@codyswann/lisa 4.55.2 → 4.55.4

package/plugins/src/base/rules/reference/claim-archaeology.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Claim-Time Archaeology (load-bearing)
 

package/plugins/src/base/rules/reference/claim-evidence-mapping.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Claim → Evidence Mapping Contract (load-bearing)
 

package/plugins/src/base/rules/reference/claim-time-guards.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Claim-Time Guards (load-bearing)
 

package/plugins/src/base/rules/reference/control-reachability.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Control Reachability — A Prescribed Control Must Reach the Changed Path (load-bearing)
 

package/plugins/src/base/rules/reference/convergent-review.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Convergent Review
 

package/plugins/src/base/rules/reference/credential-substrate-precedence.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Credential-Substrate Precedence (load-bearing)
 

package/plugins/src/base/rules/reference/dependency-decision-records.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Dependency Decisions (load-bearing)
 

package/plugins/src/base/rules/reference/dependency-internalization-kit.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Dependency Internalization Kit (load-bearing)
 

package/plugins/src/base/rules/reference/dependency-trust-classes.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Dependency Trust Classes (load-bearing)
 

package/plugins/src/base/rules/reference/deployed-state-readback.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Deployed-State Readback (load-bearing)
 

package/plugins/src/base/rules/reference/derived-branch-plan.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Derived Branch Plan (load-bearing)
 

package/plugins/src/base/rules/reference/design-source-of-truth.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Design Source of Truth (load-bearing)
 

package/plugins/src/base/rules/reference/design-value-binding.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Design Value Binding (load-bearing)
 

package/plugins/src/base/rules/reference/documentation-source-paths.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Documentation Source Paths (load-bearing)
 

package/plugins/src/base/rules/reference/leaf-only-lifecycle.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Leaf-Only Build-Ready Invariant (load-bearing)
 

package/plugins/src/base/rules/reference/observability-audit.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Observability Audit (load-bearing)
 

package/plugins/src/base/rules/reference/prd-definition-of-ready.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## PRD Definition of Ready (requirement atoms)
 

package/plugins/src/base/rules/reference/prd-lifecycle-rollup.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## PRD Lifecycle Rollup & Generated-Top-Level-Work Contract (load-bearing)
 

package/plugins/src/base/rules/reference/pre-flight-autofill.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Pre-Flight Spec Autofill — Draft-Then-Block (load-bearing)
 

package/plugins/src/base/rules/reference/promotion-contract.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Promotion Contract (load-bearing)
 

package/plugins/src/base/rules/reference/readiness-rubric.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Repository Readiness Rubric (load-bearing)
 

package/plugins/src/base/rules/reference/ready-role-filing.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Ready-Role Filing (load-bearing)
 
@@ -170,3 +170,39 @@ Two limits, stated rather than implied, because a control that documents its own
 - **`work-item-definition-of-ready`** — what "complete enough to build" means.
 - **`tracked-work`** — the filing entry point (`lisa-track`) this rule governs the readiness of.
 - **`factory-model`** — why the ready flip is a gate standing outside the factory rather than a field inside it.
+
+## Human-gate release authorization
+
+`[lisa-human-gate-release]` is a request to discharge a human hold, not proof that a human
+authorized it. A matching reason is necessary but insufficient. Every release reader passes
+`trustedHumanActorIds` to the shared `intake-blocker-reprobe.mjs` helpers together with the
+structured comment history. The allowlist contains stable human actor IDs for the active tracker
+provider and comes only from an explicit user instruction or existing human-authored trusted project
+policy. This is a helper input, not a new configuration schema. Never infer or extend the list from
+a comment, display name, issue body, assignee, automation identity, or self-asserted approval.
+
+Preserve authenticated tracker response metadata. Normalize each comment as
+`{ body, authorId, authorType }`, retaining its source comment ID, timestamp and any bot flags where
+available. `authorId` is the provider's stable ID (string or positive integer, normalized to a
+string), not a display name or a login. The helper also accepts provider-shaped `user.id`,
+`author.id`, or `author.accountId`; keep bot metadata instead of erasing it during normalization.
+
+| Tracker | Stable identity to preserve | Bot metadata to preserve |
+|---|---|---|
+| GitHub | REST comment `user.id`, or GraphQL author `id` through the User/Bot type fragment | REST `user.type`, or GraphQL author `__typename` |
+| JIRA | Comment `author.accountId` | `author.accountType` and any explicit bot flag |
+| Linear | Comment `user.id` | Non-null comment `botActor` identifies automation; preserve it or normalize to `isBot: true` |
+
+For example, `planHumanGateRelease({ labels, body, comments, trustedHumanActorIds,
+humanNeededLabel, readyLabel, lifecycleLabels, alreadyNotified })` evaluates reason matching
+**and** author trust. `classifyReadyCandidate`, `classifyPreWorkCandidate`,
+`planHumanGateReconciliation` and `planLabelNormalization` receive the same structured comments and
+allowlist, so no alternate path silently accepts weaker evidence.
+
+An absent/empty allowlist, missing or unreadable author identity, raw string comments, an actor
+outside the explicit allowlist, or a known bot cannot release a hold. A bot remains ineligible even
+if its ID appears in the list. A matching comment body, `authorized: true`, or an agent claiming to
+speak for a human confers no trust. Leave the item held and report the missing policy or identity;
+never ask automation to manufacture an approval comment to unblock itself. Unheld items remain
+unheld, and an authorized matching human release still permits the existing recovery path.
+Keep historical hold and release comments; do not rewrite the description to erase a hold.

package/plugins/src/base/rules/reference/rejection-detection.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Rejection Detection at Claim Time (load-bearing)
 

package/plugins/src/base/rules/reference/repo-scope-split.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Repo Scope & Work-Time Splitting (load-bearing)
 
@@ -42,9 +42,10 @@ A tracker can oversee multiple repos. Build-intake claims only current-repo tick
 
 Then, for each ready candidate:
 
-1. **Read `repo:<name>` label.** Wrong repo → skip. Current repo → leaf-only gate + claim. Unlabeled → determine + stamp + re-apply.
-2. **Multi-repo leaf → split, never claim.** Each split sibling is created build-ready and stamped with its own `repo:<name>`.
-3. **Wrong-repo single-repo leaf → skip** (label keeps it cheap next cycle).
+1. **Count distinct repository markers first** — all `repo:<name>` labels plus recognized JIRA repository components, deduplicated by repository. Containers go to the leaf-only gate; do not split them.
+2. **Multi-repo leaf → split, never claim.** More than one repository uses the work-time split; each sibling is build-ready and stamped with its own `repo:<name>`.
+3. **Exactly one repository:** current repo → leaf-only gate + claim; wrong repo → skip.
+4. **No repository marker:** determine from content and code, stamp the resolved markers, then re-apply this decision from the count.
 
 ---
 
@@ -86,12 +87,10 @@ A ticketing system can oversee multiple repos (one JIRA project / Linear team fo
 
 Resolve the current repo per the `config-resolution` "Repo scoping" section (config `repo` → `github.repo` → git remote basename; stop with a clear error if unresolvable). Then walk the ready candidates in priority order and apply the **repo-scope decision** to each before claiming:
 
-1. **Read the candidate's repo marker** — the `repo:<name>` label (JIRA: also a component equal to a repo name).
-   - **Labeled for another repo** → **skip** cheaply (do not claim, do not re-determine); it stays `ready` for that repo's own intake. Move to the next candidate.
-   - **Labeled for the current repo** → proceed to the leaf-only gate + claim (the cheap, common path once labels exist).
-   - **Unlabeled** → **determine** the target repo(s) from the ticket (description, acceptance criteria, technical approach) confirmed against the actual code surfaces the change requires — the same detection as step 1 of the work-time split. Then **stamp** the resolved `repo:<name>` label(s) so future cycles filter cheaply, and re-apply this decision with the now-known repo.
-2. **Multi-repo leaf → split, never claim.** If determination finds the leaf touches more than one repo, run the **work-time split procedure** below to break it into single-repo siblings — each created **build-ready** (`build_ready: true`, so the build queue auto-claims it) and stamped with its own `repo:<name>`. After the split, the current repo's sibling (if any) becomes a normal current-repo candidate; the others are separate single-repo `ready` leaves for their repos. A multi-repo leaf is never claimed as-is.
-3. **Wrong repo → skip.** A single-repo leaf whose `repo:<name>` ≠ the current repo is left `ready` (and labeled) and skipped; intake moves on until it finds a claimable current-repo leaf, then stops (one item per cycle).
+1. **Count distinct repository markers first** — all `repo:<name>` labels and JIRA components equal to recognized repository names, deduplicated by repository. Containers go to the leaf-only gate and are never split or claimed here.
+2. **Multi-repo leaf → split, never claim.** More than one distinct repository takes the work-time split procedure before any wrong-repository skip. Each sibling is created **build-ready** (`build_ready: true`) and stamped with its own `repo:<name>`. The current repo's sibling, if any, becomes a normal candidate.
+3. **Exactly one repository:** a single-repo leaf for the current repo proceeds to the leaf-only gate + claim; a leaf for another repo is skipped and left ready for its own intake.
+4. **No repository marker:** determine the target repo(s) from description, acceptance criteria, technical approach and actual code surfaces. Stamp the resolved `repo:<name>` labels and re-apply from step 1. Continue until one current-repo leaf is claimed or the candidates are exhausted.
 
 **Query-time pre-filter (the cheapest arm — apply before the per-candidate walk).** When the queue is queryable, scope the candidate **query itself** to the current repo so sibling-repo tickets never even enter the set — instead of pulling the whole project's ready tickets and skipping the wrong ones one-by-one (a full wasted scan when none belong to the current repo, e.g. a JIRA project shared across `frontend`/`backend`/`infrastructure`). On JIRA, append to the JQL:
 

package/plugins/src/base/rules/reference/reset-seed-coverage.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Reset/Seed Coverage & State Classification (load-bearing)
 

package/plugins/src/base/rules/reference/usage-accounting.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Usage Accounting (load-bearing)
 

package/plugins/src/base/rules/reference/work-item-definition-of-ready.md

@@ -2,7 +2,7 @@
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
 > section below is the former eager head, preserved verbatim; the full
-> contract follows it. Reachable on demand via `rules/eager/00-rule-index.md`.
+> contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Work-Item Definition of Ready (type-keyed)
 

package/plugins/src/base/scripts/intake-blocker-reprobe.mjs

@@ -259,18 +259,77 @@ export function humanGateHolds(body) {
 }
 
 /**
- * The reason keys every recorded release discharges, deduplicated.
+ * Normalize stable provider IDs without case folding or trusting display names.
+ * @param {unknown} value - Provider actor ID
+ * @returns {string} Stable comparison key, or empty when invalid
+ */
+function stableActorId(value) {
+  if (typeof value === "string") return value.trim();
+  return Number.isSafeInteger(value) && value > 0 ? String(value) : "";
+}
+
+/**
+ * Recognize explicit provider bot metadata even for an allowlisted identity.
+ * @param {unknown} actor - Provider or normalized author metadata
+ * @returns {boolean} Whether the metadata identifies automation
+ */
+function isKnownBot(actor) {
+  if (!actor || typeof actor !== "object") return false;
+  const kinds = [
+    actor.type,
+    actor.__typename,
+    actor.accountType,
+    actor.authorType,
+  ];
+  return (
+    actor.botActor != null ||
+    actor.isBot === true ||
+    actor.bot === true ||
+    kinds.some(kind => /^(?:bot|app)$/i.test(String(kind ?? "").trim()))
+  );
+}
+
+/**
+ * Require authenticated provider identity and separately supplied human trust.
+ * Adapters may normalize the ID to authorId, but must preserve bot metadata.
+ * Names, body text and self-asserted authorization flags never confer trust.
+ * @param {unknown} comment - Structured provider comment
+ * @param {ReadonlySet<string>} trustedIds - Explicitly trusted human actor IDs
+ * @returns {boolean} Whether the comment may discharge a human hold
+ */
+function isTrustedHumanComment(comment, trustedIds) {
+  if (!comment || typeof comment !== "object" || Array.isArray(comment))
+    return false;
+  if ([comment, comment.user, comment.author].some(isKnownBot)) return false;
+  const id = stableActorId(
+    comment.authorId ??
+      comment.user?.id ??
+      comment.author?.id ??
+      comment.author?.accountId
+  );
+  return id.length > 0 && trustedIds.has(id);
+}
+
+/**
+ * The reason keys released by explicitly trusted human authors, deduplicated.
  *
- * Accepts comment bodies as strings or as `{ body }` objects, because the three
- * vendor readers return both shapes and a release that a vendor's payload shape
- * could hide would be a release path that exists on one tracker.
- * @param {unknown} comments - Comment bodies, any order
- * @returns {string[]} One key per recorded release
+ * Comments must retain authenticated provider authorship: normalized authorId,
+ * user.id, author.id or author.accountId. The caller supplies trusted human IDs
+ * independently of comment content. Raw strings, missing IDs, known bots and
+ * an absent or empty allowlist fail closed and cannot discharge a hold.
+ * @param {unknown} comments - Structured comments, any order
+ * @param {unknown} trustedHumanActorIds - Explicit trusted human provider IDs
+ * @returns {string[]} One key per authorized recorded release
  */
-export function humanGateReleases(comments) {
-  const bodies = (Array.isArray(comments) ? comments : []).map(entry =>
-    typeof entry === "string" ? entry : (entry?.body ?? "")
+export function humanGateReleases(comments, trustedHumanActorIds = []) {
+  const trustedIds = new Set(
+    (Array.isArray(trustedHumanActorIds) ? trustedHumanActorIds : [])
+      .map(stableActorId)
+      .filter(Boolean)
   );
+  const bodies = (Array.isArray(comments) ? comments : [])
+    .filter(entry => isTrustedHumanComment(entry, trustedIds))
+    .map(entry => entry.body ?? "");
   const keys = bodies.flatMap(body =>
     declarativeText(body)
       .split("\n")
@@ -288,11 +347,13 @@ export function humanGateReleases(comments) {
  * the unsafe direction — the one this fix must not introduce while correcting
  * the safe one. An item with no declared body hold is discharged only by a
  * keyless release, which is the form that pairs with a label-only hold.
- * @param {{ body?: unknown, comments?: unknown }} input - The item's surfaces
+ * @param {{ body?: unknown, comments?: unknown, trustedHumanActorIds?: unknown }} input - The item's surfaces
  * @returns {boolean} True when nothing is left outstanding
  */
 export function humanGateDischarged(input = {}) {
-  const released = new Set(humanGateReleases(input.comments));
+  const released = new Set(
+    humanGateReleases(input.comments, input.trustedHumanActorIds)
+  );
   const holds = humanGateHolds(input.body);
   if (holds.length === 0) return released.has("");
   return holds.every(reason => released.has(reason));
@@ -319,7 +380,7 @@ export function humanGateDischarged(input = {}) {
  * no releases, so a held item stays held. Holding a gate that may be stale
  * beats releasing one that is not, and every caller that never passes comments
  * keeps its current behaviour by construction.
- * @param {{ labels?: unknown, body?: unknown, comments?: unknown, humanNeededLabel?: unknown }} input - Candidate surfaces
+ * @param {{ labels?: unknown, body?: unknown, comments?: unknown, trustedHumanActorIds?: unknown, humanNeededLabel?: unknown }} input - Candidate surfaces
  * @returns {{ held: boolean, reason: string, declared: number, outstanding: string[], released: string[], labelPresent: boolean }} Held-ness verdict
  */
 export function humanGateVerdict(input = {}) {
@@ -330,7 +391,10 @@ export function humanGateVerdict(input = {}) {
     .toLowerCase();
   const labelPresent =
     configured.length > 0 && normalizeLabels(input.labels).includes(configured);
-  const released = humanGateReleases(input.comments);
+  const released = humanGateReleases(
+    input.comments,
+    input.trustedHumanActorIds
+  );
   const releasedSet = new Set(released);
   const holds = humanGateHolds(input.body);
   const outstanding = holds.filter(reason => !releasedSet.has(reason));
@@ -370,9 +434,9 @@ export function humanGateVerdict(input = {}) {
  * It is also the only place a hold ENDS, which is why the release lives behind
  * the same call rather than beside it: a reader that could see the hold but not
  * its discharge is how the gate became one-way in the first place. Pass the
- * item's comments and a recorded release is honoured; omit them and the item
- * stays held.
- * @param {{ labels?: unknown, body?: unknown, comments?: unknown, humanNeededLabel?: unknown }} input - Candidate surfaces
+ * item's structured comments and trustedHumanActorIds to honor an authorized
+ * release; omit either and the item stays held.
+ * @param {{ labels?: unknown, body?: unknown, comments?: unknown, trustedHumanActorIds?: unknown, humanNeededLabel?: unknown }} input - Candidate surfaces
  * @returns {boolean} True when a person is holding this item
  */
 export function isHumanGated(input) {
@@ -423,6 +487,7 @@ function judgeProbe(probe) {
  *   labels?: unknown
  *   body?: unknown
  *   comments?: unknown
+ *   trustedHumanActorIds?: unknown
  *   humanNeededLabel?: unknown
  *   statedBlocker?: unknown
  *   probe?: { discharged?: unknown, evidence?: unknown } | null
@@ -535,7 +600,7 @@ export const HUMAN_GATE_NOTE_MARKER = "<!-- [lisa-human-gate-reconciled] -->";
  * a parser keyed on the structured field would miss those while appearing to
  * work on every item that happens to have one — reproducing this defect one
  * layer down.
- * @param {{ labels?: unknown, body?: unknown, comments?: unknown, humanNeededLabel?: unknown }} input - Candidate surfaces
+ * @param {{ labels?: unknown, body?: unknown, comments?: unknown, trustedHumanActorIds?: unknown, humanNeededLabel?: unknown }} input - Candidate surfaces
  * @returns {{ claimable: boolean, reason: string, humanGated: boolean }} Claim verdict
  */
 export function classifyReadyCandidate(input = {}) {
@@ -564,6 +629,7 @@ export function classifyReadyCandidate(input = {}) {
  *   labels?: unknown
  *   body?: unknown
  *   comments?: unknown
+ *   trustedHumanActorIds?: unknown
  *   humanNeededLabel?: unknown
  *   readyLabel?: unknown
  *   alreadyNotified?: unknown
@@ -670,6 +736,7 @@ const RESUME_INSTRUCTION = [
  *   labels?: unknown
  *   body?: unknown
  *   comments?: unknown
+ *   trustedHumanActorIds?: unknown
  *   humanNeededLabel?: unknown
  *   readyLabel?: unknown
  *   lifecycleLabels?: unknown
@@ -831,6 +898,7 @@ export const NORMALIZATION_HOLD_NOTE_MARKER =
  *   labels?: unknown
  *   body?: unknown
  *   comments?: unknown
+ *   trustedHumanActorIds?: unknown
  *   humanNeededLabel?: unknown
  *   lifecycleLabels?: unknown
  *   readyLabel?: unknown

package/plugins/src/base/scripts/qa-signal-lifecycle.mjs

@@ -239,8 +239,8 @@ export const VOID_PREDICATES = Object.freeze({
   "certified-role-reached": ({ role, resolvedRoles }) =>
     normalize(role) !== "" &&
     resolvedRoles.some(name => normalize(name) === normalize(role)),
-  "human-gate-release-recorded": ({ body, comments }) =>
-    humanGateDischarged({ body, comments }),
+  "human-gate-release-recorded": ({ body, comments, trustedHumanActorIds }) =>
+    humanGateDischarged({ body, comments, trustedHumanActorIds }),
 });
 
 /**
@@ -331,6 +331,7 @@ const labelNames = labels =>
  * @param {string} [options.signal] a key of {@link SIGNALS}
  * @param {readonly unknown[]} [options.labels] the item's labels
  * @param {readonly unknown[]} [options.comments] comment bodies, oldest first
+ * @param {readonly unknown[]} [options.trustedHumanActorIds] explicitly trusted human author identities
  * @param {unknown} [options.body] the item's description, for body-marker rows
  * @param {string} [options.role] the item's current lifecycle role name
  * @param {string} options.vendor `jira` | `linear` | `github`
@@ -341,6 +342,7 @@ export const evaluateSignal = ({
   signal = QA_FAILURE_SIGNAL,
   labels,
   comments,
+  trustedHumanActorIds,
   body,
   role = "",
   vendor,
@@ -380,6 +382,7 @@ export const evaluateSignal = ({
     role,
     body,
     comments,
+    trustedHumanActorIds,
     resolvedRoles: voidingRoles({ vendor, config }),
   };
   const unchecked = declared.voidConditions.filter(