@codyswann/lisa 4.27.4 → 4.27.6

package/dist/migrations/ensure-push-default-safe.d.ts

@@ -0,0 +1,50 @@
+import type { Migration, MigrationContext, MigrationResult } from "./migration.interface.js";
+/**
+ * Migration: stop a push from inheriting its destination from the upstream ref.
+ *
+ * With `push.default=upstream`, git resolves a push's destination from the
+ * branch's upstream instead of from the branch it was told to push. A working
+ * branch created the ordinary way — `git checkout -b <branch> origin/main` —
+ * has `main` as its upstream, so the ordinary `git push -u origin <branch>`
+ * resolves to `refs/heads/main` and lands there. The push reports success;
+ * branch protection and every required check are bypassed; the operator is told
+ * only afterwards, if at all.
+ *
+ * Measured in Lisa's own repository (CodySwannGT/lisa#3495): two commits
+ * reached the default branch this way. Every detection control afterwards fired
+ * correctly — the bypass was reported, the agent force-push was refused, the
+ * release run was caught and cancelled — and the commits shipped in a published
+ * release regardless, because an ordinary unrelated merge cut a release before
+ * anyone could rewind. Nothing had prevented the original push, and prevention
+ * turned out to be the only control that would have mattered.
+ *
+ * The rewrite is deliberately narrow. Only `upstream` and `tracking` are
+ * touched; `simple`, `current`, `matching`, and `nothing` are left exactly as
+ * the host set them, because none of them resolve a destination the pusher did
+ * not name. The write is `--local`, which shadows a global setting rather than
+ * editing the user's global config — this repository's problem to fix is this
+ * repository, not the machine.
+ *
+ * This is one half of the fix and the weaker half: it disarms the trap but
+ * cannot bind a clone made before it ran, and it does not survive a host
+ * setting the value back. The `validate-push-destination` guard in the pre-push
+ * hook is the other half, and it reads the destination git actually resolved
+ * rather than the config that produced it.
+ */
+export declare class EnsurePushDefaultSafeMigration implements Migration {
+    readonly name = "ensure-push-default-safe";
+    readonly description = "Set push.default=simple locally where it currently resolves a push's destination from the upstream ref, so a feature-branch push cannot land on the default branch";
+    /**
+     * Applies only where `push.default` currently inherits the destination.
+     * @param ctx - Migration context
+     * @returns True when there is work to do
+     */
+    applies(ctx: MigrationContext): Promise<boolean>;
+    /**
+     * Rewrite the inheriting value to the safe one in local git config.
+     * @param ctx - Migration context
+     * @returns Result describing the action taken
+     */
+    apply(ctx: MigrationContext): Promise<MigrationResult>;
+}
+//# sourceMappingURL=ensure-push-default-safe.d.ts.map

package/dist/migrations/ensure-push-default-safe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-push-default-safe.d.ts","sourceRoot":"","sources":["../../src/migrations/ensure-push-default-safe.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAgGlC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,qBAAa,8BAA+B,YAAW,SAAS;IAC9D,QAAQ,CAAC,IAAI,8BAA8B;IAC3C,QAAQ,CAAC,WAAW,wKAA+K;IAEnM;;;;OAIG;IACG,OAAO,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAKtD;;;;OAIG;IACG,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;CAgB7D"}

package/dist/migrations/ensure-push-default-safe.js

@@ -0,0 +1,159 @@
+/** Minimal environment for project-scoped git commands, free of caller hook state. */
+const GIT_COMMAND_ENV = {
+    PATH: "/usr/bin:/bin:/usr/sbin:/sbin",
+};
+/**
+ * The two `push.default` values that resolve a push's destination from the
+ * branch's UPSTREAM rather than from its own name.
+ *
+ * `tracking` is the deprecated spelling of `upstream`; git still honours it, so
+ * a guard that only knew the modern name would leave half the trap armed.
+ */
+const INHERITING_VALUES = new Set([
+    "upstream",
+    "tracking",
+]);
+/** What the inheriting values are rewritten to — git's own default since 2.0. */
+const SAFE_VALUE = "simple";
+/**
+ * Read the effective `push.default` for a project, or undefined when unset.
+ *
+ * Reads the EFFECTIVE value, not the local one. A repository inherits
+ * `push.default` from the user's global config just as readily as from its own
+ * `.git/config`, and the accident this migration disarms does not care which
+ * file the value came from.
+ * @param cwd - Project directory
+ * @returns The configured value lowercased, or undefined when unset or unreadable
+ */
+async function readPushDefault(cwd) {
+    const { exec } = await import("node:child_process");
+    const { promisify } = await import("node:util");
+    const run = promisify(exec);
+    try {
+        const { stdout } = await run("git config --get push.default", {
+            cwd,
+            env: GIT_COMMAND_ENV,
+        });
+        const value = stdout.trim().toLowerCase();
+        return value === "" ? undefined : value;
+    }
+    catch {
+        // Exit 1 means "not set", which is git's default `simple` and needs no fix.
+        // Any other failure means this is not a readable git directory, which is
+        // equally nothing to do here.
+        return undefined;
+    }
+}
+/**
+ * Write the safe value into one git config scope.
+ * @param cwd - Project directory
+ * @param scope - Config scope flag, `--local` or `--worktree`
+ * @returns True when the write succeeded
+ */
+async function writePushDefault(cwd, scope) {
+    const { exec } = await import("node:child_process");
+    const { promisify } = await import("node:util");
+    const run = promisify(exec);
+    try {
+        await run(`git config ${scope} push.default ${SAFE_VALUE}`, {
+            cwd,
+            env: GIT_COMMAND_ENV,
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Set `push.default` to the safe value and PROVE it took effect.
+ *
+ * A `--local` write is not always the last word. With
+ * `extensions.worktreeConfig` enabled, a `push.default` living in
+ * `config.worktree` outranks `config`, so the local write lands, exits zero,
+ * and the effective value is still `upstream` — a migration reporting success
+ * over a trap that is still armed. That is the same shape as the defect this
+ * whole change is about (a command that reports what it did rather than what
+ * happened), so it is checked rather than assumed: write, re-read the
+ * EFFECTIVE value, and escalate to `--worktree` only if the local write did
+ * not move it.
+ * @param cwd - Project directory
+ * @returns True only when the effective value is now safe
+ */
+async function applySafePushDefault(cwd) {
+    if (!(await writePushDefault(cwd, "--local")))
+        return false;
+    if (!INHERITING_VALUES.has((await readPushDefault(cwd)) ?? SAFE_VALUE)) {
+        return true;
+    }
+    if (!(await writePushDefault(cwd, "--worktree")))
+        return false;
+    return !INHERITING_VALUES.has((await readPushDefault(cwd)) ?? SAFE_VALUE);
+}
+/**
+ * Migration: stop a push from inheriting its destination from the upstream ref.
+ *
+ * With `push.default=upstream`, git resolves a push's destination from the
+ * branch's upstream instead of from the branch it was told to push. A working
+ * branch created the ordinary way — `git checkout -b <branch> origin/main` —
+ * has `main` as its upstream, so the ordinary `git push -u origin <branch>`
+ * resolves to `refs/heads/main` and lands there. The push reports success;
+ * branch protection and every required check are bypassed; the operator is told
+ * only afterwards, if at all.
+ *
+ * Measured in Lisa's own repository (CodySwannGT/lisa#3495): two commits
+ * reached the default branch this way. Every detection control afterwards fired
+ * correctly — the bypass was reported, the agent force-push was refused, the
+ * release run was caught and cancelled — and the commits shipped in a published
+ * release regardless, because an ordinary unrelated merge cut a release before
+ * anyone could rewind. Nothing had prevented the original push, and prevention
+ * turned out to be the only control that would have mattered.
+ *
+ * The rewrite is deliberately narrow. Only `upstream` and `tracking` are
+ * touched; `simple`, `current`, `matching`, and `nothing` are left exactly as
+ * the host set them, because none of them resolve a destination the pusher did
+ * not name. The write is `--local`, which shadows a global setting rather than
+ * editing the user's global config — this repository's problem to fix is this
+ * repository, not the machine.
+ *
+ * This is one half of the fix and the weaker half: it disarms the trap but
+ * cannot bind a clone made before it ran, and it does not survive a host
+ * setting the value back. The `validate-push-destination` guard in the pre-push
+ * hook is the other half, and it reads the destination git actually resolved
+ * rather than the config that produced it.
+ */
+export class EnsurePushDefaultSafeMigration {
+    name = "ensure-push-default-safe";
+    description = `Set push.default=${SAFE_VALUE} locally where it currently resolves a push's destination from the upstream ref, so a feature-branch push cannot land on the default branch`;
+    /**
+     * Applies only where `push.default` currently inherits the destination.
+     * @param ctx - Migration context
+     * @returns True when there is work to do
+     */
+    async applies(ctx) {
+        const current = await readPushDefault(ctx.projectDir);
+        return current !== undefined && INHERITING_VALUES.has(current);
+    }
+    /**
+     * Rewrite the inheriting value to the safe one in local git config.
+     * @param ctx - Migration context
+     * @returns Result describing the action taken
+     */
+    async apply(ctx) {
+        const current = await readPushDefault(ctx.projectDir);
+        if (current === undefined || !INHERITING_VALUES.has(current)) {
+            return { name: this.name, action: "noop" };
+        }
+        const detail = `push.default was "${current}", which resolves a push's destination from the branch's upstream — a feature branch created from the default branch would push straight to it. Set to "${SAFE_VALUE}" locally.`;
+        if (ctx.dryRun) {
+            ctx.logger.dry(`Would set push.default=${SAFE_VALUE} (was "${current}")`);
+            return { name: this.name, action: "applied", message: detail };
+        }
+        if (!(await applySafePushDefault(ctx.projectDir))) {
+            return { name: this.name, action: "noop" };
+        }
+        ctx.logger.success(detail);
+        return { name: this.name, action: "applied", message: detail };
+    }
+}
+//# sourceMappingURL=ensure-push-default-safe.js.map

package/dist/migrations/ensure-push-default-safe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-push-default-safe.js","sourceRoot":"","sources":["../../src/migrations/ensure-push-default-safe.ts"],"names":[],"mappings":"AAMA,sFAAsF;AACtF,MAAM,eAAe,GAAsB;IACzC,IAAI,EAAE,+BAA+B;CACtC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,UAAU;IACV,UAAU;CACX,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,UAAU,GAAG,QAAQ,CAAC;AAE5B;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAAC,GAAW;IACxC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACpD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,+BAA+B,EAAE;YAC5D,GAAG;YACH,GAAG,EAAE,eAAe;SACrB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,yEAAyE;QACzE,8BAA8B;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,KAAa;IACxD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACpD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,cAAc,KAAK,iBAAiB,UAAU,EAAE,EAAE;YAC1D,GAAG;YACH,GAAG,EAAE,eAAe;SACrB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,oBAAoB,CAAC,GAAW;IAC7C,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,OAAO,8BAA8B;IAChC,IAAI,GAAG,0BAA0B,CAAC;IAClC,WAAW,GAAG,oBAAoB,UAAU,6IAA6I,CAAC;IAEnM;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,GAAqB;QACjC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACtD,OAAO,OAAO,KAAK,SAAS,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,GAAqB;QAC/B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC7C,CAAC;QACD,MAAM,MAAM,GAAG,qBAAqB,OAAO,2JAA2J,UAAU,YAAY,CAAC;QAC7N,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,UAAU,UAAU,OAAO,IAAI,CAAC,CAAC;YAC1E,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC7C,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACjE,CAAC;CACF"}

package/dist/migrations/index.d.ts

@@ -9,6 +9,7 @@ export { EnsureNightlyE2EWorkflowPinsMigration } from "./ensure-nightly-e2e-work
 export { EnsureLisaPostinstallMigration } from "./ensure-lisa-postinstall.js";
 export { EnsureOxlintBaseConfigsMigration } from "./ensure-oxlint-base-configs.js";
 export { EnsurePlaywrightDedicatedCallerMigration } from "./ensure-playwright-dedicated-caller.js";
+export { EnsurePushDefaultSafeMigration } from "./ensure-push-default-safe.js";
 export { EnsureQualityCallerScopesMigration } from "./ensure-quality-caller-scopes.js";
 export { EnsureSeededGatesMigration } from "./ensure-seeded-gates.js";
 export { EnsureSonarExcludesLisaHarnessMigration } from "./ensure-sonar-excludes-lisa-harness.js";

package/dist/migrations/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAE,qCAAqC,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAElF;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuB;IAElD;;;OAGG;gBACS,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE;IAsB7C;;;OAGG;IACH,MAAM,IAAI,SAAS,SAAS,EAAE;IAI9B;;;;OAIG;IACG,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/D;;;;OAIG;IACG,MAAM,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC;CAazE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,iBAAiB,CAE3D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAE,qCAAqC,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAElF;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuB;IAElD;;;OAGG;gBACS,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE;IAuB7C;;;OAGG;IACH,MAAM,IAAI,SAAS,SAAS,EAAE;IAI9B;;;;OAIG;IACG,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/D;;;;OAIG;IACG,MAAM,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC;CAazE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,iBAAiB,CAE3D"}

package/dist/migrations/index.js

@@ -7,6 +7,7 @@ import { EnsureNightlyE2EWorkflowPinsMigration } from "./ensure-nightly-e2e-work
 import { EnsureLisaPostinstallMigration } from "./ensure-lisa-postinstall.js";
 import { EnsureOxlintBaseConfigsMigration } from "./ensure-oxlint-base-configs.js";
 import { EnsurePlaywrightDedicatedCallerMigration } from "./ensure-playwright-dedicated-caller.js";
+import { EnsurePushDefaultSafeMigration } from "./ensure-push-default-safe.js";
 import { EnsureQualityCallerScopesMigration } from "./ensure-quality-caller-scopes.js";
 import { EnsureSeededGatesMigration } from "./ensure-seeded-gates.js";
 import { EnsureSonarExcludesLisaHarnessMigration } from "./ensure-sonar-excludes-lisa-harness.js";
@@ -24,6 +25,7 @@ export { EnsureNightlyE2EWorkflowPinsMigration } from "./ensure-nightly-e2e-work
 export { EnsureLisaPostinstallMigration } from "./ensure-lisa-postinstall.js";
 export { EnsureOxlintBaseConfigsMigration } from "./ensure-oxlint-base-configs.js";
 export { EnsurePlaywrightDedicatedCallerMigration } from "./ensure-playwright-dedicated-caller.js";
+export { EnsurePushDefaultSafeMigration } from "./ensure-push-default-safe.js";
 export { EnsureQualityCallerScopesMigration } from "./ensure-quality-caller-scopes.js";
 export { EnsureSeededGatesMigration } from "./ensure-seeded-gates.js";
 export { EnsureSonarExcludesLisaHarnessMigration } from "./ensure-sonar-excludes-lisa-harness.js";
@@ -54,6 +56,7 @@ export class MigrationRegistry {
             new EnsureLisaPostinstallMigration(),
             new EnsureOxlintBaseConfigsMigration(),
             new EnsurePlaywrightDedicatedCallerMigration(),
+            new EnsurePushDefaultSafeMigration(),
             new EnsureQualityCallerScopesMigration(),
             new EnsureSeededGatesMigration(),
             new EnsureSonarExcludesLisaHarnessMigration(),

package/dist/migrations/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAE,qCAAqC,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAalF,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAE,qCAAqC,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAElF;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACX,UAAU,CAAuB;IAElD;;;OAGG;IACH,YAAY,UAAiC;QAC3C,IAAI,CAAC,UAAU,GAAG,UAAU,IAAI;YAC9B,IAAI,oCAAoC,EAAE;YAC1C,IAAI,yCAAyC,EAAE;YAC/C,IAAI,yCAAyC,EAAE;YAC/C,IAAI,6CAA6C,EAAE;YACnD,IAAI,qCAAqC,EAAE;YAC3C,IAAI,mCAAmC,EAAE;YACzC,IAAI,uCAAuC,EAAE;YAC7C,IAAI,qCAAqC,EAAE;YAC3C,IAAI,8BAA8B,EAAE;YACpC,IAAI,gCAAgC,EAAE;YACtC,IAAI,wCAAwC,EAAE;YAC9C,IAAI,kCAAkC,EAAE;YACxC,IAAI,0BAA0B,EAAE;YAChC,IAAI,uCAAuC,EAAE;YAC7C,IAAI,iCAAiC,EAAE;YACvC,IAAI,oCAAoC,EAAE;YAC1C,IAAI,gCAAgC,EAAE;SACvC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,GAAqB;QAC7C,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,IAAI,SAAS,CAAC,gBAAgB,EAAE,CAAC;gBAC/B,MAAM,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,GAAqB;QAChC,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC1D,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,IAAI,iBAAiB,EAAE,CAAC;AACjC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAE,qCAAqC,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAalF,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAE,qCAAqC,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAElF;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACX,UAAU,CAAuB;IAElD;;;OAGG;IACH,YAAY,UAAiC;QAC3C,IAAI,CAAC,UAAU,GAAG,UAAU,IAAI;YAC9B,IAAI,oCAAoC,EAAE;YAC1C,IAAI,yCAAyC,EAAE;YAC/C,IAAI,yCAAyC,EAAE;YAC/C,IAAI,6CAA6C,EAAE;YACnD,IAAI,qCAAqC,EAAE;YAC3C,IAAI,mCAAmC,EAAE;YACzC,IAAI,uCAAuC,EAAE;YAC7C,IAAI,qCAAqC,EAAE;YAC3C,IAAI,8BAA8B,EAAE;YACpC,IAAI,gCAAgC,EAAE;YACtC,IAAI,wCAAwC,EAAE;YAC9C,IAAI,8BAA8B,EAAE;YACpC,IAAI,kCAAkC,EAAE;YACxC,IAAI,0BAA0B,EAAE;YAChC,IAAI,uCAAuC,EAAE;YAC7C,IAAI,iCAAiC,EAAE;YACvC,IAAI,oCAAoC,EAAE;YAC1C,IAAI,gCAAgC,EAAE;SACvC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,GAAqB;QAC7C,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,IAAI,SAAS,CAAC,gBAAgB,EAAE,CAAC;gBAC/B,MAAM,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,GAAqB;QAChC,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC1D,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,IAAI,iBAAiB,EAAE,CAAC;AACjC,CAAC"}

package/package.json

@@ -34,6 +34,7 @@
     "cleanup:github-branches": "bash scripts/cleanup-github-branches.sh",
     "github:status": "bash scripts/github-status-check.sh",
     "setup:deploy-key": "bash scripts/setup-deploy-key.sh",
+    "lisa:enforcement-census": "bun run build:dist:in-place && node scripts/lisa-enforcement-census.mjs",
     "lisa:update:local": "bash scripts/lisa-update-local.sh",
     "lisa:commit-and-pr:local": "bash scripts/lisa-commit-and-pr-local.sh",
     "prepublishOnly": "$npm_execpath run build",
@@ -161,7 +162,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.27.4",
+  "version": "4.27.6",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -305,6 +306,6 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "97d9811b1db340406a0060ffa52677c0c0a2ea37",
-  "gitHead": "97d9811b1db340406a0060ffa52677c0c0a2ea37"
+  "lisaReleaseCommit": "ca4a03afc00b14c943a2b4eda506f4c9483ca4ec",
+  "gitHead": "ca4a03afc00b14c943a2b4eda506f4c9483ca4ec"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.27.4",
+  "version": "4.27.6",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.27.4",
+  "version": "4.27.6",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-setup-automations/SKILL.md

@@ -207,6 +207,29 @@ project: the per-check marker dedupe converges under a single scheduled runner,
 and two concurrent runs can both observe an empty open-ticket set and both
 file. Tear-down removes it with the rest of the `lisa-auto-<project>-*` set.
 
+**Optional automation — the fleet enforcement census.** Register
+`lisa-auto-<project>-enforcement-census` running `/lisa:enforcement-census`
+once a **day** only when BOTH are true of the repository being set up: it
+maintains a fleet roster (`.lisa.workspaces.json`, the machine-local list of
+host checkouts), and it provides the `/lisa:enforcement-census` command. Both
+hold in the Lisa monorepo and in no ordinary host project, which is the point —
+the census measures OTHER checkouts on the same machine, so only the workstation
+holding the roster has a fleet to measure. Where either is absent, register
+nothing — a host project has no fleet, and scheduling a command it does not
+have would be a loop that fails every night — and report the census as SKIPPED
+naming which prerequisite was missing, per the report contract. Registering
+nothing is correct; omitting it from the report is not, because a silently
+absent loop is indistinguishable from one that was never asked for.
+
+It **reports and never gates**: no finding about the fleet changes an exit
+status, and no run files a ticket. Enforcement resolves from the checkout an
+agent is working in, so a checkout resolving no guard is protected by nothing
+while looking identical, from inside a session, to one protected by an old
+policy — and nothing was re-measuring that (CodySwannGT/lisa#3490). The
+per-checkout half of the same finding is carried by `lisa doctor`, which every
+host does get. Tear-down removes it with the rest of the `lisa-auto-<project>-*`
+set.
+
 **Exploratory PRD pressure gate.** `auto-start-prds=true` means "create PRDs in the ready PRD
 lifecycle when the PRD queue has capacity," not "always create a new ready PRD." The
 `exploratory-prds` automation uses the same PRD source queue and pressure roles reported by

package/plugins/lisa/.codex-plugin/skills/lisa-sync-down/SKILL.md

@@ -127,8 +127,15 @@ source-only work downward.
 If residue remains after applying the appropriate pattern, abort that hop and
 report the unresolved files and the evidence gathered. Do not silently choose
 source-wins when the target may already contain the change or has moved the code.
-5. **Push** the sync branch: `git push -u origin sync/<source>-to-<target> --force-with-lease`.
+5. **Push** the sync branch with a fully qualified destination refspec:
+   `git push origin sync/<source>-to-<target>:refs/heads/sync/<source>-to-<target> --force-with-lease`.
    Only ever force-push the sync branch — never the target environment branch.
+   The refspec is not decoration. `push -u origin <branch>` names only a
+   source, so git resolves the destination from the branch's upstream; where
+   `push.default` is `upstream` and the sync branch was created from the
+   target, that resolves to the TARGET ENVIRONMENT BRANCH and a force-push
+   lands there (CodySwannGT/lisa#3495). Naming the destination in full is
+   what makes the sentence above enforceable rather than advisory.
 6. **Open or update the PR.** Check for an existing open PR
    (`gh pr list --head sync/<source>-to-<target> --base <target> --state open`).
    Update its body if it exists, otherwise create it

package/plugins/lisa/skills/lisa-setup-automations/SKILL.md

@@ -207,6 +207,29 @@ project: the per-check marker dedupe converges under a single scheduled runner,
 and two concurrent runs can both observe an empty open-ticket set and both
 file. Tear-down removes it with the rest of the `lisa-auto-<project>-*` set.
 
+**Optional automation — the fleet enforcement census.** Register
+`lisa-auto-<project>-enforcement-census` running `/lisa:enforcement-census`
+once a **day** only when BOTH are true of the repository being set up: it
+maintains a fleet roster (`.lisa.workspaces.json`, the machine-local list of
+host checkouts), and it provides the `/lisa:enforcement-census` command. Both
+hold in the Lisa monorepo and in no ordinary host project, which is the point —
+the census measures OTHER checkouts on the same machine, so only the workstation
+holding the roster has a fleet to measure. Where either is absent, register
+nothing — a host project has no fleet, and scheduling a command it does not
+have would be a loop that fails every night — and report the census as SKIPPED
+naming which prerequisite was missing, per the report contract. Registering
+nothing is correct; omitting it from the report is not, because a silently
+absent loop is indistinguishable from one that was never asked for.
+
+It **reports and never gates**: no finding about the fleet changes an exit
+status, and no run files a ticket. Enforcement resolves from the checkout an
+agent is working in, so a checkout resolving no guard is protected by nothing
+while looking identical, from inside a session, to one protected by an old
+policy — and nothing was re-measuring that (CodySwannGT/lisa#3490). The
+per-checkout half of the same finding is carried by `lisa doctor`, which every
+host does get. Tear-down removes it with the rest of the `lisa-auto-<project>-*`
+set.
+
 **Exploratory PRD pressure gate.** `auto-start-prds=true` means "create PRDs in the ready PRD
 lifecycle when the PRD queue has capacity," not "always create a new ready PRD." The
 `exploratory-prds` automation uses the same PRD source queue and pressure roles reported by

package/plugins/lisa/skills/lisa-sync-down/SKILL.md

@@ -127,8 +127,15 @@ source-only work downward.
 If residue remains after applying the appropriate pattern, abort that hop and
 report the unresolved files and the evidence gathered. Do not silently choose
 source-wins when the target may already contain the change or has moved the code.
-5. **Push** the sync branch: `git push -u origin sync/<source>-to-<target> --force-with-lease`.
+5. **Push** the sync branch with a fully qualified destination refspec:
+   `git push origin sync/<source>-to-<target>:refs/heads/sync/<source>-to-<target> --force-with-lease`.
    Only ever force-push the sync branch — never the target environment branch.
+   The refspec is not decoration. `push -u origin <branch>` names only a
+   source, so git resolves the destination from the branch's upstream; where
+   `push.default` is `upstream` and the sync branch was created from the
+   target, that resolves to the TARGET ENVIRONMENT BRANCH and a force-push
+   lands there (CodySwannGT/lisa#3495). Naming the destination in full is
+   what makes the sentence above enforceable rather than advisory.
 6. **Open or update the PR.** Check for an existing open PR
    (`gh pr list --head sync/<source>-to-<target> --base <target> --state open`).
    Update its body if it exists, otherwise create it

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.27.4",
+  "version": "4.27.6",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-setup-automations/SKILL.md

@@ -207,6 +207,29 @@ project: the per-check marker dedupe converges under a single scheduled runner,
 and two concurrent runs can both observe an empty open-ticket set and both
 file. Tear-down removes it with the rest of the `lisa-auto-<project>-*` set.
 
+**Optional automation — the fleet enforcement census.** Register
+`lisa-auto-<project>-enforcement-census` running `/lisa:enforcement-census`
+once a **day** only when BOTH are true of the repository being set up: it
+maintains a fleet roster (`.lisa.workspaces.json`, the machine-local list of
+host checkouts), and it provides the `/lisa:enforcement-census` command. Both
+hold in the Lisa monorepo and in no ordinary host project, which is the point —
+the census measures OTHER checkouts on the same machine, so only the workstation
+holding the roster has a fleet to measure. Where either is absent, register
+nothing — a host project has no fleet, and scheduling a command it does not
+have would be a loop that fails every night — and report the census as SKIPPED
+naming which prerequisite was missing, per the report contract. Registering
+nothing is correct; omitting it from the report is not, because a silently
+absent loop is indistinguishable from one that was never asked for.
+
+It **reports and never gates**: no finding about the fleet changes an exit
+status, and no run files a ticket. Enforcement resolves from the checkout an
+agent is working in, so a checkout resolving no guard is protected by nothing
+while looking identical, from inside a session, to one protected by an old
+policy — and nothing was re-measuring that (CodySwannGT/lisa#3490). The
+per-checkout half of the same finding is carried by `lisa doctor`, which every
+host does get. Tear-down removes it with the rest of the `lisa-auto-<project>-*`
+set.
+
 **Exploratory PRD pressure gate.** `auto-start-prds=true` means "create PRDs in the ready PRD
 lifecycle when the PRD queue has capacity," not "always create a new ready PRD." The
 `exploratory-prds` automation uses the same PRD source queue and pressure roles reported by

package/plugins/lisa-agy/skills/lisa-sync-down/SKILL.md

@@ -127,8 +127,15 @@ source-only work downward.
 If residue remains after applying the appropriate pattern, abort that hop and
 report the unresolved files and the evidence gathered. Do not silently choose
 source-wins when the target may already contain the change or has moved the code.
-5. **Push** the sync branch: `git push -u origin sync/<source>-to-<target> --force-with-lease`.
+5. **Push** the sync branch with a fully qualified destination refspec:
+   `git push origin sync/<source>-to-<target>:refs/heads/sync/<source>-to-<target> --force-with-lease`.
    Only ever force-push the sync branch — never the target environment branch.
+   The refspec is not decoration. `push -u origin <branch>` names only a
+   source, so git resolves the destination from the branch's upstream; where
+   `push.default` is `upstream` and the sync branch was created from the
+   target, that resolves to the TARGET ENVIRONMENT BRANCH and a force-push
+   lands there (CodySwannGT/lisa#3495). Naming the destination in full is
+   what makes the sentence above enforceable rather than advisory.
 6. **Open or update the PR.** Check for an existing open PR
    (`gh pr list --head sync/<source>-to-<target> --base <target> --state open`).
    Update its body if it exists, otherwise create it

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.27.4",
+  "version": "4.27.6",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.27.4",
+  "version": "4.27.6",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.27.4",
+  "version": "4.27.6",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.27.4",
+  "version": "4.27.6",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.27.4",
+  "version": "4.27.6",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.27.4",
+  "version": "4.27.6",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/skills/lisa-setup-automations/SKILL.md

@@ -207,6 +207,29 @@ project: the per-check marker dedupe converges under a single scheduled runner,
 and two concurrent runs can both observe an empty open-ticket set and both
 file. Tear-down removes it with the rest of the `lisa-auto-<project>-*` set.
 
+**Optional automation — the fleet enforcement census.** Register
+`lisa-auto-<project>-enforcement-census` running `/lisa:enforcement-census`
+once a **day** only when BOTH are true of the repository being set up: it
+maintains a fleet roster (`.lisa.workspaces.json`, the machine-local list of
+host checkouts), and it provides the `/lisa:enforcement-census` command. Both
+hold in the Lisa monorepo and in no ordinary host project, which is the point —
+the census measures OTHER checkouts on the same machine, so only the workstation
+holding the roster has a fleet to measure. Where either is absent, register
+nothing — a host project has no fleet, and scheduling a command it does not
+have would be a loop that fails every night — and report the census as SKIPPED
+naming which prerequisite was missing, per the report contract. Registering
+nothing is correct; omitting it from the report is not, because a silently
+absent loop is indistinguishable from one that was never asked for.
+
+It **reports and never gates**: no finding about the fleet changes an exit
+status, and no run files a ticket. Enforcement resolves from the checkout an
+agent is working in, so a checkout resolving no guard is protected by nothing
+while looking identical, from inside a session, to one protected by an old
+policy — and nothing was re-measuring that (CodySwannGT/lisa#3490). The
+per-checkout half of the same finding is carried by `lisa doctor`, which every
+host does get. Tear-down removes it with the rest of the `lisa-auto-<project>-*`
+set.
+
 **Exploratory PRD pressure gate.** `auto-start-prds=true` means "create PRDs in the ready PRD
 lifecycle when the PRD queue has capacity," not "always create a new ready PRD." The
 `exploratory-prds` automation uses the same PRD source queue and pressure roles reported by

package/plugins/lisa-copilot/skills/lisa-sync-down/SKILL.md

@@ -127,8 +127,15 @@ source-only work downward.
 If residue remains after applying the appropriate pattern, abort that hop and
 report the unresolved files and the evidence gathered. Do not silently choose
 source-wins when the target may already contain the change or has moved the code.
-5. **Push** the sync branch: `git push -u origin sync/<source>-to-<target> --force-with-lease`.
+5. **Push** the sync branch with a fully qualified destination refspec:
+   `git push origin sync/<source>-to-<target>:refs/heads/sync/<source>-to-<target> --force-with-lease`.
    Only ever force-push the sync branch — never the target environment branch.
+   The refspec is not decoration. `push -u origin <branch>` names only a
+   source, so git resolves the destination from the branch's upstream; where
+   `push.default` is `upstream` and the sync branch was created from the
+   target, that resolves to the TARGET ENVIRONMENT BRANCH and a force-push
+   lands there (CodySwannGT/lisa#3495). Naming the destination in full is
+   what makes the sentence above enforceable rather than advisory.
 6. **Open or update the PR.** Check for an existing open PR
    (`gh pr list --head sync/<source>-to-<target> --base <target> --state open`).
    Update its body if it exists, otherwise create it

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.27.4",
+  "version": "4.27.6",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/skills/lisa-setup-automations/SKILL.md

@@ -207,6 +207,29 @@ project: the per-check marker dedupe converges under a single scheduled runner,
 and two concurrent runs can both observe an empty open-ticket set and both
 file. Tear-down removes it with the rest of the `lisa-auto-<project>-*` set.
 
+**Optional automation — the fleet enforcement census.** Register
+`lisa-auto-<project>-enforcement-census` running `/lisa:enforcement-census`
+once a **day** only when BOTH are true of the repository being set up: it
+maintains a fleet roster (`.lisa.workspaces.json`, the machine-local list of
+host checkouts), and it provides the `/lisa:enforcement-census` command. Both
+hold in the Lisa monorepo and in no ordinary host project, which is the point —
+the census measures OTHER checkouts on the same machine, so only the workstation
+holding the roster has a fleet to measure. Where either is absent, register
+nothing — a host project has no fleet, and scheduling a command it does not
+have would be a loop that fails every night — and report the census as SKIPPED
+naming which prerequisite was missing, per the report contract. Registering
+nothing is correct; omitting it from the report is not, because a silently
+absent loop is indistinguishable from one that was never asked for.
+
+It **reports and never gates**: no finding about the fleet changes an exit
+status, and no run files a ticket. Enforcement resolves from the checkout an
+agent is working in, so a checkout resolving no guard is protected by nothing
+while looking identical, from inside a session, to one protected by an old
+policy — and nothing was re-measuring that (CodySwannGT/lisa#3490). The
+per-checkout half of the same finding is carried by `lisa doctor`, which every
+host does get. Tear-down removes it with the rest of the `lisa-auto-<project>-*`
+set.
+
 **Exploratory PRD pressure gate.** `auto-start-prds=true` means "create PRDs in the ready PRD
 lifecycle when the PRD queue has capacity," not "always create a new ready PRD." The
 `exploratory-prds` automation uses the same PRD source queue and pressure roles reported by