evidence the upstream issue
+   shipped.
+3. **It is idempotent**, so re-running after a retry converges rather than
+   accumulating.
+
+It also removes the claimed role rather than only adding the terminal one.
+Leaving both produces exactly the drift this step exists to end — an item that
+is closed *and* still reports as in progress.
+
+If the command refuses, do not close by hand. A refusal means the evidence is
+not there, and a lifecycle step performed by hand is one nothing can verify
+happened.
+
+**The backstop, for the ones that still slip:** `lisa-work-item.mjs sweep`
+reports every claimed item that already has a merged pull request, and
+`--apply` completes them. Reporting is the default deliberately — a sweep that
+closes things as a side effect of being run is not one anyone runs twice.
+
 ## 4. Terminal states
 
 Loop until one of:

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.41.1",
+  "version": "3.43.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.41.1",
+  "version": "3.43.0",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.41.1",
+  "version": "3.43.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.41.1",
+  "version": "3.43.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"