@codyswann/lisa 4.55.26 → 4.55.27

package/dist/core/nightly-e2e-guard-behavior-certificate.js

@@ -41,9 +41,9 @@ export const NIGHTLY_E2E_GUARD_BEHAVIOR_CERTIFICATES = Object.freeze({
     }),
     cd02b94b4db5134984c7b69f905af71c96bb5aac09a18fb3c6aef5ab0c22cf17: Object.freeze({
         contractVersion: "1.9.0",
-        packageVersions: Object.freeze(["4.55.26"]),
+        packageVersions: Object.freeze(["4.55.27"]),
         provenances: Object.freeze([
-            "workspace package @codyswann/lisa@4.55.26 (typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs)",
+            "workspace package @codyswann/lisa@4.55.27 (typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs)",
         ]),
     }),
     dfd2fef680de5ef03e63075e8a61c62ca4d95cdfdff6201939b79c748d3397f6: Object.freeze({

package/dist/core/upstream-evidence-manifest.js

@@ -422,7 +422,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/rules/eager/empirical-inquiry.md": "67aa64ba3ecc4f3cd761111d2562662e0a2acf7892703b14ec83f7f7b073e670",
     "plugins/src/base/rules/eager/falsifiable-checks.md": "8bf1a2b02cd1c44674ba3a131fa42f115ba693d66402264a3a365fdfaf656d1f",
     "plugins/src/base/rules/eager/history-audit.md": "e2365e3fb28230c643e943d26688a93906afa68e3e1355d3e86d4b22ab3db559",
-    "plugins/src/base/rules/eager/integration-access-layer.md": "e5675ec414d0dcfbbf7a29912f39ea5fb02747aa4e6045493e636cba1e635eb7",
+    "plugins/src/base/rules/eager/integration-access-layer.md": "4f98938b575c301a0f9626f4a074e802bd20363ba6e5874eb5d7dc0e6a7470d3",
     "plugins/src/base/rules/eager/intent-routing.md": "a2ef2397a98fb3d991fcfb39b669e289c1e2b697191cbeb6c071d71eca836207",
     "plugins/src/base/rules/eager/learnings-ladder.md": "58f70031f7ad720254e73db53f4f328f35cdce2a562c8f62e403be842abccab0",
     "plugins/src/base/rules/eager/local-ci-first.md": "8a0369f3b23c4c9906194ea2d5b6dab44bb82dee753571b7e3e27ed799a289f5",
@@ -668,7 +668,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-review-local/SKILL.md": "74112f88c721825464d962b05111dafe84173fb370d9522d5e155acc46cc55e9",
     "plugins/src/base/skills/lisa-rework-triage/SKILL.md": "a70ccc7c79a6cc3a695d173b7b8bfbe8334af2cdace368fe1520d0b86254fb6f",
     "plugins/src/base/skills/lisa-root-cause-analysis/SKILL.md": "3fa14217ca36b238ebb8203d18f10eaaf98a3647f949cdada6cb9f56ddf9ed50",
-    "plugins/src/base/skills/lisa-secrets-access/SKILL.md": "6ba87a36a76f70030c34bdd4bc7bffc27762ee44df5385e6048e01e1c3fa9f3e",
+    "plugins/src/base/skills/lisa-secrets-access/SKILL.md": "503617363fde042af3f02ee8e48a50ebf8e06f2cf6ca0b71cbe94774b4a2ab42",
     "plugins/src/base/skills/lisa-secrets-access/scripts/aws-bootstrap.mjs": "7f6acaa7ac13f31ebbd12e41000b5796536f1fe708684e59f79ab23b85ee08f0",
     "plugins/src/base/skills/lisa-secrets-access/scripts/bootstrap-store.mjs": "35169ea70810f7b7291d75c93ec326e0ac04407bf335949b0742e74e69850ec4",
     "plugins/src/base/skills/lisa-secrets-access/scripts/doctor-secrets.mjs": "71fd7a3f26d7e4424bb8ef80caaaa3db136595a5b9e620a32084a00521277ba3",

package/package.json

@@ -187,7 +187,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -336,7 +336,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "930911c159f0167461a637e71c170d6d718d47ed",
-  "gitHead": "930911c159f0167461a637e71c170d6d718d47ed",
-  "lisaReleaseTag": "v4.55.26"
+  "lisaReleaseCommit": "04360e12c126b0116214af7fe44c77ea2d42ebea",
+  "gitHead": "04360e12c126b0116214af7fe44c77ea2d42ebea",
+  "lisaReleaseTag": "v4.55.27"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/SKILL.md

@@ -49,6 +49,26 @@ environment  →  materialized file (surfaces that have one)  →  provider
 
 **The middle rung exists only where it must.** A remote agent container prepares itself during setup — before any task exists, and often before network policy would permit a provider call from the task itself — so files written at that moment are the only channel available.
 
+### Recovering AWS access during a task
+
+When an AWS operation reports missing or expired credentials, first resolve
+`LISA_AWS_BOOTSTRAP_JSON` through the ladder above. If available, run the existing
+`scripts/remote-agent-aws-setup.sh` from the trusted installed Lisa plugin/package
+in the project checkout, supplying the bundle only to that subprocess's
+environment. Select the intended namespace, stage and expected account from the
+project configuration. Require its successful account verification; do not
+disable verification or take over another project's default profile to force
+success. Use `lisa-setup-remote-aws` only if installation is missing. Keep the
+bundle private; do not print it or copy it into a second secret provider. Do not
+use `aws sso login` to recover this Lisa-managed bootstrap path.
+
+Before retrying the operation, verify that the selected profile's caller account
+matches the project's expected account; successful authentication alone is not
+enough. If the bundle cannot be resolved or the account mismatches, report that
+specific failure. An SSO-shaped local profile is not evidence that a human login
+is required. Projects explicitly configured for a different access method keep
+that method; do not invent a bootstrap bundle for them.
+
 ## Writing values to disk
 
 The default rule is absolute: **never write a resolved value to disk**, including "temporary" files. A value on disk is a copy that can drift and leak.

package/plugins/lisa/rules/eager/integration-access-layer.md

@@ -4,16 +4,16 @@ Skills and rules that use external integrations route through the matching
 `*-access` skill. Do not call vendor MCP tools or REST APIs directly from a
 consumer skill.
 
-Secrets are the same shape: every credential resolves through
-`lisa-secrets-access`, which owns the provider list, the note format, and the
-resolution order. Read it rather than restating it — and never ask a human to
-paste a value the provider can supply.
+Resolve credentials through `lisa-secrets-access`; do not duplicate its
+provider configuration or ask a human to paste a value it can supply.
 
-Resolution order is the configured-provider token/CLI substrate first when its
-bootstrap credential is present and identity-matched, then the interactive MCP as
-fallback, then a loud error naming the exact credential to set. Identity-match is
-mandatory on every substrate — one authenticated as a different tenant is skipped,
-never used. The ordering itself is settled in
+For missing AWS credentials, use its `LISA_AWS_BOOTSTRAP_JSON` recovery guidance
+before proposing an interactive login.
+
+Use the configured-provider token/CLI first when its bootstrap credential is
+present, then interactive MCP, then an error naming the missing credential.
+Every method must match the intended tenant; skip mismatched identities.
+Resolution order:
 [reference/credential-substrate-precedence.md](../reference/credential-substrate-precedence.md);
 full matrix and migration rules:
 [reference/integration-access-layer.md](../reference/integration-access-layer.md).

package/plugins/lisa/skills/lisa-secrets-access/SKILL.md

@@ -49,6 +49,26 @@ environment  →  materialized file (surfaces that have one)  →  provider
 
 **The middle rung exists only where it must.** A remote agent container prepares itself during setup — before any task exists, and often before network policy would permit a provider call from the task itself — so files written at that moment are the only channel available.
 
+### Recovering AWS access during a task
+
+When an AWS operation reports missing or expired credentials, first resolve
+`LISA_AWS_BOOTSTRAP_JSON` through the ladder above. If available, run the existing
+`scripts/remote-agent-aws-setup.sh` from the trusted installed Lisa plugin/package
+in the project checkout, supplying the bundle only to that subprocess's
+environment. Select the intended namespace, stage and expected account from the
+project configuration. Require its successful account verification; do not
+disable verification or take over another project's default profile to force
+success. Use `lisa-setup-remote-aws` only if installation is missing. Keep the
+bundle private; do not print it or copy it into a second secret provider. Do not
+use `aws sso login` to recover this Lisa-managed bootstrap path.
+
+Before retrying the operation, verify that the selected profile's caller account
+matches the project's expected account; successful authentication alone is not
+enough. If the bundle cannot be resolved or the account mismatches, report that
+specific failure. An SSO-shaped local profile is not evidence that a human login
+is required. Projects explicitly configured for a different access method keep
+that method; do not invent a bootstrap bundle for them.
+
 ## Writing values to disk
 
 The default rule is absolute: **never write a resolved value to disk**, including "temporary" files. A value on disk is a copy that can drift and leak.

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-secrets-access/SKILL.md

@@ -49,6 +49,26 @@ environment  →  materialized file (surfaces that have one)  →  provider
 
 **The middle rung exists only where it must.** A remote agent container prepares itself during setup — before any task exists, and often before network policy would permit a provider call from the task itself — so files written at that moment are the only channel available.
 
+### Recovering AWS access during a task
+
+When an AWS operation reports missing or expired credentials, first resolve
+`LISA_AWS_BOOTSTRAP_JSON` through the ladder above. If available, run the existing
+`scripts/remote-agent-aws-setup.sh` from the trusted installed Lisa plugin/package
+in the project checkout, supplying the bundle only to that subprocess's
+environment. Select the intended namespace, stage and expected account from the
+project configuration. Require its successful account verification; do not
+disable verification or take over another project's default profile to force
+success. Use `lisa-setup-remote-aws` only if installation is missing. Keep the
+bundle private; do not print it or copy it into a second secret provider. Do not
+use `aws sso login` to recover this Lisa-managed bootstrap path.
+
+Before retrying the operation, verify that the selected profile's caller account
+matches the project's expected account; successful authentication alone is not
+enough. If the bundle cannot be resolved or the account mismatches, report that
+specific failure. An SSO-shaped local profile is not evidence that a human login
+is required. Projects explicitly configured for a different access method keep
+that method; do not invent a bootstrap bundle for them.
+
 ## Writing values to disk
 
 The default rule is absolute: **never write a resolved value to disk**, including "temporary" files. A value on disk is a copy that can drift and leak.

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/rules/eager/integration-access-layer.md

@@ -4,16 +4,16 @@ Skills and rules that use external integrations route through the matching
 `*-access` skill. Do not call vendor MCP tools or REST APIs directly from a
 consumer skill.
 
-Secrets are the same shape: every credential resolves through
-`lisa-secrets-access`, which owns the provider list, the note format, and the
-resolution order. Read it rather than restating it — and never ask a human to
-paste a value the provider can supply.
+Resolve credentials through `lisa-secrets-access`; do not duplicate its
+provider configuration or ask a human to paste a value it can supply.
 
-Resolution order is the configured-provider token/CLI substrate first when its
-bootstrap credential is present and identity-matched, then the interactive MCP as
-fallback, then a loud error naming the exact credential to set. Identity-match is
-mandatory on every substrate — one authenticated as a different tenant is skipped,
-never used. The ordering itself is settled in
+For missing AWS credentials, use its `LISA_AWS_BOOTSTRAP_JSON` recovery guidance
+before proposing an interactive login.
+
+Use the configured-provider token/CLI first when its bootstrap credential is
+present, then interactive MCP, then an error naming the missing credential.
+Every method must match the intended tenant; skip mismatched identities.
+Resolution order:
 [reference/credential-substrate-precedence.md](../reference/credential-substrate-precedence.md);
 full matrix and migration rules:
 [reference/integration-access-layer.md](../reference/integration-access-layer.md).

package/plugins/lisa-copilot/skills/lisa-secrets-access/SKILL.md

@@ -49,6 +49,26 @@ environment  →  materialized file (surfaces that have one)  →  provider
 
 **The middle rung exists only where it must.** A remote agent container prepares itself during setup — before any task exists, and often before network policy would permit a provider call from the task itself — so files written at that moment are the only channel available.
 
+### Recovering AWS access during a task
+
+When an AWS operation reports missing or expired credentials, first resolve
+`LISA_AWS_BOOTSTRAP_JSON` through the ladder above. If available, run the existing
+`scripts/remote-agent-aws-setup.sh` from the trusted installed Lisa plugin/package
+in the project checkout, supplying the bundle only to that subprocess's
+environment. Select the intended namespace, stage and expected account from the
+project configuration. Require its successful account verification; do not
+disable verification or take over another project's default profile to force
+success. Use `lisa-setup-remote-aws` only if installation is missing. Keep the
+bundle private; do not print it or copy it into a second secret provider. Do not
+use `aws sso login` to recover this Lisa-managed bootstrap path.
+
+Before retrying the operation, verify that the selected profile's caller account
+matches the project's expected account; successful authentication alone is not
+enough. If the bundle cannot be resolved or the account mismatches, report that
+specific failure. An SSO-shaped local profile is not evidence that a human login
+is required. Projects explicitly configured for a different access method keep
+that method; do not invent a bootstrap bundle for them.
+
 ## Writing values to disk
 
 The default rule is absolute: **never write a resolved value to disk**, including "temporary" files. A value on disk is a copy that can drift and leak.

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/rules/integration-access-layer.mdc

@@ -9,16 +9,16 @@ Skills and rules that use external integrations route through the matching
 `*-access` skill. Do not call vendor MCP tools or REST APIs directly from a
 consumer skill.
 
-Secrets are the same shape: every credential resolves through
-`lisa-secrets-access`, which owns the provider list, the note format, and the
-resolution order. Read it rather than restating it — and never ask a human to
-paste a value the provider can supply.
+Resolve credentials through `lisa-secrets-access`; do not duplicate its
+provider configuration or ask a human to paste a value it can supply.
 
-Resolution order is the configured-provider token/CLI substrate first when its
-bootstrap credential is present and identity-matched, then the interactive MCP as
-fallback, then a loud error naming the exact credential to set. Identity-match is
-mandatory on every substrate — one authenticated as a different tenant is skipped,
-never used. The ordering itself is settled in
+For missing AWS credentials, use its `LISA_AWS_BOOTSTRAP_JSON` recovery guidance
+before proposing an interactive login.
+
+Use the configured-provider token/CLI first when its bootstrap credential is
+present, then interactive MCP, then an error naming the missing credential.
+Every method must match the intended tenant; skip mismatched identities.
+Resolution order:
 [reference/credential-substrate-precedence.md](credential-substrate-precedence-reference.mdc);
 full matrix and migration rules:
 [reference/integration-access-layer.md](integration-access-layer-reference.mdc).

package/plugins/lisa-cursor/skills/lisa-secrets-access/SKILL.md

@@ -49,6 +49,26 @@ environment  →  materialized file (surfaces that have one)  →  provider
 
 **The middle rung exists only where it must.** A remote agent container prepares itself during setup — before any task exists, and often before network policy would permit a provider call from the task itself — so files written at that moment are the only channel available.
 
+### Recovering AWS access during a task
+
+When an AWS operation reports missing or expired credentials, first resolve
+`LISA_AWS_BOOTSTRAP_JSON` through the ladder above. If available, run the existing
+`scripts/remote-agent-aws-setup.sh` from the trusted installed Lisa plugin/package
+in the project checkout, supplying the bundle only to that subprocess's
+environment. Select the intended namespace, stage and expected account from the
+project configuration. Require its successful account verification; do not
+disable verification or take over another project's default profile to force
+success. Use `lisa-setup-remote-aws` only if installation is missing. Keep the
+bundle private; do not print it or copy it into a second secret provider. Do not
+use `aws sso login` to recover this Lisa-managed bootstrap path.
+
+Before retrying the operation, verify that the selected profile's caller account
+matches the project's expected account; successful authentication alone is not
+enough. If the bundle cannot be resolved or the account mismatches, report that
+specific failure. An SSO-shaped local profile is not evidence that a human login
+is required. Projects explicitly configured for a different access method keep
+that method; do not invent a bootstrap bundle for them.
+
 ## Writing values to disk
 
 The default rule is absolute: **never write a resolved value to disk**, including "temporary" files. A value on disk is a copy that can drift and leak.

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.55.26",
+  "version": "4.55.27",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/rules/eager/integration-access-layer.md

@@ -4,16 +4,16 @@ Skills and rules that use external integrations route through the matching
 `*-access` skill. Do not call vendor MCP tools or REST APIs directly from a
 consumer skill.
 
-Secrets are the same shape: every credential resolves through
-`lisa-secrets-access`, which owns the provider list, the note format, and the
-resolution order. Read it rather than restating it — and never ask a human to
-paste a value the provider can supply.
+Resolve credentials through `lisa-secrets-access`; do not duplicate its
+provider configuration or ask a human to paste a value it can supply.
 
-Resolution order is the configured-provider token/CLI substrate first when its
-bootstrap credential is present and identity-matched, then the interactive MCP as
-fallback, then a loud error naming the exact credential to set. Identity-match is
-mandatory on every substrate — one authenticated as a different tenant is skipped,
-never used. The ordering itself is settled in
+For missing AWS credentials, use its `LISA_AWS_BOOTSTRAP_JSON` recovery guidance
+before proposing an interactive login.
+
+Use the configured-provider token/CLI first when its bootstrap credential is
+present, then interactive MCP, then an error naming the missing credential.
+Every method must match the intended tenant; skip mismatched identities.
+Resolution order:
 [reference/credential-substrate-precedence.md](../reference/credential-substrate-precedence.md);
 full matrix and migration rules:
 [reference/integration-access-layer.md](../reference/integration-access-layer.md).

package/plugins/src/base/skills/lisa-secrets-access/SKILL.md

@@ -49,6 +49,26 @@ environment  →  materialized file (surfaces that have one)  →  provider
 
 **The middle rung exists only where it must.** A remote agent container prepares itself during setup — before any task exists, and often before network policy would permit a provider call from the task itself — so files written at that moment are the only channel available.
 
+### Recovering AWS access during a task
+
+When an AWS operation reports missing or expired credentials, first resolve
+`LISA_AWS_BOOTSTRAP_JSON` through the ladder above. If available, run the existing
+`scripts/remote-agent-aws-setup.sh` from the trusted installed Lisa plugin/package
+in the project checkout, supplying the bundle only to that subprocess's
+environment. Select the intended namespace, stage and expected account from the
+project configuration. Require its successful account verification; do not
+disable verification or take over another project's default profile to force
+success. Use `lisa-setup-remote-aws` only if installation is missing. Keep the
+bundle private; do not print it or copy it into a second secret provider. Do not
+use `aws sso login` to recover this Lisa-managed bootstrap path.
+
+Before retrying the operation, verify that the selected profile's caller account
+matches the project's expected account; successful authentication alone is not
+enough. If the bundle cannot be resolved or the account mismatches, report that
+specific failure. An SSO-shaped local profile is not evidence that a human login
+is required. Projects explicitly configured for a different access method keep
+that method; do not invent a bootstrap bundle for them.
+
 ## Writing values to disk
 
 The default rule is absolute: **never write a resolved value to disk**, including "temporary" files. A value on disk is a copy that can drift and leak.