@codyswann/lisa 3.51.1 → 3.51.3

package/dist/opencode/plugin-templates/lisa-block-direct-issue-create.ts

@@ -43,6 +43,16 @@ const LisaBlockDirectIssueCreate = async () => {
    */
   const LABEL_FLAG =
     /--(?:label|labels|add-label|status|state)(?:=|\s+)(['"]?)([^'"\s]+)\1/g;
+  /**
+   * The repository a creation is ADDRESSED at, which decides whose ready role
+   * answers for it. `-R` is honored here even though short flags are refused
+   * for labels above: `--repo`/`-R` is one flag on one CLI with one meaning,
+   * where the label short forms collide across trackers.
+   */
+  const REPO_FLAG = /(?:^|\s)(?:--repo|-R)(?:=|\s+)(['"]?)([^'"\s]+)\1/;
+  const ISSUES_ENDPOINT = /repos\/([^/\s]+)\/([^/\s]+)\/issues\b/;
+  const DEFAULT_READY_ROLE = "status:ready";
+  const DEFAULT_UPSTREAM_REPO = "CodySwannGT/lisa";
   const CREATION_SIGNATURES: readonly {
     readonly re: RegExp;
     readonly name: string;
@@ -85,9 +95,35 @@ const LisaBlockDirectIssueCreate = async () => {
 
   interface LisaConfig {
     tracker?: string;
-    github?: { labels?: { build?: { ready?: string } } };
+    github?: {
+      org?: string;
+      repo?: string;
+      labels?: { build?: { ready?: string } };
+    };
     jira?: { workflow?: { ready?: string } };
     linear?: { workflow?: { ready?: string } };
+    hardening?: { upstreamRepo?: string; upstreamReadyRole?: string };
+  }
+
+  /** Everything the guard needs to decide whose ready role answers. */
+  interface FilingPolicy {
+    /** The calling project's own build-ready role. */
+    readonly readyRole: string;
+    /** The calling project's own repository, when it declares one. */
+    readonly ownRepo: string | undefined;
+    /** The repository upstream defects are filed at. */
+    readonly upstreamRepo: string;
+    /** The ready role that repository runs its build queue off. */
+    readonly upstreamReadyRole: string;
+    /** Whether the caller's ready role is a GitHub label at all. */
+    readonly callerIsGithub: boolean;
+  }
+
+  /** Which roles satisfy a filing, and the target a refusal should name. */
+  interface Verdict {
+    readonly roles: readonly string[];
+    /** Set only when the filing is provably addressed at another repository. */
+    readonly named: string | undefined;
   }
 
   /**
@@ -104,7 +140,7 @@ const LisaBlockDirectIssueCreate = async () => {
   };
 
   /**
-   * The configured build-ready role, or undefined when no tracker is set.
+   * The filing policy, or undefined when no tracker is set.
    *
    * Keyed off the resolved `tracker` rather than provider precedence: reading
    * whichever provider block happened to appear first could hand a GitHub label
@@ -117,9 +153,9 @@ const LisaBlockDirectIssueCreate = async () => {
    * Resolved once per session at plugin init. That is a deliberate snapshot: a
    * config edit mid-session needs a session restart to take effect, which is
    * the same lifetime as the rest of this plugin's state.
-   * @returns The role token, or undefined.
+   * @returns The filing policy, or undefined.
    */
-  const resolveReadyRole = async (): Promise<string | undefined> => {
+  const resolvePolicy = async (): Promise<FilingPolicy | undefined> => {
     const base = await readConfig(".lisa.config.json");
     const local = await readConfig(".lisa.config.local.json");
     const tracker = local.tracker ?? base.tracker;
@@ -132,10 +168,81 @@ const LisaBlockDirectIssueCreate = async () => {
       if (tracker === "linear") return config.linear?.workflow?.ready;
       return undefined;
     };
-    return pick(local) ?? pick(base) ?? "status:ready";
+    const org = local.github?.org ?? base.github?.org;
+    const name = local.github?.repo ?? base.github?.repo;
+    const hardening = { ...base.hardening, ...local.hardening };
+    return {
+      readyRole: pick(local) ?? pick(base) ?? DEFAULT_READY_ROLE,
+      ownRepo: org && name ? `${org}/${name}`.toLowerCase() : undefined,
+      upstreamRepo: (
+        hardening.upstreamRepo ?? DEFAULT_UPSTREAM_REPO
+      ).toLowerCase(),
+      upstreamReadyRole: hardening.upstreamReadyRole ?? DEFAULT_READY_ROLE,
+      callerIsGithub: tracker === "github",
+    };
+  };
+
+  const policy = await resolvePolicy();
+
+  /**
+   * A repository token reduced to a comparable `owner/name`.
+   *
+   * gh accepts `OWNER/REPO`, `HOST/OWNER/REPO`, and a full browser URL, and
+   * GitHub is case-insensitive about both halves — so comparing raw tokens
+   * would call one repository two different places depending on how it was
+   * typed.
+   * @param value The raw token.
+   * @returns A lowercased `owner/name`, or undefined when it names no repo.
+   */
+  const normaliseRepo = (value: string): string | undefined => {
+    const text = value.replace(/\.git$/, "");
+    const parts = text.split("/").filter(part => part && !part.endsWith(":"));
+    if (parts.length < 2) return undefined;
+    return `${parts.at(-2)}/${parts.at(-1)}`.toLowerCase();
   };
 
-  const readyRole = await resolveReadyRole();
+  /**
+   * The repository this creation is addressed at, when it names one.
+   * @param declarable The command text up to a bare `--`.
+   * @returns A lowercased `owner/name`, or undefined when the calling project
+   *   is the target — the common case, and today's behaviour.
+   */
+  const targetRepository = (declarable: string): string | undefined => {
+    const flag = REPO_FLAG.exec(declarable);
+    if (flag?.[2]) return normaliseRepo(flag[2]);
+    const endpoint = ISSUES_ENDPOINT.exec(declarable);
+    if (endpoint) return normaliseRepo(`${endpoint[1]}/${endpoint[2]}`);
+    return undefined;
+  };
+
+  /**
+   * Which ready-role tokens satisfy a creation addressed at `target`.
+   *
+   * A declaration is demanded either way; this decides only WHOSE vocabulary
+   * it is written in. The last branch is the indeterminate case — a
+   * GitHub-tracked project declaring no `github.org`/`github.repo` cannot be
+   * compared against a target, so both roles are accepted rather than
+   * inventing a refusal, and no cross-repo target is reported: the cross-repo
+   * message would claim this project's role does not answer, which is false in
+   * exactly that branch.
+   * @param resolved The filing policy.
+   * @param target The addressed repository, or undefined.
+   * @returns The acceptable role tokens, and the target to name in a refusal.
+   */
+  const rolesFor = (
+    resolved: FilingPolicy,
+    target: string | undefined
+  ): Verdict => {
+    if (target === undefined || target === resolved.ownRepo)
+      return { roles: [resolved.readyRole], named: undefined };
+    const role =
+      target === resolved.upstreamRepo
+        ? resolved.upstreamReadyRole
+        : DEFAULT_READY_ROLE;
+    if (resolved.ownRepo !== undefined || !resolved.callerIsGithub)
+      return { roles: [role], named: target };
+    return { roles: [resolved.readyRole, role], named: undefined };
+  };
 
   return {
     "tool.execute.before": async (
@@ -143,7 +250,7 @@ const LisaBlockDirectIssueCreate = async () => {
       output: { args?: { command?: string } }
     ) => {
       if (input.tool !== "bash") return;
-      if (readyRole === undefined) return;
+      if (policy === undefined) return;
       const command = String(output.args?.command ?? "");
       if (!command) return;
       if (/--help\b|\s-h(\s|$)/.test(command)) return;
@@ -168,13 +275,59 @@ const LisaBlockDirectIssueCreate = async () => {
       // post-`--` flags outright; acli parses straight past them and creates
       // the item with the flag silently unapplied (verified). Fails closed.
       const declarable = command.split(/(?:^|\s)--(?:\s|$)/)[0] ?? command;
+      // WHICH repository's vocabulary answers is decided by where the create
+      // is addressed, not by whose config file is nearest. A filing aimed at
+      // another repository used to be judged against this project's role,
+      // which that repository does not carry — and on a JIRA or Linear caller
+      // the demanded token was a workflow STATE, so there was no satisfiable
+      // answer at all. The property is unchanged: a declaration is still
+      // required, wherever the item lands.
+      const { roles, named } = rolesFor(policy, targetRepository(declarable));
       const declaresRole = [...declarable.matchAll(LABEL_FLAG)].some(match =>
         (match[2] ?? "")
           .split(",")
           .map(part => part.trim())
-          .includes(readyRole)
+          .some(candidate => roles.includes(candidate))
       );
       if (declaresRole || declarable.includes(HUMAN_GATE_MARKER)) return;
+      if (named !== undefined)
+        throw new Error(
+          [
+            `block-direct-issue-create: refusing ${signature.name} — this filing declares no readiness.`,
+            "",
+            "WHY: a work item filed without the build-ready role is an incomplete",
+            "handoff. Build-intake scans the ready lane and nothing else, so nothing",
+            "will ever pick it up: the write succeeds and the work still dies.",
+            "",
+            `THIS FILING IS ADDRESSED AT ANOTHER REPOSITORY: ${named}.`,
+            "That repository runs its own build queue off its own ready role, so this",
+            "project's role does not answer for it — and this project's filing flow",
+            "writes to this project's tracker, so it cannot reach the target at all.",
+            "",
+            "FILE IT THE SANCTIONED WAY:",
+            "",
+            "1. An upstream defect or hardening report. Use the upstream filing path,",
+            "   which composes a redacted, public-safe body through an allowlist",
+            "   projection instead of free-form prose:",
+            "",
+            "     bunx @codyswann/lisa file-upstream --input <filing-event>.json",
+            "",
+            "   lisa-persist-learning step 6 runs exactly this, headless, on a cron.",
+            "2. If you must run the CLI directly, the command has to carry the TARGET",
+            `   repository's build-ready role — ${roles.join(", ")} — as the value of a`,
+            "   --label flag. Configure it as hardening.upstreamReadyRole when the",
+            "   target renamed its lane.",
+            "",
+            `DO NOT reach for ${HUMAN_GATE_MARKER} to get past this one. It still`,
+            "satisfies the guard, but on an upstream defect report it is a false",
+            "declaration: the target's build queue scans the ready role and nothing",
+            "else, so the report is filed and never picked up.",
+            "",
+            "OPERATOR ESCAPE: a human can export LISA_ALLOW_DIRECT_ISSUE_CREATE=1 in",
+            "the environment before starting the session. Setting it inline on this",
+            "command is deliberately refused.",
+          ].join("\n")
+        );
       throw new Error(
         [
           `block-direct-issue-create: refusing ${signature.name} — this filing declares no readiness.`,
@@ -197,7 +350,7 @@ const LisaBlockDirectIssueCreate = async () => {
           "the ready-role-filing rule for the full contract.",
           "",
           "If you must run the CLI directly, the command has to carry one of the",
-          `two declarations itself: the configured build-ready role "${readyRole}",`,
+          `two declarations itself: the configured build-ready role "${policy.readyRole}",`,
           `or a ${HUMAN_GATE_MARKER} marker in the body it submits.`,
           "",
           "OPERATOR ESCAPE: a human can export LISA_ALLOW_DIRECT_ISSUE_CREATE=1 in",

package/expo/copy-overwrite/scripts/bdd/baseline.mjs

@@ -52,8 +52,25 @@ export const BASELINE_LABEL = "bdd-floor-baseline";
  * on it decides what this gate executes. The gate reads a base revision to
  * decide whether a pull request may merge, which makes that a real
  * substitution risk and not a theoretical one.
+ *
+ * Order within that constraint is set by measurement, not by convention. On
+ * macOS `/usr/bin/git` is not git: it is Apple's `xcrun` shim, and dispatching
+ * through it costs a **median 13,853 ms per invocation against 23-31 ms** for
+ * a real binary — randomized call order, fixed inter-call gaps, n=12 each
+ * (lisa#2887). `git --version` through the shim, doing no work at all, reached
+ * 33,699 ms. This gate makes two or more git calls per run, so the shim alone
+ * can spend a minute of a macOS run resolving a binary.
+ *
+ * The two entries promoted ahead of it are the developer-directory gits the
+ * shim itself dispatches to. Both are `root:wheel` files in system locations,
+ * so this is the same trust class as `/usr/bin/git` and not a relaxation: the
+ * user-writable `/usr/local` and Homebrew entries stay behind it, exactly
+ * where they already were. Neither promoted path exists on Linux or Windows,
+ * so every non-macOS runner resolves precisely what it resolved before.
  */
 const GIT_CANDIDATES = Object.freeze([
+  "/Library/Developer/CommandLineTools/usr/bin/git",
+  "/Applications/Xcode.app/Contents/Developer/usr/bin/git",
   "/usr/bin/git",
   "/usr/local/bin/git",
   "/opt/homebrew/bin/git",

package/package.json

@@ -141,7 +141,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "3.51.1",
+  "version": "3.51.3",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.51.1",
+  "version": "3.51.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.51.1",
+  "version": "3.51.3",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/block-direct-issue-create.sh

@@ -123,6 +123,7 @@ fi
 # The build-ready role is read from config, never hard-coded: a project that
 # renamed its ready lane must still be able to satisfy the guard, and the
 # refusal has to name the token that project actually uses.
+default_ready_role="status:ready"
 case "$tracker" in
   github) ready_role="$(read_config_value '.github.labels.build.ready')" ;;
   jira) ready_role="$(read_config_value '.jira.workflow.ready')" ;;
@@ -130,7 +131,63 @@ case "$tracker" in
   *) ready_role="" ;;
 esac
 if [ -z "$ready_role" ]; then
-  ready_role="status:ready"
+  ready_role="$default_ready_role"
+fi
+
+# WHICH REPOSITORY'S VOCABULARY ANSWERS FOR THIS FILING
+#
+# The role above is the CALLING project's. For a same-repo filing that is the
+# right question. For a filing addressed at a DIFFERENT repository — which
+# Lisa ships a first-class, cron-driven path for in `lisa-persist-learning` —
+# it is the wrong repository's vocabulary, and the guard demanded a token the
+# target does not carry:
+#
+#   - a JIRA or Linear caller's ready role is a workflow STATE. Demanded as a
+#     `gh --label` on another repo it is unsatisfiable, because that label does
+#     not exist there and `gh` rejects an unknown one. Obeying the guard made
+#     the command fail, which is not the same thing as being refused.
+#   - a GitHub caller that renamed its ready lane demanded its own token of a
+#     repository that never had it.
+#   - a GitHub caller on the stock lane worked only because both repositories
+#     happened to choose the same string. That is a coincidence, not routing.
+#
+# The one escape that IS satisfiable cross-repo, `[lisa-human-gate]`, is a lie
+# about the item: it stamps a build-ready defect report as held for a human
+# product call, and the target's build queue scans the ready role and nothing
+# else. The report is filed and never picked up — precisely the incomplete
+# handoff this guard exists to prevent, committed one repository over.
+#
+# So the target's own role answers, resolved from CONFIG rather than the
+# network. A live `gh api repos/<o>/<r>/labels` lookup would be more general
+# and is the wrong trade for a PreToolUse hook: a network round-trip on every
+# intercepted command, and a new fail-open surface when it errors.
+own_org="$(read_config_value '.github.org')"
+own_name="$(read_config_value '.github.repo')"
+own_repo=""
+if [ -n "$own_org" ] && [ -n "$own_name" ]; then
+  own_repo="$own_org/$own_name"
+fi
+
+# `hardening.upstreamRepo` already names the upstream repository across Lisa's
+# filing skills; `hardening.upstreamReadyRole` is its sibling, so the guard
+# keeps its existing discipline — read the role from config, never hard-code it
+# — while reading it from the RIGHT repository's config.
+upstream_repo="$(read_config_value '.hardening.upstreamRepo')"
+if [ -z "$upstream_repo" ]; then
+  upstream_repo="CodySwannGT/lisa"
+fi
+upstream_ready_role="$(read_config_value '.hardening.upstreamReadyRole')"
+if [ -z "$upstream_ready_role" ]; then
+  upstream_ready_role="$default_ready_role"
+fi
+
+# A non-GitHub caller's ready role is a workflow STATE, so it is never the right
+# vocabulary for a GitHub target no matter what the target turns out to be. The
+# classifier needs to know that even when this project declares no repo of its
+# own to compare against.
+caller_is_github="0"
+if [ "$tracker" = "github" ]; then
+  caller_is_github="1"
 fi
 
 # Ambient-only override. Deliberately read here, from the hook process's own
@@ -139,6 +196,11 @@ ambient_override="${LISA_ALLOW_DIRECT_ISSUE_CREATE:-}"
 
 refuse() {
   local signature="$1"
+  local roles="$2"
+  local target="$3"
+  if [ -n "$target" ]; then
+    refuse_cross_repo "$signature" "$roles" "$target"
+  fi
   cat >&2 <<EOF
 BLOCKED: refusing \`$signature\` — this filing declares no readiness.
 
@@ -184,6 +246,61 @@ EOF
   exit 2
 }
 
+# The cross-repo refusal is a separate message, not a variable swapped into the
+# one above, because its REMEDIATION is different. The local filing flow writes
+# to this project's own tracker and structurally cannot reach another
+# repository, so naming it here would send the agent to a path that cannot do
+# the thing it was just refused for. Name the route that reaches the target,
+# and name the target's role rather than this project's.
+refuse_cross_repo() {
+  local signature="$1"
+  local roles="$2"
+  local target="$3"
+  cat >&2 <<EOF
+BLOCKED: refusing \`$signature\` — this filing declares no readiness.
+
+WHY: a work item filed without the build-ready role is an incomplete handoff.
+Build-intake scans the ready lane and nothing else, so nothing will ever pick
+it up: the write succeeds and the work still dies.
+
+THIS FILING IS ADDRESSED AT ANOTHER REPOSITORY: \`$target\`.
+That repository runs its own build queue off its own ready role, so this
+project's role does not answer for it — and this project's filing flow writes
+to this project's tracker, so it cannot reach the target at all.
+
+FILE IT THE SANCTIONED WAY:
+
+1. An upstream defect or hardening report — the highest-signal report there is,
+   because it is reproduced and attributed rather than guessed at. Use the
+   upstream filing path, which composes a redacted, public-safe body through an
+   allowlist projection instead of free-form prose:
+
+     bunx @codyswann/lisa file-upstream --input <filing-event>.json
+
+   \`lisa-persist-learning\` step 6 runs exactly this, headless, on a cron, and
+   files the result with explicit \`build_ready: true\` so the target's queue
+   picks it up.
+
+2. If you must run the CLI directly, the command has to carry the TARGET
+   repository's build-ready role — \`$roles\` — as the value of a \`--label\`
+   flag. Configure it as \`hardening.upstreamReadyRole\` when the target renamed
+   its lane.
+
+DO NOT reach for \`[lisa-human-gate]\` to get past this one. It still satisfies
+the guard — it is a real declaration — but on an upstream defect report it is a
+false one: it stamps the item as held for a human product call, and the
+target's build queue scans the ready role and nothing else. The report is filed
+and never picked up, which is the incomplete handoff this guard exists to
+prevent, committed one repository over. Use it only when a human product call
+is genuinely pending on the target.
+
+OPERATOR ESCAPE: a human can export \`LISA_ALLOW_DIRECT_ISSUE_CREATE=1\` in the
+environment before starting the session. It is deliberately not reachable by
+setting it inline on this command — an inline assignment is refused.
+EOF
+  exit 2
+}
+
 # The classifier is read into a variable with a top-level here-document rather
 # than piped straight in from inside `$( … )`. bash 3.2 — which is what macOS
 # still ships as /bin/bash, and therefore what this fleet's hooks run under —
@@ -202,6 +319,11 @@ import sys
 command = os.environ.get("LISA_GUARD_COMMAND", "")
 ready_role = os.environ.get("LISA_GUARD_READY_ROLE", "")
 ambient_override = os.environ.get("LISA_GUARD_AMBIENT_OVERRIDE", "")
+default_ready_role = os.environ.get("LISA_GUARD_DEFAULT_READY_ROLE", "")
+own_repo = os.environ.get("LISA_GUARD_OWN_REPO", "").strip().lower()
+upstream_repo = os.environ.get("LISA_GUARD_UPSTREAM_REPO", "").strip().lower()
+upstream_ready_role = os.environ.get("LISA_GUARD_UPSTREAM_READY_ROLE", "")
+caller_is_github = os.environ.get("LISA_GUARD_CALLER_IS_GITHUB", "") == "1"
 
 OVERRIDE_NAME = "LISA_ALLOW_DIRECT_ISSUE_CREATE"
 HUMAN_GATE_MARKER = "[lisa-human-gate]"
@@ -269,6 +391,14 @@ PAYLOAD_VALUE_FLAGS = {"-f", "-F", "--raw-field", "--field"}
 
 GITHUB_ISSUES_PATH = re.compile(r"repos/[^/\s]+/[^/\s]+/issues/?$")
 GITHUB_ISSUES_URL = re.compile(r"api\.github\.com/repos/[^/\s]+/[^/\s]+/issues")
+# The repository a creation is ADDRESSED at, which decides whose ready role
+# answers for it. `gh` accepts the flag before or after the subcommand and in
+# either spelling, and the REST paths carry the same pair positionally.
+REPO_FLAGS = {"--repo", "-R"}
+GITHUB_ISSUES_PATH_REPO = re.compile(r"repos/([^/\s]+)/([^/\s]+)/issues/?$")
+GITHUB_ISSUES_URL_REPO = re.compile(
+    r"api\.github\.com/repos/([^/\s]+)/([^/\s]+)/issues"
+)
 JIRA_ISSUE_URL = re.compile(r"atlassian\.net/rest/api/[^/\s]+/issue")
 GRAPHQL_CREATE = re.compile(r"createIssue|issueCreate")
 
@@ -655,20 +785,118 @@ def body_file_paths(args):
     return paths
 
 
-def declares_readiness(raw_args):
+def normalise_repo(value):
+    """A `--repo` value reduced to a comparable `owner/name`.
+
+    `gh` accepts `OWNER/REPO`, `HOST/OWNER/REPO`, and a full browser URL, and
+    GitHub itself is case-insensitive about both halves — so comparing the raw
+    token would call the same repository two different places depending on how
+    it was typed.
+
+    Args:
+        value: The raw token.
+
+    Returns:
+        A lowercased `owner/name`, or None when the token names no repository.
+    """
+    text = value.strip().strip("'\"")
+    if text.endswith(".git"):
+        text = text[: -len(".git")]
+    parts = [part for part in text.split("/") if part and not part.endswith(":")]
+    if len(parts) < 2:
+        return None
+    return ("%s/%s" % (parts[-2], parts[-1])).lower()
+
+
+def target_repository(args):
+    """The repository this creation is addressed at, when it names one.
+
+    Read only from positions that actually reach the created item: a flag
+    before the end-of-options marker, or the endpoint the write is posted to.
+    A `-f repo=o/r` payload field is data being SENT, not the address being
+    posted to, and `endpoint_tokens` already excludes it.
+
+    Args:
+        args: A creating command's arguments.
+
+    Returns:
+        A lowercased `owner/name`, or None when the calling project is the
+        target — which is the overwhelmingly common case and today's behaviour.
+    """
+    scoped = before_end_of_options(args)
+    for index, token in enumerate(scoped):
+        if token in REPO_FLAGS and index + 1 < len(scoped):
+            return normalise_repo(scoped[index + 1])
+        if "=" in token:
+            head, value = token.split("=", 1)
+            if head in REPO_FLAGS:
+                return normalise_repo(value)
+    for token in endpoint_tokens(scoped, GITHUB_ISSUES_PATH):
+        match = GITHUB_ISSUES_PATH_REPO.search(token)
+        if match:
+            return normalise_repo("%s/%s" % (match.group(1), match.group(2)))
+    for token in scoped:
+        match = GITHUB_ISSUES_URL_REPO.search(token)
+        if match:
+            return normalise_repo("%s/%s" % (match.group(1), match.group(2)))
+    return None
+
+
+def roles_for(target):
+    """Which ready-role tokens satisfy a creation addressed at `target`.
+
+    The guard demands a declaration either way; this decides only WHOSE
+    vocabulary the declaration is written in.
+
+    The indeterminate case is the last branch: a GitHub-tracked project that
+    declares no `github.org`/`github.repo` cannot be compared against a target,
+    so both roles are accepted rather than inventing a refusal. That is
+    permissive about which token, never about whether one is required.
+
+    Args:
+        target: The addressed repository, or None.
+
+    Returns:
+        A (roles, cross_repo_target) pair. The target is None when the calling
+        project is the one being written to.
+    """
+    if target is None or (own_repo and target == own_repo):
+        return [ready_role], None
+    if upstream_repo and target == upstream_repo:
+        role = upstream_ready_role
+    else:
+        # Another repository Lisa has no configuration for. Its lane is
+        # whatever GitHub's stock one is; the caller's token is categorically
+        # not it.
+        role = default_ready_role
+    if own_repo or not caller_is_github:
+        return [role], target
+    # Indeterminate, and the target is deliberately NOT reported. The refusal
+    # would otherwise say "this filing is addressed at another repository" and
+    # "this project's role does not answer for it" — the first unproven and the
+    # second flatly false, since this branch accepts the project's role. A
+    # message naming a token that does not work is the remediation pointing
+    # away from the fix, which is the defect being repaired here.
+    return [ready_role, role], None
+
+
+def declares_readiness(raw_args, roles):
     """Whether the create carries one of the two required declarations.
 
     Args:
         raw_args: The creating command's arguments.
+        roles: The build-ready role tokens that satisfy this filing.
 
     Returns:
-        True when the build-ready role or a human-gate marker is present.
+        True when a build-ready role or a human-gate marker is present.
     """
     args = before_end_of_options(raw_args)
-    if ready_role:
+    for role in roles:
+        if not role:
+            continue
         for raw in flag_values(args, LABEL_FLAGS):
             candidates = [part.strip().strip("'\"") for part in raw.split(",")]
-            if ready_role in candidates:
+            if role in candidates:
                 return True
     # The human-gate marker is matched anywhere, and that asymmetry is
     # deliberate: it is a marker with no other meaning, so its presence in the
@@ -746,7 +974,8 @@ def scan(text, depth):
         depth: Current nesting depth.
 
     Returns:
-        A refusal signature, or None when nothing creation-shaped was found.
+        A (signature, roles, cross_repo_target) triple, or None when nothing
+        creation-shaped was found.
     """
     try:
         stripped = strip_heredocs(text)
@@ -757,7 +986,11 @@ def scan(text, depth):
         # raises on the unbalanced quote. Two appended characters, no binary
         # required. "I could not parse it" must never mean "it is fine".
         if UNPARSEABLE_CREATION.search(text):
-            return "an unparseable command that reads as a tracker creation"
+            return (
+                "an unparseable command that reads as a tracker creation",
+                [ready_role],
+                None,
+            )
         return None
 
     for argv in segment(tokens):
@@ -774,9 +1007,10 @@ def scan(text, depth):
             # disqualifies the override rather than supplying it.
             if ambient_override and not inline_override:
                 continue
-            if declares_readiness(args):
+            roles, target = roles_for(target_repository(args))
+            if declares_readiness(args, roles):
                 continue
-            return signature
+            return signature, roles, target
 
         for operand in nested_operands(argv):
             if depth >= MAX_NESTING_DEPTH:
@@ -784,7 +1018,11 @@ def scan(text, depth):
                 # made a creation inside a 4th `bash -c` layer pass, which is
                 # the depth cap being used as the bypass.
                 if UNPARSEABLE_CREATION.search(operand):
-                    return "a tracker creation nested past the inspection depth"
+                    return (
+                        "a tracker creation nested past the inspection depth",
+                        [ready_role],
+                        None,
+                    )
                 continue
             nested = scan(operand, depth + 1)
             if nested is not None:
@@ -802,7 +1040,14 @@ inline_override = (OVERRIDE_NAME + "=") in command
 
 found = scan(command, 0)
 if found is not None:
-    print("REFUSE %s" % found)
+    signature, roles, target = found
+    # Key=value lines rather than one delimited string: a signature contains
+    # spaces and slashes, and a role may contain a colon, so anything the shell
+    # would have to split on appears inside a value already.
+    print("REFUSE")
+    print("signature=%s" % signature)
+    print("roles=%s" % ", ".join(role for role in roles if role))
+    print("target=%s" % (target or ""))
     sys.exit(0)
 
 print("ALLOW")
@@ -815,6 +1060,11 @@ verdict="$(
     LISA_GUARD_COMMAND="$command_str" \
       LISA_GUARD_READY_ROLE="$ready_role" \
       LISA_GUARD_AMBIENT_OVERRIDE="$ambient_override" \
+      LISA_GUARD_DEFAULT_READY_ROLE="$default_ready_role" \
+      LISA_GUARD_OWN_REPO="$own_repo" \
+      LISA_GUARD_UPSTREAM_REPO="$upstream_repo" \
+      LISA_GUARD_UPSTREAM_READY_ROLE="$upstream_ready_role" \
+      LISA_GUARD_CALLER_IS_GITHUB="$caller_is_github" \
       python3 -
 )"
 python_status=$?
@@ -827,8 +1077,17 @@ if [ "$python_status" -ne 0 ]; then
   exit 0
 fi
 
+verdict_field() {
+  printf '%s\n' "$verdict" | sed -n "s/^$1=//p" | head -1
+}
+
 case "$verdict" in
-  REFUSE*) refuse "${verdict#REFUSE }" ;;
+  REFUSE*)
+    refuse \
+      "$(verdict_field signature)" \
+      "$(verdict_field roles)" \
+      "$(verdict_field target)"
+    ;;
 esac
 
 exit 0