@codyswann/lisa 4.4.13 → 4.4.15

package/all/copy-overwrite/scripts/lib/placeholder-expiry.mjs

@@ -33,20 +33,83 @@
 /** The marker a provisional value carries, followed by its condition key. */
 export const PLACEHOLDER_MARKER = "PLACEHOLDER-UNTIL:";
 
-/** Condition keys are plain slugs, so a marker cannot smuggle a regex. */
-const KEY = /PLACEHOLDER-UNTIL:\s*([a-z0-9][a-z0-9-]{0,63})/g;
+/**
+ * The marker, plus whatever token was written after it on the SAME line.
+ *
+ * Deliberately not "the marker followed by a WELL-FORMED key". Matching only
+ * well-formed keys meant a marker whose key was misspelled matched NOTHING, so
+ * a key one capital letter away from correct was neither expired nor
+ * unchecked — it passed the gate in silence, which is the precise fail-open
+ * shape this module's header says it exists to close. The marker is the
+ * commitment; the key's form is judged afterwards, so a misspelling becomes a
+ * finding instead of an exemption.
+ *
+ * The token class is identifier-shaped rather than "any non-space", and that is
+ * what separates a COMMITMENT from PROSE. A malformed key is still an attempt
+ * at an identifier. A marker followed by punctuation is this file specifying
+ * the marker, a regex containing it, or documentation quoting it — none of
+ * which is a promise anybody made. Without that distinction the module defining
+ * the marker reports itself, and a gate that fires on its own specification is
+ * one that gets deleted rather than heeded.
+ *
+ * The empty alternative catches a marker written with nothing after it on its
+ * line, which is a commitment naming no condition at all — reported, not
+ * skipped.
+ *
+ * Horizontal whitespace only. `\s*` crossed a newline, so a bare marker adopted
+ * the first token of the NEXT line as its key.
+ *
+ * The token runs to the next whitespace once it has STARTED as an identifier,
+ * and that boundary is what keeps a malformed key malformed. Stopping the
+ * capture at the first character outside the slug class read a marker written
+ * with the token `ready!` as the well-formed key `ready`: a predicate named
+ * `ready` then answered for a marker nobody wrote, and a marker whose predicate
+ * answered `false` produced neither `expired` nor `unchecked`. That is the
+ * fail-open shape this module exists to close, reintroduced one character at a
+ * time. Captured whole, `ready!` fails {@link isWellFormedKey} and is reported
+ * as unchecked, which is the honest answer for a commitment nothing evaluates.
+ *
+ * Note that this comment cannot SHOW the failing line: writing the marker with
+ * an identifier after it is a commitment as far as the scanner is concerned,
+ * and the sweep over the shipped tree reported this file the moment a draft of
+ * it did. That is the guard working, so the example is named rather than
+ * quoted.
+ *
+ * The capture is bounded rather than greedy: it is echoed into a report, and an
+ * unbounded match on a minified line would put the rest of that line there. The
+ * bound is 65 rather than 64 — one MORE than the longest well-formed key — so
+ * an over-long token is captured at a length `WELL_FORMED_KEY` rejects. Cutting
+ * at 64 would have turned a 200-character token into a valid-looking key.
+ */
+const MARKER_AND_TOKEN =
+  /PLACEHOLDER-UNTIL:[^\S\n]*([A-Za-z0-9_-][^\s]{0,64}|(?=\r?\n)|$)/g;
+
+/** A condition key is a plain slug, so a marker cannot smuggle a regex. */
+const WELL_FORMED_KEY = /^[a-z0-9][a-z0-9-]{0,63}$/;
+
+/**
+ * Whether a token read after a marker is a usable condition key.
+ * @param {string} key The token written after the marker.
+ * @returns {boolean} True when it is a plain slug.
+ */
+export function isWellFormedKey(key) {
+  return WELL_FORMED_KEY.test(key);
+}
 
 /**
  * The condition keys one source file declares.
+ *
+ * Malformed tokens are RETURNED, not filtered. They carry no predicate, so the
+ * caller reports them as unchecked — which is the honest answer for a
+ * commitment nothing can evaluate, and the one that keeps a typo from reading
+ * as an absence.
  * @param {string} source The file's contents.
  * @returns {string[]} The keys, in order of appearance, deduplicated.
  */
 export function placeholderKeys(source) {
   return [
     ...new Set(
-      [...String(source).matchAll(KEY)].flatMap(hit =>
-        hit[1] === undefined ? [] : [hit[1]]
-      )
+      [...String(source).matchAll(MARKER_AND_TOKEN)].map(hit => hit[1] ?? "")
     ),
   ];
 }
@@ -60,7 +123,7 @@ export function placeholderKeys(source) {
  * first's noise.
  * @param {object} options Inputs.
  * @param {Array<{file: string, source: string}>} options.files The sources to scan.
- * @param {Record<string, () => boolean>} options.conditions Predicate per key, true when the condition has arrived.
+ * @param {Record<string, () => boolean>} options.conditions Own-property predicate per key, true when the condition has arrived.
  * @returns {{expired: Array<{file: string, key: string}>, unchecked: Array<{file: string, key: string}>}} What must be corrected.
  */
 export function expiredPlaceholders({ files, conditions }) {
@@ -68,7 +131,16 @@ export function expiredPlaceholders({ files, conditions }) {
   const unchecked = [];
   for (const { file, source } of files) {
     for (const key of placeholderKeys(source)) {
-      const predicate = conditions[key];
+      // `Object.hasOwn`, not a plain read. `constructor` is a legal slug under
+      // the key pattern, so `conditions[key]` found `Object.prototype.constructor`
+      // on the prototype chain, passed the `typeof` check, was CALLED, returned
+      // a truthy object, and reported the placeholder expired. Same for
+      // `valueOf` and `toString`. A predicate nobody declared is not a
+      // predicate. A malformed key lands here too and has no own entry, so it
+      // becomes `unchecked` rather than silently passing.
+      const predicate = Object.hasOwn(conditions, key)
+        ? conditions[key]
+        : undefined;
       if (typeof predicate !== "function") {
         unchecked.push({ file, key });
         continue;

package/all/copy-overwrite/scripts/lisa-floor-collisions.mjs

@@ -63,8 +63,33 @@ const DEPENDENCY_SECTIONS = [
  * The prefix it skips is the comparator, which is the only thing that ever
  * precedes the number in a branch: `>=1.2.3`, `^1.2.3`, `~1.2.3`, `1.2.3`,
  * `>=1.2.3 <2`.
+ *
+ * The prefix is a CLOSED class of comparator characters rather than "anything
+ * that is not a digit", because `\D*` made every digit-bearing string look like
+ * a range. `file:../pkg2` parsed as a floor of `2.0.0`, and `collisions()`
+ * applies {@link isIncomparable} to the DEPENDENCY line only — so a protocol
+ * override carrying a digit invented a floor and reported a collision that does
+ * not exist. A false alarm in this check is the failure that gets it switched
+ * off, which costs the false negatives it was written to prevent.
+ *
+ * Minor and patch are OPTIONAL, and that is load-bearing rather than tidy.
+ * Demanding a full `x.y.z` made `^8` and `~1.2` read as carrying no floor at
+ * all, which is not a near-miss — it is the opposite of the truth. `^8` permits
+ * `>=8.0.0`, and calling that floorless broke this check in both directions at
+ * once: an override written `^8` was skipped on the reasoning that it had
+ * nothing to lose, and a dependency written `~1.2` was compared as `0.0.0` and
+ * lost to everything. The first is a false negative in a security check, which
+ * this file's own comments name as the failure mode it is built to avoid.
+ *
+ * A partial version's absent parts are zero because that is what the range
+ * means: `^8` is `>=8.0.0 <9.0.0` and `1.x` is `>=1.0.0 <2.0.0`. Only the lower
+ * bound is read here, so the upper half costs nothing to ignore.
+ *
+ * Still one left-to-right pass: the optional groups each have a literal `.`
+ * ahead of them, so there is no position at which the engine has two viable
+ * ways to match and nothing to backtrack over (S5852).
  */
-const BRANCH_VERSION = /^\D*(\d+)\.(\d+)\.(\d+)/;
+const BRANCH_VERSION = /^[\sv=><~^]*(\d+)(?:\.(\d+))?(?:\.(\d+))?/;
 
 /**
  * Lowest version a single disjunction branch permits.
@@ -81,7 +106,11 @@ function branchLowerBound(branch) {
   if (trimmed === "") return null;
   if (/^<=?\s*\d/.test(trimmed)) return [0, 0, 0];
   const match = BRANCH_VERSION.exec(trimmed);
-  return match ? match.slice(1, 4).map(Number) : null;
+  if (!match) return null;
+  // An absent minor or patch is zero, not missing: `^8` is `>=8.0.0`. Number()
+  // of undefined is NaN, which would compare as neither higher nor lower than
+  // anything and quietly disable the comparison it feeds.
+  return [match[1], match[2] ?? "0", match[3] ?? "0"].map(Number);
 }
 
 /**
@@ -95,8 +124,12 @@ function branchLowerBound(branch) {
  *
  * An alias spec (`npm:other-pkg@^1.2.3`) versions a different package
  * entirely; its number cannot be compared against a floor for this name, so it
- * returns null rather than a misleading answer. A spec carrying no version —
- * `*`, `latest`, `^8` — has no floor either.
+ * returns null rather than a misleading answer. A spec carrying no version at
+ * all — `*`, `latest` — has no floor either.
+ *
+ * A PARTIAL version is not one of those. `^8` and `~1.2` carry floors of
+ * `8.0.0` and `1.2.0`; this list used to name `^8` as floorless and the code
+ * agreed with it, which is how an override written that way went unchecked.
  *
  * `null` therefore means only "no floor was read here", and callers must not
  * read it as "nothing to check". Those are opposite answers: a range with no
@@ -108,11 +141,15 @@ function branchLowerBound(branch) {
 export function lowestPermitted(spec) {
   const raw = spec ?? "";
   if (/^\s*npm:/i.test(raw)) return null;
-  const bounds = raw
-    .split("||")
-    .map(branchLowerBound)
-    .filter(bound => bound !== null);
-  if (bounds.length === 0) return null;
+  // A floorless branch is not a branch to skip — it decides the answer. A
+  // disjunction permits the union of its branches, so `latest || ^8` permits
+  // everything `latest` does, and reading the range as `8.0.0` reports a floor
+  // the range does not have. Filtering the null out made the strongest branch
+  // speak for the weakest one, which is a floor read TOO HIGH: the caller's
+  // `compare(target, floor) >= 0` then skips a genuine collision, and a false
+  // negative in a security check is the one direction this file must not fail.
+  const bounds = raw.split("||").map(branchLowerBound);
+  if (bounds.some(bound => bound === null)) return null;
   return bounds.reduce((lowest, bound) =>
     compare(bound, lowest) < 0 ? bound : lowest
   );

package/all/copy-overwrite/scripts/lisa-postinstall.mjs

@@ -203,5 +203,14 @@ if (invokedAsScript(import.meta.url)) {
   // Unconditionally 0. See the module header: a non-zero postinstall aborts the
   // dependency install outright, which is strictly worse than a stale template
   // and would strand the project with no way to install the fix.
-  process.exit(0);
+  //
+  // `exitCode`, NOT `process.exit(0)`. Under a package manager stdout is a
+  // PIPE, and writes to a pipe are asynchronous — `process.exit` tears the
+  // process down without flushing them, so the banner this module exists to
+  // print could be truncated or lost entirely. The comment a few lines above
+  // calls a silent postinstall "the worst possible silence, since it is
+  // indistinguishable from the apply having succeeded", and the next statement
+  // was capable of causing exactly that. Setting `exitCode` makes the same
+  // unconditional-zero promise and lets the event loop drain first.
+  process.exitCode = 0;
 }

package/all/copy-overwrite/scripts/lisa-reconcile-policy.mjs

@@ -148,9 +148,14 @@ import {
 /**
  * The three context sets. Reached only when the read succeeded.
  * @typedef {object} ContextDrift
- * @property {string[]} missing Declared, not required on GitHub.
+ * @property {string[]} missing Declared, not required on GitHub. A name appears
+ *   here when ANY of its declarations is unsatisfied.
+ * @property {Array<{context: string, ruleset?: string, integration_id?: number}>} missingRecords
+ *   The unsatisfied (ruleset, context) pairs behind `missing`. What a repair
+ *   acts on: `missing` says which names to report, this says where each goes.
  * @property {LiveContext[]} extra Required on GitHub, not declared.
- * @property {string[]} matched Present on both sides.
+ * @property {string[]} matched Present on both sides, in EVERY ruleset that
+ *   declared them.
  */
 
 /**
@@ -633,25 +638,103 @@ export function readLivePolicy({ repo, gh }) {
  * beside a not-required `🔐 Credential Leakage` proving the same property,
  * `🧹 Lint` beside `🐢 Slow Lint Rules` — and a fuzzy match raises a false
  * alarm whose obvious fix is deleting the guard.
+ * ## Why a name alone is not the comparison
+ *
+ * A context declared in `github.rulesets.requiredChecks` carries structure —
+ * the ruleset that owns it, and often an `integration_id` pinning WHICH app may
+ * satisfy it. Reducing the declaration to a bare name threw that away, so a
+ * context declared pinned in one ruleset was reported as matched by an
+ * UNPINNED context of the same name in a different ruleset. No repair was
+ * produced, and the requirement stayed satisfiable by a writer the project
+ * never named — which is the whole property the pin exists to establish.
+ *
+ * The constraint applies only where the project actually declared one.
+ * A gate-derived context names no ruleset and no app, so it keeps matching on
+ * name against any active ruleset; nothing is tightened that was never stated.
  * @param {object} options Comparison inputs.
  * @param {string[]} options.declared Contexts `contextsFor` derived.
  * @param {LiveContext[]} options.live Contexts read from the rulesets.
- * @returns {ContextDrift} Three sets.
+ * @param {Record<string, string>} [options.homes] Declared ruleset per context,
+ *   from `declaredChecks`. A context absent here declares no owner.
+ * @param {Record<string, number>} [options.pins] Declared app id per context,
+ *   from `declaredChecks`. A context absent here declares no writer.
+ * @param {Array<{context: string, ruleset?: string, integration_id?: number}>} [options.records]
+ *   One record per declared (ruleset, context) pair, from `declaredChecks`.
+ *   Supplied, it is what the comparison is made of; absent, the name-keyed
+ *   `homes`/`pins` projection is reconstituted into equivalent records.
+ * @returns {ContextDrift} Three sets, plus the unsatisfied records.
  */
-export function reconcileContexts({ declared, live }) {
-  const liveNames = new Set((live ?? []).map(entry => entry.context));
+export function reconcileContexts({
+  declared,
+  live,
+  homes = {},
+  pins = {},
+  records,
+}) {
+  const liveContexts = live ?? [];
   const declaredNames = new Set(declared ?? []);
   const byName = (a, b) => a.localeCompare(b);
 
+  // The unit of declaration is a (ruleset, context) PAIR, not a name. A name
+  // set cannot hold `build` required by both `base` and `release`, so a live
+  // `build` in `release` alone answered for both and the `base` requirement was
+  // reported matched — a requirement that does not exist, reported satisfied.
+  const supplied = Array.isArray(records) ? records : null;
+  const reconstituted = [...declaredNames]
+    .filter(name => Object.hasOwn(homes, name))
+    .map(name => ({
+      context: name,
+      ruleset: homes[name],
+      // `Object.hasOwn`, not a truthiness test: an entry's absence and an entry
+      // holding a falsy value are different declarations, and the prototype
+      // chain is not a source of declared policy.
+      ...(Object.hasOwn(pins, name) ? { integration_id: pins[name] } : {}),
+    }));
+  const byContext = new Map();
+  for (const record of supplied ?? reconstituted) {
+    if (!declaredNames.has(record?.context)) continue;
+    if (!byContext.has(record.context)) byContext.set(record.context, []);
+    byContext.get(record.context).push(record);
+  }
+  // A gate-derived context names no ruleset and no app, so it keeps matching on
+  // name against any active ruleset; nothing is tightened that was never stated.
+  const declarations = [...declaredNames]
+    .sort(byName)
+    .flatMap(name => byContext.get(name) ?? [{ context: name }]);
+
+  const satisfies = (entry, record) => {
+    if (entry.context !== record.context) return false;
+    if (record.ruleset !== undefined && entry.ruleset !== record.ruleset) {
+      return false;
+    }
+    return !(
+      record.integration_id !== undefined &&
+      entry.integration_id !== record.integration_id
+    );
+  };
+  const unsatisfied = declarations.filter(
+    record => !liveContexts.some(entry => satisfies(entry, record))
+  );
+  const missingNames = new Set(unsatisfied.map(record => record.context));
+
   return {
-    missing: [...declaredNames]
-      .filter(name => !liveNames.has(name))
-      .sort(byName),
-    extra: (live ?? [])
+    // A NAME is missing when ANY of its declarations is unsatisfied, and
+    // matched only when every one of them is. The two stay mutually exclusive,
+    // and a partially-satisfied context can no longer report as done.
+    missing: [...missingNames].sort(byName),
+    // The specific pairs still to be written. `missing` says which names to
+    // report; this says where each one has to go — a distinction a name-keyed
+    // `homes` lookup cannot make once two rulesets want the same context.
+    missingRecords: unsatisfied,
+    // EXTRA stays name-based. A live context whose name IS declared is not
+    // unexpected — it is the same requirement in the wrong shape, already
+    // reported through `missing`. Listing it here too would tell `--prune` to
+    // delete the thing the repair is about to add.
+    extra: liveContexts
       .filter(entry => !declaredNames.has(entry.context))
       .sort((a, b) => a.context.localeCompare(b.context)),
     matched: [...declaredNames]
-      .filter(name => liveNames.has(name))
+      .filter(name => !missingNames.has(name))
       .sort(byName),
   };
 }
@@ -860,6 +943,15 @@ export function declaredChecks(requiredChecks = {}) {
   const contexts = [];
   const homes = {};
   const pins = {};
+  // The RECORD is the declaration; `homes` and `pins` are a name-keyed
+  // projection of it that cannot represent a context required by two rulesets.
+  // `homes[context] = ruleset` is last-write-wins, so `build` required in both
+  // `base` and `release` kept only `release` — and a live `build` in `release`
+  // alone marked the declaration matched while the `base` requirement stayed
+  // missing and unrepaired. The projections remain because callers use them to
+  // ROUTE a repair for a context that has exactly one home; they are no longer
+  // what the comparison is made of.
+  const records = [];
   for (const [ruleset, entries] of Object.entries(requiredChecks ?? {})) {
     if (!Array.isArray(entries)) continue;
     for (const entry of entries) {
@@ -867,12 +959,48 @@ export function declaredChecks(requiredChecks = {}) {
       if (typeof entry.context !== "string") continue;
       contexts.push(entry.context);
       homes[entry.context] = ruleset;
-      if (Number.isInteger(entry.integration_id)) {
-        pins[entry.context] = entry.integration_id;
-      }
+      const pinned = Number.isInteger(entry.integration_id);
+      if (pinned) pins[entry.context] = entry.integration_id;
+      records.push({
+        context: entry.context,
+        ruleset,
+        ...(pinned ? { integration_id: entry.integration_id } : {}),
+      });
     }
   }
-  return { contexts, homes, pins };
+  return { contexts, homes, pins, records };
+}
+
+/**
+ * Where an awaited context should be written.
+ *
+ * An awaited context is declared on a GATE, not in `requiredChecks`, so it
+ * names no ruleset of its own. `POLICY_RULESET_NAME` is its DEFAULT home
+ * because that is where Lisa's own generator writes it, which is what lets the
+ * two writers agree without anyone passing `--ruleset`.
+ *
+ * A default, though, and not an override — which is what it had become. The
+ * name was assigned directly, so an explicit `--ruleset` was silently ignored
+ * for exactly these contexts, and a repository with no ruleset called `base`
+ * was told to go and seed one instead of falling back to the single carrier it
+ * already had. Both are answers to a question the caller had already answered.
+ *
+ * `null` means "no declared home", which sends the context down the normal
+ * fallback path in `planContextRepairs` and surfaces that path's real
+ * diagnosis — ambiguous carriers, or none at all — rather than a message about
+ * a ruleset the project never mentioned.
+ * @param {LivePolicy} live Result of `readLivePolicy`.
+ * @param {string|null} [rulesetName] An explicit `--ruleset` name.
+ * @returns {string|null} Ruleset name to write to, or null for the fallback.
+ */
+export function awaitedHome(live, rulesetName = null) {
+  const rulesets = live?.rulesets ?? [];
+  if (rulesetName)
+    return repairTarget(rulesets, rulesetName).ruleset?.name ?? null;
+  if (rulesets.some(entry => entry?.name === POLICY_RULESET_NAME)) {
+    return POLICY_RULESET_NAME;
+  }
+  return repairTarget(rulesets, null).ruleset?.name ?? null;
 }
 
 /**
@@ -923,16 +1051,21 @@ export function rulesetPayload(
     return payload;
   }
 
+  // An ADDITION REPLACES a same-named check in this ruleset rather than losing
+  // to it. Only a context the comparison reported unsatisfied HERE reaches
+  // `add`, so an existing check of that name in this ruleset is by construction
+  // the wrong shape — the unpinned form of a pinned declaration, or one pinned
+  // to an app the project did not name. Keeping it and de-duplicating the
+  // addition away wrote a PUT that preserved the wrong pin, so the repair
+  // reported success and converged on nothing: the next run found the same
+  // drift, planned the same repair, and reported the same success forever.
+  const added = new Map(additions.map(check => [check.context, check]));
   const kept = (rule.parameters?.required_status_checks ?? []).filter(
-    check => !remove.includes(check?.context)
+    check => !remove.includes(check?.context) && !added.has(check?.context)
   );
-  const present = new Set(kept.map(check => check?.context));
   rule.parameters = {
     ...rule.parameters,
-    required_status_checks: [
-      ...kept,
-      ...additions.filter(check => !present.has(check.context)),
-    ],
+    required_status_checks: [...kept, ...added.values()],
   };
   payload.rules = rules;
   return payload;
@@ -1021,6 +1154,26 @@ export function planRepairs({
   return plan;
 }
 
+/**
+ * The pins that apply to ONE ruleset's additions.
+ *
+ * Three sources, in increasing authority: the name-keyed map (awaited-context
+ * pins, which are declared per context and belong to no ruleset), this group's
+ * own declared pins, and this group's declarations that state NO pin. The last
+ * is why a merge is not enough — an unpinned declaration has to remove an
+ * inherited value, and spreading objects can only add.
+ * @param {object} options Inputs.
+ * @param {Record<string, number>} options.pins Name-keyed declared and awaited pins.
+ * @param {Record<string, number>} options.groupPins Pins declared on this ruleset.
+ * @param {Set<string>} options.unpinned Contexts this ruleset declares without a pin.
+ * @returns {Record<string, number>} Pins to apply to this ruleset's additions.
+ */
+function pinsFor({ pins, groupPins, unpinned }) {
+  const effective = { ...pins, ...groupPins };
+  for (const context of unpinned) delete effective[context];
+  return effective;
+}
+
 /**
  * Group the context repairs by the ruleset each one belongs to.
  *
@@ -1053,10 +1206,17 @@ function planContextRepairs({
   pins,
   homes,
 }) {
-  /** @type {Map<string, {add: string[], remove: string[]}>} */
+  /** @type {Map<string, {add: string[], remove: string[], pins: Record<string, number>, unpinned: Set<string>}>} */
   const groups = new Map();
   const group = name => {
-    if (!groups.has(name)) groups.set(name, { add: [], remove: [] });
+    if (!groups.has(name)) {
+      groups.set(name, {
+        add: [],
+        remove: [],
+        pins: {},
+        unpinned: new Set(),
+      });
+    }
     return groups.get(name);
   };
   const problems = [];
@@ -1069,10 +1229,36 @@ function planContextRepairs({
   }
 
   let fallback;
-  for (const context of contexts.missing) {
-    const home = homes[context];
-    if (home) {
-      group(home).add.push(context);
+  // Planned per RECORD, not per name. A context required by two rulesets needs
+  // an addition in each one that lacks it, and `homes[context]` can only name
+  // one of them — so routing by name repaired one requirement and silently
+  // abandoned the other. `missingRecords` is the unsatisfied (ruleset, context)
+  // pairs; a record without a ruleset is gate-derived and still routes through
+  // `homes` and then the fallback, exactly as before.
+  const missingRecords =
+    contexts.missingRecords ??
+    (contexts.missing ?? []).map(context => ({ context }));
+  for (const record of missingRecords) {
+    const context = record.context;
+    const home = record.ruleset ?? homes[context];
+    const target = home ? group(home) : null;
+    if (target) {
+      target.add.push(context);
+      // A declared record is authoritative about its own pin — INCLUDING the
+      // absence of one. `pins` is name-keyed and last-write-wins, so if `base`
+      // declares a context unpinned and `release` pins it to app 99, the
+      // name-keyed value is 99 and the `base` addition inherited it: a pin the
+      // project never declared for that ruleset, written by the repair itself.
+      // Silently narrowing WHO may satisfy a required check is the same class
+      // of harm as silently widening it — both replace a stated policy with an
+      // invented one — so the record's silence is recorded, not defaulted over.
+      if (record.ruleset !== undefined) {
+        if (Number.isInteger(record.integration_id)) {
+          target.pins[context] = record.integration_id;
+        } else {
+          target.unpinned.add(context);
+        }
+      }
       continue;
     }
     fallback ??= repairTarget(live.rulesets, rulesetName);
@@ -1084,7 +1270,7 @@ function planContextRepairs({
   }
 
   const actions = [];
-  for (const [name, { add, remove }] of groups) {
+  for (const [name, { add, remove, pins: groupPins, unpinned }] of groups) {
     const ruleset = (live.rulesets ?? []).find(entry => entry?.name === name);
     if (!ruleset) {
       actions.push({
@@ -1103,7 +1289,16 @@ function planContextRepairs({
       rulesetId: ruleset.id,
       add,
       remove,
-      payload: rulesetPayload(ruleset, { add, remove, awaited, pins }),
+      payload: rulesetPayload(ruleset, {
+        add,
+        remove,
+        awaited,
+        // The name-keyed map still carries AWAITED pins, which are declared per
+        // context and have no ruleset of their own, so it stays the base. A
+        // declared record then overrides it — with its pin, or by deleting the
+        // inherited one when the declaration states none.
+        pins: pinsFor({ pins, groupPins, unpinned }),
+      }),
     });
   }
   for (const problem of [...new Set(problems)]) {
@@ -1241,7 +1436,19 @@ export function reconcile({
     };
   }
 
-  const contexts = reconcileContexts({ declared, live: live.contexts });
+  // The structured declaration travels through the comparison, so a pinned
+  // context is not reported as satisfied by an unpinned one somewhere else.
+  // Only `configured` is passed: it is what the project actually declared. The
+  // awaited-context homes below are a routing hint for repairs, not a stated
+  // expectation, and treating them as one would report drift nobody declared.
+  const contexts = reconcileContexts({
+    declared,
+    live: live.contexts,
+    homes: configured.homes,
+    pins: configured.pins,
+    records: configured.records,
+  });
+  const resolvedAwaitedHome = awaitedHome(live, rulesetName);
   const settings = reconcileSettings({ policy, live });
   const drifted =
     contexts.missing.length > 0 ||
@@ -1264,17 +1471,21 @@ export function reconcile({
         awaited: awaitedContexts(gates, moment),
         pins: { ...configured.pins, ...awaitedPins(gates, moment) },
         // An awaited context has no ruleset in its declaration — it is declared
-        // on a GATE. Its home is the ruleset Lisa generates from config, which
-        // is where the applier writes it, so the two writers agree instead of
-        // the reconciler needing --ruleset to place a context the generator
-        // already placed.
+        // on a GATE. Its home defaults to the ruleset Lisa generates from
+        // config, which is where the applier writes it, so the two writers
+        // agree instead of the reconciler needing --ruleset to place a context
+        // the generator already placed. `awaitedHome` keeps that default while
+        // letting an explicit --ruleset win and falling back when the default
+        // ruleset does not exist here.
         homes: {
-          ...Object.fromEntries(
-            awaitedContexts(gates, moment).map(context => [
-              context,
-              POLICY_RULESET_NAME,
-            ])
-          ),
+          ...(resolvedAwaitedHome === null
+            ? {}
+            : Object.fromEntries(
+                awaitedContexts(gates, moment).map(context => [
+                  context,
+                  resolvedAwaitedHome,
+                ])
+              )),
           ...configured.homes,
         },
       })
@@ -1342,8 +1553,16 @@ export function render(result) {
     `${result.verdict.toUpperCase()} — ${result.repo} at ${result.moment}`,
     `  matched: ${result.contexts.matched.length} context(s)`,
   ];
-  for (const name of result.contexts.missing) {
-    lines.push(`  MISSING  ${name}  (declared, not required on GitHub)`);
+  // Reported per unsatisfied PAIR where there is one, so a context required by
+  // two rulesets and present in one names the ruleset still lacking it. A
+  // reader who is told only the name looks at the ruleset that already has it.
+  for (const record of result.contexts.missingRecords ??
+    result.contexts.missing.map(context => ({ context }))) {
+    lines.push(
+      record.ruleset
+        ? `  MISSING  ${record.context}  (declared on "${record.ruleset}", not required there on GitHub)`
+        : `  MISSING  ${record.context}  (declared, not required on GitHub)`
+    );
   }
   for (const entry of result.contexts.extra) {
     lines.push(

package/all/copy-overwrite/scripts/lisa-schema-validate.mjs

@@ -87,7 +87,18 @@ const KEYWORD_FORMS = Object.freeze({
       Array.isArray(value) && value.every(entry => typeof entry === "string"),
     form: "an array of property names",
   },
-  properties: { accepts: isSchemaObject, form: "an object of subschemas" },
+  properties: {
+    // The VALUES, not just the container. Checking only the container accepted
+    // `{"properties": {"a": true}}` — a form the rest of this file explicitly
+    // does not implement, as `items` and `additionalProperties` both say in so
+    // many words. The boolean then reached `validateNode` and threw, so a
+    // malformed schema crashed the validator instead of producing the
+    // validation finding this allowlist exists to produce. The failure was one
+    // step later than the check that was supposed to catch it.
+    accepts: value =>
+      isSchemaObject(value) && Object.values(value).every(isSchemaObject),
+    form: "an object whose values are subschema objects (a boolean is not implemented)",
+  },
   additionalProperties: {
     accepts: value => typeof value === "boolean",
     form: "a boolean (a subschema is not implemented)",

package/cdk/package-lisa/package.lisa.json

@@ -29,7 +29,7 @@
       "@vitest/coverage-v8": "^4.1.0",
       "eslint-plugin-oxlint": "^1.62.0",
       "oxlint": "^1.62.0",
-      "oxlint-tsgolint": "^0.22.1",
+      "oxlint-tsgolint": "^0.24.0",
       "@stryker-mutator/core": "^9.0.0",
       "@stryker-mutator/vitest-runner": "^9.0.0"
     },

package/dist/core/lisa-owned-hash-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA8kBjC,CAAC"}
+{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA+lBjC,CAAC"}