@codyswann/lisa 4.22.0 → 4.22.2

package/plugins/lisa/skills/lisa-secrets-access/SKILL.md

@@ -281,7 +281,7 @@ Values never enter that process, so its output cannot leak one even if logged.
 
 | Provider | Read | Write (rotation only) |
 | --- | --- | --- |
-| `bitwarden` | `bws secret list --output json` → index by `key` | `bws secret edit` |
+| `bitwarden` | `bws secret list --output json` → index by `key` | `bws secret edit`; temporary `create`/`delete` for AWS publication coordination |
 | `doppler` | `doppler secrets download --no-file --format json` | not implemented |
 | `env` | environment only; the provider is the environment | n/a |
 | `1password` | `op read "op://<vault>/<name>/credential"` | not implemented |
@@ -297,6 +297,31 @@ secret you would otherwise store inside it.
 
 Unimplemented providers fail with a message naming where to add them, rather than failing obscurely. Do not claim support that does not exist.
 
+### AWS bootstrap publication coordination
+
+`publish-aws-bootstrap.mjs publish` and `preflight` serialize mutations of
+`LISA_AWS_BOOTSTRAP_JSON` in the provider. Each contender creates a unique,
+non-secret coordination record in the target record's Bitwarden project. The
+oldest active contender wins by provider-issued `creationDate`, with the
+provider id as a deterministic tie-breaker. Later contenders remove themselves
+and stop before the bundle is written.
+
+The winner re-reads the target after acquisition, then holds the coordination
+record across the no-op write check, candidate verification, replacement,
+read-back, post-write verification, and any rollback. Cleanup deletes the
+coordination record and proves it no longer appears in the provider. Records
+older than 30 minutes are expired and removed on the next attempt, covering a
+killed host without permitting a permanent lock.
+
+Coordination keys start with `LISA_COORDINATION_` and are excluded before
+normal secret selection, so they can never resolve or materialize as
+credentials. Their value is a fixed public sentinel; no credential is copied
+into them. This publication lock is separate from the advisory rotation lease
+record used by `rotate-secret.mjs`.
+
+Ordinary session refresh only reads and materializes existing provider values.
+It neither creates coordination records nor writes the AWS bundle.
+
 Cache **in-process only**. Never write a resolved value to disk except through the materialization contract above.
 
 ## Doctor checks worth wiring

package/plugins/lisa/skills/lisa-secrets-access/scripts/providers.mjs

@@ -33,6 +33,17 @@ export const ENV_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
  */
 export const LEASE_KEY = "LISA_ROTATION_LEASES";
 
+/**
+ * Prefix reserved for provider-side coordination records.
+ *
+ * These records contain no credential material. They exist only long enough
+ * to serialize a provider mutation and must never cross the exposure boundary
+ * into a shell, file, hook, or CI environment.
+ */
+export const COORDINATION_KEY_PREFIX = "LISA_COORDINATION_";
+
+const COORDINATION_VALUE = "coordination-only";
+
 /**
  * The environment variable each provider's CLI reads its own bootstrap from.
  *
@@ -177,7 +188,7 @@ function fromKeychain(key) {
  * caller may see, so the set it returns *is* the permitted set. Restating that
  * as a list in config would duplicate a boundary the provider already enforces.
  * @param {object} cfg Resolved configuration.
- * @returns {Array<{key: string, value: string, note: string, projectId: string|null}>} Rows.
+ * @returns {Array<{key: string, value: string, note: string, projectId: string|null, id?: string|null, creationDate?: string|null, revisionDate?: string|null}>} Rows.
  */
 export function fetchRaw(cfg) {
   const env = providerEnv(cfg);
@@ -201,6 +212,8 @@ export function fetchRaw(cfg) {
       note: s.note ?? "",
       projectId: s.projectId ?? null,
       id: s.id ?? null,
+      creationDate: s.creationDate ?? null,
+      revisionDate: s.revisionDate ?? null,
     }));
   }
 
@@ -248,7 +261,7 @@ function run(bin, args, env) {
  * which is neither stable nor visible at the call site.
  * @param {Array<object>} rows Raw provider rows.
  * @param {{projectIds: string[], excludeKeys: string[]}} narrow Narrowing controls.
- * @returns {Map<string, {value: string, note: string, id: string|null}>} Selected secrets by name.
+ * @returns {Map<string, {value: string, note: string, id: string|null, projectId: string|null, creationDate: string|null, revisionDate: string|null}>} Selected secrets by name.
  */
 export function normalizeRows(
   rows,
@@ -260,6 +273,12 @@ export function normalizeRows(
 
   for (const row of rows) {
     if (projects.size && !projects.has(row.projectId)) continue;
+    if (
+      typeof row.key === "string" &&
+      row.key.startsWith(COORDINATION_KEY_PREFIX)
+    ) {
+      continue;
+    }
     if (typeof row.key !== "string" || !ENV_KEY.test(row.key)) continue;
     if (excluded.has(row.key)) continue;
     if (out.has(row.key)) {
@@ -276,6 +295,9 @@ export function normalizeRows(
       value: row.value,
       note: row.note ?? "",
       id: row.id ?? null,
+      projectId: row.projectId ?? null,
+      creationDate: row.creationDate ?? null,
+      revisionDate: row.revisionDate ?? null,
     });
   }
   return out;
@@ -370,3 +392,69 @@ export function writeSecret(cfg, id, value) {
       `Rotation requires a proven write path; add one in providers.mjs.`
   );
 }
+
+/**
+ * Create one provider-issued publication contender in the target project.
+ *
+ * The deliberately constrained interface accepts no value: coordination
+ * records always contain the same public sentinel, which prevents this helper
+ * from becoming an alternate credential-write path.
+ * @param {object} cfg Resolved configuration.
+ * @param {string} key Unique coordination key.
+ * @param {string} projectId Project containing the target provider record.
+ * @param {string} note Non-sensitive lifecycle metadata.
+ * @returns {object} The provider-issued coordination row.
+ */
+export function createCoordinationRecord(cfg, key, projectId, note) {
+  const env = providerEnv(cfg);
+
+  if (cfg.provider === "bitwarden") {
+    const raw = run(
+      "bws",
+      [
+        "secret",
+        "create",
+        key,
+        COORDINATION_VALUE,
+        projectId,
+        "--note",
+        note,
+        "--output",
+        "json",
+      ],
+      env
+    );
+    const created = JSON.parse(raw);
+    return {
+      key: created.key,
+      value: created.value,
+      note: created.note ?? "",
+      projectId: created.projectId ?? null,
+      id: created.id ?? null,
+      creationDate: created.creationDate ?? null,
+      revisionDate: created.revisionDate ?? null,
+    };
+  }
+  throw new Error(
+    `provider "${cfg.provider}" has no coordination-record creation implemented.\n` +
+      `AWS bootstrap publication requires a provider-backed single-writer lock.`
+  );
+}
+
+/**
+ * Remove one provider-side coordination record by its provider identifier.
+ * @param {object} cfg Resolved configuration.
+ * @param {string} id Provider-side identifier for the coordination record.
+ */
+export function removeCoordinationRecord(cfg, id) {
+  const env = providerEnv(cfg);
+
+  if (cfg.provider === "bitwarden") {
+    run("bws", ["secret", "delete", id, "--output", "none"], env);
+    return;
+  }
+  throw new Error(
+    `provider "${cfg.provider}" has no coordination-record deletion implemented.\n` +
+      `AWS bootstrap publication requires verified lock cleanup.`
+  );
+}

package/plugins/lisa/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs

@@ -11,11 +11,13 @@
  *
  * This command makes that handoff one fail-closed operation:
  *
- * 1. prove the existing provider record is writable with a no-op write;
- * 2. validate the candidate and assume every declared role with it;
- * 3. replace the provider value;
- * 4. read the value back exactly and assume every role again; and
- * 5. restore the previous provider value if a post-write check fails.
+ * 1. acquire a provider-backed lock for the exact bundle record;
+ * 2. re-read and prove the record is writable with a no-op write;
+ * 3. validate the candidate and assume every declared role with it;
+ * 4. replace the provider value;
+ * 5. read the value back exactly and assume every role again;
+ * 6. restore the previous value if a post-write check fails; and
+ * 7. release the lock only after publication or rollback is complete.
  *
  * The candidate arrives on stdin so it never appears in a shell command or a
  * temporary file. No credential value is written to stdout or stderr.
@@ -28,6 +30,7 @@
  * @module publish-aws-bootstrap
  */
 
+import { randomUUID } from "node:crypto";
 import { readFileSync, realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 
@@ -36,7 +39,14 @@ import {
   parseBootstrap,
   readProfiles,
 } from "./aws-bootstrap.mjs";
-import { fetchAll, writeSecret } from "./providers.mjs";
+import {
+  COORDINATION_KEY_PREFIX,
+  createCoordinationRecord,
+  fetchAll,
+  fetchRaw as providerFetchRaw,
+  removeCoordinationRecord,
+  writeSecret,
+} from "./providers.mjs";
 import { readConfig } from "./surfaces.mjs";
 
 import { boundedChildOutput } from "../../lisa-setup-workstation/scripts/bounded-child.mjs";
@@ -44,6 +54,8 @@ import { boundedChildOutput } from "../../lisa-setup-workstation/scripts/bounded
 const PROFILE_NAME = /^[\w.@-]+$/;
 const ROLE_ARN =
   /^arn:(?:aws|aws-us-gov|aws-cn):iam::\d{12}:role\/[\w+=,.@/-]+$/;
+const PUBLICATION_COORDINATION_SCOPE = "AWS_BOOTSTRAP_";
+const PUBLICATION_LOCK_TTL_MS = 30 * 60 * 1000;
 
 /**
  * Validate and normalize one complete bundle without changing its serialized
@@ -188,7 +200,7 @@ export function verifyAwsBootstrap(candidate, run = boundedChildOutput) {
  * Locate the provider record that owns the bundle.
  * @param {object} cfg Resolved lisa-secrets-access configuration.
  * @param {(cfg: object) => Map<string, object>} fetch Provider reader.
- * @returns {{id: string, value: string}} Writable provider entry.
+ * @returns {{id: string, value: string, projectId: string|null}} Writable provider entry.
  */
 function currentEntry(cfg, fetch) {
   const entry = fetch(cfg).get(BOOTSTRAP_KEY);
@@ -202,32 +214,272 @@ function currentEntry(cfg, fetch) {
       `${BOOTSTRAP_KEY} has no provider identifier, so it cannot be published`
     );
   }
-  return { id: entry.id, value: entry.value };
+  return {
+    id: entry.id,
+    value: entry.value,
+    projectId: entry.projectId ?? null,
+  };
+}
+
+function firstLine(error) {
+  return (error instanceof Error ? error.message : String(error)).split(
+    "\n"
+  )[0];
+}
+
+function lockPrefix(targetId) {
+  return `${COORDINATION_KEY_PREFIX}${PUBLICATION_COORDINATION_SCOPE}${targetId}_`;
+}
+
+function deleteCoordination(cfg, row, fetchRaw, remove) {
+  remove(cfg, row.id);
+  if (fetchRaw(cfg).some(candidate => candidate.id === row.id)) {
+    throw new Error(
+      `publication lock ${row.id} is still present after deletion`
+    );
+  }
+}
+
+function writeProviderValue(cfg, id, value, write) {
+  try {
+    write(cfg, id, value);
+  } catch (error) {
+    const status =
+      typeof error === "object" &&
+      error !== null &&
+      Number.isInteger(error.status)
+        ? ` (exit ${error.status})`
+        : "";
+    // `bws secret edit` has no stdin form, so the value is present in argv and
+    // therefore in Node's child-process error message. Never propagate that
+    // message: doing so would print the credential this command protects.
+    throw new Error(`provider write command failed${status}`);
+  }
 }
 
 /**
- * Exercise the exact provider write permission without changing its value.
+ * Enter the provider election for one AWS bootstrap record.
+ *
+ * Every publisher creates a unique contender. The provider's creation time,
+ * with its immutable id as a tie-breaker, elects exactly one oldest active
+ * contender. Unlike a read-then-create mutex, no participant can overwrite or
+ * mistake another participant's record for its own.
  * @param {object} cfg Resolved configuration.
+ * @param {{id: string, projectId: string|null}} target Target provider entry.
  * @param {object} [operations] Injectable provider operations for tests.
- * @returns {{id: string, value: string}} Current provider entry.
+ * @returns {object} The winning coordination row.
  */
-export function preflightAwsBootstrap(cfg, operations = {}) {
+export function acquirePublicationLock(cfg, target, operations = {}) {
+  if (!target.projectId) {
+    throw new Error(
+      `${BOOTSTRAP_KEY} has no provider project identifier, so publication cannot be serialized`
+    );
+  }
+
+  const create = operations.createCoordination ?? createCoordinationRecord;
+  const fetchRaw = operations.fetchRaw ?? providerFetchRaw;
+  const remove = operations.removeCoordination ?? removeCoordinationRecord;
+  const holderId = (operations.holderId ?? randomUUID)();
+  const prefix = lockPrefix(target.id);
+  const key = `${prefix}${holderId}`;
+  let contender;
+
+  try {
+    contender = create(
+      cfg,
+      key,
+      target.projectId,
+      "Lisa AWS bootstrap publication contender; expires after 30 minutes"
+    );
+  } catch (error) {
+    throw new Error(`publication lock creation failed: ${firstLine(error)}`);
+  }
+
+  if (!contender?.id || contender.key !== key) {
+    if (contender?.id) {
+      try {
+        deleteCoordination(cfg, contender, fetchRaw, remove);
+      } catch {
+        // The validation failure below remains the actionable root cause.
+      }
+    }
+    throw new Error("provider returned an invalid publication lock contender");
+  }
+
+  let rows;
+  try {
+    rows = fetchRaw(cfg).filter(
+      row =>
+        row.projectId === target.projectId &&
+        typeof row.key === "string" &&
+        row.key.startsWith(prefix)
+    );
+  } catch (error) {
+    try {
+      deleteCoordination(cfg, contender, fetchRaw, remove);
+    } catch (cleanupError) {
+      throw new Error(
+        `publication lock read failed: ${firstLine(error)}; contender cleanup failed: ${firstLine(cleanupError)}`
+      );
+    }
+    throw new Error(`publication lock read failed: ${firstLine(error)}`);
+  }
+
+  const visible = rows.find(row => row.id === contender.id);
+  if (!visible) {
+    try {
+      deleteCoordination(cfg, contender, fetchRaw, remove);
+    } catch (cleanupError) {
+      throw new Error(
+        `the publication lock contender could not be observed after creation; contender cleanup failed: ${firstLine(cleanupError)}`
+      );
+    }
+    throw new Error(
+      "the publication lock contender could not be observed after creation"
+    );
+  }
+
+  const providerNow = Date.parse(visible.creationDate ?? "");
+  if (!Number.isFinite(providerNow)) {
+    try {
+      deleteCoordination(cfg, contender, fetchRaw, remove);
+    } catch (cleanupError) {
+      throw new Error(
+        `the publication lock contender has no valid provider creation time; contender cleanup failed: ${firstLine(cleanupError)}`
+      );
+    }
+    throw new Error(
+      "the publication lock contender has no valid provider creation time"
+    );
+  }
+
+  const active = [];
+  for (const row of rows) {
+    const createdAt = Date.parse(row.creationDate ?? "");
+    if (!Number.isFinite(createdAt)) {
+      try {
+        deleteCoordination(cfg, contender, fetchRaw, remove);
+      } catch (cleanupError) {
+        throw new Error(
+          `publication lock ${row.id ?? "without an id"} has no valid provider creation time; contender cleanup failed: ${firstLine(cleanupError)}`
+        );
+      }
+      throw new Error(
+        `publication lock ${row.id ?? "without an id"} has no valid provider creation time`
+      );
+    }
+    // Compare provider time with provider time. A remote host whose wall clock
+    // is skewed must not be able to expire another host's active publication.
+    if (createdAt <= providerNow - PUBLICATION_LOCK_TTL_MS) {
+      try {
+        deleteCoordination(cfg, row, fetchRaw, remove);
+      } catch (error) {
+        throw new Error(
+          `expired publication lock cleanup failed: ${firstLine(error)}`
+        );
+      }
+      continue;
+    }
+    active.push({ row, createdAt });
+  }
+
+  active.sort(
+    (left, right) =>
+      left.createdAt - right.createdAt ||
+      String(left.row.id).localeCompare(String(right.row.id))
+  );
+  if (active[0]?.row.id !== contender.id) {
+    try {
+      deleteCoordination(cfg, contender, fetchRaw, remove);
+    } catch (error) {
+      throw new Error(
+        `another publisher holds the provider lock; contender cleanup failed: ${firstLine(error)}`
+      );
+    }
+    throw new Error("another publisher holds the provider lock");
+  }
+
+  return { ...visible, targetId: target.id };
+}
+
+/**
+ * Delete a publication contender and prove the provider no longer lists it.
+ * @param {object} cfg Resolved configuration.
+ * @param {{id: string}} lock Acquired coordination row.
+ * @param {object} [operations] Injectable provider operations for tests.
+ */
+export function releasePublicationLock(cfg, lock, operations = {}) {
+  const fetchRaw = operations.fetchRaw ?? providerFetchRaw;
+  const remove = operations.removeCoordination ?? removeCoordinationRecord;
+  deleteCoordination(cfg, lock, fetchRaw, remove);
+}
+
+/**
+ * Hold the provider lock around an entire publication or preflight operation.
+ * The target is deliberately refreshed after acquisition so a pre-lock
+ * snapshot can never overwrite a publication that finished while this process
+ * was entering the election.
+ */
+function withPublicationLock(cfg, operations, task) {
   const fetch = operations.fetch ?? fetchAll;
-  const write = operations.write ?? writeSecret;
-  const entry = currentEntry(cfg, fetch);
+  const acquire = operations.acquireLock ?? acquirePublicationLock;
+  const release = operations.releaseLock ?? releasePublicationLock;
+  const target = currentEntry(cfg, fetch);
+  const lock = acquire(cfg, target, operations);
+  let result;
+  let taskError;
+
   try {
-    write(cfg, entry.id, entry.value);
+    const current = currentEntry(cfg, fetch);
+    if (current.id !== target.id || current.projectId !== target.projectId) {
+      throw new Error(
+        `${BOOTSTRAP_KEY} moved after publication lock acquisition; retry from the new provider record`
+      );
+    }
+    result = task(current);
+  } catch (error) {
+    taskError = error;
+  }
+
+  try {
+    release(cfg, lock, operations);
+  } catch (releaseError) {
+    const releaseReason = `publication lock release failed: ${firstLine(releaseError)}`;
+    if (taskError) {
+      throw new Error(`${firstLine(taskError)}; ${releaseReason}`);
+    }
+    throw new Error(releaseReason);
+  }
+
+  if (taskError) throw taskError;
+  return result;
+}
+
+function preflightUnderLock(cfg, entry, write) {
+  try {
+    writeProviderValue(cfg, entry.id, entry.value, write);
   } catch (error) {
-    const reason =
-      error instanceof Error ? error.message.split("\n")[0] : String(error);
     throw new Error(
-      `no write access to ${BOOTSTRAP_KEY}: ${reason}\n` +
+      `no write access to ${BOOTSTRAP_KEY}: ${firstLine(error)}\n` +
         `Refusing to continue because a rotated key that cannot be published would strand every remote session.`
     );
   }
   return entry;
 }
 
+/**
+ * Exercise the exact provider write permission without changing its value.
+ * @param {object} cfg Resolved configuration.
+ * @param {object} [operations] Injectable provider operations for tests.
+ * @returns {{id: string, value: string}} Current provider entry.
+ */
+export function preflightAwsBootstrap(cfg, operations = {}) {
+  const write = operations.write ?? writeSecret;
+  return withPublicationLock(cfg, operations, entry =>
+    preflightUnderLock(cfg, entry, write)
+  );
+}
+
 /**
  * Restore the previous provider value and prove the restoration.
  * @param {object} cfg Resolved configuration.
@@ -243,7 +495,7 @@ function rollback(cfg, previous, candidateRaw, fetch, write) {
     if (current.value !== candidateRaw) {
       return "rollback skipped because the provider changed after this publication";
     }
-    write(cfg, previous.id, previous.value);
+    writeProviderValue(cfg, previous.id, previous.value, write);
     const restored = currentEntry(cfg, fetch);
     if (restored.value !== previous.value) {
       return "the previous provider value could not be verified after rollback";
@@ -268,46 +520,48 @@ export function publishAwsBootstrap(raw, cfg, operations = {}) {
   const fetch = operations.fetch ?? fetchAll;
   const write = operations.write ?? writeSecret;
   const verify = operations.verify ?? verifyAwsBootstrap;
-  const previous = preflightAwsBootstrap(cfg, { fetch, write });
   const candidate = validateAwsBootstrap(raw);
+  return withPublicationLock(cfg, operations, previous => {
+    preflightUnderLock(cfg, previous, write);
 
-  // Verify before the write. A candidate that cannot assume one of its roles
-  // never becomes the value every new remote session receives.
-  verify(candidate);
+    // Verify before the write. A candidate that cannot assume one of its roles
+    // never becomes the value every new remote session receives.
+    verify(candidate);
 
-  if (candidate.raw === previous.value) {
-    return {
-      changed: false,
-      profiles: candidate.profiles.map(profile => profile.name),
-    };
-  }
+    if (candidate.raw === previous.value) {
+      return {
+        changed: false,
+        profiles: candidate.profiles.map(profile => profile.name),
+      };
+    }
 
-  try {
-    write(cfg, previous.id, candidate.raw);
-    const stored = currentEntry(cfg, fetch);
-    if (stored.value !== candidate.raw) {
-      throw new Error("provider read-back did not match the candidate exactly");
+    try {
+      writeProviderValue(cfg, previous.id, candidate.raw, write);
+      const stored = currentEntry(cfg, fetch);
+      if (stored.value !== candidate.raw) {
+        throw new Error(
+          "provider read-back did not match the candidate exactly"
+        );
+      }
+      const storedCandidate = validateAwsBootstrap(stored.value);
+      verify(storedCandidate);
+      return {
+        changed: true,
+        profiles: storedCandidate.profiles.map(profile => profile.name),
+      };
+    } catch (error) {
+      const rollbackOutcome = rollback(
+        cfg,
+        previous,
+        candidate.raw,
+        fetch,
+        write
+      );
+      throw new Error(
+        `${BOOTSTRAP_KEY} publication failed: ${firstLine(error)}; ${rollbackOutcome}`
+      );
     }
-    const storedCandidate = validateAwsBootstrap(stored.value);
-    verify(storedCandidate);
-    return {
-      changed: true,
-      profiles: storedCandidate.profiles.map(profile => profile.name),
-    };
-  } catch (error) {
-    const reason =
-      error instanceof Error ? error.message.split("\n")[0] : String(error);
-    const rollbackOutcome = rollback(
-      cfg,
-      previous,
-      candidate.raw,
-      fetch,
-      write
-    );
-    throw new Error(
-      `${BOOTSTRAP_KEY} publication failed: ${reason}; ${rollbackOutcome}`
-    );
-  }
+  });
 }
 
 /** Read a candidate from stdin without ever placing it in argv. */

package/plugins/lisa/skills/lisa-setup-remote-aws/SKILL.md

@@ -56,9 +56,12 @@ which is current. Treat the infrastructure secret as a short-lived deployment
 emission and the configured provider as the consumer-facing source of truth.
 
 Publish the emission as part of the same rotation automation. The publisher
-reads the candidate on stdin, proves every role before writing, reads the
-provider value back exactly, proves every stored role again, and restores the
-previous provider value if a post-write check fails:
+reads the candidate on stdin, acquires a provider-backed lock for the exact
+bundle record, re-reads the current value after winning, proves every role
+before writing, reads the provider value back exactly, proves every stored role
+again, and restores the previous provider value if a post-write check fails.
+The lock remains held through rollback and its deletion is verified before the
+command reports success:
 
 ```bash
 aws --profile shared secretsmanager get-secret-value \
@@ -73,10 +76,24 @@ Resolve the script from the installed runtime or `node_modules` when the
 argument or temporary file. A CDK deployment followed later by a human copy is
 not a completed rotation.
 
+The current publisher supports Bitwarden writes. It creates a temporary,
+non-secret contender in the bundle's Bitwarden project, elects the oldest
+active contender using provider-issued creation metadata, and removes the
+contender when the transaction finishes. A contender expires after 30 minutes
+so a killed publisher cannot block future rotations forever. The service
+account therefore needs create and delete access as well as read and edit
+access; `preflight` proves that complete lifecycle without changing the bundle.
+
+Normal remote-session setup is read-only. It refreshes the already-published
+bundle but does not enter the publisher election or mutate Bitwarden, so two
+containers starting together cannot cause this publication race.
+
 **One provider cannot serve this particular secret.** If `secrets.provider` is
 `aws`, reading the bundle requires AWS credentials — and the bundle *is* the AWS
 credential. Anything else works: Bitwarden, 1Password, Doppler, Vault, or a
 platform secret store. Pick the one that is not the thing being bootstrapped.
+Automated publication additionally requires a provider with an implemented
+write and coordination path; that is currently Bitwarden.
 
 On a surface that materializes (see `lisa-secrets-access`), the bundle arrives
 in `secrets.env` with everything else, so the project hook can run this setup

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.22.0",
+  "version": "4.22.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"