@codyswann/lisa 4.22.8 → 4.22.10

package/dist/opencode/plugin-templates/parity-safety-net.sh

@@ -1064,8 +1064,38 @@ readonly AGENT_CREDENTIAL='(\.(claude|codex|cursor|copilot|gemini|antigravity)/[
 # 15d. Dotenv files. `.env.example`, `.sample`, `.template`, `.dist` and
 # `.schema` are checked-in documentation of which keys exist, never the values,
 # so they are excluded — that collision is the one this rule most had to avoid.
-readonly DOTENV_SECRET='(^|[[:space:]='"$qc"'./])\.env(\.[[:alnum:]_-]+)?([[:space:]'"$qc"']|$)'
-readonly DOTENV_PUBLIC='\.env\.(example|sample|template|dist|schema|defaults)([[:space:]'"$qc"']|$)'
+# Decide dotenv privacy per PATH, never by subtracting one command-wide match
+# from another. A command that names `.env.example` and `.env` contains both a
+# public path and a private one; seeing the former cannot authorize the latter.
+#
+# The one write-only shape this guard has always allowed remains explicit:
+# seeding a private dotenv destination from one public template. This is safe
+# because the private path is the destination, not a value being read back.
+has_private_dotenv_path() {
+  dotenv_scan_status=0
+  dotenv_candidates="$(printf '%s' "$normalized_command_str" \
+    | grep -Eio -- '(^|[[:space:]='"$qc"'./])\.env(\.[[:alnum:]_-]+)?')" \
+    || dotenv_scan_status=$?
+  if [ "$dotenv_scan_status" -gt 1 ]; then
+    block "dotenv path classification failed; denying the credential-store read fail-closed."
+  fi
+
+  while IFS= read -r candidate; do
+    [ -n "$candidate" ] || continue
+    candidate="$(printf '%s' "$candidate" \
+      | tr '[:upper:]' '[:lower:]' \
+      | grep -Eo -- '\.env(\.[[:alnum:]_-]+)?')"
+    case "$candidate" in
+      .env.example | .env.sample | .env.template | .env.dist | .env.schema | .env.defaults) ;;
+      *) return 0 ;;
+    esac
+  done <<EOF
+$dotenv_candidates
+EOF
+  return 1
+}
+
+readonly SAFE_DOTENV_SEED='^[[:space:]]*(cp|mv)[[:space:]]+\.env\.(example|sample|template|dist|schema|defaults)[[:space:]]+\.env(\.[[:alnum:]_-]+)?[[:space:]]*$'
 
 if matches "$SECRET_READ_VERB"; then
   if matches "$SSH_PRIVATE_KEY"; then
@@ -1077,10 +1107,10 @@ if matches "$SECRET_READ_VERB"; then
   if matches "$AGENT_CREDENTIAL"; then
     block "reading, copying or transmitting a coding-agent or package-registry credential store. These tokens impersonate the operator to every service the agent can reach."
   fi
-  # `.env` only when the path is NOT one of the public example forms. Ordered as
-  # an exclusion rather than a narrower pattern so a new example suffix is one
-  # word to add, and so the reason a file is exempt stays readable.
-  if matches "$DOTENV_SECRET" && ! matches "$DOTENV_PUBLIC"; then
+  # A public path elsewhere in the command never exempts a private path. The
+  # narrow public-template -> private-destination seed is write-only and remains
+  # allowed; every other command containing a private dotenv path is refused.
+  if has_private_dotenv_path && ! matches "$SAFE_DOTENV_SEED"; then
     block "reading, copying or transmitting a dotenv file holding real values. \`.env.example\`, \`.env.sample\`, \`.env.template\` and \`.env.dist\` are readable, and WRITING a .env is unaffected — only reading one back is refused."
   fi
   # Fail-closed, narrowly. A read whose DIRECTORY is a known credential store

package/nestjs/package-lisa/package.lisa.json

@@ -43,7 +43,7 @@
       "security:zap": "bash scripts/zap-baseline.sh",
       "test": "vitest run",
       "test:unit": "vitest run --exclude='**/integration/**'",
-      "test:integration:lisa": "vitest run '.integration.' 'integration/' --passWithNoTests",
+      "test:integration:lisa": "vitest run '.integration.' 'integration/'",
       "test:cov": "vitest run --coverage",
       "test:cov:unit": "LISA_COVERAGE_SCOPE=unit vitest run --coverage --exclude='**/integration/**' --exclude='**/*.integration.*'",
       "test:mutation": "node scripts/lisa-mutation.mjs",

package/package.json

@@ -161,7 +161,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -300,6 +300,6 @@
     "vite": "^8.0.16"
   },
   "type": "module",
-  "lisaReleaseCommit": "aef178549f447caa476ef4664eed332c7212cd49",
-  "gitHead": "aef178549f447caa476ef4664eed332c7212cd49"
+  "lisaReleaseCommit": "0e3dc332d948df9ab08ef99e564a2cd8132a89b7",
+  "gitHead": "0e3dc332d948df9ab08ef99e564a2cd8132a89b7"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-atlassian-access/SKILL.md

@@ -57,9 +57,9 @@ read_atlassian_token() {
   # OS keychain here — a second reader is how the same credential ends up living
   # in two places and drifting.
   #
-  # Ordered repo-first, ending at the plugin's own copy. Repo-relative rungs
-  # lead because a project that vendors the resolver has declared which copy it
-  # wants used, and that decision must survive this change untouched. The plugin
+  # Ordered across trusted machine-managed substrates, ending at the installed
+  # package. Checkout-local paths are deliberately absent: a familiar generated
+  # destination is still repository-controlled executable code. The plugin
   # rungs are the floor: `resolve-secret.mjs` ships beside this skill, so a rung
   # pointing at it is reachable from anywhere the plugin itself is installed.
   # Without one, a consumer repository that vendors none of the leading paths
@@ -68,12 +68,9 @@ read_atlassian_token() {
   # lookups. This LADDER is identical in every skill that resolves a credential
   # and `credential-resolver-ladder` fails if any copy diverges. Only what
   # happens AFTER the ladder may differ between them.
-  local candidates=(
-    .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .opencode/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-    .codex/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-  )
+  # Executable resolvers are a code boundary. Checkout-local copies are mutable
+  # repository content, so use only machine-managed plugin/package locations.
+  local candidates=()
   if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
     candidates+=("$CLAUDE_PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
   fi
@@ -92,7 +89,7 @@ read_atlassian_token() {
       local via_lisa
       via_lisa=$(node "$resolver" get ATLASSIAN_API_TOKEN 2>/dev/null) \
         && [ -n "$via_lisa" ] && { echo "$via_lisa"; return; }
-      break
+      # Empty/error means this substrate had no answer; try the next trusted one.
     fi
   done
   # Legacy fallback: the OS keychain written by the guided /lisa:setup:atlassian
@@ -152,7 +149,7 @@ public static class LisaCred {
   echo "Error: could not resolve ATLASSIAN_API_TOKEN through lisa-secrets-access or the legacy keychain." >&2
   echo "Tried, in order (relative paths are from $PWD):" >&2
   printf '  %s\n' "${tried[@]}" >&2
-  echo "  <OS keychain> service=lisa-atlassian account=$email" >&2
+  echo "  <OS keychain> service=lisa-atlassian account=<configured>" >&2
   return 1
 }
 TOKEN=$(read_atlassian_token "$EMAIL")
@@ -288,7 +285,7 @@ if [ -n "$site" ] && [ "$current_site" != "$site" ]; then
 fi
 
 if [ -n "$email" ] && [ -n "$current_email" ] && [ "$current_email" != "$email" ]; then
-  echo "Error: acli active account is '$current_email', but .lisa.config.json requires '$email'. Run /lisa:setup:atlassian to add or repair the matching profile." >&2
+  echo "Error: acli active account does not match the configured Atlassian account. Run /lisa:setup:atlassian to add or repair the matching profile." >&2
   exit 1
 fi
 ```
@@ -310,7 +307,7 @@ if [ -z "$me_email" ]; then
   exit 1
 fi
 if [ "$me_email" != "$email" ]; then
-  echo "Error: ATLASSIAN_API_TOKEN belongs to '$me_email', but .lisa.config.local.json declares '$email'. Multi-account misconfiguration." >&2
+  echo "Error: ATLASSIAN_API_TOKEN identity does not match the configured Atlassian account. Multi-account misconfiguration; re-run /lisa:setup:atlassian." >&2
   exit 1
 fi
 ```

package/plugins/lisa/.codex-plugin/skills/lisa-doctor/SKILL.md

@@ -480,8 +480,8 @@ against both enforcing surfaces on paths a machine already takes:
 | the shipped ruleset template a repository is provisioned from | `lisa doctor` (one operator-readable line) and `lisa doctor --json` → `declarationDrift.templates` | no |
 | the live branch-protection ruleset | `lisa doctor --json` → `declarationDrift.live`, and the `github.declared-checks` check in `lisa health` | yes |
 
-Both report one verdict per required context, and the vocabulary is six values rather than
-matched/unmatched, because four of the mismatches need four different actions:
+Both report one verdict per required context, and the vocabulary is seven values rather than
+matched/unmatched, because the mismatches and an unreadable surface need different actions:
 
 - `matched` — declared `required`, and the surface requires it.
 - `declared-not-enforced` — the settings file says it must pass and nothing requires it. The
@@ -495,6 +495,8 @@ matched/unmatched, because four of the mismatches need four different actions:
 - `enforced-not-lisa-owned` — protection requires it and no registry gate produces it. Third-party
   checks are required by construction and declared by nobody; this bucket exists so they can be told
   apart from a Lisa gate that fell out of the settings file, never so they can be removed.
+- `unproven` — the surface could not be read, so no enforcement comparison was made. It is never a
+  match and never drift; the operator fixes access/availability and reruns the observation.
 
 `enforced-declared-off` and `declared-not-enforced` fail the health check; the two gaps warn. No
 remedy in that vocabulary removes a required context — the type has no such member, so the

package/plugins/lisa/.codex-plugin/skills/lisa-drive-pr-to-merge/SKILL.md

@@ -343,9 +343,18 @@ auto-merge armed (section 1); when it returns, re-read `headRefOid` and reset
 
 **Merging past a rate-limited CodeRabbit is permitted — but ONLY when CodeRabbit
 is the sole gate still blocking the merge.** When the CodeRabbit context reports
-`Review rate limited` (or stays pending/queued because of the vendor cap) and it
-is the *only* thing standing between the PR and `MERGED`, do not wait it out:
-with `auto_merge=true` the PR already has auto-merge enabled (section 1), so
+`Review rate limited` and it is the *only* thing standing between the PR and
+`MERGED`, do not wait it out. Prove that vendor-cap signal from the live check
+description; `statusCheckRollup` does not carry enough detail, so read it with:
+
+```bash
+gh pr checks <pr> --json name,state,description,bucket \
+  --jq '.[] | select(.name == "CodeRabbit")'
+```
+
+A merely pending or queued CodeRabbit check is not proof of a vendor cap and
+must keep polling. Once that signal is explicit, and with `auto_merge=true`, the
+PR already has auto-merge enabled (section 1), so
 leave the latch armed and merge directly with `gh pr merge <pr> --<merge_method>`
 (pass `--admin` only if branch protection lists the rate-limited context as
 required and refuses the plain merge). "Sole gate" means every one of these is
@@ -355,7 +364,15 @@ from memory:
 - every other required check in `statusCheckRollup` is green (no FAILURE, no
   other PENDING);
 - zero unresolved review threads (human or bot);
-- `reviewDecision` is not `CHANGES_REQUESTED`;
+- the repository's human-approval requirement is demonstrably satisfied at the
+  current head: read the live branch/ruleset requirement, and when it requires
+  one or more approvals require `reviewDecision == APPROVED` plus the current
+  **effective** non-dismissed approval count. Compute effective reviews from the
+  latest non-dismissed review per reviewer, ordered by `submitted_at` then id;
+  an older approval from a reviewer never satisfies a later `CHANGES_REQUESTED`
+  from that reviewer. If the required count is zero, record that live
+  policy result. `REVIEW_REQUIRED`, `CHANGES_REQUESTED`, and `null` never stand
+  in for this proof before an admin merge;
 - `mergeable == MERGEABLE` and `mergeStateStatus` is not `BEHIND`/`DIRTY`;
 - no pending auto-fix PR into this branch (step f).
 
@@ -380,6 +397,14 @@ Some org rulesets allow 0 approvals yet a bot `CHANGES_REQUESTED` still blocks
 auto-merge — dismissing the stale review after resolving all threads is what
 unblocks it.
 
+When reading review history, derive the current review set rather than counting
+the whole array. One reproducible REST shape is:
+
+```bash
+gh api --paginate repos/<owner>/<repo>/pulls/<pr>/reviews --slurp \
+  --jq 'add | map(select(.state != "DISMISSED")) | sort_by(.submitted_at, .id) | reduce .[] as $review ({}; .[$review.user.login] = $review) | [.[]]'
+```
+
 ### f. Pending auto-fix PR into this branch
 If an open PR from `claude-auto-fix-<headRefName>` targets this PR's head
 branch (the CI auto-fix workflow engaged before this session took the lease),

package/plugins/lisa/.codex-plugin/skills/lisa-github-sync/SKILL.md

@@ -113,10 +113,15 @@ If the `subIssues` field is unavailable (older GHES), fall back to body parentag
 - **Blocked dominates — and the rollup must say which child and which kind** — a single blocked child surfaces `status:blocked` on the parent even while siblings progress, so a human sees the parent needs attention. `status:blocked` alone is a single bit and cannot tell a child waiting on an external event from one whose acceptance criteria are unbuildable; the second never clears on its own. Run the shared classifier over the resolved child graph before writing the label or the comment:
 
 ```bash
-node "${CLAUDE_PLUGIN_ROOT}/scripts/rollup-blocker-classification.mjs" --input=<graph.json>
+CLASSIFIER_ROOT="${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-plugins/lisa}}"
+node "${CLASSIFIER_ROOT}/scripts/rollup-blocker-classification.mjs" --input=<graph.json>
 ```
 
-  Its report names, per class, the blocking leaf, the path to it (`#1495 -> #1515 -> #1547`) and **who must act** — that text goes in the rollup comment verbatim. It exits non-zero when it classified nothing (unreadable graph, no children, no readable child): treat that as a rollup that could not be derived and fall through to the **Safe default** below, never to "no blocked children". Never infer a class from prose and never apply the `spec_defect` marker from a flow — see `leaf-only-lifecycle` → **Classifying a hold**.
+The current-directory `plugins/lisa` fallback is for a Lisa checkout where no
+plugin-root variable is injected; it must be tried before declaring the shared
+classifier absent.
+
+  Its report names, per class, the blocking leaf, the path to it (`#1495 -> #1515 -> #1547`) and **who must act** — that text goes in the rollup comment verbatim. It exits non-zero when it classified nothing (unreadable graph, no children, no readable child): that is a strict **no-write** result. Do not change a label and do not post/update a rollup comment; report the classifier failure to the caller. Never fall through to "no blocked children", infer a class from prose, or apply the `spec_defect` marker from a flow — see `leaf-only-lifecycle` → **Classifying a hold**.
 - **Least-advanced env wins** — the parent reaches an env only when every required child has reached at least that env; it never sits ahead of its laggard child. Native closure (`gh issue close --reason completed`) fires only when the resolved env is the production `status:done`, never at `status:on-dev`/`status:on-stg`.
 - **"Required" children only** — a child labelled won't-do / optional does not hold the parent open; only leaves that must ship count toward the env-rollup check.
 - **Recursive** — a parent reaches an env only when its children have all reached at least that env; an Epic reaches it only when its Stories have themselves rolled up to it. Evaluate bottom-up.
@@ -131,7 +136,7 @@ gh issue edit <parent-number> --repo <org>/<repo> \
   --remove-label "<current status:*>" --add-label "<derived status:*>"
 ```
 
-**Safe default.** If rollup cannot be applied automatically (e.g. ambiguous required-set, GraphQL hierarchy unavailable, or a derived terminal that the env logic cannot resolve), this skill does **not** guess — it posts the derived suggestion as a comment and leaves the parent's label untouched. No unsafe transition is ever made.
+**Safe default.** If a successfully-read rollup cannot be applied automatically (e.g. ambiguous required-set or a derived terminal that the env logic cannot resolve), this skill does **not** guess — it posts the derived suggestion as a comment and leaves the parent's label untouched. A classifier/read failure is stricter: it writes neither label nor comment. No unsafe transition is ever made.
 
 ## Important Notes
 

package/plugins/lisa/.codex-plugin/skills/lisa-jam-access/SKILL.md

@@ -48,9 +48,9 @@ export PATH="$HOME/.local/bin:$PATH"
 read_jam_pat() {
   [ -n "${JAM_PAT:-}" ] && { echo "$JAM_PAT"; return; }
   #
-  # Ordered repo-first, ending at the plugin's own copy. Repo-relative rungs
-  # lead because a project that vendors the resolver has declared which copy it
-  # wants used, and that decision must survive this change untouched. The plugin
+  # Ordered across trusted machine-managed substrates, ending at the installed
+  # package. Checkout-local paths are deliberately absent: a familiar generated
+  # destination is still repository-controlled executable code. The plugin
   # rungs are the floor: `resolve-secret.mjs` ships beside this skill, so a rung
   # pointing at it is reachable from anywhere the plugin itself is installed.
   # Without one, a consumer repository that vendors none of the leading paths
@@ -59,12 +59,9 @@ read_jam_pat() {
   # lookups. This LADDER is identical in every skill that resolves a credential
   # and `credential-resolver-ladder` fails if any copy diverges. Only what
   # happens AFTER the ladder may differ between them.
-  local candidates=(
-    .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .opencode/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-    .codex/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-  )
+  # Execute only machine-managed plugin/package resolvers. Checkout-local
+  # candidates are repository-controlled code, not trusted merely by path.
+  local candidates=()
   if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
     candidates+=("$CLAUDE_PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
   fi
@@ -83,7 +80,7 @@ read_jam_pat() {
       local via_lisa
       via_lisa=$(node "$resolver" get JAM_PAT 2>/dev/null) \
         && [ -n "$via_lisa" ] && { echo "$via_lisa"; return; }
-      break
+      # Empty/error means this substrate had no answer; try the next trusted one.
     fi
   done
   # Name every path. A bare `return 1` sends the next reader hunting for a

package/plugins/lisa/.codex-plugin/skills/lisa-jira-journey/SKILL.md

@@ -35,6 +35,11 @@ Run the parser script to extract the Validation Journey from the JIRA ticket des
 python3 .claude/skills/jira-journey/scripts/parse-plan.py <TICKET_ID>
 ```
 
+The parser resolves Jira configuration from the checkout first: it searches
+`$CLAUDE_PROJECT_DIR/.lisa/jira-cli/.config.yml`, then the current directory and
+its parents, and only then falls back to `~/.config/.jira/.config.yml`. Do not
+copy project settings into the home-level file just to make this step work.
+
 The script outputs JSON with: `ticket`, `prerequisites`, `steps`, `viewports`, `assertions`.
 
 Note: `viewports` may be empty for TypeScript tickets — that is expected.

package/plugins/lisa/.codex-plugin/skills/lisa-jira-journey/scripts/parse-plan.py

@@ -41,9 +41,43 @@ from pathlib import Path
 LOCAL_EVIDENCE_PATTERN = re.compile(r'\[(SCREENSHOT|EVIDENCE):\s*([^\]]+)\]')
 
 
+def jira_config_candidates():
+    """Return project-first jira-cli config candidates without duplicates."""
+    roots = []
+    project_dir = os.environ.get("CLAUDE_PROJECT_DIR", "").strip()
+    if project_dir:
+        roots.append(Path(project_dir).expanduser().resolve())
+
+    current = Path.cwd().resolve()
+    roots.extend([current, *current.parents])
+
+    candidates = []
+    seen = set()
+    for root in roots:
+        candidate = root / ".lisa" / "jira-cli" / ".config.yml"
+        key = str(candidate)
+        if key not in seen:
+            candidates.append(candidate)
+            seen.add(key)
+
+    home_candidate = (Path.home() / ".config" / ".jira" / ".config.yml").resolve()
+    if str(home_candidate) not in seen:
+        candidates.append(home_candidate)
+    return candidates
+
+
+def resolve_jira_config_path():
+    """Resolve the first existing project config, then the home fallback."""
+    candidates = jira_config_candidates()
+    for candidate in candidates:
+        if candidate.exists():
+            return candidate
+    return candidates[-1]
+
+
 def get_jira_config():
-    """Read JIRA server and login from jira-cli config."""
-    config_path = Path.home() / ".config" / ".jira" / ".config.yml"
+    """Read JIRA server and login from the project-first jira-cli config."""
+    config_path = resolve_jira_config_path()
     if not config_path.exists():
         print(f"ERROR: jira-cli config not found at {config_path}", file=sys.stderr)
         sys.exit(1)

package/plugins/lisa/.codex-plugin/skills/lisa-jira-sync/SKILL.md

@@ -94,7 +94,7 @@ When invoked with `--rollup`, this skill **derives a parent/container ticket's s
 | else any child has **started** (`In Progress` / `Code Review`, or shipped to an env while a sibling has not) | `claimed` | `In Progress` |
 | else (children exist, none started) | — | unchanged — parent keeps its non-ready container status |
 
-- **Blocked dominates** — a single blocked child surfaces `Blocked` on the parent even while siblings progress. It never says *which* child or *which kind* of hold; run `scripts/rollup-blocker-classification.mjs` over the resolved child graph and carry its per-class report — blocking leaf, path, and who must act — into the rollup note. A non-zero exit means it classified nothing; that is a failure to report, never an all-clear. See `leaf-only-lifecycle` → **Classifying a hold**.
+- **Blocked dominates** — a single blocked child surfaces `Blocked` on the parent even while siblings progress. It never says *which* child or *which kind* of hold; resolve and run the shared classifier exactly as `lisa-tracker-sync` specifies, then carry its per-class report — blocking leaf, path, and who must act — into the rollup note. A missing classifier or non-zero exit is a strict **no-write** result: do not transition the parent and do not post/update a rollup comment; report the failure, never an all-clear. See `leaf-only-lifecycle` → **Classifying a hold**.
 - **Least-advanced env wins** — the parent reaches an env only when every required child has reached at least that env; it never sits ahead of its laggard child. Apply native terminal resolution (the `leaf-only-lifecycle` Terminal native closure) only when the resolved env is the production `Done`, never at `On Dev`/`On Stg`.
 - **"Required" children only** — won't-do / optional children do not hold the parent open.
 - **Recursive** — an Epic reaches an env only when its Stories have themselves rolled up to at least that env; a Story reaches it only when its Sub-tasks have. Evaluate bottom-up.

package/plugins/lisa/.codex-plugin/skills/lisa-linear-access/SKILL.md

@@ -85,22 +85,18 @@ All GraphQL calls use:
 read_linear_key() {
   [ -n "${LINEAR_API_KEY:-}" ] && { echo "$LINEAR_API_KEY"; return; }
 
-  # The ladder is ordered repo-first and ends at the plugin's own copy.
-  #
-  # Repo-relative rungs lead because a project that vendors the resolver has
-  # declared which copy it wants used, and that decision must survive this
-  # change untouched. The plugin rungs are the floor: `resolve-secret.mjs`
+  # The ladder is ordered across trusted machine-managed substrates and ends at
+  # the installed package. Checkout-local paths are deliberately absent: a
+  # familiar generated destination is still repository-controlled executable
+  # code. The plugin rungs are the floor: `resolve-secret.mjs`
   # ships beside this skill, so a rung pointing at it is reachable from
   # anywhere the plugin itself is installed. Without one, a repo that vendors
   # none of the leading paths has no route to the key at all — which is what
   # every consumer of this skill in a `.opencode`-layout repository actually
   # hit, and why agents started improvising their own key lookups.
-  local candidates=(
-    .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .opencode/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-    .codex/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-  )
+  # Execute only machine-managed plugin/package resolvers. Checkout-local
+  # candidates are repository-controlled code, not trusted merely by path.
+  local candidates=()
   if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
     candidates+=("$CLAUDE_PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
   fi
@@ -119,7 +115,7 @@ read_linear_key() {
       local via_lisa
       via_lisa=$(node "$resolver" get LINEAR_API_KEY 2>/dev/null) \
         && [ -n "$via_lisa" ] && { echo "$via_lisa"; return; }
-      break
+      # Empty/error means this substrate had no answer; try the next trusted one.
     fi
   done
 

package/plugins/lisa/.codex-plugin/skills/lisa-linear-sync/SKILL.md

@@ -140,7 +140,7 @@ When the caller passes `--rollup`, this skill **derives a parent/container's wor
 | else any child has **started** (at the `claimed` state, at the `review` state where the project configures one, or shipped to an env while a sibling has not) | `claimed` | the configured `claimed` state |
 | else (children exist, none started) | — | unchanged — parent keeps its non-ready container state |
 
-- **Blocked dominates** — one blocked child surfaces `Blocked` on the parent even while siblings progress. It never says *which* child or *which kind* of hold; run `scripts/rollup-blocker-classification.mjs` over the resolved child graph and carry its per-class report — blocking leaf, path, and who must act — into the rollup note. A non-zero exit means it classified nothing; that is a failure to report, never an all-clear. See `leaf-only-lifecycle` → **Classifying a hold**.
+- **Blocked dominates** — one blocked child surfaces `Blocked` on the parent even while siblings progress. It never says *which* child or *which kind* of hold; resolve and run the shared classifier exactly as `lisa-tracker-sync` specifies, then carry its per-class report — blocking leaf, path, and who must act — into the rollup note. A missing classifier or non-zero exit is a strict **no-write** result: do not save parent state and do not post/update a rollup comment; report the failure, never an all-clear. See `leaf-only-lifecycle` → **Classifying a hold**.
 - **Least-advanced env wins** — the parent reaches an env only when every required child has reached at least that env; it never sits ahead of its laggard child. Native completion (moving the workflow `state` to Done) fires only when the resolved env is the production `Done`, never at `On Dev`/`On Stg`.
 - **"Required" children only** — won't-do / optional (e.g. `Canceled`) children do not hold the parent open.
 - **Recursive** — a Project reaches an env only when its Issues have themselves rolled up to at least that env. Evaluate bottom-up.

package/plugins/lisa/.codex-plugin/skills/lisa-nightly-lower-code-complexity/SKILL.md

@@ -25,8 +25,14 @@ The caller provides pre-computed context:
 9. Run the project's typecheck script with the provided package manager to catch type errors early — same reasoning as step 7, so `npm run typecheck` / `yarn typecheck` / `bun run typecheck`, falling back to `./node_modules/.bin/tsc --noEmit` rather than `npx tsc`:
 
    ```sh
+   case "$PACKAGE_MANAGER" in
+     npm)  runner=(npm run) ;;
+     yarn) runner=(yarn) ;;
+     bun)  runner=(bun run) ;;
+     *) echo "unsupported package manager: $PACKAGE_MANAGER" >&2; exit 2 ;;
+   esac
    status=0
-   bun run typecheck >tsc.log 2>&1 || status=$?
+   "${runner[@]}" typecheck >tsc.log 2>&1 || status=$?
    head -n 30 tsc.log; echo "exit=$status"
    ```
 

package/plugins/lisa/.codex-plugin/skills/lisa-notion-access/SKILL.md

@@ -58,9 +58,9 @@ read_notion_token() {
   # OS keychain here — a second reader is how the same credential ends up living
   # in two places and drifting.
   #
-  # Ordered repo-first, ending at the plugin's own copy. Repo-relative rungs
-  # lead because a project that vendors the resolver has declared which copy it
-  # wants used, and that decision must survive this change untouched. The plugin
+  # Ordered across trusted machine-managed substrates, ending at the installed
+  # package. Checkout-local paths are deliberately absent: a familiar generated
+  # destination is still repository-controlled executable code. The plugin
   # rungs are the floor: `resolve-secret.mjs` ships beside this skill, so a rung
   # pointing at it is reachable from anywhere the plugin itself is installed.
   # Without one, a consumer repository that vendors none of the leading paths
@@ -69,12 +69,9 @@ read_notion_token() {
   # lookups. This LADDER is identical in every skill that resolves a credential
   # and `credential-resolver-ladder` fails if any copy diverges. Only what
   # happens AFTER the ladder may differ between them.
-  local candidates=(
-    .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .opencode/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-    .codex/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-  )
+  # Execute only machine-managed plugin/package resolvers. Checkout-local
+  # candidates are repository-controlled code, not trusted merely by path.
+  local candidates=()
   if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
     candidates+=("$CLAUDE_PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
   fi
@@ -93,7 +90,7 @@ read_notion_token() {
       local via_lisa
       via_lisa=$(node "$resolver" get NOTION_API_TOKEN 2>/dev/null) \
         && [ -n "$via_lisa" ] && { echo "$via_lisa"; return; }
-      break
+      # Empty/error means this substrate had no answer; try the next trusted one.
     fi
   done
   # Legacy fallback: the OS keychain written by the guided /lisa:setup:notion

package/plugins/lisa/.codex-plugin/skills/lisa-posthog-access/SKILL.md

@@ -49,9 +49,9 @@ POSTHOG_HOST=${POSTHOG_HOST:-https://app.posthog.com}
 read_posthog_key() {
   [ -n "${POSTHOG_PERSONAL_API_KEY:-}" ] && { echo "$POSTHOG_PERSONAL_API_KEY"; return; }
   #
-  # Ordered repo-first, ending at the plugin's own copy. Repo-relative rungs
-  # lead because a project that vendors the resolver has declared which copy it
-  # wants used, and that decision must survive this change untouched. The plugin
+  # Ordered across trusted machine-managed substrates, ending at the installed
+  # package. Checkout-local paths are deliberately absent: a familiar generated
+  # destination is still repository-controlled executable code. The plugin
   # rungs are the floor: `resolve-secret.mjs` ships beside this skill, so a rung
   # pointing at it is reachable from anywhere the plugin itself is installed.
   # Without one, a consumer repository that vendors none of the leading paths
@@ -60,12 +60,9 @@ read_posthog_key() {
   # lookups. This LADDER is identical in every skill that resolves a credential
   # and `credential-resolver-ladder` fails if any copy diverges. Only what
   # happens AFTER the ladder may differ between them.
-  local candidates=(
-    .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .opencode/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-    .codex/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-  )
+  # Execute only machine-managed plugin/package resolvers. Checkout-local
+  # candidates are repository-controlled code, not trusted merely by path.
+  local candidates=()
   if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
     candidates+=("$CLAUDE_PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
   fi
@@ -84,7 +81,7 @@ read_posthog_key() {
       local via_lisa
       via_lisa=$(node "$resolver" get POSTHOG_PERSONAL_API_KEY 2>/dev/null) \
         && [ -n "$via_lisa" ] && { echo "$via_lisa"; return; }
-      break
+      # Empty/error means this substrate had no answer; try the next trusted one.
     fi
   done
   # Name every path. A bare `return 1` sends the next reader hunting for a

package/plugins/lisa/.codex-plugin/skills/lisa-repair-intake/SKILL.md

@@ -383,6 +383,11 @@ invisible on that surface — the exact state this recovery path exists to catch
 only via search (no `Closes #` / native dev link) would otherwise never be discovered, and the leaf
 would never recover. Read each PR with the vendor's native state, e.g. GitHub
 `gh pr view <n> --json state,mergedAt,mergeable,mergeStateStatus,reviewDecision,statusCheckRollup,comments,reviews`.
+For `reviews`, derive the effective set from the **latest non-dismissed review
+per reviewer**, ordered by `submitted_at` then id. Never count the raw history:
+an older approval does not satisfy a later `CHANGES_REQUESTED` review by the
+same reviewer. Use the same paginated REST reduction documented by
+`lisa-drive-pr-to-merge` when the `gh pr view` projection is incomplete.
 
 **2. PR already merged → recover, don't re-dispatch.** If `state == MERGED`, the build is effectively
 complete and the only thing missing is the env transition the build-intake never applied (its merge
@@ -695,10 +700,18 @@ left in a status it should not carry, including a stale build-ready `ready`).
 
 ```bash
 ROLLUP_DIR="$(mktemp -d)"
+# Serialize the EXACT graph resolved in step 1 before any classifier reads it.
+# RESOLVED_CHILD_GRAPH_JSON is the in-memory object from that read; do not
+# re-query the tracker here or hand-author a smaller substitute.
+printf '%s\n' "$RESOLVED_CHILD_GRAPH_JSON" \
+  | jq -e '{container, children, readError, renderedState, childTally}' \
+  > "$ROLLUP_DIR/graph.json"
+test -s "$ROLLUP_DIR/graph.json"
+
 # children[]: { ref, state, labels[], blockedBy[{ref, open}], children[] } — the graph
 # step 1 already resolved, nested as deep as it was read. The script probes nothing.
 jq -n --slurpfile g "$ROLLUP_DIR/graph.json" \
-      '{container: $g[0].container, children: $g[0].children, readError: $g[0].readError}' \
+      '{container: $g[0].container, children: $g[0].children, readError: $g[0].readError, renderedState: $g[0].renderedState, childTally: $g[0].childTally}' \
   > "$ROLLUP_DIR/input.json"
 
 node "${CLAUDE_PLUGIN_ROOT}/scripts/rollup-blocker-classification.mjs" \
@@ -707,7 +720,8 @@ node "${CLAUDE_PLUGIN_ROOT}/scripts/rollup-blocker-classification.mjs" \
 
    It **exits non-zero and classifies nothing** when the tracker could not be read, the container
    has no children, or no child was readable. That is a repair failure to report, never an
-   all-clear: do not fall through to "no blocked children" on a non-zero exit. On success its
+   all-clear and a strict **no-write** result: do not transition lifecycle state and do not
+   post/update the rollup note. Do not fall through to "no blocked children" on a non-zero exit. On success its
    report names, per class, the blocking leaf, the path to it, and **who must act** — those lines
    are what goes in the rollup note, verbatim. Never set the `spec_defect` marker yourself and
    never infer a class from prose; a hold with nothing recorded classifies `unknown`, and the
@@ -717,7 +731,9 @@ node "${CLAUDE_PLUGIN_ROOT}/scripts/rollup-blocker-classification.mjs" \
    lifecycle write (JIRA transition, GitHub/Linear label swap keeping exactly one `status:*`),
    removing any conflicting stale build lifecycle role — **including a stale `ready`** the parent
    should never carry. Post an idempotent `[lisa-repair-intake]` rollup note naming the derived
-   state and the child tally (honor the backoff window + fingerprint). **When the derived state is
+   state and the child tally (honor the backoff window + fingerprint). Include that exact rendered
+   state and tally in the classifier input: its fingerprint deduplicates the complete note, not only
+   the blocker classes. **When the derived state is
    `blocked`, the note carries the classifier's per-class report** — the blocking leaf, its path,
    and its actor — so an operator never descends the tree by hand to find out which item and which
    kind. Use the classifier's `change.summary` as the dedupe test: an unchanged verdict has nothing

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/materialize-secrets.mjs

@@ -161,12 +161,16 @@ function stripFamilyBlocks(text, family) {
     const opened = findFamily(out, start);
     if (opened.index === -1) return out;
     const closed = findFamily(out, end, opened.index + opened.length);
-    // A truncated block (opened, never closed) would otherwise swallow the rest
-    // of the file on every subsequent write.
-    const after =
-      closed.index === -1
-        ? ""
-        : out.slice(closed.index + closed.length).replace(/^\n/, "");
+    // A truncated block (opened, never closed) is not safe to interpret. Any
+    // guessed boundary could delete operator-authored content after the marker,
+    // so refuse before the caller writes and preserve the original byte-for-byte.
+    if (closed.index === -1) {
+      throw new Error(
+        `Refusing to rewrite a managed ${family} block with no closing marker. ` +
+          `Repair the marker pair first; no file was changed.`
+      );
+    }
+    const after = out.slice(closed.index + closed.length).replace(/^\n/, "");
     out = `${out.slice(0, opened.index)}${after}`;
   }
 }