@codyswann/lisa 4.26.4 → 4.27.0

package/plugins/lisa/skills/lisa-setup-remote-aws/SKILL.md

@@ -30,14 +30,45 @@ Install the vendor-neutral AWS bootstrap into the current repository.
    `.github/workflows/copilot-setup-steps.yml`; and it always writes
    `docs/remote-agent-aws.md`.
 4. Run `bash -n scripts/remote-agent-aws-setup.sh`.
-5. Never write or request the actual bootstrap bundle in repository files. Tell
+5. Confirm the operator knows which project component the profiles will carry.
+   The script resolves it from `LISA_AWS_PROFILE_NAMESPACE`, then the bundle's
+   `namespace`, then `<owner>-<repository>` from the git origin remote, and
+   refuses to write anything when none resolves. Set the variable explicitly
+   whenever the setup hook runs outside a checkout.
+6. Never write or request the actual bootstrap bundle in repository files. Tell
    the operator where to obtain it and where to put it — see **Where the bundle
    lives** below. Pass `--secret-name` when the source names it something other
    than `remote-agent-credentials`, so the generated runbook contains the exact
    retrieval command.
-6. Report the external step that remains: configure that one secret in the
+7. Report the external step that remains: configure that one secret in the
    remote environment and launch a smoke session.
 
+## Profile naming and readiness
+
+Every profile the script writes is scoped `<project>-agent-<stage>`, and the
+private source profile is `<project>-agent-bootstrap`. Bare stage names state a
+stage but not an owner, so on a workstation carrying more than one organisation
+two bundles declaring the same stages overwrite each other in the shared
+`~/.aws/config` — silently, because nothing about the surviving profile is
+malformed. The name is the only place the owner can be recorded.
+
+`default` cannot be namespaced. The script claims it only when nothing else
+owns it, and otherwise stops and names the current owner;
+`LISA_AWS_CLAIM_DEFAULT_PROFILE=1` takes it over deliberately.
+
+Readiness is an account check, not a liveness check. `sts:GetCallerIdentity`
+succeeding proves the credentials work, not that they reached the intended
+account — a check that ignores the returned value passes on any credential that
+authenticates anywhere. The script compares the returned account id against the
+account named in the role ARN it configured and refuses to report ready on a
+mismatch, quoting both. Do not substitute a hand-run `get-caller-identity` for
+the script's own exit status.
+
+Workstations bootstrapped under the previous unnamespaced convention keep their
+old profiles. They are reported by name on every run and removed only when
+`LISA_AWS_PRUNE_LEGACY_PROFILES=1` is passed, so the migration is explicit in
+both directions.
+
 ## Where the bundle lives
 
 `LISA_AWS_BOOTSTRAP_JSON` is **just another secret**, and it belongs wherever

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.26.4",
+  "version": "4.27.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/scripts/install-remote-agent-aws.mjs

@@ -313,14 +313,32 @@ Generated for: \`${platform}\`.
 
 ## Implementation
 
-The bootstrap bundle defines the available profile names. \`dev\` is the
-default when present. Select another account explicitly, for example:
+Profiles are named \`<project>-agent-<stage>\`, not bare \`dev\` or
+\`production\`. The bundle supplies the stage; the project component comes from
+\`LISA_AWS_PROFILE_NAMESPACE\`, then the bundle's \`namespace\`, then
+\`<owner>-<repository>\` from this checkout's git origin. Select an account
+explicitly, for example:
 
 \`\`\`bash
-aws --profile staging sts get-caller-identity
-aws --profile production cloudformation describe-stacks
+aws --profile <project>-agent-staging sts get-caller-identity
+aws --profile <project>-agent-production cloudformation describe-stacks
 \`\`\`
 
+The setup line prints the exact names it wrote; use those.
+
+A bare stage name states a stage but not an owner. Two organisations' bundles
+declaring the same stages write the same names into the same shared
+\`~/.aws/config\`, the last bootstrap silently wins, and every later command
+runs in the other tenant's account while reporting success. Nothing about the
+resulting profile is malformed, so no check on the profile can catch it — only
+a name carrying the owner prevents it.
+
+\`default\` is the one name that cannot be namespaced. The setup script writes
+it for this project only when nothing else already owns it; if another Lisa
+project or the operator's own configuration holds it, the script stops and says
+so rather than repointing every unqualified \`aws\` command. Pass
+\`LISA_AWS_CLAIM_DEFAULT_PROFILE=1\` to take it over deliberately.
+
 Production and shared profiles are observer-only. Production repair remains a
 human-driven local-workstation operation.
 
@@ -340,8 +358,36 @@ this project requires a named source profile to read the emission; \`shared\` is
 not an implicit requirement.
 
 Store that exact output as the masked secret \`LISA_AWS_BOOTSTRAP_JSON\` on each
-remote-agent platform. Run the setup command and require its live
-\`sts:GetCallerIdentity\` check to pass before considering the platform ready.
+remote-agent platform, then run the setup command.
+
+## Readiness
+
+\`sts:GetCallerIdentity\` succeeding proves only that the credentials work. It
+does not prove they reached the intended account, and a check that never looks
+at what the call returned passes on any credential that authenticates —
+including one that authenticates into somebody else's account.
+
+The setup script therefore compares the returned account id against the account
+named in the role ARN it just configured, and refuses to report ready on a
+mismatch, quoting both ids. A bundle may also declare \`expectedAccountId\` per
+stage; a declared id that disagrees with its own role ARN fails before anything
+is written. \`LISA_AWS_EXPECTED_ACCOUNT_ID\` states the same expectation from
+outside the bundle, and \`LISA_AWS_VERIFY_ALL_PROFILES=1\` proves every stage
+rather than only the default.
+
+Treat the setup command's own exit status as the readiness gate. Do not
+substitute a hand-run \`aws sts get-caller-identity\`: it answers "do these
+credentials work", which is not the question.
+
+## Migration
+
+Workstations bootstrapped before profiles were namespaced still carry the old
+bare names. The setup script detects them — by the retired
+\`lisa-remote-agent-bootstrap\` source profile, so an operator's own \`dev\` is
+never mistaken for one of ours — and names them on stderr on every run. They are
+left in place, because deleting a profile somebody may still be using is its own
+silent surprise. Re-run with \`LISA_AWS_PRUNE_LEGACY_PROFILES=1\` to delete the
+ones Lisa wrote; it reports exactly what it removed.
 
 ## Notes
 

package/plugins/lisa-agy/scripts/remote-agent-aws-setup.sh

@@ -13,13 +13,40 @@
 #                            contains.
 # Optional plain variables:
 #   LISA_REMOTE_AGENT       claude | codex | cursor | copilot | agy | opencode
-#   LISA_AWS_DEFAULT_PROFILE  Defaults to dev, then the first available profile.
+#   LISA_AWS_PROFILE_NAMESPACE
+#                           The project component every written profile is
+#                           scoped by. Falls back to the bundle's `namespace`
+#                           (or `project`), then to `<owner>-<repo>` from the
+#                           git origin remote. Required when none resolves.
+#   LISA_AWS_DEFAULT_PROFILE  Stage selected as the default. Defaults to dev,
+#                           then the first stage in the bundle.
+#   LISA_AWS_EXPECTED_ACCOUNT_ID
+#                           Operator-declared account for the default stage.
+#                           Checked against the bundle before anything is
+#                           written, and against the live identity after.
+#   LISA_AWS_VERIFY_ALL_PROFILES
+#                           1 to prove every stage's account, not just the
+#                           default's.
+#   LISA_AWS_CLAIM_DEFAULT_PROFILE
+#                           1 to take over a `[default]` this project does not
+#                           already own. Off by default: silently repointing
+#                           `default` is how one tenant's commands end up in
+#                           another tenant's account.
+#   LISA_AWS_PRUNE_LEGACY_PROFILES
+#                           1 to delete the unnamespaced profiles an earlier
+#                           Lisa bootstrap wrote. Off by default; they are
+#                           reported either way, never silently orphaned.
 #   LISA_AWS_SKIP_VERIFY    Set to 1 only for an offline image build.
 
 set -euo pipefail
 umask 077
 
-BOOTSTRAP_PROFILE="lisa-remote-agent-bootstrap"
+# Profiles are scoped `<namespace>-agent-<stage>`, matching the convention every
+# other profile on a multi-organisation workstation already follows. The old
+# name is retained only so an earlier bootstrap's output can be recognised and
+# migrated rather than left behind unexplained.
+BOOTSTRAP_PROFILE_SUFFIX="-agent-bootstrap"
+LEGACY_BOOTSTRAP_PROFILE="lisa-remote-agent-bootstrap"
 AWS_CLI_VERSION="2.36.2"
 
 fail() {
@@ -141,6 +168,84 @@ remove_profile_setting() {
   mv "$temporary_file" "$credentials_file"
 }
 
+# Delete one whole ini section, header and body, from an AWS shared-config file.
+#
+# Used only for the migration path: profiles a PREVIOUS Lisa bootstrap wrote
+# under the old unnamespaced convention. Sections this script never wrote are
+# never candidates — see legacy_profile_sections, which identifies ours by the
+# retired source_profile name rather than by guessing from the profile name.
+remove_profile_section() {
+  local file section temporary_file
+  file="$1"
+  section="$2"
+  [ -f "$file" ] || return 0
+
+  temporary_file="$(mktemp "${file}.XXXXXX")"
+  awk -v section="$section" '
+    /^\[[^]]*\][[:space:]]*$/ {
+      current = $0
+      sub(/^\[[[:space:]]*/, "", current)
+      sub(/[[:space:]]*\][[:space:]]*$/, "", current)
+      in_section = current == section
+      if (in_section) next
+    }
+    !in_section { print }
+  ' "$file" >"$temporary_file"
+  chmod 600 "$temporary_file"
+  mv "$temporary_file" "$file"
+}
+
+# Read one setting out of one ini section, or print nothing.
+profile_setting_value() {
+  local file section setting
+  file="$1"
+  section="$2"
+  setting="$3"
+  [ -f "$file" ] || return 0
+
+  awk -v section="$section" -v setting="$setting" '
+    /^\[[^]]*\][[:space:]]*$/ {
+      current = $0
+      sub(/^\[[[:space:]]*/, "", current)
+      sub(/[[:space:]]*\][[:space:]]*$/, "", current)
+      in_section = current == section
+      next
+    }
+    in_section && $0 ~ "^[[:space:]]*" setting "[[:space:]]*=" {
+      sub(/^[^=]*=[[:space:]]*/, "")
+      sub(/[[:space:]]*$/, "")
+      print
+      exit
+    }
+  ' "$file"
+}
+
+# Every section written by the OLD, unnamespaced convention.
+#
+# Identified by the retired bootstrap profile name, which only Lisa ever wrote,
+# so an operator's own `[profile dev]` can never be mistaken for ours.
+legacy_profile_sections() {
+  local file
+  file="$1"
+  [ -f "$file" ] || return 0
+
+  awk -v bootstrap="$LEGACY_BOOTSTRAP_PROFILE" '
+    /^\[[^]]*\][[:space:]]*$/ {
+      current = $0
+      sub(/^\[[[:space:]]*/, "", current)
+      sub(/[[:space:]]*\][[:space:]]*$/, "", current)
+      section = current
+      next
+    }
+    $0 ~ "^[[:space:]]*source_profile[[:space:]]*=" {
+      value = $0
+      sub(/^[^=]*=[[:space:]]*/, "", value)
+      sub(/[[:space:]]*$/, "", value)
+      if (value == bootstrap && section != "") print section
+    }
+  ' "$file"
+}
+
 sanitize_session_name() {
   local candidate
   candidate="$(printf '%s' "${LISA_REMOTE_AGENT:-remote-agent}" \
@@ -150,6 +255,125 @@ sanitize_session_name() {
   printf '%s\n' "$candidate"
 }
 
+# Reduce any project identifier to the safe, stable component of a profile name.
+sanitize_namespace() {
+  printf '%s' "$1" \
+    | tr '[:upper:]' '[:lower:]' \
+    | sed -e 's/[^a-z0-9]\{1,\}/-/g' -e 's/^-*//' -e 's/-*$//' \
+    | cut -c1-48
+}
+
+# `<owner>-<repository>` for the checkout this script was run from.
+#
+# The forge owner is what makes the result distinguishing: two organisations
+# routinely have a repository of the same NAME, which is the collision this
+# whole change exists to remove, and they cannot share an owner.
+namespace_from_git() {
+  need git || return 0
+
+  local url slug
+  url="$(git config --get remote.origin.url 2>/dev/null || true)"
+  [ -n "$url" ] || return 0
+  url="${url%.git}"
+  url="${url%/}"
+  slug="$(printf '%s' "$url" \
+    | sed -e 's#^[a-zA-Z0-9+.-]*://##' -e 's#^[^@/]*@##' -e 's#^[^/:]*[:/]##')"
+  printf '%s' "$slug" | tr '/' '-'
+}
+
+# The project component every profile this script writes is scoped by.
+#
+# Bare stage names (`dev`, `production`) name a stage but not an OWNER. On a
+# workstation carrying more than one organisation two bundles then write the
+# same names into the same shared `~/.aws/config`, the last bootstrap wins, and
+# every later command resolves another tenant's account while reporting success.
+# Nothing about the resulting profile is malformed, so no check on the profile
+# can catch it; only a name that carries the owner can prevent it.
+# Prints `<namespace>\t<where it came from>`. Both halves are returned together
+# because this runs in a command substitution: a variable assigned inside a
+# subshell never reaches the caller, and reporting the wrong provenance is how
+# an operator ends up unable to explain why their profiles are named what they
+# are named.
+resolve_namespace() {
+  local candidate sanitized namespace_source
+  namespace_source="LISA_AWS_PROFILE_NAMESPACE"
+  candidate="${LISA_AWS_PROFILE_NAMESPACE:-}"
+  if [ -z "$candidate" ]; then
+    namespace_source="the bootstrap bundle"
+    candidate="$(printf '%s' "$bootstrap_json" | jq -r '.namespace // .project // empty')"
+  fi
+  if [ -z "$candidate" ]; then
+    namespace_source="git remote origin"
+    candidate="$(namespace_from_git)"
+  fi
+  [ -n "$candidate" ] || fail \
+    "cannot determine which project these AWS profiles belong to. Set LISA_AWS_PROFILE_NAMESPACE (for example the repository slug), add a \"namespace\" to the bootstrap bundle, or run this from a checkout with an origin remote. Unnamespaced profiles collide across organisations on a shared workstation."
+
+  sanitized="$(sanitize_namespace "$candidate")"
+  printf '%s' "$sanitized" | grep -qE '^[a-z0-9][a-z0-9-]{1,47}$' || fail \
+    "profile namespace from ${namespace_source} (\"${candidate}\") does not reduce to a usable name; set LISA_AWS_PROFILE_NAMESPACE to two or more alphanumeric characters"
+  printf '%s\t%s\n' "$sanitized" "$namespace_source"
+}
+
+# Prove which ACCOUNT a profile reaches, not merely that it authenticates.
+#
+# `sts:GetCallerIdentity` succeeding proves the credentials work. It says
+# nothing about whose account they work in, and the old code never looked at
+# what it returned — a lookup whose success was read as the answer. Comparing
+# the returned account against the one named in the role ARN just configured is
+# what turns a liveness probe into an identity check.
+assert_profile_account() {
+  local profile expected stage identity actual
+  profile="$1"
+  expected="$2"
+  stage="$3"
+
+  identity="$(AWS_PAGER="" aws sts get-caller-identity --profile "$profile" --output json)" || fail \
+    "sts:GetCallerIdentity failed for profile ${profile} (stage ${stage})"
+  actual="$(printf '%s' "$identity" | jq -r '.Account // empty')"
+  [ -n "$actual" ] || fail \
+    "sts:GetCallerIdentity returned no account id for profile ${profile} (stage ${stage}); cannot prove which account it reached"
+  [ "$actual" = "$expected" ] || fail \
+    "profile ${profile} (stage ${stage}) resolved to AWS account ${actual}, but this project expects ${expected}. The credentials authenticate; they are not this project's account. Refusing to report ready."
+}
+
+# Who currently owns `[default]`.
+#
+# `default` is the one name that cannot be namespaced, so it is the one place
+# two projects still contend. Taking it over silently is the whole defect in
+# miniature: every unqualified `aws` command would change accounts with nothing
+# said. An inert `[default]` holding only region/output is not a claim on it,
+# and a container that ships one must still be able to bootstrap.
+default_profile_owner() {
+  local source_value setting
+  source_value="$(profile_setting_value "$config_file" "default" "source_profile")"
+  if [ "$source_value" = "$BOOTSTRAP_PROFILE" ]; then
+    printf 'ours\n'
+    return 0
+  fi
+  if [ "$source_value" = "$LEGACY_BOOTSTRAP_PROFILE" ]; then
+    printf 'legacy\n'
+    return 0
+  fi
+  case "$source_value" in
+    *"$BOOTSTRAP_PROFILE_SUFFIX")
+      printf 'another Lisa project\n'
+      return 0
+      ;;
+  esac
+  for setting in role_arn credential_process sso_start_url sso_session aws_access_key_id; do
+    if [ -n "$(profile_setting_value "$config_file" "default" "$setting")" ]; then
+      printf 'this workstation operator\n'
+      return 0
+    fi
+  done
+  if [ -n "$(profile_setting_value "$credentials_file" "default" "aws_access_key_id")" ]; then
+    printf 'this workstation operator\n'
+    return 0
+  fi
+  printf 'unclaimed\n'
+}
+
 install_base_tools
 install_aws_cli
 
@@ -181,21 +405,89 @@ profiles_json="$(printf '%s' "$bootstrap_json" | jq -c '
   end
 ')"
 
+namespace_resolution="$(resolve_namespace)"
+PROFILE_NAMESPACE="${namespace_resolution%%$'\t'*}"
+namespace_source="${namespace_resolution#*$'\t'}"
+BOOTSTRAP_PROFILE="${PROFILE_NAMESPACE}${BOOTSTRAP_PROFILE_SUFFIX}"
+
+# The role ARN carries the account the role lives in, so every bundle already
+# declares an expected account per stage whether or not it says so explicitly.
+# Requiring the full ARN shape is what makes that field readable at all.
 printf '%s' "$profiles_json" | jq -e --arg bootstrap_profile "$BOOTSTRAP_PROFILE" '
   type == "object" and length > 0 and
   all(to_entries[];
     (.key != $bootstrap_profile) and
+    (.key != "bootstrap") and
     (.key | test("^[A-Za-z0-9_-]+$")) and
-    (.value.roleArn | type == "string" and startswith("arn:aws:iam::")) and
+    (.value.roleArn | type == "string" and test("^arn:aws:iam::[0-9]{12}:role/.+")) and
     (.value.region | type == "string" and length > 0)
   )
-' >/dev/null || fail "bootstrap profiles must map safe names to roleArn and region"
+' >/dev/null || fail "bootstrap profiles must map safe names (not \"bootstrap\") to a full arn:aws:iam::<account>:role/<name> roleArn and a region"
+
+# An explicitly declared account that disagrees with the role ARN is a bundle
+# that cannot be believed. Fail here, before anything is written, naming both.
+while IFS="$(printf '\t')" read -r stage declared_account arn_account; do
+  [ "$declared_account" = "$arn_account" ] || fail \
+    "bundle stage ${stage} declares expectedAccountId ${declared_account} but its roleArn names account ${arn_account}"
+done < <(printf '%s' "$profiles_json" | jq -r '
+  to_entries[]
+  | select(.value.expectedAccountId != null)
+  | [.key, (.value.expectedAccountId | tostring), (.value.roleArn | split(":")[4])]
+  | @tsv
+')
+
+default_stage="${LISA_AWS_DEFAULT_PROFILE:-dev}"
+if ! printf '%s' "$profiles_json" | jq -e --arg stage "$default_stage" 'has($stage)' >/dev/null; then
+  default_stage="$(printf '%s' "$profiles_json" | jq -r 'keys[0]')"
+fi
+
+default_role_arn="$(printf '%s' "$profiles_json" | jq -er --arg stage "$default_stage" '.[$stage].roleArn')"
+default_region="$(printf '%s' "$profiles_json" | jq -er --arg stage "$default_stage" '.[$stage].region')"
+default_expected_account="$(printf '%s' "$profiles_json" | jq -er --arg stage "$default_stage" '
+  (.[$stage].expectedAccountId // (.[$stage].roleArn | split(":")[4])) | tostring
+')"
+
+if [ -n "${LISA_AWS_EXPECTED_ACCOUNT_ID:-}" ] \
+  && [ "$LISA_AWS_EXPECTED_ACCOUNT_ID" != "$default_expected_account" ]; then
+  fail "LISA_AWS_EXPECTED_ACCOUNT_ID is ${LISA_AWS_EXPECTED_ACCOUNT_ID} but the bundle's ${default_stage} role is in account ${default_expected_account}"
+fi
 
 credentials_file="${AWS_SHARED_CREDENTIALS_FILE:-$HOME/.aws/credentials}"
 config_file="${AWS_CONFIG_FILE:-$HOME/.aws/config}"
 mkdir -p "$HOME/.aws" "$(dirname "$credentials_file")" "$(dirname "$config_file")"
 chmod 700 "$HOME/.aws"
 
+profile_names="$(printf '%s' "$profiles_json" \
+  | jq -r --arg namespace "$PROFILE_NAMESPACE" 'keys | map($namespace + "-agent-" + .) | join(", ")')"
+
+# Migration: the previous convention's profiles are still on this workstation.
+#
+# They are reported rather than removed, because deleting a profile an operator
+# may still be using is its own silent surprise. Pruning is opt-in and says
+# exactly what it removed.
+legacy_sections="$(legacy_profile_sections "$config_file")"
+legacy_names=""
+if [ -n "$legacy_sections" ]; then
+  legacy_names="$(printf '%s\n' "$legacy_sections" | sed 's/^profile //' | paste -sd ',' - | sed 's/,/, /g')"
+  if [ "${LISA_AWS_PRUNE_LEGACY_PROFILES:-0}" = "1" ]; then
+    printf '%s\n' "$legacy_sections" | while IFS= read -r section; do
+      [ -n "$section" ] || continue
+      remove_profile_section "$config_file" "$section"
+    done
+    remove_profile_section "$config_file" "profile ${LEGACY_BOOTSTRAP_PROFILE}"
+    remove_profile_section "$credentials_file" "$LEGACY_BOOTSTRAP_PROFILE"
+  fi
+fi
+
+default_owner="$(default_profile_owner)"
+case "$default_owner" in
+  ours | legacy | unclaimed) ;;
+  *)
+    [ "${LISA_AWS_CLAIM_DEFAULT_PROFILE:-0}" = "1" ] || fail \
+      "refusing to overwrite the [default] AWS profile in ${config_file}: it belongs to ${default_owner}, not to ${PROFILE_NAMESPACE}. Overwriting it would silently repoint every unqualified aws command at this project's accounts. Use the named profiles instead (${profile_names}), or set LISA_AWS_CLAIM_DEFAULT_PROFILE=1 to take it over deliberately."
+    ;;
+esac
+
 aws configure set aws_access_key_id "$access_key_id" --profile "$BOOTSTRAP_PROFILE"
 aws configure set aws_secret_access_key "$secret_access_key" --profile "$BOOTSTRAP_PROFILE"
 if [ -n "$session_token" ]; then
@@ -208,7 +500,8 @@ else
 fi
 
 session_name="$(sanitize_session_name)"
-while IFS=$'\t' read -r profile_name role_arn region; do
+while IFS="$(printf '\t')" read -r stage role_arn region; do
+  profile_name="${PROFILE_NAMESPACE}-agent-${stage}"
   aws configure set role_arn "$role_arn" --profile "$profile_name"
   aws configure set source_profile "$BOOTSTRAP_PROFILE" --profile "$profile_name"
   aws configure set external_id "$external_id" --profile "$profile_name"
@@ -216,13 +509,7 @@ while IFS=$'\t' read -r profile_name role_arn region; do
   aws configure set region "$region" --profile "$profile_name"
 done < <(printf '%s' "$profiles_json" | jq -r 'to_entries[] | [.key, .value.roleArn, .value.region] | @tsv')
 
-default_profile="${LISA_AWS_DEFAULT_PROFILE:-dev}"
-if ! printf '%s' "$profiles_json" | jq -e --arg profile "$default_profile" 'has($profile)' >/dev/null; then
-  default_profile="$(printf '%s' "$profiles_json" | jq -r 'keys[0]')"
-fi
-
-default_role_arn="$(printf '%s' "$profiles_json" | jq -er --arg profile "$default_profile" '.[$profile].roleArn')"
-default_region="$(printf '%s' "$profiles_json" | jq -er --arg profile "$default_profile" '.[$profile].region')"
+default_profile="${PROFILE_NAMESPACE}-agent-${default_stage}"
 aws configure set role_arn "$default_role_arn" --profile default
 aws configure set source_profile "$BOOTSTRAP_PROFILE" --profile default
 aws configure set external_id "$external_id" --profile default
@@ -232,8 +519,25 @@ aws configure set region "$default_region" --profile default
 chmod 600 "$credentials_file" "$config_file"
 
 if [ "${LISA_AWS_SKIP_VERIFY:-0}" != "1" ]; then
-  AWS_PAGER="" aws sts get-caller-identity --profile "$default_profile" >/dev/null
+  if [ "${LISA_AWS_VERIFY_ALL_PROFILES:-0}" = "1" ]; then
+    while IFS="$(printf '\t')" read -r stage expected_account; do
+      assert_profile_account "${PROFILE_NAMESPACE}-agent-${stage}" "$expected_account" "$stage"
+    done < <(printf '%s' "$profiles_json" | jq -r '
+      to_entries[]
+      | [.key, ((.value.expectedAccountId // (.value.roleArn | split(":")[4])) | tostring)]
+      | @tsv
+    ')
+  else
+    assert_profile_account "$default_profile" "$default_expected_account" "$default_stage"
+  fi
+fi
+
+if [ -n "$legacy_names" ]; then
+  if [ "${LISA_AWS_PRUNE_LEGACY_PROFILES:-0}" = "1" ]; then
+    echo "remote-agent-aws-setup: removed unnamespaced profiles left by an earlier bootstrap: ${legacy_names}" >&2
+  else
+    echo "remote-agent-aws-setup: ${config_file} still contains unnamespaced profiles written by an earlier Lisa bootstrap: ${legacy_names}. They name a stage but no owner, so on a workstation carrying more than one organisation they can resolve to another tenant's account. Review them, or re-run with LISA_AWS_PRUNE_LEGACY_PROFILES=1 to delete the ones Lisa wrote." >&2
+  fi
 fi
 
-profile_names="$(printf '%s' "$profiles_json" | jq -r 'keys | join(", ")')"
-echo "remote-agent-aws-setup: ready (${session_name}; default=${default_profile}; profiles=${profile_names})"
+echo "remote-agent-aws-setup: ready (${session_name}; namespace=${PROFILE_NAMESPACE} via ${namespace_source}; default=${default_profile} in account ${default_expected_account}; profiles=${profile_names})"

package/plugins/lisa-agy/skills/lisa-analyze-claude-remote/SKILL.md

@@ -369,9 +369,9 @@ so the generator can render acquisition comments into its template:
   ],
   "awsProfiles": [
     {
-      "name": "dev",
+      "name": "<project>-agent-dev",
       "roleArn": "arn:aws:iam::<account-id>:role/<role-name>",
-      "credentialSource": "lisa-remote-agent-bootstrap",
+      "credentialSource": "<project>-agent-bootstrap",
       "externalId": "<project-external-id>",
       "region": "us-east-1"
     }

package/plugins/lisa-agy/skills/lisa-implement/SKILL.md

@@ -346,6 +346,16 @@ Before shutting down the team, execute the Verify flow:
 4. Record Implement usage on the originating work artifact via `lisa-usage-accounting` so the work item (or other implementation-owned artifact) gains a direct `lisa-implement` usage entry in the canonical `## Lisa Usage` section. If the parent / child graph is already known, prefer `record_and_rollup` so ancestor totals refresh in the same write; otherwise still write the direct entry, and if runtime usage is unavailable, use `source: unavailable` with nullable token/cost fields instead of skipping the row.
 5. Commit ALL outstanding changes in logical batches on the branch (minus sensitive data/information) — not just changes made by the agent team. This includes pre-existing uncommitted changes that were on the branch before the plan started. Do NOT filter commits to only "task-related" files. If it shows up in git status, it gets committed (unless it contains secrets).
 6. Push the changes - if any pre-push hook blocks you, create a task for the agent team to fix the error/problem whether it was pre-existing or not
+6a. **Review the branch locally BEFORE opening the pull request, every time.** Invoke `lisa-review-local` over the branch diff, triage what it finds under the `convergent-review` rule (same contract as any other reviewer — fix what is valid, refute what is not, on the record), and commit the fixes. Only then proceed to step 7.
+
+    **Unconditional, not a fallback.** Do not gate this on whether a third-party reviewer is available, rate limited, or skipped. Measured on this repository, 47 of the last 60 merged pull requests carried a review context reporting `SUCCESS` while having read nothing — 29 rate limited, 16 skipped because the vendor does not auto-review public repositories, one skipped on size. A rule that fires only when the vendor is absent has to detect four distinct vacuity strings correctly, forever, and still leaves the vendor being *present but wrong* unguarded. Reviewing always needs no detection at all and makes the third-party review **additive**: its findings still arrive at step 8 and are handled there exactly as today.
+
+    **Before the pull request, not after it.** Auto-merge is armed at submit time, so the pull request can merge the moment CI goes green — a review that starts after step 7 is racing a latch that is already set. Running here has nothing to race.
+
+    **A local review is a weaker claim than an independent one, and the report must say so.** The agents reviewing the branch are the same team that wrote it. Record the outcome as *self-reviewed* — never as *reviewed* — and never describe it as satisfying the third-party review check, which is ruleset-required and can only be posted by that vendor's app. Collapsing the two would be the same vacuous-success failure this step exists to remove, one level up.
+
+    **If no subagent delegation is available in this runtime**, say so explicitly in the completion summary and proceed — but record that no local review was possible. "Could not review" must never be reported as "reviewed and found nothing"; an unavailable check is not a passing one.
+
 7. Open a pull request with auto-merge on via `lisa-git-submit-pr`, targeting the **base branch resolved from the ticket's environment** (`target_branch=<base>`, per the branch step above), and including the mandatory work-item ref so the PR can be linked natively to the source issue.
 7a. Confirm two-way linkage before treating PR submission as complete: the PR body/title/branch must reference the work item, and the work item must have either a verified native PR link or the single managed `[lisa-pr-link]` comment. Establish that comment with `node scripts/lisa-work-item.mjs backlink --ref <work_item_ref> --pr-url <url>` rather than posting it by hand — it is idempotent, and it is the same file that enforces the check, so producer and consumer cannot drift.
 8. PR Watch Loop: Drive the PR to merge via the `drive-pr-to-merge` skill — the single source of truth for clearing every blocker (auto-merge with direct-merge fallback, `BEHIND` re-sync, conflict resolution, failing-check fixes, human + bot review-comment handling with thread resolution, stale `CHANGES_REQUESTED` dismissal, and post-merge ancestry verification). `git-submit-pr` already invokes it; if you reach this step with a PR already open, invoke `drive-pr-to-merge` directly with the PR number. For a large review backlog you may fan the code-fix work out to the agent team, but `drive-pr-to-merge` owns the loop and the terminal conditions — do not re-implement them.

package/plugins/lisa-agy/skills/lisa-setup-remote-aws/SKILL.md

@@ -30,14 +30,45 @@ Install the vendor-neutral AWS bootstrap into the current repository.
    `.github/workflows/copilot-setup-steps.yml`; and it always writes
    `docs/remote-agent-aws.md`.
 4. Run `bash -n scripts/remote-agent-aws-setup.sh`.
-5. Never write or request the actual bootstrap bundle in repository files. Tell
+5. Confirm the operator knows which project component the profiles will carry.
+   The script resolves it from `LISA_AWS_PROFILE_NAMESPACE`, then the bundle's
+   `namespace`, then `<owner>-<repository>` from the git origin remote, and
+   refuses to write anything when none resolves. Set the variable explicitly
+   whenever the setup hook runs outside a checkout.
+6. Never write or request the actual bootstrap bundle in repository files. Tell
    the operator where to obtain it and where to put it — see **Where the bundle
    lives** below. Pass `--secret-name` when the source names it something other
    than `remote-agent-credentials`, so the generated runbook contains the exact
    retrieval command.
-6. Report the external step that remains: configure that one secret in the
+7. Report the external step that remains: configure that one secret in the
    remote environment and launch a smoke session.
 
+## Profile naming and readiness
+
+Every profile the script writes is scoped `<project>-agent-<stage>`, and the
+private source profile is `<project>-agent-bootstrap`. Bare stage names state a
+stage but not an owner, so on a workstation carrying more than one organisation
+two bundles declaring the same stages overwrite each other in the shared
+`~/.aws/config` — silently, because nothing about the surviving profile is
+malformed. The name is the only place the owner can be recorded.
+
+`default` cannot be namespaced. The script claims it only when nothing else
+owns it, and otherwise stops and names the current owner;
+`LISA_AWS_CLAIM_DEFAULT_PROFILE=1` takes it over deliberately.
+
+Readiness is an account check, not a liveness check. `sts:GetCallerIdentity`
+succeeding proves the credentials work, not that they reached the intended
+account — a check that ignores the returned value passes on any credential that
+authenticates anywhere. The script compares the returned account id against the
+account named in the role ARN it configured and refuses to report ready on a
+mismatch, quoting both. Do not substitute a hand-run `get-caller-identity` for
+the script's own exit status.
+
+Workstations bootstrapped under the previous unnamespaced convention keep their
+old profiles. They are reported by name on every run and removed only when
+`LISA_AWS_PRUNE_LEGACY_PROFILES=1` is passed, so the migration is explicit in
+both directions.
+
 ## Where the bundle lives
 
 `LISA_AWS_BOOTSTRAP_JSON` is **just another secret**, and it belongs wherever

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.26.4",
+  "version": "4.27.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.26.4",
+  "version": "4.27.0",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.26.4",
+  "version": "4.27.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.26.4",
+  "version": "4.27.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"