@codyswann/lisa 4.55.25 → 4.55.27

package/dist/core/nightly-e2e-guard-behavior-certificate.js

@@ -41,9 +41,9 @@ export const NIGHTLY_E2E_GUARD_BEHAVIOR_CERTIFICATES = Object.freeze({
     }),
     cd02b94b4db5134984c7b69f905af71c96bb5aac09a18fb3c6aef5ab0c22cf17: Object.freeze({
         contractVersion: "1.9.0",
-        packageVersions: Object.freeze(["4.55.25"]),
+        packageVersions: Object.freeze(["4.55.27"]),
         provenances: Object.freeze([
-            "workspace package @codyswann/lisa@4.55.25 (typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs)",
+            "workspace package @codyswann/lisa@4.55.27 (typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs)",
         ]),
     }),
     dfd2fef680de5ef03e63075e8a61c62ca4d95cdfdff6201939b79c748d3397f6: Object.freeze({

package/dist/core/upstream-evidence-manifest.js

@@ -422,7 +422,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/rules/eager/empirical-inquiry.md": "67aa64ba3ecc4f3cd761111d2562662e0a2acf7892703b14ec83f7f7b073e670",
     "plugins/src/base/rules/eager/falsifiable-checks.md": "8bf1a2b02cd1c44674ba3a131fa42f115ba693d66402264a3a365fdfaf656d1f",
     "plugins/src/base/rules/eager/history-audit.md": "e2365e3fb28230c643e943d26688a93906afa68e3e1355d3e86d4b22ab3db559",
-    "plugins/src/base/rules/eager/integration-access-layer.md": "e5675ec414d0dcfbbf7a29912f39ea5fb02747aa4e6045493e636cba1e635eb7",
+    "plugins/src/base/rules/eager/integration-access-layer.md": "4f98938b575c301a0f9626f4a074e802bd20363ba6e5874eb5d7dc0e6a7470d3",
     "plugins/src/base/rules/eager/intent-routing.md": "a2ef2397a98fb3d991fcfb39b669e289c1e2b697191cbeb6c071d71eca836207",
     "plugins/src/base/rules/eager/learnings-ladder.md": "58f70031f7ad720254e73db53f4f328f35cdce2a562c8f62e403be842abccab0",
     "plugins/src/base/rules/eager/local-ci-first.md": "8a0369f3b23c4c9906194ea2d5b6dab44bb82dee753571b7e3e27ed799a289f5",
@@ -567,7 +567,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-git-prune/SKILL.md": "11fad06d109538f1a8ee4ef8043bb0e083672e3c9a7cb7ae8a7233c5411d6dd2",
     "plugins/src/base/skills/lisa-git-submit-pr/SKILL.md": "395c08ad3e620e27a1c636d784f8051853136cdb409b2a52661f79711ad5edc7",
     "plugins/src/base/skills/lisa-github-add-journey/SKILL.md": "4ceda3474a9b32abae835c2676e8cb2b7e888c6ba04b95843dbe7254293bbf32",
-    "plugins/src/base/skills/lisa-github-build-intake/SKILL.md": "64bdbf75ef115752b91a357b6ce04e3a6118bb4899610bc9d9e8d8013638945e",
+    "plugins/src/base/skills/lisa-github-build-intake/SKILL.md": "aa84417983f20fc9193518df2698b4781fc561cc2ed1d78831cb659379e624bc",
     "plugins/src/base/skills/lisa-github-claim/SKILL.md": "71301c6d45d7eb5523e74aa7f070bb2becf57ca68fb8bde9e02ee937b78815f7",
     "plugins/src/base/skills/lisa-github-create/SKILL.md": "2128a5069c2663a6a33cef7d0465e672682429b176183e101d3ea65f276a1b93",
     "plugins/src/base/skills/lisa-github-evidence/SKILL.md": "73142ef660766f4b4e4947ad25d00614b8fb9ad4dfa7e4f45b19379ae981d84d",
@@ -594,7 +594,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-intake/SKILL.md": "6ad62fd1a8148729b6ff0cdffdf853529f72ee73ba08f7bb1b27237c19f47d4d",
     "plugins/src/base/skills/lisa-jam-access/SKILL.md": "8c9007e4ef4b79ba6de30be0baf75972d1a68451204d7a29f5cc504d7095279e",
     "plugins/src/base/skills/lisa-jira-add-journey/SKILL.md": "a00606cc7927f034e847f34d7e44e72fa7f3a14ddf6a469deb7eae1e06531fd7",
-    "plugins/src/base/skills/lisa-jira-build-intake/SKILL.md": "c59ee7fb3eb285b698241ad3c705bb41bcd68ee11393a3588fc8708ab4378ce2",
+    "plugins/src/base/skills/lisa-jira-build-intake/SKILL.md": "ef4e1f071a8ee63f8cb2a4d875153391753cd537740be4116a4f8ff145377357",
     "plugins/src/base/skills/lisa-jira-claim/SKILL.md": "9c4935441a4e6b55df0949178f96e927184c4909bffff8929b39a304bc5ac00a",
     "plugins/src/base/skills/lisa-jira-create/SKILL.md": "77078002d2a16e0b2a65725f4e86b13caa1c43ba193eb37beb5b7da20feed3f1",
     "plugins/src/base/skills/lisa-jira-evidence/SKILL.md": "091149fefcfc51e3cec789082a0a8e21167239da1cf2b684e86224db733d974d",
@@ -613,7 +613,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-learnings-audit/SKILL.md": "ca79cd7fed7e9ca0965c2fcfa8266f2ebfb4ff9cc5fc53dc59343849e5373540",
     "plugins/src/base/skills/lisa-linear-access/SKILL.md": "cdd4fa5e60c70d0e054d9d85239d20536f24800946ae0bb64e296db8da0bb1eb",
     "plugins/src/base/skills/lisa-linear-add-journey/SKILL.md": "e63ae35df1a928dac7b42535ce11e77e8c617e60838ba319f22081400e87886e",
-    "plugins/src/base/skills/lisa-linear-build-intake/SKILL.md": "950616d4fdd364be4be4ced054dc5d1c049105c9c205866417399bcac5bcd504",
+    "plugins/src/base/skills/lisa-linear-build-intake/SKILL.md": "f65cbb4a54e5b2d7e2767c002c8e02d282d8835479dac3cf6d5e1df3d1646cb6",
     "plugins/src/base/skills/lisa-linear-claim/SKILL.md": "efde30b5eac8b2cc56499ce391bd3d43ebb017c4ce948b5d547b52acb66715bb",
     "plugins/src/base/skills/lisa-linear-create/SKILL.md": "b9b0b89903fc980e7b591109cffcf377f7397cc6c7b6110975d0b21bafb6de2e",
     "plugins/src/base/skills/lisa-linear-evidence/SKILL.md": "e25f8ab93f5204ac55c99c6cba5fe53cc4ad792c0140553eef7d3478ffb69694",
@@ -668,7 +668,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-review-local/SKILL.md": "74112f88c721825464d962b05111dafe84173fb370d9522d5e155acc46cc55e9",
     "plugins/src/base/skills/lisa-rework-triage/SKILL.md": "a70ccc7c79a6cc3a695d173b7b8bfbe8334af2cdace368fe1520d0b86254fb6f",
     "plugins/src/base/skills/lisa-root-cause-analysis/SKILL.md": "3fa14217ca36b238ebb8203d18f10eaaf98a3647f949cdada6cb9f56ddf9ed50",
-    "plugins/src/base/skills/lisa-secrets-access/SKILL.md": "6ba87a36a76f70030c34bdd4bc7bffc27762ee44df5385e6048e01e1c3fa9f3e",
+    "plugins/src/base/skills/lisa-secrets-access/SKILL.md": "503617363fde042af3f02ee8e48a50ebf8e06f2cf6ca0b71cbe94774b4a2ab42",
     "plugins/src/base/skills/lisa-secrets-access/scripts/aws-bootstrap.mjs": "7f6acaa7ac13f31ebbd12e41000b5796536f1fe708684e59f79ab23b85ee08f0",
     "plugins/src/base/skills/lisa-secrets-access/scripts/bootstrap-store.mjs": "35169ea70810f7b7291d75c93ec326e0ac04407bf335949b0742e74e69850ec4",
     "plugins/src/base/skills/lisa-secrets-access/scripts/doctor-secrets.mjs": "71fd7a3f26d7e4424bb8ef80caaaa3db136595a5b9e620a32084a00521277ba3",

package/package.json

@@ -187,7 +187,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.55.25",
+  "version": "4.55.27",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -336,7 +336,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "ce3b74e2696a399f640bec2dd525483e5cabcc61",
-  "gitHead": "ce3b74e2696a399f640bec2dd525483e5cabcc61",
-  "lisaReleaseTag": "v4.55.25"
+  "lisaReleaseCommit": "04360e12c126b0116214af7fe44c77ea2d42ebea",
+  "gitHead": "04360e12c126b0116214af7fe44c77ea2d42ebea",
+  "lisaReleaseTag": "v4.55.27"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.25",
+  "version": "4.55.27",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.25",
+  "version": "4.55.27",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-github-build-intake/SKILL.md

@@ -174,15 +174,25 @@ A "transition" means: remove the old role label and add the new one, in two `gh
 ### Phase 2 — Find ready issues
 
 ```bash
-if [ -n "$ASSIGNEE" ]; then
-  gh issue list --repo <org>/<repo> --label "$READY" --assignee "$ASSIGNEE" --state open \
-    --json number,title,labels,assignees,milestone,createdAt --limit 100
-else
-  gh issue list --repo <org>/<repo> --label "$READY" --state open \
-    --json number,title,labels,assignees,milestone,createdAt --limit 100
+# QUEUE_REPO is the resolved <org>/<repo> from Phase 1.
+if [ "${ASSIGNEE:-}" = "@me" ]; then
+  ASSIGNEE=$(gh api user --jq .login) || exit 1
 fi
+ISSUE_PAGES=$(gh api --method GET "repos/$QUEUE_REPO/issues" \
+  -f state=open -f per_page=100 --paginate --slurp) || exit 1
+# The repository issues endpoint also returns pull requests; exclude them.
+ISSUES_JSON=$(printf '%s' "$ISSUE_PAGES" | jq '[.[][] | select(has("pull_request") | not)]') || exit 1
+printf '%s' "$ISSUES_JSON" | jq --arg ready "$READY" --arg assignee "${ASSIGNEE:-}" '
+  [.[] | select(any(.labels[]; .name == $ready))
+       | select($assignee == "" or any(.assignees[]; .login == $assignee))]'
 ```
 
+Wait for every page before choosing work or reporting an empty queue. A failed
+page is an incomplete read: report it and end this cycle without dispatching.
+The REST fields use `created_at` and label/assignee objects. Reuse this complete
+issue snapshot for the lane counts below; apply the assignee filter to candidates
+only, so the repository totals still describe the whole queue.
+
 If empty, run a secondary check to distinguish a genuinely empty queue from an unconfigured repo:
 
 ```bash
@@ -206,8 +216,8 @@ GitHub's data model, not a preference (see "Why labels" above). That makes the o
 - open issues carrying **no** build role label — which this scanner must see anyway in order to
   determine and stamp their repo.
 
-Count each lane and the repo's **total open** count (`gh issue list --state open --limit 1000 --json
-number | jq length`), then build the denominator with the shared helper — GitHub callers pass the
+Count each lane and the repo's **total open** count from `ISSUES_JSON`, then build
+the denominator with the shared helper — GitHub callers pass the
 lane type explicitly, since there is none to read:
 
 ```text

package/plugins/lisa/.codex-plugin/skills/lisa-jira-build-intake/SKILL.md

@@ -177,7 +177,16 @@ the Linear side produced 31 consecutive false "dry lane" cycles (#2657).
 2. Then sweep the rest of pre-work with the same base JQL, swapping the status clause for
    `statusCategory = "To Do"`, and read the **total open** count (`statusCategory != Done`). The
    open total is what makes an omitted lane arithmetically visible.
-3. Page to exhaustion — a single unpaged `search-issues` call is not a count.
+3. Page each query to exhaustion using the configured access tool's pagination
+   fields. For token-based search, pass the returned `nextPageToken` until the
+   response marks the last page. For offset-based search, advance `startAt` by
+   the number of returned issues until the reported total is reached. Keep the
+   same JQL and ordering throughout, and deduplicate issue keys across pages.
+   A failed page, repeated cursor, or missing continuation while more results
+   are reported makes the read incomplete. Report that condition and end the
+   cycle without dispatching; never report a partial read as an empty queue.
+   If the access tool hides pagination, use its documented complete-list mode
+   or another configured read path that exposes continuation metadata.
 
 Capture each ticket's: key, summary, issue type, priority, assignee, parent (epic), status (with
 its category), labels, components.

package/plugins/lisa/.codex-plugin/skills/lisa-linear-build-intake/SKILL.md

@@ -164,8 +164,15 @@ This skill ONLY transitions `$READY → $CLAIMED` on claim, and `$CLAIMED → $D
 
 1. List the team's workflow states via `lisa-linear-access operation: list-workflow-states`.
 2. Keep every state whose `type` is `backlog` or `unstarted` — that is the pre-work set. `$READY` is one member of it, not the whole of it.
-3. Query each pre-work state: `lisa-linear-access operation: list-issues({team: <teamId>, state: "<state>"})`, paging to `hasNextPage=false`. Linear's GraphQL complexity ceiling silently truncates at `first: 250`, so a single unpaged call is not a count.
-4. Also read the **total open** count for the team (every state whose `type` is not `completed` / `canceled`). This number is what makes an omitted lane arithmetically visible.
+3. Query each pre-work state: `lisa-linear-access operation: list-issues({team: <teamId>, state: "<state>"})`, following `endCursor` until `hasNextPage=false`. Deduplicate issue IDs. A failed page or non-advancing cursor makes the read incomplete; report it and end the cycle without dispatching. Do not infer completeness from a single page's size.
+4. Also read the **total open** count for the team using the same terminal set as the child check below: exclude `completed`, `canceled`, and `duplicate`. Intermediate deployment states remain open.
+
+Report the query scope, pages read and distinct issue count. If a previous read
+or a known issue contradicts the result, re-read that evidence before declaring
+the queue empty. Identifier ranges and gaps are diagnostics, not proof of
+completeness: filters, deleted issues and unseen omissions can all affect them.
+The historical 249-row report did not establish a root-connection defect, so it
+does not justify changing connections or adding a separate range-validation gate.
 
 Capture each Issue's: identifier, title, type label, priority, assignee, project, state (with its `type`), labels, description summary.
 

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/SKILL.md

@@ -49,6 +49,26 @@ environment  →  materialized file (surfaces that have one)  →  provider
 
 **The middle rung exists only where it must.** A remote agent container prepares itself during setup — before any task exists, and often before network policy would permit a provider call from the task itself — so files written at that moment are the only channel available.
 
+### Recovering AWS access during a task
+
+When an AWS operation reports missing or expired credentials, first resolve
+`LISA_AWS_BOOTSTRAP_JSON` through the ladder above. If available, run the existing
+`scripts/remote-agent-aws-setup.sh` from the trusted installed Lisa plugin/package
+in the project checkout, supplying the bundle only to that subprocess's
+environment. Select the intended namespace, stage and expected account from the
+project configuration. Require its successful account verification; do not
+disable verification or take over another project's default profile to force
+success. Use `lisa-setup-remote-aws` only if installation is missing. Keep the
+bundle private; do not print it or copy it into a second secret provider. Do not
+use `aws sso login` to recover this Lisa-managed bootstrap path.
+
+Before retrying the operation, verify that the selected profile's caller account
+matches the project's expected account; successful authentication alone is not
+enough. If the bundle cannot be resolved or the account mismatches, report that
+specific failure. An SSO-shaped local profile is not evidence that a human login
+is required. Projects explicitly configured for a different access method keep
+that method; do not invent a bootstrap bundle for them.
+
 ## Writing values to disk
 
 The default rule is absolute: **never write a resolved value to disk**, including "temporary" files. A value on disk is a copy that can drift and leak.

package/plugins/lisa/rules/eager/integration-access-layer.md

@@ -4,16 +4,16 @@ Skills and rules that use external integrations route through the matching
 `*-access` skill. Do not call vendor MCP tools or REST APIs directly from a
 consumer skill.
 
-Secrets are the same shape: every credential resolves through
-`lisa-secrets-access`, which owns the provider list, the note format, and the
-resolution order. Read it rather than restating it — and never ask a human to
-paste a value the provider can supply.
+Resolve credentials through `lisa-secrets-access`; do not duplicate its
+provider configuration or ask a human to paste a value it can supply.
 
-Resolution order is the configured-provider token/CLI substrate first when its
-bootstrap credential is present and identity-matched, then the interactive MCP as
-fallback, then a loud error naming the exact credential to set. Identity-match is
-mandatory on every substrate — one authenticated as a different tenant is skipped,
-never used. The ordering itself is settled in
+For missing AWS credentials, use its `LISA_AWS_BOOTSTRAP_JSON` recovery guidance
+before proposing an interactive login.
+
+Use the configured-provider token/CLI first when its bootstrap credential is
+present, then interactive MCP, then an error naming the missing credential.
+Every method must match the intended tenant; skip mismatched identities.
+Resolution order:
 [reference/credential-substrate-precedence.md](../reference/credential-substrate-precedence.md);
 full matrix and migration rules:
 [reference/integration-access-layer.md](../reference/integration-access-layer.md).

package/plugins/lisa/skills/lisa-github-build-intake/SKILL.md

@@ -174,15 +174,25 @@ A "transition" means: remove the old role label and add the new one, in two `gh
 ### Phase 2 — Find ready issues
 
 ```bash
-if [ -n "$ASSIGNEE" ]; then
-  gh issue list --repo <org>/<repo> --label "$READY" --assignee "$ASSIGNEE" --state open \
-    --json number,title,labels,assignees,milestone,createdAt --limit 100
-else
-  gh issue list --repo <org>/<repo> --label "$READY" --state open \
-    --json number,title,labels,assignees,milestone,createdAt --limit 100
+# QUEUE_REPO is the resolved <org>/<repo> from Phase 1.
+if [ "${ASSIGNEE:-}" = "@me" ]; then
+  ASSIGNEE=$(gh api user --jq .login) || exit 1
 fi
+ISSUE_PAGES=$(gh api --method GET "repos/$QUEUE_REPO/issues" \
+  -f state=open -f per_page=100 --paginate --slurp) || exit 1
+# The repository issues endpoint also returns pull requests; exclude them.
+ISSUES_JSON=$(printf '%s' "$ISSUE_PAGES" | jq '[.[][] | select(has("pull_request") | not)]') || exit 1
+printf '%s' "$ISSUES_JSON" | jq --arg ready "$READY" --arg assignee "${ASSIGNEE:-}" '
+  [.[] | select(any(.labels[]; .name == $ready))
+       | select($assignee == "" or any(.assignees[]; .login == $assignee))]'
 ```
 
+Wait for every page before choosing work or reporting an empty queue. A failed
+page is an incomplete read: report it and end this cycle without dispatching.
+The REST fields use `created_at` and label/assignee objects. Reuse this complete
+issue snapshot for the lane counts below; apply the assignee filter to candidates
+only, so the repository totals still describe the whole queue.
+
 If empty, run a secondary check to distinguish a genuinely empty queue from an unconfigured repo:
 
 ```bash
@@ -206,8 +216,8 @@ GitHub's data model, not a preference (see "Why labels" above). That makes the o
 - open issues carrying **no** build role label — which this scanner must see anyway in order to
   determine and stamp their repo.
 
-Count each lane and the repo's **total open** count (`gh issue list --state open --limit 1000 --json
-number | jq length`), then build the denominator with the shared helper — GitHub callers pass the
+Count each lane and the repo's **total open** count from `ISSUES_JSON`, then build
+the denominator with the shared helper — GitHub callers pass the
 lane type explicitly, since there is none to read:
 
 ```text

package/plugins/lisa/skills/lisa-jira-build-intake/SKILL.md

@@ -177,7 +177,16 @@ the Linear side produced 31 consecutive false "dry lane" cycles (#2657).
 2. Then sweep the rest of pre-work with the same base JQL, swapping the status clause for
    `statusCategory = "To Do"`, and read the **total open** count (`statusCategory != Done`). The
    open total is what makes an omitted lane arithmetically visible.
-3. Page to exhaustion — a single unpaged `search-issues` call is not a count.
+3. Page each query to exhaustion using the configured access tool's pagination
+   fields. For token-based search, pass the returned `nextPageToken` until the
+   response marks the last page. For offset-based search, advance `startAt` by
+   the number of returned issues until the reported total is reached. Keep the
+   same JQL and ordering throughout, and deduplicate issue keys across pages.
+   A failed page, repeated cursor, or missing continuation while more results
+   are reported makes the read incomplete. Report that condition and end the
+   cycle without dispatching; never report a partial read as an empty queue.
+   If the access tool hides pagination, use its documented complete-list mode
+   or another configured read path that exposes continuation metadata.
 
 Capture each ticket's: key, summary, issue type, priority, assignee, parent (epic), status (with
 its category), labels, components.

package/plugins/lisa/skills/lisa-linear-build-intake/SKILL.md

@@ -164,8 +164,15 @@ This skill ONLY transitions `$READY → $CLAIMED` on claim, and `$CLAIMED → $D
 
 1. List the team's workflow states via `lisa-linear-access operation: list-workflow-states`.
 2. Keep every state whose `type` is `backlog` or `unstarted` — that is the pre-work set. `$READY` is one member of it, not the whole of it.
-3. Query each pre-work state: `lisa-linear-access operation: list-issues({team: <teamId>, state: "<state>"})`, paging to `hasNextPage=false`. Linear's GraphQL complexity ceiling silently truncates at `first: 250`, so a single unpaged call is not a count.
-4. Also read the **total open** count for the team (every state whose `type` is not `completed` / `canceled`). This number is what makes an omitted lane arithmetically visible.
+3. Query each pre-work state: `lisa-linear-access operation: list-issues({team: <teamId>, state: "<state>"})`, following `endCursor` until `hasNextPage=false`. Deduplicate issue IDs. A failed page or non-advancing cursor makes the read incomplete; report it and end the cycle without dispatching. Do not infer completeness from a single page's size.
+4. Also read the **total open** count for the team using the same terminal set as the child check below: exclude `completed`, `canceled`, and `duplicate`. Intermediate deployment states remain open.
+
+Report the query scope, pages read and distinct issue count. If a previous read
+or a known issue contradicts the result, re-read that evidence before declaring
+the queue empty. Identifier ranges and gaps are diagnostics, not proof of
+completeness: filters, deleted issues and unseen omissions can all affect them.
+The historical 249-row report did not establish a root-connection defect, so it
+does not justify changing connections or adding a separate range-validation gate.
 
 Capture each Issue's: identifier, title, type label, priority, assignee, project, state (with its `type`), labels, description summary.
 

package/plugins/lisa/skills/lisa-secrets-access/SKILL.md

@@ -49,6 +49,26 @@ environment  →  materialized file (surfaces that have one)  →  provider
 
 **The middle rung exists only where it must.** A remote agent container prepares itself during setup — before any task exists, and often before network policy would permit a provider call from the task itself — so files written at that moment are the only channel available.
 
+### Recovering AWS access during a task
+
+When an AWS operation reports missing or expired credentials, first resolve
+`LISA_AWS_BOOTSTRAP_JSON` through the ladder above. If available, run the existing
+`scripts/remote-agent-aws-setup.sh` from the trusted installed Lisa plugin/package
+in the project checkout, supplying the bundle only to that subprocess's
+environment. Select the intended namespace, stage and expected account from the
+project configuration. Require its successful account verification; do not
+disable verification or take over another project's default profile to force
+success. Use `lisa-setup-remote-aws` only if installation is missing. Keep the
+bundle private; do not print it or copy it into a second secret provider. Do not
+use `aws sso login` to recover this Lisa-managed bootstrap path.
+
+Before retrying the operation, verify that the selected profile's caller account
+matches the project's expected account; successful authentication alone is not
+enough. If the bundle cannot be resolved or the account mismatches, report that
+specific failure. An SSO-shaped local profile is not evidence that a human login
+is required. Projects explicitly configured for a different access method keep
+that method; do not invent a bootstrap bundle for them.
+
 ## Writing values to disk
 
 The default rule is absolute: **never write a resolved value to disk**, including "temporary" files. A value on disk is a copy that can drift and leak.

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.25",
+  "version": "4.55.27",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-github-build-intake/SKILL.md

@@ -174,15 +174,25 @@ A "transition" means: remove the old role label and add the new one, in two `gh
 ### Phase 2 — Find ready issues
 
 ```bash
-if [ -n "$ASSIGNEE" ]; then
-  gh issue list --repo <org>/<repo> --label "$READY" --assignee "$ASSIGNEE" --state open \
-    --json number,title,labels,assignees,milestone,createdAt --limit 100
-else
-  gh issue list --repo <org>/<repo> --label "$READY" --state open \
-    --json number,title,labels,assignees,milestone,createdAt --limit 100
+# QUEUE_REPO is the resolved <org>/<repo> from Phase 1.
+if [ "${ASSIGNEE:-}" = "@me" ]; then
+  ASSIGNEE=$(gh api user --jq .login) || exit 1
 fi
+ISSUE_PAGES=$(gh api --method GET "repos/$QUEUE_REPO/issues" \
+  -f state=open -f per_page=100 --paginate --slurp) || exit 1
+# The repository issues endpoint also returns pull requests; exclude them.
+ISSUES_JSON=$(printf '%s' "$ISSUE_PAGES" | jq '[.[][] | select(has("pull_request") | not)]') || exit 1
+printf '%s' "$ISSUES_JSON" | jq --arg ready "$READY" --arg assignee "${ASSIGNEE:-}" '
+  [.[] | select(any(.labels[]; .name == $ready))
+       | select($assignee == "" or any(.assignees[]; .login == $assignee))]'
 ```
 
+Wait for every page before choosing work or reporting an empty queue. A failed
+page is an incomplete read: report it and end this cycle without dispatching.
+The REST fields use `created_at` and label/assignee objects. Reuse this complete
+issue snapshot for the lane counts below; apply the assignee filter to candidates
+only, so the repository totals still describe the whole queue.
+
 If empty, run a secondary check to distinguish a genuinely empty queue from an unconfigured repo:
 
 ```bash
@@ -206,8 +216,8 @@ GitHub's data model, not a preference (see "Why labels" above). That makes the o
 - open issues carrying **no** build role label — which this scanner must see anyway in order to
   determine and stamp their repo.
 
-Count each lane and the repo's **total open** count (`gh issue list --state open --limit 1000 --json
-number | jq length`), then build the denominator with the shared helper — GitHub callers pass the
+Count each lane and the repo's **total open** count from `ISSUES_JSON`, then build
+the denominator with the shared helper — GitHub callers pass the
 lane type explicitly, since there is none to read:
 
 ```text

package/plugins/lisa-agy/skills/lisa-jira-build-intake/SKILL.md

@@ -177,7 +177,16 @@ the Linear side produced 31 consecutive false "dry lane" cycles (#2657).
 2. Then sweep the rest of pre-work with the same base JQL, swapping the status clause for
    `statusCategory = "To Do"`, and read the **total open** count (`statusCategory != Done`). The
    open total is what makes an omitted lane arithmetically visible.
-3. Page to exhaustion — a single unpaged `search-issues` call is not a count.
+3. Page each query to exhaustion using the configured access tool's pagination
+   fields. For token-based search, pass the returned `nextPageToken` until the
+   response marks the last page. For offset-based search, advance `startAt` by
+   the number of returned issues until the reported total is reached. Keep the
+   same JQL and ordering throughout, and deduplicate issue keys across pages.
+   A failed page, repeated cursor, or missing continuation while more results
+   are reported makes the read incomplete. Report that condition and end the
+   cycle without dispatching; never report a partial read as an empty queue.
+   If the access tool hides pagination, use its documented complete-list mode
+   or another configured read path that exposes continuation metadata.
 
 Capture each ticket's: key, summary, issue type, priority, assignee, parent (epic), status (with
 its category), labels, components.

package/plugins/lisa-agy/skills/lisa-linear-build-intake/SKILL.md

@@ -164,8 +164,15 @@ This skill ONLY transitions `$READY → $CLAIMED` on claim, and `$CLAIMED → $D
 
 1. List the team's workflow states via `lisa-linear-access operation: list-workflow-states`.
 2. Keep every state whose `type` is `backlog` or `unstarted` — that is the pre-work set. `$READY` is one member of it, not the whole of it.
-3. Query each pre-work state: `lisa-linear-access operation: list-issues({team: <teamId>, state: "<state>"})`, paging to `hasNextPage=false`. Linear's GraphQL complexity ceiling silently truncates at `first: 250`, so a single unpaged call is not a count.
-4. Also read the **total open** count for the team (every state whose `type` is not `completed` / `canceled`). This number is what makes an omitted lane arithmetically visible.
+3. Query each pre-work state: `lisa-linear-access operation: list-issues({team: <teamId>, state: "<state>"})`, following `endCursor` until `hasNextPage=false`. Deduplicate issue IDs. A failed page or non-advancing cursor makes the read incomplete; report it and end the cycle without dispatching. Do not infer completeness from a single page's size.
+4. Also read the **total open** count for the team using the same terminal set as the child check below: exclude `completed`, `canceled`, and `duplicate`. Intermediate deployment states remain open.
+
+Report the query scope, pages read and distinct issue count. If a previous read
+or a known issue contradicts the result, re-read that evidence before declaring
+the queue empty. Identifier ranges and gaps are diagnostics, not proof of
+completeness: filters, deleted issues and unseen omissions can all affect them.
+The historical 249-row report did not establish a root-connection defect, so it
+does not justify changing connections or adding a separate range-validation gate.
 
 Capture each Issue's: identifier, title, type label, priority, assignee, project, state (with its `type`), labels, description summary.
 

package/plugins/lisa-agy/skills/lisa-secrets-access/SKILL.md

@@ -49,6 +49,26 @@ environment  →  materialized file (surfaces that have one)  →  provider
 
 **The middle rung exists only where it must.** A remote agent container prepares itself during setup — before any task exists, and often before network policy would permit a provider call from the task itself — so files written at that moment are the only channel available.
 
+### Recovering AWS access during a task
+
+When an AWS operation reports missing or expired credentials, first resolve
+`LISA_AWS_BOOTSTRAP_JSON` through the ladder above. If available, run the existing
+`scripts/remote-agent-aws-setup.sh` from the trusted installed Lisa plugin/package
+in the project checkout, supplying the bundle only to that subprocess's
+environment. Select the intended namespace, stage and expected account from the
+project configuration. Require its successful account verification; do not
+disable verification or take over another project's default profile to force
+success. Use `lisa-setup-remote-aws` only if installation is missing. Keep the
+bundle private; do not print it or copy it into a second secret provider. Do not
+use `aws sso login` to recover this Lisa-managed bootstrap path.
+
+Before retrying the operation, verify that the selected profile's caller account
+matches the project's expected account; successful authentication alone is not
+enough. If the bundle cannot be resolved or the account mismatches, report that
+specific failure. An SSO-shaped local profile is not evidence that a human login
+is required. Projects explicitly configured for a different access method keep
+that method; do not invent a bootstrap bundle for them.
+
 ## Writing values to disk
 
 The default rule is absolute: **never write a resolved value to disk**, including "temporary" files. A value on disk is a copy that can drift and leak.

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.25",
+  "version": "4.55.27",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.25",
+  "version": "4.55.27",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.25",
+  "version": "4.55.27",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.25",
+  "version": "4.55.27",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.25",
+  "version": "4.55.27",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.25",
+  "version": "4.55.27",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/rules/eager/integration-access-layer.md

@@ -4,16 +4,16 @@ Skills and rules that use external integrations route through the matching
 `*-access` skill. Do not call vendor MCP tools or REST APIs directly from a
 consumer skill.
 
-Secrets are the same shape: every credential resolves through
-`lisa-secrets-access`, which owns the provider list, the note format, and the
-resolution order. Read it rather than restating it — and never ask a human to
-paste a value the provider can supply.
+Resolve credentials through `lisa-secrets-access`; do not duplicate its
+provider configuration or ask a human to paste a value it can supply.
 
-Resolution order is the configured-provider token/CLI substrate first when its
-bootstrap credential is present and identity-matched, then the interactive MCP as
-fallback, then a loud error naming the exact credential to set. Identity-match is
-mandatory on every substrate — one authenticated as a different tenant is skipped,
-never used. The ordering itself is settled in
+For missing AWS credentials, use its `LISA_AWS_BOOTSTRAP_JSON` recovery guidance
+before proposing an interactive login.
+
+Use the configured-provider token/CLI first when its bootstrap credential is
+present, then interactive MCP, then an error naming the missing credential.
+Every method must match the intended tenant; skip mismatched identities.
+Resolution order:
 [reference/credential-substrate-precedence.md](../reference/credential-substrate-precedence.md);
 full matrix and migration rules:
 [reference/integration-access-layer.md](../reference/integration-access-layer.md).

package/plugins/lisa-copilot/skills/lisa-github-build-intake/SKILL.md

@@ -174,15 +174,25 @@ A "transition" means: remove the old role label and add the new one, in two `gh
 ### Phase 2 — Find ready issues
 
 ```bash
-if [ -n "$ASSIGNEE" ]; then
-  gh issue list --repo <org>/<repo> --label "$READY" --assignee "$ASSIGNEE" --state open \
-    --json number,title,labels,assignees,milestone,createdAt --limit 100
-else
-  gh issue list --repo <org>/<repo> --label "$READY" --state open \
-    --json number,title,labels,assignees,milestone,createdAt --limit 100
+# QUEUE_REPO is the resolved <org>/<repo> from Phase 1.
+if [ "${ASSIGNEE:-}" = "@me" ]; then
+  ASSIGNEE=$(gh api user --jq .login) || exit 1
 fi
+ISSUE_PAGES=$(gh api --method GET "repos/$QUEUE_REPO/issues" \
+  -f state=open -f per_page=100 --paginate --slurp) || exit 1
+# The repository issues endpoint also returns pull requests; exclude them.
+ISSUES_JSON=$(printf '%s' "$ISSUE_PAGES" | jq '[.[][] | select(has("pull_request") | not)]') || exit 1
+printf '%s' "$ISSUES_JSON" | jq --arg ready "$READY" --arg assignee "${ASSIGNEE:-}" '
+  [.[] | select(any(.labels[]; .name == $ready))
+       | select($assignee == "" or any(.assignees[]; .login == $assignee))]'
 ```
 
+Wait for every page before choosing work or reporting an empty queue. A failed
+page is an incomplete read: report it and end this cycle without dispatching.
+The REST fields use `created_at` and label/assignee objects. Reuse this complete
+issue snapshot for the lane counts below; apply the assignee filter to candidates
+only, so the repository totals still describe the whole queue.
+
 If empty, run a secondary check to distinguish a genuinely empty queue from an unconfigured repo:
 
 ```bash
@@ -206,8 +216,8 @@ GitHub's data model, not a preference (see "Why labels" above). That makes the o
 - open issues carrying **no** build role label — which this scanner must see anyway in order to
   determine and stamp their repo.
 
-Count each lane and the repo's **total open** count (`gh issue list --state open --limit 1000 --json
-number | jq length`), then build the denominator with the shared helper — GitHub callers pass the
+Count each lane and the repo's **total open** count from `ISSUES_JSON`, then build
+the denominator with the shared helper — GitHub callers pass the
 lane type explicitly, since there is none to read:
 
 ```text