@codyswann/lisa 4.55.2 → 4.55.3

package/plugins/src/base/hooks/worktree-binding-guard.sh

@@ -54,7 +54,8 @@ if [ -r "$lisa_guard_dedupe_lib" ]; then
   # shellcheck source=guard-dedupe.bash
   . "$lisa_guard_dedupe_lib"
   trap 'lisa_guard_dedupe_record $?' EXIT
-  lisa_guard_dedupe worktree-binding-guard "$input"
+  lisa_guard_dedupe worktree-binding-guard "$input" \
+    "$lisa_guard_hook_dir/worktree-binding-guard.mjs"
 fi
 
 if ! command -v node >/dev/null 2>&1; then

package/plugins/src/base/rules/eager/00-rule-index.md

@@ -68,6 +68,7 @@ Paths are relative to this file.
 
 | Slug | Read it when | Body |
 |---|---|---|
+| `operational-hazards` | looking up or publishing an active operational hazard that other sessions must see | [../reference/operational-hazards.md](../reference/operational-hazards.md) |
 | `automation-runbook-contract` | registering a loop, or ending any flow with its run outcome | [../reference/automation-runbook-contract.md](../reference/automation-runbook-contract.md) |
 | `convergent-review` | reviewing a PR or resolving review findings | [../reference/convergent-review.md](../reference/convergent-review.md) |
 | `credential-substrate-precedence` | writing or editing an `*-access` skill | [../reference/credential-substrate-precedence.md](../reference/credential-substrate-precedence.md) |

package/plugins/src/base/rules/eager/base-rules.md

@@ -7,7 +7,7 @@ These are mandatory disciplines that apply to every session. Full prose, JIRA de
 You are factory machinery, not a chat assistant. Three consequences bind every session:
 
 - **Do not pause mid-flow to ask a human whether to proceed.** Handoff happens at the gates — the ready-role flips and intake's adversarial validation — never in the middle of a flow.
-- **Every flow must work headless**: no interactive prompts, idempotent re-runs, clean exits on empty queues. Flows run under native schedulers as often as under a human.
+- **Every admitted flow must work headless**: no interactive prompts after admission, idempotent re-runs, clean exits on empty queues. Resolve required input before admission: interactive requests may need clarification; unattended requests with missing input return `recovery-required` without guessing or applying side effects. Flows run under native schedulers as often as under a human.
 - **Never weaken a gate to get work through it — fix the work.**
 
 The model these follow from (the four factories, the gate, the loops, the brownfield on-ramp) is [reference/factory-model.md](../reference/factory-model.md); read it when you need the shape rather than the obligations.
@@ -16,6 +16,8 @@ The model these follow from (the four factories, the gate, the loops, the brownf
 
 Treat every request as potentially underspecified. Before starting any work:
 
+**Unattended: override stop-and-ask below.** Missing input means `recovery-required`: no guessing, prompts or side effects. Ask only before interactive admission.
+
 1. Identify ambiguities that would prevent completion. If any exist, stop and ask.
 2. Identify open questions whose answers would change your approach. If any exist, stop and ask.
 3. Define how you will empirically verify the work is complete by USING the resulting software, not just running tests. If you cannot define this, stop and ask.

package/plugins/src/base/rules/eager/withdrawn-rulings.md

@@ -25,14 +25,25 @@ The result is one-directional propagation. **New guidance travels; corrections d
 - **Record every withdrawal in the ledger, with one command.** Retracting a claim you circulated,
   wrote down, or published is not done until this has run:
 
+  ```sh
+  node "$CLAUDE_PLUGIN_ROOT/hooks/withdrawn-rulings.mjs" --withdraw "<id>" \
+    --claim "<the withdrawn claim, verbatim>" \
+    --because "<what disproved it>" \
+    --derived "<an artifact you left standing on it>"
   ```
-  node "$CLAUDE_PLUGIN_ROOT/hooks/withdrawn-rulings.mjs" --withdraw <id> \
+
+  If the audit found no surviving derived artifact, use this alternative:
+
+  ```sh
+  node "$CLAUDE_PLUGIN_ROOT/hooks/withdrawn-rulings.mjs" --withdraw "<id>" \
     --claim "<the withdrawn claim, verbatim>" \
     --because "<what disproved it>" \
-    --derived "<an artifact you left standing on it>" ... | --derived none \
-    [--superseded-by <id>] [--reached <channel> ...]
+    --derived none
   ```
 
+  Repeat `--derived "<artifact>"` for additional artifacts. Either form may also
+  include `--superseded-by "<id>"` and repeated `--reached "<channel>"` arguments.
+
   The verbatim claim is required and the command refuses without it: **a tombstone the holder of the
   claim cannot recognise reaches them without reaching them.**
 

package/plugins/src/base/rules/reference/automation-runbook-contract.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Automation Runbook Contract (load-bearing)
 

package/plugins/src/base/rules/reference/bdd-e2e-coverage.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## BDD Behavior Contract & E2E Coverage (load-bearing)
 

package/plugins/src/base/rules/reference/blocker-containment.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Blocker Containment (load-bearing)
 
@@ -39,7 +39,7 @@ A false negative (left blocked) costs a cycle and is visible. A false positive (
 
 ## The one carve-out: a blocker with no code
 
-A dependency need not deliver code. A blocker **closed as completed** that positively declares no code deliverable — `Target Backend Environment: None — no runtime behavior change` (doc-only / config-only / type-only), no linked PR, no merge commit — is **cleared**, because there is no artifact whose location could matter.
+A dependency need not deliver code. A blocker **closed as completed** that positively declares no code deliverable — `## Target Backend Environment` reading `None — no runtime behavior change: <kind>` (`doc-only` / `config-only` / `type-only`), no linked PR, no merge commit — is **cleared**, because there is no artifact whose location could matter.
 
 This requires a **positive determination**, never an absence. "I could not find a PR" is fail-closed under the rule above; "the item declares it ships no code" is this carve-out. Collapsing the two turns the carve-out into a universal bypass.
 
@@ -131,7 +131,7 @@ A blocker is cleared under this carve-out when **all** of the following hold:
 
 1. it is **closed as completed** (not `not planned` — see `rejection-detection`, where *not planned* is a durable decline);
 2. it **positively declares no code deliverable** — `## Target Backend Environment` reading `None — no runtime behavior change: doc-only` (or `config-only` / `type-only`), per the grammar `derived-branch-plan` already defines;
-3. it has **no linked merged PR**. If it has one, the normal containment test applies regardless of what the section declares — the code is the authority over the prose.
+3. it has **no linked PR and no merge commit**. Any linked PR requires the normal containment test regardless of what the section declares; an open or unmerged PR remains blocking — the code is the authority over the prose.
 
 This is a **positive determination, never an absence.** "I could not find a PR" is `no-pr` in the fail-closed table above. "The item declares that it ships no code" is this carve-out. Collapsing the two converts a narrow carve-out into a universal bypass, and it is the single most likely way for this rule to be implemented wrongly.
 

package/plugins/src/base/rules/reference/claim-archaeology.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Claim-Time Archaeology (load-bearing)
 

package/plugins/src/base/rules/reference/claim-evidence-mapping.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Claim → Evidence Mapping Contract (load-bearing)
 

package/plugins/src/base/rules/reference/claim-time-guards.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Claim-Time Guards (load-bearing)
 

package/plugins/src/base/rules/reference/control-reachability.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Control Reachability — A Prescribed Control Must Reach the Changed Path (load-bearing)
 

package/plugins/src/base/rules/reference/convergent-review.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Convergent Review
 

package/plugins/src/base/rules/reference/credential-substrate-precedence.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Credential-Substrate Precedence (load-bearing)
 

package/plugins/src/base/rules/reference/dependency-decision-records.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Dependency Decisions (load-bearing)
 

package/plugins/src/base/rules/reference/dependency-internalization-kit.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Dependency Internalization Kit (load-bearing)
 

package/plugins/src/base/rules/reference/dependency-trust-classes.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Dependency Trust Classes (load-bearing)
 

package/plugins/src/base/rules/reference/deployed-state-readback.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Deployed-State Readback (load-bearing)
 

package/plugins/src/base/rules/reference/derived-branch-plan.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Derived Branch Plan (load-bearing)
 

package/plugins/src/base/rules/reference/design-source-of-truth.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Design Source of Truth (load-bearing)
 

package/plugins/src/base/rules/reference/design-value-binding.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Design Value Binding (load-bearing)
 

package/plugins/src/base/rules/reference/documentation-source-paths.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Documentation Source Paths (load-bearing)
 

package/plugins/src/base/rules/reference/leaf-only-lifecycle.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Leaf-Only Build-Ready Invariant (load-bearing)
 

package/plugins/src/base/rules/reference/observability-audit.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Observability Audit (load-bearing)
 

package/plugins/src/base/rules/reference/prd-definition-of-ready.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## PRD Definition of Ready (requirement atoms)
 

package/plugins/src/base/rules/reference/prd-lifecycle-rollup.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## PRD Lifecycle Rollup & Generated-Top-Level-Work Contract (load-bearing)
 

package/plugins/src/base/rules/reference/pre-flight-autofill.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Pre-Flight Spec Autofill — Draft-Then-Block (load-bearing)
 

package/plugins/src/base/rules/reference/promotion-contract.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Promotion Contract (load-bearing)
 

package/plugins/src/base/rules/reference/readiness-rubric.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Repository Readiness Rubric (load-bearing)
 

package/plugins/src/base/rules/reference/ready-role-filing.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Ready-Role Filing (load-bearing)
 

package/plugins/src/base/rules/reference/rejection-detection.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Rejection Detection at Claim Time (load-bearing)
 

package/plugins/src/base/rules/reference/repo-scope-split.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Repo Scope & Work-Time Splitting (load-bearing)
 
@@ -42,9 +42,10 @@ A tracker can oversee multiple repos. Build-intake claims only current-repo tick
 
 Then, for each ready candidate:
 
-1. **Read `repo:<name>` label.** Wrong repo → skip. Current repo → leaf-only gate + claim. Unlabeled → determine + stamp + re-apply.
-2. **Multi-repo leaf → split, never claim.** Each split sibling is created build-ready and stamped with its own `repo:<name>`.
-3. **Wrong-repo single-repo leaf → skip** (label keeps it cheap next cycle).
+1. **Count distinct repository markers first** — all `repo:<name>` labels plus recognized JIRA repository components, deduplicated by repository. Containers go to the leaf-only gate; do not split them.
+2. **Multi-repo leaf → split, never claim.** More than one repository uses the work-time split; each sibling is build-ready and stamped with its own `repo:<name>`.
+3. **Exactly one repository:** current repo → leaf-only gate + claim; wrong repo → skip.
+4. **No repository marker:** determine from content and code, stamp the resolved markers, then re-apply this decision from the count.
 
 ---
 
@@ -86,12 +87,10 @@ A ticketing system can oversee multiple repos (one JIRA project / Linear team fo
 
 Resolve the current repo per the `config-resolution` "Repo scoping" section (config `repo` → `github.repo` → git remote basename; stop with a clear error if unresolvable). Then walk the ready candidates in priority order and apply the **repo-scope decision** to each before claiming:
 
-1. **Read the candidate's repo marker** — the `repo:<name>` label (JIRA: also a component equal to a repo name).
-   - **Labeled for another repo** → **skip** cheaply (do not claim, do not re-determine); it stays `ready` for that repo's own intake. Move to the next candidate.
-   - **Labeled for the current repo** → proceed to the leaf-only gate + claim (the cheap, common path once labels exist).
-   - **Unlabeled** → **determine** the target repo(s) from the ticket (description, acceptance criteria, technical approach) confirmed against the actual code surfaces the change requires — the same detection as step 1 of the work-time split. Then **stamp** the resolved `repo:<name>` label(s) so future cycles filter cheaply, and re-apply this decision with the now-known repo.
-2. **Multi-repo leaf → split, never claim.** If determination finds the leaf touches more than one repo, run the **work-time split procedure** below to break it into single-repo siblings — each created **build-ready** (`build_ready: true`, so the build queue auto-claims it) and stamped with its own `repo:<name>`. After the split, the current repo's sibling (if any) becomes a normal current-repo candidate; the others are separate single-repo `ready` leaves for their repos. A multi-repo leaf is never claimed as-is.
-3. **Wrong repo → skip.** A single-repo leaf whose `repo:<name>` ≠ the current repo is left `ready` (and labeled) and skipped; intake moves on until it finds a claimable current-repo leaf, then stops (one item per cycle).
+1. **Count distinct repository markers first** — all `repo:<name>` labels and JIRA components equal to recognized repository names, deduplicated by repository. Containers go to the leaf-only gate and are never split or claimed here.
+2. **Multi-repo leaf → split, never claim.** More than one distinct repository takes the work-time split procedure before any wrong-repository skip. Each sibling is created **build-ready** (`build_ready: true`) and stamped with its own `repo:<name>`. The current repo's sibling, if any, becomes a normal candidate.
+3. **Exactly one repository:** a single-repo leaf for the current repo proceeds to the leaf-only gate + claim; a leaf for another repo is skipped and left ready for its own intake.
+4. **No repository marker:** determine the target repo(s) from description, acceptance criteria, technical approach and actual code surfaces. Stamp the resolved `repo:<name>` labels and re-apply from step 1. Continue until one current-repo leaf is claimed or the candidates are exhausted.
 
 **Query-time pre-filter (the cheapest arm — apply before the per-candidate walk).** When the queue is queryable, scope the candidate **query itself** to the current repo so sibling-repo tickets never even enter the set — instead of pulling the whole project's ready tickets and skipping the wrong ones one-by-one (a full wasted scan when none belong to the current repo, e.g. a JIRA project shared across `frontend`/`backend`/`infrastructure`). On JIRA, append to the JQL:
 

package/plugins/src/base/rules/reference/reset-seed-coverage.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Reset/Seed Coverage & State Classification (load-bearing)
 

package/plugins/src/base/rules/reference/usage-accounting.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Usage Accounting (load-bearing)
 

package/plugins/src/base/rules/reference/work-item-definition-of-ready.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Work-Item Definition of Ready (type-keyed)
 

package/plugins/src/base/skills/lisa-github-build-intake/SKILL.md

@@ -215,9 +215,15 @@ nothing survives, exit on the denominator-stated summary from `summarizeDryLane`
 A blocker is a **claim with a timestamp, not a fact** — it goes stale the moment its condition comes
 true, and nothing re-read one before this phase. For each `$BLOCKED` candidate:
 
-1. **Human gate first, and it is absolute.** An issue carrying the configured human-needed label
-   (`github.labels.build.human_needed`, default `human-needed`) or a `[lisa-human-gate]` marker in
-   its body is **never** auto-selected, whatever any probe says.
+1. **Read release comments before applying the human gate.** Pass all item comments, labels,
+   body and configured `humanNeededLabel` to `classifyReadyCandidate(...)`. For a discharged hold,
+   call `planHumanGateRelease({ labels, body, comments, humanNeededLabel, readyLabel, lifecycleLabels, alreadyNotified })`
+   and retain its plan. Apply human-marker cleanup only as planned; defer any ready-role restoration
+   until steps 2–5 have cleared the remaining blockers (map the role to the vendor's state or label).
+   A still-active hold is never auto-selected, whatever any probe says. An absent or unreadable
+   comment history cannot discharge a hold. A release removes only the human hold: continue the
+   remaining blocker checks below before selecting the item.
+
 2. **Extract the stated discharge condition**, then **probe it**. Machine-testable conditions — a
    version on trunk, a published package, a CI run history, an advisory's patched status — rot
    fastest and are cheapest to check. A human decision is not machine-testable; leave it.
@@ -335,8 +341,9 @@ other gate's verdict — however conclusive — may promote an item a person par
    is the same repair the leaf-only gate already performs for a ready item that must not be
    dispatched.
 4. **On `claimable: true` for an item that still carries a hold, RELEASE it — do not just proceed.**
-   The hold left durable state behind: the item is out of the queue and flagged as needing a person,
-   and answering the question does not undo either. Call
+   This ready-lane candidate can retain a historical body marker and a human-needed label.
+   This step reconciles only candidates still in the ready lane; released holds outside it are
+   recovered by `lisa-repair-intake` step 2b (or Phase 2.5 when included in this cycle). Call
    `planHumanGateRelease({ labels, body, comments, humanNeededLabel, readyLabel, lifecycleLabels, alreadyNotified })`
    and apply exactly the actions it returns: remove the configured human-needed marker, add the
    configured ready role back, and post `formatHumanGateReleaseNote()` once. It is the exact inverse
@@ -369,11 +376,12 @@ GitHub Issues live in one repo by definition, so the scanned repo's issues are u
 1. **Resolve the current repo** per `config-resolution` "Repo scoping" (`.repo` → `.github.repo` → `git remote get-url origin` basename). If unresolvable, stop and report.
 2. **Cheap path first.** Prefer candidates already carrying the `repo:<current>` label. Keep the Phase 2 scan broad so unlabeled issues are still seen, determined, and stamped.
 3. **Per candidate, apply the repo-scope decision (`repo-scope-split`):**
-   - Carries `repo:<other>` → **skip** (leave it `ready` for that repo's own intake); next candidate.
-   - **Unlabeled** → determine the target repo(s) from the issue + code surfaces, then **stamp** `repo:<name>` via `gh issue edit <n> --add-label "repo:<name>"` (create the label lazily) so later cycles filter cheaply; re-apply with the now-known repo. (An issue whose work is entirely in the scanned repo is simply labeled `repo:<current>`.)
-   - **Container visibility is allowed.** A multi-repo Epic / Story / Spike may legitimately carry multiple `repo:<name>` labels for operator visibility. Do not split or claim it here; leave the repo markers intact and fall through to the leaf-only gate, which repairs the stale build-ready label instead of dispatching the container.
-   - **Multi-repo leaf → split, never claim.** Run the `repo-scope-split` work-time procedure into single-repo siblings, each created **build-ready** (`build_ready: true`) and stamped with its own `repo:<name>`; the current repo's sibling becomes a normal candidate.
-   - **Single-repo leaf for the current repo** → fall through to 3a (leaf-only gate) and 3b (claim).
+   - **Count distinct repository markers first**: collect all `repo:<name>` labels and, on JIRA, recognized repository components; deduplicate by repository. A container may carry multiple `repo:<name>` labels. Do not split or claim it here; send it to the leaf-only gate.
+   - **Multi-repo leaf → split, never claim.** More than one repository takes the work-time split before any wrong-repository skip. Each sibling is **build-ready** (`build_ready: true`) and stamped with its own `repo:<name>`; the current repo's sibling becomes a normal candidate.
+   - **Exactly one other repository** (`repo:<other>`) → **skip**, leaving the item ready for that repo's intake.
+   - **No repository marker** → determine target repo(s) from the ticket and code, stamp `repo:<name>` through the vendor access layer, and re-apply from the count.
+   - **Single-repo leaf for the current repo** → fall through to 3a and 3b.
+
 4. Continue until a claimable current-repo leaf is found (claim it; one per cycle) or the candidate set is exhausted — exit cleanly on the denominator-stated summary, naming the current repo alongside the swept lanes.
 
 #### 3a. Leaf-only claim gate (repair containers)

package/plugins/src/base/skills/lisa-jira-build-intake/SKILL.md

@@ -189,9 +189,15 @@ swept (see `automation-runbook-contract`).
 A blocker is a **claim with a timestamp, not a fact** — it goes stale the moment its condition comes
 true, and nothing re-read one before this phase. For each pre-work candidate outside `$READY`:
 
-1. **Human gate first, and it is absolute.** A ticket carrying the configured human-needed label
-   (`jira.labels.human_needed`, default `Human Needed`) or a `[lisa-human-gate]` marker in its
-   description is **never** auto-selected, whatever any probe says.
+1. **Read release comments before applying the human gate.** Pass all item comments, labels,
+   body and configured `humanNeededLabel` to `classifyReadyCandidate(...)`. For a discharged hold,
+   call `planHumanGateRelease({ labels, body, comments, humanNeededLabel, readyLabel, lifecycleLabels, alreadyNotified })`
+   and retain its plan. Apply human-marker cleanup only as planned; defer any ready-role restoration
+   until steps 2–5 have cleared the remaining blockers (map the role to the vendor's state or label).
+   A still-active hold is never auto-selected, whatever any probe says. An absent or unreadable
+   comment history cannot discharge a hold. A release removes only the human hold: continue the
+   remaining blocker checks below before selecting the item.
+
 2. **Extract the stated discharge condition**, then **probe it**. Machine-testable conditions — a
    version on trunk, a published package, a CI run history, an advisory's patched status — rot
    fastest and are cheapest to check. A human decision is not machine-testable; leave it.
@@ -240,8 +246,9 @@ other gate's verdict — however conclusive — may promote an item a person par
    is the same repair the leaf-only gate already performs for a ready item that must not be
    dispatched.
 4. **On `claimable: true` for an item that still carries a hold, RELEASE it — do not just proceed.**
-   The hold left durable state behind: the item is out of the queue and flagged as needing a person,
-   and answering the question does not undo either. Call
+   This ready-lane candidate can retain a historical body marker and a human-needed label.
+   This step reconciles only candidates still in the ready lane; released holds outside it are
+   recovered by `lisa-repair-intake` step 2b (or Phase 2.5 when included in this cycle). Call
    `planHumanGateRelease({ labels, body, comments, humanNeededLabel, readyLabel, lifecycleLabels, alreadyNotified })`
    and apply exactly the actions it returns: remove the configured human-needed marker, add the
    configured ready role back, and post `formatHumanGateReleaseNote()` once. It is the exact inverse
@@ -274,10 +281,12 @@ A JIRA project can oversee multiple repos (`frontend` / `backend` / `infrastruct
 1. **Resolve the current repo** per `config-resolution` "Repo scoping" (`.repo` → `.github.repo` → `git remote get-url origin` basename). If unresolvable, stop and report — do not claim tickets you cannot scope.
 2. **Cheap path first.** Phase 1's query-time pre-filter has already dropped tickets explicitly stamped for a sibling repo, so the Phase 2 result set is current-repo-labeled + unlabeled tickets. Prefer candidates already carrying `repo:<current>` — a JIRA **label**, or a **component** equal to the repo name (accepted as an alias); the pre-filter is label-only, so a ticket scoped solely by a sibling-repo **component** can still appear and is skipped here. The result set still includes unlabeled tickets so they can be determined and stamped; this gate orders/filters what remains.
 3. **Per candidate, apply the repo-scope decision (`repo-scope-split`):**
-   - Carries `repo:<other>` (label or component) → **skip** (leave it `ready` for that repo's own intake); next candidate.
-   - **Unlabeled** → determine the target repo(s) from the ticket (description, AC, technical approach) confirmed against the code surfaces, then **stamp** `repo:<name>` via `lisa-atlassian-access` `operation: write-ticket` (add the label / set the component) so later cycles filter cheaply; re-apply with the now-known repo.
-   - **Multi-repo leaf → split, never claim.** Run the `repo-scope-split` work-time procedure to break it into single-repo siblings, each created **build-ready** (`build_ready: true`) and stamped with its own `repo:<name>`; the current repo's sibling becomes a normal candidate.
-   - **Single-repo leaf for the current repo** → fall through to 3a (leaf-only gate) and 3b (claim).
+   - **Count distinct repository markers first**: collect all `repo:<name>` labels and, on JIRA, recognized repository components; deduplicate by repository. A container may carry multiple `repo:<name>` labels. Do not split or claim it here; send it to the leaf-only gate.
+   - **Multi-repo leaf → split, never claim.** More than one repository takes the work-time split before any wrong-repository skip. Each sibling is **build-ready** (`build_ready: true`) and stamped with its own `repo:<name>`; the current repo's sibling becomes a normal candidate.
+   - **Exactly one other repository** (`repo:<other>`) → **skip**, leaving the item ready for that repo's intake.
+   - **No repository marker** → determine target repo(s) from the ticket and code, stamp `repo:<name>` through the vendor access layer, and re-apply from the count.
+   - **Single-repo leaf for the current repo** → fall through to 3a and 3b.
+
 4. Continue until a claimable current-repo leaf is found (claim it; one per cycle) or the candidate set is exhausted — exit cleanly on the denominator-stated summary, naming the current repo alongside the swept lanes.
 
 #### 3a. Leaf-only claim gate (skip / safe-block containers)