@codyswann/lisa 4.22.8 → 4.22.10

package/plugins/lisa/skills/lisa-setup-notion/SKILL.md

@@ -173,9 +173,9 @@ read_notion_token() {
   # than "this function" is deliberate — the old wording asked for something
   # unachievable, and an unachievable rule is one that gets quietly dropped.
   #
-  # Ordered repo-first, ending at the plugin's own copy. Repo-relative rungs
-  # lead because a project that vendors the resolver has declared which copy it
-  # wants used, and that decision must survive this change untouched. The plugin
+  # Ordered across trusted machine-managed substrates, ending at the installed
+  # package. Checkout-local paths are deliberately absent: a familiar generated
+  # destination is still repository-controlled executable code. The plugin
   # rungs are the floor: `resolve-secret.mjs` ships beside this skill, so a rung
   # pointing at it is reachable from anywhere the plugin itself is installed.
   # Without one, a consumer repository that vendors none of the leading paths
@@ -184,12 +184,9 @@ read_notion_token() {
   # lookups. This LADDER is identical in every skill that resolves a credential
   # and `credential-resolver-ladder` fails if any copy diverges. Only what
   # happens AFTER the ladder may differ between them.
-  local candidates=(
-    .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .opencode/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-    .codex/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-  )
+  # Execute only machine-managed plugin/package resolvers. Checkout-local
+  # candidates are repository-controlled code, not trusted merely by path.
+  local candidates=()
   if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
     candidates+=("$CLAUDE_PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
   fi
@@ -208,7 +205,7 @@ read_notion_token() {
       local via_lisa
       via_lisa=$(node "$resolver" get NOTION_API_TOKEN 2>/dev/null) \
         && [ -n "$via_lisa" ] && { echo "$via_lisa"; return; }
-      break
+      # Empty/error means this substrate had no answer; try the next trusted one.
     fi
   done
   # Legacy fallback: the OS keychain written by the guided flow below, for

package/plugins/lisa/skills/lisa-setup-remote-aws/SKILL.md

@@ -64,13 +64,18 @@ The lock remains held through rollback and its deletion is verified before the
 command reports success:
 
 ```bash
-aws --profile shared secretsmanager get-secret-value \
-  --secret-id remote-agent-credentials \
+aws secretsmanager get-secret-value \
+  --secret-id <selected-secret-name> \
   --query SecretString \
   --output text \
   | node .claude/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs publish
 ```
 
+Use the same secret name passed to `--secret-name`; the default is
+`remote-agent-credentials`. Add `--profile <source-profile>` only when the
+operator's ambient AWS identity cannot read the emission and the project names
+a source profile. A named `shared` profile is not otherwise required.
+
 Resolve the script from the installed runtime or `node_modules` when the
 `.claude/skills` copy is not present. Never print or place the candidate in an
 argument or temporary file. A CDK deployment followed later by a human copy is

package/plugins/lisa/skills/lisa-setup-remote-env/SKILL.md

@@ -97,9 +97,14 @@ A surface that **re-runs this script when a container resumes** — Codex Cloud
 A surface that **skips this script whenever a filesystem cache exists** — Claude Code web — must not. Materializing here would write the values once and then never refresh them, so a credential rotated on Tuesday would still be serving Monday's value until the cache expired days later. Those surfaces materialize from a session-start hook instead, which runs every session including a resumed one:
 
 ```sh
-bash scripts/lisa-remote-env/session-start.sh   # guard; reruns toolchain, secrets, then hook
+bash "$CLAUDE_PROJECT_DIR/scripts/lisa-remote-env/session-start.sh"   # project-scoped absolute hook
 ```
 
+The installer also registers a user-scoped hook using the checkout's resolved
+absolute path. If invoking this asset by hand, either use that absolute path or
+change to the repository root first; a bare checkout-relative command is not a
+portable session-start configuration.
+
 The selection comes from the surface's `materializeAt` capability in `lisa-secrets-access`, not from its name, so adding a surface does not mean editing a branch. The hook is committed to the repository, so it also fires on a developer's machine — it exits `0` immediately there rather than failing, because a correct local session must not look broken.
 
 ## Detect before you provision

package/plugins/lisa/skills/lisa-setup-remote-env/assets/session-start.sh

@@ -46,8 +46,27 @@ here="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)"
 # SessionStart hosts are fail-open, so they surface that result and still allow
 # the agent session to continue.
 bash "${here}/setup.sh" --phase=toolchain "$@"
+
+# The toolchain child cannot export into this parent shell. Its durable output
+# is linked into ~/.local/bin, so make that directory visible before the next
+# child tries to execute the provider CLI it just installed.
+case ":$PATH:" in
+  *":$HOME/.local/bin:"*) ;;
+  *) PATH="$HOME/.local/bin:$PATH"; export PATH ;;
+esac
+
 bash "${here}/setup.sh" --phase=secrets "$@"
 
+# Materialization writes a Lisa-owned block into .profile that sources the
+# generated environment and removes ambient AWS credential poison. The project
+# hook is another non-login child, so load that block here and let the child
+# inherit the exact environment materialization just produced.
+if [ -r "$HOME/.profile" ]; then
+  # The materializer owns this runtime path.
+  # shellcheck disable=SC1090
+  . "$HOME/.profile"
+fi
+
 # A project hook is part of the remote toolchain contract too. It covers tools
 # that cannot be expressed by the pinned manifest, so skipping it on a cached
 # session can leave fresh credentials with no client capable of using them.

package/plugins/lisa/skills/lisa-setup-remote-env/assets/setup.sh

@@ -132,6 +132,7 @@ for candidate in \
   ".claude/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
   ".agents/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
   ".codex/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
+  ".opencode/skills/lisa/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
   "plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
   "node_modules/@codyswann/lisa/plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs"; do
   if [ -f "$candidate" ]; then

package/plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -51,7 +51,10 @@ import { pathDirs } from "../../lisa-setup-workstation/scripts/catalogue.mjs";
 
 import { assertPinned, extractVersion, planToolchain } from "./toolchain.mjs";
 
-import { boundedChildOutput } from "../../lisa-setup-workstation/scripts/bounded-child.mjs";
+import {
+  boundedChildOutput,
+  SETUP_OPERATION_BUDGET_MS,
+} from "../../lisa-setup-workstation/scripts/bounded-child.mjs";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 
@@ -173,12 +176,14 @@ function installReleaseZip(tool, binDir) {
     const archive = join(temporary, "download.zip");
     boundedChildOutput("curl", ["-fsSL", tool.url, "-o", archive], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     // Verify before unpacking, not after. An unexpected archive must fail
     // before any of its contents reach a directory that is on PATH.
     verifyChecksum(archive, tool.sha256, tool.name);
     boundedChildOutput("unzip", ["-q", "-o", archive, "-d", temporary], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     const binary = join(temporary, tool.binary ?? tool.name);
     boundedChildOutput(
@@ -186,6 +191,7 @@ function installReleaseZip(tool, binDir) {
       ["-m", "0755", binary, join(binDir, tool.name)],
       {
         stdio: "inherit",
+        timeout: SETUP_OPERATION_BUDGET_MS,
       }
     );
   } finally {
@@ -210,10 +216,12 @@ function installReleaseTar(tool, binDir) {
     const archive = join(temporary, "download.tar.gz");
     boundedChildOutput("curl", ["-fsSL", tool.url, "-o", archive], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     verifyChecksum(archive, tool.sha256, tool.name);
     boundedChildOutput("tar", ["-xzf", archive, "-C", temporary], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     // Release tarballs usually nest under a versioned directory, so `binary` is
     // a path within the archive rather than a bare name.
@@ -223,6 +231,7 @@ function installReleaseTar(tool, binDir) {
       ["-m", "0755", binary, join(binDir, tool.name)],
       {
         stdio: "inherit",
+        timeout: SETUP_OPERATION_BUDGET_MS,
       }
     );
   } finally {
@@ -272,6 +281,7 @@ function installReleaseTree(tool, binDir) {
     const archive = join(temporary, "download.archive");
     boundedChildOutput("curl", ["-fsSL", tool.url, "-o", archive], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     // Verify before unpacking, as everywhere else here: an unexpected archive
     // must fail before any of its contents reach the filesystem.
@@ -285,10 +295,12 @@ function installReleaseTree(tool, binDir) {
     if (tool.url.endsWith(".zip")) {
       boundedChildOutput("unzip", ["-q", "-o", archive, "-d", prefix], {
         stdio: "inherit",
+        timeout: SETUP_OPERATION_BUDGET_MS,
       });
     } else {
       boundedChildOutput("tar", ["-xzf", archive, "-C", prefix], {
         stdio: "inherit",
+        timeout: SETUP_OPERATION_BUDGET_MS,
       });
     }
 
@@ -342,6 +354,7 @@ function installReleaseBinary(tool, binDir) {
     const artifact = join(temporary, tool.name);
     boundedChildOutput("curl", ["-fsSL", tool.url, "-o", artifact], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     // Verify before it reaches a directory on PATH. For this kind that ordering
     // matters more than for the archives: the downloaded file is directly
@@ -353,6 +366,7 @@ function installReleaseBinary(tool, binDir) {
       ["-m", "0755", artifact, join(binDir, tool.name)],
       {
         stdio: "inherit",
+        timeout: SETUP_OPERATION_BUDGET_MS,
       }
     );
   } finally {
@@ -370,6 +384,7 @@ function installNpmGlobal(tool) {
     ["install", "--global", `${tool.package}@${tool.version}`],
     {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     }
   );
 }
@@ -509,7 +524,10 @@ function runHook(hook, dryRun) {
   console.log(`\nProject hook: ${hook}`);
   if (dryRun) return;
   chmodSync(path, 0o755);
-  boundedChildOutput("bash", [path], { stdio: "inherit" });
+  boundedChildOutput("bash", [path], {
+    stdio: "inherit",
+    timeout: SETUP_OPERATION_BUDGET_MS,
+  });
 }
 
 /** Phases this runner can execute, in the order they must happen. */
@@ -789,7 +807,10 @@ export function installUserSessionHook(repoRoot, options = {}) {
 
   const dir = join(home, ".claude");
   const settingsPath = join(dir, "settings.json");
-  const command = `bash ${script}`;
+  // Settings stores shell source, so the absolute path still needs quoting.
+  // JSON string syntax is accepted by the shell for ordinary path text and
+  // safely escapes spaces, quotes, dollars and backticks.
+  const command = `bash ${JSON.stringify(script)}`;
 
   let settings = {};
   if (exists(settingsPath)) {
@@ -1506,7 +1527,7 @@ async function main() {
       boundedChildOutput(
         "node",
         dryRun ? [materialize, "--dry-run"] : [materialize],
-        { stdio: "inherit" }
+        { stdio: "inherit", timeout: SETUP_OPERATION_BUDGET_MS }
       );
     } catch (err) {
       if (!retried) throw err;

package/plugins/lisa/skills/lisa-setup-workstation/scripts/bounded-child.mjs

@@ -83,6 +83,15 @@ import { execFileSync, spawnSync } from "node:child_process";
  */
 export const CHILD_BUDGET_MS = 30_000;
 
+/**
+ * Deadline for setup operations that legitimately include downloads, package
+ * installation, secret-provider calls, or a project-declared hook.
+ *
+ * Kept separate from {@link CHILD_BUDGET_MS}: probes should still fail quickly,
+ * while a cold network install must not be killed by the probe budget.
+ */
+export const SETUP_OPERATION_BUDGET_MS = 10 * 60_000;
+
 /**
  * Whether this value is a child that was killed at its deadline.
  *

package/plugins/lisa/skills/lisa-setup-workstation/scripts/workstation.mjs

@@ -36,7 +36,10 @@
 import { existsSync, lstatSync, mkdirSync, rmSync, symlinkSync } from "node:fs";
 import { join } from "node:path";
 
-import { boundedChildOutput } from "./bounded-child.mjs";
+import {
+  boundedChildOutput,
+  SETUP_OPERATION_BUDGET_MS,
+} from "./bounded-child.mjs";
 
 import {
   AGENTS,
@@ -387,7 +390,9 @@ export function installEntry(entry, row, deps = {}) {
 
   try {
     if (entry.kind === "npm-global") {
-      run("npm", ["install", "-g", entry.package]);
+      run("npm", ["install", "-g", entry.package], {
+        timeout: SETUP_OPERATION_BUDGET_MS,
+      });
     } else if (entry.kind === "vendor-script") {
       if (!entry.script) {
         return {
@@ -410,12 +415,11 @@ export function installEntry(entry, row, deps = {}) {
       // exit status is the SHELL's, not curl's, so a 404 feeds an empty script
       // to bash, bash exits 0, and a tool that was never installed is reported
       // as installed. That is exactly what `sonarsource.com/install` did.
-      run("bash", [
-        "-o",
-        "pipefail",
-        "-c",
-        `curl -fsSL ${entry.script} | bash`,
-      ]);
+      run(
+        "bash",
+        ["-o", "pipefail", "-c", `curl -fsSL ${entry.script} | bash`],
+        { timeout: SETUP_OPERATION_BUDGET_MS }
+      );
     } else if (entry.kind === "aws-cli") {
       // macOS ships a .pkg that wants an administrator, which a headless run
       // has no business prompting for. Reported as manual with the one-line
@@ -436,20 +440,24 @@ export function installEntry(entry, row, deps = {}) {
       const url = `https://awscli.amazonaws.com/awscli-exe-linux-${
         process.arch === "arm64" ? "aarch64" : "x86_64"
       }.zip`;
-      run("bash", [
-        "-o",
-        "pipefail",
-        "-c",
+      run(
+        "bash",
         [
-          "set -e",
-          'tmp="$(mktemp -d)"',
-          `curl -fsSL "${url}" -o "$tmp/awscli.zip"`,
-          'unzip -q "$tmp/awscli.zip" -d "$tmp"',
-          `"$tmp/aws/install" --install-dir "${home}/.local/aws-cli" ` +
-            `--bin-dir "${home}/.local/bin" --update`,
-          'rm -rf "$tmp"',
-        ].join("\n"),
-      ]);
+          "-o",
+          "pipefail",
+          "-c",
+          [
+            "set -e",
+            'tmp="$(mktemp -d)"',
+            `curl -fsSL "${url}" -o "$tmp/awscli.zip"`,
+            'unzip -q "$tmp/awscli.zip" -d "$tmp"',
+            `"$tmp/aws/install" --install-dir "${home}/.local/aws-cli" ` +
+              `--bin-dir "${home}/.local/bin" --update`,
+            'rm -rf "$tmp"',
+          ].join("\n"),
+        ],
+        { timeout: SETUP_OPERATION_BUDGET_MS }
+      );
     } else if (CHECKSUMMED.has(entry.kind)) {
       // The pinned, checksummed path belongs to the remote-env installer. It is
       // borrowed rather than reimplemented so the pins and checksums cannot

package/plugins/lisa/skills/lisa-sonarcloud-access/SKILL.md

@@ -63,9 +63,9 @@ read_sonar_secret() {
   local name="$1"
   [ -n "${!name:-}" ] && { echo "${!name}"; return; }
   #
-  # Ordered repo-first, ending at the plugin's own copy. Repo-relative rungs
-  # lead because a project that vendors the resolver has declared which copy it
-  # wants used, and that decision must survive this change untouched. The plugin
+  # Ordered across trusted machine-managed substrates, ending at the installed
+  # package. Checkout-local paths are deliberately absent: a familiar generated
+  # destination is still repository-controlled executable code. The plugin
   # rungs are the floor: `resolve-secret.mjs` ships beside this skill, so a rung
   # pointing at it is reachable from anywhere the plugin itself is installed.
   # Without one, a consumer repository that vendors none of the leading paths
@@ -74,12 +74,9 @@ read_sonar_secret() {
   # lookups. This LADDER is identical in every skill that resolves a credential
   # and `credential-resolver-ladder` fails if any copy diverges. Only what
   # happens AFTER the ladder may differ between them.
-  local candidates=(
-    .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .opencode/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-    .codex/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-  )
+  # Execute only machine-managed plugin/package resolvers. Checkout-local
+  # candidates are repository-controlled code, not trusted merely by path.
+  local candidates=()
   if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
     candidates+=("$CLAUDE_PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
   fi
@@ -98,7 +95,7 @@ read_sonar_secret() {
       local via_lisa
       via_lisa=$(node "$resolver" get "$name" 2>/dev/null) \
         && [ -n "$via_lisa" ] && { echo "$via_lisa"; return; }
-      break
+      # Empty/error means this substrate had no answer; try the next trusted one.
     fi
   done
   # Name every path. A bare `return 1` sends the next reader hunting for a

package/plugins/lisa/skills/lisa-tracker-sync/SKILL.md

@@ -58,7 +58,7 @@ The state machine (first match wins, evaluated over the **required** leaves only
 | else any leaf has **started** (claimed or in review, or shipped while a sibling has not) | active / in-progress | `claimed` (or `review` where supported) |
 | else (leaves exist, none started) | unchanged | — |
 
-- **Blocked dominates** — one blocked leaf surfaces blocked on the parent even while others progress. It never says *which* child or *which kind* of hold; run `scripts/rollup-blocker-classification.mjs` over the resolved child graph and carry its per-class report — blocking leaf, path, and who must act — into the rollup note. A non-zero exit means it classified nothing; that is a failure to report, never an all-clear. See `leaf-only-lifecycle` → **Classifying a hold**.
+- **Blocked dominates** — one blocked leaf surfaces blocked on the parent even while others progress. It never says *which* child or *which kind* of hold. Resolve the shared classifier from `${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-plugins/lisa}}/scripts/rollup-blocker-classification.mjs` (the current-directory fallback supports a Lisa checkout), run it over the resolved child graph, and carry its per-class report — blocking leaf, path, and who must act — into the rollup note. A missing classifier or non-zero exit is a strict **no-write** result for every vendor: no lifecycle mutation and no rollup-comment mutation. Report the failure, never an all-clear. See `leaf-only-lifecycle` → **Classifying a hold**.
 - **Least-advanced env wins** — a parent reaches an env only once all required leaves have reached at least that env (all `On Stg` → `On Stg`; mixed dev/staging → the dev value). Native terminal closure fires only at the production `done`, never at an intermediate env.
 - **The parent never carries `ready`** — `ready` is a human "claim this leaf" signal; rollup only moves a parent between non-ready container states.
 - **Rollup is recursive** — an Epic rolls up from its Stories, each of which rolls up from its own leaves. Evaluate bottom-up.

package/plugins/lisa-agy/hooks/parity-safety-net.sh

@@ -1064,8 +1064,38 @@ readonly AGENT_CREDENTIAL='(\.(claude|codex|cursor|copilot|gemini|antigravity)/[
 # 15d. Dotenv files. `.env.example`, `.sample`, `.template`, `.dist` and
 # `.schema` are checked-in documentation of which keys exist, never the values,
 # so they are excluded — that collision is the one this rule most had to avoid.
-readonly DOTENV_SECRET='(^|[[:space:]='"$qc"'./])\.env(\.[[:alnum:]_-]+)?([[:space:]'"$qc"']|$)'
-readonly DOTENV_PUBLIC='\.env\.(example|sample|template|dist|schema|defaults)([[:space:]'"$qc"']|$)'
+# Decide dotenv privacy per PATH, never by subtracting one command-wide match
+# from another. A command that names `.env.example` and `.env` contains both a
+# public path and a private one; seeing the former cannot authorize the latter.
+#
+# The one write-only shape this guard has always allowed remains explicit:
+# seeding a private dotenv destination from one public template. This is safe
+# because the private path is the destination, not a value being read back.
+has_private_dotenv_path() {
+  dotenv_scan_status=0
+  dotenv_candidates="$(printf '%s' "$normalized_command_str" \
+    | grep -Eio -- '(^|[[:space:]='"$qc"'./])\.env(\.[[:alnum:]_-]+)?')" \
+    || dotenv_scan_status=$?
+  if [ "$dotenv_scan_status" -gt 1 ]; then
+    block "dotenv path classification failed; denying the credential-store read fail-closed."
+  fi
+
+  while IFS= read -r candidate; do
+    [ -n "$candidate" ] || continue
+    candidate="$(printf '%s' "$candidate" \
+      | tr '[:upper:]' '[:lower:]' \
+      | grep -Eo -- '\.env(\.[[:alnum:]_-]+)?')"
+    case "$candidate" in
+      .env.example | .env.sample | .env.template | .env.dist | .env.schema | .env.defaults) ;;
+      *) return 0 ;;
+    esac
+  done <<EOF
+$dotenv_candidates
+EOF
+  return 1
+}
+
+readonly SAFE_DOTENV_SEED='^[[:space:]]*(cp|mv)[[:space:]]+\.env\.(example|sample|template|dist|schema|defaults)[[:space:]]+\.env(\.[[:alnum:]_-]+)?[[:space:]]*$'
 
 if matches "$SECRET_READ_VERB"; then
   if matches "$SSH_PRIVATE_KEY"; then
@@ -1077,10 +1107,10 @@ if matches "$SECRET_READ_VERB"; then
   if matches "$AGENT_CREDENTIAL"; then
     block "reading, copying or transmitting a coding-agent or package-registry credential store. These tokens impersonate the operator to every service the agent can reach."
   fi
-  # `.env` only when the path is NOT one of the public example forms. Ordered as
-  # an exclusion rather than a narrower pattern so a new example suffix is one
-  # word to add, and so the reason a file is exempt stays readable.
-  if matches "$DOTENV_SECRET" && ! matches "$DOTENV_PUBLIC"; then
+  # A public path elsewhere in the command never exempts a private path. The
+  # narrow public-template -> private-destination seed is write-only and remains
+  # allowed; every other command containing a private dotenv path is refused.
+  if has_private_dotenv_path && ! matches "$SAFE_DOTENV_SEED"; then
     block "reading, copying or transmitting a dotenv file holding real values. \`.env.example\`, \`.env.sample\`, \`.env.template\` and \`.env.dist\` are readable, and WRITING a .env is unaffected — only reading one back is refused."
   fi
   # Fail-closed, narrowly. A read whose DIRECTORY is a known credential store

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/scripts/install-remote-agent-aws.mjs

@@ -329,12 +329,16 @@ the complete bundle from the shared account. Do not extract or distribute its
 individual access-key fields:
 
 \`\`\`bash
-aws --profile shared secretsmanager get-secret-value \\
+aws secretsmanager get-secret-value \\
   --secret-id ${secretName} \\
   --query SecretString \\
   --output text
 \`\`\`
 
+This uses the ambient AWS identity. Add \`--profile <source-profile>\` only when
+this project requires a named source profile to read the emission; \`shared\` is
+not an implicit requirement.
+
 Store that exact output as the masked secret \`LISA_AWS_BOOTSTRAP_JSON\` on each
 remote-agent platform. Run the setup command and require its live
 \`sts:GetCallerIdentity\` check to pass before considering the platform ready.

package/plugins/lisa-agy/scripts/rollup-blocker-classification.mjs

@@ -293,6 +293,8 @@ function collectHolds(children, context, path, seen, tally) {
  *   container?: { ref?: unknown, type?: unknown }
  *   readError?: unknown
  *   children?: unknown
+ *   renderedState?: unknown
+ *   childTally?: unknown
  *   blockedStates?: unknown
  *   markerNames?: { specDefect?: unknown, humanNeeded?: unknown }
  * }} input
@@ -339,6 +341,10 @@ export function classifyRollupBlockers(input = {}) {
       blockers.filter(blocker => blocker.class === name),
     ]).filter(([, group]) => group.length > 0)
   );
+  const renderedState = trimmedString(input.renderedState);
+  const childTally =
+    trimmedString(input.childTally) ||
+    `examined=${tally.examined}, held=${blockers.length}, unreadable=${tally.unexaminable.length}`;
 
   return {
     ok: true,
@@ -348,6 +354,8 @@ export function classifyRollupBlockers(input = {}) {
     blockers,
     byClass,
     unexaminable: tally.unexaminable,
+    renderedState,
+    childTally,
   };
 }
 
@@ -433,8 +441,8 @@ export function renderRollupBlockerReport(result) {
 }
 
 /**
- * A stable identity for a rollup verdict: the container, plus every held item
- * and its class, sorted.
+ * A stable identity for a rollup note: the rendered lifecycle state, child
+ * tally, container, and every held item plus its class, sorted.
  *
  * This is what lets a repeat cycle stay quiet. 32 identical hold comments over
  * six weeks was the same verdict restated on a schedule; comparing this string
@@ -451,7 +459,14 @@ export function rollupBlockerFingerprint(result) {
     .map(blocker => `${blocker.ref}:${blocker.class}`)
     .sort((left, right) => left.localeCompare(right));
 
-  return `container=${result.container.ref};verdict=${result.verdict};examined=${result.examined};holds=${pairs.join(",")}`;
+  return [
+    `container=${result.container.ref}`,
+    `verdict=${result.verdict}`,
+    `rendered=${JSON.stringify(trimmedString(result.renderedState))}`,
+    `tally=${JSON.stringify(trimmedString(result.childTally))}`,
+    `examined=${result.examined}`,
+    `holds=${pairs.join(",")}`,
+  ].join(";");
 }
 
 /**

package/plugins/lisa-agy/skills/lisa-atlassian-access/SKILL.md

@@ -57,9 +57,9 @@ read_atlassian_token() {
   # OS keychain here — a second reader is how the same credential ends up living
   # in two places and drifting.
   #
-  # Ordered repo-first, ending at the plugin's own copy. Repo-relative rungs
-  # lead because a project that vendors the resolver has declared which copy it
-  # wants used, and that decision must survive this change untouched. The plugin
+  # Ordered across trusted machine-managed substrates, ending at the installed
+  # package. Checkout-local paths are deliberately absent: a familiar generated
+  # destination is still repository-controlled executable code. The plugin
   # rungs are the floor: `resolve-secret.mjs` ships beside this skill, so a rung
   # pointing at it is reachable from anywhere the plugin itself is installed.
   # Without one, a consumer repository that vendors none of the leading paths
@@ -68,12 +68,9 @@ read_atlassian_token() {
   # lookups. This LADDER is identical in every skill that resolves a credential
   # and `credential-resolver-ladder` fails if any copy diverges. Only what
   # happens AFTER the ladder may differ between them.
-  local candidates=(
-    .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .opencode/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-    .codex/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-  )
+  # Executable resolvers are a code boundary. Checkout-local copies are mutable
+  # repository content, so use only machine-managed plugin/package locations.
+  local candidates=()
   if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
     candidates+=("$CLAUDE_PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
   fi
@@ -92,7 +89,7 @@ read_atlassian_token() {
       local via_lisa
       via_lisa=$(node "$resolver" get ATLASSIAN_API_TOKEN 2>/dev/null) \
         && [ -n "$via_lisa" ] && { echo "$via_lisa"; return; }
-      break
+      # Empty/error means this substrate had no answer; try the next trusted one.
     fi
   done
   # Legacy fallback: the OS keychain written by the guided /lisa:setup:atlassian
@@ -152,7 +149,7 @@ public static class LisaCred {
   echo "Error: could not resolve ATLASSIAN_API_TOKEN through lisa-secrets-access or the legacy keychain." >&2
   echo "Tried, in order (relative paths are from $PWD):" >&2
   printf '  %s\n' "${tried[@]}" >&2
-  echo "  <OS keychain> service=lisa-atlassian account=$email" >&2
+  echo "  <OS keychain> service=lisa-atlassian account=<configured>" >&2
   return 1
 }
 TOKEN=$(read_atlassian_token "$EMAIL")
@@ -288,7 +285,7 @@ if [ -n "$site" ] && [ "$current_site" != "$site" ]; then
 fi
 
 if [ -n "$email" ] && [ -n "$current_email" ] && [ "$current_email" != "$email" ]; then
-  echo "Error: acli active account is '$current_email', but .lisa.config.json requires '$email'. Run /lisa:setup:atlassian to add or repair the matching profile." >&2
+  echo "Error: acli active account does not match the configured Atlassian account. Run /lisa:setup:atlassian to add or repair the matching profile." >&2
   exit 1
 fi
 ```
@@ -310,7 +307,7 @@ if [ -z "$me_email" ]; then
   exit 1
 fi
 if [ "$me_email" != "$email" ]; then
-  echo "Error: ATLASSIAN_API_TOKEN belongs to '$me_email', but .lisa.config.local.json declares '$email'. Multi-account misconfiguration." >&2
+  echo "Error: ATLASSIAN_API_TOKEN identity does not match the configured Atlassian account. Multi-account misconfiguration; re-run /lisa:setup:atlassian." >&2
   exit 1
 fi
 ```

package/plugins/lisa-agy/skills/lisa-doctor/SKILL.md

@@ -480,8 +480,8 @@ against both enforcing surfaces on paths a machine already takes:
 | the shipped ruleset template a repository is provisioned from | `lisa doctor` (one operator-readable line) and `lisa doctor --json` → `declarationDrift.templates` | no |
 | the live branch-protection ruleset | `lisa doctor --json` → `declarationDrift.live`, and the `github.declared-checks` check in `lisa health` | yes |
 
-Both report one verdict per required context, and the vocabulary is six values rather than
-matched/unmatched, because four of the mismatches need four different actions:
+Both report one verdict per required context, and the vocabulary is seven values rather than
+matched/unmatched, because the mismatches and an unreadable surface need different actions:
 
 - `matched` — declared `required`, and the surface requires it.
 - `declared-not-enforced` — the settings file says it must pass and nothing requires it. The
@@ -495,6 +495,8 @@ matched/unmatched, because four of the mismatches need four different actions:
 - `enforced-not-lisa-owned` — protection requires it and no registry gate produces it. Third-party
   checks are required by construction and declared by nobody; this bucket exists so they can be told
   apart from a Lisa gate that fell out of the settings file, never so they can be removed.
+- `unproven` — the surface could not be read, so no enforcement comparison was made. It is never a
+  match and never drift; the operator fixes access/availability and reruns the observation.
 
 `enforced-declared-off` and `declared-not-enforced` fail the health check; the two gaps warn. No
 remedy in that vocabulary removes a required context — the type has no such member, so the