@codyswann/lisa 3.56.0 → 3.59.0

package/dist/migrations/ensure-seeded-gates.d.ts

@@ -0,0 +1,47 @@
+import type { Migration, MigrationContext, MigrationResult } from "./migration.interface.js";
+/**
+ * Migration: declare, in `.lisa.config.json`, the gates this project is already
+ * proving with a command written into a Lisa-shipped hook or workflow.
+ *
+ * WHY A MIGRATION AND NOT A TEMPLATE. Nothing seeds a `gates` block into a
+ * consumer: exactly one `.lisa.config.json` is tracked anywhere in Lisa, and it
+ * is Lisa's own. So the hardcoded path in the pre-push hook and in every gated
+ * CI job is not a fallback for the unusual project — it is the DEFAULT for
+ * essentially every installed one. A create-only artifact would never reach a
+ * repository that already exists, and a version bump alone would deliver
+ * nothing, which is why this is a migration that runs on `lisa apply`.
+ *
+ * WHY IT SEEDS LESS THAN THE REGISTRY. A seeded declaration has to reproduce
+ * what the built-in did, or the migration reddens a fleet on a version bump.
+ * `seedGates` therefore declares a gate only when the task that reproduces the
+ * built-in is a script the project actually has, and only at a moment the
+ * registry says the gate may be declared at. Everything it declines stays
+ * ungoverned — and stays reported by `lisa-gates.mjs unconfigured`, which the
+ * pre-push hook and every gated CI job now print. Visible beats declared-away.
+ *
+ * Idempotent: an existing declaration always wins, so a second run seeds
+ * nothing. Never removes or rewrites a declaration the project made.
+ */
+export declare class EnsureSeededGatesMigration implements Migration {
+    readonly name = "ensure-seeded-gates";
+    readonly description = "Declare the gates the project already proves with a command written into a Lisa-shipped hook or workflow";
+    /**
+     * Resolve what seeding would change, or null when there is nothing to do.
+     * @param ctx - Migration context
+     * @returns The plan, or null
+     */
+    private plan;
+    /**
+     * Applies when at least one ungoverned property has a task that reproduces it.
+     * @param ctx - Migration context
+     * @returns True when there is work to do
+     */
+    applies(ctx: MigrationContext): Promise<boolean>;
+    /**
+     * Write the seeded declarations into `.lisa.config.json`.
+     * @param ctx - Migration context
+     * @returns Result describing the action taken
+     */
+    apply(ctx: MigrationContext): Promise<MigrationResult>;
+}
+//# sourceMappingURL=ensure-seeded-gates.d.ts.map

package/dist/migrations/ensure-seeded-gates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-seeded-gates.d.ts","sourceRoot":"","sources":["../../src/migrations/ensure-seeded-gates.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AA+DlC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,0BAA2B,YAAW,SAAS;IAC1D,QAAQ,CAAC,IAAI,yBAAyB;IACtC,QAAQ,CAAC,WAAW,8GACyF;IAE7G;;;;OAIG;YACW,IAAI;IAoClB;;;;OAIG;IACG,OAAO,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAItD;;;;OAIG;IACG,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;CAyB7D"}

package/dist/migrations/ensure-seeded-gates.js

@@ -0,0 +1,139 @@
+import * as path from "node:path";
+import * as fse from "fs-extra";
+import { importGateRegistry } from "../cli/gate-registry-source.js";
+import { readJsonOrNull, writeJson } from "../utils/json-utils.js";
+const LISA_CONFIG = ".lisa.config.json";
+const PACKAGE_JSON = "package.json";
+/**
+ * The task runner a seeded block should record, from the project's lockfile.
+ *
+ * LOCKFILE ONLY, and deliberately so. This matches the pre-push hook's
+ * PRIORITY (bun, then yarn, then npm) but not its `command -v` availability
+ * check, because the two answer different questions. The hook decides what to
+ * run on THIS machine, now, and re-decides on every machine. `gates.runner` is
+ * written into `.lisa.config.json` and committed: one value, resolved once,
+ * then read by every contributor and every CI runner.
+ *
+ * Probing the seeding machine's PATH and freezing the result would let a
+ * laptop that happens not to have bun installed record `npm run` for a bun
+ * project, permanently and for everyone. The lockfile is the portable fact
+ * about which runner the project uses; an absent binary is a local
+ * environment gap to fix locally, not a property of the repository.
+ * @param projectDir - Destination project directory
+ * @returns A runner string for `gates.runner`
+ */
+async function detectRunner(projectDir) {
+    const has = async (file) => fse.pathExists(path.join(projectDir, file));
+    if ((await has("bun.lockb")) || (await has("bun.lock")))
+        return "bun run";
+    if (await has("yarn.lock"))
+        return "yarn";
+    return "npm run";
+}
+/**
+ * Migration: declare, in `.lisa.config.json`, the gates this project is already
+ * proving with a command written into a Lisa-shipped hook or workflow.
+ *
+ * WHY A MIGRATION AND NOT A TEMPLATE. Nothing seeds a `gates` block into a
+ * consumer: exactly one `.lisa.config.json` is tracked anywhere in Lisa, and it
+ * is Lisa's own. So the hardcoded path in the pre-push hook and in every gated
+ * CI job is not a fallback for the unusual project — it is the DEFAULT for
+ * essentially every installed one. A create-only artifact would never reach a
+ * repository that already exists, and a version bump alone would deliver
+ * nothing, which is why this is a migration that runs on `lisa apply`.
+ *
+ * WHY IT SEEDS LESS THAN THE REGISTRY. A seeded declaration has to reproduce
+ * what the built-in did, or the migration reddens a fleet on a version bump.
+ * `seedGates` therefore declares a gate only when the task that reproduces the
+ * built-in is a script the project actually has, and only at a moment the
+ * registry says the gate may be declared at. Everything it declines stays
+ * ungoverned — and stays reported by `lisa-gates.mjs unconfigured`, which the
+ * pre-push hook and every gated CI job now print. Visible beats declared-away.
+ *
+ * Idempotent: an existing declaration always wins, so a second run seeds
+ * nothing. Never removes or rewrites a declaration the project made.
+ */
+export class EnsureSeededGatesMigration {
+    name = "ensure-seeded-gates";
+    description = "Declare the gates the project already proves with a command written into a Lisa-shipped hook or workflow";
+    /**
+     * Resolve what seeding would change, or null when there is nothing to do.
+     * @param ctx - Migration context
+     * @returns The plan, or null
+     */
+    async plan(ctx) {
+        const configPath = path.join(ctx.projectDir, LISA_CONFIG);
+        const config = await readJsonOrNull(configPath);
+        // No config file means the project has not been onboarded at all. Creating
+        // one here would declare gates for a repository that has not asked Lisa to
+        // govern anything, so this stays a migration for projects that already
+        // carry the file.
+        if (config === null)
+            return null;
+        const manifest = await readJsonOrNull(path.join(ctx.projectDir, PACKAGE_JSON));
+        if (manifest === null)
+            return null;
+        const registry = await importGateRegistry();
+        if (registry === null)
+            return null;
+        const { runner: declaredRunner, ...gates } = config.gates ?? {};
+        const result = registry.seedGates({
+            gates: gates,
+            scripts: manifest.scripts ?? {},
+            runner: typeof declaredRunner === "string"
+                ? declaredRunner
+                : await detectRunner(ctx.projectDir),
+        });
+        if (result.seeded.length === 0)
+            return null;
+        return {
+            configPath,
+            config,
+            gates: result.gates,
+            seeded: result.seeded.map(entry => ({
+                gate: entry.gate,
+                moment: entry.moment,
+            })),
+        };
+    }
+    /**
+     * Applies when at least one ungoverned property has a task that reproduces it.
+     * @param ctx - Migration context
+     * @returns True when there is work to do
+     */
+    async applies(ctx) {
+        return (await this.plan(ctx)) !== null;
+    }
+    /**
+     * Write the seeded declarations into `.lisa.config.json`.
+     * @param ctx - Migration context
+     * @returns Result describing the action taken
+     */
+    async apply(ctx) {
+        const plan = await this.plan(ctx);
+        if (plan === null)
+            return { name: this.name, action: "noop" };
+        const declared = plan.seeded
+            .map(entry => `${entry.gate}@${entry.moment}`)
+            .join(", ");
+        const message = `Declared ${plan.seeded.length} gate(s) in ${LISA_CONFIG} that were running a command written into a Lisa-shipped hook or workflow: ${declared}`;
+        if (ctx.dryRun) {
+            ctx.logger.dry(`Would seed ${plan.seeded.length} gate declaration(s)`);
+            return {
+                name: this.name,
+                action: "applied",
+                changedFiles: [LISA_CONFIG],
+                message,
+            };
+        }
+        await writeJson(plan.configPath, { ...plan.config, gates: plan.gates });
+        ctx.logger.success(message);
+        return {
+            name: this.name,
+            action: "applied",
+            changedFiles: [LISA_CONFIG],
+            message,
+        };
+    }
+}
+//# sourceMappingURL=ensure-seeded-gates.js.map

package/dist/migrations/ensure-seeded-gates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-seeded-gates.js","sourceRoot":"","sources":["../../src/migrations/ensure-seeded-gates.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAOnE,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,YAAY,GAAG,cAAc,CAAC;AAkCpC;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,YAAY,CAAC,UAAkB;IAC5C,MAAM,GAAG,GAAG,KAAK,EAAE,IAAY,EAAoB,EAAE,CACnD,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1E,IAAI,MAAM,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,MAAM,CAAC;IAC1C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,0BAA0B;IAC5B,IAAI,GAAG,qBAAqB,CAAC;IAC7B,WAAW,GAClB,0GAA0G,CAAC;IAE7G;;;;OAIG;IACK,KAAK,CAAC,IAAI,CAAC,GAAqB;QACtC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAa,UAAU,CAAC,CAAC;QAC5D,2EAA2E;QAC3E,2EAA2E;QAC3E,uEAAuE;QACvE,kBAAkB;QAClB,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,cAAc,CACnC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CACxC,CAAC;QACF,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAsB,CAAC;QAChE,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAEnC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC;YAChC,KAAK,EAAE,KAAgC;YACvC,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,EAAE;YAC/B,MAAM,EACJ,OAAO,cAAc,KAAK,QAAQ;gBAChC,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;SACzC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,OAAO;YACL,UAAU;YACV,MAAM;YACN,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAClC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,GAAqB;QACjC,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,GAAqB;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM;aACzB,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;aAC7C,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,OAAO,GAAG,YAAY,IAAI,CAAC,MAAM,CAAC,MAAM,eAAe,WAAW,8EAA8E,QAAQ,EAAE,CAAC;QACjK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,MAAM,sBAAsB,CAAC,CAAC;YACvE,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,SAAS;gBACjB,YAAY,EAAE,CAAC,WAAW,CAAC;gBAC3B,OAAO;aACR,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACxE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,SAAS;YACjB,YAAY,EAAE,CAAC,WAAW,CAAC;YAC3B,OAAO;SACR,CAAC;IACJ,CAAC;CACF"}

package/dist/migrations/index.d.ts

@@ -8,6 +8,7 @@ export { EnsureLisaPostinstallMigration } from "./ensure-lisa-postinstall.js";
 export { EnsureOxlintBaseConfigsMigration } from "./ensure-oxlint-base-configs.js";
 export { EnsurePlaywrightDedicatedCallerMigration } from "./ensure-playwright-dedicated-caller.js";
 export { EnsureQualityCallerScopesMigration } from "./ensure-quality-caller-scopes.js";
+export { EnsureSeededGatesMigration } from "./ensure-seeded-gates.js";
 export { EnsureSonarExcludesLisaHarnessMigration } from "./ensure-sonar-excludes-lisa-harness.js";
 export { EnsureTsconfigLocalFilesFallbackMigration } from "./ensure-tsconfig-local-files-fallback.js";
 export { EnsureWikiSourceDeclaredMigration } from "./ensure-wiki-source-declared.js";

package/dist/migrations/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAElF;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuB;IAElD;;;OAGG;gBACS,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE;IAmB7C;;;OAGG;IACH,MAAM,IAAI,SAAS,SAAS,EAAE;IAI9B;;;;OAIG;IACG,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/D;;;;OAIG;IACG,MAAM,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC;CAazE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,iBAAiB,CAE3D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAElF;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuB;IAElD;;;OAGG;gBACS,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE;IAoB7C;;;OAGG;IACH,MAAM,IAAI,SAAS,SAAS,EAAE;IAI9B;;;;OAIG;IACG,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/D;;;;OAIG;IACG,MAAM,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC;CAazE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,iBAAiB,CAE3D"}

package/dist/migrations/index.js

@@ -6,6 +6,7 @@ import { EnsureLisaPostinstallMigration } from "./ensure-lisa-postinstall.js";
 import { EnsureOxlintBaseConfigsMigration } from "./ensure-oxlint-base-configs.js";
 import { EnsurePlaywrightDedicatedCallerMigration } from "./ensure-playwright-dedicated-caller.js";
 import { EnsureQualityCallerScopesMigration } from "./ensure-quality-caller-scopes.js";
+import { EnsureSeededGatesMigration } from "./ensure-seeded-gates.js";
 import { EnsureSonarExcludesLisaHarnessMigration } from "./ensure-sonar-excludes-lisa-harness.js";
 import { EnsureTsconfigLocalFilesFallbackMigration } from "./ensure-tsconfig-local-files-fallback.js";
 import { EnsureWikiSourceDeclaredMigration } from "./ensure-wiki-source-declared.js";
@@ -20,6 +21,7 @@ export { EnsureLisaPostinstallMigration } from "./ensure-lisa-postinstall.js";
 export { EnsureOxlintBaseConfigsMigration } from "./ensure-oxlint-base-configs.js";
 export { EnsurePlaywrightDedicatedCallerMigration } from "./ensure-playwright-dedicated-caller.js";
 export { EnsureQualityCallerScopesMigration } from "./ensure-quality-caller-scopes.js";
+export { EnsureSeededGatesMigration } from "./ensure-seeded-gates.js";
 export { EnsureSonarExcludesLisaHarnessMigration } from "./ensure-sonar-excludes-lisa-harness.js";
 export { EnsureTsconfigLocalFilesFallbackMigration } from "./ensure-tsconfig-local-files-fallback.js";
 export { EnsureWikiSourceDeclaredMigration } from "./ensure-wiki-source-declared.js";
@@ -47,6 +49,7 @@ export class MigrationRegistry {
             new EnsureOxlintBaseConfigsMigration(),
             new EnsurePlaywrightDedicatedCallerMigration(),
             new EnsureQualityCallerScopesMigration(),
+            new EnsureSeededGatesMigration(),
             new EnsureSonarExcludesLisaHarnessMigration(),
             new EnsureWikiSourceDeclaredMigration(),
             new ReconcileClaudeStackPluginsMigration(),

package/dist/migrations/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAalF,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAElF;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACX,UAAU,CAAuB;IAElD;;;OAGG;IACH,YAAY,UAAiC;QAC3C,IAAI,CAAC,UAAU,GAAG,UAAU,IAAI;YAC9B,IAAI,oCAAoC,EAAE;YAC1C,IAAI,yCAAyC,EAAE;YAC/C,IAAI,yCAAyC,EAAE;YAC/C,IAAI,6CAA6C,EAAE;YACnD,IAAI,qCAAqC,EAAE;YAC3C,IAAI,mCAAmC,EAAE;YACzC,IAAI,8BAA8B,EAAE;YACpC,IAAI,gCAAgC,EAAE;YACtC,IAAI,wCAAwC,EAAE;YAC9C,IAAI,kCAAkC,EAAE;YACxC,IAAI,uCAAuC,EAAE;YAC7C,IAAI,iCAAiC,EAAE;YACvC,IAAI,oCAAoC,EAAE;YAC1C,IAAI,gCAAgC,EAAE;SACvC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,GAAqB;QAC7C,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,IAAI,SAAS,CAAC,gBAAgB,EAAE,CAAC;gBAC/B,MAAM,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,GAAqB;QAChC,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC1D,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,IAAI,iBAAiB,EAAE,CAAC;AACjC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAalF,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAElF;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACX,UAAU,CAAuB;IAElD;;;OAGG;IACH,YAAY,UAAiC;QAC3C,IAAI,CAAC,UAAU,GAAG,UAAU,IAAI;YAC9B,IAAI,oCAAoC,EAAE;YAC1C,IAAI,yCAAyC,EAAE;YAC/C,IAAI,yCAAyC,EAAE;YAC/C,IAAI,6CAA6C,EAAE;YACnD,IAAI,qCAAqC,EAAE;YAC3C,IAAI,mCAAmC,EAAE;YACzC,IAAI,8BAA8B,EAAE;YACpC,IAAI,gCAAgC,EAAE;YACtC,IAAI,wCAAwC,EAAE;YAC9C,IAAI,kCAAkC,EAAE;YACxC,IAAI,0BAA0B,EAAE;YAChC,IAAI,uCAAuC,EAAE;YAC7C,IAAI,iCAAiC,EAAE;YACvC,IAAI,oCAAoC,EAAE;YAC1C,IAAI,gCAAgC,EAAE;SACvC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,GAAqB;QAC7C,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,IAAI,SAAS,CAAC,gBAAgB,EAAE,CAAC;gBAC/B,MAAM,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,GAAqB;QAChC,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC1D,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,IAAI,iBAAiB,EAAE,CAAC;AACjC,CAAC"}

package/expo/copy-overwrite/scripts/bdd/baseline.mjs

@@ -41,9 +41,6 @@ const defect = (code, message) => ({ code, message });
 /** Defect / evidence code, named once. */
 const SCENARIO_DELETED = "scenario-deleted";
 
-/** The maintainer-applied PR label that authorizes giving coverage back. */
-export const BASELINE_LABEL = "bdd-floor-baseline";
-
 /**
  * Fixed absolute locations git is installed at, tried before anything on PATH.
  *
@@ -301,15 +298,23 @@ const RETIREMENT_FIELDS = ["reason", "ticket", "approvedBy", "recordedAt"];
 
 /**
  * Whether a scenario has been retired the way the contract requires: a
- * complete `retirements` record AND the maintainer-applied label. Either alone
- * is not an authorization — that is the whole point of asking for two
- * artifacts one author cannot produce by editing one file.
+ * COMPLETE `retirements` record.
+ *
+ * This used to also demand a maintainer-applied PR label, on the reasoning that
+ * two artifacts one author cannot produce alone is a stronger guarantee than
+ * one. The label was dropped because it guarantees the wrong thing: it verifies
+ * that a second person clicked, not that the behavior is actually gone, and it
+ * stalls the case it was most needed for — an agent retiring coverage for a
+ * feature the product genuinely no longer has.
+ *
+ * The record is the part that carries information. It still owes every field in
+ * {@link RETIREMENT_FIELDS}, is still refused when incomplete, and still lands
+ * in the diff where it can be read and challenged.
  * @param {object|undefined} record - The retirements entry, if any.
- * @param {readonly string[]} labels - PR labels.
- * @returns {boolean} True when the retirement is authorized and complete.
+ * @returns {boolean} True when the retirement is complete.
  */
-function isRetired(record, labels) {
-  if (!record || !labels.includes(BASELINE_LABEL)) return false;
+function isRetired(record) {
+  if (!record) return false;
   return RETIREMENT_FIELDS.every(field => Boolean(record[field]));
 }
 
@@ -324,15 +329,10 @@ function isRetired(record, labels) {
  * Keys whose scenario disappeared from the contract entirely are left to
  * {@link checkDeletions}, which names that act precisely; reporting both would
  * describe one deletion as two different failures.
- * @param {object} input - Baseline, head contract and scenarios, and PR labels.
+ * @param {object} input - Baseline, and head contract and scenarios.
  * @returns {object[]} Defects found.
  */
-export function checkCoverageRegression({
-  baseline,
-  contract,
-  scenarios,
-  labels,
-}) {
+export function checkCoverageRegression({ baseline, contract, scenarios }) {
   const before = acceptedKeys(baseline.scenarios, baseline.contract);
   const after = acceptedKeys(scenarios, contract);
   const present = new Set(scenarios.map(scenario => scenario.id));
@@ -343,42 +343,42 @@ export function checkCoverageRegression({
   return [...before]
     .filter(key => !after.has(key) && present.has(partsOf(key).scenario))
     .sort(byCodeUnit)
-    .flatMap(key => regressionDefect(key, { retired, waived, labels }));
+    .flatMap(key => regressionDefect(key, { retired, waived }));
 }
 
 /**
  * The defect for one obligation whose accepted coverage disappeared, or none
  * when it left the denominator through an authorized route.
  * @param {string} key - The `SCENARIO:platform` key.
- * @param {object} input - Retirement records, waived keys, and PR labels.
+ * @param {object} input - Retirement records and waived keys.
  * @returns {object[]} Zero or one defect.
  */
-function regressionDefect(key, { retired, waived, labels }) {
+function regressionDefect(key, { retired, waived }) {
   const { scenario, platform } = partsOf(key);
-  if (isRetired(retired.get(scenario), labels)) return [];
-  if (waived.has(key) && labels.includes(BASELINE_LABEL)) return [];
+  if (isRetired(retired.get(scenario))) return [];
+  if (waived.has(key)) return [];
   return [
     defect(
       "coverage-regression",
-      `${scenario}:${platform} was covered at the base revision and is not covered here. Coverage this repository already accepted cannot be handed back quietly. Restore the mapping, or take one of the two recorded routes out — a retirements record (${RETIREMENT_FIELDS.join(", ")}) for a behavior the product no longer has, or a platformWaivers entry for a runner that cannot decide it — and get the maintainer-applied "${BASELINE_LABEL}" label on this pull request. ${routeTaken(key, { retired, waived, labels })}`
+      `${scenario}:${platform} was covered at the base revision and is not covered here. Coverage this repository already accepted cannot be handed back quietly. Restore the mapping, or take one of the two recorded routes out — a retirements record (${RETIREMENT_FIELDS.join(", ")}) for a behavior the product no longer has, or a platformWaivers entry for a runner that cannot decide it. ${routeTaken(key, { retired })}`
     ),
   ];
 }
 
 /**
- * Say which half of the authorization is missing, so the operator is told what
- * to do rather than only what went wrong.
+ * Say what is missing from the authorization, so the operator is told what to
+ * do rather than only what went wrong.
+ *
+ * Only reached for a key that took NEITHER route: {@link regressionDefect}
+ * returns early for a waived one, so the waiver set cannot inform this
+ * sentence and is not passed.
  * @param {string} key - The `SCENARIO:platform` key.
- * @param {object} input - Retirement records, waived keys, labels, contract.
+ * @param {object} input - Retirement records.
  * @returns {string} A one-sentence next step.
  */
-function routeTaken(key, { retired, waived, labels }) {
+function routeTaken(key, { retired }) {
   const { scenario } = partsOf(key);
   const record = retired.get(scenario);
-  const authorized = labels.includes(BASELINE_LABEL);
-  if ((record || waived.has(key)) && !authorized) {
-    return `A record is present but the "${BASELINE_LABEL}" label is not: recording a reduction in the same pull request that makes it is not an authorization.`;
-  }
   if (record) {
     const missing = RETIREMENT_FIELDS.filter(field => !record[field]);
     return `Its retirements record is incomplete (no ${missing.join(", no ")}).`;
@@ -419,10 +419,10 @@ export function checkNewObligations({ baseline, contract, scenarios }) {
  * The contract's answer to a retired behavior is `@superseded`, which keeps
  * the audit trail. Deleting the scenario instead makes coverage look better
  * by describing less of the product.
- * @param {object} input - Base IDs, head scenarios, and the PR labels.
+ * @param {object} input - Base IDs and head scenarios.
  * @returns {object[]} Defects found.
  */
-export function checkDeletions({ baseIds, scenarios, contract, labels }) {
+export function checkDeletions({ baseIds, scenarios, contract }) {
   const present = new Set(scenarios.map(scenario => scenario.id));
   const retired = new Map(
     (contract.retirements ?? []).map(entry => [entry.scenario, entry])
@@ -430,22 +430,21 @@ export function checkDeletions({ baseIds, scenarios, contract, labels }) {
   return [...baseIds]
     .filter(id => !present.has(id))
     .sort(byCodeUnit)
-    .flatMap(id => deletionDefects(id, retired.get(id), labels));
+    .flatMap(id => deletionDefects(id, retired.get(id)));
 }
 
 /**
  * Defects for one deleted scenario.
  * @param {string} id - The scenario ID that disappeared.
  * @param {object|undefined} record - Its retirement record, if any.
- * @param {readonly string[]} labels - PR labels.
  * @returns {object[]} Defects found.
  */
-function deletionDefects(id, record, labels) {
+function deletionDefects(id, record) {
   if (!record) {
     return [
       defect(
         SCENARIO_DELETED,
-        `${id} was deleted from the contract. Retiring a behavior is @superseded, not deletion — deleting it shrinks the denominator instead of the gap. A genuine removal needs a retirements record and the "${BASELINE_LABEL}" label.`
+        `${id} was deleted from the contract. Retiring a behavior is @superseded, not deletion — deleting it shrinks the denominator instead of the gap. A genuine removal needs a complete retirements record (${RETIREMENT_FIELDS.join(", ")}).`
       ),
     ];
   }
@@ -453,13 +452,5 @@ function deletionDefects(id, record, labels) {
   const defects = missing.map(field =>
     defect(SCENARIO_DELETED, `${id}: retirements record has no ${field}`)
   );
-  if (!labels.includes(BASELINE_LABEL)) {
-    defects.push(
-      defect(
-        SCENARIO_DELETED,
-        `${id}: a retirement needs the maintainer-applied "${BASELINE_LABEL}" label`
-      )
-    );
-  }
   return defects;
 }

package/expo/copy-overwrite/scripts/bdd/render.mjs

@@ -208,7 +208,7 @@ ${executionSection(report)}
 
 ## Coverage floor
 
-The committed floor is an absolute bar — "is this platform below it right now" — and nothing else. It is **not** a ratchet and nobody has to nudge it upward: what protects coverage already earned is a separate, per-obligation check. Coverage accepted at the base revision cannot disappear, and behavior that is new must arrive mapped or waived; either reduction takes a recorded route (a \`retirements\` record or a \`platformWaivers\` entry) plus the maintainer-applied \`bdd-floor-baseline\` label — two artifacts one author cannot produce alone.
+The committed floor is an absolute bar — "is this platform below it right now" — and nothing else. It is **not** a ratchet and nobody has to nudge it upward: what protects coverage already earned is a separate, per-obligation check. Coverage accepted at the base revision cannot disappear, and behavior that is new must arrive mapped or waived; either reduction takes a recorded route — a complete \`retirements\` record or a \`platformWaivers\` entry — which lands in the diff where it can be read and challenged.
 
 ${floorTable(report)}
 

package/expo/copy-overwrite/scripts/check-bdd-coverage.mjs

@@ -312,14 +312,12 @@ function validateAll({
       baseline,
       contract,
       scenarios,
-      labels: options.labels,
     }),
     ...checkNewObligations({ baseline, contract, scenarios }),
     ...checkDeletions({
       baseIds: baseline.scenarioIds,
       scenarios,
       contract,
-      labels: options.labels,
     }),
   ];
 }
@@ -679,10 +677,6 @@ export function parseArgs(argv, env) {
     report: argv.includes("--report"),
     resultFiles,
     baseSha: env.BDD_BASE_SHA || null,
-    labels: (env.BDD_PR_LABELS ?? "")
-      .split(",")
-      .map(item => item.trim())
-      .filter(Boolean),
     today: env.BDD_TODAY || new Date().toISOString().slice(0, 10),
   };
 }

package/package.json

@@ -46,7 +46,7 @@
     "refresh:upstream-public-commits": "node scripts/generate-upstream-evidence-manifest.mjs --refresh-public-commits",
     "check:rules-pairing": "bash scripts/check-rules-pairing.sh",
     "check:workflow-inputs": "node scripts/detect-stale-workflow-inputs.mjs --project . --project typescript/create-only --project rails/create-only --json",
-    "check:conflict-markers": "node scripts/check-conflict-markers.mjs",
+    "check:conflict-markers": "node all/copy-overwrite/scripts/check-conflict-markers.mjs",
     "check:template-workflow-refs": "node scripts/check-template-workflow-refs.mjs",
     "check:delivery-deletion-conflicts": "node scripts/check-delivery-deletion-conflicts.mjs",
     "check:duplicate-versions": "node scripts/check-duplicate-versions.mjs",
@@ -141,7 +141,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "3.56.0",
+  "version": "3.59.0",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.56.0",
+  "version": "3.59.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.56.0",
+  "version": "3.59.0",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-setup-sonar/SKILL.md

@@ -12,7 +12,7 @@ unattended factories run. It replaces Lisa's former hand-rolled SonarCloud REST
 access with the vendor's official token-authed MCP, which is Lisa's single Sonar
 substrate on both developer machines and headless cloud routines.
 
-This does **not** touch the CI SonarCloud SAST job in `quality.yml` or its
+This does **not** touch the CI static-security job in `quality.yml` or its
 `SONAR_TOKEN` secret — that enforcement gate is separate and stays as-is.
 
 ## Supported agents

package/plugins/lisa/rules/reference/bdd-e2e-coverage.md

@@ -145,9 +145,9 @@ forces it upward, and lowering it needs no ceremony.
 
 What stops coverage sliding backwards is checked directly, per obligation, against the base
 revision — **an obligation that was mapped may not stop being mapped, and new behavior arrives
-mapped or waived**. Giving coverage back is legitimate but takes two artifacts one author cannot
-produce alone: a recorded route (a `retirements` record or a `platformWaivers` entry) plus the
-maintainer-applied `bdd-floor-baseline` label. Gaps that predate the change are burndown, never a
+mapped or waived**. Giving coverage back is legitimate but takes a recorded route: a complete `retirements`
+record (for a behavior the product no longer has) or a `platformWaivers` entry (for a runner
+that cannot decide it). Gaps that predate the change are burndown, never a
 gate failure — which is what lets a brownfield project adopt `enforced` without first backfilling
 its whole history.
 

package/plugins/lisa/skills/lisa-setup-sonar/SKILL.md

@@ -12,7 +12,7 @@ unattended factories run. It replaces Lisa's former hand-rolled SonarCloud REST
 access with the vendor's official token-authed MCP, which is Lisa's single Sonar
 substrate on both developer machines and headless cloud routines.
 
-This does **not** touch the CI SonarCloud SAST job in `quality.yml` or its
+This does **not** touch the CI static-security job in `quality.yml` or its
 `SONAR_TOKEN` secret — that enforcement gate is separate and stays as-is.
 
 ## Supported agents

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.56.0",
+  "version": "3.59.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-setup-sonar/SKILL.md

@@ -12,7 +12,7 @@ unattended factories run. It replaces Lisa's former hand-rolled SonarCloud REST
 access with the vendor's official token-authed MCP, which is Lisa's single Sonar
 substrate on both developer machines and headless cloud routines.
 
-This does **not** touch the CI SonarCloud SAST job in `quality.yml` or its
+This does **not** touch the CI static-security job in `quality.yml` or its
 `SONAR_TOKEN` secret — that enforcement gate is separate and stays as-is.
 
 ## Supported agents

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.56.0",
+  "version": "3.59.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.56.0",
+  "version": "3.59.0",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.56.0",
+  "version": "3.59.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.56.0",
+  "version": "3.59.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.56.0",
+  "version": "3.59.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.56.0",
+  "version": "3.59.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/rules/reference/bdd-e2e-coverage.md

@@ -145,9 +145,9 @@ forces it upward, and lowering it needs no ceremony.
 
 What stops coverage sliding backwards is checked directly, per obligation, against the base
 revision — **an obligation that was mapped may not stop being mapped, and new behavior arrives
-mapped or waived**. Giving coverage back is legitimate but takes two artifacts one author cannot
-produce alone: a recorded route (a `retirements` record or a `platformWaivers` entry) plus the
-maintainer-applied `bdd-floor-baseline` label. Gaps that predate the change are burndown, never a
+mapped or waived**. Giving coverage back is legitimate but takes a recorded route: a complete `retirements`
+record (for a behavior the product no longer has) or a `platformWaivers` entry (for a runner
+that cannot decide it). Gaps that predate the change are burndown, never a
 gate failure — which is what lets a brownfield project adopt `enforced` without first backfilling
 its whole history.
 

package/plugins/lisa-copilot/skills/lisa-setup-sonar/SKILL.md

@@ -12,7 +12,7 @@ unattended factories run. It replaces Lisa's former hand-rolled SonarCloud REST
 access with the vendor's official token-authed MCP, which is Lisa's single Sonar
 substrate on both developer machines and headless cloud routines.
 
-This does **not** touch the CI SonarCloud SAST job in `quality.yml` or its
+This does **not** touch the CI static-security job in `quality.yml` or its
 `SONAR_TOKEN` secret — that enforcement gate is separate and stays as-is.
 
 ## Supported agents