@codyswann/lisa 4.22.12 → 4.22.13

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.22.12",
+  "version": "4.22.13",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.22.12",
+  "version": "4.22.13",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.22.12",
+  "version": "4.22.13",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.22.12",
+  "version": "4.22.13",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.22.12",
+  "version": "4.22.13",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.22.12",
+  "version": "4.22.13",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.22.12",
+  "version": "4.22.13",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.22.12",
+  "version": "4.22.13",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.22.12",
+  "version": "4.22.13",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.22.12",
+  "version": "4.22.13",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.22.12",
+  "version": "4.22.13",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.22.12",
+  "version": "4.22.13",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.22.12",
+  "version": "4.22.13",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.22.12",
+  "version": "4.22.13",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.22.12",
+  "version": "4.22.13",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/hooks/block-no-verify.sh

@@ -23,7 +23,7 @@
 # Add a name here in the same commit that closes a vector. A hardening that
 # forgets to is invisible to refresh, and shows up as an unexplained diff at
 # review time instead of a named capability.
-# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, git-config-key, git-config-parameters, git-config-parameters-append, git-config-parameters-expansion, heredoc-shell-word, herestring-aware, no-verify-short
+# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, git-config-key, git-config-parameters, git-config-parameters-append, git-config-parameters-expansion, heredoc-shell-word, herestring-aware, no-verify-short, nested-shell-no-verify
 #
 # Shell-token matching avoids false positives from issue bodies, heredocs, and
 # commit-message prose while still catching quoted real argv values such as
@@ -216,6 +216,9 @@ COMMAND_SEPARATORS = {
     ";", "|", "||", "&", "&&", "(", ")", "<", ">", ">>", "<<", "&|",
 }
 
+SHELL_PROGRAMS = {"bash", "dash", "ksh", "sh", "zsh"}
+MAX_SHELL_NESTING = 8
+
 # git's own options that take a SEPARATE value token, which therefore must be
 # skipped when looking for the subcommand: `git -c core.hooksPath=x commit` and
 # `git -C /repo commit` both reach `commit`.
@@ -333,6 +336,8 @@ def commit_bypasses_verification(argv):
         if token.startswith("--"):
             if token in COMMIT_LONG_SEPARATE_VALUE:
                 index += 1
+            elif disables_verification(token):
+                return True
             continue
         # A bare `-` is git's stdin placeholder, not an option cluster.
         if not token.startswith("-") or token == "-":
@@ -366,11 +371,25 @@ def subcommand_after_git(tokens, start):
     return None
 
 
-def git_commit_skips_verification(text):
+def shell_starts_command(tokens, index):
+    """Whether a recognized shell token occupies command position."""
+    start = index - 1
+    while start >= 0 and tokens[start] not in COMMAND_SEPARATORS:
+        start -= 1
+    prefix = tokens[start + 1:index]
+    if not prefix:
+        return True
+    if prefix[0] == "env":
+        prefix = prefix[1:]
+    return all("=" in token and not token.startswith("=") for token in prefix)
+
+
+def git_commit_skips_verification(text, depth=0):
     """Whether the command runs `git commit` with the short `-n` bypass.
 
     Args:
         text: The command line, heredoc payloads already stripped.
+        depth: Number of recognized shell payloads already traversed.
 
     Returns:
         True if any `git commit` invocation on the line skips verification.
@@ -387,6 +406,28 @@ def git_commit_skips_verification(text):
         found = subcommand_after_git(scoped_tokens, index + 1)
         if found and found[0] == "commit" and commit_bypasses_verification(found[1]):
             return True
+    if depth >= MAX_SHELL_NESTING:
+        return False
+    for index, token in enumerate(scoped_tokens):
+        program = token.rsplit("/", 1)[-1]
+        if program not in SHELL_PROGRAMS or not shell_starts_command(
+            scoped_tokens, index
+        ):
+            continue
+        cursor = index + 1
+        while cursor < len(scoped_tokens):
+            option = scoped_tokens[cursor]
+            if option in COMMAND_SEPARATORS or not option.startswith("-"):
+                break
+            cursor += 1
+            if "c" not in option[1:]:
+                continue
+            if cursor >= len(scoped_tokens):
+                break
+            payload = scoped_tokens[cursor]
+            if git_commit_skips_verification(payload, depth + 1):
+                return True
+            break
     return False
 
 

package/plugins/src/base/hooks/parity-safety-net.sh

@@ -724,6 +724,10 @@ classify_rm_target() {
       set +f
       block "recursive forced delete of the current directory (rm -rf .)"
       ;;
+    .git | .git/* | */.git | */.git/*)
+      set +f
+      block "recursive forced delete of the git control plane (.git holds every commit, branch and stash not already pushed; nothing in the working tree can rebuild it)"
+      ;;
     .. | ../* | */.. | */../*)
       set +f
       block "recursive forced delete of a path outside the project (.. traversal)"
@@ -1031,11 +1035,16 @@ fi
 # purpose, and blocking those would be the collision that gets a guard switched
 # off. The trailing `([/[:space:]'"$qc"']|$)` is what draws that line.
 readonly GIT_CONTROL_PLANE='(^|[[:space:]='"$qc"'./])\.git([/[:space:]'"$qc"']|$)'
-if matches_cs "$RM_RF_CLUSTER" || matches_cs "$RM_RF_SPLIT"; then
-  if matches_cs "$GIT_CONTROL_PLANE"; then
+while IFS= read -r git_stmt; do
+  [ -n "$git_stmt" ] || continue
+  if ! scan -E "$git_stmt" "$RM_RF_CLUSTER" \
+    && ! scan -E "$git_stmt" "$RM_RF_SPLIT"; then
+    continue
+  fi
+  if scan -E "$git_stmt" "$GIT_CONTROL_PLANE"; then
     block "recursive forced delete of the git control plane (.git holds every commit, branch and stash not already pushed; nothing in the working tree can rebuild it). Delete a specific ignored artifact instead, or re-clone if the checkout is genuinely to be discarded."
   fi
-fi
+done <<< "$(printf '%s' "$normalized_command_str" | tr '&|;' '\n')"
 
 # 15. Credential stores. Reading one into an agent transcript is disclosure even
 # when nothing is copied anywhere: the value lands in a log, a context window,
@@ -1077,14 +1086,19 @@ has_private_dotenv_path() {
     | grep -Eio -- '(^|[[:space:]='"$qc"'./])\.env(\.[[:alnum:]_-]+)?')" \
     || dotenv_scan_status=$?
   if [ "$dotenv_scan_status" -gt 1 ]; then
-    block "dotenv path classification failed; denying the credential-store read fail-closed."
+    scan_failed "$dotenv_scan_status"
   fi
 
   while IFS= read -r candidate; do
     [ -n "$candidate" ] || continue
+    dotenv_normalize_status=0
     candidate="$(printf '%s' "$candidate" \
       | tr '[:upper:]' '[:lower:]' \
-      | grep -Eo -- '\.env(\.[[:alnum:]_-]+)?')"
+      | grep -Eo -- '\.env(\.[[:alnum:]_-]+)?')" \
+      || dotenv_normalize_status=$?
+    if [ "$dotenv_normalize_status" -gt 1 ] || [ -z "$candidate" ]; then
+      scan_failed "$dotenv_normalize_status"
+    fi
     case "$candidate" in
       .env.example | .env.sample | .env.template | .env.dist | .env.schema | .env.defaults) ;;
       *) return 0 ;;

package/plugins/src/base/hooks/threshold-ratchet-families.mjs

@@ -79,7 +79,7 @@ export const FAMILIES = [
   },
   {
     id: "lighthouse",
-    match: /(^|\/)lighthouserc-config\.json$/,
+    match: /(^|\/)(?:lighthouserc-config|lighthouserc|\.lighthouserc)\.json$/,
     kind: "lighthouse",
   },
 ];
@@ -98,6 +98,8 @@ export const LIGHTHOUSE_ASSERTION_DIRECTIONS = Object.freeze({
   maxLength: "max",
 });
 
+const LIGHTHOUSE_LEVELS = Object.freeze({ off: 0, warn: 1, error: 2 });
+
 /**
  * Extract numeric Lighthouse assertions with a direction chosen per key.
  *
@@ -133,6 +135,13 @@ export function extractLighthouseAssertions(conf) {
     return out;
   }
   for (const [audit, spec] of Object.entries(assertions)) {
+    const level = Array.isArray(spec) ? spec[0] : spec;
+    if (typeof level === "string" && Object.hasOwn(LIGHTHOUSE_LEVELS, level)) {
+      out.set(`${audit}.$level`, {
+        value: LIGHTHOUSE_LEVELS[level],
+        direction: "min",
+      });
+    }
     const options =
       Array.isArray(spec) &&
       spec.length >= 2 &&

package/plugins/src/base/rules/reference/config-resolution.md

@@ -909,10 +909,6 @@ read_notion_token() {
   if [ -n "${PLUGIN_ROOT:-}" ]; then
     candidates+=("$PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
   fi
-  # Last rung deliberately needs no environment variable: an agent that was
-  # never handed a plugin root still has the installed package to fall back on.
-  candidates+=(node_modules/@codyswann/lisa/plugins/lisa/skills/lisa-secrets-access/scripts/resolve-secret.mjs)
-
   local resolver
   local tried=()
   for resolver in "${candidates[@]}"; do

package/plugins/src/base/rules/reference/leaf-only-lifecycle.md

@@ -83,7 +83,7 @@ Notes:
 
 ### Classifying a hold
 
-`rollup-blocker-classification` (`plugins/src/base/scripts/rollup-blocker-classification.mjs`) is the single implementation. It takes the child graph the vendor reader already produced and returns, per held leaf, a class and the actor who must clear it:
+`rollup-blocker-classification` (`scripts/rollup-blocker-classification.mjs` under the active Lisa plugin root) is the single installed implementation. It takes the child graph the vendor reader already produced and returns, per held leaf, a class and the actor who must clear it:
 
 | Class | Recorded signal on the leaf | Who must act | Clears on its own? |
 |---|---|---|---|

package/plugins/src/base/scripts/resolve-lifecycle-role.mjs

@@ -94,6 +94,9 @@ export const VENDOR_ROOTS = Object.freeze({
   github: "github.labels.build",
 });
 
+/** GitHub's PRD lifecycle is a separate required role map from build work. */
+const GITHUB_PRD_PREFIX = "prd.";
+
 /** Resolution outcomes, reported so a caller never has to guess what happened. */
 export const OUTCOMES = Object.freeze({
   CONFIGURED: "configured",
@@ -170,7 +173,12 @@ export const resolveRole = ({
   global: globalConfig,
   fallback,
 }) => {
-  const root = VENDOR_ROOTS[vendor];
+  let root = VENDOR_ROOTS[vendor];
+  let configuredRole = role;
+  if (vendor === "github" && role.startsWith(GITHUB_PRD_PREFIX)) {
+    root = "github.labels.prd";
+    configuredRole = role.slice(GITHUB_PRD_PREFIX.length);
+  }
   if (!root) {
     return {
       value: "",
@@ -182,7 +190,9 @@ export const resolveRole = ({
 
   // `done` is env-keyed on every vendor; an env selects one rung of the map.
   const path =
-    env && role === "done" ? `${root}.done.${env}` : `${root}.${role}`;
+    env && configuredRole === "done"
+      ? `${root}.done.${env}`
+      : `${root}.${configuredRole}`;
 
   for (const [label, source] of [
     ["local", local],
@@ -199,7 +209,9 @@ export const resolveRole = ({
     }
   }
 
-  const optional = OPTIONAL_ROLES.includes(role);
+  const optional =
+    !role.startsWith(GITHUB_PRD_PREFIX) &&
+    OPTIONAL_ROLES.includes(configuredRole);
 
   // R2 — a fallback may inform a read, never supply a write target.
   if (fallback && intent === "write") {

package/plugins/src/base/skills/lisa-github-build-intake/SKILL.md

@@ -36,18 +36,17 @@ selection-only: never assign or reassign issues as part of build intake.
 Build-queue label names are read from `.lisa.config.json` `github.labels.build.*`, falling back to defaults documented in the `config-resolution` rule. Bash pattern:
 
 ```bash
-# Read role with default fallback. Local overrides global per-key.
 read_role() {
   # Single resolver — see config-resolution "The single resolver".
-  # Exit 0 + empty output means an OPTIONAL role is unset: skip that transition,
-  # never substitute the second argument. A default on an optional role is what
-  # made "unset" indistinguishable from "not customized".
-  node "${CLAUDE_PLUGIN_ROOT}/scripts/resolve-lifecycle-role.mjs" \
-    --role "$1" --vendor github --intent "${3:-read}" 2>/dev/null
+  local value
+  value=$(node "${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-plugins/lisa}}/scripts/resolve-lifecycle-role.mjs" \
+    --role "$1" --vendor github --intent "${2:-read}") || return $?
+  [ -n "$value" ] || { echo "Error: required GitHub role '$1' resolved empty." >&2; return 2; }
+  printf '%s\n' "$value"
 }
 
-READY=$(read_role ready "status:ready")
-CLAIMED=$(read_role claimed "status:in-progress")
+READY=$(read_role ready read) || exit $?
+CLAIMED=$(read_role claimed write) || exit $?
 
 read_intake_assignee() {
   local cli_value local_v

package/plugins/src/base/skills/lisa-github-prd-intake/SKILL.md

@@ -19,21 +19,20 @@ Run one intake cycle against that repo. The first eligible issue with the `ready
 PRD label names are read from `.lisa.config.json` `github.labels.prd.*`, falling back to defaults documented in the `config-resolution` rule. Bash pattern:
 
 ```bash
-# Read role with default fallback. Local overrides global per-key.
 read_role() {
   # Single resolver — see config-resolution "The single resolver".
-  # Exit 0 + empty output means an OPTIONAL role is unset: skip that transition,
-  # never substitute the second argument. A default on an optional role is what
-  # made "unset" indistinguishable from "not customized".
-  node "${CLAUDE_PLUGIN_ROOT}/scripts/resolve-lifecycle-role.mjs" \
-    --role "$1" --vendor github --intent "${3:-read}" 2>/dev/null
+  local value
+  value=$(node "${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-plugins/lisa}}/scripts/resolve-lifecycle-role.mjs" \
+    --role "$1" --vendor github --intent "${2:-write}") || return $?
+  [ -n "$value" ] || { echo "Error: required GitHub PRD role '$1' resolved empty." >&2; return 2; }
+  printf '%s\n' "$value"
 }
 
-READY=$(read_role ready "prd-ready")
-IN_REVIEW=$(read_role in_review "prd-in-review")
-BLOCKED=$(read_role blocked "prd-blocked")
-TICKETED=$(read_role ticketed "prd-ticketed")
-SHIPPED=$(read_role shipped "prd-shipped")
+READY=$(read_role prd.ready write) || exit $?
+IN_REVIEW=$(read_role prd.in_review write) || exit $?
+BLOCKED=$(read_role prd.blocked write) || exit $?
+TICKETED=$(read_role prd.ticketed write) || exit $?
+SHIPPED=$(read_role prd.shipped write) || exit $?
 ```
 
 In prose below, the role names refer to the resolved labels: e.g. "the `ready` label" means whatever `github.labels.prd.ready` resolves to (default: `prd-ready`).

package/plugins/src/base/skills/lisa-github-sync/SKILL.md

@@ -129,7 +129,7 @@ classifier absent.
 
 **Single-environment collapse (this repo).** `.lisa.config.json` `deploy.branches` declares only `production: main`, so the env-keyed `done` resolves to the single label `status:done` — there is no `status:on-dev` / `status:on-stg` and **no dev → staging → prod promotion chain**. Resolve the env rungs via the env-keyed `done` logic in `config-resolution`, but in the single-environment case the only rung is production and it collapses to the one `status:done` value; the rollup never attempts to resolve a dev or staging `done`. Projects that DO have multiple environments keep the env-keyed map and roll the parent up to whichever `done` (including intermediate `status:on-dev`/`status:on-stg`) its leaves have collectively reached.
 
-**Apply the derived label** (only when it differs from the parent's current `status:*`): remove the parent's existing `status:*` label and add the derived one, keeping exactly one `status:*` label so the build-queue invariant holds. Post an idempotent `[claude-sync] rollup` comment naming the derived state and the child tally (e.g. `3/4 leaves terminal, 1 blocked → status:blocked`); when the derived state is `status:blocked` the comment also carries the classifier's per-class section, so the blocking child and its actor are one read rather than a descent. Skip the comment if an identical one is already the most recent rollup comment — the classifier's fingerprint is the dedupe key, and an unchanged verdict is not re-posted.
+**Apply the derived label** (only when it differs from the parent's current `status:*`): remove the parent's existing `status:*` label and add the derived one, keeping exactly one `status:*` label so the build-queue invariant holds. Re-read the labels immediately after the edit and require exactly one `status:*`; if the count differs, surface an error and stop without trying to normalize the ambiguous set automatically. Post an idempotent `[claude-sync] rollup` comment naming the derived state and the child tally (e.g. `3/4 leaves terminal, 1 blocked → status:blocked`); when the derived state is `status:blocked` the comment also carries the classifier's per-class section, so the blocking child and its actor are one read rather than a descent. Use the classifier's `change.summary` as the dedupe key and skip the comment when that summary is unchanged.
 
 ```bash
 gh issue edit <parent-number> --repo <org>/<repo> \

package/plugins/src/base/skills/lisa-github-write-prd/SKILL.md

@@ -22,21 +22,23 @@ REPO=$(jq -r '.github.repo // empty' .lisa.config.local.json 2>/dev/null); REPO=
 
 read_role() {
   # Single resolver — see config-resolution "The single resolver".
-  # Exit 0 + empty output means an OPTIONAL role is unset: skip that transition,
-  # never substitute the second argument. A default on an optional role is what
-  # made "unset" indistinguishable from "not customized".
-  node "${CLAUDE_PLUGIN_ROOT}/scripts/resolve-lifecycle-role.mjs" \
-    --role "$1" --vendor github --intent "${3:-read}" 2>/dev/null
+  # Every PRD role used here is required. Resolver errors remain visible, and
+  # an empty result is refused rather than passed to `gh --label`.
+  local value
+  value=$(node "${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-plugins/lisa}}/scripts/resolve-lifecycle-role.mjs" \
+    --role "$1" --vendor github --intent "${2:-write}") || return $?
+  [ -n "$value" ] || { echo "Error: required GitHub role '$1' resolved empty." >&2; return 2; }
+  printf '%s\n' "$value"
 }
 # Resolve the FULL PRD lifecycle vocabulary from config (never hard-code names) — needed so the
 # "exactly one role" reconcile and the past-ready check work for projects that renamed any label.
-PRD_DRAFT=$(read_role '.github.labels.prd.draft' 'prd-draft')
-PRD_READY=$(read_role '.github.labels.prd.ready' 'prd-ready')
-PRD_IN_REVIEW=$(read_role '.github.labels.prd.in_review' 'prd-in-review')
-PRD_BLOCKED=$(read_role '.github.labels.prd.blocked' 'prd-blocked')
-PRD_TICKETED=$(read_role '.github.labels.prd.ticketed' 'prd-ticketed')
-PRD_SHIPPED=$(read_role '.github.labels.prd.shipped' 'prd-shipped')
-PRD_VERIFIED=$(read_role '.github.labels.prd.verified' 'prd-verified')
+PRD_DRAFT=$(read_role prd.draft write) || exit $?
+PRD_READY=$(read_role prd.ready write) || exit $?
+PRD_IN_REVIEW=$(read_role prd.in_review write) || exit $?
+PRD_BLOCKED=$(read_role prd.blocked write) || exit $?
+PRD_TICKETED=$(read_role prd.ticketed write) || exit $?
+PRD_SHIPPED=$(read_role prd.shipped write) || exit $?
+PRD_VERIFIED=$(read_role prd.verified write) || exit $?
 # All lifecycle labels (for one-of reconcile) and the "progressed past ready" set (never down-rank):
 ALL_PRD_LABELS=("$PRD_DRAFT" "$PRD_READY" "$PRD_IN_REVIEW" "$PRD_BLOCKED" "$PRD_TICKETED" "$PRD_SHIPPED" "$PRD_VERIFIED")
 PROGRESSED=("$PRD_IN_REVIEW" "$PRD_BLOCKED" "$PRD_TICKETED" "$PRD_SHIPPED" "$PRD_VERIFIED")

package/plugins/src/base/skills/lisa-jira-build-intake/SKILL.md

@@ -20,18 +20,17 @@ Run one build-intake cycle. The first eligible ready ticket is claimed, built vi
 Status names are read from `.lisa.config.json` `jira.workflow.*`, falling back to defaults documented in the `config-resolution` rule. Bash pattern:
 
 ```bash
-# Read role with default fallback. Local overrides global per-key.
 read_role() {
   # Single resolver — see config-resolution "The single resolver".
-  # Exit 0 + empty output means an OPTIONAL role is unset: skip that transition,
-  # never substitute the second argument. A default on an optional role is what
-  # made "unset" indistinguishable from "not customized".
-  node "${CLAUDE_PLUGIN_ROOT}/scripts/resolve-lifecycle-role.mjs" \
-    --role "$1" --vendor jira --intent "${3:-read}" 2>/dev/null
+  local value
+  value=$(node "${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-plugins/lisa}}/scripts/resolve-lifecycle-role.mjs" \
+    --role "$1" --vendor jira --intent "${2:-read}") || return $?
+  [ -n "$value" ] || { echo "Error: required JIRA role '$1' resolved empty." >&2; return 2; }
+  printf '%s\n' "$value"
 }
 
-READY=$(read_role ready "Ready")
-CLAIMED=$(read_role claimed "In Progress")
+READY=$(read_role ready read) || exit $?
+CLAIMED=$(read_role claimed write) || exit $?
 ```
 
 For env-keyed `done`, resolve the env first, then look up `done[<env>]`:

package/plugins/src/base/skills/lisa-jira-journey/scripts/parse-plan.py

@@ -33,6 +33,7 @@ import sys
 import urllib.request
 from base64 import b64encode
 from pathlib import Path
+from urllib.parse import urlsplit
 
 
 # Intentionally matches the exact local-claim prefixes only. EVIDENCE-REF is a
@@ -66,13 +67,50 @@ def jira_config_candidates():
     return candidates
 
 
+def read_jira_config(config_path):
+    """Read the server and login fields from one jira-cli config."""
+    server = ""
+    login = ""
+    with open(config_path) as config:
+        for line in config:
+            if line.startswith("server:"):
+                server = line.split(":", 1)[1].strip()
+            elif line.startswith("login:"):
+                login = line.split(":", 1)[1].strip()
+    return server, login
+
+
+def server_origin(server):
+    """Return the normalized HTTPS origin used as the credential trust key."""
+    try:
+        parsed = urlsplit(server)
+        port = parsed.port
+    except ValueError:
+        return ""
+    if parsed.scheme.lower() != "https" or not parsed.hostname:
+        return ""
+    authority = parsed.hostname.lower()
+    if port and port != 443:
+        authority = f"{authority}:{port}"
+    return f"https://{authority}"
+
+
 def resolve_jira_config_path():
-    """Resolve the first existing project config, then the home fallback."""
+    """Resolve a project config only when its host matches a user trust root."""
     candidates = jira_config_candidates()
-    for candidate in candidates:
-        if candidate.exists():
+    home_config = candidates[-1]
+    trusted_server = os.environ.get("JIRA_SERVER", "").strip()
+    if not trusted_server and home_config.exists():
+        trusted_server, _ = read_jira_config(home_config)
+    trusted_origin = server_origin(trusted_server)
+
+    for candidate in candidates[:-1]:
+        if not candidate.exists():
+            continue
+        candidate_server, _ = read_jira_config(candidate)
+        if trusted_origin and server_origin(candidate_server) == trusted_origin:
             return candidate
-    return candidates[-1]
+    return home_config
 
 
 def get_jira_config():
@@ -82,14 +120,18 @@ def get_jira_config():
         print(f"ERROR: jira-cli config not found at {config_path}", file=sys.stderr)
         sys.exit(1)
 
-    server = ""
-    login = ""
-    with open(config_path) as f:
-        for line in f:
-            if line.startswith("server:"):
-                server = line.split(":", 1)[1].strip()
-            elif line.startswith("login:"):
-                login = line.split(":", 1)[1].strip()
+    server, login = read_jira_config(config_path)
+
+    trusted_server = os.environ.get("JIRA_SERVER", "").strip()
+    trusted_origin = server_origin(trusted_server)
+    if trusted_origin:
+        if server_origin(server) != trusted_origin:
+            print("ERROR: jira-cli config server does not match trusted JIRA_SERVER", file=sys.stderr)
+            sys.exit(1)
+        server = trusted_server.rstrip("/")
+    if not server_origin(server):
+        print("ERROR: JIRA server must be an HTTPS URL from a trusted config", file=sys.stderr)
+        sys.exit(1)
 
     token = os.environ.get("JIRA_API_TOKEN", "")
     if not token: