@codyswann/lisa 4.49.0 → 4.50.0

package/scripts/lisa-enforcement-fallback.sh

@@ -273,6 +273,178 @@ resolve_vintages() {
     plugin_tree_version="$json_version"
   fi
   note_version "$plugin_tree_version" "$plugin_tree"
+
+  # The channel this dispatcher races. Deliberately NOT folded into
+  # `note_version`: the newest-on-disk maximum answers "is this copy behind
+  # something local", and the plugin channel's age is a separate question
+  # about a copy that runs in parallel rather than instead.
+  resolve_plugin_channel || true
+}
+
+# ---------------------------------------------------------------------------
+# The other channel
+#
+# YOU CANNOT RETIRE A REFUSAL BY SHIPPING A FIX.
+#
+# These guards reach an agent by two independent channels: this dispatcher,
+# registered in `.claude/settings.json`, and the plugin manifest, which
+# registers the same guards individually. An agent sees the UNION of the two
+# verdicts, so a TIGHTENING on either channel takes effect at once while a
+# RELAXATION is inert until the slower channel catches up — the stale copy goes
+# on refusing, and its refusal wins. What the operator sees is a guard blocking
+# something `main` already permits, which reads as the guard being WRONG rather
+# than OLD, and the move that reading suggests is to route around it.
+#
+# The two channels are two different files refreshed by two different
+# mechanisms: `scripts/lisa-hooks/` when `lisa apply` runs, the plugin's own
+# `hooks/` when the plugin updates. They drift. Measured on one machine on one
+# day, two checkouts of the SAME repository resolved plugin 4.32.2 and 4.47.0.
+#
+# `plugin_tree` above cannot see any of that: it is repo-relative, so it exists
+# only inside the Lisa monorepo, and in a host project the plugin actually in
+# force is somewhere else entirely. The vintage machinery written for #3205
+# was therefore blind to the channel it races. This resolves it properly, from
+# the record the runtime itself keeps.
+#
+# WHAT THIS RECORD CAN AND CANNOT ANSWER. The header above explains why a
+# previous stand-down keyed on `installed_plugins.json` was removed: the record
+# is project-blind as it was read then, enablement-blind (`enabledPlugins` can
+# switch a plugin off without removing its entry), and session-blind (hooks load
+# at session start; the record is rewritten on any install). Those defeat a
+# LIVENESS question — "are the plugin's guards running in this session?" — and
+# nothing on disk answers that one.
+#
+# This asks a different question: "what VINTAGE is the plugin installed for this
+# project?" The record answers that directly, and the project-blindness is
+# resolved by keying the lookup on this repo root rather than on the plugin name.
+# The remaining two blindnesses bound the claim rather than break it: a skew
+# reported here is a real difference between two copies on disk, but a disabled
+# or not-yet-loaded plugin may mean those copies are not both firing right now.
+# So the wording below reports what is INSTALLED and what the union WOULD mean,
+# and never asserts that both channels are live. Reporting is also why this may
+# use the record at all where a stand-down may not: an over-reported skew costs
+# a line of notice, while an over-confident stand-down costs enforcement.
+plugin_channel_version=""
+plugin_channel_path=""
+
+# Resolve the vintage of the guard channel the PLUGIN MANIFEST runs.
+#
+# `plugins/installed_plugins.json` records installs PER PROJECT DIRECTORY —
+# which is exactly why one checkout sits versions behind another on the same
+# disk — so the lookup is keyed on this repo root, not on the machine.
+#
+# A record is claimed only when its `installPath` sits under a `lisa/lisa/`
+# marketplace cache. A locally-installed plugin does not match and is left
+# UNRESOLVED on purpose: reporting "agree" about a copy that was never read is
+# the failure this whole section exists to end, and an honest "I could not
+# tell" is the safe direction.
+#
+# `grep` does the scanning because the record runs to tens of thousands of
+# lines; the bash loop then sees a handful. Called only from resolve_vintages,
+# so it inherits that latch and never runs on the silent allow path.
+resolve_plugin_channel() {
+  local config_dir="${CLAUDE_CONFIG_DIR-}"
+  [ -n "$config_dir" ] || config_dir="${HOME-}/.claude"
+  local record="$config_dir/plugins/installed_plugins.json"
+  [ -f "$record" ] || return 1
+
+  local install_pattern="^[[:space:]]*\"installPath\"[[:space:]]*:[[:space:]]*\"(.*/lisa/lisa/[^\"]+)\""
+  local version_pattern="^[[:space:]]*\"version\"[[:space:]]*:[[:space:]]*\"([^\"]+)\""
+  local line
+  local candidate=""
+  while IFS= read -r line || [ -n "$line" ]; do
+    # `grep -A` separates non-adjacent groups with `--`. A candidate must not
+    # survive across that boundary or one plugin's installPath answers for
+    # another plugin's version.
+    if [ "$line" = "--" ]; then
+      candidate=""
+      continue
+    fi
+    if [[ "$line" =~ $install_pattern ]]; then
+      candidate="${BASH_REMATCH[1]}"
+      continue
+    fi
+    if [ -n "$candidate" ] && [[ "$line" =~ $version_pattern ]]; then
+      plugin_channel_path="$candidate"
+      plugin_channel_version="${BASH_REMATCH[1]}"
+      return 0
+    fi
+  done < <(grep -F -A4 "\"projectPath\": \"$repo_root\"," "$record" 2>/dev/null)
+  return 1
+}
+
+# Verdict of the last classify_channel_skew call: agree | skew | undetermined.
+#
+# Three answers, never two. "The channels agree" and "I could not read one of
+# them" are DIFFERENT facts, and collapsing them is how a probe reports success
+# while measuring nothing.
+#
+# THIS PROBE REPORTS. IT NEVER BLOCKS. A permitted command stays permitted
+# whatever the verdict, and the finding goes into the once-per-session notice.
+# That is a decision, not an oversight, so here is the reasoning for whoever
+# comes to change it:
+#
+#   - The two error directions have asymmetric costs. An over-reported skew
+#     costs a line of notice; an over-confident stand-down costs enforcement.
+#     When the costs are that lopsided the direction is settled without needing
+#     to argue about likelihood.
+#   - Failing closed on `undetermined` would refuse work on every host with no
+#     `installed_plugins.json` — containers, fresh clones, non-Claude runtimes.
+#     That is a large population with nothing wrong with it, and refusing them
+#     is a bigger fault than the one being detected.
+#   - What is detected is two copies at different AGES, not a compromised
+#     guard. Blocking on it turns a diagnostic into an outage.
+#   - And the practical argument, which beats the principled one: skew is the
+#     common case on a developer machine right now, so as a blocker this would
+#     be a permanent stop-work and the first response would be to switch it
+#     off. A blocker everyone turns off protects nothing.
+#
+# Pinned by the test named "lets a permitted command through whatever the
+# verdict is", which asserts exit 0 on both the skew and undetermined arms.
+channel_skew_verdict="undetermined"
+channel_skew_line=""
+
+# Compare the vintage of the channel this dispatcher runs against the vintage
+# of the channel the plugin manifest runs.
+classify_channel_skew() {
+  local mine=""
+  if [ "$host_tree_used" -eq 1 ]; then
+    mine="$host_tree_version"
+  elif [ "$plugin_tree_used" -eq 1 ]; then
+    mine="$plugin_tree_version"
+  fi
+
+  if [ -z "$mine" ] || [ -z "$plugin_channel_version" ]; then
+    channel_skew_verdict="undetermined"
+    channel_skew_line="  cross-channel vintage UNDETERMINED — this dispatcher's guards could not be
+    compared with the plugin manifest's copies. Not agreement: an unread copy
+    can be any age, and a relaxation shipped to one channel stays inert until
+    the other catches up.
+"
+    return 0
+  fi
+
+  if [ "$mine" = "$plugin_channel_version" ]; then
+    channel_skew_verdict="agree"
+    channel_skew_line=""
+    return 0
+  fi
+
+  channel_skew_verdict="skew"
+  # The sentence is kept whole on one line on purpose: it is the finding, and
+  # an operator greps for it.
+  channel_skew_line="  cross-channel vintage SKEW — this dispatcher runs lisa $mine; the plugin
+    installed for this project is lisa $plugin_channel_version at $plugin_channel_path.
+    When both fire on one tool call the agent sees the UNION of their verdicts,
+    which means:
+      YOU CANNOT RETIRE A REFUSAL BY SHIPPING A FIX.
+    A relaxation on the newer channel does nothing until the older one is
+    refreshed, so a block you cannot explain from \`main\` is the older copy
+    still enforcing.
+      repair: refresh both — \`npx @codyswann/lisa apply\` for this checkout's
+      guards, and update the installed plugin for the manifest's copies.
+"
+  return 0
 }
 
 # Description of the last describe_vintage call.
@@ -610,8 +782,10 @@ if [ "$notice_due" -eq 1 ]; then
   if [ "$plugin_tree_used" -eq 1 ]; then
     note_tree_staleness "$plugin_tree" "$plugin_tree_version" "$PLUGIN_REPAIR"
   fi
+  classify_channel_skew
 
-  if [ -n "$stale_notice" ] || [ -n "$shadowed" ] || [ -n "$missing" ]; then
+  if [ -n "$stale_notice" ] || [ -n "$shadowed" ] || [ -n "$missing" ] || \
+    [ -n "$channel_skew_line" ]; then
     # Claim the session BEFORE printing. A failed `mkdir` suppresses this copy
     # only when another process left the expected real directory behind. Every
     # other failure leaves the claim unproven and prints, so an unwritable state
@@ -647,6 +821,9 @@ if [ "$notice_due" -eq 1 ]; then
         if [ -n "$missing" ]; then
           printf '  unresolved guards: %s (no copy was dispatched)\n' "$missing"
         fi
+        if [ -n "$channel_skew_line" ]; then
+          printf '%s' "$channel_skew_line"
+        fi
       } >&2
     fi
   fi

package/scripts/remedy-conformance.mjs

@@ -0,0 +1,435 @@
+#!/usr/bin/env node
+/**
+ * Every remedy a guard prints must be one this environment permits (#3825).
+ *
+ * ## The defect
+ *
+ * A guard refuses correctly and then hands the operator an instruction that
+ * cannot work. The guard is fine; its remedy is the defect — and the failure is
+ * misattributed by construction, because when an agent follows the printed
+ * advice and is refused, the refusal names **the guard it obeyed**, not the
+ * advice that sent it there. So the evidence points away from the actual bug.
+ *
+ * Nothing executed a remedy string, so a remedy rotted exactly like a comment,
+ * except an agent will *act* on it. Three guards, three unrelated authors,
+ * accumulated broken remedies before anyone named the class.
+ *
+ * ## Why permission alone is not the check — measured, not assumed
+ *
+ * The obvious mechanism is "run the remedy through the guard chain, assert
+ * permitted". **That mechanism would have passed the instance that motivated
+ * the ticket.** Measured on this repository: `git stash push` is PERMITTED by
+ * `parity-safety-net.sh` — guard 7 refuses only `stash drop`/`clear`. So when a
+ * guard advised "use git stash to preserve work first", a permission check
+ * would have gone green while the advice pointed every reader at one stash
+ * stack shared by every worktree of the clone, racing concurrent agents.
+ *
+ * A remedy is therefore conformant only when BOTH hold:
+ *
+ * 1. the guard chain PERMITS it — nothing refuses the operator who obeys; and
+ * 2. it names no FORBIDDEN operation — an operation this repository has ruled
+ *    unsafe for reasons no guard enforces at the command level.
+ *
+ * Check 2 exists precisely because check 1 cannot see hazards that are policy
+ * rather than pattern.
+ *
+ * ## Fail direction
+ *
+ * **Report-only on its findings, fail-closed on its own blindness.** It gates
+ * no commit and no push; a broken remedy is a documentation defect, and a guard
+ * that refused a contributor's push because some message was worded badly would
+ * be worse than the defect. But a probe whose guard did not refuse produced NO
+ * remedy text, and counting that as "no unfollowable remedies" is the reassuring
+ * answer for a measurement that never happened. Those become `NOT_EXAMINED`,
+ * and any of them makes the sweep `NOT_MEASURED` rather than `CONFORMING`.
+ * Exit codes carry the same split: 0 conforming, 1 findings, 2 not measured.
+ */
+
+import { spawnSync } from "node:child_process";
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+/** Per-remedy verdicts. */
+export const REMEDY_VERDICTS = Object.freeze([
+  "PERMITTED",
+  "REFUSED",
+  "FORBIDDEN",
+]);
+
+/** Whole-sweep verdicts. */
+export const REMEDY_SWEEP_VERDICTS = Object.freeze([
+  "CONFORMING",
+  "UNFOLLOWABLE_REMEDIES",
+  "NOT_MEASURED",
+]);
+
+/**
+ * Operations no remedy may recommend, whatever the guard chain permits.
+ *
+ * Each entry is a ruling this repository has already made and written down
+ * somewhere other than a command pattern. `git stash` is the founding member:
+ * `PRESERVE_GUIDANCE` in `parity-safety-net.sh` says "Do NOT reach for `git
+ * stash`. One stash stack is shared by every worktree of a clone, so a
+ * concurrently running agent can consume the entry you just pushed" — and yet
+ * the guard permits the command, because refusing it outright would break the
+ * legitimate single-worktree uses.
+ *
+ * `advisory` is what separates a recommendation from a prohibition. Guard 7's
+ * own message must keep containing the word "stash" while REFUSING it; only
+ * text that offers the operation as the way forward is a finding. Keying on the
+ * bare token would fail the one message doing the right thing — the mistake
+ * `parity-safety-net-no-stash-advice.test.ts` records making.
+ */
+export const FORBIDDEN_REMEDY_OPERATIONS = Object.freeze([
+  Object.freeze({
+    id: "shared-stash",
+    advisory: /\bgit\s+stash\s+(push|pop|save|apply)\b/i,
+    why: "one stash stack is shared by every worktree of a clone, so a concurrent agent can consume the entry",
+  }),
+]);
+
+/** Command verbs a remedy line may begin with to count as a command. */
+const REMEDY_VERBS = /^(git|gh|node|bun|npm|npx|bash|sh|mktemp|jq)\b/;
+
+/**
+ * Markers that make a line talk ABOUT a command rather than instruct it.
+ *
+ * **Measured, not anticipated.** The first live run of this sweep reported six
+ * findings, every one of them the same string pulled out of
+ * `PRESERVE_GUIDANCE`'s sentence "Untracked files survive, exactly as they
+ * survive ...". That is a comparison. The guard is not telling anyone to run
+ * that command — it refuses it two guards further up the same file.
+ *
+ * So the extractor was making exactly the mistake #3815 and this ticket's own
+ * second comment describe: treating text ABOUT a thing as the thing. A
+ * conformance control that makes it reports its loudest findings against
+ * correct prose, and a control whose findings are wrong on day one gets
+ * switched off. That outcome matters more here than a missed remedy, because
+ * the entire value of this control is that somebody reads its output.
+ *
+ * The marker is looked for in a WINDOW of text immediately preceding the
+ * command, not on its line and not in its paragraph. Both of those were tried
+ * and both were measured wrong on this repository's real guard text:
+ *
+ * - LINE scope missed the founding case outright. The heredoc wraps, so
+ *   "exactly as they" ends one line and "survive `git reset --hard`." begins
+ *   the next; the marker and the command it qualifies are never on one line.
+ * - PARAGRAPH scope demotes correct remedies wholesale. `DESTRUCTIVE_GUIDANCE`
+ *   opens a bullet with "Do not try to reword it" and then names three real
+ *   remedies in the same bullet, all of which would vanish from the sweep.
+ *
+ * The window approximates the clause the command sits in, which is the scope
+ * the qualifier actually applies to. Mentions are not classified, and they are
+ * COUNTED AND REPORTED rather than dropped, so the coverage this rule costs
+ * stays visible instead of being silently absorbed.
+ */
+const MENTION_CONTEXT =
+  /\b(do not|don't|never|no longer|used to|as they survive|instead of|rather than|cannot|would|refuses?|blocks?|prohibit)/i;
+
+/** How much text before a command is read for a mention marker. */
+const MENTION_WINDOW = 64;
+
+/**
+ * Pull the runnable commands out of a guard's refusal text.
+ *
+ * Two shapes, because guards use both: a backticked span, and an indented line
+ * inside a heredoc. Prose is skipped by requiring a known verb at the start —
+ * a remedy sentence is advice, and only its commands can be classified.
+ *
+ * A placeholder like `<path>` is substituted with a plausible path so the
+ * command reaches the guard in the shape an operator would actually type;
+ * leaving the angle brackets in would feed the guard a redirection.
+ *
+ * @param {string} text - A guard's refusal output.
+ * @returns {{ commands: readonly string[], mentions: readonly string[] }}
+ *   Instructions to classify, and commands the text only talks about.
+ */
+export function extractRemedyCommands(text) {
+  const source = typeof text === "string" ? text : "";
+  const commands = [];
+  const mentions = [];
+
+  // Backticked spans, judged against the clause that precedes each one. The
+  // source is flattened so a wrapped qualifier still sits inside the window.
+  const flat = source.replace(/\s+/g, " ");
+  for (const match of flat.matchAll(/`([^`]+)`/g)) {
+    const candidate = match[1].trim();
+    if (!REMEDY_VERBS.test(candidate)) continue;
+    const before = flat.slice(
+      Math.max(0, match.index - MENTION_WINDOW),
+      match.index
+    );
+    (MENTION_CONTEXT.test(before) ? mentions : commands).push(candidate);
+  }
+
+  // Indented lines are code blocks, which are instructions by convention even
+  // where the surrounding prose is comparative.
+  for (const line of source.split("\n")) {
+    if (!/^\s{2,}\S/.test(line)) continue;
+    const trimmed = line.trim();
+    if (REMEDY_VERBS.test(trimmed) || /^[a-z_]+="\$\(/.test(trimmed)) {
+      commands.push(trimmed);
+    }
+  }
+
+  const instructions = new Set(commands.map(substitutePlaceholders));
+  return {
+    commands: [...instructions],
+    // A command that appears BOTH as an instruction and as a mention is an
+    // instruction: the code block is the operative text.
+    mentions: [...new Set(mentions)].filter(
+      mention => !instructions.has(substitutePlaceholders(mention))
+    ),
+  };
+}
+
+/**
+ * Replace `<placeholder>` tokens with a plausible concrete path.
+ *
+ * @param {string} command - A command that may carry placeholders.
+ * @returns {string} The command with placeholders made concrete.
+ */
+function substitutePlaceholders(command) {
+  return command.replace(/<[a-z][a-z -]*>/gi, "tmp/remedy-conformance-probe");
+}
+
+/**
+ * Classify one remedy command.
+ *
+ * Forbidden beats refused: a remedy naming the shared stash is a finding even
+ * where the guard chain waves it through, which is the whole reason check 2
+ * exists.
+ *
+ * @param {string} command - The remedy command as printed.
+ * @param {(command: string) => number | null} permits - Guard-chain classifier,
+ *   returning the guard's exit status for the command.
+ * @returns {{ command: string, verdict: string, reason: string }} The verdict.
+ */
+export function classifyRemedy(command, permits) {
+  const forbidden = FORBIDDEN_REMEDY_OPERATIONS.find(operation =>
+    operation.advisory.test(command)
+  );
+  if (forbidden) {
+    return {
+      command,
+      verdict: "FORBIDDEN",
+      reason: `${forbidden.id}: ${forbidden.why}`,
+    };
+  }
+
+  const status = permits(command);
+  return status === 0
+    ? { command, verdict: "PERMITTED", reason: "guard-chain-permits" }
+    : {
+        command,
+        verdict: "REFUSED",
+        reason: `guard-chain-refuses (exit ${status})`,
+      };
+}
+
+/**
+ * Sweep a set of probes and report every unfollowable remedy.
+ *
+ * @param {{
+ *   readonly probes?: readonly { label: string, refusal: string | null }[]
+ *   readonly permits?: (command: string) => number | null
+ * }} input - `refusal` is the guard's output, or `null` when the guard did not
+ *   refuse and therefore produced no remedy to examine.
+ * @returns {{
+ *   readonly verdict: string
+ *   readonly reasons: readonly string[]
+ *   readonly examinedCount: number
+ *   readonly commandCount: number
+ *   readonly mentionCount: number
+ *   readonly findings: readonly {
+ *     readonly command: string
+ *     readonly verdict: string
+ *     readonly reason: string
+ *     readonly probe: string
+ *   }[]
+ *   readonly notExamined: readonly string[]
+ *   readonly reportOnly: true
+ * }} The sweep result.
+ */
+export function sweepRemedyConformance(input = {}) {
+  const probes = Array.isArray(input.probes) ? input.probes : null;
+  const permits = input.permits ?? (() => 0);
+
+  if (probes === null) {
+    return emptySweep("NOT_MEASURED", ["probe-list-unavailable"]);
+  }
+
+  const notExamined = probes
+    .filter(probe => typeof probe?.refusal !== "string")
+    .map(probe => String(probe?.label ?? "<unlabelled>"));
+
+  const findings = [];
+  let commandCount = 0;
+  let mentionCount = 0;
+  for (const probe of probes) {
+    if (typeof probe?.refusal !== "string") continue;
+    const extracted = extractRemedyCommands(probe.refusal);
+    mentionCount += extracted.mentions.length;
+    for (const command of extracted.commands) {
+      commandCount += 1;
+      const verdict = classifyRemedy(command, permits);
+      if (verdict.verdict !== "PERMITTED") {
+        findings.push({ ...verdict, probe: probe.label });
+      }
+    }
+  }
+
+  const examinedCount = probes.length - notExamined.length;
+
+  // Blindness outranks findings: a sweep that read no remedy text from part of
+  // the guard set cannot call the rest of it conformant.
+  if (notExamined.length > 0) {
+    return {
+      verdict: "NOT_MEASURED",
+      reasons: ["guard-did-not-refuse"],
+      examinedCount,
+      commandCount,
+      mentionCount,
+      findings,
+      notExamined,
+      reportOnly: true,
+    };
+  }
+
+  return {
+    verdict: findings.length > 0 ? "UNFOLLOWABLE_REMEDIES" : "CONFORMING",
+    reasons:
+      findings.length > 0
+        ? ["remedies-the-environment-refuses-or-forbids"]
+        : ["every-printed-remedy-permitted-and-allowed"],
+    examinedCount,
+    commandCount,
+    mentionCount,
+    findings,
+    notExamined,
+    reportOnly: true,
+  };
+}
+
+/**
+ * A sweep result carrying nothing, for the paths that measured nothing.
+ *
+ * @param {string} verdict - The sweep verdict.
+ * @param {readonly string[]} reasons - Why.
+ * @returns {ReturnType<typeof sweepRemedyConformance>} The empty sweep.
+ */
+function emptySweep(verdict, reasons) {
+  return {
+    verdict,
+    reasons,
+    examinedCount: 0,
+    commandCount: 0,
+    mentionCount: 0,
+    findings: [],
+    notExamined: [],
+    reportOnly: true,
+  };
+}
+
+/**
+ * The CLI exit status for a sweep.
+ *
+ * `2` is load-bearing: a sweep that examined nothing must not exit 0 beside an
+ * empty finding list, which is indistinguishable from a conformant guard set.
+ *
+ * @param {{ readonly verdict?: string }} sweep - A sweep result.
+ * @returns {0 | 1 | 2} The exit status.
+ */
+export function remedyConformanceExitCode(sweep) {
+  if (sweep?.verdict === "CONFORMING") return 0;
+  if (sweep?.verdict === "UNFOLLOWABLE_REMEDIES") return 1;
+  return 2;
+}
+
+/**
+ * Render the sweep for an operator.
+ *
+ * @param {ReturnType<typeof sweepRemedyConformance>} sweep - A sweep result.
+ * @returns {string} A terminal-first report.
+ */
+export function formatRemedyConformanceReport(sweep) {
+  const lines = [`Remedy conformance: ${sweep.verdict}`];
+
+  if (sweep.verdict === "NOT_MEASURED") {
+    lines.push(
+      `No remedy text was read for ${sweep.notExamined.length} probe(s) (${sweep.reasons.join(", ")}).`,
+      "This is not a conformant guard set — it is an unanswered question.",
+      ...sweep.notExamined.map(label => `  ? ${label}`)
+    );
+    return `${lines.join("\n")}\n`;
+  }
+
+  lines.push(
+    `Examined ${sweep.examinedCount} guard refusal(s) and classified ${sweep.commandCount} printed command(s).`,
+    `Not classified: ${sweep.mentionCount} command(s) the text only mentions (comparisons and prohibitions).`
+  );
+
+  if (sweep.verdict === "CONFORMING") {
+    lines.push(
+      "Every command any examined guard prints is permitted here and names no forbidden operation."
+    );
+    return `${lines.join("\n")}\n`;
+  }
+
+  lines.push("These printed remedies cannot be followed as written:");
+  for (const finding of sweep.findings) {
+    lines.push(`  ! [${finding.probe}] ${finding.command}`);
+    lines.push(`      ${finding.verdict}: ${finding.reason}`);
+  }
+  return `${lines.join("\n")}\n`;
+}
+
+/**
+ * Build a guard-chain classifier that runs the real shipped guard.
+ *
+ * @param {string} guardPath - Path to the shipped guard script.
+ * @param {string} cwd - Working directory reported to the guard.
+ * @returns {(command: string) => number | null} The classifier.
+ */
+export function guardChainClassifier(guardPath, cwd) {
+  return command =>
+    spawnSync("/bin/bash", [guardPath], {
+      input: JSON.stringify({
+        tool_name: "Bash",
+        tool_input: { command },
+        cwd,
+      }),
+      encoding: "utf8",
+    }).status;
+}
+
+/**
+ * True when `moduleUrl` names the module node was asked to run.
+ *
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path.
+ * @returns {boolean} Whether to run the CLI body.
+ */
+export function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
+if (invokedAsScript(import.meta.url)) {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  const raw = Buffer.concat(chunks).toString("utf8").trim();
+  const sweep = sweepRemedyConformance({
+    probes: raw.length === 0 ? null : JSON.parse(raw).probes,
+    permits: guardChainClassifier(
+      process.argv[2] ?? "plugins/lisa/hooks/parity-safety-net.sh",
+      process.cwd()
+    ),
+  });
+  process.stdout.write(formatRemedyConformanceReport(sweep));
+  process.exitCode = remedyConformanceExitCode(sweep);
+}

package/scripts/two-channel-couplings.json

@@ -4,8 +4,8 @@
     "quality.yml::scripts/generate-nightly-e2e-guard-certificate.mjs": "Lisa-source-only branch. Both reusable jobs require `github.repository == 'CodySwannGT/lisa'` before the step can start, and the run body repeats that exact repository guard before checking this artifact path. Ordinary and private host callers therefore skip the step without reading or fetching from their own tree. The scoped branch fetches only the immutable refs needed to behavior-test Lisa's own retained certificate inputs. Ratified because the caller-tree read is unreachable outside this repository, not because an undelivered host dependency is tolerated."
   },
   "inspected": {
-    "workflows": 22,
-    "steps": 716,
+    "workflows": 23,
+    "steps": 719,
     "couplings": 34,
     "inventory": 77
   },