@codyswann/lisa 4.33.6 → 4.33.9

package/plugins/src/base/skills/lisa-intake-explain/SKILL.md

@@ -190,7 +190,7 @@ Apply gate verdicts in the same order as build intake:
 
 1. **Repo-scope gate.** A build item carrying `repo:<other>` and not `repo:<current>` is outside this repo's pickup lane. Return `MISCONFIGURED` when repo scope is absent or contradictory enough that the current repo cannot be determined confidently; otherwise explain the repo-scope mismatch and recommend running intake in the target repo or fixing the `repo:<name>` label. For an unlabeled item whose target repo is obvious from the item body, report the inferred repo signal but stay read-only: execution intake would stamp `repo:<name>`, while intake-explain only says it would do so. A multi-repo leaf is not directly buildable; explain that execution intake would split it per `repo-scope-split`, but this read-only diagnosis does not split.
 2. **Leaf-only gate.** If the item has open child work from native GitHub sub-issues or body parentage, return `NON_LEAF_CONTAINER` and explain that direct build pickup is leaf-only per `leaf-only-lifecycle`. If it has no open children but carries `type:Epic`, also return `NON_LEAF_CONTAINER` because a childless Epic is a pure rollup container that still needs decomposition or reclassification. (A childless `type:Story` or `type:Spike` is a valid leaf per `leaf-only-lifecycle` and is NOT a `NON_LEAF_CONTAINER` — it is directly buildable.) The next action for a childless Epic is decomposition, moving `status:ready` to leaf children, or correcting the issue type. Execution build intake would move such a stale ready container out of the pickup queue; this read-only diagnosis must not perform that repair.
-3. **Dependency hold gate.** If a single-repo leaf for the current repo has explicit blockers, read each blocker. Closed blockers are clear. Open blockers are clear only when they carry a cleared build status such as `status:code-review`, `status:on-dev`, `status:on-stg`, `status:done`, or the configured done-equivalent labels. Open blockers with `status:ready`, `status:in-progress`, no cleared status label, or inaccessible state are active. Return `HELD_BY_BLOCKERS`, list the active blocker refs, and make the next action blocker resolution rather than `/lisa:intake`.
+3. **Dependency hold gate.** If a single-repo leaf for the current repo has explicit blockers, read each blocker and clear-check it **by containment, per the `blocker-containment` rule** — cite that slug for the full contract rather than restating it. A blocker is clear only when its merged PRs are ancestors of the branch this leaf will be built from (resolved from the leaf's `## Target Backend Environment` through `.lisa.config.json` `deploy.branches`, never from a rendered `Branch Plan`), or when the rule's narrow no-code carve-out or human override applies. **A build status label is never the test** — `status:code-review`, `status:on-dev`, `status:on-stg` and `status:done` are name matches that hold in a single-trunk workflow and come apart in a promotion workflow, where `main` is the trailing branch. Every other state, and every case where containment is not computable, is active: fail closed. Return `HELD_BY_BLOCKERS`, list the active blocker refs with the rule's reason key for each, and make the next action blocker resolution rather than `/lisa:intake`.
 4. **Ready leaf.** A build item in the configured ready role, scoped to the current repo, with no open child work and no active blockers returns `ELIGIBLE_FOR_INTAKE`. The `Why:` line should say it is a single-repo leaf for the current repo and that leaf-only, repo-scope, and dependency gates all pass.
 
 Relevant `Signals:` should include the decisive context, not every field: for example `repo:lisa; type:Sub-task; no open children`, `open children #12/#13`, `repo:api but current repo is web`, or `active blockers CodySwannGT/lisa#123`.

package/plugins/src/base/skills/lisa-repair-intake/SKILL.md

@@ -1005,28 +1005,40 @@ is no normalized `is blocked by` field. Read the bundle, then extract blockers p
 - **Linear**: inspect the native issue **relations** from Linear MCP `get_issue` and select
   blocker relations.
 
-Then classify each blocker:
-
-- **Closed, or shipped to any environment** → **cleared**. A blocker is cleared at **any**
-  env-staged `done` role — not only the production terminal. The `done` role is configured
-  per-env as a `{dev, staging, production}` map (`config-resolution`), so `On Dev`, `On Stg`,
-  **and** production `Done` all mean the blocker's code is merged and deployed to ≥1 environment.
-  A post-build `review` role (e.g. `Code Review`) is likewise cleared — the change exists and is
-  in flight. An `is blocked by` link is a **development** dependency: it is satisfied once the
-  blocker's code is in trunk; it must NOT wait for the blocker to reach production. (This matches
-  the intake-path dependency-hold gate in `lisa-intake-explain`, which already treats
-  `code-review` / `on-dev` / `on-stg` / `done` as cleared — repair-intake must not be stricter.
-  In an env-staged workflow where `Done` means "in production", a strict production-terminal
-  check strands every dependent forever behind a blocker that is already merged and sitting at
-  `On Stg` / `On Dev`.)
-- **Open** in a pre-merge role (`ready` / `claimed` / unknown — code not yet in trunk) → **still
-  blocking**.
-- **Inaccessible** (deleted, cross-org, permission denied) → **still blocking**, unless the item
-  body or a newer human comment explicitly states the dependency is resolved.
+Then classify each blocker **by containment, per the `blocker-containment` rule** — cite that
+slug for the full contract; do not restate its resolution steps or its fail-closed table here.
+
+The one question is whether the blocker's code is on the branch **this item** will be built from:
+resolve this item's base branch from its `## Target Backend Environment` through
+`.lisa.config.json` `deploy.branches` (`derived-branch-plan`, `config-resolution` — never by
+reading a rendered `Branch Plan`), resolve the blocker's merge commit through the vendor access
+layer, and test ancestry against the remote.
+
+- **Contained** — every merged PR on the blocker is an ancestor of this item's base branch →
+  **cleared**.
+- **Not contained**, or containment **not computable** for any reason the rule enumerates (no
+  linked PR, PR not merged, blocker inaccessible, base branch underivable or absent from the
+  remote, ancestry query errored) → **still blocking**, with the rule's reason key in the run
+  record.
+- **Ships no code** — the blocker is closed as completed, positively declares
+  `Target Backend Environment: None — no runtime behavior change`, and has no merged PR →
+  **cleared** under the rule's carve-out. This is a positive determination, never an absence:
+  "no PR found" is `no-pr` and stays blocking.
+- **Human override** — an explicit human statement on this item that the dependency is satisfied
+  clears it and outranks a failed containment check. Name it in the run record.
+
+**A lifecycle status name is never the test.** `done`, `on-stg`, `on-dev` and `code-review` are
+labels that correlate with containment in a single-trunk workflow and come apart from it in a
+promotion workflow, where `main` is the trailing branch — a blocker at `On Stg` is on `staging`
+and absent from `main`, and a blocker in `Code Review` is merged to nothing. Containment gets
+both the loose and the strict failure right at once: a blocker merged into the branch this item
+builds from clears **immediately**, with no wait for production, so a dependent is never stranded
+behind work already merged where it needs it.
 
 Only re-dispatch when **every** parsed blocker is cleared. When in doubt, stay blocked — a
-false-negative (left blocked) is cheap; a false-positive (re-dispatched into a real blocker)
-wastes a build cycle.
+false-negative (left blocked) costs one cycle and is visible; a false-positive is **invisible**,
+because the item moves to `ready`, which looks exactly like a repair that worked, and the failure
+surfaces days later as work begun before its dependency existed.
 
 ### Class B — validation / quality-gate self-block
 

package/plugins/src/base/skills/lisa-ticket-triage/SKILL.md

@@ -46,7 +46,7 @@ If relevant code IS found, proceed to Phase 2.
 
 From the context bundle, evaluate relationships before analyzing this ticket in isolation:
 
-- **Open blockers (`is blocked by`)**: if any blocker is not `Done` or its linked PR is not merged, raise an ambiguity: "Blocker {KEY} is not shipped — work cannot meaningfully start." This is an automatic `BLOCKED` verdict unless the human confirms the blocker state is acceptable.
+- **Open blockers (`is blocked by`)**: clear-check each blocker **by containment, per the `blocker-containment` rule** — cite that slug for the full contract rather than restating it. A blocker is satisfied when its merged PRs are ancestors of the branch this ticket will be built from (resolved from this ticket's `## Target Backend Environment` through `.lisa.config.json` `deploy.branches`, never from a rendered `Branch Plan`), or when the rule's narrow no-code carve-out or human override applies. **`Done` is not the test** — a state name holds in a single-trunk workflow and comes apart in a promotion workflow, and requiring the production terminal strands every dependent behind work already merged where this ticket needs it. This is the same predicate the `DUPLICATE_ALREADY_FIXED` bullet below already requires ("present on the relevant base branch… never from a name/label match alone"), applied here too. For a blocker that is not contained, or where containment is not computable, raise an ambiguity naming the rule's reason key: "Blocker {KEY} is not on {BRANCH} ({REASON}) — work cannot meaningfully start." That is an automatic `BLOCKED` verdict unless the human confirms the blocker state is acceptable.
 - **Epic siblings in progress**: if a sibling under the same epic is `In Progress` / `In Review` with a different assignee and overlapping scope, raise it as an edge case in Phase 4 ("Duplicate-work risk with {KEY}").
 - **`duplicates` / `is duplicated by` links**:
   - If this ticket is a duplicate of an open canonical ticket whose fix is not yet merged into the base branch, verdict is `BLOCKED` with the recommendation to close as duplicate manually rather than implement.

package/scripts/two-channel-couplings.json

@@ -5,7 +5,7 @@
   },
   "inspected": {
     "workflows": 22,
-    "steps": 677,
+    "steps": 678,
     "couplings": 33,
     "inventory": 69
   },

package/typescript/copy-overwrite/.github/GITHUB_ACTIONS.md

@@ -45,6 +45,8 @@ For full functionality, configure the following secrets:
 |--------|---------|--------------|
 | `EXPO_TOKEN` | EAS builds and updates | Mobile deployment |
 | `SENTRY_AUTH_TOKEN` | Error tracking | Release monitoring |
+| `SENTRY_ORG` | Sentry organization slug | Release monitoring |
+| `SENTRY_PROJECT` | Sentry project slug | Release monitoring |
 | `SONAR_TOKEN` | Code quality analysis | Security scanning |
 | `SNYK_TOKEN` | Vulnerability scanning | Security scanning |
 
@@ -535,8 +537,6 @@ Variables are non-sensitive configuration values. Set them in **Settings** > **S
 | `JIRA_BASE_URL` | Jira instance base URL (enables Jira triage workflow) | `https://company.atlassian.net` |
 | `JIRA_USER_EMAIL` | Email associated with the Jira API token | `user@company.com` |
 | `JIRA_PROJECT_KEY` | Jira project key for ticket queries | `PROJ` |
-| `SENTRY_ORG` | Sentry organization slug | `my-company` |
-| `SENTRY_PROJECT` | Sentry project slug | `frontend-app` |
 
 ## External Service Setup
 

package/typescript/copy-overwrite/scripts/lisa-mutation.mjs

@@ -197,6 +197,87 @@ export const OUTCOMES = Object.freeze({
   noFloorApplied: "mutation-gate: no-floor-applied",
 });
 
+/**
+ * The outcomes under which Stryker generated mutants and produced a score.
+ *
+ * THE POINT OF #3668. Every other outcome in {@link OUTCOMES} ends a run that
+ * MEASURED NOTHING, and until this set existed the exit-0 members of that group
+ * were indistinguishable from a real pass at the only layer a merge decision
+ * consults: `🔍 Quality Checks / 🧬 Mutation Testing Gate` printed `pass` for a
+ * pull request no mutant had touched. Measured on #3664 — a 400-line change to
+ * a shipped guard script, `nothing-to-mutate`, `pass`.
+ *
+ * The file said so itself, above {@link OUTCOMES}, and had for months: "both
+ * exit 0, and only the marker says which one happened." The marker lives in a
+ * log; a log is not a control. This set is what lets the workflow render the
+ * difference.
+ *
+ * MEMBERSHIP IS THE STRYKER RUN, not the verdict. `scoped` and `wholeList` are
+ * the two outcomes that carry a `reportRun`, so they are the two under which
+ * mutants existed — whether the score then cleared the floor or not is a
+ * different question, answered by the exit code. A run that measured and FAILED
+ * is still a run that measured.
+ */
+export const MEASURED_OUTCOMES = Object.freeze([
+  OUTCOMES.scoped,
+  OUTCOMES.wholeList,
+]);
+
+/**
+ * Whether an outcome means mutants were generated against this change.
+ *
+ * An unknown marker answers `false`, and that direction is deliberate: a new
+ * outcome added without being classified must not inherit "measured". Failing
+ * closed here costs a `skipping` row on a run that did measure; failing open
+ * costs exactly the false green this issue is about.
+ *
+ * @param {string} outcome - One {@link OUTCOMES} marker
+ * @returns {boolean} True when Stryker produced mutants
+ */
+export const measuredAnything = outcome =>
+  MEASURED_OUTCOMES.includes(String(outcome));
+
+/**
+ * Publishes the outcome where the workflow can render it, then returns the code.
+ *
+ * Every exit in {@link runGate} goes through here, and that is the property
+ * worth more than the plumbing: an exit that forgets to name its outcome is now
+ * impossible to write, rather than merely discouraged by a convention. It is
+ * the same shape the automation-runbook contract asks of a loop — end in
+ * exactly one named outcome — applied to a gate.
+ *
+ * `$GITHUB_OUTPUT` rather than a check-run publish, and the difference is
+ * forced rather than chosen: `test_mutation` in `quality.yml` declares
+ * `permissions: contents: read`, and `quality.yml` is `workflow_call`-only. A
+ * called workflow may only DOWNGRADE its caller's grant — asking for `checks:
+ * write` is a `startup_failure` for the entire run (#2049), which is why
+ * `review-evidence.yml` is a standalone workflow rather than a job. So the
+ * verdict leaves as a job output and a downstream job renders it.
+ *
+ * Best-effort, for the reason every reporting path in this repository is: a
+ * lost output line must never change the exit code the gate worked to earn.
+ *
+ * @param {string} outcome - The {@link OUTCOMES} marker this run ended on
+ * @param {number} code - The exit code to return unchanged
+ * @param {NodeJS.ProcessEnv} [env] - Environment, injectable for tests
+ * @returns {number} `code`, unchanged
+ */
+export const finish = (outcome, code, env = process.env) => {
+  const target = env.GITHUB_OUTPUT;
+  if (target === undefined || target === "") return code;
+  try {
+    fs.appendFileSync(
+      target,
+      `mutation_outcome=${outcome}\nmutation_measured=${measuredAnything(outcome)}\n`
+    );
+  } catch (error) {
+    console.error(
+      `[mutation-gate] outcome outputs not written: ${error.message}`
+    );
+  }
+  return code;
+};
+
 /**
  * Stryker config file names, in the order Stryker itself resolves them.
  *
@@ -2080,7 +2161,7 @@ export const runGate = (cwd = process.cwd(), argv = []) => {
       `⚪ ${OUTCOMES.disabled} — mutation.gate.json says "enabled": false. Skipping.\n` +
         '   Flip "enabled": true (and tune thresholds.break in stryker.conf.json) to turn it on.'
     );
-    return 0;
+    return finish(OUTCOMES.disabled, 0);
   }
 
   const declaration = resolveMutateDeclaration(cwd);
@@ -2093,7 +2174,7 @@ export const runGate = (cwd = process.cwd(), argv = []) => {
         `   ${error instanceof Error ? error.message : String(error)}\n` +
         `   Fix the \`mutate\` patterns in ${declaration.source} before re-running.`
     );
-    return 1;
+    return finish(OUTCOMES.invalidMutatePattern, 1);
   }
 
   if (countMutateTargetsInRepo(cwd, patterns) === 0) {
@@ -2105,7 +2186,7 @@ export const runGate = (cwd = process.cwd(), argv = []) => {
         "   that is switched on and wired to nothing.\n" +
         "   Fix the `mutate` patterns in your Stryker config, or turn the gate off."
     );
-    return 1;
+    return finish(OUTCOMES.inertConfig, 1);
   }
 
   const unparseable = selectUninstrumentableMutateTargets(cwd, patterns);
@@ -2127,7 +2208,7 @@ export const runGate = (cwd = process.cwd(), argv = []) => {
         "   script against a payload table and asserts the blocked/allowed\n" +
         "   verdict — never by this gate."
     );
-    return 1;
+    return finish(OUTCOMES.uninstrumentableTarget, 1);
   }
 
   if (argv.includes(WHOLE_LIST_FLAG)) {
@@ -2135,7 +2216,7 @@ export const runGate = (cwd = process.cwd(), argv = []) => {
       `🧬 ${OUTCOMES.wholeList} — Stryker over every pattern in ` +
         `${declaration.source}, with no diff scoping.`
     );
-    return reportRun(cwd, runStryker(cwd, []));
+    return finish(OUTCOMES.wholeList, reportRun(cwd, runStryker(cwd, [])));
   }
 
   const base = resolveDiffBase(cwd, since);
@@ -2145,7 +2226,7 @@ export const runGate = (cwd = process.cwd(), argv = []) => {
         "   unknown ref). Skipping rather than mutating the whole repository.\n" +
         "   Nothing was measured; this is not a mutation score."
     );
-    return 0;
+    return finish(OUTCOMES.noBase, 0);
   }
 
   let scope;
@@ -2168,7 +2249,7 @@ export const runGate = (cwd = process.cwd(), argv = []) => {
         "   NO mutant was generated and NO score was computed. Nothing was measured,\n" +
         "   so nothing passed."
     );
-    return 1;
+    return finish(OUTCOMES.diffFailed, 1);
   }
 
   if (scope.uninstrumentable.length > 0) {
@@ -2191,7 +2272,7 @@ export const runGate = (cwd = process.cwd(), argv = []) => {
         "   on both sides. Check that one exists; nothing here did."
     );
     if (scope.selected.length === 0 && scope.noCurrentLines.length === 0)
-      return 0;
+      return finish(OUTCOMES.uninstrumentableLanguage, 0);
   }
 
   if (scope.selected.length === 0) {
@@ -2207,7 +2288,7 @@ export const runGate = (cwd = process.cwd(), argv = []) => {
           "   Stryker can place mutants only on current lines. NO mutant was generated\n" +
           "   and NO score was computed; this is not a measured pass."
       );
-      return 0;
+      return finish(OUTCOMES.noCurrentLines, 0);
     }
     console.log(
       `⚪ ${OUTCOMES.nothingToMutate}\n` +
@@ -2216,7 +2297,7 @@ export const runGate = (cwd = process.cwd(), argv = []) => {
         "   NO mutant was generated and NO score was computed. Nothing was measured,\n" +
         "   so nothing passed — do not read this as evidence about your tests."
     );
-    return 0;
+    return finish(OUTCOMES.nothingToMutate, 0);
   }
 
   // `--mutate` is one comma-separated argument, so a path containing a comma
@@ -2234,7 +2315,7 @@ export const runGate = (cwd = process.cwd(), argv = []) => {
         `${listed}\n` +
         "   Rename them, or exclude them in your Stryker config."
     );
-    return 1;
+    return finish(OUTCOMES.unrepresentablePath, 1);
   }
 
   console.log(
@@ -2243,7 +2324,10 @@ export const runGate = (cwd = process.cwd(), argv = []) => {
   );
   for (const file of scope.selected) console.log(`   • ${file}`);
 
-  return reportRun(cwd, runStryker(cwd, scope.selected));
+  return finish(
+    OUTCOMES.scoped,
+    reportRun(cwd, runStryker(cwd, scope.selected))
+  );
 };
 
 /**

package/typescript/copy-overwrite/scripts/reconcile-nightly-e2e-tracking.mjs

@@ -36,8 +36,9 @@ function validateAuthority(findings, trackers) {
   if (!Array.isArray(findings) || findings.length !== 2) {
     refuse(exactSuiteMessage);
   }
-  const labels = findings.map(finding => finding?.label).sort();
-  const expected = [...TRACKED_SUITE_LABELS].sort();
+  const byLabel = (left, right) => String(left).localeCompare(String(right));
+  const labels = findings.map(finding => finding?.label).sort(byLabel);
+  const expected = [...TRACKED_SUITE_LABELS].sort(byLabel);
   if (JSON.stringify(labels) !== JSON.stringify(expected)) {
     refuse(exactSuiteMessage);
   }

package/typescript/deletions.json

@@ -52,5 +52,12 @@
     ".github/workflows/reusable-claude-nightly-test-improvement-rails.yml",
     ".github/workflows/required-checks-drift.yml"
   ],
-  "keep": []
+  "keep": [],
+  "force": {
+    ".github/workflows/auto-update-pr-branches.yml": "Removed fleet-wide (CodySwannGT/lisa#3590): it force-updated PR branches with the workflow's own github.token, and GitHub will not start runs from such a push, so required checks went ABSENT at head and pull requests silently stopped becoming mergeable. An edited copy does the same damage, so this removal overrides workflow ownership.",
+    ".github/workflows/auto-update-pr-branches-dispatch.yml": "Removed fleet-wide (CodySwannGT/lisa#3590): it force-updated PR branches with the workflow's own github.token, and GitHub will not start runs from such a push, so required checks went ABSENT at head and pull requests silently stopped becoming mergeable. An edited copy does the same damage, so this removal overrides workflow ownership.",
+    ".github/workflows/reusable-auto-update-pr-branches.yml": "Removed fleet-wide (CodySwannGT/lisa#3590): it force-updated PR branches with the workflow's own github.token, and GitHub will not start runs from such a push, so required checks went ABSENT at head and pull requests silently stopped becoming mergeable. An edited copy does the same damage, so this removal overrides workflow ownership.",
+    ".github/workflows/reusable-auto-update-pr-branches-dispatch.yml": "Removed fleet-wide (CodySwannGT/lisa#3590): it force-updated PR branches with the workflow's own github.token, and GitHub will not start runs from such a push, so required checks went ABSENT at head and pull requests silently stopped becoming mergeable. An edited copy does the same damage, so this removal overrides workflow ownership.",
+    ".github/workflows/required-checks-drift.yml": "Removed fleet-wide (CodySwannGT/lisa#3599): it read the live ruleset over the GitHub API, which needs administration:read and therefore a personal access token held in a permanent repository secret. An edited copy still asks for that token, so this removal overrides workflow ownership."
+  }
 }