@codyswann/lisa 4.42.6 → 4.42.7

package/expo/copy-overwrite/scripts/bdd/baseline.mjs

@@ -143,9 +143,18 @@ export function showAtRevision(root, revision, relative) {
 
 /**
  * List the feature files that existed at a revision.
+ *
+ * Three-state on purpose. `git ls-tree` exits 0 with EMPTY output for a
+ * revision that genuinely holds no features, so a non-zero exit is always
+ * "could not ask" and never "there were none". Handing both back as `[]` let
+ * one failed listing read as an empty baseline, and an empty `before` set
+ * produces no `scenario-deleted` and no `coverage-regression` finding at all —
+ * so the gate reported that nothing regressed having compared against nothing.
+ * That is the same hole `loadBaseline` already closes for the coverage map,
+ * left open on the feature files beside it.
  * @param {string} root - Repo root.
  * @param {string} revision - Commit-ish.
- * @returns {string[]} Repo-relative feature paths.
+ * @returns {{ok: boolean, files: string[]}} Listing, and whether it was taken.
  */
 function featureFilesAt(root, revision) {
   const result = git(root, [
@@ -156,11 +165,16 @@ function featureFilesAt(root, revision) {
     "--",
     "bdd/features",
   ]);
-  if (!result.ok) return [];
-  return result.stdout
-    .split("\n")
-    .map(line => line.trim())
-    .filter(line => line.endsWith(".feature"));
+  // probe-direction: fail-closed — `ok: false` reaches `loadBaseline`, which
+  // records the baseline UNAVAILABLE instead of empty.
+  if (!result.ok) return { ok: false, files: [] };
+  return {
+    ok: true,
+    files: result.stdout
+      .split("\n")
+      .map(line => line.trim())
+      .filter(line => line.endsWith(".feature")),
+  };
 }
 
 /**
@@ -198,12 +212,17 @@ export function loadBaseline(root, revision, headPlatforms = new Set()) {
       error = `bdd/coverage-map.json at that revision is not valid JSON: ${parseError.message}`;
     }
   }
+  const listing = featureFilesAt(root, revision);
   if (binary === null) {
     error = "git was not found, so no base revision could be read";
   } else if (!revisionExists) {
     error = "the requested base does not name a readable commit";
+  } else if (!listing.ok) {
+    error =
+      "the base revision's feature files could not be listed, so no scenario " +
+      "from it could be compared";
   }
-  const documents = featureFilesAt(root, revision)
+  const documents = listing.files
     .map(file => ({ file, source: showAtRevision(root, revision, file) }))
     .filter(document => document.source !== null);
   const platforms = new Set([

package/package.json

@@ -63,6 +63,7 @@
     "check:pipeline-status-reads": "node scripts/check-pipeline-status-reads.mjs",
     "check:whole-output-guards": "node scripts/check-whole-output-guards.mjs",
     "check:empty-subject-guards": "node scripts/check-empty-subject-guards.mjs",
+    "check:probe-absence-direction": "node scripts/check-probe-absence-direction.mjs",
     "check:shell-guard-refusals": "bun run build && $npm_execpath run lisa-test-run -- --adapter direct -- node scripts/check-shell-guard-refusal-coverage.mjs",
     "check:workflow-inputs": "node scripts/detect-stale-workflow-inputs.mjs --project . --project typescript/create-only --project rails/create-only --json",
     "check:conflict-markers": "node all/copy-overwrite/scripts/check-conflict-markers.mjs",
@@ -173,7 +174,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.42.6",
+  "version": "4.42.7",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -321,7 +322,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "1148474ed60b8770215ec537dd4c949d259cda45",
-  "gitHead": "1148474ed60b8770215ec537dd4c949d259cda45",
-  "lisaReleaseTag": "v4.42.6"
+  "lisaReleaseCommit": "d968e062e6a11798f0d1f7c138d611a0531d975e",
+  "gitHead": "d968e062e6a11798f0d1f7c138d611a0531d975e",
+  "lisaReleaseTag": "v4.42.7"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.42.6",
+  "version": "4.42.7",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.42.6",
+  "version": "4.42.7",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-drive-pr-to-merge/SKILL.md

@@ -617,6 +617,17 @@ gh api "repos/<owner>/<repo>/actions/runs?head_sha=<head>" --jq .total_count
 problem. If CI were merely slow you would see runs QUEUED, not absent. Resolve
 the conflict and the runs appear; nothing else will make them appear.
 
+**`<head>` must be the FULL 40-character SHA.** `head_sha=` does not match a
+prefix and does not reject one: an abbreviated SHA returns a clean
+`total_count: 0` — not a 404, not a validation error, an absence shaped exactly
+like "no workflow ran". Measured on one pull request's own head: `77f223b9d` →
+`total_count 0`, `77f223b9d8ffe7b172e9cac48b068b3bcac304c3` → `total_count 4`.
+Take the SHA from `gh pr view <pr> --json headRefOid --jq .headRefOid`, never
+from `git log --oneline` or a truncated line in a log or a UI. Copying a short
+SHA here makes EVERY pull request read as having no CI, and the natural next
+action — rebase and force-push — throws away the live run you could not see
+(#3848).
+
 **`mergeable` is computed asynchronously.** GitHub returns `null` while it is
 still working it out, so a single read on a freshly-opened PR can say `null` on
 a perfectly clean branch. Treat `null` as "cannot tell yet" and re-read — never

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/bootstrap-store.mjs

@@ -218,6 +218,9 @@ export function hasBootstrap(key, deps = {}) {
       );
       return true;
     } catch {
+      // probe-direction: fail-closed — false means "no bootstrap value proven
+      // present", which makes the setup flow ASK for one. A keychain that cannot
+      // be queried costs a redundant prompt, never a skipped bootstrap.
       return false;
     }
   }

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/preflight-secrets.mjs

@@ -270,6 +270,9 @@ export function runProbe(substrate) {
     });
     return true;
   } catch {
+    // probe-direction: fail-closed — false makes the caller behave as if no
+    // substrate existed and fall through to the provider, which is the stricter
+    // path, exactly as the paragraph above states.
     return false;
   }
 }

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/providers.mjs

@@ -178,6 +178,8 @@ function keychainServiceNames() {
       ([, name]) => name
     );
   } catch {
+    // probe-direction: neutral — the names only enrich a diagnostic message on a
+    // path that has already failed; no verdict reads them.
     // A locked, absent, or oversized keychain leaves the list empty.
     return [];
   }
@@ -253,6 +255,8 @@ export function providerCliPresent(prefix) {
       ).trim()
     );
   } catch {
+    // probe-direction: neutral — PATH presence is reported in the explanation of
+    // an already-failing lookup; it gates nothing on its own.
     return false;
   }
 }

package/plugins/lisa/.codex-plugin/skills/lisa-setup-workstation/scripts/workstation.mjs

@@ -66,6 +66,9 @@ export function locate(name, exec = boundedChildOutput) {
       exec("command", ["-v", name], { encoding: "utf8", shell: true })
     ).trim();
   } catch {
+    // probe-direction: fail-closed — null means "not proven present", and the
+    // setup flow responds by installing. A probe that cannot answer costs a
+    // redundant install, never a missing tool reported as present.
     return null;
   }
 }

package/plugins/lisa/hooks/threshold-ratchet.mjs

@@ -121,6 +121,10 @@ function git(args, cwd) {
       timeout: 30_000,
     });
   } catch {
+    // probe-direction: fail-closed — null never reaches a verdict as "no
+    // weakening found". `changePlan` turns it into `undeterminable`, which
+    // REFUSES, and `isPromotion` falls to the strict reading that keeps the
+    // allow list pinned to the baseline.
     return null;
   }
 }
@@ -166,6 +170,8 @@ function resolvePlan(mode, root, baseRef, onlyFiles) {
       try {
         return fs.readFileSync(path.join(root, f), "utf-8");
       } catch {
+        // probe-direction: fail-closed — an unreadable current file compares as
+        // absent against the baseline, which is the strict side of the ratchet.
         return null;
       }
     },

package/plugins/lisa/hooks/worktree-binding-guard.mjs

@@ -96,14 +96,35 @@ function git(args, cwd) {
       stdio: ["ignore", "pipe", "ignore"],
     }).trim();
   } catch {
+    // probe-direction: neutral — this helper REPORTS, it does not decide. Both
+    // callers below read null and each one says out loud what it could not do
+    // before returning, so no gate outcome follows from this null silently
+    // (#3848). Keep that true: a caller added here that spends null as an
+    // answer has to say so at its own line.
     return null;
   }
 }
 
-/** The worktree root containing `cwd`, or null when `cwd` is not in a repo. */
+/**
+ * The worktree root containing `cwd`, or null when `cwd` is not in a repo.
+ *
+ * `--show-toplevel` exits non-zero for two OPPOSITE reasons and hands back the
+ * same nothing for both: `cwd` is outside any repository — a real absence, and
+ * a call there is genuinely none of this guard's business — or git could not
+ * answer at all, where the binding is unproven rather than inapplicable. Only
+ * the second is a withdrawal of enforcement, and it is the one that must not
+ * pass for the first. `git --version` succeeds wherever git can run, so its
+ * failure is what separates them.
+ * @param {string} cwd Directory the tool call runs in.
+ * @returns {string|null} Absolute worktree root, or null.
+ */
 function worktreeRoot(cwd) {
   const top = git(["rev-parse", "--show-toplevel"], cwd);
-  return top ? resolve(top) : null;
+  if (top) return resolve(top);
+  if (git(["--version"], cwd) === null) {
+    say("git could not be run here, so the worktree binding is NOT enforced");
+  }
+  return null;
 }
 
 /**
@@ -117,7 +138,14 @@ function mainCheckout(cwd) {
     ["rev-parse", "--path-format=absolute", "--git-common-dir"],
     cwd
   );
-  return common ? dirname(resolve(common)) : null;
+  if (common) return dirname(resolve(common));
+  // Reached only for an `EnterWorktree` naming a worktree, which means a
+  // repository was already in hand — so failing here is "could not ask", and
+  // the consequence is that the claim goes unrecorded and the NEXT call's
+  // displacement check has nothing to compare against. Said out loud rather
+  // than returned as a quiet null (#3848).
+  say("git could not resolve the main checkout, so this claim is NOT recorded");
+  return null;
 }
 
 function stateFile(sessionId) {

package/plugins/lisa/scripts/design-variable-ids.mjs

@@ -298,6 +298,8 @@ async function callMcp(token, tool, args) {
       .map(part => part.text ?? "")
       .join("");
   } catch {
+    // probe-direction: neutral — this is a design-token lookup for a generator;
+    // no gate reads the result, and null renders as a missing token.
     return null;
   }
 }

package/plugins/lisa/skills/lisa-drive-pr-to-merge/SKILL.md

@@ -617,6 +617,17 @@ gh api "repos/<owner>/<repo>/actions/runs?head_sha=<head>" --jq .total_count
 problem. If CI were merely slow you would see runs QUEUED, not absent. Resolve
 the conflict and the runs appear; nothing else will make them appear.
 
+**`<head>` must be the FULL 40-character SHA.** `head_sha=` does not match a
+prefix and does not reject one: an abbreviated SHA returns a clean
+`total_count: 0` — not a 404, not a validation error, an absence shaped exactly
+like "no workflow ran". Measured on one pull request's own head: `77f223b9d` →
+`total_count 0`, `77f223b9d8ffe7b172e9cac48b068b3bcac304c3` → `total_count 4`.
+Take the SHA from `gh pr view <pr> --json headRefOid --jq .headRefOid`, never
+from `git log --oneline` or a truncated line in a log or a UI. Copying a short
+SHA here makes EVERY pull request read as having no CI, and the natural next
+action — rebase and force-push — throws away the live run you could not see
+(#3848).
+
 **`mergeable` is computed asynchronously.** GitHub returns `null` while it is
 still working it out, so a single read on a freshly-opened PR can say `null` on
 a perfectly clean branch. Treat `null` as "cannot tell yet" and re-read — never

package/plugins/lisa/skills/lisa-secrets-access/scripts/bootstrap-store.mjs

@@ -218,6 +218,9 @@ export function hasBootstrap(key, deps = {}) {
       );
       return true;
     } catch {
+      // probe-direction: fail-closed — false means "no bootstrap value proven
+      // present", which makes the setup flow ASK for one. A keychain that cannot
+      // be queried costs a redundant prompt, never a skipped bootstrap.
       return false;
     }
   }

package/plugins/lisa/skills/lisa-secrets-access/scripts/preflight-secrets.mjs

@@ -270,6 +270,9 @@ export function runProbe(substrate) {
     });
     return true;
   } catch {
+    // probe-direction: fail-closed — false makes the caller behave as if no
+    // substrate existed and fall through to the provider, which is the stricter
+    // path, exactly as the paragraph above states.
     return false;
   }
 }

package/plugins/lisa/skills/lisa-secrets-access/scripts/providers.mjs

@@ -178,6 +178,8 @@ function keychainServiceNames() {
       ([, name]) => name
     );
   } catch {
+    // probe-direction: neutral — the names only enrich a diagnostic message on a
+    // path that has already failed; no verdict reads them.
     // A locked, absent, or oversized keychain leaves the list empty.
     return [];
   }
@@ -253,6 +255,8 @@ export function providerCliPresent(prefix) {
       ).trim()
     );
   } catch {
+    // probe-direction: neutral — PATH presence is reported in the explanation of
+    // an already-failing lookup; it gates nothing on its own.
     return false;
   }
 }

package/plugins/lisa/skills/lisa-setup-workstation/scripts/workstation.mjs

@@ -66,6 +66,9 @@ export function locate(name, exec = boundedChildOutput) {
       exec("command", ["-v", name], { encoding: "utf8", shell: true })
     ).trim();
   } catch {
+    // probe-direction: fail-closed — null means "not proven present", and the
+    // setup flow responds by installing. A probe that cannot answer costs a
+    // redundant install, never a missing tool reported as present.
     return null;
   }
 }

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.42.6",
+  "version": "4.42.7",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/scripts/design-variable-ids.mjs

@@ -298,6 +298,8 @@ async function callMcp(token, tool, args) {
       .map(part => part.text ?? "")
       .join("");
   } catch {
+    // probe-direction: neutral — this is a design-token lookup for a generator;
+    // no gate reads the result, and null renders as a missing token.
     return null;
   }
 }

package/plugins/lisa-agy/skills/lisa-drive-pr-to-merge/SKILL.md

@@ -617,6 +617,17 @@ gh api "repos/<owner>/<repo>/actions/runs?head_sha=<head>" --jq .total_count
 problem. If CI were merely slow you would see runs QUEUED, not absent. Resolve
 the conflict and the runs appear; nothing else will make them appear.
 
+**`<head>` must be the FULL 40-character SHA.** `head_sha=` does not match a
+prefix and does not reject one: an abbreviated SHA returns a clean
+`total_count: 0` — not a 404, not a validation error, an absence shaped exactly
+like "no workflow ran". Measured on one pull request's own head: `77f223b9d` →
+`total_count 0`, `77f223b9d8ffe7b172e9cac48b068b3bcac304c3` → `total_count 4`.
+Take the SHA from `gh pr view <pr> --json headRefOid --jq .headRefOid`, never
+from `git log --oneline` or a truncated line in a log or a UI. Copying a short
+SHA here makes EVERY pull request read as having no CI, and the natural next
+action — rebase and force-push — throws away the live run you could not see
+(#3848).
+
 **`mergeable` is computed asynchronously.** GitHub returns `null` while it is
 still working it out, so a single read on a freshly-opened PR can say `null` on
 a perfectly clean branch. Treat `null` as "cannot tell yet" and re-read — never

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/bootstrap-store.mjs

@@ -218,6 +218,9 @@ export function hasBootstrap(key, deps = {}) {
       );
       return true;
     } catch {
+      // probe-direction: fail-closed — false means "no bootstrap value proven
+      // present", which makes the setup flow ASK for one. A keychain that cannot
+      // be queried costs a redundant prompt, never a skipped bootstrap.
       return false;
     }
   }

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/preflight-secrets.mjs

@@ -270,6 +270,9 @@ export function runProbe(substrate) {
     });
     return true;
   } catch {
+    // probe-direction: fail-closed — false makes the caller behave as if no
+    // substrate existed and fall through to the provider, which is the stricter
+    // path, exactly as the paragraph above states.
     return false;
   }
 }

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/providers.mjs

@@ -178,6 +178,8 @@ function keychainServiceNames() {
       ([, name]) => name
     );
   } catch {
+    // probe-direction: neutral — the names only enrich a diagnostic message on a
+    // path that has already failed; no verdict reads them.
     // A locked, absent, or oversized keychain leaves the list empty.
     return [];
   }
@@ -253,6 +255,8 @@ export function providerCliPresent(prefix) {
       ).trim()
     );
   } catch {
+    // probe-direction: neutral — PATH presence is reported in the explanation of
+    // an already-failing lookup; it gates nothing on its own.
     return false;
   }
 }

package/plugins/lisa-agy/skills/lisa-setup-workstation/scripts/workstation.mjs

@@ -66,6 +66,9 @@ export function locate(name, exec = boundedChildOutput) {
       exec("command", ["-v", name], { encoding: "utf8", shell: true })
     ).trim();
   } catch {
+    // probe-direction: fail-closed — null means "not proven present", and the
+    // setup flow responds by installing. A probe that cannot answer costs a
+    // redundant install, never a missing tool reported as present.
     return null;
   }
 }

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.42.6",
+  "version": "4.42.7",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.42.6",
+  "version": "4.42.7",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.42.6",
+  "version": "4.42.7",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.42.6",
+  "version": "4.42.7",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.42.6",
+  "version": "4.42.7",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.42.6",
+  "version": "4.42.7",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/threshold-ratchet.mjs

@@ -121,6 +121,10 @@ function git(args, cwd) {
       timeout: 30_000,
     });
   } catch {
+    // probe-direction: fail-closed — null never reaches a verdict as "no
+    // weakening found". `changePlan` turns it into `undeterminable`, which
+    // REFUSES, and `isPromotion` falls to the strict reading that keeps the
+    // allow list pinned to the baseline.
     return null;
   }
 }
@@ -166,6 +170,8 @@ function resolvePlan(mode, root, baseRef, onlyFiles) {
       try {
         return fs.readFileSync(path.join(root, f), "utf-8");
       } catch {
+        // probe-direction: fail-closed — an unreadable current file compares as
+        // absent against the baseline, which is the strict side of the ratchet.
         return null;
       }
     },

package/plugins/lisa-copilot/hooks/worktree-binding-guard.mjs

@@ -96,14 +96,35 @@ function git(args, cwd) {
       stdio: ["ignore", "pipe", "ignore"],
     }).trim();
   } catch {
+    // probe-direction: neutral — this helper REPORTS, it does not decide. Both
+    // callers below read null and each one says out loud what it could not do
+    // before returning, so no gate outcome follows from this null silently
+    // (#3848). Keep that true: a caller added here that spends null as an
+    // answer has to say so at its own line.
     return null;
   }
 }
 
-/** The worktree root containing `cwd`, or null when `cwd` is not in a repo. */
+/**
+ * The worktree root containing `cwd`, or null when `cwd` is not in a repo.
+ *
+ * `--show-toplevel` exits non-zero for two OPPOSITE reasons and hands back the
+ * same nothing for both: `cwd` is outside any repository — a real absence, and
+ * a call there is genuinely none of this guard's business — or git could not
+ * answer at all, where the binding is unproven rather than inapplicable. Only
+ * the second is a withdrawal of enforcement, and it is the one that must not
+ * pass for the first. `git --version` succeeds wherever git can run, so its
+ * failure is what separates them.
+ * @param {string} cwd Directory the tool call runs in.
+ * @returns {string|null} Absolute worktree root, or null.
+ */
 function worktreeRoot(cwd) {
   const top = git(["rev-parse", "--show-toplevel"], cwd);
-  return top ? resolve(top) : null;
+  if (top) return resolve(top);
+  if (git(["--version"], cwd) === null) {
+    say("git could not be run here, so the worktree binding is NOT enforced");
+  }
+  return null;
 }
 
 /**
@@ -117,7 +138,14 @@ function mainCheckout(cwd) {
     ["rev-parse", "--path-format=absolute", "--git-common-dir"],
     cwd
   );
-  return common ? dirname(resolve(common)) : null;
+  if (common) return dirname(resolve(common));
+  // Reached only for an `EnterWorktree` naming a worktree, which means a
+  // repository was already in hand — so failing here is "could not ask", and
+  // the consequence is that the claim goes unrecorded and the NEXT call's
+  // displacement check has nothing to compare against. Said out loud rather
+  // than returned as a quiet null (#3848).
+  say("git could not resolve the main checkout, so this claim is NOT recorded");
+  return null;
 }
 
 function stateFile(sessionId) {

package/plugins/lisa-copilot/scripts/design-variable-ids.mjs

@@ -298,6 +298,8 @@ async function callMcp(token, tool, args) {
       .map(part => part.text ?? "")
       .join("");
   } catch {
+    // probe-direction: neutral — this is a design-token lookup for a generator;
+    // no gate reads the result, and null renders as a missing token.
     return null;
   }
 }

package/plugins/lisa-copilot/skills/lisa-drive-pr-to-merge/SKILL.md

@@ -617,6 +617,17 @@ gh api "repos/<owner>/<repo>/actions/runs?head_sha=<head>" --jq .total_count
 problem. If CI were merely slow you would see runs QUEUED, not absent. Resolve
 the conflict and the runs appear; nothing else will make them appear.
 
+**`<head>` must be the FULL 40-character SHA.** `head_sha=` does not match a
+prefix and does not reject one: an abbreviated SHA returns a clean
+`total_count: 0` — not a 404, not a validation error, an absence shaped exactly
+like "no workflow ran". Measured on one pull request's own head: `77f223b9d` →
+`total_count 0`, `77f223b9d8ffe7b172e9cac48b068b3bcac304c3` → `total_count 4`.
+Take the SHA from `gh pr view <pr> --json headRefOid --jq .headRefOid`, never
+from `git log --oneline` or a truncated line in a log or a UI. Copying a short
+SHA here makes EVERY pull request read as having no CI, and the natural next
+action — rebase and force-push — throws away the live run you could not see
+(#3848).
+
 **`mergeable` is computed asynchronously.** GitHub returns `null` while it is
 still working it out, so a single read on a freshly-opened PR can say `null` on
 a perfectly clean branch. Treat `null` as "cannot tell yet" and re-read — never

package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/bootstrap-store.mjs

@@ -218,6 +218,9 @@ export function hasBootstrap(key, deps = {}) {
       );
       return true;
     } catch {
+      // probe-direction: fail-closed — false means "no bootstrap value proven
+      // present", which makes the setup flow ASK for one. A keychain that cannot
+      // be queried costs a redundant prompt, never a skipped bootstrap.
       return false;
     }
   }

package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/preflight-secrets.mjs

@@ -270,6 +270,9 @@ export function runProbe(substrate) {
     });
     return true;
   } catch {
+    // probe-direction: fail-closed — false makes the caller behave as if no
+    // substrate existed and fall through to the provider, which is the stricter
+    // path, exactly as the paragraph above states.
     return false;
   }
 }

package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/providers.mjs

@@ -178,6 +178,8 @@ function keychainServiceNames() {
       ([, name]) => name
     );
   } catch {
+    // probe-direction: neutral — the names only enrich a diagnostic message on a
+    // path that has already failed; no verdict reads them.
     // A locked, absent, or oversized keychain leaves the list empty.
     return [];
   }
@@ -253,6 +255,8 @@ export function providerCliPresent(prefix) {
       ).trim()
     );
   } catch {
+    // probe-direction: neutral — PATH presence is reported in the explanation of
+    // an already-failing lookup; it gates nothing on its own.
     return false;
   }
 }

package/plugins/lisa-copilot/skills/lisa-setup-workstation/scripts/workstation.mjs

@@ -66,6 +66,9 @@ export function locate(name, exec = boundedChildOutput) {
       exec("command", ["-v", name], { encoding: "utf8", shell: true })
     ).trim();
   } catch {
+    // probe-direction: fail-closed — null means "not proven present", and the
+    // setup flow responds by installing. A probe that cannot answer costs a
+    // redundant install, never a missing tool reported as present.
     return null;
   }
 }