@codyswann/lisa 4.38.0 → 4.38.2

package/all/copy-overwrite/scripts/lisa-hooks/block-direct-issue-create.sh

@@ -82,6 +82,36 @@
 # settings env block, CI config). An escape the governed agent reaches by
 # typing one more token in front of the command it was just refused is not an
 # escape hatch — it is the prose problem with extra steps.
+#
+# ## What this hook costs, and the number that would change the decision
+#
+# Registered `matcher: ""` since CodySwannGT/lisa#3753 — it runs on EVERY tool
+# call, not only Bash. Measured on a developer machine at load ~8-26, 50
+# invocations per row:
+#
+#     16.7 ms   enforce-team-first.sh          already `matcher: ""` today
+#     17.5 ms   enforce-verification-gate.sh   already `matcher: ""` today
+#     11.5 ms   this guard, non-Bash payload   what the broad matcher adds
+#    112.3 ms   this guard, Bash payload       what Bash calls already paid
+#
+# So the broad registration was not novel — two hooks were already there, this
+# one is cheaper than either, and it raises an existing ~34 ms per-call baseline
+# by about a third.
+#
+# THIS IS A THRESHOLD, NOT A PRECEDENT. The argument is about the TOTAL cost of
+# the broad set, so it does not transfer to the next guard: four more hooks
+# moved to `matcher: ""` would put ~90 ms on every tool call and the answer
+# flips. **Before widening any other hook's matcher, re-run the measurement and
+# reconsider if the broad set totals more than ~100 ms per tool call, or if any
+# single broad hook exceeds ~50 ms.** Do not cite these numbers for a fifth
+# hook; measure again, because the number that matters is the sum.
+#
+# The cost is also irreducible rather than sloppy. A 9-line script containing
+# only this file's preamble measured 11.7 ms, and padding it to this file's
+# length changed nothing (11.5 ms) — it is process spawn plus one `jq`, not
+# parsing. Moving the early exit further up the file buys nothing; the exit is
+# already ahead of config resolution, which is what keeps the figure at 11.5
+# rather than at the 112 ms the Bash path pays.
 set -euo pipefail
 
 input="$(cat)"
@@ -102,13 +132,72 @@ for required in jq python3; do
 done
 
 tool_name="$(printf '%s' "$input" | jq -r '.tool_name // empty' 2>/dev/null || true)"
+
+# ── The two substrates ────────────────────────────────────────────────────
+#
+# A creation reaches a tracker two ways, and until CodySwannGT/lisa#3753 this
+# guard saw only one of them. It was registered `matcher: "Bash"` AND gated
+# here on `tool_name != "Bash"`, so an MCP tool call was refused entry twice
+# over. MEASURED before the change, driving the guard with synthetic payloads:
+#
+#   ALLOW   mcp__linear-server__create_issue, undeclared      <- the defect
+#   ALLOW   mcp__github__create_issue, undeclared             <- the defect
+#   REFUSE  the same creation as `gh issue create` shell text <- control
+#   ALLOW   an ordinary Read tool call                        <- control
+#
+# The two controls are what make those ALLOWs mean anything: the refusal proves
+# the guard is live, the Read proves it is not simply refusing everything.
+#
+# **Widening the matcher alone would have changed nothing** — the call would
+# arrive and this gate would still exit 0. Anyone who "fixed" #3753 by editing
+# `plugin.json` would have seen no test fail and shipped a guard that still
+# allows every MCP filing. The registration and this gate had to move together.
+#
+# The SHELL path below is untouched. A structured payload has no command line
+# to tokenise, so it gets its own small classifier rather than being forced
+# through a parser built for shell text.
+structured_call=""
 if [ "$tool_name" != "Bash" ]; then
-  exit 0
+  # The cheap shape gate, deliberately BEFORE config resolution.
+  #
+  # This hook now runs on EVERY tool call, so the cost of the path that does
+  # nothing is the cost of the whole change. Config resolution spawns two jq
+  # processes per lookup and is what makes the Bash path ~112 ms; putting it
+  # ahead of this gate would charge that to every Read and Grep. So the
+  # not-a-creation exit happens here, on a shell `case` with no subprocess.
+  #
+  # Matched on SHAPE, not on an enumerated list of server tool names. Server
+  # names are supplied by whoever wrote the server and change when one is
+  # added or renamed, so a list would pass every row anyone thought of and
+  # miss the first one nobody did — the failure mode this repository's guard
+  # suites are written to defeat.
+  #
+  # RESIDUAL, stated rather than hidden: a server whose creation tool is named
+  # without a create-verb or without a tracker noun (`mcp__x__file_work`) is
+  # not recognised and is allowed. That is a fail-open, and it is the honest
+  # cost of refusing to enumerate. Add shapes here as they are measured.
+  case "$tool_name" in
+    Bash | Read | Write | Edit | MultiEdit | Glob | Grep | Task | TodoWrite)
+      exit 0
+      ;;
+  esac
+  case "$tool_name" in
+    *[Cc]reate* | *[Nn]ew* | *[Aa]dd* | *[Ff]ile*) ;;
+    *) exit 0 ;;
+  esac
+  case "$tool_name" in
+    *[Ii]ssue* | *[Tt]icket* | *[Tt]ask* | *[Ss]tory* | *[Bb]ug* | *[Ee]pic* | *[Ww]ork*) ;;
+    *) exit 0 ;;
+  esac
+  structured_call="1"
 fi
 
-command_str="$(printf '%s' "$input" | jq -r '.tool_input.command // empty' 2>/dev/null || true)"
-if [ -z "$command_str" ]; then
-  exit 0
+command_str=""
+if [ -z "$structured_call" ]; then
+  command_str="$(printf '%s' "$input" | jq -r '.tool_input.command // empty' 2>/dev/null || true)"
+  if [ -z "$command_str" ]; then
+    exit 0
+  fi
 fi
 
 project_dir="${CLAUDE_PROJECT_DIR:-}"
@@ -1862,6 +1951,53 @@ print("ALLOW")
 PY
 
 set +e
+# ── The structured substrate ──────────────────────────────────────────────
+#
+# An MCP call carries named fields, not a command line, so `scan()` — which
+# tokenises shell text — has nothing to parse. The declaration is read from the
+# payload instead, and the recogniser is deliberately small: this path decides
+# ONE question (is a build-ready role or a human-gate marker present anywhere
+# in the submitted fields), where the shell path has to answer "which of these
+# tokens is a client, an endpoint, a flag value, or a file it executes".
+#
+# Every string in the payload is searched, at any depth, because a role lands
+# in a different field on every tracker — `labels[]` on GitHub, `stateId` or a
+# workflow state name on Linear, a transition `id` on JIRA — and enumerating
+# field names per vendor is the same brittleness as enumerating tool names.
+# Over-collecting is safe here: the values are compared against ONE configured
+# role string, so an unrelated field cannot accidentally satisfy it.
+if [ -n "$structured_call" ]; then
+  # The operator's ambient escape works on both substrates. There is no inline
+  # form to disqualify it here — a structured call has no shell in which to
+  # assign one — so the override is simply honoured.
+  if [ -n "$ambient_override" ]; then
+    exit 0
+  fi
+
+  structured_declaration="$(
+    printf '%s' "$input" |
+      jq -r --arg role "$ready_role" '
+        [(.tool_input // {}) | .. | strings] as $values
+        | if ($values | index($role)) then "role"
+          elif ($values | map(select(contains("[lisa-human-gate]"))) | length) > 0 then "gate"
+          else "" end
+      ' 2>/dev/null || printf 'UNREADABLE'
+  )"
+
+  # Fail closed on a creation-shaped call whose payload cannot be read. Silence
+  # about a filing the guard could not inspect is the defect this whole ticket
+  # is about, one substrate over.
+  if [ "$structured_declaration" = "UNREADABLE" ]; then
+    refuse "an unreadable $tool_name payload that reads as a tracker creation" \
+      "$ready_role" ""
+  fi
+
+  if [ -z "$structured_declaration" ]; then
+    refuse "a tracker creation through $tool_name" "$ready_role" ""
+  fi
+  exit 0
+fi
+
 verdict="$(
   printf '%s' "$classifier" |
     LISA_GUARD_COMMAND="$command_str" \

package/all/copy-overwrite/scripts/lisa-work-item.mjs

@@ -82,6 +82,14 @@ const NOT_A_DEPLOY_BRANCH = "not a deploy branch";
  * for a producer that, until this command existed, was prose in a SKILL.md.
  */
 const BACKLINK_COMMAND = "node scripts/lisa-work-item.mjs backlink";
+/**
+ * The subcommand that closes out the two gates a push had to defer.
+ *
+ * Named in the push report rather than described, because the push report is
+ * the only place an operator learns that two requirements are still open, and
+ * a list of open work with no command against it is a complaint.
+ */
+const DISCHARGE_COMMAND = "discharge-pr-gates";
 /**
  * The prefix only — an anchored, fixed-length literal with no quantifier, so
  * it cannot backtrack. The ReDoS was never here; it was in the `\s*(.+?)\s*$`
@@ -3053,11 +3061,24 @@ function currentRepository() {
   return safeJson(result.stdout, "GitHub repository").nameWithOwner;
 }
 
-function currentPullRequest(number, repository = currentRepository()) {
+function currentPullRequest(
+  number,
+  repository = currentRepository(),
+  fields = "url,body,state"
+) {
   const args = ["pr", "view"];
   if (number) args.push(String(number));
-  if (repository) args.push("--repo", repository);
-  args.push("--json", "url,body,state");
+  // `--repo` ONLY alongside a number, because `gh pr view --repo <r>` with no
+  // positional argument is a USAGE ERROR — "argument required when using the
+  // --repo flag" — not a lookup that returns nothing. It exits 1, this
+  // function reads that as "no pull request exists", and the push then takes
+  // the deferral branch on every branch that HAS one. Measured on this
+  // repository: an open pull request, and the push reporting gates 4 and 5 as
+  // unchecked because the flag combination could never have found it. Without
+  // a number `gh` resolves the pull request from the current branch's remote,
+  // which is the answer this caller wants and the only one it can get.
+  if (number && repository) args.push("--repo", repository);
+  args.push("--json", fields);
   const result = run("gh", args, { allowFailure: true });
   return result.status === 0
     ? safeJson(result.stdout, "GitHub pull request")
@@ -4158,6 +4179,61 @@ function pushDeferralNote(result) {
   return `no pull request exists yet, so gates 4 and 5 could not be checked here — CI will verify both.${spanning}`;
 }
 
+/**
+ * The two unchecked gates as open work, addressed to whoever runs the push.
+ *
+ * The wording is the whole point of this function, so it is worth saying what
+ * it is deliberately NOT: `WORK_ITEM_TRACKING_OK`. This same text used to be
+ * appended to that token, which made a finding arrive inside a success — and a
+ * finding inside a success is not a finding. Nobody reads an unmet requirement
+ * out of a line that opens by declaring the check passed, so the gate did the
+ * hard part (it knows exactly which two requirements it could not reach, and
+ * says so) and then threw the answer away in its own headline
+ * (CodySwannGT/lisa#3791).
+ *
+ * The exit code stays 0, and that is not the same compromise. A push is the
+ * only way to make a branch exist on the remote, and a pull request cannot be
+ * opened for a branch the remote has never seen — so refusing here would be a
+ * refusal with no remedy, and the first push of every branch would be
+ * impossible. What is available at this moment is the OTHER half of a control:
+ * name the unmet requirements as unmet, and name the command that discharges
+ * them the moment they become checkable. `discharge-pr-gates` is that command,
+ * and it is what makes this list closeable rather than merely honest.
+ *
+ * Gate 5 is stated as inapplicable rather than unresolved under the `trailer`
+ * level, because a run that contacted no tracker has not left a backlink
+ * unposted — it is not required at all there. Listing it as open work would
+ * ask an operator to resolve something no check will ever look at.
+ * Exported so the report can be asserted in-process. The push path reaches it
+ * only through a spawned child, where a mutation run records no coverage and
+ * scores every line of this text as unreached — so the subprocess cases prove
+ * the WIRING and the direct cases prove the WORDS.
+ * @param {object} result Commit-side result.
+ * @param {string} label Prefix naming the ref, empty for a single-ref push.
+ * @returns {string} The whole report, replacing the success line.
+ */
+export function unresolvedPushReport(result, label) {
+  const contract = result.contract;
+  const refs = result.refs ?? [];
+  const declaration = refs.map(ref => `Work-Item: ${ref}`).join("\n     ");
+  const backlinkLine =
+    contract.verify === "full"
+      ? `  UNRESOLVED gate 5 — each item needs a managed \`${MARKER}\` backlink comment pointing at the pull request. \`discharge-pr-gates\` posts it; nothing else has to remember to.`
+      : `  n/a         gate 5 — the tracker backlink is not required here: workItem.verify is "trailer".`;
+  return [
+    `WORK_ITEM_TRACKING_INCOMPLETE ${label}${result.relevant} commit(s)${alreadyTraced(result)}: gates 1-3 proved here, 2 of 5 gates NOT CHECKED.`,
+    `  This push is not a clean bill of health for ${refs.join(", ")}. ${pushDeferralNote(result)}`,
+    `  UNRESOLVED gate 4 — the pull-request BODY must carry, on its own line${refs.length > 1 ? "s" : ""}:`,
+    `     ${declaration}`,
+    `     \`Refs #n\` and \`Closes #n\` do NOT satisfy it.`,
+    backlinkLine,
+    `  Discharge both the moment the pull request exists — it evaluates them and`,
+    `  posts what it can, so neither waits for CI to reveal it:`,
+    `     node scripts/lisa-work-item.mjs ${DISCHARGE_COMMAND}`,
+    gateSummary(contract),
+  ].join("\n");
+}
+
 /**
  * Report one pushed ref's outcome, refusing when it did not prove out.
  * @param {{result?: object, error?: Error}} outcome Commit-side outcome.
@@ -4177,9 +4253,20 @@ function reportPushGroup(outcome, pr, label) {
   // CI — so the checklist goes out either way. Saying nothing is precisely
   // what made those two gates separate CI-cycle surprises (#2681).
   if (outcome.error) throw withGateSummary(outcome.error);
-  console.log(
-    `WORK_ITEM_TRACKING_OK ${label}${outcome.result.relevant} commit(s); ${pushDeferralNote(outcome.result)}${gateSummary(outcome.result.contract)}`
-  );
+  // A range naming no work item is a different fact from a range whose
+  // declaration nobody checked, and the two must not share a sentence. Nothing
+  // here is deferred: a release commit and a back-merge have no item for a
+  // pull-request body to declare or a tracker to link, so gates 4 and 5 have
+  // NOTHING to check rather than something unchecked. Reporting those as open
+  // work would put an unresolvable item on every release push, which is how a
+  // checklist teaches the reader to skip it.
+  if ((outcome.result.refs ?? []).length === 0) {
+    console.log(
+      `WORK_ITEM_TRACKING_OK ${label}${outcome.result.relevant} commit(s)${alreadyTraced(outcome.result)}; this range names no work item, so gates 4 and 5 have nothing to check here.`
+    );
+    return;
+  }
+  console.log(unresolvedPushReport(outcome.result, label));
 }
 
 function validatePush(args) {
@@ -4202,6 +4289,116 @@ function validatePush(args) {
   }
 }
 
+/**
+ * Refuse, but as "there is nothing here to check" rather than "this failed".
+ *
+ * Its own exit code because the two answers ask opposite things of whoever is
+ * reading. `1` says a requirement is unmet and the change must not proceed;
+ * `3` says this command was run somewhere it has no subject — before the pull
+ * request exists, or on a branch that has none. A caller that fires this
+ * automatically (the PostToolUse hook does, after any `gh pr` command,
+ * including ones that failed) must be able to tell them apart without parsing
+ * prose, or every failed `gh pr create` would report a work-item violation
+ * that did not happen.
+ * Exported so the code and the wording can be asserted without a tracker: an
+ * error object is a value, and the whole content of this one is which number
+ * it carries.
+ * @returns {Error} The refusal, carrying its own exit code.
+ */
+export function noPullRequestToDischarge() {
+  const error = new TrackingError(
+    `${DISCHARGE_COMMAND} found no pull request for this branch, so gates 4 ` +
+      `and 5 have no subject yet. Open the pull request, then run it again.`
+  );
+  error.exitCode = 3;
+  error.selfExplanatory = true;
+  return error;
+}
+
+/**
+ * Close out gates 4 and 5 at the first moment they can be checked.
+ *
+ * A push cannot check them: both are properties of a pull request, and the
+ * push is what makes the pull request possible. Until this command existed the
+ * next thing that looked was CI, one cycle later — so a body missing its
+ * `Work-Item:` line, or an item missing its backlink, cost a full red run to
+ * discover something that was knowable the second the pull request opened
+ * (CodySwannGT/lisa#3791).
+ *
+ * It does not merely CHECK gate 5, it satisfies it. The managed backlink is
+ * something a producer can write and no human should have to remember, and the
+ * reason it has to be written at all is a coupling neither rule states on its
+ * own: the convention is to reference an item with `Refs #n` rather than
+ * `Closes #n`, so the merge cannot close it before deploy and verification —
+ * and `Refs` populates no native development link for gate 5 to read. The
+ * non-closing rule is what MAKES the managed comment mandatory.
+ *
+ * Gate 4 is checked and never written. The body is the author's declaration of
+ * what this change is for; a command that inserted the line would be answering
+ * its own question, and the gate would be proving that this command can write.
+ * @param {string[]} args Command arguments.
+ */
+function dischargePrGates(args) {
+  const remote = option(args, "--remote", "LISA_PR_REMOTE") || "origin";
+  const pr = currentPullRequest(
+    option(args, "--pr-number", "LISA_PR_NUMBER"),
+    undefined,
+    "url,body,state,commits"
+  );
+  if (!pr) throw noPullRequestToDischarge();
+  const configRef = remoteDefaultRef(remote);
+  const commits = (pr.commits ?? []).map(commit => commit.oid).filter(Boolean);
+  const first = commitOutcome(commits, configRef, remote);
+  const contract = first.result?.contract ?? trackerContract();
+  const refs = first.result?.refs ?? [];
+  const wrote = postDischargeBacklinks(refs, pr.url, contract);
+  // A SECOND read when anything actually changed, and the reason is the defect
+  // this whole file exists to avoid. `validatePrData` reads gate 5 out of the
+  // issue payload the FIRST pass cached — fetched before the comment above was
+  // posted — so validating against it would report a backlink missing that
+  // this command had just written, and the operator would be sent to fix
+  // something already fixed. Nothing is re-read when every backlink came back
+  // `unchanged`, because then the cached payload and the tracker agree.
+  const outcome = wrote ? commitOutcome(commits, configRef, remote) : first;
+  validatePrData(outcome, pr.url, pr.body);
+  console.log(
+    `WORK_ITEM_TRACKING_OK ${outcome.result.relevant} commit(s)${alreadyTraced(outcome.result)}, ${provedHere(contract)} — gates 4 and 5 discharged at the pull request, not deferred to CI`
+  );
+}
+
+/**
+ * Establish the managed backlink for every item this pull request carries.
+ *
+ * The writer is a parameter for the same reason `assertBacklink` takes its
+ * issue payload as one: it is the only part that touches a tracker, and
+ * without the seam the answer this function returns — did anything actually
+ * change, which is what decides whether the verification re-reads — can only
+ * be observed through a network round trip.
+ * @param {string[]} refs Work items the range names.
+ * @param {string} prUrl Pull request URL.
+ * @param {object} contract Resolved tracker contract.
+ * @param {Function} [post] Backlink writer, defaulting to the real one.
+ * @returns {boolean} True when any tracker write actually changed something.
+ */
+export function postDischargeBacklinks(
+  refs,
+  prUrl,
+  contract,
+  post = postBacklink
+) {
+  // `trailer` contacts no tracker anywhere else in this file, and it may not
+  // start here: a project that keeps no tracker credentials cannot satisfy a
+  // write, and gate 5 is not asked of it.
+  if (contract.verify !== "full") return false;
+  let changed = false;
+  for (const ref of refs) {
+    const outcome = post(ref, prUrl, contract);
+    changed ||= outcome !== "unchanged";
+    console.log(`work-item backlink ${outcome} on ${ref}: ${MARKER} ${prUrl}`);
+  }
+  return changed;
+}
+
 function validatePr(args) {
   const base = option(args, "--base", "LISA_PR_BASE_SHA");
   const head = option(args, "--head", "LISA_PR_HEAD_SHA") || "HEAD";
@@ -4317,8 +4514,9 @@ function main() {
   if (command === "validate-push-destination")
     return validatePushDestination(args);
   if (command === "validate-pr") return validatePr(args);
+  if (command === DISCHARGE_COMMAND) return dischargePrGates(args);
   throw new TrackingError(
-    "Usage: lisa-work-item.mjs link|current|attach-branch|clear|verify-level|contract-version|backlink|complete|sweep|prepare-commit-msg|validate-commit|validate-push|validate-push-destination|validate-pr" +
+    "Usage: lisa-work-item.mjs link|current|attach-branch|clear|verify-level|contract-version|backlink|complete|sweep|prepare-commit-msg|validate-commit|validate-push|validate-push-destination|validate-pr|discharge-pr-gates" +
       "\n(`bind` is accepted as an alias for `link`, but some agent harnesses refuse the token `bind` in a command line.)"
   );
 }
@@ -4343,7 +4541,10 @@ export function runCli() {
         ? `\n❌ ${detail}\n`
         : `\n❌ Work-item tracking blocked this operation: ${detail}\n\n${GUIDANCE}\n`
     );
-    process.exitCode = 1;
+    // A refusal may name its own exit code, and one does: `discharge-pr-gates`
+    // answers 3 for "no pull request to check yet", which is not a violation
+    // and must not read as one to a caller that only has the status to go on.
+    process.exitCode = error?.exitCode ?? 1;
   }
 }
 

package/dist/core/lisa-owned-hash-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAo/BjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAu5BjC,CAAC"}
+{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAy/BjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA45BjC,CAAC"}

package/dist/core/lisa-owned-hash-ledger.js

@@ -598,11 +598,13 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "22184f1dd1b96e818741bd4ae659446299535d7ce594817155edebac4172a7ba",
         "2832037d6c8d7930a111519dee0cca0ed0110deba3988f8e713bb9203de254df",
         "2e030d5a394d3edb48c391db49661fb3d45545c85f88ea03d1ab07ad3787c089",
+        "412209ea2329a64737eeffa4ffc9b6f9371f14cf86419fd0626361a99188a3f8",
         "5b3bd8a3460524457435f51a0994fb12009c97fffb921375bc79db3798acbabf",
         "5c5a9f1c39f99e493a575784f70379eb857c4963da5d400b6ee86f0e69fc5402",
         "60a4f94ec671b2372f7492680ab327d97aff686588ce85791f54e0fbd098b0ca",
         "63c2f9b54ea30997905bc6e17709dd1300436204ac82ad16717d7cc215af262b",
         "698131242f9ea27ea00e864d4b302f4ccc4a24d1383cb8ca9f0b17b565796197",
+        "6edfeec55433192c89b955a026ca3b5a25ade8e04c3267542d1cd884cd0bb3bb",
         "73e94b73830d8961026947d99bf4ac5f959b5bca025203b913d8a6363cbe2b9f",
         "803752f85a9f013014be5d04e444c65f7d3eea476569c5d7048d4d13b8e0bb9e",
         "847dfca48823a495fc3de47dfdb4b26e49d6808c6570c46d024a99793df1d370",
@@ -879,6 +881,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "2c678c75d6de9b029f27fa6eec45b8421217a4fb5ef3412ad39883e10b213987",
         "2d9ca0841db9e75ddfd95e3a4d485fd01aa639a512ef648996f565b7991d8e2b",
         "3a9ec1ff863693a0fa0fef0ade6fa5534485d0249fb78302d37cdac3781348f1",
+        "3f8c59e0f4ad43211f6964b4889f3fc673bee0496ec3613bdbdc4544424340f6",
         "41b967f736d7fcf9d8928ad7c8cc767c5beb9544e2fbfa3317c65734aa02fcfd",
         "4372872a448d3b943dea5541167ed5be6155703b57b9f8224d19ddefd3b80898",
         "475cb9ef86c2ac54c8fd8cb6d63e9a55ea8cd0017e26efbe3c44391a4aeeab41",
@@ -892,6 +895,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "637741a9e5d2904aed24d48efd6bec1326c5573f718a13152807aa0e4b42f0a1",
         "653252b0bbfd19bdffa046a2173c053e566ac6bf605c8d9060f9cf71ad7386de",
         "6a8be8577242588f14ab52b25b2a22b6def53aefa9513b4d3d7c49f4d8027079",
+        "6afe796f5a69a68a026c79a64aa451eb2bf7907a0ace0d9079f8b4add16b886b",
         "6dadc065016e741568b6ae1ebcd0378085005c076fdb93346bad7c1fd9e3b8b8",
         "71ff42c2cb8ac7022e0066132476764dd745fb92bf19ccd395000b1fe319abc7",
         "7573b5170fcba45ccd6123cd0712baba8faa52f063b639140be829d9ce87327d",
@@ -916,6 +920,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "bdeab1cb7cbb427a69bc8450075b5d36d364a7b71e69666fef6966097084b0a5",
         "c78df9d5f0f3fc388ff60a7db5898478a2a4d6d7325833f10384b5a8c62bb34a",
         "cdea136456d2b9880c3abd2bbd402fb08051822b9e92484c66cd184ec7ed7d0f",
+        "ce1520dba31d32856d470cf744700e0636518dd3a767627d42ac0a77007d6813",
         "ce5ff040b1f75925bc286027dcb893649edfb408021916920b07105baa2d9949",
         "d0321aa197d748813a2451eaa1c509cc74aced19a7f887b14a4bb15a7a73a525",
         "d1b07166efb5534c1d9b0fd09032e311854477160244f5318925035392318d36",
@@ -1559,11 +1564,13 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "22184f1dd1b96e818741bd4ae659446299535d7ce594817155edebac4172a7ba",
         "2832037d6c8d7930a111519dee0cca0ed0110deba3988f8e713bb9203de254df",
         "2e030d5a394d3edb48c391db49661fb3d45545c85f88ea03d1ab07ad3787c089",
+        "412209ea2329a64737eeffa4ffc9b6f9371f14cf86419fd0626361a99188a3f8",
         "5b3bd8a3460524457435f51a0994fb12009c97fffb921375bc79db3798acbabf",
         "5c5a9f1c39f99e493a575784f70379eb857c4963da5d400b6ee86f0e69fc5402",
         "60a4f94ec671b2372f7492680ab327d97aff686588ce85791f54e0fbd098b0ca",
         "63c2f9b54ea30997905bc6e17709dd1300436204ac82ad16717d7cc215af262b",
         "698131242f9ea27ea00e864d4b302f4ccc4a24d1383cb8ca9f0b17b565796197",
+        "6edfeec55433192c89b955a026ca3b5a25ade8e04c3267542d1cd884cd0bb3bb",
         "73e94b73830d8961026947d99bf4ac5f959b5bca025203b913d8a6363cbe2b9f",
         "803752f85a9f013014be5d04e444c65f7d3eea476569c5d7048d4d13b8e0bb9e",
         "847dfca48823a495fc3de47dfdb4b26e49d6808c6570c46d024a99793df1d370",
@@ -1817,6 +1824,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "2c678c75d6de9b029f27fa6eec45b8421217a4fb5ef3412ad39883e10b213987",
         "2d9ca0841db9e75ddfd95e3a4d485fd01aa639a512ef648996f565b7991d8e2b",
         "3a9ec1ff863693a0fa0fef0ade6fa5534485d0249fb78302d37cdac3781348f1",
+        "3f8c59e0f4ad43211f6964b4889f3fc673bee0496ec3613bdbdc4544424340f6",
         "41b967f736d7fcf9d8928ad7c8cc767c5beb9544e2fbfa3317c65734aa02fcfd",
         "4372872a448d3b943dea5541167ed5be6155703b57b9f8224d19ddefd3b80898",
         "475cb9ef86c2ac54c8fd8cb6d63e9a55ea8cd0017e26efbe3c44391a4aeeab41",
@@ -1829,6 +1837,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "62f53156d425198609564e996f3844f52ab110e63f99f22e8338fcf7a83f316d",
         "653252b0bbfd19bdffa046a2173c053e566ac6bf605c8d9060f9cf71ad7386de",
         "6a8be8577242588f14ab52b25b2a22b6def53aefa9513b4d3d7c49f4d8027079",
+        "6afe796f5a69a68a026c79a64aa451eb2bf7907a0ace0d9079f8b4add16b886b",
         "6dadc065016e741568b6ae1ebcd0378085005c076fdb93346bad7c1fd9e3b8b8",
         "71ff42c2cb8ac7022e0066132476764dd745fb92bf19ccd395000b1fe319abc7",
         "7573b5170fcba45ccd6123cd0712baba8faa52f063b639140be829d9ce87327d",
@@ -1853,6 +1862,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "bdeab1cb7cbb427a69bc8450075b5d36d364a7b71e69666fef6966097084b0a5",
         "c78df9d5f0f3fc388ff60a7db5898478a2a4d6d7325833f10384b5a8c62bb34a",
         "cdea136456d2b9880c3abd2bbd402fb08051822b9e92484c66cd184ec7ed7d0f",
+        "ce1520dba31d32856d470cf744700e0636518dd3a767627d42ac0a77007d6813",
         "ce5ff040b1f75925bc286027dcb893649edfb408021916920b07105baa2d9949",
         "d0321aa197d748813a2451eaa1c509cc74aced19a7f887b14a4bb15a7a73a525",
         "d1b07166efb5534c1d9b0fd09032e311854477160244f5318925035392318d36",