@codyswann/lisa 4.60.7 → 4.60.9

package/dist/opencode/plugin-templates/lisa-block-instruction-file-edits.ts

@@ -7,9 +7,9 @@
  * session for the project. Agents appending their own findings is how they grow
  * into hundreds of lines of stale, ticket-specific trivia.
  *
- * Port of Lisa's canonical hook `block-instruction-file-edits.sh`. OpenCode
- * exposes only `edit` / `write` filesystem tools (no `apply_patch`), so the file
- * path comes straight from `output.args.filePath`. Throwing in
+ * Adapter for Lisa's hook `block-instruction-file-edits.sh`. This adapter
+ * handles `edit` / `write`; shell screening belongs to the shell dispatcher
+ * where installed. The file path comes from `output.args.filePath`. Throwing in
  * `tool.execute.before` cancels the tool call and surfaces the message to the
  * agent.
  *
@@ -35,10 +35,11 @@ const LisaBlockInstructionFileEdits = async () => {
       const filePath = String(output.args?.filePath ?? "");
       if (!filePath) return;
       if (/(^|\/)(node_modules|dist)\//.test(filePath)) return;
-      // The operator's explicit override, named in the refusal below.
+      // Existing operator-configured override; not proof of conversation approval.
       if (process.env["LISA_ALLOW_INSTRUCTION_FILE_WRITE"]) return;
-      // Lisa's own marker-bounded regions replace in place and cannot grow the
-      // file, so they are never the unbounded append this guard exists to stop.
+      // Existing parity gap: this adapter accepts a content marker; the shell
+      // guard requires bounded old/new replacement pairs. Do not describe this
+      // weaker exemption as authorization or proof that an edit cannot grow.
       if (String(output.args?.content ?? "").includes("<!-- LISA_")) return;
       const base = (filePath.split("/").pop() ?? "").toLowerCase();
       if (!INSTRUCTION_FILES.has(base)) return;
@@ -46,25 +47,27 @@ const LisaBlockInstructionFileEdits = async () => {
         [
           `block-instruction-file-edits: refusing to write ${filePath}.`,
           "",
-          "WHY: this is a session-instruction file, not a place to record what",
-          "you just learned. Every line in it loads into the context of every",
-          "agent, in every future session, in this project, forever. It is",
-          "human-curated on purpose.",
+          "WHY: this session-instruction file is loaded into future agent sessions.",
+          "Appending incidental findings makes every later session carry those notes.",
+          "This adapter cannot read or authenticate conversation approval.",
           "",
-          "WHERE IT GOES INSTEAD — take the first one that fits:",
+          "If an operator already requested a standing-rule edit, that authorization",
+          "is enough for the requested change. Use the relevant topic file in",
+          ".agents/rules/ when no other destination was specified. All six agents",
+          "read it through the existing AGENTS.md pointer. Edit it directly; do not",
+          "require learning capture, another ticket, or repeated approval.",
           "",
-          "1. Every agent needs it every session, only in this project? That is a",
-          "   project rule — capture it with /lisa:persist-learning so it lands in",
-          "   the learnings ledger. The gardener (/lisa:learnings:audit) proposes",
-          "   promotion into the host-rules directory .agents/rules/ as a human-gated ticket.",
-          "2. It changes how an existing skill behaves? Edit that skill's SKILL.md.",
-          "3. It is true beyond this project? Propose it upstream via",
-          "   /lisa:cross-pollinate, or open an issue on CodySwannGT/lisa.",
-          "4. Otherwise it is background, not a standing instruction — write it",
-          "   into the project documentation (wiki/ or docs/).",
+          "If the operator explicitly named this guarded file, preserve that target",
+          "and use the runtime's authorized edit path, or report this restriction.",
+          "Do not silently move the edit, switch tools to evade this refusal, or",
+          "set an override yourself. The existing operator-configured",
+          "LISA_ALLOW_INSTRUCTION_FILE_WRITE=1 escape hatch is not proof of consent.",
           "",
-          "If a human explicitly asked for this edit, re-run with",
-          "LISA_ALLOW_INSTRUCTION_FILE_WRITE=1 set.",
+          "For an agent's own finding, first decide whether it is worth maintaining.",
+          "Decline one-off trivia and unnecessary rules. Durable project knowledge",
+          "can use /lisa:persist-learning; procedures belong with their SKILL.md;",
+          "background belongs in existing documentation. Use /lisa:cross-pollinate",
+          "only for a material, reusable upstream improvement.",
         ].join("\n")
       );
     },

package/package.json

@@ -187,7 +187,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.60.7",
+  "version": "4.60.9",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -336,7 +336,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "df30c717ece730d5fb6e9c4f3a44b9e43bd6cee0",
-  "gitHead": "df30c717ece730d5fb6e9c4f3a44b9e43bd6cee0",
-  "lisaReleaseTag": "v4.60.7"
+  "lisaReleaseCommit": "a751e96b63604310f04fb158b76c8ac632d85852",
+  "gitHead": "a751e96b63604310f04fb158b76c8ac632d85852",
+  "lisaReleaseTag": "v4.60.9"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.60.7",
+  "version": "4.60.9",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.60.7",
+  "version": "4.60.9",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/block-instruction-file-edits.sh

@@ -24,11 +24,9 @@
 #      Reads (`cat AGENTS.md`, `rg pattern AGENTS.md`) never fire.
 #
 # Exemptions (allowed):
-#   - `LISA_ALLOW_INSTRUCTION_FILE_WRITE` set — the operator's explicit override,
-#     named in the refusal so a human who really wants the edit can take it;
-#   - payloads carrying a `<!-- LISA_` marker: Lisa's own marker-bounded regions
-#     (the agy project-learnings bridge, cross-pollinate's rule section) replace
-#     in place on re-run and cannot grow the file;
+#   - `LISA_ALLOW_INSTRUCTION_FILE_WRITE` set in the operator's runtime config.
+#     This cooperative override does not authenticate conversation approval;
+#   - Edit/MultiEdit replacing only bounded `<!-- LISA_` regions on both sides;
 #   - paths under `node_modules/` or `dist/` — vendored copies, not the host's.
 set -euo pipefail
 
@@ -58,8 +56,8 @@ fi
 
 command -v jq >/dev/null 2>&1 || exit 0
 
-# The operator's override. Checked before anything else so it is always the
-# cheapest way out of a refusal a human deliberately wants to overrule.
+# Existing operator-configured override. This hook sees tool payloads, not the
+# conversation; the environment variable is not proof of who approved an edit.
 if [ -n "${LISA_ALLOW_INSTRUCTION_FILE_WRITE:-}" ]; then
   exit 0
 fi
@@ -129,34 +127,27 @@ refuse() {
   cat >&2 <<EOF
 BLOCKED: refusing to write \`$target\`.
 
-WHY: this is a session-instruction file, not a place to record what you just
-learned. Every line in it is loaded into the context of every agent, in every
-future session, in this project, forever. It is human-curated on purpose. An
-agent appending its own findings is how these files grow into hundreds of lines
-of stale, ticket-specific trivia that every later session pays for and half of
-which was only ever true once.
-
-WHERE IT GOES INSTEAD — take the first one that fits:
-
-1. Every agent genuinely needs this in every session, and only in this project.
-   That is a project rule — but do not write it yourself. Capture it with
-   \`/lisa:persist-learning\` so it lands in the learnings ledger with provenance
-   and a confidence score. The gardener (\`/lisa:learnings:audit\`) then proposes
-   promotion into the host-rules directory \`.agents/rules/\` as a human-gated ticket.
-
-2. It changes how an existing skill should behave. Edit that skill's SKILL.md.
-   Knowledge belongs next to the procedure it modifies, not in a global preamble.
-
-3. It is true beyond this project. Propose it upstream to Lisa via
-   \`/lisa:cross-pollinate\`, or open an issue on CodySwannGT/lisa. A local copy of
-   a general rule silently drifts the moment upstream changes.
-
-4. None of the above — it is background someone may want to look up, not a
-   standing instruction. Write it into the project documentation (\`wiki/\` or
-   \`docs/\`).
-
-If a human explicitly asked for this edit, they can re-run with
-\`LISA_ALLOW_INSTRUCTION_FILE_WRITE=1\` set, which bypasses this guard.
+WHY: this session-instruction file is loaded into future agent sessions.
+Appending incidental findings makes every later session carry those notes.
+This hook checks write patterns; it cannot read or authenticate conversation approval.
+
+If an operator already requested a standing-rule edit, that authorization is
+enough for the requested change. Use the relevant topic file in \`.agents/rules/\`
+when no other destination was specified. All six supported agents read that
+directory through the existing \`AGENTS.md\` pointer. Edit it directly; do not
+require learning capture, another ticket, or repeated approval for the same ruling.
+
+If the operator explicitly named this guarded file, preserve that target and
+use the runtime's authorized edit path, or report this remaining restriction.
+Do not silently move the edit, switch tools to evade this refusal, or set an
+override yourself. The existing operator-configured
+\`LISA_ALLOW_INSTRUCTION_FILE_WRITE=1\` escape hatch is not proof of consent.
+
+For an agent's own finding, first decide whether it is worth maintaining.
+Decline one-off trivia and unnecessary rules. Durable project knowledge can
+use \`/lisa:persist-learning\`; procedural knowledge belongs with its SKILL.md;
+background belongs in existing project documentation. Use
+\`/lisa:cross-pollinate\` only for a material, reusable upstream improvement.
 EOF
   exit 2
 }

package/plugins/lisa/rules/reference/config-resolution.md

@@ -286,7 +286,7 @@ fi
 Host-authored operating rules live in `.agents/rules/` — **fixed, not configurable**. One directory, every agent.
 
 - **Not a native auto-load tree.** `.claude/rules`, `.cursor/rules`, and `.github/instructions` are; `.agents/rules` deliberately is not. Every agent reaches it through the single Lisa-managed pointer block in `AGENTS.md` (Claude via the `@AGENTS.md` import in `CLAUDE.md`), so no agent loads host rules twice.
-- **Host-owned.** Lisa never writes rule bodies into `.agents/rules/`, and never edits or deletes a file there. Lisa's own rules originate in its plugins and arrive by their own route.
+- **Host-owned.** Lisa's installer never overwrites host rule bodies. Agents may make specific operator-requested edits directly, without recapturing the approved decision as a learning or promotion ticket; see **Operator-directed standing rules** in `project-learnings.md`. Lisa's own rules arrive through its plugins.
 - **Not the learnings ledger.** `.agents/rules` is reserved in the auto-loaded-tree blocklist, so a `learnings.file` override can never resolve inside it.
 - **Transition.** A project that still has the retired `.claude/rules/PROJECT_RULES.md` keeps it, untouched and authoritative. The pointer block names it so agents whose runtime does not auto-load `.claude/rules/` still find it. Moving that content is a human-gated decision, never an automated rewrite.
 

package/plugins/lisa/rules/reference/project-learnings.md

@@ -81,10 +81,35 @@ collide.
 - The **build-intake flows** advance `last_confirmed` at claim time
   (`confirmLearningEntry`, below).
 
-Promotion to a higher rung (skill, eager rule, executable control, upstream
-ticket) is never a writer here — it is the gardener's job, gated by a human
+Automated promotion of a captured learning to a higher rung (skill, eager rule,
+executable control, upstream ticket) is the gardener's job, gated by a human
 flipping a tracker ticket to `status:ready`.
 
+## Operator-directed standing rules
+
+An operator's instruction to add, revise, or remove a standing rule is already
+authorization for that specific edit. It is not a new machine-captured learning.
+Make the requested change directly, preserving unrelated content; do not require
+learning capture, a promotion ticket, or repeated approval for the same decision.
+"Human-authored" describes who controls the rule, not who types the approved edit.
+
+Use the existing topic file under `.agents/rules/`, or create a short one there,
+when the operator has not specified another destination. The `AGENTS.md` host-rules
+pointer reaches Claude Code, Codex, Cursor, OpenCode, Antigravity, and Copilot.
+These shared rules are not a Claude-only surface, and they do not need to be
+copied into every agent's startup file.
+
+If the operator explicitly named a guarded startup file, do not substitute a
+different destination or switch tools to evade a refusal. Use the runtime's
+authorized edit path, or report the specific remaining runtime restriction.
+The existing instruction-file override is an operator-configured escape hatch,
+not proof of human approval; agents must not set it to work around a refusal.
+No new approval token is needed for ordinary authorized edits to shared host rules.
+
+This does not authorize agents to promote their own incidental findings. Decline
+one-off notes and unnecessary rules; use the existing learning flow only for
+durable knowledge worth maintaining.
+
 ## Claim-time confirmation (`last_confirmed`)
 
 `last_confirmed` is advanced at claim time by the build-intake flows (step
@@ -111,7 +136,7 @@ warning, apply no entry, and do not block unrelated work.
 Precedence:
 
 1. System, developer, user, and repo instructions still outrank learnings.
-2. Committed host rules (`.agents/rules/`) remain durable human-authored
+2. Committed host rules (`.agents/rules/`) remain durable, operator-controlled
    guidance.
 3. Project learnings add recent operational knowledge, but never rewrite or
    append to host rules.

package/plugins/lisa-agy/hooks/block-instruction-file-edits.sh

@@ -24,11 +24,9 @@
 #      Reads (`cat AGENTS.md`, `rg pattern AGENTS.md`) never fire.
 #
 # Exemptions (allowed):
-#   - `LISA_ALLOW_INSTRUCTION_FILE_WRITE` set — the operator's explicit override,
-#     named in the refusal so a human who really wants the edit can take it;
-#   - payloads carrying a `<!-- LISA_` marker: Lisa's own marker-bounded regions
-#     (the agy project-learnings bridge, cross-pollinate's rule section) replace
-#     in place on re-run and cannot grow the file;
+#   - `LISA_ALLOW_INSTRUCTION_FILE_WRITE` set in the operator's runtime config.
+#     This cooperative override does not authenticate conversation approval;
+#   - Edit/MultiEdit replacing only bounded `<!-- LISA_` regions on both sides;
 #   - paths under `node_modules/` or `dist/` — vendored copies, not the host's.
 set -euo pipefail
 
@@ -58,8 +56,8 @@ fi
 
 command -v jq >/dev/null 2>&1 || exit 0
 
-# The operator's override. Checked before anything else so it is always the
-# cheapest way out of a refusal a human deliberately wants to overrule.
+# Existing operator-configured override. This hook sees tool payloads, not the
+# conversation; the environment variable is not proof of who approved an edit.
 if [ -n "${LISA_ALLOW_INSTRUCTION_FILE_WRITE:-}" ]; then
   exit 0
 fi
@@ -129,34 +127,27 @@ refuse() {
   cat >&2 <<EOF
 BLOCKED: refusing to write \`$target\`.
 
-WHY: this is a session-instruction file, not a place to record what you just
-learned. Every line in it is loaded into the context of every agent, in every
-future session, in this project, forever. It is human-curated on purpose. An
-agent appending its own findings is how these files grow into hundreds of lines
-of stale, ticket-specific trivia that every later session pays for and half of
-which was only ever true once.
-
-WHERE IT GOES INSTEAD — take the first one that fits:
-
-1. Every agent genuinely needs this in every session, and only in this project.
-   That is a project rule — but do not write it yourself. Capture it with
-   \`/lisa:persist-learning\` so it lands in the learnings ledger with provenance
-   and a confidence score. The gardener (\`/lisa:learnings:audit\`) then proposes
-   promotion into the host-rules directory \`.agents/rules/\` as a human-gated ticket.
-
-2. It changes how an existing skill should behave. Edit that skill's SKILL.md.
-   Knowledge belongs next to the procedure it modifies, not in a global preamble.
-
-3. It is true beyond this project. Propose it upstream to Lisa via
-   \`/lisa:cross-pollinate\`, or open an issue on CodySwannGT/lisa. A local copy of
-   a general rule silently drifts the moment upstream changes.
-
-4. None of the above — it is background someone may want to look up, not a
-   standing instruction. Write it into the project documentation (\`wiki/\` or
-   \`docs/\`).
-
-If a human explicitly asked for this edit, they can re-run with
-\`LISA_ALLOW_INSTRUCTION_FILE_WRITE=1\` set, which bypasses this guard.
+WHY: this session-instruction file is loaded into future agent sessions.
+Appending incidental findings makes every later session carry those notes.
+This hook checks write patterns; it cannot read or authenticate conversation approval.
+
+If an operator already requested a standing-rule edit, that authorization is
+enough for the requested change. Use the relevant topic file in \`.agents/rules/\`
+when no other destination was specified. All six supported agents read that
+directory through the existing \`AGENTS.md\` pointer. Edit it directly; do not
+require learning capture, another ticket, or repeated approval for the same ruling.
+
+If the operator explicitly named this guarded file, preserve that target and
+use the runtime's authorized edit path, or report this remaining restriction.
+Do not silently move the edit, switch tools to evade this refusal, or set an
+override yourself. The existing operator-configured
+\`LISA_ALLOW_INSTRUCTION_FILE_WRITE=1\` escape hatch is not proof of consent.
+
+For an agent's own finding, first decide whether it is worth maintaining.
+Decline one-off trivia and unnecessary rules. Durable project knowledge can
+use \`/lisa:persist-learning\`; procedural knowledge belongs with its SKILL.md;
+background belongs in existing project documentation. Use
+\`/lisa:cross-pollinate\` only for a material, reusable upstream improvement.
 EOF
   exit 2
 }

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.60.7",
+  "version": "4.60.9",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.60.7",
+  "version": "4.60.9",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.60.7",
+  "version": "4.60.9",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.60.7",
+  "version": "4.60.9",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.60.7",
+  "version": "4.60.9",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.60.7",
+  "version": "4.60.9",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.60.7",
+  "version": "4.60.9",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/block-instruction-file-edits.sh

@@ -24,11 +24,9 @@
 #      Reads (`cat AGENTS.md`, `rg pattern AGENTS.md`) never fire.
 #
 # Exemptions (allowed):
-#   - `LISA_ALLOW_INSTRUCTION_FILE_WRITE` set — the operator's explicit override,
-#     named in the refusal so a human who really wants the edit can take it;
-#   - payloads carrying a `<!-- LISA_` marker: Lisa's own marker-bounded regions
-#     (the agy project-learnings bridge, cross-pollinate's rule section) replace
-#     in place on re-run and cannot grow the file;
+#   - `LISA_ALLOW_INSTRUCTION_FILE_WRITE` set in the operator's runtime config.
+#     This cooperative override does not authenticate conversation approval;
+#   - Edit/MultiEdit replacing only bounded `<!-- LISA_` regions on both sides;
 #   - paths under `node_modules/` or `dist/` — vendored copies, not the host's.
 set -euo pipefail
 
@@ -58,8 +56,8 @@ fi
 
 command -v jq >/dev/null 2>&1 || exit 0
 
-# The operator's override. Checked before anything else so it is always the
-# cheapest way out of a refusal a human deliberately wants to overrule.
+# Existing operator-configured override. This hook sees tool payloads, not the
+# conversation; the environment variable is not proof of who approved an edit.
 if [ -n "${LISA_ALLOW_INSTRUCTION_FILE_WRITE:-}" ]; then
   exit 0
 fi
@@ -129,34 +127,27 @@ refuse() {
   cat >&2 <<EOF
 BLOCKED: refusing to write \`$target\`.
 
-WHY: this is a session-instruction file, not a place to record what you just
-learned. Every line in it is loaded into the context of every agent, in every
-future session, in this project, forever. It is human-curated on purpose. An
-agent appending its own findings is how these files grow into hundreds of lines
-of stale, ticket-specific trivia that every later session pays for and half of
-which was only ever true once.
-
-WHERE IT GOES INSTEAD — take the first one that fits:
-
-1. Every agent genuinely needs this in every session, and only in this project.
-   That is a project rule — but do not write it yourself. Capture it with
-   \`/lisa:persist-learning\` so it lands in the learnings ledger with provenance
-   and a confidence score. The gardener (\`/lisa:learnings:audit\`) then proposes
-   promotion into the host-rules directory \`.agents/rules/\` as a human-gated ticket.
-
-2. It changes how an existing skill should behave. Edit that skill's SKILL.md.
-   Knowledge belongs next to the procedure it modifies, not in a global preamble.
-
-3. It is true beyond this project. Propose it upstream to Lisa via
-   \`/lisa:cross-pollinate\`, or open an issue on CodySwannGT/lisa. A local copy of
-   a general rule silently drifts the moment upstream changes.
-
-4. None of the above — it is background someone may want to look up, not a
-   standing instruction. Write it into the project documentation (\`wiki/\` or
-   \`docs/\`).
-
-If a human explicitly asked for this edit, they can re-run with
-\`LISA_ALLOW_INSTRUCTION_FILE_WRITE=1\` set, which bypasses this guard.
+WHY: this session-instruction file is loaded into future agent sessions.
+Appending incidental findings makes every later session carry those notes.
+This hook checks write patterns; it cannot read or authenticate conversation approval.
+
+If an operator already requested a standing-rule edit, that authorization is
+enough for the requested change. Use the relevant topic file in \`.agents/rules/\`
+when no other destination was specified. All six supported agents read that
+directory through the existing \`AGENTS.md\` pointer. Edit it directly; do not
+require learning capture, another ticket, or repeated approval for the same ruling.
+
+If the operator explicitly named this guarded file, preserve that target and
+use the runtime's authorized edit path, or report this remaining restriction.
+Do not silently move the edit, switch tools to evade this refusal, or set an
+override yourself. The existing operator-configured
+\`LISA_ALLOW_INSTRUCTION_FILE_WRITE=1\` escape hatch is not proof of consent.
+
+For an agent's own finding, first decide whether it is worth maintaining.
+Decline one-off trivia and unnecessary rules. Durable project knowledge can
+use \`/lisa:persist-learning\`; procedural knowledge belongs with its SKILL.md;
+background belongs in existing project documentation. Use
+\`/lisa:cross-pollinate\` only for a material, reusable upstream improvement.
 EOF
   exit 2
 }

package/plugins/lisa-copilot/rules/reference/config-resolution.md

@@ -286,7 +286,7 @@ fi
 Host-authored operating rules live in `.agents/rules/` — **fixed, not configurable**. One directory, every agent.
 
 - **Not a native auto-load tree.** `.claude/rules`, `.cursor/rules`, and `.github/instructions` are; `.agents/rules` deliberately is not. Every agent reaches it through the single Lisa-managed pointer block in `AGENTS.md` (Claude via the `@AGENTS.md` import in `CLAUDE.md`), so no agent loads host rules twice.
-- **Host-owned.** Lisa never writes rule bodies into `.agents/rules/`, and never edits or deletes a file there. Lisa's own rules originate in its plugins and arrive by their own route.
+- **Host-owned.** Lisa's installer never overwrites host rule bodies. Agents may make specific operator-requested edits directly, without recapturing the approved decision as a learning or promotion ticket; see **Operator-directed standing rules** in `project-learnings.md`. Lisa's own rules arrive through its plugins.
 - **Not the learnings ledger.** `.agents/rules` is reserved in the auto-loaded-tree blocklist, so a `learnings.file` override can never resolve inside it.
 - **Transition.** A project that still has the retired `.claude/rules/PROJECT_RULES.md` keeps it, untouched and authoritative. The pointer block names it so agents whose runtime does not auto-load `.claude/rules/` still find it. Moving that content is a human-gated decision, never an automated rewrite.
 

package/plugins/lisa-copilot/rules/reference/project-learnings.md

@@ -81,10 +81,35 @@ collide.
 - The **build-intake flows** advance `last_confirmed` at claim time
   (`confirmLearningEntry`, below).
 
-Promotion to a higher rung (skill, eager rule, executable control, upstream
-ticket) is never a writer here — it is the gardener's job, gated by a human
+Automated promotion of a captured learning to a higher rung (skill, eager rule,
+executable control, upstream ticket) is the gardener's job, gated by a human
 flipping a tracker ticket to `status:ready`.
 
+## Operator-directed standing rules
+
+An operator's instruction to add, revise, or remove a standing rule is already
+authorization for that specific edit. It is not a new machine-captured learning.
+Make the requested change directly, preserving unrelated content; do not require
+learning capture, a promotion ticket, or repeated approval for the same decision.
+"Human-authored" describes who controls the rule, not who types the approved edit.
+
+Use the existing topic file under `.agents/rules/`, or create a short one there,
+when the operator has not specified another destination. The `AGENTS.md` host-rules
+pointer reaches Claude Code, Codex, Cursor, OpenCode, Antigravity, and Copilot.
+These shared rules are not a Claude-only surface, and they do not need to be
+copied into every agent's startup file.
+
+If the operator explicitly named a guarded startup file, do not substitute a
+different destination or switch tools to evade a refusal. Use the runtime's
+authorized edit path, or report the specific remaining runtime restriction.
+The existing instruction-file override is an operator-configured escape hatch,
+not proof of human approval; agents must not set it to work around a refusal.
+No new approval token is needed for ordinary authorized edits to shared host rules.
+
+This does not authorize agents to promote their own incidental findings. Decline
+one-off notes and unnecessary rules; use the existing learning flow only for
+durable knowledge worth maintaining.
+
 ## Claim-time confirmation (`last_confirmed`)
 
 `last_confirmed` is advanced at claim time by the build-intake flows (step
@@ -111,7 +136,7 @@ warning, apply no entry, and do not block unrelated work.
 Precedence:
 
 1. System, developer, user, and repo instructions still outrank learnings.
-2. Committed host rules (`.agents/rules/`) remain durable human-authored
+2. Committed host rules (`.agents/rules/`) remain durable, operator-controlled
    guidance.
 3. Project learnings add recent operational knowledge, but never rewrite or
    append to host rules.

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.60.7",
+  "version": "4.60.9",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"