@codyswann/lisa 4.69.4 → 4.70.0

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.69.4",
+  "version": "4.70.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/rails/copy-overwrite/.rubocop.yml

@@ -16,8 +16,6 @@ plugins:
   - rubocop-rspec
   - rubocop-capybara
   - rubocop-factory_bot
-
-require:
   - rubocop-yard
 
 AllCops:

package/rails/copy-overwrite/Gemfile.lisa

@@ -13,16 +13,16 @@ group :development, :test do
   gem "rubocop-rails", "~> 2.30", require: false
   gem "rubocop-performance", "~> 1.24", require: false
   gem "rubocop-rspec", "~> 3.5", require: false
-  gem "rubocop-capybara", "~> 2.22", require: false
+  gem "rubocop-capybara", "~> 3.0", require: false
   gem "rubocop-factory_bot", "~> 2.26", require: false
-  gem "rubocop-yard", "~> 0.9", require: false
+  gem "rubocop-yard", "~> 1.3", require: false
 
   # Testing
-  gem "rspec-rails", "~> 7.1"
+  gem "rspec-rails", "~> 8.0"
   gem "factory_bot_rails", "~> 6.4"
   gem "faker", "~> 3.5"
-  gem "shoulda-matchers", "~> 6.4"
-  gem "simplecov", "~> 0.22", require: false
+  gem "shoulda-matchers", "~> 8.0", ">= 8.0.1"
+  gem "simplecov", "~> 1.3", ">= 1.3.2", require: false
   gem "webmock", "~> 3.24"
   gem "vcr", "~> 6.3"
 
@@ -37,20 +37,20 @@ group :development, :test do
   gem "mutant-rspec", "~> 0.12", require: false
 
   # Security
-  gem "brakeman", "~> 7.0", require: false
+  gem "brakeman", "~> 8.1", require: false
   gem "bundler-audit", "~> 0.9", require: false
 
   # Documentation
   gem "yard", "~> 0.9", require: false
 
   # Database Quality
-  gem "database_consistency", "~> 1.7", require: false
+  gem "database_consistency", "~> 3.0", require: false
 end
 
 group :development do
   # Performance
   gem "bullet", "~> 8.0"
-  gem "rack-mini-profiler", "~> 3.3"
+  gem "rack-mini-profiler", "~> 5.0"
 
   # Git Hooks
   gem "lefthook", require: false

package/rails/copy-overwrite/lefthook.yml

@@ -33,7 +33,8 @@ commit-msg:
 pre-push:
   commands:
     work-item:
-      run: node scripts/lisa-work-item.mjs validate-push {1}
+      run: >-
+        node --input-type=module -e 'try { const { main } = await import("./scripts/lisa-rails-prepush.mjs"); process.exitCode = await main(process.argv.slice(1)); } catch { console.error("Managed Rails push tooling is unavailable or damaged. Run full Lisa apply and retry; raw bootstrap errors are withheld."); process.exitCode = 1; }' {1}
       use_stdin: true
     rspec:
       # One supervisor boundary: run-scoped scratch, an outside cleanup

package/rails/create-only/.simplecov

@@ -9,21 +9,23 @@ thresholds = if File.exist?(thresholds_path)
                { 'line' => 80, 'branch' => 70 }
              end
 
-SimpleCov.start 'rails' do
-  enable_coverage :branch
+SimpleCov.load_profile 'rails'
 
-  minimum_coverage line: thresholds['line'], branch: thresholds['branch']
+SimpleCov.configure do
+  deprecations :raise
+  coverage :line, minimum: thresholds['line']
+  coverage :branch, minimum: thresholds['branch']
 
-  add_group 'Models', 'app/models'
-  add_group 'Controllers', 'app/controllers'
-  add_group 'Services', 'app/services'
-  add_group 'Jobs', 'app/jobs'
-  add_group 'Mailers', 'app/mailers'
-  add_group 'Serializers', 'app/serializers'
-  add_group 'Libraries', 'lib'
+  group 'Models', 'app/models'
+  group 'Controllers', 'app/controllers'
+  group 'Services', 'app/services'
+  group 'Jobs', 'app/jobs'
+  group 'Mailers', 'app/mailers'
+  group 'Serializers', 'app/serializers'
+  group 'Libraries', 'lib'
 
-  add_filter '/spec/'
-  add_filter '/config/'
-  add_filter '/db/'
-  add_filter '/vendor/'
+  skip '/spec/'
+  skip '/config/'
+  skip '/db/'
+  skip '/vendor/'
 end

package/rails/create-only/spec/spec_helper.rb

@@ -1,8 +1,10 @@
 # frozen_string_literal: true
+
 # Seeded by Lisa on first setup — this file is YOURS.
 # Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
 
 require 'simplecov'
+SimpleCov.start
 
 RSpec.configure do |config|
   config.expect_with :rspec do |expectations|

package/scripts/two-channel-couplings.json

@@ -4,6 +4,10 @@
     "quality.yml::scripts/generate-nightly-e2e-guard-certificate.mjs": "Lisa-source-only branch. Both reusable jobs require `github.repository == 'CodySwannGT/lisa'` before the step can start, and the run body repeats that exact repository guard before checking this artifact path. Ordinary and private host callers therefore skip the step without reading or fetching from their own tree. The scoped branch fetches only the immutable refs needed to behavior-test Lisa's own retained certificate inputs. Ratified because the caller-tree read is unreachable outside this repository, not because an undelivered host dependency is tolerated."
   },
   "staleness": {
+    "history-secrets.yml::scripts/lib/history-secret-policy.mjs": {
+      "decision": "warranted",
+      "reason": "Verdict-bearing required route delivered through full Lisa apply. An absent policy helper fails its import with static actionable guidance; the existence test chooses the emitted or Lisa-source directory and does not measure age. A successful historyPolicy import and required builtin resolution establish capability only. Neither the reusable workflow's contract major nor the pinned Gitleaks binary checksum/version establishes the installed policy/range helper's contract version. A superseded helper could interpret the declaration or required facade differently, so an artifact version handshake is warranted and remains an open obligation rather than a claimed handshake or exemption."
+    },
     "create-github-issue-on-failure.yml::scripts/nightly-e2e-provider-action.mjs": {
       "decision": "not-needed",
       "reason": "Advisory transport, not a verdict. The script files and reconciles a tracker issue about a nightly run that has ALREADY failed; it posts no check context and no job depends on its answer. A superseded copy files a differently-shaped issue, which lands in front of a human who can see it — the visible failure, not the believed-red one this dimension exists to catch. A handshake here would gate issue filing on a version comparison and buy no cover."
@@ -94,14 +98,14 @@
     }
   },
   "inspected": {
-    "workflows": 23,
-    "steps": 786,
-    "couplings": 33,
-    "inventory": 90
+    "workflows": 24,
+    "steps": 789,
+    "couplings": 34,
+    "inventory": 95
   },
   "counts": {
     "package-backed": 10,
-    "apply-lagged": 21,
+    "apply-lagged": 22,
     "never-delivered": 0,
     "undelivered": 2
   },
@@ -109,13 +113,13 @@
     "version-handshake": 4,
     "capability-probe": 0,
     "existence-only": 5,
-    "no-probe": 12,
+    "no-probe": 13,
     "unchecked": 2
   },
   "decisionCounts": {
     "handshake": 4,
     "not-needed": 11,
-    "warranted": 8
+    "warranted": 9
   },
   "couplings": [
     {
@@ -190,6 +194,26 @@
       ],
       "detail": "`create-sentry-issue-on-failure.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/nightly-e2e-provider-action.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text carries none of the tokens this scan can see (`else-branch`, `exit-zero`, `exit-nonzero`, `error-annotation`, `notice-annotation`, `failure-suppression`), which is a statement about those names and not about the step's behaviour. STALENESS (a separate dimension from the delivery verdict above): `no-probe`. Neither an existence test nor a version probe bears on this read, so nothing here distinguishes a current artifact from an absent or a superseded one. None of the staleness tokens this scan can see (`artifact-declares-version`, `artifact-answers-version`, `step-requests-version`, `workflow-requests-version`) were found."
     },
+    {
+      "key": "history-secrets.yml::scripts/lib/history-secret-policy.mjs",
+      "workflow": "history-secrets.yml",
+      "path": "scripts/lib/history-secret-policy.mjs",
+      "channel": "apply",
+      "verdict": "apply-lagged",
+      "remedy": "run-lisa-apply",
+      "guarded": false,
+      "handling": [
+        "else-branch"
+      ],
+      "detection": "no-probe",
+      "stalenessSignals": [],
+      "decision": "warranted",
+      "reason": "Verdict-bearing required route delivered through full Lisa apply. An absent policy helper fails its import with static actionable guidance; the existence test chooses the emitted or Lisa-source directory and does not measure age. A successful historyPolicy import and required builtin resolution establish capability only. Neither the reusable workflow's contract major nor the pinned Gitleaks binary checksum/version establishes the installed policy/range helper's contract version. A superseded helper could interpret the declaration or required facade differently, so an artifact version handshake is warranted and remains an open obligation rather than a claimed handshake or exemption.",
+      "lanes": [
+        "all/copy-overwrite"
+      ],
+      "detail": "`history-secrets.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/lib/history-secret-policy.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (all/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text does carry `else-branch` — located in the step, deliberately NOT related to this read, and enough to make \"it skips silently\" a claim to check rather than assume. STALENESS (a separate dimension from the delivery verdict above): `no-probe`. Neither an existence test nor a version probe bears on this read, so nothing here distinguishes a current artifact from an absent or a superseded one. None of the staleness tokens this scan can see (`artifact-declares-version`, `artifact-answers-version`, `step-requests-version`, `workflow-requests-version`) were found."
+    },
     {
       "key": "maestro-native-e2e.yml::scripts/classify-maestro-failures.mjs",
       "workflow": "maestro-native-e2e.yml",

package/scripts/verify-npm-advisories-4333.mjs

@@ -0,0 +1,166 @@
+#!/usr/bin/env node
+/** Ordinary installed compatibility smoke checks for the dependency refresh. */
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import {
+  SCRATCH_SUPERVISION_LEASE_ENV,
+  createSupervisedWorkerScope,
+  parseScratchSupervisionLease,
+  removeSupervisedWorkerScope,
+} from "../dist/configs/vitest/scratch-supervision.js";
+
+const root = path.resolve(process.env.LISA_NPM_PROOF_ROOT ?? ".");
+const packageFile = "package.json";
+const require = createRequire(path.join(root, packageFile));
+const serializedLease = process.env[SCRATCH_SUPERVISION_LEASE_ENV];
+assert.ok(serializedLease, "Run through lisa-test-run with its owned lease");
+const lease = parseScratchSupervisionLease(serializedLease);
+const scope = createSupervisedWorkerScope(lease);
+const temporary = scope.path;
+const checks = [];
+
+try {
+  const j = require("jscodeshift").withParser("tsx");
+  const tree = j("const value: number = 1; const view = <div>{value}</div>;");
+  tree.find(j.Identifier, { name: "value" }).forEach(p => {
+    p.node.name = "answer";
+  });
+  assert.ok(tree.toSource().includes("{answer}"));
+  checks.push("jscodeshift: TSX transform");
+
+  const eslintRequire = createRequire(require.resolve("eslint"));
+  const Ajv6 = eslintRequire("ajv");
+  const validate6 = new Ajv6().compile({
+    type: "object",
+    required: ["name"],
+    properties: { name: { type: "string" } },
+  });
+  assert.equal(validate6({ name: "ordinary" }), true);
+  assert.equal(validate6({ name: 1 }), false);
+  const commitlintRequire = createRequire(require.resolve("@commitlint/cli"));
+  const Ajv8 = createRequire(
+    commitlintRequire.resolve("@commitlint/config-validator")
+  )("ajv");
+  const validate8 = new Ajv8.default().compile({ type: "integer" });
+  assert.equal(validate8(42), true);
+  assert.equal(validate8("42"), false);
+  checks.push("Ajv: distinct v6/v8 schema APIs");
+
+  const legacyMatch = eslintRequire("minimatch");
+  assert.equal(typeof legacyMatch, "function");
+  assert.equal(legacyMatch("src/file.ts", "**/*.ts"), true);
+  assert.equal(legacyMatch("src/file.js", "**/*.ts"), false);
+  const modernMatch = require("minimatch").minimatch;
+  assert.equal(modernMatch("src/file.ts", "**/*.ts"), true);
+  assert.equal(modernMatch("src/file.js", "**/*.ts"), false);
+  checks.push("minimatch: legacy callable and modern object APIs");
+
+  const strykerRequire = createRequire(
+    require.resolve("@stryker-mutator/core")
+  );
+  const restRequire = createRequire(
+    strykerRequire.resolve("typed-rest-client/HttpClient")
+  );
+  const qs = restRequire("qs");
+  assert.deepEqual(qs.parse("name=ordinary&tasks=lint&tasks=test"), {
+    name: "ordinary",
+    tasks: ["lint", "test"],
+  });
+  assert.equal(qs.stringify({ name: "ordinary" }), "name=ordinary");
+  assert.equal(
+    typeof strykerRequire("@stryker-mutator/core").Stryker,
+    "function"
+  );
+  checks.push(
+    "Stryker: installed core and compatible qs6 parse/stringify APIs"
+  );
+
+  const functionalPath = require.resolve("eslint-plugin-functional");
+  const functional = (await import(pathToFileURL(functionalPath).href)).default;
+  const functionalRequire = createRequire(functionalPath);
+  const { deepmerge } = functionalRequire("deepmerge-ts");
+  assert.deepEqual(
+    deepmerge(
+      { labels: ["first"], options: { enabled: true } },
+      { labels: ["second"], options: { level: 2 } }
+    ),
+    {
+      labels: ["first", "second"],
+      options: { enabled: true, level: 2 },
+    }
+  );
+  const { Linter } = require("eslint");
+  const linter = new Linter();
+  const functionalConfig = [
+    {
+      plugins: { functional },
+      rules: {
+        "functional/no-let": ["error", { ignoreIdentifierPattern: "^ignored" }],
+      },
+    },
+  ];
+  const ordinaryLet = linter.verify(
+    "let answer = 42; answer;",
+    functionalConfig
+  );
+  assert.equal(
+    ordinaryLet.filter(message => message.ruleId === "functional/no-let")
+      .length,
+    1
+  );
+  assert.deepEqual(
+    linter.verify("const answer = 42; answer;", functionalConfig),
+    []
+  );
+  checks.push("functional: actual ESLint rule and installed deepmerge APIs");
+
+  const cdk = require("aws-cdk-lib");
+  const app = new cdk.App({ outdir: path.join(temporary, "cdk.out") });
+  const stack = new cdk.Stack(app, "AnonymousProof");
+  new cdk.aws_s3.Bucket(stack, "Storage", {
+    enforceSSL: true,
+    versioned: true,
+    blockPublicAccess: cdk.aws_s3.BlockPublicAccess.BLOCK_ALL,
+  });
+  new cdk.CfnOutput(stack, "Proof", { value: "synth-only" });
+  const template = app.synth().getStackArtifact(stack.artifactId).template;
+  assert.equal(template.Outputs.Proof.Value, "synth-only");
+  assert.ok(
+    Object.values(template.Resources).some(
+      resource => resource.Type === "AWS::S3::Bucket"
+    )
+  );
+  checks.push("CDK: actual local synthesis without cloud operations");
+
+  const release = path.join(temporary, "release");
+  fs.mkdirSync(release);
+  fs.writeFileSync(
+    path.join(release, packageFile),
+    JSON.stringify({ name: "anonymous-release-proof", version: "1.0.0" })
+  );
+  const original = process.cwd();
+  process.chdir(release);
+  try {
+    await require("standard-version")({
+      dryRun: true,
+      releaseAs: "patch",
+      skip: { changelog: true, commit: true, tag: true },
+      silent: true,
+    });
+    assert.equal(
+      JSON.parse(fs.readFileSync(packageFile, "utf8")).version,
+      "1.0.0"
+    );
+  } finally {
+    process.chdir(original);
+  }
+  checks.push(
+    "standard-version: ordinary release dry run leaves manifest unchanged"
+  );
+  console.log(JSON.stringify({ success: true, checks }, null, 2));
+} finally {
+  removeSupervisedWorkerScope(scope, lease);
+}