@codyswann/lisa 4.55.2 → 4.55.4

package/plugins/lisa-cursor/rules/pre-flight-autofill-reference.mdc

@@ -7,7 +7,7 @@ alwaysApply: false
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](00-rule-index.mdc).
 
 ## Pre-Flight Spec Autofill — Draft-Then-Block (load-bearing)
 

package/plugins/lisa-cursor/rules/promotion-contract-reference.mdc

@@ -7,7 +7,7 @@ alwaysApply: false
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](00-rule-index.mdc).
 
 ## Promotion Contract (load-bearing)
 

package/plugins/lisa-cursor/rules/readiness-rubric-reference.mdc

@@ -7,7 +7,7 @@ alwaysApply: false
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](00-rule-index.mdc).
 
 ## Repository Readiness Rubric (load-bearing)
 

package/plugins/lisa-cursor/rules/ready-role-filing-reference.mdc

@@ -7,7 +7,7 @@ alwaysApply: false
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](00-rule-index.mdc).
 
 ## Ready-Role Filing (load-bearing)
 
@@ -175,3 +175,39 @@ Two limits, stated rather than implied, because a control that documents its own
 - **`work-item-definition-of-ready`** — what "complete enough to build" means.
 - **`tracked-work`** — the filing entry point (`lisa-track`) this rule governs the readiness of.
 - **`factory-model`** — why the ready flip is a gate standing outside the factory rather than a field inside it.
+
+## Human-gate release authorization
+
+`[lisa-human-gate-release]` is a request to discharge a human hold, not proof that a human
+authorized it. A matching reason is necessary but insufficient. Every release reader passes
+`trustedHumanActorIds` to the shared `intake-blocker-reprobe.mjs` helpers together with the
+structured comment history. The allowlist contains stable human actor IDs for the active tracker
+provider and comes only from an explicit user instruction or existing human-authored trusted project
+policy. This is a helper input, not a new configuration schema. Never infer or extend the list from
+a comment, display name, issue body, assignee, automation identity, or self-asserted approval.
+
+Preserve authenticated tracker response metadata. Normalize each comment as
+`{ body, authorId, authorType }`, retaining its source comment ID, timestamp and any bot flags where
+available. `authorId` is the provider's stable ID (string or positive integer, normalized to a
+string), not a display name or a login. The helper also accepts provider-shaped `user.id`,
+`author.id`, or `author.accountId`; keep bot metadata instead of erasing it during normalization.
+
+| Tracker | Stable identity to preserve | Bot metadata to preserve |
+|---|---|---|
+| GitHub | REST comment `user.id`, or GraphQL author `id` through the User/Bot type fragment | REST `user.type`, or GraphQL author `__typename` |
+| JIRA | Comment `author.accountId` | `author.accountType` and any explicit bot flag |
+| Linear | Comment `user.id` | Non-null comment `botActor` identifies automation; preserve it or normalize to `isBot: true` |
+
+For example, `planHumanGateRelease({ labels, body, comments, trustedHumanActorIds,
+humanNeededLabel, readyLabel, lifecycleLabels, alreadyNotified })` evaluates reason matching
+**and** author trust. `classifyReadyCandidate`, `classifyPreWorkCandidate`,
+`planHumanGateReconciliation` and `planLabelNormalization` receive the same structured comments and
+allowlist, so no alternate path silently accepts weaker evidence.
+
+An absent/empty allowlist, missing or unreadable author identity, raw string comments, an actor
+outside the explicit allowlist, or a known bot cannot release a hold. A bot remains ineligible even
+if its ID appears in the list. A matching comment body, `authorized: true`, or an agent claiming to
+speak for a human confers no trust. Leave the item held and report the missing policy or identity;
+never ask automation to manufacture an approval comment to unblock itself. Unheld items remain
+unheld, and an authorized matching human release still permits the existing recovery path.
+Keep historical hold and release comments; do not rewrite the description to erase a hold.

package/plugins/lisa-cursor/rules/rejection-detection-reference.mdc

@@ -7,7 +7,7 @@ alwaysApply: false
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](00-rule-index.mdc).
 
 ## Rejection Detection at Claim Time (load-bearing)
 

package/plugins/lisa-cursor/rules/repo-scope-split-reference.mdc

@@ -7,7 +7,7 @@ alwaysApply: false
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](00-rule-index.mdc).
 
 ## Repo Scope & Work-Time Splitting (load-bearing)
 
@@ -47,9 +47,10 @@ A tracker can oversee multiple repos. Build-intake claims only current-repo tick
 
 Then, for each ready candidate:
 
-1. **Read `repo:<name>` label.** Wrong repo → skip. Current repo → leaf-only gate + claim. Unlabeled → determine + stamp + re-apply.
-2. **Multi-repo leaf → split, never claim.** Each split sibling is created build-ready and stamped with its own `repo:<name>`.
-3. **Wrong-repo single-repo leaf → skip** (label keeps it cheap next cycle).
+1. **Count distinct repository markers first** — all `repo:<name>` labels plus recognized JIRA repository components, deduplicated by repository. Containers go to the leaf-only gate; do not split them.
+2. **Multi-repo leaf → split, never claim.** More than one repository uses the work-time split; each sibling is build-ready and stamped with its own `repo:<name>`.
+3. **Exactly one repository:** current repo → leaf-only gate + claim; wrong repo → skip.
+4. **No repository marker:** determine from content and code, stamp the resolved markers, then re-apply this decision from the count.
 
 ---
 
@@ -91,12 +92,10 @@ A ticketing system can oversee multiple repos (one JIRA project / Linear team fo
 
 Resolve the current repo per the `config-resolution` "Repo scoping" section (config `repo` → `github.repo` → git remote basename; stop with a clear error if unresolvable). Then walk the ready candidates in priority order and apply the **repo-scope decision** to each before claiming:
 
-1. **Read the candidate's repo marker** — the `repo:<name>` label (JIRA: also a component equal to a repo name).
-   - **Labeled for another repo** → **skip** cheaply (do not claim, do not re-determine); it stays `ready` for that repo's own intake. Move to the next candidate.
-   - **Labeled for the current repo** → proceed to the leaf-only gate + claim (the cheap, common path once labels exist).
-   - **Unlabeled** → **determine** the target repo(s) from the ticket (description, acceptance criteria, technical approach) confirmed against the actual code surfaces the change requires — the same detection as step 1 of the work-time split. Then **stamp** the resolved `repo:<name>` label(s) so future cycles filter cheaply, and re-apply this decision with the now-known repo.
-2. **Multi-repo leaf → split, never claim.** If determination finds the leaf touches more than one repo, run the **work-time split procedure** below to break it into single-repo siblings — each created **build-ready** (`build_ready: true`, so the build queue auto-claims it) and stamped with its own `repo:<name>`. After the split, the current repo's sibling (if any) becomes a normal current-repo candidate; the others are separate single-repo `ready` leaves for their repos. A multi-repo leaf is never claimed as-is.
-3. **Wrong repo → skip.** A single-repo leaf whose `repo:<name>` ≠ the current repo is left `ready` (and labeled) and skipped; intake moves on until it finds a claimable current-repo leaf, then stops (one item per cycle).
+1. **Count distinct repository markers first** — all `repo:<name>` labels and JIRA components equal to recognized repository names, deduplicated by repository. Containers go to the leaf-only gate and are never split or claimed here.
+2. **Multi-repo leaf → split, never claim.** More than one distinct repository takes the work-time split procedure before any wrong-repository skip. Each sibling is created **build-ready** (`build_ready: true`) and stamped with its own `repo:<name>`. The current repo's sibling, if any, becomes a normal candidate.
+3. **Exactly one repository:** a single-repo leaf for the current repo proceeds to the leaf-only gate + claim; a leaf for another repo is skipped and left ready for its own intake.
+4. **No repository marker:** determine the target repo(s) from description, acceptance criteria, technical approach and actual code surfaces. Stamp the resolved `repo:<name>` labels and re-apply from step 1. Continue until one current-repo leaf is claimed or the candidates are exhausted.
 
 **Query-time pre-filter (the cheapest arm — apply before the per-candidate walk).** When the queue is queryable, scope the candidate **query itself** to the current repo so sibling-repo tickets never even enter the set — instead of pulling the whole project's ready tickets and skipping the wrong ones one-by-one (a full wasted scan when none belong to the current repo, e.g. a JIRA project shared across `frontend`/`backend`/`infrastructure`). On JIRA, append to the JQL:
 

package/plugins/lisa-cursor/rules/reset-seed-coverage-reference.mdc

@@ -7,7 +7,7 @@ alwaysApply: false
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](00-rule-index.mdc).
 
 ## Reset/Seed Coverage & State Classification (load-bearing)
 

package/plugins/lisa-cursor/rules/usage-accounting-reference.mdc

@@ -7,7 +7,7 @@ alwaysApply: false
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](00-rule-index.mdc).
 
 ## Usage Accounting (load-bearing)
 

package/plugins/lisa-cursor/rules/withdrawn-rulings.mdc

@@ -30,14 +30,25 @@ The result is one-directional propagation. **New guidance travels; corrections d
 - **Record every withdrawal in the ledger, with one command.** Retracting a claim you circulated,
   wrote down, or published is not done until this has run:
 
+  ```sh
+  node "$CLAUDE_PLUGIN_ROOT/hooks/withdrawn-rulings.mjs" --withdraw "<id>" \
+    --claim "<the withdrawn claim, verbatim>" \
+    --because "<what disproved it>" \
+    --derived "<an artifact you left standing on it>"
   ```
-  node "$CLAUDE_PLUGIN_ROOT/hooks/withdrawn-rulings.mjs" --withdraw <id> \
+
+  If the audit found no surviving derived artifact, use this alternative:
+
+  ```sh
+  node "$CLAUDE_PLUGIN_ROOT/hooks/withdrawn-rulings.mjs" --withdraw "<id>" \
     --claim "<the withdrawn claim, verbatim>" \
     --because "<what disproved it>" \
-    --derived "<an artifact you left standing on it>" ... | --derived none \
-    [--superseded-by <id>] [--reached <channel> ...]
+    --derived none
   ```
 
+  Repeat `--derived "<artifact>"` for additional artifacts. Either form may also
+  include `--superseded-by "<id>"` and repeated `--reached "<channel>"` arguments.
+
   The verbatim claim is required and the command refuses without it: **a tombstone the holder of the
   claim cannot recognise reaches them without reaching them.**
 

package/plugins/lisa-cursor/rules/work-item-definition-of-ready-reference.mdc

@@ -7,7 +7,7 @@ alwaysApply: false
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](00-rule-index.mdc).
 
 ## Work-Item Definition of Ready (type-keyed)
 

package/plugins/lisa-cursor/scripts/intake-blocker-reprobe.mjs

@@ -259,18 +259,77 @@ export function humanGateHolds(body) {
 }
 
 /**
- * The reason keys every recorded release discharges, deduplicated.
+ * Normalize stable provider IDs without case folding or trusting display names.
+ * @param {unknown} value - Provider actor ID
+ * @returns {string} Stable comparison key, or empty when invalid
+ */
+function stableActorId(value) {
+  if (typeof value === "string") return value.trim();
+  return Number.isSafeInteger(value) && value > 0 ? String(value) : "";
+}
+
+/**
+ * Recognize explicit provider bot metadata even for an allowlisted identity.
+ * @param {unknown} actor - Provider or normalized author metadata
+ * @returns {boolean} Whether the metadata identifies automation
+ */
+function isKnownBot(actor) {
+  if (!actor || typeof actor !== "object") return false;
+  const kinds = [
+    actor.type,
+    actor.__typename,
+    actor.accountType,
+    actor.authorType,
+  ];
+  return (
+    actor.botActor != null ||
+    actor.isBot === true ||
+    actor.bot === true ||
+    kinds.some(kind => /^(?:bot|app)$/i.test(String(kind ?? "").trim()))
+  );
+}
+
+/**
+ * Require authenticated provider identity and separately supplied human trust.
+ * Adapters may normalize the ID to authorId, but must preserve bot metadata.
+ * Names, body text and self-asserted authorization flags never confer trust.
+ * @param {unknown} comment - Structured provider comment
+ * @param {ReadonlySet<string>} trustedIds - Explicitly trusted human actor IDs
+ * @returns {boolean} Whether the comment may discharge a human hold
+ */
+function isTrustedHumanComment(comment, trustedIds) {
+  if (!comment || typeof comment !== "object" || Array.isArray(comment))
+    return false;
+  if ([comment, comment.user, comment.author].some(isKnownBot)) return false;
+  const id = stableActorId(
+    comment.authorId ??
+      comment.user?.id ??
+      comment.author?.id ??
+      comment.author?.accountId
+  );
+  return id.length > 0 && trustedIds.has(id);
+}
+
+/**
+ * The reason keys released by explicitly trusted human authors, deduplicated.
  *
- * Accepts comment bodies as strings or as `{ body }` objects, because the three
- * vendor readers return both shapes and a release that a vendor's payload shape
- * could hide would be a release path that exists on one tracker.
- * @param {unknown} comments - Comment bodies, any order
- * @returns {string[]} One key per recorded release
+ * Comments must retain authenticated provider authorship: normalized authorId,
+ * user.id, author.id or author.accountId. The caller supplies trusted human IDs
+ * independently of comment content. Raw strings, missing IDs, known bots and
+ * an absent or empty allowlist fail closed and cannot discharge a hold.
+ * @param {unknown} comments - Structured comments, any order
+ * @param {unknown} trustedHumanActorIds - Explicit trusted human provider IDs
+ * @returns {string[]} One key per authorized recorded release
  */
-export function humanGateReleases(comments) {
-  const bodies = (Array.isArray(comments) ? comments : []).map(entry =>
-    typeof entry === "string" ? entry : (entry?.body ?? "")
+export function humanGateReleases(comments, trustedHumanActorIds = []) {
+  const trustedIds = new Set(
+    (Array.isArray(trustedHumanActorIds) ? trustedHumanActorIds : [])
+      .map(stableActorId)
+      .filter(Boolean)
   );
+  const bodies = (Array.isArray(comments) ? comments : [])
+    .filter(entry => isTrustedHumanComment(entry, trustedIds))
+    .map(entry => entry.body ?? "");
   const keys = bodies.flatMap(body =>
     declarativeText(body)
       .split("\n")
@@ -288,11 +347,13 @@ export function humanGateReleases(comments) {
  * the unsafe direction — the one this fix must not introduce while correcting
  * the safe one. An item with no declared body hold is discharged only by a
  * keyless release, which is the form that pairs with a label-only hold.
- * @param {{ body?: unknown, comments?: unknown }} input - The item's surfaces
+ * @param {{ body?: unknown, comments?: unknown, trustedHumanActorIds?: unknown }} input - The item's surfaces
  * @returns {boolean} True when nothing is left outstanding
  */
 export function humanGateDischarged(input = {}) {
-  const released = new Set(humanGateReleases(input.comments));
+  const released = new Set(
+    humanGateReleases(input.comments, input.trustedHumanActorIds)
+  );
   const holds = humanGateHolds(input.body);
   if (holds.length === 0) return released.has("");
   return holds.every(reason => released.has(reason));
@@ -319,7 +380,7 @@ export function humanGateDischarged(input = {}) {
  * no releases, so a held item stays held. Holding a gate that may be stale
  * beats releasing one that is not, and every caller that never passes comments
  * keeps its current behaviour by construction.
- * @param {{ labels?: unknown, body?: unknown, comments?: unknown, humanNeededLabel?: unknown }} input - Candidate surfaces
+ * @param {{ labels?: unknown, body?: unknown, comments?: unknown, trustedHumanActorIds?: unknown, humanNeededLabel?: unknown }} input - Candidate surfaces
  * @returns {{ held: boolean, reason: string, declared: number, outstanding: string[], released: string[], labelPresent: boolean }} Held-ness verdict
  */
 export function humanGateVerdict(input = {}) {
@@ -330,7 +391,10 @@ export function humanGateVerdict(input = {}) {
     .toLowerCase();
   const labelPresent =
     configured.length > 0 && normalizeLabels(input.labels).includes(configured);
-  const released = humanGateReleases(input.comments);
+  const released = humanGateReleases(
+    input.comments,
+    input.trustedHumanActorIds
+  );
   const releasedSet = new Set(released);
   const holds = humanGateHolds(input.body);
   const outstanding = holds.filter(reason => !releasedSet.has(reason));
@@ -370,9 +434,9 @@ export function humanGateVerdict(input = {}) {
  * It is also the only place a hold ENDS, which is why the release lives behind
  * the same call rather than beside it: a reader that could see the hold but not
  * its discharge is how the gate became one-way in the first place. Pass the
- * item's comments and a recorded release is honoured; omit them and the item
- * stays held.
- * @param {{ labels?: unknown, body?: unknown, comments?: unknown, humanNeededLabel?: unknown }} input - Candidate surfaces
+ * item's structured comments and trustedHumanActorIds to honor an authorized
+ * release; omit either and the item stays held.
+ * @param {{ labels?: unknown, body?: unknown, comments?: unknown, trustedHumanActorIds?: unknown, humanNeededLabel?: unknown }} input - Candidate surfaces
  * @returns {boolean} True when a person is holding this item
  */
 export function isHumanGated(input) {
@@ -423,6 +487,7 @@ function judgeProbe(probe) {
  *   labels?: unknown
  *   body?: unknown
  *   comments?: unknown
+ *   trustedHumanActorIds?: unknown
  *   humanNeededLabel?: unknown
  *   statedBlocker?: unknown
  *   probe?: { discharged?: unknown, evidence?: unknown } | null
@@ -535,7 +600,7 @@ export const HUMAN_GATE_NOTE_MARKER = "<!-- [lisa-human-gate-reconciled] -->";
  * a parser keyed on the structured field would miss those while appearing to
  * work on every item that happens to have one — reproducing this defect one
  * layer down.
- * @param {{ labels?: unknown, body?: unknown, comments?: unknown, humanNeededLabel?: unknown }} input - Candidate surfaces
+ * @param {{ labels?: unknown, body?: unknown, comments?: unknown, trustedHumanActorIds?: unknown, humanNeededLabel?: unknown }} input - Candidate surfaces
  * @returns {{ claimable: boolean, reason: string, humanGated: boolean }} Claim verdict
  */
 export function classifyReadyCandidate(input = {}) {
@@ -564,6 +629,7 @@ export function classifyReadyCandidate(input = {}) {
  *   labels?: unknown
  *   body?: unknown
  *   comments?: unknown
+ *   trustedHumanActorIds?: unknown
  *   humanNeededLabel?: unknown
  *   readyLabel?: unknown
  *   alreadyNotified?: unknown
@@ -670,6 +736,7 @@ const RESUME_INSTRUCTION = [
  *   labels?: unknown
  *   body?: unknown
  *   comments?: unknown
+ *   trustedHumanActorIds?: unknown
  *   humanNeededLabel?: unknown
  *   readyLabel?: unknown
  *   lifecycleLabels?: unknown
@@ -831,6 +898,7 @@ export const NORMALIZATION_HOLD_NOTE_MARKER =
  *   labels?: unknown
  *   body?: unknown
  *   comments?: unknown
+ *   trustedHumanActorIds?: unknown
  *   humanNeededLabel?: unknown
  *   lifecycleLabels?: unknown
  *   readyLabel?: unknown

package/plugins/lisa-cursor/scripts/qa-signal-lifecycle.mjs

@@ -239,8 +239,8 @@ export const VOID_PREDICATES = Object.freeze({
   "certified-role-reached": ({ role, resolvedRoles }) =>
     normalize(role) !== "" &&
     resolvedRoles.some(name => normalize(name) === normalize(role)),
-  "human-gate-release-recorded": ({ body, comments }) =>
-    humanGateDischarged({ body, comments }),
+  "human-gate-release-recorded": ({ body, comments, trustedHumanActorIds }) =>
+    humanGateDischarged({ body, comments, trustedHumanActorIds }),
 });
 
 /**
@@ -331,6 +331,7 @@ const labelNames = labels =>
  * @param {string} [options.signal] a key of {@link SIGNALS}
  * @param {readonly unknown[]} [options.labels] the item's labels
  * @param {readonly unknown[]} [options.comments] comment bodies, oldest first
+ * @param {readonly unknown[]} [options.trustedHumanActorIds] explicitly trusted human author identities
  * @param {unknown} [options.body] the item's description, for body-marker rows
  * @param {string} [options.role] the item's current lifecycle role name
  * @param {string} options.vendor `jira` | `linear` | `github`
@@ -341,6 +342,7 @@ export const evaluateSignal = ({
   signal = QA_FAILURE_SIGNAL,
   labels,
   comments,
+  trustedHumanActorIds,
   body,
   role = "",
   vendor,
@@ -380,6 +382,7 @@ export const evaluateSignal = ({
     role,
     body,
     comments,
+    trustedHumanActorIds,
     resolvedRoles: voidingRoles({ vendor, config }),
   };
   const unchecked = declared.voidConditions.filter(

package/plugins/lisa-cursor/skills/lisa-github-build-intake/SKILL.md

@@ -6,6 +6,20 @@ allowed-tools: ["Skill", "Bash"]
 
 # GitHub Build Intake: $ARGUMENTS
 
+## Human-gate release authorization
+
+A release requires a trusted human author, not just matching comment text. Follow
+`ready-role-filing` — **Human-gate release authorization**: preserve tracker-supplied comment
+author IDs and bot metadata, resolve `trustedHumanActorIds` only from an explicit user instruction
+or existing human-authored trusted project policy, and pass it with structured `comments` to every
+hold classifier, reconciliation, normalization and release planner. Never derive trust from the
+comment body, a display name, the actor's own assertion, or an automation posting on its own behalf.
+Missing policy, missing/unreadable author identity, raw body strings, untrusted actors and known bots
+cannot discharge a hold. Keep the item held and report the missing authorization; do not silently
+replace these inputs with an empty history or an inferred allowlist. Authorized matching releases
+continue through the existing path and never override an independently declared caller hold.
+
+
 `$ARGUMENTS` is one of:
 
 1. A GitHub `org/repo` token (e.g., `acme/frontend-v2`).
@@ -215,14 +229,21 @@ nothing survives, exit on the denominator-stated summary from `summarizeDryLane`
 A blocker is a **claim with a timestamp, not a fact** — it goes stale the moment its condition comes
 true, and nothing re-read one before this phase. For each `$BLOCKED` candidate:
 
-1. **Human gate first, and it is absolute.** An issue carrying the configured human-needed label
-   (`github.labels.build.human_needed`, default `human-needed`) or a `[lisa-human-gate]` marker in
-   its body is **never** auto-selected, whatever any probe says.
+1. **Read release comments before applying the human gate.** Pass all item comments, labels,
+   body, `trustedHumanActorIds` and configured `humanNeededLabel` to `classifyReadyCandidate(...)`. For a discharged hold,
+   call `planHumanGateRelease({ labels, body, comments, trustedHumanActorIds, humanNeededLabel, readyLabel, lifecycleLabels, alreadyNotified })`
+   and retain its plan. Apply human-marker cleanup only as planned; defer any ready-role restoration
+   until steps 2–5 have cleared the remaining blockers (map the role to the vendor's state or label).
+   A still-active hold is never auto-selected, whatever any probe says. An absent or unreadable
+   comment history cannot discharge a hold. A release removes only the human hold: continue the
+   remaining blocker checks below before selecting the item.
+
 2. **Extract the stated discharge condition**, then **probe it**. Machine-testable conditions — a
    version on trunk, a published package, a CI run history, an advisory's patched status — rot
    fastest and are cheapest to check. A human decision is not machine-testable; leave it.
-3. **Classify with `classifyPreWorkCandidate(...)`** from `scripts/intake-blocker-reprobe.mjs`. A
-   discharge with no recorded evidence is not a discharge, and neither is a candidate nothing
+3. **Classify with `classifyPreWorkCandidate(...)`** from `scripts/intake-blocker-reprobe.mjs`.
+   Include the structured `comments` and `trustedHumanActorIds` from step 1.
+   A discharge with no recorded evidence is not a discharge, and neither is a candidate nothing
    probed this cycle — the helper refuses both.
 4. **Record the result on the issue either way** via `formatReprobeNote(...)` as a comment, so the
    next cycle reads the answer rather than re-deriving it. Keep it idempotent.
@@ -317,7 +338,7 @@ other gate's verdict — however conclusive — may promote an item a person par
    drift, and a drifted gate fails *silently*, by quietly ceasing to match. Do **not** re-implement
    the test here, and do **not** key it on `reason=`: markers in the wild carry no `reason=` key at
    all and sit anywhere in the body, so a structured parse would miss them while appearing to work
-   on every item that happens to have one. **Pass the item's `comments` alongside its labels and
+   on every item that happens to have one. **Pass the item's structured `comments` and `trustedHumanActorIds` alongside its labels and
    body.** A hold is ended by a release recorded in a comment, so a reader handed no comments cannot
    see the discharge — it goes on holding an item whose question was answered weeks ago, which is
    the defect this gate carried from the day it was written (CodySwannGT/lisa#3852). Omitting them
@@ -328,16 +349,17 @@ other gate's verdict — however conclusive — may promote an item a person par
    and re-rejected every cycle forever and seen by nothing — `lisa-repair-intake` sweeps items that
    are **not** in the ready role and excludes gated ones outright, so a ready-and-gated item falls
    outside its filter twice over. Call
-   `planHumanGateReconciliation({ labels, body, humanNeededLabel, readyLabel, alreadyNotified })`
+   `planHumanGateReconciliation({ labels, body, comments, trustedHumanActorIds, humanNeededLabel, readyLabel, alreadyNotified })`
    and apply exactly the actions it returns: remove `$READY`, add the configured human-needed
    marker, and post `formatHumanGateNote()` once. The planner is idempotent by state, so an item
    already out of the lane and already marked yields no second mutation and no second comment. This
    is the same repair the leaf-only gate already performs for a ready item that must not be
    dispatched.
 4. **On `claimable: true` for an item that still carries a hold, RELEASE it — do not just proceed.**
-   The hold left durable state behind: the item is out of the queue and flagged as needing a person,
-   and answering the question does not undo either. Call
-   `planHumanGateRelease({ labels, body, comments, humanNeededLabel, readyLabel, lifecycleLabels, alreadyNotified })`
+   This ready-lane candidate can retain a historical body marker and a human-needed label.
+   This step reconciles only candidates still in the ready lane; released holds outside it are
+   recovered by `lisa-repair-intake` step 2b (or Phase 2.5 when included in this cycle). Call
+   `planHumanGateRelease({ labels, body, comments, trustedHumanActorIds, humanNeededLabel, readyLabel, lifecycleLabels, alreadyNotified })`
    and apply exactly the actions it returns: remove the configured human-needed marker, add the
    configured ready role back, and post `formatHumanGateReleaseNote()` once. It is the exact inverse
    of step 3's planner and it refuses in both directions — an item still held plans nothing, and an
@@ -369,11 +391,12 @@ GitHub Issues live in one repo by definition, so the scanned repo's issues are u
 1. **Resolve the current repo** per `config-resolution` "Repo scoping" (`.repo` → `.github.repo` → `git remote get-url origin` basename). If unresolvable, stop and report.
 2. **Cheap path first.** Prefer candidates already carrying the `repo:<current>` label. Keep the Phase 2 scan broad so unlabeled issues are still seen, determined, and stamped.
 3. **Per candidate, apply the repo-scope decision (`repo-scope-split`):**
-   - Carries `repo:<other>` → **skip** (leave it `ready` for that repo's own intake); next candidate.
-   - **Unlabeled** → determine the target repo(s) from the issue + code surfaces, then **stamp** `repo:<name>` via `gh issue edit <n> --add-label "repo:<name>"` (create the label lazily) so later cycles filter cheaply; re-apply with the now-known repo. (An issue whose work is entirely in the scanned repo is simply labeled `repo:<current>`.)
-   - **Container visibility is allowed.** A multi-repo Epic / Story / Spike may legitimately carry multiple `repo:<name>` labels for operator visibility. Do not split or claim it here; leave the repo markers intact and fall through to the leaf-only gate, which repairs the stale build-ready label instead of dispatching the container.
-   - **Multi-repo leaf → split, never claim.** Run the `repo-scope-split` work-time procedure into single-repo siblings, each created **build-ready** (`build_ready: true`) and stamped with its own `repo:<name>`; the current repo's sibling becomes a normal candidate.
-   - **Single-repo leaf for the current repo** → fall through to 3a (leaf-only gate) and 3b (claim).
+   - **Count distinct repository markers first**: collect all `repo:<name>` labels and, on JIRA, recognized repository components; deduplicate by repository. A container may carry multiple `repo:<name>` labels. Do not split or claim it here; send it to the leaf-only gate.
+   - **Multi-repo leaf → split, never claim.** More than one repository takes the work-time split before any wrong-repository skip. Each sibling is **build-ready** (`build_ready: true`) and stamped with its own `repo:<name>`; the current repo's sibling becomes a normal candidate.
+   - **Exactly one other repository** (`repo:<other>`) → **skip**, leaving the item ready for that repo's intake.
+   - **No repository marker** → determine target repo(s) from the ticket and code, stamp `repo:<name>` through the vendor access layer, and re-apply from the count.
+   - **Single-repo leaf for the current repo** → fall through to 3a and 3b.
+
 4. Continue until a claimable current-repo leaf is found (claim it; one per cycle) or the candidate set is exhausted — exit cleanly on the denominator-stated summary, naming the current repo alongside the swept lanes.
 
 #### 3a. Leaf-only claim gate (repair containers)

package/plugins/lisa-cursor/skills/lisa-github-write-issue/SKILL.md

@@ -6,6 +6,20 @@ allowed-tools: ["Bash", "Skill", "Read"]
 
 # Write GitHub Issue: $ARGUMENTS
 
+## Human-gate release authorization
+
+A release requires a trusted human author, not just matching comment text. Follow
+`ready-role-filing` — **Human-gate release authorization**: preserve tracker-supplied comment
+author IDs and bot metadata, resolve `trustedHumanActorIds` only from an explicit user instruction
+or existing human-authored trusted project policy, and pass it with structured `comments` to every
+hold classifier, reconciliation, normalization and release planner. Never derive trust from the
+comment body, a display name, the actor's own assertion, or an automation posting on its own behalf.
+Missing policy, missing/unreadable author identity, raw body strings, untrusted actors and known bots
+cannot discharge a hold. Keep the item held and report the missing authorization; do not silently
+replace these inputs with an empty history or an inferred allowlist. Authorized matching releases
+continue through the existing path and never override an independently declared caller hold.
+
+
 Create or update a GitHub Issue with all required relationships, metadata, and quality gates. Every section below is mandatory. Thin issues are rejected.
 
 This skill is the GitHub counterpart of `lisa-jira-write-ticket`. The two skills share the same gates, description structure, acceptance-criteria format, and verification flow. The data-model translation is documented under "GitHub Issues data model" below — keep that table in sync with `lisa-github-validate-issue` so what one skill writes the other accepts.
@@ -323,7 +337,7 @@ If the label does not exist in the tracker, create it, or record that it could n
 proceed — the marker still holds. Never file the label *instead of* the marker.
 
 **Write a `reason=` the release can name.** The hold's reason is not decoration: a hold ends when a
-`[lisa-human-gate-release]` comment repeating that same `reason=` is recorded on the item, and the
+`[lisa-human-gate-release]` comment repeating that same `reason=` is recorded on the item by an authorized human, and the
 next intake sweep then takes the marker label off and puts the item back in the build-ready role on
 its own. Matching is per-reason so that a hold declared *after* an earlier release is not born
 discharged. A keyless hold is legal and is discharged by a keyless release; a hold whose reason is a