@codyswann/lisa 4.55.0 → 4.55.2

package/expo/create-only/.github/workflows/deploy.yml

@@ -188,17 +188,33 @@ jobs:
       - name: 📥 Checkout
         uses: actions/checkout@v6
         with:
-          fetch-depth: 2
+          fetch-depth: 0
 
       - name: Check if app config changed
         id: check_changes
+        env:
+          PUSH_BEFORE: ${{ github.event.before }}
+          EVENT_NAME: ${{ github.event_name }}
         run: |
-          if git diff --name-only HEAD^ HEAD | grep -qE "^(app\.config\.ts|app\.json|eas\.json)$"; then
-            echo "app_config_changed=true" >> $GITHUB_OUTPUT
-            echo "app config (app.config.ts / app.json / eas.json) has been modified"
+          set -euo pipefail
+          # A push may contain several commits. Inspect the complete push so
+          # this single build trigger also covers changes before the last commit.
+          base=HEAD^
+          if [ "$EVENT_NAME" = push ]; then
+            base="$PUSH_BEFORE"
+          fi
+          if [ -z "$base" ] || ! git cat-file -e "$base^{commit}" 2>/dev/null; then
+            # A new branch or unavailable before-revision needs a build.
+            echo "app_config_changed=true" >> "$GITHUB_OUTPUT"
+          elif git diff --quiet "$base" HEAD -- app.config.ts app.json eas.json; then
+            echo "app_config_changed=false" >> "$GITHUB_OUTPUT"
           else
-            echo "app_config_changed=false" >> $GITHUB_OUTPUT
-            echo "app config has not been modified"
+            result=$?
+            if [ "$result" -ne 1 ]; then
+              echo "::error::Could not compare native app configuration."
+              exit "$result"
+            fi
+            echo "app_config_changed=true" >> "$GITHUB_OUTPUT"
           fi
 
   # Trigger EAS Build if needed (only runs if app config changed)

package/package.json

@@ -155,7 +155,7 @@
     "form-data": ">=4.0.6",
     "handlebars": ">=4.7.9",
     "lodash": ">=4.18.1",
-    "multer": ">=2.2.0",
+    "multer": ">=2.3.0",
     "nanoid": "^3.3.18",
     "postcss": ">=8.5.18",
     "undici": "^6.28.0",
@@ -164,6 +164,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "overrides": {
+    "smol-toml": "1.7.1",
     "@isaacs/brace-expansion": "^5.0.1",
     "@istanbuljs/load-nyc-config": {
       "js-yaml": "^3.15.1"
@@ -177,7 +178,7 @@
     "form-data": ">=4.0.6",
     "handlebars": ">=4.7.9",
     "lodash": ">=4.18.1",
-    "multer": ">=2.2.0",
+    "multer": ">=2.3.0",
     "nanoid": "^3.3.18",
     "postcss": ">=8.5.18",
     "undici": "^6.28.0",
@@ -186,7 +187,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.55.0",
+  "version": "4.55.2",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -303,7 +304,7 @@
     "picocolors": "^1.0.0",
     "prettier": "^3.3.3",
     "semver": "^7.8.1",
-    "smol-toml": "^1.6.1",
+    "smol-toml": "1.7.1",
     "standard-version": "^9.5.0",
     "ts-jest": "^29.4.9",
     "ts-morph": "^27.0.2",
@@ -313,6 +314,7 @@
     "vitest": "^4.1.9"
   },
   "devDependencies": {
+    "@actions/expressions": "0.3.61",
     "@codyswann/lisa": "^4.33.1",
     "@playwright/test": "^1.61.1",
     "@stryker-mutator/api": "^9.0.0",
@@ -334,7 +336,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "e01ec6ad7d10e2f097c3cb8034b7903fbf66534d",
-  "gitHead": "e01ec6ad7d10e2f097c3cb8034b7903fbf66534d",
-  "lisaReleaseTag": "v4.55.0"
+  "lisaReleaseCommit": "dfa8eee4cbdc81e60bd25f83e68afea9deb8d45a",
+  "gitHead": "dfa8eee4cbdc81e60bd25f83e68afea9deb8d45a",
+  "lisaReleaseTag": "v4.55.2"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.0",
+  "version": "4.55.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.0",
+  "version": "4.55.2",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-linear-access/SKILL.md

@@ -188,8 +188,7 @@ Consumers pass business-shaped arguments only; they do not embed GraphQL.
 
 **This layer does not accept a state to write. It resolves one.** A `save-issue`
 that changes the workflow state declares `lifecycle_role:<ROLE>` — the semantic
-role it is applying (`ready`, `claimed`, `blocked`, `review`, `done`,
-`qa.queue`, `qa.certified`) — plus `env:<KEY>` when the role is the env-indexed
+role it is applying (`ready`, `claimed`, `blocked`, `review`, `done`) — plus `env:<KEY>` when the role is the env-indexed
 `done`. This layer then resolves that role against config and the team's own
 catalog, and sends the ID **it** resolved.
 

package/plugins/lisa/scripts/linear-state-write-target.mjs

@@ -174,8 +174,8 @@ export const resolveStateWriteTarget = ({
     return refuse(
       REFUSALS.MISSING_ROLE,
       "no lifecycle role was declared. Every `stateId` write must name the role " +
-        "it is applying (ready | claimed | blocked | review | done | qa.queue | " +
-        "qa.certified) so the configured target can be resolved instead of trusted."
+        "it is applying (ready | claimed | blocked | review | done) so the " +
+        "configured target can be resolved instead of trusted."
     );
 
   // The environment key belongs to exactly one shape: an env-indexed `done`.

package/plugins/lisa/scripts/qa-signal-lifecycle.mjs

@@ -71,10 +71,13 @@ import {
   parseArgs,
   parseConfig,
   readPath,
-  resolveRole,
 } from "./resolve-lifecycle-role.mjs";
 
-/** The QA-failure signal: applied by `lisa-qa-fail`, read by rework triage. */
+/**
+ * The QA-failure signal. Historically applied by the retired `lisa-qa-fail`
+ * skill; now applied by a human or by whatever a project uses for QA, and read
+ * by rework triage.
+ */
 export const QA_FAILURE_SIGNAL = "qa-failure";
 
 /** The human-gate signal: applied at filing, read by every intake sweep. */
@@ -190,8 +193,13 @@ const verdictOf = body => {
 };
 
 /**
- * Role names whose occupancy proves the QA failure was resolved: the certified
- * role, and every environment rung of the terminal `done` map.
+ * Role names whose occupancy proves the QA failure was resolved: every
+ * environment rung of the terminal `done` map.
+ *
+ * Previously this also resolved a `qa.certified` role. That role was retired
+ * along with the QA acceptance skills that were its only writers, so reaching a
+ * `done` rung is now the whole proof. A project that wants a distinct
+ * post-QA state expresses it as a `done` rung.
  *
  * @param {object} options inputs
  * @param {string} options.vendor `jira` | `linear` | `github`
@@ -199,16 +207,21 @@ const verdictOf = body => {
  * @returns {string[]} configured role names, empty when none are bound
  */
 export const voidingRoles = ({ vendor, config }) => {
-  const certified = resolveRole({
-    role: "qa.certified",
-    vendor,
-    global: config,
-  });
   const root = VENDOR_ROOTS[vendor];
   const doneMap = root ? readPath(config, `${root}.done`) : undefined;
+  // `done` has two sanctioned shapes: an env-indexed map, and a single scalar
+  // state for a project with one terminal rung. Every other reader handles
+  // both — linear-state-write-target.mjs:147, lifecycle-label-trust.mjs:213,
+  // queue-status-build-readers.mjs:315 — and this one must too. Missing the
+  // scalar here returns NO voiding roles at all, which holds a QA failure live
+  // forever on exactly the projects with the simplest config.
   const done =
-    doneMap && typeof doneMap === "object" ? Object.values(doneMap) : [];
-  return [certified.value, ...done].filter(
+    typeof doneMap === "string"
+      ? [doneMap]
+      : doneMap && typeof doneMap === "object"
+        ? Object.values(doneMap)
+        : [];
+  return done.filter(
     name => typeof name === "string" && name.trim().length > 0
   );
 };

package/plugins/lisa/scripts/resolve-lifecycle-role.mjs

@@ -80,12 +80,7 @@ export const REQUIRED_ROLES = Object.freeze([
  * Roles a project MAY bind. Omitting one means the lifecycle skips that
  * transition. These have NO built-in default — that is the whole point of R1.
  */
-export const OPTIONAL_ROLES = Object.freeze([
-  "review",
-  "qa.queue",
-  "qa.certified",
-  "human_needed",
-]);
+export const OPTIONAL_ROLES = Object.freeze(["review", "human_needed"]);
 
 /** Where each vendor keeps its build lifecycle role map. */
 export const VENDOR_ROOTS = Object.freeze({
@@ -155,7 +150,7 @@ export const parseConfig = file => {
  * built-in default tier: see R1 in the module docblock.
  *
  * @param {object} options resolution inputs
- * @param {string} options.role role name (`ready`, `review`, `qa.queue`, …)
+ * @param {string} options.role role name (`ready`, `review`, `human_needed`, …)
  * @param {string} options.vendor one of `jira` | `linear` | `github`
  * @param {"read" | "write"} [options.intent] what the caller will do with it
  * @param {string} [options.env] env key when resolving the env-keyed `done` map

package/plugins/lisa/skills/lisa-linear-access/SKILL.md

@@ -188,8 +188,7 @@ Consumers pass business-shaped arguments only; they do not embed GraphQL.
 
 **This layer does not accept a state to write. It resolves one.** A `save-issue`
 that changes the workflow state declares `lifecycle_role:<ROLE>` — the semantic
-role it is applying (`ready`, `claimed`, `blocked`, `review`, `done`,
-`qa.queue`, `qa.certified`) — plus `env:<KEY>` when the role is the env-indexed
+role it is applying (`ready`, `claimed`, `blocked`, `review`, `done`) — plus `env:<KEY>` when the role is the env-indexed
 `done`. This layer then resolves that role against config and the team's own
 catalog, and sends the ID **it** resolved.
 

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.0",
+  "version": "4.55.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/scripts/linear-state-write-target.mjs

@@ -174,8 +174,8 @@ export const resolveStateWriteTarget = ({
     return refuse(
       REFUSALS.MISSING_ROLE,
       "no lifecycle role was declared. Every `stateId` write must name the role " +
-        "it is applying (ready | claimed | blocked | review | done | qa.queue | " +
-        "qa.certified) so the configured target can be resolved instead of trusted."
+        "it is applying (ready | claimed | blocked | review | done) so the " +
+        "configured target can be resolved instead of trusted."
     );
 
   // The environment key belongs to exactly one shape: an env-indexed `done`.

package/plugins/lisa-agy/scripts/qa-signal-lifecycle.mjs

@@ -71,10 +71,13 @@ import {
   parseArgs,
   parseConfig,
   readPath,
-  resolveRole,
 } from "./resolve-lifecycle-role.mjs";
 
-/** The QA-failure signal: applied by `lisa-qa-fail`, read by rework triage. */
+/**
+ * The QA-failure signal. Historically applied by the retired `lisa-qa-fail`
+ * skill; now applied by a human or by whatever a project uses for QA, and read
+ * by rework triage.
+ */
 export const QA_FAILURE_SIGNAL = "qa-failure";
 
 /** The human-gate signal: applied at filing, read by every intake sweep. */
@@ -190,8 +193,13 @@ const verdictOf = body => {
 };
 
 /**
- * Role names whose occupancy proves the QA failure was resolved: the certified
- * role, and every environment rung of the terminal `done` map.
+ * Role names whose occupancy proves the QA failure was resolved: every
+ * environment rung of the terminal `done` map.
+ *
+ * Previously this also resolved a `qa.certified` role. That role was retired
+ * along with the QA acceptance skills that were its only writers, so reaching a
+ * `done` rung is now the whole proof. A project that wants a distinct
+ * post-QA state expresses it as a `done` rung.
  *
  * @param {object} options inputs
  * @param {string} options.vendor `jira` | `linear` | `github`
@@ -199,16 +207,21 @@ const verdictOf = body => {
  * @returns {string[]} configured role names, empty when none are bound
  */
 export const voidingRoles = ({ vendor, config }) => {
-  const certified = resolveRole({
-    role: "qa.certified",
-    vendor,
-    global: config,
-  });
   const root = VENDOR_ROOTS[vendor];
   const doneMap = root ? readPath(config, `${root}.done`) : undefined;
+  // `done` has two sanctioned shapes: an env-indexed map, and a single scalar
+  // state for a project with one terminal rung. Every other reader handles
+  // both — linear-state-write-target.mjs:147, lifecycle-label-trust.mjs:213,
+  // queue-status-build-readers.mjs:315 — and this one must too. Missing the
+  // scalar here returns NO voiding roles at all, which holds a QA failure live
+  // forever on exactly the projects with the simplest config.
   const done =
-    doneMap && typeof doneMap === "object" ? Object.values(doneMap) : [];
-  return [certified.value, ...done].filter(
+    typeof doneMap === "string"
+      ? [doneMap]
+      : doneMap && typeof doneMap === "object"
+        ? Object.values(doneMap)
+        : [];
+  return done.filter(
     name => typeof name === "string" && name.trim().length > 0
   );
 };

package/plugins/lisa-agy/scripts/resolve-lifecycle-role.mjs

@@ -80,12 +80,7 @@ export const REQUIRED_ROLES = Object.freeze([
  * Roles a project MAY bind. Omitting one means the lifecycle skips that
  * transition. These have NO built-in default — that is the whole point of R1.
  */
-export const OPTIONAL_ROLES = Object.freeze([
-  "review",
-  "qa.queue",
-  "qa.certified",
-  "human_needed",
-]);
+export const OPTIONAL_ROLES = Object.freeze(["review", "human_needed"]);
 
 /** Where each vendor keeps its build lifecycle role map. */
 export const VENDOR_ROOTS = Object.freeze({
@@ -155,7 +150,7 @@ export const parseConfig = file => {
  * built-in default tier: see R1 in the module docblock.
  *
  * @param {object} options resolution inputs
- * @param {string} options.role role name (`ready`, `review`, `qa.queue`, …)
+ * @param {string} options.role role name (`ready`, `review`, `human_needed`, …)
  * @param {string} options.vendor one of `jira` | `linear` | `github`
  * @param {"read" | "write"} [options.intent] what the caller will do with it
  * @param {string} [options.env] env key when resolving the env-keyed `done` map

package/plugins/lisa-agy/skills/lisa-linear-access/SKILL.md

@@ -188,8 +188,7 @@ Consumers pass business-shaped arguments only; they do not embed GraphQL.
 
 **This layer does not accept a state to write. It resolves one.** A `save-issue`
 that changes the workflow state declares `lifecycle_role:<ROLE>` — the semantic
-role it is applying (`ready`, `claimed`, `blocked`, `review`, `done`,
-`qa.queue`, `qa.certified`) — plus `env:<KEY>` when the role is the env-indexed
+role it is applying (`ready`, `claimed`, `blocked`, `review`, `done`) — plus `env:<KEY>` when the role is the env-indexed
 `done`. This layer then resolves that role against config and the team's own
 catalog, and sends the ID **it** resolved.
 

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.0",
+  "version": "4.55.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.0",
+  "version": "4.55.2",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.0",
+  "version": "4.55.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.0",
+  "version": "4.55.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.0",
+  "version": "4.55.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.0",
+  "version": "4.55.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/scripts/linear-state-write-target.mjs

@@ -174,8 +174,8 @@ export const resolveStateWriteTarget = ({
     return refuse(
       REFUSALS.MISSING_ROLE,
       "no lifecycle role was declared. Every `stateId` write must name the role " +
-        "it is applying (ready | claimed | blocked | review | done | qa.queue | " +
-        "qa.certified) so the configured target can be resolved instead of trusted."
+        "it is applying (ready | claimed | blocked | review | done) so the " +
+        "configured target can be resolved instead of trusted."
     );
 
   // The environment key belongs to exactly one shape: an env-indexed `done`.

package/plugins/lisa-copilot/scripts/qa-signal-lifecycle.mjs

@@ -71,10 +71,13 @@ import {
   parseArgs,
   parseConfig,
   readPath,
-  resolveRole,
 } from "./resolve-lifecycle-role.mjs";
 
-/** The QA-failure signal: applied by `lisa-qa-fail`, read by rework triage. */
+/**
+ * The QA-failure signal. Historically applied by the retired `lisa-qa-fail`
+ * skill; now applied by a human or by whatever a project uses for QA, and read
+ * by rework triage.
+ */
 export const QA_FAILURE_SIGNAL = "qa-failure";
 
 /** The human-gate signal: applied at filing, read by every intake sweep. */
@@ -190,8 +193,13 @@ const verdictOf = body => {
 };
 
 /**
- * Role names whose occupancy proves the QA failure was resolved: the certified
- * role, and every environment rung of the terminal `done` map.
+ * Role names whose occupancy proves the QA failure was resolved: every
+ * environment rung of the terminal `done` map.
+ *
+ * Previously this also resolved a `qa.certified` role. That role was retired
+ * along with the QA acceptance skills that were its only writers, so reaching a
+ * `done` rung is now the whole proof. A project that wants a distinct
+ * post-QA state expresses it as a `done` rung.
  *
  * @param {object} options inputs
  * @param {string} options.vendor `jira` | `linear` | `github`
@@ -199,16 +207,21 @@ const verdictOf = body => {
  * @returns {string[]} configured role names, empty when none are bound
  */
 export const voidingRoles = ({ vendor, config }) => {
-  const certified = resolveRole({
-    role: "qa.certified",
-    vendor,
-    global: config,
-  });
   const root = VENDOR_ROOTS[vendor];
   const doneMap = root ? readPath(config, `${root}.done`) : undefined;
+  // `done` has two sanctioned shapes: an env-indexed map, and a single scalar
+  // state for a project with one terminal rung. Every other reader handles
+  // both — linear-state-write-target.mjs:147, lifecycle-label-trust.mjs:213,
+  // queue-status-build-readers.mjs:315 — and this one must too. Missing the
+  // scalar here returns NO voiding roles at all, which holds a QA failure live
+  // forever on exactly the projects with the simplest config.
   const done =
-    doneMap && typeof doneMap === "object" ? Object.values(doneMap) : [];
-  return [certified.value, ...done].filter(
+    typeof doneMap === "string"
+      ? [doneMap]
+      : doneMap && typeof doneMap === "object"
+        ? Object.values(doneMap)
+        : [];
+  return done.filter(
     name => typeof name === "string" && name.trim().length > 0
   );
 };

package/plugins/lisa-copilot/scripts/resolve-lifecycle-role.mjs

@@ -80,12 +80,7 @@ export const REQUIRED_ROLES = Object.freeze([
  * Roles a project MAY bind. Omitting one means the lifecycle skips that
  * transition. These have NO built-in default — that is the whole point of R1.
  */
-export const OPTIONAL_ROLES = Object.freeze([
-  "review",
-  "qa.queue",
-  "qa.certified",
-  "human_needed",
-]);
+export const OPTIONAL_ROLES = Object.freeze(["review", "human_needed"]);
 
 /** Where each vendor keeps its build lifecycle role map. */
 export const VENDOR_ROOTS = Object.freeze({
@@ -155,7 +150,7 @@ export const parseConfig = file => {
  * built-in default tier: see R1 in the module docblock.
  *
  * @param {object} options resolution inputs
- * @param {string} options.role role name (`ready`, `review`, `qa.queue`, …)
+ * @param {string} options.role role name (`ready`, `review`, `human_needed`, …)
  * @param {string} options.vendor one of `jira` | `linear` | `github`
  * @param {"read" | "write"} [options.intent] what the caller will do with it
  * @param {string} [options.env] env key when resolving the env-keyed `done` map

package/plugins/lisa-copilot/skills/lisa-linear-access/SKILL.md

@@ -188,8 +188,7 @@ Consumers pass business-shaped arguments only; they do not embed GraphQL.
 
 **This layer does not accept a state to write. It resolves one.** A `save-issue`
 that changes the workflow state declares `lifecycle_role:<ROLE>` — the semantic
-role it is applying (`ready`, `claimed`, `blocked`, `review`, `done`,
-`qa.queue`, `qa.certified`) — plus `env:<KEY>` when the role is the env-indexed
+role it is applying (`ready`, `claimed`, `blocked`, `review`, `done`) — plus `env:<KEY>` when the role is the env-indexed
 `done`. This layer then resolves that role against config and the team's own
 catalog, and sends the ID **it** resolved.
 

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.0",
+  "version": "4.55.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/scripts/linear-state-write-target.mjs

@@ -174,8 +174,8 @@ export const resolveStateWriteTarget = ({
     return refuse(
       REFUSALS.MISSING_ROLE,
       "no lifecycle role was declared. Every `stateId` write must name the role " +
-        "it is applying (ready | claimed | blocked | review | done | qa.queue | " +
-        "qa.certified) so the configured target can be resolved instead of trusted."
+        "it is applying (ready | claimed | blocked | review | done) so the " +
+        "configured target can be resolved instead of trusted."
     );
 
   // The environment key belongs to exactly one shape: an env-indexed `done`.

package/plugins/lisa-cursor/scripts/qa-signal-lifecycle.mjs

@@ -71,10 +71,13 @@ import {
   parseArgs,
   parseConfig,
   readPath,
-  resolveRole,
 } from "./resolve-lifecycle-role.mjs";
 
-/** The QA-failure signal: applied by `lisa-qa-fail`, read by rework triage. */
+/**
+ * The QA-failure signal. Historically applied by the retired `lisa-qa-fail`
+ * skill; now applied by a human or by whatever a project uses for QA, and read
+ * by rework triage.
+ */
 export const QA_FAILURE_SIGNAL = "qa-failure";
 
 /** The human-gate signal: applied at filing, read by every intake sweep. */
@@ -190,8 +193,13 @@ const verdictOf = body => {
 };
 
 /**
- * Role names whose occupancy proves the QA failure was resolved: the certified
- * role, and every environment rung of the terminal `done` map.
+ * Role names whose occupancy proves the QA failure was resolved: every
+ * environment rung of the terminal `done` map.
+ *
+ * Previously this also resolved a `qa.certified` role. That role was retired
+ * along with the QA acceptance skills that were its only writers, so reaching a
+ * `done` rung is now the whole proof. A project that wants a distinct
+ * post-QA state expresses it as a `done` rung.
  *
  * @param {object} options inputs
  * @param {string} options.vendor `jira` | `linear` | `github`
@@ -199,16 +207,21 @@ const verdictOf = body => {
  * @returns {string[]} configured role names, empty when none are bound
  */
 export const voidingRoles = ({ vendor, config }) => {
-  const certified = resolveRole({
-    role: "qa.certified",
-    vendor,
-    global: config,
-  });
   const root = VENDOR_ROOTS[vendor];
   const doneMap = root ? readPath(config, `${root}.done`) : undefined;
+  // `done` has two sanctioned shapes: an env-indexed map, and a single scalar
+  // state for a project with one terminal rung. Every other reader handles
+  // both — linear-state-write-target.mjs:147, lifecycle-label-trust.mjs:213,
+  // queue-status-build-readers.mjs:315 — and this one must too. Missing the
+  // scalar here returns NO voiding roles at all, which holds a QA failure live
+  // forever on exactly the projects with the simplest config.
   const done =
-    doneMap && typeof doneMap === "object" ? Object.values(doneMap) : [];
-  return [certified.value, ...done].filter(
+    typeof doneMap === "string"
+      ? [doneMap]
+      : doneMap && typeof doneMap === "object"
+        ? Object.values(doneMap)
+        : [];
+  return done.filter(
     name => typeof name === "string" && name.trim().length > 0
   );
 };

package/plugins/lisa-cursor/scripts/resolve-lifecycle-role.mjs

@@ -80,12 +80,7 @@ export const REQUIRED_ROLES = Object.freeze([
  * Roles a project MAY bind. Omitting one means the lifecycle skips that
  * transition. These have NO built-in default — that is the whole point of R1.
  */
-export const OPTIONAL_ROLES = Object.freeze([
-  "review",
-  "qa.queue",
-  "qa.certified",
-  "human_needed",
-]);
+export const OPTIONAL_ROLES = Object.freeze(["review", "human_needed"]);
 
 /** Where each vendor keeps its build lifecycle role map. */
 export const VENDOR_ROOTS = Object.freeze({
@@ -155,7 +150,7 @@ export const parseConfig = file => {
  * built-in default tier: see R1 in the module docblock.
  *
  * @param {object} options resolution inputs
- * @param {string} options.role role name (`ready`, `review`, `qa.queue`, …)
+ * @param {string} options.role role name (`ready`, `review`, `human_needed`, …)
  * @param {string} options.vendor one of `jira` | `linear` | `github`
  * @param {"read" | "write"} [options.intent] what the caller will do with it
  * @param {string} [options.env] env key when resolving the env-keyed `done` map

package/plugins/lisa-cursor/skills/lisa-linear-access/SKILL.md

@@ -188,8 +188,7 @@ Consumers pass business-shaped arguments only; they do not embed GraphQL.
 
 **This layer does not accept a state to write. It resolves one.** A `save-issue`
 that changes the workflow state declares `lifecycle_role:<ROLE>` — the semantic
-role it is applying (`ready`, `claimed`, `blocked`, `review`, `done`,
-`qa.queue`, `qa.certified`) — plus `env:<KEY>` when the role is the env-indexed
+role it is applying (`ready`, `claimed`, `blocked`, `review`, `done`) — plus `env:<KEY>` when the role is the env-indexed
 `done`. This layer then resolves that role against config and the team's own
 catalog, and sends the ID **it** resolved.
 

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.55.0",
+  "version": "4.55.2",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"