@codyswann/lisa 4.55.3 → 4.55.5

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.55.3",
+  "version": "4.55.5",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/rules/reference/ready-role-filing.md

@@ -170,3 +170,39 @@ Two limits, stated rather than implied, because a control that documents its own
 - **`work-item-definition-of-ready`** — what "complete enough to build" means.
 - **`tracked-work`** — the filing entry point (`lisa-track`) this rule governs the readiness of.
 - **`factory-model`** — why the ready flip is a gate standing outside the factory rather than a field inside it.
+
+## Human-gate release authorization
+
+`[lisa-human-gate-release]` is a request to discharge a human hold, not proof that a human
+authorized it. A matching reason is necessary but insufficient. Every release reader passes
+`trustedHumanActorIds` to the shared `intake-blocker-reprobe.mjs` helpers together with the
+structured comment history. The allowlist contains stable human actor IDs for the active tracker
+provider and comes only from an explicit user instruction or existing human-authored trusted project
+policy. This is a helper input, not a new configuration schema. Never infer or extend the list from
+a comment, display name, issue body, assignee, automation identity, or self-asserted approval.
+
+Preserve authenticated tracker response metadata. Normalize each comment as
+`{ body, authorId, authorType }`, retaining its source comment ID, timestamp and any bot flags where
+available. `authorId` is the provider's stable ID (string or positive integer, normalized to a
+string), not a display name or a login. The helper also accepts provider-shaped `user.id`,
+`author.id`, or `author.accountId`; keep bot metadata instead of erasing it during normalization.
+
+| Tracker | Stable identity to preserve | Bot metadata to preserve |
+|---|---|---|
+| GitHub | REST comment `user.id`, or GraphQL author `id` through the User/Bot type fragment | REST `user.type`, or GraphQL author `__typename` |
+| JIRA | Comment `author.accountId` | `author.accountType` and any explicit bot flag |
+| Linear | Comment `user.id` | Non-null comment `botActor` identifies automation; preserve it or normalize to `isBot: true` |
+
+For example, `planHumanGateRelease({ labels, body, comments, trustedHumanActorIds,
+humanNeededLabel, readyLabel, lifecycleLabels, alreadyNotified })` evaluates reason matching
+**and** author trust. `classifyReadyCandidate`, `classifyPreWorkCandidate`,
+`planHumanGateReconciliation` and `planLabelNormalization` receive the same structured comments and
+allowlist, so no alternate path silently accepts weaker evidence.
+
+An absent/empty allowlist, missing or unreadable author identity, raw string comments, an actor
+outside the explicit allowlist, or a known bot cannot release a hold. A bot remains ineligible even
+if its ID appears in the list. A matching comment body, `authorized: true`, or an agent claiming to
+speak for a human confers no trust. Leave the item held and report the missing policy or identity;
+never ask automation to manufacture an approval comment to unblock itself. Unheld items remain
+unheld, and an authorized matching human release still permits the existing recovery path.
+Keep historical hold and release comments; do not rewrite the description to erase a hold.

package/plugins/src/base/scripts/intake-blocker-reprobe.mjs

@@ -259,18 +259,77 @@ export function humanGateHolds(body) {
 }
 
 /**
- * The reason keys every recorded release discharges, deduplicated.
+ * Normalize stable provider IDs without case folding or trusting display names.
+ * @param {unknown} value - Provider actor ID
+ * @returns {string} Stable comparison key, or empty when invalid
+ */
+function stableActorId(value) {
+  if (typeof value === "string") return value.trim();
+  return Number.isSafeInteger(value) && value > 0 ? String(value) : "";
+}
+
+/**
+ * Recognize explicit provider bot metadata even for an allowlisted identity.
+ * @param {unknown} actor - Provider or normalized author metadata
+ * @returns {boolean} Whether the metadata identifies automation
+ */
+function isKnownBot(actor) {
+  if (!actor || typeof actor !== "object") return false;
+  const kinds = [
+    actor.type,
+    actor.__typename,
+    actor.accountType,
+    actor.authorType,
+  ];
+  return (
+    actor.botActor != null ||
+    actor.isBot === true ||
+    actor.bot === true ||
+    kinds.some(kind => /^(?:bot|app)$/i.test(String(kind ?? "").trim()))
+  );
+}
+
+/**
+ * Require authenticated provider identity and separately supplied human trust.
+ * Adapters may normalize the ID to authorId, but must preserve bot metadata.
+ * Names, body text and self-asserted authorization flags never confer trust.
+ * @param {unknown} comment - Structured provider comment
+ * @param {ReadonlySet<string>} trustedIds - Explicitly trusted human actor IDs
+ * @returns {boolean} Whether the comment may discharge a human hold
+ */
+function isTrustedHumanComment(comment, trustedIds) {
+  if (!comment || typeof comment !== "object" || Array.isArray(comment))
+    return false;
+  if ([comment, comment.user, comment.author].some(isKnownBot)) return false;
+  const id = stableActorId(
+    comment.authorId ??
+      comment.user?.id ??
+      comment.author?.id ??
+      comment.author?.accountId
+  );
+  return id.length > 0 && trustedIds.has(id);
+}
+
+/**
+ * The reason keys released by explicitly trusted human authors, deduplicated.
  *
- * Accepts comment bodies as strings or as `{ body }` objects, because the three
- * vendor readers return both shapes and a release that a vendor's payload shape
- * could hide would be a release path that exists on one tracker.
- * @param {unknown} comments - Comment bodies, any order
- * @returns {string[]} One key per recorded release
+ * Comments must retain authenticated provider authorship: normalized authorId,
+ * user.id, author.id or author.accountId. The caller supplies trusted human IDs
+ * independently of comment content. Raw strings, missing IDs, known bots and
+ * an absent or empty allowlist fail closed and cannot discharge a hold.
+ * @param {unknown} comments - Structured comments, any order
+ * @param {unknown} trustedHumanActorIds - Explicit trusted human provider IDs
+ * @returns {string[]} One key per authorized recorded release
  */
-export function humanGateReleases(comments) {
-  const bodies = (Array.isArray(comments) ? comments : []).map(entry =>
-    typeof entry === "string" ? entry : (entry?.body ?? "")
+export function humanGateReleases(comments, trustedHumanActorIds = []) {
+  const trustedIds = new Set(
+    (Array.isArray(trustedHumanActorIds) ? trustedHumanActorIds : [])
+      .map(stableActorId)
+      .filter(Boolean)
   );
+  const bodies = (Array.isArray(comments) ? comments : [])
+    .filter(entry => isTrustedHumanComment(entry, trustedIds))
+    .map(entry => entry.body ?? "");
   const keys = bodies.flatMap(body =>
     declarativeText(body)
       .split("\n")
@@ -288,11 +347,13 @@ export function humanGateReleases(comments) {
  * the unsafe direction — the one this fix must not introduce while correcting
  * the safe one. An item with no declared body hold is discharged only by a
  * keyless release, which is the form that pairs with a label-only hold.
- * @param {{ body?: unknown, comments?: unknown }} input - The item's surfaces
+ * @param {{ body?: unknown, comments?: unknown, trustedHumanActorIds?: unknown }} input - The item's surfaces
  * @returns {boolean} True when nothing is left outstanding
  */
 export function humanGateDischarged(input = {}) {
-  const released = new Set(humanGateReleases(input.comments));
+  const released = new Set(
+    humanGateReleases(input.comments, input.trustedHumanActorIds)
+  );
   const holds = humanGateHolds(input.body);
   if (holds.length === 0) return released.has("");
   return holds.every(reason => released.has(reason));
@@ -319,7 +380,7 @@ export function humanGateDischarged(input = {}) {
  * no releases, so a held item stays held. Holding a gate that may be stale
  * beats releasing one that is not, and every caller that never passes comments
  * keeps its current behaviour by construction.
- * @param {{ labels?: unknown, body?: unknown, comments?: unknown, humanNeededLabel?: unknown }} input - Candidate surfaces
+ * @param {{ labels?: unknown, body?: unknown, comments?: unknown, trustedHumanActorIds?: unknown, humanNeededLabel?: unknown }} input - Candidate surfaces
  * @returns {{ held: boolean, reason: string, declared: number, outstanding: string[], released: string[], labelPresent: boolean }} Held-ness verdict
  */
 export function humanGateVerdict(input = {}) {
@@ -330,7 +391,10 @@ export function humanGateVerdict(input = {}) {
     .toLowerCase();
   const labelPresent =
     configured.length > 0 && normalizeLabels(input.labels).includes(configured);
-  const released = humanGateReleases(input.comments);
+  const released = humanGateReleases(
+    input.comments,
+    input.trustedHumanActorIds
+  );
   const releasedSet = new Set(released);
   const holds = humanGateHolds(input.body);
   const outstanding = holds.filter(reason => !releasedSet.has(reason));
@@ -370,9 +434,9 @@ export function humanGateVerdict(input = {}) {
  * It is also the only place a hold ENDS, which is why the release lives behind
  * the same call rather than beside it: a reader that could see the hold but not
  * its discharge is how the gate became one-way in the first place. Pass the
- * item's comments and a recorded release is honoured; omit them and the item
- * stays held.
- * @param {{ labels?: unknown, body?: unknown, comments?: unknown, humanNeededLabel?: unknown }} input - Candidate surfaces
+ * item's structured comments and trustedHumanActorIds to honor an authorized
+ * release; omit either and the item stays held.
+ * @param {{ labels?: unknown, body?: unknown, comments?: unknown, trustedHumanActorIds?: unknown, humanNeededLabel?: unknown }} input - Candidate surfaces
  * @returns {boolean} True when a person is holding this item
  */
 export function isHumanGated(input) {
@@ -423,6 +487,7 @@ function judgeProbe(probe) {
  *   labels?: unknown
  *   body?: unknown
  *   comments?: unknown
+ *   trustedHumanActorIds?: unknown
  *   humanNeededLabel?: unknown
  *   statedBlocker?: unknown
  *   probe?: { discharged?: unknown, evidence?: unknown } | null
@@ -535,7 +600,7 @@ export const HUMAN_GATE_NOTE_MARKER = "<!-- [lisa-human-gate-reconciled] -->";
  * a parser keyed on the structured field would miss those while appearing to
  * work on every item that happens to have one — reproducing this defect one
  * layer down.
- * @param {{ labels?: unknown, body?: unknown, comments?: unknown, humanNeededLabel?: unknown }} input - Candidate surfaces
+ * @param {{ labels?: unknown, body?: unknown, comments?: unknown, trustedHumanActorIds?: unknown, humanNeededLabel?: unknown }} input - Candidate surfaces
  * @returns {{ claimable: boolean, reason: string, humanGated: boolean }} Claim verdict
  */
 export function classifyReadyCandidate(input = {}) {
@@ -564,6 +629,7 @@ export function classifyReadyCandidate(input = {}) {
  *   labels?: unknown
  *   body?: unknown
  *   comments?: unknown
+ *   trustedHumanActorIds?: unknown
  *   humanNeededLabel?: unknown
  *   readyLabel?: unknown
  *   alreadyNotified?: unknown
@@ -670,6 +736,7 @@ const RESUME_INSTRUCTION = [
  *   labels?: unknown
  *   body?: unknown
  *   comments?: unknown
+ *   trustedHumanActorIds?: unknown
  *   humanNeededLabel?: unknown
  *   readyLabel?: unknown
  *   lifecycleLabels?: unknown
@@ -831,6 +898,7 @@ export const NORMALIZATION_HOLD_NOTE_MARKER =
  *   labels?: unknown
  *   body?: unknown
  *   comments?: unknown
+ *   trustedHumanActorIds?: unknown
  *   humanNeededLabel?: unknown
  *   lifecycleLabels?: unknown
  *   readyLabel?: unknown

package/plugins/src/base/scripts/qa-signal-lifecycle.mjs

@@ -239,8 +239,8 @@ export const VOID_PREDICATES = Object.freeze({
   "certified-role-reached": ({ role, resolvedRoles }) =>
     normalize(role) !== "" &&
     resolvedRoles.some(name => normalize(name) === normalize(role)),
-  "human-gate-release-recorded": ({ body, comments }) =>
-    humanGateDischarged({ body, comments }),
+  "human-gate-release-recorded": ({ body, comments, trustedHumanActorIds }) =>
+    humanGateDischarged({ body, comments, trustedHumanActorIds }),
 });
 
 /**
@@ -331,6 +331,7 @@ const labelNames = labels =>
  * @param {string} [options.signal] a key of {@link SIGNALS}
  * @param {readonly unknown[]} [options.labels] the item's labels
  * @param {readonly unknown[]} [options.comments] comment bodies, oldest first
+ * @param {readonly unknown[]} [options.trustedHumanActorIds] explicitly trusted human author identities
  * @param {unknown} [options.body] the item's description, for body-marker rows
  * @param {string} [options.role] the item's current lifecycle role name
  * @param {string} options.vendor `jira` | `linear` | `github`
@@ -341,6 +342,7 @@ export const evaluateSignal = ({
   signal = QA_FAILURE_SIGNAL,
   labels,
   comments,
+  trustedHumanActorIds,
   body,
   role = "",
   vendor,
@@ -380,6 +382,7 @@ export const evaluateSignal = ({
     role,
     body,
     comments,
+    trustedHumanActorIds,
     resolvedRoles: voidingRoles({ vendor, config }),
   };
   const unchecked = declared.voidConditions.filter(

package/plugins/src/base/skills/lisa-github-build-intake/SKILL.md

@@ -6,6 +6,20 @@ allowed-tools: ["Skill", "Bash"]
 
 # GitHub Build Intake: $ARGUMENTS
 
+## Human-gate release authorization
+
+A release requires a trusted human author, not just matching comment text. Follow
+`ready-role-filing` — **Human-gate release authorization**: preserve tracker-supplied comment
+author IDs and bot metadata, resolve `trustedHumanActorIds` only from an explicit user instruction
+or existing human-authored trusted project policy, and pass it with structured `comments` to every
+hold classifier, reconciliation, normalization and release planner. Never derive trust from the
+comment body, a display name, the actor's own assertion, or an automation posting on its own behalf.
+Missing policy, missing/unreadable author identity, raw body strings, untrusted actors and known bots
+cannot discharge a hold. Keep the item held and report the missing authorization; do not silently
+replace these inputs with an empty history or an inferred allowlist. Authorized matching releases
+continue through the existing path and never override an independently declared caller hold.
+
+
 `$ARGUMENTS` is one of:
 
 1. A GitHub `org/repo` token (e.g., `acme/frontend-v2`).
@@ -216,8 +230,8 @@ A blocker is a **claim with a timestamp, not a fact** — it goes stale the mome
 true, and nothing re-read one before this phase. For each `$BLOCKED` candidate:
 
 1. **Read release comments before applying the human gate.** Pass all item comments, labels,
-   body and configured `humanNeededLabel` to `classifyReadyCandidate(...)`. For a discharged hold,
-   call `planHumanGateRelease({ labels, body, comments, humanNeededLabel, readyLabel, lifecycleLabels, alreadyNotified })`
+   body, `trustedHumanActorIds` and configured `humanNeededLabel` to `classifyReadyCandidate(...)`. For a discharged hold,
+   call `planHumanGateRelease({ labels, body, comments, trustedHumanActorIds, humanNeededLabel, readyLabel, lifecycleLabels, alreadyNotified })`
    and retain its plan. Apply human-marker cleanup only as planned; defer any ready-role restoration
    until steps 2–5 have cleared the remaining blockers (map the role to the vendor's state or label).
    A still-active hold is never auto-selected, whatever any probe says. An absent or unreadable
@@ -227,8 +241,9 @@ true, and nothing re-read one before this phase. For each `$BLOCKED` candidate:
 2. **Extract the stated discharge condition**, then **probe it**. Machine-testable conditions — a
    version on trunk, a published package, a CI run history, an advisory's patched status — rot
    fastest and are cheapest to check. A human decision is not machine-testable; leave it.
-3. **Classify with `classifyPreWorkCandidate(...)`** from `scripts/intake-blocker-reprobe.mjs`. A
-   discharge with no recorded evidence is not a discharge, and neither is a candidate nothing
+3. **Classify with `classifyPreWorkCandidate(...)`** from `scripts/intake-blocker-reprobe.mjs`.
+   Include the structured `comments` and `trustedHumanActorIds` from step 1.
+   A discharge with no recorded evidence is not a discharge, and neither is a candidate nothing
    probed this cycle — the helper refuses both.
 4. **Record the result on the issue either way** via `formatReprobeNote(...)` as a comment, so the
    next cycle reads the answer rather than re-deriving it. Keep it idempotent.
@@ -323,7 +338,7 @@ other gate's verdict — however conclusive — may promote an item a person par
    drift, and a drifted gate fails *silently*, by quietly ceasing to match. Do **not** re-implement
    the test here, and do **not** key it on `reason=`: markers in the wild carry no `reason=` key at
    all and sit anywhere in the body, so a structured parse would miss them while appearing to work
-   on every item that happens to have one. **Pass the item's `comments` alongside its labels and
+   on every item that happens to have one. **Pass the item's structured `comments` and `trustedHumanActorIds` alongside its labels and
    body.** A hold is ended by a release recorded in a comment, so a reader handed no comments cannot
    see the discharge — it goes on holding an item whose question was answered weeks ago, which is
    the defect this gate carried from the day it was written (CodySwannGT/lisa#3852). Omitting them
@@ -334,7 +349,7 @@ other gate's verdict — however conclusive — may promote an item a person par
    and re-rejected every cycle forever and seen by nothing — `lisa-repair-intake` sweeps items that
    are **not** in the ready role and excludes gated ones outright, so a ready-and-gated item falls
    outside its filter twice over. Call
-   `planHumanGateReconciliation({ labels, body, humanNeededLabel, readyLabel, alreadyNotified })`
+   `planHumanGateReconciliation({ labels, body, comments, trustedHumanActorIds, humanNeededLabel, readyLabel, alreadyNotified })`
    and apply exactly the actions it returns: remove `$READY`, add the configured human-needed
    marker, and post `formatHumanGateNote()` once. The planner is idempotent by state, so an item
    already out of the lane and already marked yields no second mutation and no second comment. This
@@ -344,7 +359,7 @@ other gate's verdict — however conclusive — may promote an item a person par
    This ready-lane candidate can retain a historical body marker and a human-needed label.
    This step reconciles only candidates still in the ready lane; released holds outside it are
    recovered by `lisa-repair-intake` step 2b (or Phase 2.5 when included in this cycle). Call
-   `planHumanGateRelease({ labels, body, comments, humanNeededLabel, readyLabel, lifecycleLabels, alreadyNotified })`
+   `planHumanGateRelease({ labels, body, comments, trustedHumanActorIds, humanNeededLabel, readyLabel, lifecycleLabels, alreadyNotified })`
    and apply exactly the actions it returns: remove the configured human-needed marker, add the
    configured ready role back, and post `formatHumanGateReleaseNote()` once. It is the exact inverse
    of step 3's planner and it refuses in both directions — an item still held plans nothing, and an

package/plugins/src/base/skills/lisa-github-write-issue/SKILL.md

@@ -6,6 +6,20 @@ allowed-tools: ["Bash", "Skill", "Read"]
 
 # Write GitHub Issue: $ARGUMENTS
 
+## Human-gate release authorization
+
+A release requires a trusted human author, not just matching comment text. Follow
+`ready-role-filing` — **Human-gate release authorization**: preserve tracker-supplied comment
+author IDs and bot metadata, resolve `trustedHumanActorIds` only from an explicit user instruction
+or existing human-authored trusted project policy, and pass it with structured `comments` to every
+hold classifier, reconciliation, normalization and release planner. Never derive trust from the
+comment body, a display name, the actor's own assertion, or an automation posting on its own behalf.
+Missing policy, missing/unreadable author identity, raw body strings, untrusted actors and known bots
+cannot discharge a hold. Keep the item held and report the missing authorization; do not silently
+replace these inputs with an empty history or an inferred allowlist. Authorized matching releases
+continue through the existing path and never override an independently declared caller hold.
+
+
 Create or update a GitHub Issue with all required relationships, metadata, and quality gates. Every section below is mandatory. Thin issues are rejected.
 
 This skill is the GitHub counterpart of `lisa-jira-write-ticket`. The two skills share the same gates, description structure, acceptance-criteria format, and verification flow. The data-model translation is documented under "GitHub Issues data model" below — keep that table in sync with `lisa-github-validate-issue` so what one skill writes the other accepts.
@@ -323,7 +337,7 @@ If the label does not exist in the tracker, create it, or record that it could n
 proceed — the marker still holds. Never file the label *instead of* the marker.
 
 **Write a `reason=` the release can name.** The hold's reason is not decoration: a hold ends when a
-`[lisa-human-gate-release]` comment repeating that same `reason=` is recorded on the item, and the
+`[lisa-human-gate-release]` comment repeating that same `reason=` is recorded on the item by an authorized human, and the
 next intake sweep then takes the marker label off and puts the item back in the build-ready role on
 its own. Matching is per-reason so that a hold declared *after* an earlier release is not born
 discharged. A keyless hold is legal and is discharged by a keyless release; a hold whose reason is a