@codyswann/lisa 4.59.0 → 4.59.2

package/plugins/src/base/skills/lisa-github-build-intake/SKILL.md

@@ -491,7 +491,11 @@ Before the claim mutation, apply `claim-time-guards` — **Value before claim**,
 1. **`two-failed-attempts` valve.** Count `[lisa-build-attempt]` markers on the issue from the read bundle's comments (match on the marker, never the title), applying both filters from `claim-time-guards`: count a marker only when it carries `measures=work` (a marker with no `measures=` counts as `work`), and only when its `createdAt` is **after the issue most recently gained the ready label**. The ready-lane entry comes from the read bundle's `LabeledEvent` stream, which is already fetched — no extra call. If that history is `unknown`, count every `measures=work` marker regardless of age and say so in the comment. With two or more surviving markers, do **not** claim: relabel to the configured blocked role (`gh issue edit <number> --repo <org>/<repo> --remove-label "$READY" --add-label "$BLOCKED"`, resolved from `github.labels.build.blocked` per `config-resolution`), post the operator-readable comment naming both attempts, and **stop the cycle** at Phase 3e. Every non-success terminal outcome recorded in 3c/3d also appends a fresh `<!-- [lisa-build-attempt] n=<N> outcome=<outcome> measures=<work|machine> -->` marker so the next cycle can count it — `measures=machine` when the run was terminated by a signal or its outcome was `recovery-required`, `measures=work` when the build ran and did not satisfy the issue.
 2. **`already-implemented` check.** Probe for this issue's own key — `git log --all --grep "<org>/<repo>#<number>"` and `gh pr list --repo <org>/<repo> --state all --search "<org>/<repo>#<number>" --json number,state,mergedAt,url`. On a hit, claim as normal but route 3c to **verify-and-close** instead of `lisa-implement`: verify what shipped against the issue's acceptance criteria, post evidence via `lisa-github-evidence` naming the shipping PR/commit, then run the ordinary 3d transition and 3d.1 rollup. A partial hit implements only the remaining gap. An unreadable history degrades to "no hit" and the ordinary path proceeds — the guard never blocks the claim. This is not `DUPLICATE_ALREADY_FIXED` (a *different* canonical issue) and not `claim-archaeology` (a *different* ancestor issue); it is this issue's own work already having shipped without a transition.
 
+Immediately before claiming, re-read native state. If it is closed, skip it without
+relabeling or dispatching; an unreadable state holds the candidate.
+
 ```bash
+gh issue view <number> --repo <org>/<repo> --json state -q '.state' # must be OPEN
 gh issue edit <number> --repo <org>/<repo> --remove-label "$READY" --add-label "$CLAIMED"
 # Assign to the authenticated user ONLY when the issue is currently unassigned (attributable claim;
 # do not pile a second assignee onto an issue that already has an owner):
@@ -536,7 +540,7 @@ The lifecycle run returns one of the following outcomes; resume this scanner wit
 
 - **Success** — the build flow completed and a PR exists; evidence posted. The PR may already be **merged** or still **open** (auto-merge enabled, awaiting checks/merge). "Success" means the build work is sound — it does **not** assert the change reached an environment. The env transition in 3d gates on the PR actually being merged; an open PR does not advance the issue to a `done` env status.
 - **Blocked by github-verify pre-flight gate** — the pre-flight gate (github-agent workflow step 2) relabels the issue to `status:blocked` (or removes `$CLAIMED` and reassigns to the original author). This is correct and expected — let it stand. Record and move on.
-- **Duplicate already fixed** — `lisa-ticket-triage` returned `DUPLICATE_ALREADY_FIXED` with a canonical issue reference and empirical base-branch evidence. Post the triage finding, ensure the native `duplicates <canonical>` relationship exists when GitHub exposes it (otherwise leave an explicit cross-reference comment/body link), remove `$CLAIMED`, add the terminal `$DONE` label, close the issue with `gh issue close --reason "not planned"`, and do not open a PR. If the canonical fix is merged but not yet on the production branch, the close comment must say the production error can recur until the canonical issue promotes and that recurrence is tracked by the canonical issue; do not reopen this duplicate for that recurrence.
+- **Duplicate already fixed** — `lisa-ticket-triage` returned `DUPLICATE_ALREADY_FIXED` with a canonical issue reference and empirical base-branch evidence. Follow 3c.1 to link the duplicate, remove lifecycle roles, and close it as not planned without adding a done label or opening a PR. If the canonical fix is merged but not yet on the production branch, the close comment must say the production error can recur until the canonical issue promotes and that recurrence is tracked by the canonical issue; do not reopen this duplicate for that recurrence.
 - **Blocked by ticket-triage ambiguities** — triage posts findings and the lifecycle stops. The issue stays in `$CLAIMED`. Surface to human; do not auto-relabel. Record under "Errors".
 - **Errored** — exception, missing config, etc. Leave the issue in `$CLAIMED` for human investigation. Record under "Errors".
 
@@ -547,12 +551,12 @@ Run this only when the returned triage verdict is exactly `DUPLICATE_ALREADY_FIX
 1. Verify the structured result includes a canonical issue reference, the canonical PR/commit, and empirical evidence that the canonical fix is present on the base branch. If any piece is missing, treat the outcome as Held instead of closing.
 2. Post or preserve the triage-finding comment that explains why this issue is a duplicate and names the canonical issue.
 3. Ensure a native `duplicates <canonical>` link exists when GitHub exposes issue relationships; if this installation cannot create that relationship, leave an explicit issue cross-reference comment/body link and record the limitation in the summary.
-4. Resolve terminal `$DONE` exactly as in Phase 3d. For a single-env repo, `$DONE` is terminal; for env-keyed config, only the production/final value is terminal.
-5. Apply `$DONE` and retire every competing lifecycle role the issue currently carries — not just `$CLAIMED` — per the `leaf-only-lifecycle` rule's "Exactly one lifecycle role survives closure". Then close the issue as duplicate/not-planned:
+4. Resolve the configured lifecycle role set, including every environment's done value.
+5. Remove every lifecycle role the issue currently carries. Add no done label: this duplicate is being declined, and the canonical issue records delivery. Close as duplicate/not-planned:
 
 ```bash
 gh issue view <number> --repo <org>/<repo> --json labels -q '[.labels[].name] | join(" ")'
-gh issue edit <number> --repo <org>/<repo> --add-label "$DONE" <one --remove-label "<role>" per competing role the issue CURRENTLY carries>
+gh issue edit <number> --repo <org>/<repo> <one --remove-label "<role>" per lifecycle role the issue CURRENTLY carries; skip when none>
 gh issue close <number> --repo <org>/<repo> --reason "not planned"
 ```
 
@@ -562,7 +566,7 @@ gh issue close <number> --repo <org>/<repo> --reason "not planned"
 gh issue view <number> --repo <org>/<repo> --json state,stateReason,labels
 ```
 
-It must read `state: CLOSED` with `stateReason: NOT_PLANNED`, carry `$DONE`, and carry **no** other lifecycle role. Anything else is an Error naming what is still present. Post the closeout comment only after that passes:
+It must read `state: CLOSED` with `stateReason: NOT_PLANNED` and carry **no** lifecycle role, including `$DONE`. Anything else is an Error naming what is still present. Post the closeout comment only after that passes:
 
 ```bash
 gh issue comment <number> --repo <org>/<repo> --body "[claude-build-intake] Closed as duplicate of <canonical>. Canonical fix: <PR-or-commit>. Evidence: <base-branch-proof>."

package/plugins/src/base/skills/lisa-repair-intake/SKILL.md

@@ -683,7 +683,8 @@ LISA_BLOCKER_NODE
    invoke `resolveBlockerEdges` as shown above; never create a second resolver in the host.
    It returns `dissolve` / `keep` / `escalate` per edge.
    **Dissolve the edge in the SAME write that records the ruling, then read the relation back and
-   confirm it is gone.** Only when every edge dissolves → move `blocked → claimed`, then run the
+   confirm it is gone.** Only when the parsed edge set is non-empty and the resolver returns
+   `proceed: true` with every edge dissolved → move `blocked → claimed`, then run the
    same agent-dispatch + post-agent `claimed → done` sequence as the stalled-`claimed` path above
    (one-cycle recovery). If the agent re-blocks, move back to `blocked` — a valid outcome.
 
@@ -773,22 +774,16 @@ native-open / active / unresolved:
 4. Post a compact `[lisa-repair-intake]` note only when the native close-out changed state or when
    an actionable setup error must be surfaced. Do not spam already-closed terminal items.
 
-### Lifecycle label contradicts native state — walk BOTH directions
+### Lifecycle label contradicts native state — walk every direction
 
-A lifecycle label can lie in two ways, and historically only one of them had an owner:
+Use the existing detector to check native state and closure reason together.
+`directionsWalked` reports all three repair directions:
 
-| label | native state | owned by |
+| Label | Native state | Repair |
 |---|---|---|
-| terminal `done` role | still open / active | the `Build terminal-open` section above |
-| non-terminal role (`ready`, `claimed`, `blocked`, or any other `status:` member) | closed / completed | **nothing, until now** |
-
-A pass that walks one direction leaves the other accumulating silently. Measured on the Linear TUN
-board: **TUN-556 and TUN-503 both carry a terminal `status:done` while still natively open in
-`On Dev`** — invisible to intake and indistinguishable from handled, exactly like a bot-applied
-`status:in-progress` on GitHub.
-
-Resolve both directions in one pass with the shipped detector, which always reports
-`directionsWalked` covering both, so a "clean" verdict is an assertion that both were examined.
+| Terminal `done` role | Open / active | Follow `Build terminal-open` above |
+| Non-terminal lifecycle role | Closed as `COMPLETED` or reason absent | Advance to the configured terminal role |
+| Non-terminal lifecycle role | Closed as `NOT_PLANNED` | Remove the stale role and add nothing |
 
 **Build the classifier input inside this cycle. Never consume a temp file another skill wrote.**
 repair-intake runs as its own cycle, so borrowing `lisa-github-build-intake`'s scratch file fails
@@ -801,6 +796,9 @@ silent-clean verdict this section promises cannot happen.
 TRUST_DIR=$(mktemp -d)
 trap 'rm -rf "$TRUST_DIR"' EXIT
 
+# REST, not `gh issue view`: this payload carries `state_reason`, and the reason is
+# what separates the two closed directions. A read that drops it makes a NOT_PLANNED
+# closure indistinguishable from a completion at the exact moment one of them WRITES.
 gh api "repos/<org>/<repo>/issues/<n>" > "$TRUST_DIR/issue.json"
 
 # --paginate emits ONE ARRAY PER PAGE; --slurp + `add` flattens all of them so a
@@ -835,14 +833,18 @@ The `excluded` array reports what was held back; surface it, do not repair it.
 1. **`terminal-label-open-state`** → hand to the `Build terminal-open → native close` section above.
    Do not restate its rules; the terminality test lives there (intermediate env rungs like
    `status:on-dev` / `status:on-stg` are **not** terminal).
-2. **`open-label-closed-state`** → the previously unowned direction. The item is natively closed or
-   completed while still wearing a non-terminal lifecycle role. Advance the label to the env-resolved
-   terminal `done` role and post one idempotent `[lisa-repair-intake]` note. This is a write on
-   **Lisa's own** lifecycle surface, not a contest with another writer.
+2. **`open-label-closed-state`** → the previously unowned direction. The item is natively closed as
+   **completed** while still wearing a non-terminal lifecycle role. Advance the label to the
+   env-resolved terminal `done` role and post one idempotent `[lisa-repair-intake]` note. This is a
+   write on **Lisa's own** lifecycle surface, not a contest with another writer.
    Apply the leaf/container check from the **Lifecycle ownership guard** section *before* this
    branch: repair-intake owns container repair, so a natively-closed `ready` **leaf** is skipped
    here and left to the build lane rather than claimed by this pass.
-3. **Vendor caveat — Linear.** On Linear the lifecycle surface is the native workflow **state**, not a
+3. **`open-label-abandoned-state`** → closed as **`NOT_PLANNED`**. Remove the stale
+   non-terminal role and add nothing: declined work has not shipped. Post one idempotent
+   `[lisa-repair-intake]` note naming the closure reason. This removal also applies to closed
+   ready leaves, before the ordinary ready-leaf skip; it never claims or dispatches them.
+4. **Vendor caveat — Linear.** On Linear the lifecycle surface is the native workflow **state**, not a
    `status:*` label (see `config-resolution`). A `status:*` label there is leftover cruft that no
    repair direction reads, which is precisely why TUN-556 and TUN-503 rotted. Treat Linear's native
    state as authoritative and remove the contradicting stale label; never move the state to match a
@@ -1417,8 +1419,9 @@ It MAY:
   terminal `done`.
 - Reconcile a **container** wrongly carrying the build-ready `ready` role (a leaf-only-invariant
   violation) by rolling it up from its children and removing the `ready`, with a
-  `[lisa-repair-intake]` audit note. This is the one `ready`-touching exception (see MUST NOT) and
-  applies only to containers, never to leaves.
+  `[lisa-repair-intake]` audit note.
+- Remove stale lifecycle labels from a natively closed `NOT_PLANNED` item, including a ready
+  leaf. Add no done label and do not claim or dispatch it.
 - Move a PRD with fully terminal generated work to `shipped` and close/archive the source artifact
   where the source vendor supports native close-out, per `prd-lifecycle-rollup`.
 - Repair missing native GitHub child links by replaying the same-repo, idempotent `addSubIssue`
@@ -1439,9 +1442,8 @@ It MUST NOT:
   (empty parent token / `Top-level work:` entries) may become PRD children.
 - Apply a build `done` value other than via the env-resolution rules, or close a native item at
   any value other than the true terminal `done` (see `leaf-only-lifecycle`).
-- Touch `ready` **leaves** (that is `lisa-intake`'s lane). A container carrying `ready` is the
-  documented exception above — repair-intake reconciles it because `ready` on a parent is an
-  invariant violation, not the human "claim this leaf" signal intake owns.
+- Touch `ready` **leaves** except to remove stale labels from a natively closed `NOT_PLANNED`
+  item as above. Open ready leaves remain `lisa-intake`'s lane.
 - Move a GitHub issue that already carries a configured lifecycle label back to `ready` merely
   because some other label looks stale. Official lifecycle labels remain authoritative.
 

package/typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs

@@ -997,6 +997,84 @@ export function countDecisiveJobs(jobs) {
   return jobs.filter(job => DECISIVE_CONCLUSIONS.has(job?.conclusion)).length;
 }
 
+/** GitHub's explicit job-ceiling diagnostic; unrecognized wording stays unknown. */
+const TIMEOUT_ANNOTATION = /exceeded the maximum execution time/iu;
+
+/** Bound diagnostic requests; larger matrices remain unattributed. */
+const TIMEOUT_PROBE_JOB_CAP = 20;
+
+/**
+ * Restrict authenticated annotation reads to this repository's check runs.
+ * Preserve Enterprise API prefixes when deriving the relative request path.
+ * @param {object} api - Configured API root and repository.
+ * @param {object} job - Job returned by the Actions API.
+ * @returns {string|null} Repository-scoped API path, or null.
+ */
+function checkRunPath(api, job) {
+  const url = job?.check_run_url;
+  if (typeof url !== "string") return null;
+  if (typeof api?.apiUrl !== "string") return null;
+  const prefix = `${api.apiUrl}/repos/${api.repo}/check-runs/`;
+  if (!url.startsWith(prefix) || !/^\d+$/u.test(url.slice(prefix.length)))
+    return null;
+  return url.slice(api.apiUrl.length);
+}
+
+/**
+ * Read explicit timeout evidence without changing the scored verdict.
+ * Missing, failed or partial reads remain unknown; absence does not prove
+ * that an operator cancelled the run.
+ * @param {object} api - API coordinates.
+ * @param {ReadonlyArray<object>|null|undefined} jobs - The scored run's jobs.
+ * @param {(ms: number) => Promise<void>} [wait] - Injectable sleep.
+ * @returns {Promise<boolean|null>} Timeout found, absent, or unknown.
+ */
+export async function readTimeoutEvidence(api, jobs, wait) {
+  if (!Array.isArray(jobs)) return null;
+  const candidates = jobs.filter(
+    job => !DECISIVE_CONCLUSIONS.has(job?.conclusion)
+  );
+  // No indecisive job means nothing was killed part-way, which is a different
+  // statement from "we looked and found nothing" — the caller only asks this
+  // about a run that did not finish.
+  if (candidates.length === 0 || candidates.length > TIMEOUT_PROBE_JOB_CAP)
+    return null;
+  let readEverything = true;
+  for (const job of candidates) {
+    const path = checkRunPath(api, job);
+    if (path === null) {
+      readEverything = false;
+      continue;
+    }
+    let result;
+    try {
+      result = await apiGet(api, `${path}/annotations?per_page=100`, wait);
+    } catch {
+      readEverything = false;
+      continue;
+    }
+    // A 404 is `null`, and a body that is not the documented array is a shape
+    // this cannot read. Both are unread, not empty — counting either as "no
+    // annotations" would manufacture the absence of evidence.
+    if (result === null || !Array.isArray(result.body)) {
+      readEverything = false;
+      continue;
+    }
+    if (
+      result.body.some(entry =>
+        TIMEOUT_ANNOTATION.test(String(entry?.message ?? ""))
+      )
+    )
+      return true;
+    if (
+      result.body.length >= 100 ||
+      result.headers.get("link")?.includes('rel="next"')
+    )
+      readEverything = false;
+  }
+  return readEverything ? false : null;
+}
+
 /**
  * Reads the scope markers a run published, from its artifact NAMES.
  *
@@ -2039,13 +2117,13 @@ export function formatFinding(finding) {
  * which run it scores is the same defect one layer down, so the selection is not
  * conditional on anything having gone wrong.
  *
- * A scored run that reached NO verdict also names its cause, from the job
- * counts the walk already read. `cancelled` is overloaded across a displaced
- * duplicate, a job killed at its own `timeout-minutes` ceiling, and an operator
- * cancel; "0 of 1 job(s) reached a verdict" and "7 of 8" are different enough
- * that a reader can tell "it never started" from "it ran out of time" without
- * opening the run. That costs nothing — the counts come from jobs already
- * fetched, and no workflow job configuration is read to produce them.
+ * A scored run that reached NO verdict also names its cause. The job counts
+ * come free from the walk and separate "it never started" from "it started and
+ * stopped"; what they cannot separate is why it stopped, and the earlier
+ * version of this comment claimed they could — it read "7 of 8" as "it ran out
+ * of time", which is true of a ceiling kill and false of an operator cancel.
+ * That guess is now a read: `readTimeoutEvidence` asks GitHub whether it killed
+ * a job at its ceiling, and `describeShortfall` says only what came back.
  *
  * A DECISIVE conclusion gets no such suffix. `success` and `failure` already say
  * what happened, and appending job arithmetic to every green is noise.
@@ -2053,6 +2131,43 @@ export function formatFinding(finding) {
  * @param {object|null|undefined} selection - The finding's selection record
  * @returns {string|null} One trailing line, or null when there is nothing to say
  */
+/**
+ * Names why an inconclusive run stopped, to whatever resolution is evidenced.
+ *
+ * Four answers, and the boundary between the last two is the point. A run that
+ * reached no verdict of its own is one of: a duplicate the concurrency group
+ * displaced before it scored anything, a job killed at its `timeout-minutes`
+ * ceiling, an operator pressing cancel, a newer run displacing this one
+ * mid-flight, a runner evicted underneath it, or a `needs:` dependency failing
+ * and taking its dependents with it.
+ *
+ * Only the ceiling kill is a statement about the software or its budget. An
+ * operator cancel is a human decision and says nothing about health, so
+ * reporting the two alike cries wolf: it presents a decision somebody made as a
+ * suite that exhausted its time. It cannot hide a regression in the other
+ * direction — the run is scored and blocks either way, and only the diagnosis
+ * differed — which is why this is a reporting-resolution fix and changes
+ * nothing about which runs are scoreable.
+ *
+ * The residual is named as unattributed rather than as "an operator cancel",
+ * because nothing here proves a human did anything. The evidence available says
+ * a ceiling was hit or does not say so; claiming the negative as a positive
+ * would be the same category error one layer along.
+ * @param {object} selection - The finding's selection record
+ * @returns {string} A clause completing "so it …"
+ */
+function describeShortfall(selection) {
+  if (selection.decisiveJobs === 0) return "tested nothing";
+  if (selection.timedOut === true) return "was killed at a time limit";
+  if (selection.timedOut === false)
+    return (
+      "stopped before finishing, with no time-limit evidence on any " +
+      "unfinished job — an operator cancel, a displaced duplicate, an evicted " +
+      "runner and a failed dependency all land here"
+    );
+  return "ran but did not finish, for a reason this gate could not read";
+}
+
 export function formatSelection(selection) {
   if (!selection) return null;
   const conclusion = selection.conclusion ?? null;
@@ -2061,7 +2176,7 @@ export function formatSelection(selection) {
     typeof selection.decisiveJobs === "number" &&
     typeof selection.totalJobs === "number";
   const cause = counted
-    ? ` — ${selection.decisiveJobs} of ${selection.totalJobs} job(s) reached a verdict, so it ${selection.decisiveJobs === 0 ? "tested nothing" : "ran but did not finish"}`
+    ? ` — ${selection.decisiveJobs} of ${selection.totalJobs} job(s) reached a verdict, so it ${describeShortfall(selection)}`
     : "";
   const scored = `↳ scored run ${selection.runId ?? "?"} (${conclusion ?? "no conclusion"}${cause}, ${selection.createdAt ?? "unknown time"})`;
   const fallback = selection.fellBack
@@ -3350,6 +3465,18 @@ async function selectScoredRun(api, candidates, freshnessHours, now, wait) {
   // honest report is "this was scored because nothing better existed", not a
   // line contradicting itself.
   const skipped = walkedPast.filter(entry => entry.runId !== run.id);
+  const decisiveJobs = countDecisiveJobs(jobs);
+  // Asked only of the one shape that is ambiguous: a run that reached no
+  // verdict of its own yet scored some of its jobs. A decisive run has already
+  // said what happened, and a run with nothing decisive tested nothing — both
+  // are named without this, so neither pays for it. That keeps the common path
+  // at exactly the request count it had before.
+  const timedOut =
+    jobsComplete &&
+    !DECISIVE_CONCLUSIONS.has(run.conclusion ?? null) &&
+    decisiveJobs > 0
+      ? await readTimeoutEvidence(api, jobs, wait)
+      : null;
   return {
     run,
     jobs,
@@ -3360,7 +3487,8 @@ async function selectScoredRun(api, candidates, freshnessHours, now, wait) {
       createdAt: run.created_at ?? null,
       // Carried for the SCORED run too, not only the skipped ones, so an
       // inconclusive verdict can name its cause. See `formatSelection`.
-      decisiveJobs: countDecisiveJobs(jobs),
+      decisiveJobs,
+      timedOut,
       totalJobs: jobs.length,
       fellBack: chosen === null && walkedPast.length > 0,
       skipped: Object.freeze(skipped.map(entry => Object.freeze(entry))),