@codyswann/lisa 4.54.13 → 4.55.0

package/dist/utils/path-utils.js

@@ -43,4 +43,45 @@ export function getDirname(filePath) {
 export function getBasename(filePath) {
     return path.basename(filePath);
 }
+/**
+ * Whether one path is a root itself or lies beneath it, judged on a path
+ * boundary rather than a string prefix.
+ *
+ * ## The defect this exists against
+ *
+ * `"/a/land3716-tmp/f".startsWith("/a/land3716")` is true, so a bare prefix
+ * comparison reports a SIBLING as being inside the root (CodySwannGT/lisa#3808).
+ * The convention agents follow makes that the common shape, not the exotic one:
+ * a scratch worktree at `<TMPDIR>/<name>` and its scratch directory at
+ * `<TMPDIR>/<name>-tmp` are siblings, and the second string-prefixes the first.
+ *
+ * ## What it decides, and what it does not
+ *
+ * It is **lexical**. Both arguments are resolved to absolute paths and `..`
+ * segments are collapsed, so traversal and relative inputs are handled, and a
+ * trailing separator is irrelevant. It does NOT follow symlinks: a link inside
+ * the root whose target is outside it still reports as inside, because the path
+ * as written is inside. A caller that must refuse such an escape has to resolve
+ * the real paths itself and ask this question about those instead.
+ *
+ * It fails closed. An argument that cannot name a path — the empty string,
+ * which `path.resolve` would silently turn into the working directory — reads
+ * as NOT contained, because "inside" is the answer that grants access.
+ * @param root Directory the candidate is tested against
+ * @param candidate Path being tested
+ * @returns True when `candidate` is `root` or lives beneath it
+ */
+export function isPathInside(root, candidate) {
+    if (root === "" || candidate === "") {
+        return false;
+    }
+    const relative = path.relative(path.resolve(root), path.resolve(candidate));
+    if (relative === "") {
+        return true;
+    }
+    if (path.isAbsolute(relative)) {
+        return false;
+    }
+    return relative !== ".." && !relative.startsWith(`..${path.sep}`);
+}
 //# sourceMappingURL=path-utils.js.map

package/dist/utils/path-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"path-utils.js","sourceRoot":"","sources":["../../src/utils/path-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,UAAkB;IAClE,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,GAAG,QAAkB;IAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC"}
+{"version":3,"file":"path-utils.js","sourceRoot":"","sources":["../../src/utils/path-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,UAAkB;IAClE,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,GAAG,QAAkB;IAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,SAAiB;IAC1D,IAAI,IAAI,KAAK,EAAE,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5E,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AACpE,CAAC"}

package/expo/create-only/.github/workflows/ci.yml

@@ -40,6 +40,13 @@ jobs:
       pull-requests: read
     uses: CodySwannGT/lisa/.github/workflows/quality.yml@main
     with:
+      # Travels with the `uses:` line above — the two are one unit. Lisa's
+      # reusable workflows are tracked at `@main`, so that file changes under
+      # this repository with no pull request here. This is the contract major it
+      # spoke when Lisa seeded this file; the run fails loudly if it has since
+      # declared a break, and says NOT DETERMINED if this line goes missing
+      # (CodySwannGT/lisa#3698).
+      expected_workflow_contract_major: '1'
       node_version: '22.21.1'
       package_manager: 'bun'
       skip_jobs: 'test:e2e,playwright_e2e'
@@ -66,6 +73,13 @@ jobs:
     needs: [quality]
     uses: CodySwannGT/lisa/.github/workflows/lighthouse.yml@main
     with:
+      # Travels with the `uses:` line above — the two are one unit. Lisa's
+      # reusable workflows are tracked at `@main`, so that file changes under
+      # this repository with no pull request here. This is the contract major it
+      # spoke when Lisa seeded this file; the run fails loudly if it has since
+      # declared a break, and says NOT DETERMINED if this line goes missing
+      # (CodySwannGT/lisa#3698).
+      expected_workflow_contract_major: '1'
       node_version: '22.21.1'
       package_manager: 'bun'
 
@@ -74,5 +88,12 @@ jobs:
     needs: [quality]
     uses: CodySwannGT/lisa/.github/workflows/zap-baseline-expo.yml@main
     with:
+      # Travels with the `uses:` line above — the two are one unit. Lisa's
+      # reusable workflows are tracked at `@main`, so that file changes under
+      # this repository with no pull request here. This is the contract major it
+      # spoke when Lisa seeded this file; the run fails loudly if it has since
+      # declared a break, and says NOT DETERMINED if this line goes missing
+      # (CodySwannGT/lisa#3698).
+      expected_workflow_contract_major: '1'
       node_version: '22.21.1'
       package_manager: 'bun'

package/expo/create-only/.github/workflows/deploy.yml

@@ -106,6 +106,13 @@ jobs:
     uses: CodySwannGT/lisa/.github/workflows/gates.yml@main
     needs: [determine_environment]
     with:
+      # Travels with the `uses:` line above — the two are one unit. Lisa's
+      # reusable workflows are tracked at `@main`, so that file changes under
+      # this repository with no pull request here. This is the contract major it
+      # spoke when Lisa seeded this file; the run fails loudly if it has since
+      # declared a break, and says NOT DETERMINED if this line goes missing
+      # (CodySwannGT/lisa#3698).
+      expected_workflow_contract_major: '1'
       moment: pre-deploy:${{ needs.determine_environment.outputs.environment }}
       node_version: '22.21.1'
       package_manager: 'bun'
@@ -121,6 +128,13 @@ jobs:
       contents: write
       pull-requests: read
     with:
+      # Travels with the `uses:` line above — the two are one unit. Lisa's
+      # reusable workflows are tracked at `@main`, so that file changes under
+      # this repository with no pull request here. This is the contract major it
+      # spoke when Lisa seeded this file; the run fails loudly if it has since
+      # declared a break, and says NOT DETERMINED if this line goes missing
+      # (CodySwannGT/lisa#3698).
+      expected_workflow_contract_major: '1'
       environment: ${{ needs.determine_environment.outputs.environment }}
       release_strategy: 'standard-version'
       skip_jobs: 'test:e2e,test:unit,test:integration'
@@ -196,6 +210,13 @@ jobs:
     permissions:
       contents: read
     with:
+      # Travels with the `uses:` line above — the two are one unit. Lisa's
+      # reusable workflows are tracked at `@main`, so that file changes under
+      # this repository with no pull request here. This is the contract major it
+      # spoke when Lisa seeded this file; the run fails loudly if it has since
+      # declared a break, and says NOT DETERMINED if this line goes missing
+      # (CodySwannGT/lisa#3698).
+      expected_workflow_contract_major: '1'
       environment: ${{ needs.determine_environment.outputs.environment }}
     secrets:
       EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
@@ -347,6 +368,13 @@ jobs:
     needs: [determine_environment, deploy]
     if: ${{ always() && !cancelled() && needs.deploy.result == 'success' }}
     with:
+      # Travels with the `uses:` line above — the two are one unit. Lisa's
+      # reusable workflows are tracked at `@main`, so that file changes under
+      # this repository with no pull request here. This is the contract major it
+      # spoke when Lisa seeded this file; the run fails loudly if it has since
+      # declared a break, and says NOT DETERMINED if this line goes missing
+      # (CodySwannGT/lisa#3698).
+      expected_workflow_contract_major: '1'
       moment: post-deploy:${{ needs.determine_environment.outputs.environment }}
       node_version: '22.21.1'
       package_manager: 'bun'

package/expo/create-only/.github/workflows/maestro-e2e.yml

@@ -96,6 +96,13 @@ jobs:
     name: 📱 Maestro Native E2E
     uses: CodySwannGT/lisa/.github/workflows/maestro-native-e2e.yml@main
     with:
+      # Travels with the `uses:` line above — the two are one unit. Lisa's
+      # reusable workflows are tracked at `@main`, so that file changes under
+      # this repository with no pull request here. This is the contract major it
+      # spoke when Lisa seeded this file; the run fails loudly if it has since
+      # declared a break, and says NOT DETERMINED if this line goes missing
+      # (CodySwannGT/lisa#3698).
+      expected_workflow_contract_major: '1'
       platform: ${{ inputs.platform || 'all' }}
       # Return the shared environment to a known state before either platform
       # starts. Both lifecycle commands are mandatory. If this project needs no

package/expo/create-only/.github/workflows/nightly-e2e-bypass-reaper.yml

@@ -3,7 +3,8 @@
 
 name: 🧹 Nightly E2E Bypass Reaper
 
-# Removes a used `nightly-e2e-bypass` label when its pull request closes.
+# Writes the durable waiver record, then removes a used `nightly-e2e-bypass`
+# label, when its pull request closes.
 #
 # ## Why removal happens on CLOSE and not on USE
 #
@@ -20,12 +21,36 @@ name: 🧹 Nightly E2E Bypass Reaper
 # applied (default 24, hard ceiling 72). The reaper keeps the label list honest;
 # it is not what bounds the waiver's lifetime.
 #
-# ## Why the audit survives removal
+# ## Why the RECORD is written before the label is stripped
 #
-# The audit record lives in the gate's job summary, its `::notice::` annotation
-# and its `audit_json` output on the run that honoured the bypass — none of which
-# this workflow touches. Removing the label removes the REQUEST, never the
-# RECORD.
+# The audit lives on the gate run that honoured the bypass — its job summary,
+# its `::notice::` annotation, its `audit_json` output — and none of that is
+# reachable from the pull request a reviewer is looking at, nor from any
+# repository-wide question. Measured on a consumer: the LABEL was the only
+# index of "which merges went past this gate on a waiver", and stripping it
+# withdrew the REQUEST and erased the INDEX in the same call. After a waived
+# merge closed, the repository could no longer answer "what shipped on a
+# waiver, and why" — a compliance question as much as an engineering one.
+#
+# So this workflow re-derives the waiver from the live pull request FIRST and
+# posts a marker-delimited record comment, and only then strips the label. The
+# ordering is the whole point, and it is enforced by the step order plus the
+# refusal below: if the record could not be established, the label is LEFT ON.
+# A label nobody removed is untidy; an unrecorded waived merge is unauditable,
+# and untidy is the cheaper of the two.
+#
+# ## Why an EXPIRED waiver is still recorded
+#
+# By the time a pull request closes the waiver has often lapsed, and the
+# re-derivation says `refused`. That is not a reason to write nothing — an
+# expired waiver still shipped something, and those are exactly the merges most
+# worth being able to find later. The record carries the state it was recorded
+# in rather than pretending the waiver was fine.
+#
+# The one state that is NOT recorded is `not_determined`: the live pull request
+# could not be read, so nothing was established. Writing a confident-looking
+# record there would be worse than writing none, so the workflow fails and
+# leaves the label in place for a re-run to catch.
 
 on:
   pull_request_target:
@@ -33,8 +58,8 @@ on:
 
 permissions:
   contents: read
-  # The one write in the whole nightly-gate standard, scoped to removing one
-  # label from an already-closed PR.
+  # The one write in the whole nightly-gate standard: posting the waiver record
+  # and removing one label from an already-closed PR.
   pull-requests: write
 
 concurrency:
@@ -43,23 +68,109 @@ concurrency:
 
 jobs:
   reap:
-    name: 🧹 Remove used bypass label
+    name: 🧹 Record the waiver, then remove its label
     # `pull_request_target` runs with a writable token against the BASE repo, so
     # this job must never check out or execute pull-request code. It does not:
-    # there is no checkout step and the only command is a `gh` API call.
+    # the checkout below pins the BASE ref explicitly and nothing in this file
+    # names the pull request's head commit, so the only code that runs here is
+    # code already merged into the base branch and reviewed on its own terms.
+    #
+    # The reaper checks out at all because it re-derives the waiver through the
+    # SAME guard the gate uses. The alternative — restating that derivation in
+    # shell here — is a second implementation of "is this waiver good?", and two
+    # of those drift.
     if: contains(github.event.pull_request.labels.*.name, 'nightly-e2e-bypass')
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 10
     steps:
+      - name: 📥 Checkout the BASE branch (never the pull request's head)
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.base.ref }}
+          persist-credentials: false
+
+      - name: 🔧 Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          package-manager-cache: false
+          node-version: '22'
+
+      - name: 🔎 Locate the guard
+        id: guard
+        env:
+          # Two addresses for the SAME file, not a fallback to a different
+          # implementation: `lisa apply` installs the guard into `scripts/`, and
+          # a repository that has not run it yet still carries the template.
+          INSTALLED: scripts/check-nightly-e2e-health.mjs
+          TEMPLATE: typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs
+        run: |
+          set -euo pipefail
+          if [[ -f "$INSTALLED" ]]; then
+            echo "path=$INSTALLED" >> "$GITHUB_OUTPUT"
+          elif [[ -f "$TEMPLATE" ]]; then
+            echo "path=$TEMPLATE" >> "$GITHUB_OUTPUT"
+          else
+            echo "::error title=Nightly E2E guard is not installed::Neither '$INSTALLED' nor '$TEMPLATE' exists on this branch, so the waiver cannot be re-derived. Refusing to strip the bypass label: that would erase the only index of this waived merge. Run \`lisa apply\`."
+            exit 1
+          fi
+
+      - name: 🧾 Re-derive the waiver from the live pull request
+        id: waiver
+        # A refused waiver exits 1 by design — that exit code is the merge-time
+        # contract — and on THIS path a refusal is an ordinary outcome to be
+        # recorded, not a failure. The state is read from the output instead,
+        # and the step below decides what each state means here.
+        continue-on-error: true
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          NIGHTLY_PR_NUMBER: ${{ github.event.pull_request.number }}
+          NIGHTLY_BYPASS_LABEL: nightly-e2e-bypass
+          GUARD: ${{ steps.guard.outputs.path }}
+        run: node "$GUARD" --waiver-verdict
+
+      - name: 🗒️ Post the durable waiver record
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR: ${{ github.event.pull_request.number }}
+          STATE: ${{ steps.waiver.outputs.waiver_state }}
+          RECORD: ${{ steps.waiver.outputs.waiver_record }}
+          MARKER: NIGHTLY-E2E-BYPASS-RECORD
+        run: |
+          set -euo pipefail
+          if [[ "$STATE" == "none" ]]; then
+            echo "::notice title=No waiver to record::The live pull request carries no bypass label, so somebody removed it between the close event and this run. There is nothing to record and nothing to strip."
+            exit 0
+          fi
+          if [[ "$STATE" != "waived" && "$STATE" != "refused" ]]; then
+            echo "::error title=Waiver NOT recorded::The waiver could not be re-derived (state: '${STATE:-unreadable}'), so nothing was established about it. Refusing to write a record that would look authoritative and refusing to strip the label, which is currently the only index of this waived merge. Re-run this workflow once the API is readable."
+            exit 1
+          fi
+          # Idempotent. `pull_request_target` can fire more than once for a
+          # close, and two identical records read as two waived merges.
+          if gh api --paginate "repos/$REPO/issues/$PR/comments" \
+            --jq '.[].body' 2>/dev/null | grep -qF "$MARKER"; then
+            echo "::notice title=Waiver already recorded::#$PR already carries a $MARKER comment. Not posting a second one."
+            exit 0
+          fi
+          printf '%s\n' \
+            "Recorded by the nightly-E2E bypass reaper when this pull request closed, BEFORE its \`nightly-e2e-bypass\` label was stripped." \
+            "" \
+            "$RECORD" > "$RUNNER_TEMP/waiver-record.md"
+          gh pr comment "$PR" --repo "$REPO" --body-file "$RUNNER_TEMP/waiver-record.md"
+          echo "::notice title=Waiver recorded::The waiver on #$PR is now durable: it survives the label removal below."
+
       - name: 🧹 Strip the bypass label
         env:
           GH_TOKEN: ${{ github.token }}
           REPO: ${{ github.repository }}
           PR: ${{ github.event.pull_request.number }}
           LABEL: nightly-e2e-bypass
+          MERGED: ${{ github.event.pull_request.merged && 'merged' || 'closed' }}
         run: |
           set -euo pipefail
-          echo "Removing '$LABEL' from $REPO#$PR (state: ${{ github.event.pull_request.merged && 'merged' || 'closed' }})."
+          echo "Removing '$LABEL' from $REPO#$PR (state: $MERGED)."
           # ONE delete. Someone removing the label between the event and this
           # run is the desired end state, not a failure — but a permission or
           # API problem must NEVER look like a successful reap, or the label
@@ -75,7 +186,7 @@ jobs:
           deleted=$?
           set -e
           if [[ $deleted -eq 0 ]]; then
-            echo "::notice title=Nightly E2E bypass label removed::'$LABEL' cleared from #$PR after close. The audit record on the gate run that honoured it is unaffected."
+            echo "::notice title=Nightly E2E bypass label removed::'$LABEL' cleared from #$PR after close. The waiver record posted above outlives it, and the audit on the gate run that honoured it is unaffected."
             exit 0
           fi
           if gh api "repos/$REPO/issues/$PR/labels" --jq '.[].name' 2>/dev/null \

package/expo/create-only/.github/workflows/nightly-e2e-health.yml

@@ -166,6 +166,13 @@ jobs:
     # `scripts/check-template-workflow-refs.mjs`.
     uses: CodySwannGT/lisa/.github/workflows/nightly-e2e-health.yml@main
     with:
+      # Travels with the `uses:` line above — the two are one unit. Lisa's
+      # reusable workflows are tracked at `@main`, so that file changes under
+      # this repository with no pull request here. This is the contract major it
+      # spoke when Lisa seeded this file; the run fails loudly if it has since
+      # declared a break, and says NOT DETERMINED if this line goes missing
+      # (CodySwannGT/lisa#3698).
+      expected_workflow_contract_major: '1'
       branch: dev
       # Structured JSON, schema-validated before any API call. Duplicated
       # labels, unanchored regexes, unknown keys and zero-match patterns are all

package/expo/create-only/.github/workflows/nightly-e2e-report.yml

@@ -96,6 +96,13 @@ jobs:
     # detects a mismatch. Enforced by `scripts/check-template-workflow-refs.mjs`.
     uses: CodySwannGT/lisa/.github/workflows/nightly-e2e-report.yml@main
     with:
+      # Travels with the `uses:` line above — the two are one unit. Lisa's
+      # reusable workflows are tracked at `@main`, so that file changes under
+      # this repository with no pull request here. This is the contract major it
+      # spoke when Lisa seeded this file; the run fails loudly if it has since
+      # declared a break, and says NOT DETERMINED if this line goes missing
+      # (CodySwannGT/lisa#3698).
+      expected_workflow_contract_major: '1'
       branch: dev
       # The status-check context the GATE publishes, used to MEASURE whether it
       # is actually required on `branch`. This default is the composite GitHub

package/expo/create-only/.github/workflows/nightly-e2e-tracking.yml

@@ -35,4 +35,12 @@ jobs:
     # including the gate whose job is checking these refs — it reported this
     # file as having none at all.
     uses: CodySwannGT/lisa/.github/workflows/nightly-e2e-tracking.yml@main
+    with:
+      # Travels with the `uses:` line above — the two are one unit. Lisa's
+      # reusable workflows are tracked at `@main`, so that file changes under
+      # this repository with no pull request here. This is the contract major it
+      # spoke when Lisa seeded this file; the run fails loudly if it has since
+      # declared a break, and says NOT DETERMINED if this line goes missing
+      # (CodySwannGT/lisa#3698).
+      expected_workflow_contract_major: '1'
     secrets: inherit

package/expo/create-only/.github/workflows/playwright-e2e.yml

@@ -130,6 +130,13 @@ jobs:
     name: 🎭 Playwright Web E2E
     uses: CodySwannGT/lisa/.github/workflows/playwright-e2e.yml@main
     with:
+      # Travels with the `uses:` line above — the two are one unit. Lisa's
+      # reusable workflows are tracked at `@main`, so that file changes under
+      # this repository with no pull request here. This is the contract major it
+      # spoke when Lisa seeded this file; the run fails loudly if it has since
+      # declared a break, and says NOT DETERMINED if this line goes missing
+      # (CodySwannGT/lisa#3698).
+      expected_workflow_contract_major: '1'
       node_version: '22.21.1'
       package_manager: 'bun'
       # The moment this workflow's cadence corresponds to. It is what makes the

package/harper-fabric/copy-overwrite/.github/workflows/ci.yml

@@ -19,6 +19,13 @@ jobs:
       pull-requests: read
     uses: CodySwannGT/lisa/.github/workflows/quality.yml@main
     with:
+      # Travels with the `uses:` line above — the two are one unit. Lisa's
+      # reusable workflows are tracked at `@main`, so that file changes under
+      # this repository with no pull request here. This is the contract major it
+      # spoke when Lisa seeded this file; the run fails loudly if it has since
+      # declared a break, and says NOT DETERMINED if this line goes missing
+      # (CodySwannGT/lisa#3698).
+      expected_workflow_contract_major: '1'
       node_version: '22.21.1'
       package_manager: 'bun'
       skip_jobs: ''

package/harper-fabric/create-only/.github/workflows/deploy.yml

@@ -33,6 +33,13 @@ jobs:
     name: 🚦 Pre-Deploy Gates
     uses: CodySwannGT/lisa/.github/workflows/gates.yml@main
     with:
+      # Travels with the `uses:` line above — the two are one unit. Lisa's
+      # reusable workflows are tracked at `@main`, so that file changes under
+      # this repository with no pull request here. This is the contract major it
+      # spoke when Lisa seeded this file; the run fails loudly if it has since
+      # declared a break, and says NOT DETERMINED if this line goes missing
+      # (CodySwannGT/lisa#3698).
+      expected_workflow_contract_major: '1'
       moment: pre-deploy:${{ github.ref_name }}
       node_version: '22.21.1'
       package_manager: 'bun'
@@ -117,6 +124,13 @@ jobs:
     needs: [deploy]
     if: ${{ always() && !cancelled() && needs.deploy.result == 'success' }}
     with:
+      # Travels with the `uses:` line above — the two are one unit. Lisa's
+      # reusable workflows are tracked at `@main`, so that file changes under
+      # this repository with no pull request here. This is the contract major it
+      # spoke when Lisa seeded this file; the run fails loudly if it has since
+      # declared a break, and says NOT DETERMINED if this line goes missing
+      # (CodySwannGT/lisa#3698).
+      expected_workflow_contract_major: '1'
       moment: post-deploy:${{ github.ref_name }}
       node_version: '22.21.1'
       package_manager: 'bun'

package/nestjs/create-only/.github/workflows/ci.yml

@@ -21,6 +21,13 @@ jobs:
       pull-requests: read
     uses: CodySwannGT/lisa/.github/workflows/quality.yml@main
     with:
+      # Travels with the `uses:` line above — the two are one unit. Lisa's
+      # reusable workflows are tracked at `@main`, so that file changes under
+      # this repository with no pull request here. This is the contract major it
+      # spoke when Lisa seeded this file; the run fails loudly if it has since
+      # declared a break, and says NOT DETERMINED if this line goes missing
+      # (CodySwannGT/lisa#3698).
+      expected_workflow_contract_major: '1'
       node_version: '22.21.1'
       package_manager: 'bun'
       skip_jobs: 'test:e2e,playwright_e2e'
@@ -42,5 +49,12 @@ jobs:
     needs: [quality]
     uses: CodySwannGT/lisa/.github/workflows/zap-baseline-nestjs.yml@main
     with:
+      # Travels with the `uses:` line above — the two are one unit. Lisa's
+      # reusable workflows are tracked at `@main`, so that file changes under
+      # this repository with no pull request here. This is the contract major it
+      # spoke when Lisa seeded this file; the run fails loudly if it has since
+      # declared a break, and says NOT DETERMINED if this line goes missing
+      # (CodySwannGT/lisa#3698).
+      expected_workflow_contract_major: '1'
       node_version: '22.21.1'
       package_manager: 'bun'

package/nestjs/create-only/.github/workflows/deploy.yml

@@ -102,6 +102,13 @@ jobs:
     uses: CodySwannGT/lisa/.github/workflows/gates.yml@main
     needs: [determine_environment]
     with:
+      # Travels with the `uses:` line above — the two are one unit. Lisa's
+      # reusable workflows are tracked at `@main`, so that file changes under
+      # this repository with no pull request here. This is the contract major it
+      # spoke when Lisa seeded this file; the run fails loudly if it has since
+      # declared a break, and says NOT DETERMINED if this line goes missing
+      # (CodySwannGT/lisa#3698).
+      expected_workflow_contract_major: '1'
       moment: pre-deploy:${{ needs.determine_environment.outputs.environment }}
       node_version: '22.21.1'
       package_manager: 'bun'
@@ -117,6 +124,13 @@ jobs:
       contents: write
       pull-requests: read
     with:
+      # Travels with the `uses:` line above — the two are one unit. Lisa's
+      # reusable workflows are tracked at `@main`, so that file changes under
+      # this repository with no pull request here. This is the contract major it
+      # spoke when Lisa seeded this file; the run fails loudly if it has since
+      # declared a break, and says NOT DETERMINED if this line goes missing
+      # (CodySwannGT/lisa#3698).
+      expected_workflow_contract_major: '1'
       environment: ${{ needs.determine_environment.outputs.environment }}
       release_strategy: 'standard-version'
       skip_jobs: 'test:e2e,test:unit,test:integration,test'
@@ -430,6 +444,13 @@ jobs:
     needs: [determine_environment, deploy]
     if: ${{ always() && !cancelled() && needs.deploy.result == 'success' }}
     with:
+      # Travels with the `uses:` line above — the two are one unit. Lisa's
+      # reusable workflows are tracked at `@main`, so that file changes under
+      # this repository with no pull request here. This is the contract major it
+      # spoke when Lisa seeded this file; the run fails loudly if it has since
+      # declared a break, and says NOT DETERMINED if this line goes missing
+      # (CodySwannGT/lisa#3698).
+      expected_workflow_contract_major: '1'
       moment: post-deploy:${{ needs.determine_environment.outputs.environment }}
       node_version: '22.21.1'
       package_manager: 'bun'
@@ -447,6 +468,13 @@ jobs:
       (needs.determine_environment.outputs.environment == 'staging' || needs.determine_environment.outputs.environment == 'stage')
     uses: CodySwannGT/lisa/.github/workflows/load-test.yml@main
     with:
+      # Travels with the `uses:` line above — the two are one unit. Lisa's
+      # reusable workflows are tracked at `@main`, so that file changes under
+      # this repository with no pull request here. This is the contract major it
+      # spoke when Lisa seeded this file; the run fails loudly if it has since
+      # declared a break, and says NOT DETERMINED if this line goes missing
+      # (CodySwannGT/lisa#3698).
+      expected_workflow_contract_major: '1'
       environment: ${{ needs.determine_environment.outputs.environment }}
       test_scenario: 'smoke' # Start with smoke test after deployment
       base_url: ${{ needs.deploy.outputs.environment_url }}

package/package.json

@@ -19,8 +19,10 @@
     "lint": "oxlint --disable-nested-config && eslint . --quiet",
     "lint:fix": "oxlint --fix --disable-nested-config && eslint . --fix",
     "lint:slow": "eslint . --config eslint.slow.config.ts --quiet",
-    "typecheck": "tsc --noEmit && bun run typecheck:tests",
+    "typecheck": "tsc --noEmit && bun run typecheck:tests && bun run typecheck:engine-floor",
     "typecheck:tests": "node scripts/check-typecheck-tests.mjs",
+    "typecheck:engine-floor": "node scripts/check-engine-floor.mjs",
+    "measure:scripts-profile-gap": "bun scripts/measure-scripts-profile-gap.mts",
     "format:check": "prettier --check .",
     "format": "prettier --check . --write",
     "knip:check": "knip",
@@ -68,6 +70,7 @@
     "check:empty-subject-guards": "node scripts/check-empty-subject-guards.mjs",
     "check:cwd-resolution-corpus": "node scripts/check-cwd-resolution-corpus.mjs",
     "check:probe-absence-direction": "node scripts/check-probe-absence-direction.mjs",
+    "check:guard-parity-notes": "node scripts/check-guard-parity-notes.mjs",
     "check:shell-guard-refusals": "bun run build && $npm_execpath run lisa-test-run -- --adapter direct -- node scripts/check-shell-guard-refusal-coverage.mjs --trace-out .lisa/shell-guard-trace.jsonl",
     "check:workflow-inputs": "node scripts/detect-stale-workflow-inputs.mjs --project . --project typescript/create-only --project rails/create-only --json",
     "check:conflict-markers": "node all/copy-overwrite/scripts/check-conflict-markers.mjs",
@@ -76,7 +79,9 @@
     "check:merge-drivers": "node scripts/check-merge-driver-registration.mjs",
     "check:failure-signatures": "node plugins/src/base/hooks/failure-signature-index.mjs --check",
     "check:withdrawn-rulings": "node plugins/src/base/hooks/withdrawn-rulings.mjs --check",
+    "check:operational-hazards": "node plugins/src/base/hooks/operational-hazards.mjs --check",
     "check:template-workflow-refs": "node scripts/check-template-workflow-refs.mjs",
+    "check:workflow-contract-assertions": "node scripts/check-workflow-contract-assertions.mjs",
     "check:third-party-action-pins": "node scripts/check-third-party-action-pins.mjs",
     "check:workflow-package-paths": "node scripts/check-workflow-package-paths.mjs",
     "check:delivery-deletion-conflicts": "node scripts/check-delivery-deletion-conflicts.mjs",
@@ -181,7 +186,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.54.13",
+  "version": "4.55.0",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -329,7 +334,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "01138bafd69dc080f1cbf16b725477234cbde58a",
-  "gitHead": "01138bafd69dc080f1cbf16b725477234cbde58a",
-  "lisaReleaseTag": "v4.54.13"
+  "lisaReleaseCommit": "e01ec6ad7d10e2f097c3cb8034b7903fbf66534d",
+  "gitHead": "e01ec6ad7d10e2f097c3cb8034b7903fbf66534d",
+  "lisaReleaseTag": "v4.55.0"
 }

package/phaser/copy-overwrite/.github/workflows/ci.yml

@@ -22,6 +22,13 @@ jobs:
       pull-requests: read
     uses: CodySwannGT/lisa/.github/workflows/quality.yml@main
     with:
+      # Travels with the `uses:` line above — the two are one unit. Lisa's
+      # reusable workflows are tracked at `@main`, so that file changes under
+      # this repository with no pull request here. This is the contract major it
+      # spoke when Lisa seeded this file; the run fails loudly if it has since
+      # declared a break, and says NOT DETERMINED if this line goes missing
+      # (CodySwannGT/lisa#3698).
+      expected_workflow_contract_major: '1'
       node_version: '22.21.1'
       package_manager: 'bun'
       skip_jobs: ''