@codyswann/lisa 4.64.0 → 4.64.2

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.64.0",
+  "version": "4.64.2",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/rules/eager/tool-access-gate.md

@@ -1,21 +1,23 @@
 # Tool Access Gate (load-bearing)
 
+- If you can't reach something you need, such as a repository, a secret, an API, or a connector, say exactly what's missing in your first message and stop. Don't substitute, mock, or guess.
+
+If the missing access is discovered after work begins, say exactly what's
+missing in your next message and stop.
+
 Only take on work you can finish. Before implementation starts — and again the
 moment a new requirement surfaces mid-flow — enumerate every external tool the
 work item needs (implementation, proof command, remote verification: AWS CLI,
 Figma, Jam, Sentry, SonarCloud, PostHog, device/browser harnesses, databases,
 deploy targets, …) and **prove access with a cheap read-only probe**, routing
-through the matching `*-access` skill where one exists. Presence on PATH is not
-access; a probe failure counts only after exhausting documented credential
-sources.
+through the matching `*-access` skill where one exists. Resolve credentials through the documented access path before probing;
+presence on PATH is not access. If that path or the probe cannot provide the
+required access, report the gap and stop.
 
-If a required tool is inaccessible: **break out — never work around it.** Post
-an "Access Needed" comment on the work item (plain-English summary, the exact
-credential/role/env var to grant, and the probe that must pass), transition it
-to the configured blocked state with the `human_needed` marker, and write a
-`blocked` verification verdict. Substituting weaker verification, mocking the
-inaccessible system, guessing at tool contents, or narrowing scope to dodge the
-gap are all forbidden.
+The message must name the missing resource, the operation it blocks, and any
+known access requirement, without exposing secret values. Substituting weaker
+verification, mocking the inaccessible system, guessing at its contents, or
+narrowing scope to dodge the gap are all forbidden.
 
-Full contract (probe table, comment format, resume path):
+Full contract (probe table, blocker report, resume path):
 [reference/tool-access-gate.md](../reference/tool-access-gate.md).

package/plugins/src/base/rules/reference/design-source-of-truth.md

@@ -1,18 +1,41 @@
 # Design Source of Truth
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
-> section below is the former eager head, preserved verbatim; the full
+> section below is the former eager head, maintained with the full
 > contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Design Source of Truth (load-bearing)
 
-**Figma is the design source of truth, and every UI surface a change touches declares where its design came from.** A changed UI surface that neither cites a Figma node nor carries the designated marker is a contract violation — and so is a surface whose declaration the gate cannot resolve.
+**When enabled, Figma is the design source of truth, and every UI surface a change touches declares where its design came from.** A changed UI surface that neither cites a Figma node nor carries the designated marker is a contract violation — and so is a surface whose declaration the gate cannot resolve.
 
 **One vendor-neutral contract, cited by** `lisa-implement`, `lisa-tdd-implementation`, `lisa-review-local`, `lisa-quality-review`, and `lisa-tracker-source-artifacts` (the `leaf-only-lifecycle` / `repo-scope-split` precedent: one shared slug, never divergent per-skill prose).
 
+## Explicit project opt-out
+
+A project with **no design source at all** may set this in `.lisa.config.json`:
+
+```json
+{ "designSource": { "enabled": false } }
+```
+
+Only `designSource.enabled` set to boolean `false` opts out. Absent, true, and
+invalid values retain the default enforcement. The explicit configuration is
+the auditable record; it replaces per-file exception markers for this project.
+The gate exits 0 with `SKIPPED: designSource.enabled=false` before resolving the
+diff. JSON output reports `verdict: "SKIPPED"`, the config key in `reasons`, and
+zero judged surfaces. A skip does not claim that surfaces passed inspection.
+
+When opted out, the five consuming skills omit the design-source step from
+plans, tickets, teammate instructions, and review; they do not ask for markers,
+Figma nodes, or Figma access for this obligation. All declaration, sync-back,
+and fail-closed requirements below apply only when enabled. Host design-system
+rules, `design-value-binding`, and `bdd-e2e-coverage` remain independent and
+unchanged. A project that has Figma must still not use `exclude` to hide its UI
+tree from this contract.
+
 ## Membership
 
-Membership is **surface, not repo name or file extension**: a file is in scope the moment a change makes it render something user-observable — a screen, component, layout, style token, visual state, or markup a user reads. Barrels, pure-logic modules, tests, stories, generated output, and vendored code are out. Projects narrow or widen the default detection through `designSource.include` / `designSource.exclude` in `.lisa.config.json`; they never turn the obligation off.
+Membership is **surface, not repo name or file extension**: a file is in scope the moment a change makes it render something user-observable — a screen, component, layout, style token, visual state, or markup a user reads. Barrels, pure-logic modules, tests, stories, generated output, and vendored code are out. Projects narrow or widen the default detection through `designSource.include` / `designSource.exclude` in `.lisa.config.json`; those filters never turn the obligation off. Only the explicit project opt-out above does.
 
 ## The two declarations
 
@@ -39,7 +62,7 @@ Projects that carry their own design-system rules (`figma-design-system`, `desig
 
 ## Bootstrap and degradation
 
-Adoption never demands a retroactive backfill: the gate judges **only the surfaces this change touched**. Pre-existing unannotated UI is burndown, recorded and worked down, not this work item's blocker. If a project has no Figma at all, that is not an exemption — every changed surface carries the marker, and the resulting exception list is the honest record of how much of the product lives outside its design source. Behavior obligations for the same surfaces are unchanged and still governed by `bdd-e2e-coverage`.
+Adoption never demands a retroactive backfill: the gate judges **only the surfaces this change touched**. Pre-existing unannotated UI is burndown, recorded and worked down, not this work item's blocker. A project with no design source may use the explicit project opt-out above; otherwise every changed surface still needs a declaration. Behavior obligations for the same surfaces are unchanged and still governed by `bdd-e2e-coverage`.
 
 ---
 
@@ -188,7 +211,7 @@ Two consequences worth stating plainly:
 node design-source-gate.mjs --base=origin/main [--head=HEAD] [--figma-access] [--json]
 ```
 
-Exit `0` = PASS, `1` = FAIL, `2` = usage error. It classifies every changed file into one status:
+Exit `0` = PASS or explicit SKIPPED, `1` = FAIL, `2` = usage error. When enabled, it classifies every changed file into one status:
 
 | Status | Verdict | Meaning |
 |---|---|---|
@@ -231,8 +254,7 @@ so a repository with hundreds of unannotated legacy components can adopt the con
 and be green on Tuesday. Pre-existing unannotated UI is **burndown**: recorded, worked down
 opportunistically as files are touched, never treated as the current work item's blocker.
 
-A project with no Figma at all is not exempt. Every changed surface carries the marker, and the
-resulting exception list is the honest, mounting record of how much of the product lives outside its
-design source — which is far more useful than an exemption flag that makes the question disappear.
-Deleting or excluding a surface to make the gate green is a violation of the same kind as deleting a
-BDD scenario to improve coverage: mark it, do not drop it.
+A project with no design source may opt out explicitly using `designSource.enabled: false`.
+Without that explicit opt-out, every changed surface still declares its source. In an enabled
+project, deleting or excluding a surface to make the gate green is a violation of the same kind as
+deleting a BDD scenario to improve coverage: mark it, do not drop it.

package/plugins/src/base/rules/reference/tool-access-gate.md

@@ -1,9 +1,14 @@
 # Tool Access Gate
 
+- If you can't reach something you need, such as a repository, a secret, an API, or a connector, say exactly what's missing in your first message and stop. Don't substitute, mock, or guess.
+
+If the missing access is discovered after work begins, say exactly what's
+missing in your next message and stop.
+
 A flow may only take on work it can actually finish. If completing a work item —
 including its empirical verification — requires an external tool or system the
-agent cannot access, the flow must **break out and report the missing access on
-the work item**, never work around it. This is the flow-side arm of the factory
+agent cannot access, the flow must **tell the user exactly what access is missing and stop**, never
+work around it. This is the flow-side arm of the factory
 contract: intake validates that the factory has "the tooling *and provable
 access to that tooling*"; this gate re-proves that promise at execution time and
 enforces it for tools discovered mid-flow.
@@ -31,7 +36,8 @@ enforces it for tools discovered mid-flow.
    environment.
 2. **Continuously** — the moment a previously unknown tool requirement surfaces
    mid-flow (e.g. verification turns out to need CloudWatch log capture), probe
-   it right then and record the new tool + probe result in the same places the
+   it right then. If access is unavailable, report it and stop. Otherwise, record
+   the new tool + probe result in the same places the
    preflight wrote to (the plan/tracker artifact and the affected tasks'
    `metadata.required_access`) before continuing. Discovery timing changes
    nothing about the protocol.
@@ -62,44 +68,31 @@ Example probes:
 | Deploy target | reach the target environment with the credentials the verify step will use |
 | Device/browser harness | the harness's own doctor/smoke entry (e.g. `playwright --version` plus a trivial headless launch) |
 
-A probe failure only counts **after exhausting the documented credential
-sources** (the same order the `verification` rule mandates): project e2e
-config/fixtures, `.lisa.config.local.json` and environment variables, then
-documented work-item credentials (e.g. `Sign-in Required`). Missing access you
-could have resolved from those sources is not a blocker — resolve it and
-proceed.
+Resolve credentials through the documented sources before probing: project
+e2e config/fixtures, `.lisa.config.local.json` and environment variables, then
+documented work-item credentials (e.g. `Sign-in Required`). If the documented
+access path or probe cannot provide the required access, report the gap and
+stop. Do not continue exploring substitute sources after confirming the gap.
 
-Record the enumeration and probe results in the flow's plan/tracker artifact
+Record successful probes in the flow's plan/tracker artifact
 (and task `metadata.required_access` where the flow's task contract carries
 it), so the verifier can confirm the gate ran.
 
 ## On failure: break out, never work around
 
-When a required tool fails its probe:
-
-1. **Stop the affected work immediately.** Do not start (or continue)
-   implementation whose completion condition cannot be proven.
-2. **Update the work item with an "Access Needed" comment** containing, for
-   each missing tool:
-   - a one-sentence plain-English summary a non-technical operator can act on
-     ("Lisa needs read access to the app's AWS logs to prove this fix works");
-   - the tool and the operation it is needed for (which acceptance criterion /
-     verification step);
-   - the exact access to grant: env var name, credential/role/permission, or
-     account invitation required;
-   - the probe command that must pass once access is granted.
-3. **Transition the work item to the configured blocked state** and apply the
-   configured `human_needed` / needs-human marker — missing access is a
-   **human-only blocker** (someone must provision credentials or grant access);
-   do not fabricate a build-ready ticket for it.
-4. **Release the verification gate honestly**: write the verdict with
-   `status: "blocked"`, and mark each acceptance criterion whose proof depends
-   on the missing tool as `status: "blocked"` with the missing-access
-   diagnosis as its `evidence`; unaffected criteria keep their real
-   `pass`/`fail` result.
-5. **Resume only when the probe passes.** When access is granted, re-run the
-   recorded probe before continuing; `repair-intake` re-validates blocked items
-   whose blockers cleared.
+When required access is unavailable, tell the user and stop. Use the first
+message if the gap is already known, or the next message if it is discovered
+mid-task. The message must state:
+
+- the exact resource that cannot be reached and the operation it blocks;
+- the observed failure and, if known, the credential name, role, permission, or
+  invitation needed — never secret values, and never a guessed diagnosis;
+- the read-only probe that must pass before work can resume.
+
+Do not substitute, mock, guess, or continue other tasks as a workaround.
+Reporting does not depend on access to a tracker, and it does not require
+creating a new ticket. Resume after the required access is available and its
+probe passes.
 
 ### Forbidden workarounds
 
@@ -116,6 +109,6 @@ None of the following ever substitutes for missing access:
   ticket points at).
 - Silently narrowing scope so the inaccessible part is "out of scope".
 
-If a *partial* set of tasks is unaffected by the missing access, those tasks may
-complete, but the work item as a whole must not be marked terminal-done while
-any acceptance criterion's proof is blocked on access.
+Keep results already obtained, but stop further work until the required access
+is available. An inaccessible tracker does not prevent reporting the blocker
+to the user. Do not claim blocked acceptance criteria have passed.