@codyswann/lisa 4.34.7 → 4.34.9

package/plugins/lisa-agy/skills/lisa-drive-pr-to-merge/SKILL.md

@@ -41,6 +41,11 @@ merges" loop. Other skills delegate here instead of re-implementing it. Runs
   green, open, un-merged PR is the *success* outcome of this mode, not a hang.
   Used by learning-persistence flows whose low-confidence PRs must wait for a
   human (`lisa-persist-learning`).
+
+  **`auto_merge` is caller-time and nothing re-reads it.** That is what the hold
+  label (section 0) exists for: the same behaviour, raisable by anyone at any
+  point while the loop runs. Both routes land in `awaiting-human`; they differ
+  only in who can take them and when.
 - `on_blocker=<fix|report>` — what to do when a blocker needs code or review work.
   Default `fix`.
   - **`fix`** (the full loop): resolve conflicts, fix failing checks, address +
@@ -97,9 +102,115 @@ gh pr edit <pr> --add-label "lisa:babysitter-on-duty"
 closed, or a hard block handed to a human. A crashed session that never
 releases is why the TTL exists; do not rely on it as the normal release path.
 
+### The hold gate — a stop anyone can raise
+
+Section 0 owns this skill's two PR labels: the lease it **writes** to declare
+ownership, and the hold it **reads** to be told to stop. Same mechanism, pointed
+at different things — a lease is a claim, a hold is a decision.
+
+**The label** is `lisa:hold` by default, overridable per project at
+`github.labels.merge.hold`, resolved local-over-global like every other
+configured name. Resolve it ONCE at startup and reuse the resolved string; a
+name re-resolved each iteration can change identity mid-loop for no reason a
+reader could reconstruct afterwards.
+
+```bash
+HOLD_LABEL=$(
+  jq -r 'first(.github.labels.merge.hold | strings)' \
+    .lisa.config.local.json .lisa.config.json 2>/dev/null | head -n1
+)
+HOLD_LABEL="${HOLD_LABEL:-lisa:hold}"
+```
+
+**What it means:** exactly `auto_merge=false`, for as long as it is present. Not
+a new concept and not a new terminal state — the same disarm, the same
+fail-closed re-read, the same `awaiting-human` landing. The only new surface is
+one label read.
+
+**Why it exists.** `auto_merge` is decided by the caller at invocation, and
+nothing re-reads it, so the only person who can stop the merge is the person who
+started it. Anyone else — a reviewer who opens the PR while the loop is driving
+it, someone holding a PR another session armed — has no lever and loses the
+race. Measured (#3558): four explicit `gh pr merge --disable-auto` calls were
+each followed by a re-arm 7–25 seconds later, and the PR merged two seconds
+after its final check went green. **The hold did not fail; it lost a race.** A
+signal the loop itself reads cannot be raced, because the loop is what reads it.
+
+#### Evaluate it in two places, and re-read it every iteration
+
+- **Before arming** (section 1) — a PR already carrying the label is never armed.
+- **On every watch-loop iteration** (section 2), before acting on any blocker.
+
+Re-reading is the entire point. A check that runs once at startup is a
+caller-time signal wearing a loop's clothing and fixes nothing, because the case
+that matters is a label applied **after** the loop is already running. If you
+are changing this and it is convenient to read the label once, you have
+reintroduced the defect.
+
+```bash
+gh pr view <pr> --json labels --jq "[.labels[].name] | index(\"$HOLD_LABEL\") != null"
+```
+
+**Match the resolved name exactly — never a prefix.** `lisa:babysitter-on-duty`
+is a label this skill applies to itself and shares the `lisa:` prefix; a
+prefix match would make the loop stop on its own lease, which is a deadlock
+that looks like a human decision.
+
+#### When held
+
+1. Run the existing `auto_merge=false` disarm (section 1) — disable the latch
+   once and prove with the fail-closed re-read that it took.
+2. Return `awaiting-human:held` (section 4).
+3. **Do not remove the label.** Removing a human's signal is unrecoverable from
+   inside the loop; leaving a stale one costs a cycle and is visible. Only
+   whoever applied it takes it off, and a later invocation then resumes normally.
+
+Do not keep polling while held. Held is terminal for this run, not a pause to
+wait out — the loop has been told a human is looking, and continuing to drive is
+the behaviour the label exists to stop.
+
+**The disarm is once and terminal: never re-arm the latch afterwards, and never
+resume driving in the same run.** This is what keeps a hold compatible with the
+armed-across-fix-pushes rule in section 1, which otherwise forbids disarming on
+the `auto_merge=true` path. That rule exists to prevent a *race* — disarm, then
+re-arm, repeatedly, while still driving — and a hold does neither half of it: it
+turns the latch off exactly once and then stops. A hold that re-armed, or that
+kept driving afterwards, would be the race that rule names, wearing a label.
+
+#### When the read fails
+
+**Fail toward hold.** The asymmetry decides it: a false hold costs one cycle and
+is visible in a terminal report someone can act on, while a false no-hold merges
+past a human's objection and cannot be undone. Where the two errors are
+unequal, take the recoverable one.
+
+But a read that keeps failing must not become a silent deadlock, so the failure
+is **reported as its own outcome** rather than dressed up as a decision:
+
+- retry the read once;
+- if it still fails, disarm as above and return **`awaiting-human:hold-unknown`**,
+  naming the error.
+
+`awaiting-human:held` and `awaiting-human:hold-unknown` are different facts and
+an operator needs to know which: the first says *a human stopped this*, the
+second says *I could not tell whether a human stopped this.* Collapsing them
+would hide a broken permission behind a human decision, and nobody would ever
+look.
+
+**A PR with no hold label is driven exactly as it is today.** This gate adds a
+stop; it does not add a block. If the label is absent and the read succeeded,
+nothing about the run changes.
+
 ## 1. Enable auto-merge
 
-**Gate: only when `auto_merge=true` (the default).** When `auto_merge=false`,
+**Gate: the hold label is absent (section 0's hold gate), and `auto_merge=true`
+(the default).** Evaluate the hold gate BEFORE anything in this section,
+including the arm gate below and the direct-merge capability fallback: a held PR
+is not armed, not merged directly, and not driven — it disarms once and returns
+`awaiting-human:held`. Checking after arming would authorise the merge the label
+exists to prevent, which is the same ordering error the arm gate itself fixes.
+
+When `auto_merge=false`,
 skip the enable step and its capability fallback — do not enable auto-merge,
 and do **not** use the capability fallback below: on a repo that disallows
 auto-merge, an `auto_merge=false` PR must stay OPEN for human triage, never be
@@ -357,6 +468,12 @@ Poll the live state each iteration:
 gh pr view <pr> --json state,mergeStateStatus,mergeable,reviewDecision,statusCheckRollup,headRefName,baseRefName
 ```
 
+**Re-read the hold label on every iteration, before handling any blocker**
+(section 0's hold gate). It is polled separately from the line above rather than
+folded into it, because `labels` is not part of the blocker state: the hold is a
+question about whether to keep going at all, asked before the blocker questions,
+and a run that answers it once at startup has not implemented it.
+
 Handle every blocker class; after any fix, re-poll and continue. Do not stop while
 the PR is still open and progress is possible. On each iteration, refresh the
 babysitter lease if its last stamp is older than ~30 minutes (section 0).
@@ -393,6 +510,13 @@ and return per the input contract above. That includes (f): adjudicating a pendi
 auto-fix PR (merging, closing, or deleting its branch) is destructive work, not
 diagnosis — return its classification (`blocked:pending-auto-fix`) instead.
 
+**The hold gate binds in report mode too**, and it binds first: a held PR
+returns `awaiting-human:held` without arming, without the mechanical step (a)
+nudge, and without an `update-branch`. Hold is not a blocker classification and
+never returns as one — `blocked:*` says *this PR cannot proceed yet*, while a
+hold says *someone asked me not to proceed*, and reporting the second as the
+first would file a human's decision as a defect for something else to clear.
+
 The arm gate binds in report mode too, and this is the mode where forgetting it
 does the most damage: a diagnose-only run that arms the latch has not diagnosed
 anything, it has authorised a merge. Under a vacuous review context, report mode
@@ -938,6 +1062,22 @@ Loop until one of:
   merge but nobody reviewed it: the review tool says it skips public
   repositories, and that will not change on its own. Merge it yourself or ask
   for a human review."*
+- **`awaiting-human:held`** → success, and the only terminal state a person can
+  cause on purpose from outside the run. The hold label (section 0) was present,
+  the latch was disarmed once and the re-read proved it, and the label was left
+  in place. Report the PR URL, the resolved label name, and that removing the
+  label lets a later invocation resume — for example: *"PR #123 is on hold:
+  someone added the `lisa:hold` label, so I stopped instead of merging it.
+  Remove that label when you want it to continue."* Not a stall and not a
+  failure: a human asked for the PR to stop, and it stopped.
+- **`awaiting-human:hold-unknown`** → the hold label could not be read (twice),
+  so whether a human asked for a stop is **unknown**. The latch is disarmed and
+  the PR sits OPEN, on the fail-toward-hold rule in section 0. Report the read
+  error verbatim. This is deliberately NOT reported as `awaiting-human:held`:
+  that would file a broken permission or a rate limit as a human decision, and
+  the one thing nobody would then do is investigate it. Usually a missing
+  `issues: read` / label-read permission, which is fixable and invisible from
+  the merge outcome alone.
 - **`CLOSED`** → report (PR was closed without merge).
 - **Hard block needing a human**: an unresolvable conflict, a failing check that
   needs design input, or genuine unresolved human objection (not a bot gate). Stop

package/plugins/lisa-agy/skills/lisa-git-submit-pr/SKILL.md

@@ -48,6 +48,8 @@ Recognized optional hints:
 
    This delegation is now load-bearing rather than a convenience: it is the only path that arms auto-merge, so skipping it leaves the PR open rather than quietly merging it. Reporting submission as complete without invoking it is a failed submit, not a partial one — say so instead of implying the PR is on its way to merged.
 
+   **The hold label needs no check here, and adding one would be dead code.** `drive-pr-to-merge` evaluates its hold gate before it arms anything, so a PR created with the label already on it is never armed — by the delegation, not by a second check in this skill. That guarantee used to require one: while step 5 armed the latch at creation, a hold that covered only the loop left the creation-time arm wide open, which is why CodySwannGT/lisa#3558 asked for a check in both places. Step 5 no longer arms, so there is nothing here for a label to gate. If you are adding one because the ticket says to, re-read step 5 first.
+
 ### Native Development Linkage
 
 Add provider-appropriate linkage to the PR title and/or body without changing the status lifecycle:

package/plugins/lisa-agy/skills/lisa-repair-intake/SKILL.md

@@ -186,7 +186,9 @@ rule — never hardcode status/label strings. The relevant repair roles:
 
 In addition to the lifecycle roles above, the build lifecycle defines the **`human_needed` marker** — an additive label (`jira.labels.human_needed` / `github.labels.build.human_needed` / `linear.labels.build.human_needed`, default `Human Needed` / `human-needed`) that rides alongside `blocked` when the block needs human-only input no agent or retry can supply (see `config-resolution` "Build markers"). repair-intake's interaction with the marker is asymmetric and is the whole point of the distinction below:
 
-- The blocks repair-intake **itself writes** are the auto-recoverable kind — it files a build-ready fix ticket and moves the item `blocked` *blocked by that ticket*, expecting the next cycle to self-heal. Those are **not** `human_needed`; if such an item arrives already carrying a stale `human_needed` marker, repair-intake **clears** it (the block is no longer waiting on a human).
+- The blocks repair-intake **itself writes** are the auto-recoverable kind — it files a build-ready fix ticket and moves the item `blocked` *blocked by that ticket*, expecting the next cycle to self-heal. Those are **not** `human_needed`; if such an item arrives carrying a `human_needed` marker **this skill applied on an earlier cycle**, repair-intake **clears** it (the block is no longer waiting on a human).
+- **Never remove a `human_needed` marker this skill did not apply.** "Stale" is a judgment about the block's kind, not about who applied the marker or when — so without this rule an operator's deliberate hold, applied *after* correcting a wrong transition, is indistinguishable from a leftover the sweep is designed to clear, and gets swept. Establish provenance from the label event's actor (`rejection-detection` **Automation-reversal memory** reads the same surfaces); if provenance is not readable, **leave the marker in place**. Removing a human's hold is unrecoverable within the loop; leaving a stale one costs a cycle and is visible.
+- The marker is consulted **before **any** repair transition**, not only before Class C. Class C's hard stop is the strictest reading of it, but a marker that is honoured on one classification path and ignored on the other three is not a guard — and Class A, dependency clearing, is exactly the path an operator reverting a wrongly-cleared blocker is trying to protect. Match it robustly (hyphen/underscore, case-insensitive, label set and note prose) wherever it is read.
 - The blocks the **vendor agent** writes when repair-intake re-dispatches it (its pre-flight gate) carry `human_needed` already — the agent owns that marker. repair-intake leaves it in place.
 
 Resolve with the standard role-read pattern (local overrides global, default fallback):
@@ -305,6 +307,16 @@ Apply per candidate. Continue through the ordered list until every candidate ins
 native close/archive/complete, re-dispatch, or refreshed note), be recorded read-only, or be
 recorded under Errors. Do not stop after the first write; the cap is the batch boundary.
 
+**Before any lifecycle write on a candidate, classify it for `automation-reversal`** per
+`rejection-detection` **Automation-reversal memory** — a role change this skill made that a human
+then moved back. This runs once per candidate at the top of the walk, ahead of the branches below,
+because it wraps every repair path rather than belonging to one: a reversed rollup reconciliation
+involves no dependency link at all, and a reversed Class-B re-check is the same shape as a reversed
+Class-A clearing. Detection is a pure read and `unknown` **never blocks the sweep** — an item whose
+history or authorship cannot be read is judged by the normal rules below, treated as neither a
+reversal nor a clearance. A candidate classified `automation-reversal` skips the branches below and
+is handled per Loop prevention.
+
 ### Build `claimed` (stalled in-progress) → diagnose blocker, else resume in place
 
 **First check for an already-merged PR — this check is NOT gated on staleness.** Read the item's
@@ -478,9 +490,13 @@ re-issued against an unchanged conflicting head.
    new fix ticket (vendor-native: JIRA issue link `is blocked by`; GitHub/Linear `Blocked by:` line
    + label). Post a `[lisa-repair-intake]` note naming what it is blocked by and why. This block is
    **auto-recoverable** — the fix ticket will build and close on its own — so do **not** add the
-   `human_needed` marker, and if the item already carries a stale `human_needed` label, remove it
-   here (it is no longer waiting on a human). The `human_needed` marker is reserved for blocks a
-   human must clear; this one a later cycle clears automatically.
+   `human_needed` marker, and if the item carries a `human_needed` label **this skill applied on an
+   earlier cycle**, remove it here (it is no longer waiting on a human). The `human_needed` marker
+   is reserved for blocks a human must clear; this one a later cycle clears automatically.
+   **A marker this skill did not apply is never removed here** — see the marker's provenance rule
+   above. The block's kind says the *block* self-heals; it says nothing about why a human put a
+   hold on the item, and an operator's hold applied after correcting a wrong transition looks
+   identical to a leftover unless provenance is checked.
 3. **Record it** as a repair write. Do **not** dispatch the vendor agent for this item this cycle.
 
 The item now sits in `blocked`; once the fix ticket reaches a terminal state, the **Build
@@ -1026,6 +1042,14 @@ layer, and test ancestry against the remote.
   "no PR found" is `no-pr` and stays blocking.
 - **Human override** — an explicit human statement on this item that the dependency is satisfied
   clears it and outranks a failed containment check. Name it in the run record.
+- **Human hold** — the override runs in both directions. `human_needed` is checked here as well as
+  in Class C: an item carrying it is left `blocked` and recorded `skipped: human_needed`, without
+  running the containment check. Class A is the path an operator reverting a wrongly-cleared
+  blocker is protecting, so a marker honoured only on Class C is not honoured where it is most
+  often meant. Match it robustly (hyphen/underscore, case-insensitive, label set and note prose).
+  Symmetrically, an explicit human statement that the dependency is **not** satisfied keeps the
+  item blocked and outranks a *passing* containment check — the contract has an input channel for
+  "you may now proceed" and it needs one for "your reasoning was wrong".
 
 **A lifecycle status name is never the test.** `done`, `on-stg`, `on-dev` and `code-review` are
 labels that correlate with containment in a single-trunk workflow and come apart from it in a
@@ -1139,12 +1163,33 @@ cron tick.
   self-block** (so a human filling in one of several missing sections changes the fingerprint and
   triggers a re-check next cycle, rather than being suppressed as a no-op), terminal/open state,
   rollup child tally, and a timestamp.
+- The fingerprint also carries **authorship and an overturn bit**: the actor class of the most
+  recent lifecycle role change (`automation` / `human` / `unknown`), and whether that change
+  **reversed** a transition this skill made — the `automation-reversal` classification from
+  `rejection-detection` **Automation-reversal memory**. Without these the fingerprint records only
+  *what* the state is, never *who* set it or *whether the last automated decision was overturned*,
+  and those are the only fields that separate "the world moved on" from "a human told me I was
+  wrong".
 - Before writing a note or re-attempting a `blocked` item, compute the current fingerprint. If
   an identical fingerprint was already posted within the **backoff window**, skip the item
   silently (record as `still_blocked` / `active`, no write).
 - Backoff window default = `stale_after` (2h). `force=true` bypasses backoff for a manual run.
-- A *changed* fingerprint (new blocker state, new answers, new verdict) always warrants a fresh
-  note + re-attempt — backoff suppresses only no-op repeats.
+- A *changed* fingerprint (new blocker state, new answers, new verdict) warrants a fresh note +
+  re-attempt — backoff suppresses only no-op repeats.
+- **A change whose only cause is a human overturn is not a warrant.** Where the overturn bit is
+  set and no evidence postdates the reversal, the changed fingerprint is **not on its own a
+  warrant** to re-attempt: do not re-apply the reversed classification, leave the item where the
+  human put it, ensure `human_needed`, and record the outcome naming the **reversed transition**
+  and the classification that produced it. Re-attempt only on evidence postdating the reversal —
+  a blocker state change or a human comment supplying what was missing — cited in the run record.
+  Without this qualifier the revert *itself* changes the fingerprint and releases backoff, so the
+  faster a reviewer corrects a wrong transition, the sooner it returns.
+- **This inversion is signed per path.** It applies to the paths that decide whether to re-make a
+  lifecycle transition — Class A/B/C/D clearing and rollup reconciliation. It does **not** touch
+  the staleness model: there a human comment counts as forward progress and resets the staleness
+  clock, so an objecting comment already makes the item look active and this skill leaves it
+  alone. That reading is protective; a single global "human activity no longer counts" would
+  switch it off while reading like a tightening.
 
 ## Lifecycle ownership guard
 
@@ -1261,6 +1306,12 @@ Report outcomes in these buckets:
 - `normalized_ready` — GitHub issues missing official lifecycle labels that were classified and
   given the configured PRD/build `ready` label so normal intake can claim them.
 - `still_blocked` — examined and intentionally left `blocked`, with the active reason.
+- `reversal_suppressed` — a repair this skill previously made was reversed by a human, so the
+  classification was **not** re-applied. Name the **reversed transition** (role, direction, and
+  when), the classification that produced it, and that the item now carries `human_needed`. This
+  bucket is never merged into `still_blocked`: "I declined to act because I was overruled" and "I
+  examined it and the blocker stands" are different facts about the loop, and only the first tells
+  an operator their correction was received.
 - `active` — skipped because current work is not stale (or within backoff).
 - `errors` — items that failed evaluation, with the error.
 
@@ -1280,7 +1331,7 @@ to each item* — the two never merge in the one-line summary.
 | Nothing actionable — the idle case (walk step 5): examined N, all active or in backoff — including a fix ticket suppressed by a prior decline (`rejection-detection` **Proposal rejection memory**), which the summary names in its suppression count | `nothing-needed` |
 | Repairs applied **and confirmed** this cycle — `resumed` / `resynced` / `recovered` / `unblocked` / `closed_out` / `rolled_up` / `relinked` / `normalized_ready` | `change-proved` |
 | Repair produced new work for a human to pick up — e.g. an unmergeable PR or failed deploy filed as a **build-ready fix ticket** and left `blocked` | `candidate-proposed` |
-| A repair reached an autonomy boundary needing a human (a protected-deploy approval before it can proceed) | `approval-requested` |
+| A repair reached an autonomy boundary needing a human (a protected-deploy approval before it can proceed), **or a repair this loop previously made was reversed by a human** and is therefore suppressed and escalated to `human_needed` (`reversal_suppressed`) rather than re-attempted | `approval-requested` |
 | The loop itself could not run — the queue is unreadable, tracker credentials are revoked, or an open-and-closed rejection-memory / blocker-marker search is unreadable and therefore must not fall through to `nothing-needed` | `recovery-required` |
 | The runbook's **Retirement condition** tripped | `policy-obsolete` — **never reached by design for this loop** (see Retirement evaluation below) |
 
@@ -1343,6 +1394,12 @@ stuck work accumulates), or interleaved on a longer cadence.
   do."
 - Never re-dispatch a `blocked` build item unless every parsed blocker is cleared (conservative
   dependency clearing).
+- Never re-make a transition a human reversed. Classify every candidate for `automation-reversal`
+  before any lifecycle write (`rejection-detection`), and on a hit leave the item where the human
+  put it with `human_needed`, naming the reversed transition in the run record. Re-attempt only on
+  evidence postdating the reversal.
+- Never remove a `human_needed` marker this skill did not apply, and consult the marker before
+  **any** repair transition rather than only before Class C.
 - Repair every materially actionable candidate inside the `max_candidates` cap; default cap is 100.
 - Default GitHub `intake_mode` is `both` when both PRD and build namespaces exist.
 - Honor the backoff window — never re-post an identical `[lisa-repair-intake]` note within it

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.7",
+  "version": "4.34.9",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.7",
+  "version": "4.34.9",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.7",
+  "version": "4.34.9",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.7",
+  "version": "4.34.9",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.7",
+  "version": "4.34.9",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.34.7",
+  "version": "4.34.9",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/block-direct-issue-create.sh

@@ -1399,12 +1399,190 @@ def nested_operands(argv):
 inspected_files = set()
 
 
+# Interpreters whose OPERAND is a program they run. Broader than a shell list
+# because `file_creation` recognises a creation in any language — the
+# `node wrapper.mjs` that speaks HTTP directly is exactly the shape #3484
+# measured as a fail-open, so narrowing this to shells would reopen it.
+EXECUTING_INTERPRETERS = {
+    "bash", "dash", "ksh", "sh", "zsh",
+    "bun", "deno", "node", "nodejs", "perl", "php",
+    "python", "python3", "ruby", "ts-node", "tsx",
+}
+
+# `.` and its `source` alias run the named file in the CURRENT shell.
+SOURCE_BUILTINS = {"source", "."}
+
+# Wrappers that run what FOLLOWS them without changing what it is, mapped to
+# (options whose value is a SEPARATE token, positional operands consumed).
+# The positional count is why this is a table: `timeout 5 bash create.sh` puts
+# an operand between the wrapper and the interpreter, so a walk that steps over
+# `-flags` only stops at `5` and never reaches the interpreter.
+EXEC_WRAPPERS = {
+    "builtin": (frozenset(), 0),
+    "command": (frozenset(), 0),
+    "exec": (frozenset({"-a"}), 0),
+    "env": (frozenset({"-u", "--unset", "-C", "--chdir", "--argv0"}), 0),
+    "nice": (frozenset({"-n", "--adjustment"}), 0),
+    "nohup": (frozenset(), 0),
+    "setsid": (frozenset(), 0),
+    "stdbuf": (frozenset({"-i", "-o", "-e"}), 0),
+    "sudo": (frozenset({"-u", "--user", "-g", "--group", "-C", "--close-from"}), 0),
+    "time": (frozenset(), 0),
+    "timeout": (frozenset({"-k", "--kill-after", "-s", "--signal"}), 1),
+}
+
+# Interpreter options that mean "no script file follows": a command string or a
+# module name, both of which the guard reads by other means or not at all.
+NO_SCRIPT_OPTIONS = {"-c", "-e", "-m", "--eval", "--command", "--module"}
+
+# Programs that READ their operands and never execute them as programs.
+#
+# This is an allowlist of readers rather than the inverse, and the asymmetry is
+# deliberate. An UNKNOWN program with a file operand is still followed, because
+# whether it executes that operand is genuinely unknowable from the command —
+# and a probe in this guard's own suite drives it with a runner nobody
+# enumerated precisely so a fix keyed on a list of interpreters fails. Failing
+# closed on the unknown keeps that coverage.
+#
+# What the list buys is the measured population of #3705, every member of which
+# is a well-known inspector: `git diff`, `grep -n`, `wc -l`, a `git grep`
+# PATHSPEC, `sed -n '1,50p'`, and a test run. `git` is here wholesale because no
+# git subcommand executes a named file as a program — `git commit -F <file>` and
+# `git grep -- <pathspec>` both take the path as data.
+#
+# Test runners are here on purpose and it is the one entry worth arguing about.
+# `vitest <file>` does run that file, so the executes-rule would follow it — but
+# running a test is not filing an issue, and refusing a test run is the sharpest
+# harm #3705 records, because it can block the verification of a fix while
+# saying nothing about why.
+#
+# RESIDUAL, stated rather than hidden: a reader NOT on this list is still
+# followed and can still over-refuse. The set of read-only tools is unbounded,
+# so this closes the measured population and not the class. Add names here as
+# they are measured; do not invert the default to close it by fiat, or the
+# executed-script reach that #3484 bought is lost.
+READ_ONLY_PROGRAMS = {
+    "awk", "bat", "cat", "cksum", "cmp", "column", "comm", "cut", "diff",
+    "du", "file", "fold", "git", "grep", "head", "hexdump", "jest", "jq",
+    "less", "ls", "md5", "md5sum", "more", "nl", "od", "pytest", "rg",
+    "sed", "sha1sum", "sha256sum", "shellcheck", "shfmt", "sort", "stat",
+    "strings", "tail", "tee", "uniq", "vitest", "wc", "xxd", "yamllint",
+}
+
+
+def executing_command(argv):
+    """The program this command runs, and the tokens after it.
+
+    Steps over leading variable assignments and over wrappers that do not
+    change what runs. Reading a wrapper as the command is how a payload hides
+    from a classifier that inspects only a segment's first word.
+
+    Args:
+        argv: One command's tokens.
+
+    Returns:
+        A triple (token, program, args); (None, None, []) when none is named.
+        The raw token is carried alongside the basename because a script run by
+        bare path — `./create.sh`, relying on its shebang — has no interpreter
+        to recognise, and the command word IS the thing being executed.
+    """
+    index = 0
+    while index < len(argv):
+        token = argv[index]
+        if "=" in token and not token.startswith(("=", "-")):
+            index += 1
+            continue
+        program = basename(token)
+        if program not in EXEC_WRAPPERS:
+            return (token, program, argv[index + 1 :])
+        separate, positional = EXEC_WRAPPERS[program]
+        index += 1
+        while index < len(argv) and argv[index].startswith("-"):
+            option = argv[index]
+            if option == "--":
+                index += 1
+                break
+            index += 2 if option in separate else 1
+        index += positional
+    return (None, None, [])
+
+
+def executed_operand(argv):
+    """The path this command EXECUTES, or None.
+
+    THIS IS THE COMMAND-POSITION QUESTION, and declining to ask it is what
+    #3705 records: the guard opened any readable file any token named, then
+    justified a refusal from that FILE's contents rather than from the
+    COMMAND's behaviour. Measured refusals included `git diff`, `grep -n`,
+    `wc -l`, a `git grep` PATHSPEC and a test run — every one of them read-only,
+    and one of them blocked running the tests that would have proved a fix.
+
+    `parity-safety-net.sh` already states the rule this restores, and names the
+    opposite as the known-wrong fix (`origin/main`, lines 337-346 and 704-705):
+    "Only a COMMAND POSITION can execute something. A path anywhere else is an
+    argument, and an argument is data." `block-no-verify.sh:495-513`
+    (`strip_command_prefix`) implements the same split with a fail-closed third
+    state. Both live in this directory; this guard was the one that declined.
+
+    NOT narrowed to shells, and NOT narrowed to an enumerated interpreter list.
+    `file_creation` recognises a creation in any language, so `node wrapper.mjs`
+    must still be followed — a measured fail-open in #3484 — and this guard's
+    own suite drives it with a runner nobody enumerated, precisely so a fix
+    keyed on such a list fails. So the default for an unrecognised program is to
+    FOLLOW, and only a known reader is exempt. A script run by bare path with no
+    interpreter at all (`./create.sh`, via its shebang) is followed too: there
+    the command word is itself the thing being executed.
+
+    Reading a REQUEST PAYLOAD is a separate question with a separate answer:
+    `payload_text` resolves `--data-binary @file` and friends by flag name, so
+    narrowing this walk does not stop a creation whose body lives in a file
+    from being seen.
+
+    Args:
+        argv: One command's tokens.
+
+    Returns:
+        The operand token naming a program that will run, or None.
+    """
+    token, program, args = executing_command(argv)
+    if program is None:
+        return None
+    # A reader takes its operands as data. This is the #3705 population.
+    if program in READ_ONLY_PROGRAMS:
+        return None
+    if program in SOURCE_BUILTINS:
+        return args[0] if args else None
+    # A command word that is ITSELF a readable file is being executed by its
+    # shebang — `./create.sh` names no interpreter and runs all the same.
+    if program not in EXECUTING_INTERPRETERS and resolve_operand(token) is not None:
+        return token
+    # `bash < create.sh` runs that file as surely as `bash create.sh` does, and
+    # `<` is not a segment boundary, so the pair survives in one argv.
+    for index, argument in enumerate(args):
+        if argument == "<" and index + 1 < len(args):
+            return args[index + 1]
+    # Reached by a known interpreter AND by a program this parser cannot name.
+    # The unknown case is followed on purpose — see READ_ONLY_PROGRAMS.
+    for argument in args:
+        if argument == "--":
+            continue
+        if argument.startswith("-"):
+            # A command string or a module name; no script file follows.
+            head = argument.split("=", 1)[0]
+            if argument in NO_SCRIPT_OPTIONS or head in NO_SCRIPT_OPTIONS:
+                return None
+            continue
+        return argument
+    return None
+
+
 def file_operands(argv):
-    """Files this command names, in the order they appear.
+    """The file this command EXECUTES, if it executes one.
 
-    Every token is offered, and the ones that name a readable regular file are
-    kept. Deciding WHICH programs execute their operands is the unbounded
-    question this file already refuses to ask, so it is not asked here either.
+    Deciding WHICH programs execute their operands is the question this file
+    used to refuse to ask, and refusing it is what made the guard read a path
+    quoted as prose inside a `--body-file` markdown and attribute its contents
+    to the command. It is answered in `executed_operand` now.
 
     Args:
         argv: One command's tokens.
@@ -1413,7 +1591,8 @@ def file_operands(argv):
         Existing paths, deduplicated across the whole scan and capped.
     """
     paths = []
-    for token in argv:
+    operand = executed_operand(argv)
+    for token in [operand] if operand is not None else []:
         if len(paths) >= FILE_OPERANDS_PER_SEGMENT:
             break
         path = resolve_operand(token)

package/plugins/lisa-copilot/hooks/block-managed-file-edits.sh

@@ -415,11 +415,17 @@ EOF
     # what a tokenizer is for.
     #
     # The analyzer is read into a variable by `read -d ''` rather than run
-    # inside a `$(python3 - <<'PY' … PY)`. Bash has to find the closing paren of
-    # a command substitution by re-scanning its text, and a heredoc body nested
-    # there is scanned too: the lone backtick in `re.compile(r"[$`]")` below
-    # reads as an unterminated backtick substitution and the whole script fails
-    # to parse. Keeping the heredoc out of the substitution is the fix.
+    # inside a command substitution wrapping a here-document. Bash finds the
+    # closing paren of a command substitution by re-scanning its text, and a
+    # here-document body nested there is scanned too: the lone backtick in
+    # `re.compile(r"[$`]")` below then reads as an unterminated backtick
+    # substitution and the whole script fails to parse. Keeping the
+    # here-document out of the substitution is the fix. This is also the shape
+    # `block-direct-issue-create.sh` already uses for its own classifier.
+    #
+    # The delimiter is deliberately not spelled out in this comment: a tool that
+    # greps for here-document starts would otherwise match the prose and read
+    # the wrong span.
     analyzer=''
     IFS= read -r -d '' analyzer <<'PY' || true
 import os

package/plugins/lisa-copilot/rules/eager/rejection-detection.md

@@ -48,4 +48,17 @@ A **loop-proposed** item that a human **closed as _not planned_** is a durable d
 - **Outcomes:** an all-suppressed cycle ends `nothing-needed` naming the **suppression count**; a memory check that cannot read the tracker ends `recovery-required`, never a silent `nothing-needed` (e.g. `Tracker unreachable during the decline check — restore credentials; nothing was filed this run.`).
 - **Concurrency:** search-then-write = convergence, not mutual exclusion — a transient duplicate is closed by the next run; no cross-run lock.
 
-Full contract (classification table, per-vendor bindings, reflection & evidence handoff, Proposal rejection memory): [reference/rejection-detection.md](../reference/rejection-detection.md).
+## Automation-reversal memory (repair-side — orthogonal to both halves above)
+
+A human who **undoes a lifecycle transition this flow made** is correcting the flow, not supplying new state. Every loop that writes a lifecycle role as a **repair** (`lisa-repair-intake`) consults this before re-making a transition. It is a third classification, never merged into `rejection-reclaim`: that one is anchored on the ready lane and answers a rejection with re-implementation; this one lands in `$BLOCKED` and answers a correction by withdrawing a decision.
+
+- **Seam:** top of the repair walk for each item, **before any lifecycle write** — after the write the current-lane signal is gone.
+- **Classify:** `automation-reversal` — a role change **authored by** this flow, then a later **backward** move of that role **authored by** a human, with no automation move after it. Otherwise `no-reversal`. Authorship unavailable or history unreadable → `unknown`.
+- **Authorship is the signal, not the backward move.** An item can return to `$BLOCKED` because a real new blocker appeared — that is the world moving on. Read the `actor` (GitHub timeline, Linear history) or `author` (JIRA changelog) through the access layers; an unexposed actor is `unknown`, never an assumed human. **A marker and a transition on the same item say nothing until you know their order** — compare timestamps, and treat an unorderable pair as `unknown`.
+- **Lanes from config** (`github.labels.build.blocked` + the JIRA/Linear equivalents, `config-resolution`) — never hardcode.
+- **Degrade:** `unknown` is **neither a reversal nor a clearance** — the item is judged by the loop's normal rules and detection **never blocks the sweep**. The learning-loop exclusion above applies unchanged.
+- **Rule:** on `automation-reversal`, do not re-apply the reversed classification; leave the item where the human put it, ensure `human_needed`, and **name the reversed transition in the run record**. Re-attempt **only** on evidence that **postdates the reversal**, cited in the run record — mirroring the re-proposal rule the proposal half enforces.
+- **A changed lifecycle role is no longer a sufficient warrant on its own.** A consuming loop's recurrence brake must carry **authorship and an overturn bit**, not state alone.
+- **Signed per path.** Apply the inversion only where the loop decides whether to re-make a transition. A staleness/keep-alive path where a human comment already *suppresses* action is protective — leave it. One global sign reads as tightening and removes that protection.
+
+Full contract (classification table, per-vendor bindings, reflection & evidence handoff, Proposal rejection memory, Automation-reversal memory): [reference/rejection-detection.md](../reference/rejection-detection.md).