@codyswann/lisa 4.27.2 → 4.27.4

package/cdk/create-only/.github/workflows/ci.yml

@@ -18,9 +18,17 @@ jobs:
       cdk_env: ${{ steps.env.outputs.cdk_env }}
       aws_account_id: ${{ steps.env.outputs.aws_account_id }}
       role_arn: ${{ steps.env.outputs.role_arn }}
+      role_name: ${{ steps.env.outputs.role_name }}
     steps:
       - name: 🔄 Set environment
         id: env
+        env:
+          # Non-secret REPOSITORY VARIABLE (Settings → Variables), not a secret
+          # — a role name is not sensitive and secrets are unreadable when you
+          # need to debug this. Read through `env:` rather than interpolated
+          # straight into the shell below, because `${{ vars.* }}` pasted into a
+          # `run:` body is a script-injection seam.
+          CDK_CI_READ_ONLY_ROLE_NAME: ${{ vars.CDK_CI_READ_ONLY_ROLE_NAME }}
         run: |
           # For workflow dispatch, use the input
           if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
@@ -48,25 +56,72 @@ jobs:
 
           echo "environment=$TARGET_ENV" >> $GITHUB_OUTPUT
 
+          # ─────────────────────────────────────────────────────────────────
+          # Pick the AWS identity by TRIGGER, not by environment.
+          #
+          # This job only READS — cdk synth, cdk diff, unit tests — so a pull
+          # request must not be able to obtain deploy credentials. GitHub emits
+          # the SAME OIDC subject for every pull request no matter which branch
+          # it targets:
+          #
+          #   pull_request      -> repo:<owner>/<repo>:pull_request
+          #   workflow_dispatch -> repo:<owner>/<repo>:ref:refs/heads/<branch>
+          #
+          # Because this workflow maps base branch -> account, a deploy role
+          # used here has to trust `...:pull_request` in EVERY account this
+          # repo validates against, production included. Anyone who can open a
+          # pull request could then assume the production deploy role.
+          #
+          # ⚠️ Do NOT collapse this to a single role. The branch is the whole
+          # point. A read-only role whose trust policy admits only the
+          # `pull_request` subject will REFUSE the `ref:refs/heads/<branch>`
+          # subject that workflow_dispatch presents, and the failure is opaque:
+          #
+          #   Not authorized to perform sts:AssumeRoleWithWebIdentity
+          #
+          # with nothing in it naming the subject that was rejected. You would
+          # only discover it the day you reach for the manual-dispatch path.
+          #
+          # To adopt the least-privileged default, create a role (default name
+          # CiReadOnlyServiceRole) in each account, with:
+          #   - a trust policy on the GitHub OIDC provider whose
+          #     token.actions.githubusercontent.com:sub condition is
+          #     repo:<owner>/<repo>:pull_request
+          #   - read-only permissions, plus whatever the CDK bootstrap lookup
+          #     role needs for `cdk synth` / `cdk diff`.
+          # Name it something else? Set the repository VARIABLE
+          # CDK_CI_READ_ONLY_ROLE_NAME. Haven't provisioned it yet? Set that
+          # same variable to DeployServiceRole — behaviour is then identical to
+          # a repo scaffolded before this seam existed, and nothing here breaks.
+          # ─────────────────────────────────────────────────────────────────
+          if [ "${{ github.event_name }}" == "pull_request" ]; then
+            ROLE_NAME="${CDK_CI_READ_ONLY_ROLE_NAME:-CiReadOnlyServiceRole}"
+          else
+            ROLE_NAME="DeployServiceRole"
+          fi
+
+          echo "role_name=$ROLE_NAME" >> $GITHUB_OUTPUT
+
           # Map to CDK environment name.
           # Set your per-environment AWS account IDs as repository or environment
           # secrets: AWS_ACCOUNT_ID_PRODUCTION / AWS_ACCOUNT_ID_STAGING / AWS_ACCOUNT_ID_DEV.
-          # The deploy role name defaults to DeployServiceRole; change it below if yours differs.
+          # The role name comes from the trigger-based selection above — do not
+          # hardcode one here, or the pull-request narrowing is silently undone.
           case $TARGET_ENV in
             production)
               echo "cdk_env=production" >> $GITHUB_OUTPUT
               echo "aws_account_id=${{ secrets.AWS_ACCOUNT_ID_PRODUCTION }}" >> $GITHUB_OUTPUT
-              echo "role_arn=arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID_PRODUCTION }}:role/DeployServiceRole" >> $GITHUB_OUTPUT
+              echo "role_arn=arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID_PRODUCTION }}:role/$ROLE_NAME" >> $GITHUB_OUTPUT
               ;;
             staging)
               echo "cdk_env=staging" >> $GITHUB_OUTPUT
               echo "aws_account_id=${{ secrets.AWS_ACCOUNT_ID_STAGING }}" >> $GITHUB_OUTPUT
-              echo "role_arn=arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID_STAGING }}:role/DeployServiceRole" >> $GITHUB_OUTPUT
+              echo "role_arn=arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID_STAGING }}:role/$ROLE_NAME" >> $GITHUB_OUTPUT
               ;;
             dev|*)
               echo "cdk_env=dev" >> $GITHUB_OUTPUT
               echo "aws_account_id=${{ secrets.AWS_ACCOUNT_ID_DEV }}" >> $GITHUB_OUTPUT
-              echo "role_arn=arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID_DEV }}:role/DeployServiceRole" >> $GITHUB_OUTPUT
+              echo "role_arn=arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID_DEV }}:role/$ROLE_NAME" >> $GITHUB_OUTPUT
               ;;
           esac
 
@@ -104,6 +159,26 @@ jobs:
           role-session-name: cdk-ci-checks
           aws-region: us-east-1
 
+      - name: 🪪 Verify assumed identity
+        id: verify_identity
+        env:
+          EXPECTED_ROLE: ${{ needs.determine_environment.outputs.role_name }}
+        run: |
+          # Every remaining step in this job only reads, so a silent revert to
+          # the deploy role would pass all of them. Without this assertion the
+          # over-privilege regression is invisible. sts:GetCallerIdentity needs
+          # no IAM permissions at all, so it works under the read-only role.
+          CALLER_ARN="$(aws sts get-caller-identity --query Arn --output text)"
+          case "${CALLER_ARN}" in
+            *":assumed-role/${EXPECTED_ROLE}/"*)
+              echo "✅ assumed ${EXPECTED_ROLE}"
+              ;;
+            *)
+              echo "::error::Expected to assume ${EXPECTED_ROLE}, but the caller identity is ${CALLER_ARN}"
+              exit 1
+              ;;
+          esac
+
       - name: 📋 CDK Synth
         run: |
           echo "🔍 Running CDK synth for ${{ needs.determine_environment.outputs.environment }} environment..."

package/dist/core/nightly-e2e-guard-behavior-certificate.js

@@ -20,9 +20,9 @@ export const NIGHTLY_E2E_GUARD_BEHAVIOR_CERTIFICATES = Object.freeze({
     }),
     "312e8962e21be2f3c6c6c0235b0c6159b8dc39425508b4965c7df87fb1333380": Object.freeze({
         contractVersion: "1.9.0",
-        packageVersions: Object.freeze(["4.27.2"]),
+        packageVersions: Object.freeze(["4.27.4"]),
         provenances: Object.freeze([
-            "workspace package @codyswann/lisa@4.27.2 (typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs)",
+            "workspace package @codyswann/lisa@4.27.4 (typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs)",
         ]),
     }),
     "898ee0247806c7aa6e98328662d80bcff22ff067999298865462a58daef8bb22": Object.freeze({

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAw8EpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAi4PjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA08EpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CA44PjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -56,7 +56,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "cdk/copy-overwrite/tsconfig.json": "bd960df819bb1ce01163ac4b28721eea3f07d482f6c454cfea9a8dc90191033a",
     "cdk/copy-overwrite/vitest.cdk.ts": "030158b11bec4f10b39585feb98f498981f307faa1fa314c7522e6def5d73c94",
     "cdk/copy-overwrite/vitest.config.ts": "c7f309d4f43d9188b9c067cb4900b2bdbacfbd28d135a6a2e6313cb0a37b030f",
-    "cdk/create-only/.github/workflows/ci.yml": "98bd4b784a5a0a96bedc40c209f5bf5afe97fa422c200533d4544990a69a5c1a",
+    "cdk/create-only/.github/workflows/ci.yml": "2cb902c76ebd5235c8152f1fa0f2caae3a20a409ac0da747d19d29185047a418",
     "cdk/create-only/.github/workflows/deploy.yml": "f32ec7eecc7451812213fc66f1a6fa4b360137c586d47ede06747f04eb557251",
     "cdk/create-only/cdk.json": "f89030d8fe145a1dbabd59d89ddee4e16984f222d737f7fcf6b778d911e9fe40",
     "cdk/create-only/tsconfig.local.json": "d26253827e21fd7c41d30565fe3d339675f119e00bb24c5713a01f57ccd06602",
@@ -263,8 +263,8 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/agents/learner.md": "1e43e74801354e3ed29beed787a673b99599b442d69d8f769829273fdd1c293b",
     "plugins/src/base/agents/learning-judge.md": "28618c3e20a0f790e4d254a9c8118645774233f19e3042b3cfeddf4ffbaf783a",
     "plugins/src/base/agents/learnings-synthesizer.md": "d3ffc4294df44813772d8c2641ebbd79a97cbc9051fa88b407ef7bfdc5b8e0d9",
-    "plugins/src/base/agents/linear-agent.md": "d55664da47505d702d9bbbb96f9f98930d871acc5fc2972d35e1ae143f2dbde7",
-    "plugins/src/base/agents/linear-build-intake.md": "1dbc43b74857a1f6d99394a206a510d95c0875946fa6f4d94f90706cbd29e7b4",
+    "plugins/src/base/agents/linear-agent.md": "165a7ec3df84402c12d768e61e5cea8530abdd68030024e3a5131136e9f1f75f",
+    "plugins/src/base/agents/linear-build-intake.md": "8cb476b76bf4a00e0e91c2d6224b2a54b7c6892436b79bec57ff6e88f3d8ff49",
     "plugins/src/base/agents/linear-prd-intake.md": "28c4ee9f2ebbb4f089dd54bb4633063b48ea8099327a0bf2923825d83c3fe07c",
     "plugins/src/base/agents/notion-prd-intake.md": "53df0fba395b10b17bafe1a82c8c2706e4ec029d2aee8f3a2e7d5afe38d9be98",
     "plugins/src/base/agents/performance-specialist.md": "39c088eaf9347410988a82310e3a151034cbac28a756b1c7b28bb4c1c32a6a5d",
@@ -501,6 +501,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/scripts/intake-blocker-reprobe.mjs": "135a9b5a0894f70562b54d2071caff1e679c0fe542a606caca39e9e6a5b65f24",
     "plugins/src/base/scripts/intake-prework-denominator.mjs": "0a40cb91ab1c0e810f42d035d9652af3033e97c692b93b911de851991c12eca1",
     "plugins/src/base/scripts/lifecycle-label-trust.mjs": "0a9892890da6011733bf9b1186fbe936253c2796c4ac448f1a55f63b8daaa154",
+    "plugins/src/base/scripts/linear-state-write-target.mjs": "2c06525345b47a93e8ad75566d4a7d0cac6850ce30cf0481120ad88146d4c220",
     "plugins/src/base/scripts/plugin-sync-explain.mjs": "17cc7dde8f269b0cbc848c6385d6630a5926327c24e5769b2a16ed7d6aba2d76",
     "plugins/src/base/scripts/project-ideation-idempotency-harness.mjs": "5722de5c53efb033051442f965d0873beb9cdb18aa1d3f5cd82151b5fb9ed529",
     "plugins/src/base/scripts/queue-contract-resolution.mjs": "5944dd862f949155db1f4e43279041407dc2c920723cee808fa353dc0bdd2c6e",
@@ -589,20 +590,20 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-jsdoc-best-practices/SKILL.md": "7cf0729966ac0afcab6e2c043f192772a9e9e7c72fae61e55b300e97308f970e",
     "plugins/src/base/skills/lisa-kane-browser/SKILL.md": "e082517cb42f437eeb22b3935aa0fef09299874736e55184e88d2b64f7860a7d",
     "plugins/src/base/skills/lisa-learnings-audit/SKILL.md": "98a1c4916f376a3f85008c43a4dde033c374ed0a6111a8094f72296973c5d21b",
-    "plugins/src/base/skills/lisa-linear-access/SKILL.md": "f6644b11ad2d730795471acf826e52b284e310de70923b65a78f14b58242cf15",
+    "plugins/src/base/skills/lisa-linear-access/SKILL.md": "2f25e54f3f91a8b3b4c0cdb7dc53f0314a20bb78e2fe102edd93fc4380cefbe0",
     "plugins/src/base/skills/lisa-linear-add-journey/SKILL.md": "0a9f2bd0e19fbaa4794537e436c22748c7621644253a91923d84bc77ca43f793",
-    "plugins/src/base/skills/lisa-linear-build-intake/SKILL.md": "9c2d59a903ef2778ccf249136d8b561a6c381596631b6d35e6f469fd74497cee",
-    "plugins/src/base/skills/lisa-linear-claim/SKILL.md": "d3fee9a0435e93402be53769313f971c77b847521826fbaee0d19a0bdbc34b93",
+    "plugins/src/base/skills/lisa-linear-build-intake/SKILL.md": "969da0c138ad3297900149507039f848f9b42919ade4b46f6f5a1167d1944df6",
+    "plugins/src/base/skills/lisa-linear-claim/SKILL.md": "efde30b5eac8b2cc56499ce391bd3d43ebb017c4ce948b5d547b52acb66715bb",
     "plugins/src/base/skills/lisa-linear-create/SKILL.md": "b9b0b89903fc980e7b591109cffcf377f7397cc6c7b6110975d0b21bafb6de2e",
-    "plugins/src/base/skills/lisa-linear-evidence/SKILL.md": "aaf40dc38149b160a2ec9edf72de94813305b17425104eb6ed6502197212dfb6",
+    "plugins/src/base/skills/lisa-linear-evidence/SKILL.md": "e25f8ab93f5204ac55c99c6cba5fe53cc4ad792c0140553eef7d3478ffb69694",
     "plugins/src/base/skills/lisa-linear-journey/SKILL.md": "6f189eba5d96f8537883277de1d2d6c87d08226e90df5dd73f16852b0a46224e",
     "plugins/src/base/skills/lisa-linear-prd-intake/SKILL.md": "39753c2143e88a685c2b804ada37c950989f67f2c300771bb2df67829dfbfb71",
     "plugins/src/base/skills/lisa-linear-read-issue/SKILL.md": "a6b8241648ba4b7b9f1196a37e9924ffaccc5461f3ac2ee8ae283c58559e9717",
-    "plugins/src/base/skills/lisa-linear-sync/SKILL.md": "2d75d9954a6c8a7ef43d55c18c9894d0b34358f67fb53ced0ee568f142dbc268",
+    "plugins/src/base/skills/lisa-linear-sync/SKILL.md": "30ef30a6f6dbf173437b25bb2bddca6d9adf63fa3db7ec499ae24d7510fa0e90",
     "plugins/src/base/skills/lisa-linear-to-tracker/SKILL.md": "3190bbf85223c7a0508f8bc894fd2c21fc9dce4c977a5af2252191d09c0c6f97",
     "plugins/src/base/skills/lisa-linear-validate-issue/SKILL.md": "db1c68a80c29e0d7b1f8431eaa02f43c0e7c65ff4f0af0f3d54ca772f22c0d4c",
     "plugins/src/base/skills/lisa-linear-verify/SKILL.md": "d11a58bd7c2b773a973fe8f8ad19a2621f038327ee2d8afa3039bd72885f5e97",
-    "plugins/src/base/skills/lisa-linear-write-issue/SKILL.md": "37fdce274949ecaaaa38f0cfe9208add08a0e47ca73acf976549b47b49f841a6",
+    "plugins/src/base/skills/lisa-linear-write-issue/SKILL.md": "cc3298e2b3f1cb1df12e0af3736fd5f1f64c90246c150c7cdf55587adb34b3c9",
     "plugins/src/base/skills/lisa-linear-write-prd/SKILL.md": "ad4289b5530d65d3b61b27da54db8cd7f8e9133f97326d8961f853f364c5b457",
     "plugins/src/base/skills/lisa-monitor/SKILL.md": "e441767176da88484b8034df9589cb33240d5d895339ee96926917a52a103423",
     "plugins/src/base/skills/lisa-nightly-add-test-coverage/SKILL.md": "1e8d7c9519e107ca21aaa9438515b4d51fac4cd25f2a0f80bdb4e037ac89856c",
@@ -643,7 +644,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-queue-status/SKILL.md": "87c6d34d0511d4afd812d1af3fee80fa3b7aa47db8449760b12f2699fedc1d78",
     "plugins/src/base/skills/lisa-remote-dispatch/SKILL.md": "f3c48120a206d01db45f849ca5b61690d572abc16bc36d559a4cacc8f9422c06",
     "plugins/src/base/skills/lisa-remote-dispatch/scripts/dispatch.mjs": "2c51d388ecb681905f6b2280ffefc03434f91bfe4901e637869b716be81ccc93",
-    "plugins/src/base/skills/lisa-repair-intake/SKILL.md": "1a35f239dbd763129ba6f5aeb00ffaa5b2e6d67cf08a956d91710874e8b6779b",
+    "plugins/src/base/skills/lisa-repair-intake/SKILL.md": "760c05581d5ac8cf3b4b7c3ab46b097367807828238461cdc07d8086a1dd40e7",
     "plugins/src/base/skills/lisa-reproduce-bug/SKILL.md": "4d460993fac6021219ca23eee29b1b9afa7c37479dddc662b2fcfaca510edd68",
     "plugins/src/base/skills/lisa-research/SKILL.md": "9e2e7f3d02a18d9bb34f0b9e8c43d6b9b454d0f81987390839d40a84331b20f7",
     "plugins/src/base/skills/lisa-review-implementation/SKILL.md": "42134253cca50e384f36eaa085c0a1e6b8772e9f3e912a8d1231f1cd69199858",
@@ -681,7 +682,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-setup-github/SKILL.md": "75435e81130abd21c678d302b7a220da95a19868d122ca93168278628b200666",
     "plugins/src/base/skills/lisa-setup-jira/SKILL.md": "261acaeb2923cc9238f468dcf986a0e1323a67e1e51d175b2c1b700dacab2fb8",
     "plugins/src/base/skills/lisa-setup-kane/SKILL.md": "fe50024a4f896af01716f2435f57227b1f8de61803e80bf3e3c3247ec179b103",
-    "plugins/src/base/skills/lisa-setup-linear/SKILL.md": "b4a495927481bba1341edc841a6c487161de86aede3f423d740967641c66983e",
+    "plugins/src/base/skills/lisa-setup-linear/SKILL.md": "dff849db2697c122aa2f09c4d7f7237edac550077725a1e4149e078723fc0442",
     "plugins/src/base/skills/lisa-setup-local-env/SKILL.md": "4d4b8c92e3616256f5f689fbe433f09c31d39c623508bc4ec0d8c1770caddf22",
     "plugins/src/base/skills/lisa-setup-local-env/scripts/local-env.mjs": "6f3713451139d9d4fd8eed8f11f49e472667394c4f9a7cae63897b7702115687",
     "plugins/src/base/skills/lisa-setup-notion/SKILL.md": "667d3767dfb06056145d1ad3f64a6ebfa012b61c19cb2c5f82cf1f6534499c38",
@@ -726,7 +727,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-tracker-write/SKILL.md": "3c2e12ef37a8e20abe4d7ce4d01799dc2bc7b5304f6a18108da8f2318be31da1",
     "plugins/src/base/skills/lisa-usage-accounting/SKILL.md": "838da4ca08fb6e6a4bc14b6cb5446be93c4565f468f169a1ec68435d275d1ef8",
     "plugins/src/base/skills/lisa-use-the-product/SKILL.md": "ab3f3ab475b7c97c3409f502b80d688816b1ff4b8e3dfeec7715d93ca41e3fa0",
-    "plugins/src/base/skills/lisa-validate-tracker-mapping/SKILL.md": "b8a5082205428b43d463fa63e4629cc50bf1b417a2615db6fa0660474c55f1ae",
+    "plugins/src/base/skills/lisa-validate-tracker-mapping/SKILL.md": "092958f58fb6db9ca37e8e11b7e8eaf0d1ec8d882ab35ad88ea59d1b16501ba1",
     "plugins/src/base/skills/lisa-verification-lifecycle/SKILL.md": "3fbcb619281a91f229e4564549b7f7d0ea68e7fd2d874820515846f8cbd6e0e7",
     "plugins/src/base/skills/lisa-verify-prd/SKILL.md": "fd4dc76c42c1083f5223e650f6c25d53694138860ebcb02588689f6eb6d0b416",
     "plugins/src/base/skills/lisa-verify-workflow-change/SKILL.md": "d89740a4dc350a9ac0d26b1b955bf74f009775b60ee0275df3f9a50fe8be3048",
@@ -2279,6 +2280,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-agy/scripts/intake-blocker-reprobe.mjs": true,
     "plugins/lisa-agy/scripts/intake-prework-denominator.mjs": true,
     "plugins/lisa-agy/scripts/lifecycle-label-trust.mjs": true,
+    "plugins/lisa-agy/scripts/linear-state-write-target.mjs": true,
     "plugins/lisa-agy/scripts/plugin-sync-explain.mjs": true,
     "plugins/lisa-agy/scripts/project-ideation-idempotency-harness.mjs": true,
     "plugins/lisa-agy/scripts/queue-contract-resolution.mjs": true,
@@ -2767,6 +2769,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-copilot/scripts/intake-blocker-reprobe.mjs": true,
     "plugins/lisa-copilot/scripts/intake-prework-denominator.mjs": true,
     "plugins/lisa-copilot/scripts/lifecycle-label-trust.mjs": true,
+    "plugins/lisa-copilot/scripts/linear-state-write-target.mjs": true,
     "plugins/lisa-copilot/scripts/plugin-sync-explain.mjs": true,
     "plugins/lisa-copilot/scripts/project-ideation-idempotency-harness.mjs": true,
     "plugins/lisa-copilot/scripts/queue-contract-resolution.mjs": true,
@@ -3241,6 +3244,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-cursor/scripts/intake-blocker-reprobe.mjs": true,
     "plugins/lisa-cursor/scripts/intake-prework-denominator.mjs": true,
     "plugins/lisa-cursor/scripts/lifecycle-label-trust.mjs": true,
+    "plugins/lisa-cursor/scripts/linear-state-write-target.mjs": true,
     "plugins/lisa-cursor/scripts/plugin-sync-explain.mjs": true,
     "plugins/lisa-cursor/scripts/project-ideation-idempotency-harness.mjs": true,
     "plugins/lisa-cursor/scripts/queue-contract-resolution.mjs": true,
@@ -5830,6 +5834,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa/scripts/intake-blocker-reprobe.mjs": true,
     "plugins/lisa/scripts/intake-prework-denominator.mjs": true,
     "plugins/lisa/scripts/lifecycle-label-trust.mjs": true,
+    "plugins/lisa/scripts/linear-state-write-target.mjs": true,
     "plugins/lisa/scripts/plugin-sync-explain.mjs": true,
     "plugins/lisa/scripts/project-ideation-idempotency-harness.mjs": true,
     "plugins/lisa/scripts/queue-contract-resolution.mjs": true,
@@ -6487,6 +6492,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/src/base/scripts/intake-blocker-reprobe.mjs": true,
     "plugins/src/base/scripts/intake-prework-denominator.mjs": true,
     "plugins/src/base/scripts/lifecycle-label-trust.mjs": true,
+    "plugins/src/base/scripts/linear-state-write-target.mjs": true,
     "plugins/src/base/scripts/plugin-sync-explain.mjs": true,
     "plugins/src/base/scripts/project-ideation-idempotency-harness.mjs": true,
     "plugins/src/base/scripts/queue-contract-resolution.mjs": true,
@@ -7830,6 +7836,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/integration/apply-reports-unchanged-manifest.test.ts": true,
     "tests/integration/apply-unattended-preserves-host-config.test.ts": true,
     "tests/integration/bootstrap-keychain.test.ts": true,
+    "tests/integration/cdk-ci-role-selection.test.ts": true,
     "tests/integration/cli-smoke.test.ts": true,
     "tests/integration/coverage-scratch-debris.test.ts": true,
     "tests/integration/deletion-reference-guard.test.ts": true,
@@ -7940,6 +7947,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/integration/standards-proof-tamper.test.ts": true,
     "tests/integration/standards-proof-timeout.test.ts": true,
     "tests/integration/standards-proof-typescript.test.ts": true,
+    "tests/integration/support/cdk-ci-role-selection-harness.ts": true,
     "tests/integration/support/maestro-android-retry-fixtures.ts": true,
     "tests/integration/support/maestro-android-retry-harness.ts": true,
     "tests/integration/support/maestro-build-step-harness.ts": true,
@@ -8854,7 +8862,11 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/strategies/lifecycle-label-trust.test.ts": true,
     "tests/unit/strategies/linear-access-history.test.ts": true,
     "tests/unit/strategies/linear-key-resolver-ladder-parity.test.ts": true,
+    "tests/unit/strategies/linear-lifecycle-guard-parity.test.ts": true,
     "tests/unit/strategies/linear-ready-state-inversion.test.ts": true,
+    "tests/unit/strategies/linear-state-write-fixtures.ts": true,
+    "tests/unit/strategies/linear-state-write-guard.test.ts": true,
+    "tests/unit/strategies/linear-state-write-sink.test.ts": true,
     "tests/unit/strategies/merge.test.ts": true,
     "tests/unit/strategies/mld-telemetry-contract.test.ts": true,
     "tests/unit/strategies/monitor-threshold-compatibility.test.ts": true,