@codyswann/lisa 4.71.3 → 4.71.4

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.71.3",
+  "version": "4.71.4",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.71.3",
+  "version": "4.71.4",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.71.3",
+  "version": "4.71.4",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.71.3",
+  "version": "4.71.4",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.71.3",
+  "version": "4.71.4",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.71.3",
+  "version": "4.71.4",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.71.3",
+  "version": "4.71.4",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.71.3",
+  "version": "4.71.4",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.71.3",
+  "version": "4.71.4",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.71.3",
+  "version": "4.71.4",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.71.3",
+  "version": "4.71.4",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.71.3",
+  "version": "4.71.4",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.71.3",
+  "version": "4.71.4",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.71.3",
+  "version": "4.71.4",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.71.3",
+  "version": "4.71.4",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.71.3",
+  "version": "4.71.4",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.71.3",
+  "version": "4.71.4",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.71.3",
+  "version": "4.71.4",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.71.3",
+  "version": "4.71.4",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.71.3",
+  "version": "4.71.4",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.71.3",
+  "version": "4.71.4",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.71.3",
+  "version": "4.71.4",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.71.3",
+  "version": "4.71.4",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/hooks/parity-safety-net.sh

@@ -524,6 +524,94 @@ follow_names=""
 follow_count=0
 follow_bytes=0
 followed_text=""
+followed_rm_text=""
+# Generated from the canonical reviewed supervisor, never from a host manifest.
+# Regenerate through scripts/generate-scratch-supervisor-profile.mjs.
+readonly SCRATCH_SUPERVISOR_SHA256='6fdec1ad0441d7636dc6749c44a23167baf7b75004f156b8a7d4ce1c18c790b7'
+readonly SCRATCH_SUPERVISOR_CLEANUP_COUNT='7'
+
+# An authenticated public supervisor owns its fixed cleanup sites. Its original
+# source remains visible to every other policy; its actual payload is followed.
+follow_supervisor() {
+  local token="$1" depth="$2" statement="$3" path="" profile="" payload="" rm_source="" original=""
+  case "$token" in *lisa-scratch-run.sh) ;; *) return 1 ;; esac
+  follow_locate "$token" || follow_refuse "$token" "supervisor source could not be resolved"
+  path="$follow_located"
+  profile="$(python3 - "$path" "$SCRATCH_SUPERVISOR_SHA256" "$statement" "$token" "$SCRATCH_SUPERVISOR_CLEANUP_COUNT" <<'PY'
+import hashlib
+import json
+import os
+import re
+import shlex
+import stat
+import sys
+
+path, digest, statement, operand, expected_count = sys.argv[1:]
+def refuse():
+    sys.exit(2)
+
+try:
+    info = os.lstat(path)
+    if not stat.S_ISREG(info.st_mode) or info.st_size > 262144:
+        refuse()
+    raw = open(path, 'rb').read(262145)
+    if len(raw) != info.st_size or not re.fullmatch(r'[0-9a-f]{64}', digest):
+        refuse()
+    if hashlib.sha256(raw).hexdigest() != digest:
+        refuse()
+    tokens = shlex.split(statement)
+    indices = [index for index, token in enumerate(tokens) if token == operand]
+    if len(indices) != 1 or '$' in operand or '`' in operand:
+        refuse()
+    index = indices[0]
+    if index < 1 or tokens[index - 1] not in ('sh', 'bash', '/bin/sh', '/bin/bash'):
+        refuse()
+    prefix = tokens[:index - 1]
+    if prefix[:1] == ['env']:
+        prefix = prefix[1:]
+    assignments = {}
+    for token in prefix:
+        if '=' not in token or re.search(r'[$`\r\n]', token):
+            refuse()
+        key, value = token.split('=', 1)
+        if key not in ('LISA_SCRATCH_BASE', 'LISA_SCRATCH_TRACE', 'TMPDIR') or key in assignments:
+            refuse()
+        assignments[key] = value
+    # Match actual shell :- precedence, including inherited and
+    # explicitly empty values. TMPDIR cannot override a nonempty inherited base.
+    effective = dict(os.environ, **assignments)
+    base = effective.get('LISA_SCRATCH_BASE') or effective.get('TMPDIR') or '/tmp'
+    if not base or not os.path.isabs(base) or re.search(r'[$`\r\n]', base):
+        refuse()
+    real_base = os.path.realpath(base)
+    roots = ['/tmp', '/var/tmp', os.environ.get('TMPDIR', '/tmp')]
+    if not any(os.path.commonpath([real_base, os.path.realpath(root)]) == os.path.realpath(root) for root in roots if root and os.path.isabs(root)):
+        refuse()
+    args = tokens[index + 1:]
+    if len(args) < 4 or args[0] != '--suite' or args[2] != '--':
+        refuse()
+    if not re.fullmatch(r'[A-Za-z0-9._-]{1,64}', args[1]):
+        refuse()
+    payload = args[3:]
+    if not payload[0] or payload[0].startswith('-') or any(re.search(r'[$`\x00\r\n]', value) for value in payload):
+        refuse()
+    source = raw.decode('utf8')
+    cleaned, count = re.subn(r'(?m)^(\s*)rm -rf "(\$_quarantine|\$_root|\$_entry|\$LISA_SCRATCH_ROOT)"', r'\1:', source)
+    if not re.fullmatch(r'[1-9][0-9]*', expected_count) or count != int(expected_count):
+        refuse()
+    print(json.dumps({'source': cleaned, 'original': source, 'payload': shlex.join(payload)}))
+except (OSError, UnicodeError, ValueError):
+    refuse()
+PY
+)" || follow_refuse "$path" "supervisor source or public entry authority could not be authenticated"
+  rm_source="$(printf '%s' "$profile" | jq -er '.source')" || follow_refuse "$path" "invalid supervisor profile"
+  original="$(printf '%s' "$profile" | jq -er '.original')" || follow_refuse "$path" "invalid supervisor source"
+  payload="$(printf '%s' "$profile" | jq -er '.payload')" || follow_refuse "$path" "invalid supervisor payload"
+  follow_take "$path" "$depth" "$rm_source" "$original"
+  [ "$depth" -lt "$FOLLOW_MAX_DEPTH" ] || follow_refuse "$path" "supervisor payload exceeds inspection depth"
+  follow_scan "$payload" "$((depth + 1))"
+  return 0
+}
 
 FOLLOW_GUIDANCE="This command EXECUTES a file. These guards classify shell text, so the script an
 invocation runs is read and scanned as part of the command — a destructive line
@@ -810,7 +898,7 @@ follow_locate() {
 # executes, to a bounded depth. Full-line comments are dropped: a commented line
 # is never executed, so scanning it can only manufacture a false refusal.
 follow_take() {
-  local path="$1" depth="$2" size="" content=""
+  local path="$1" depth="$2" size="" content="" rm_content="${3-}"
   case "$follow_paths" in
     *$'\n'"$path"$'\n'*) return 0 ;;
   esac
@@ -830,10 +918,22 @@ follow_take() {
   if [ "$follow_bytes" -gt "$FOLLOW_MAX_TOTAL_BYTES" ]; then
     follow_refuse "$path" "the files this command executes total more than the ${FOLLOW_MAX_TOTAL_BYTES}-byte inspection budget"
   fi
-  content="$(LC_ALL=C tr -d '\000' <"$path" | sed 's/^[[:space:]]*#.*$//')" \
-    || follow_refuse "$path" "it could not be read"
+  if [ "$#" -eq 4 ]; then
+    # Scan the same complete bytes whose digest was authenticated, not a
+    # second file read that could pair changed source with the cleanup view.
+    content="$(printf '%s' "$4" | sed 's/^[[:space:]]*#.*$//')" || follow_refuse "$path" "authenticated source could not be read"
+  else
+    content="$(LC_ALL=C tr -d '\000' <"$path" | sed 's/^[[:space:]]*#.*$//')" \
+      || follow_refuse "$path" "it could not be read"
+  fi
   follow_names="$follow_names $path"
   followed_text="$followed_text"$'\n'"$content"
+  if [ "$#" -lt 3 ]; then
+    rm_content="$content"
+  else
+    rm_content="$(printf '%s' "$rm_content" | sed 's/^[[:space:]]*#.*$//')" || follow_refuse "$path" "supervisor cleanup view could not be read"
+  fi
+  followed_rm_text="$followed_rm_text"$'\n'"$rm_content"
   if [ "$depth" -lt "$FOLLOW_MAX_DEPTH" ]; then
     # A `cd` inside the followed script governs what THAT script goes on to
     # execute, and nothing after it in the command that ran the script — the
@@ -852,6 +952,11 @@ follow_take() {
 follow_target() {
   local token="$1" depth="$2" path=""
   [ -n "$token" ] || return 0
+  # Entry authority belongs to each invocation, not the file-read cache. Only
+  # follow_supervisor may admit the exact public interpreter/argv profile.
+  case "$token" in
+    *lisa-scratch-run.sh) follow_refuse "$token" "supervisor requires its authenticated public interpreter entry" ;;
+  esac
   if ! follow_locate "$token"; then
     if [ "$depth" -eq 0 ]; then
       follow_refuse "$token" "no readable file could be resolved for it"
@@ -885,6 +990,9 @@ follow_direct() {
     return 0
   fi
   path="$follow_located"
+  case "$path" in
+    *lisa-scratch-run.sh) follow_refuse "$path" "supervisor requires its authenticated public interpreter entry" ;;
+  esac
   IFS= read -r -n 256 raw <"$path" 2>/dev/null || true
   while [ "$k" -lt "${#raw}" ]; do
     char="${raw:k:1}"
@@ -1216,7 +1324,9 @@ follow_scan() {
         fi
         follow_unwrap "${toks[j]}"
         tj="$follow_unwrapped"
-        follow_target "$tj" "$depth"
+        if ! follow_supervisor "$tj" "$depth" "$stmt"; then
+          follow_target "$tj" "$depth"
+        fi
         cmd_pos=0
         i=$((j + 1))
         continue
@@ -1245,6 +1355,7 @@ follow_scan() {
 }
 
 follow_scan "$command_for_guards" 0
+rm_command_for_guards="$command_for_guards"$'\n'"$followed_rm_text"
 if [ -n "$follow_names" ]; then
   command_for_guards="$command_for_guards"$'\n'"$followed_text"
   # A refusal must say WHERE the match is. Without this the operator reads
@@ -1263,6 +1374,8 @@ fi
 # `sed ':a;N;$!ba;…'`, which errors on BSD sed (macOS) and there silently no-ops.
 normalized_command_str="$(printf '%s' "$command_for_guards" \
   | awk '{ if (sub(/\\$/, "")) printf "%s ", $0; else print }')"
+rm_normalized_command_str="$(printf '%s' "$rm_command_for_guards" \
+  | awk '{ if (sub(/\\$/, "")) printf "%s ", $0; else print }')"
 
 # matches / matches_cs run an ERE against the guarded command text. matches is
 # case-insensitive (the default for these guards); matches_cs is case-SENSITIVE
@@ -1567,7 +1680,7 @@ rm_assignment_value() {
   # small lexer below preserves quoted right-hand sides such as V="/tmp/x"
   # while excluding an argument such as echo "V=/tmp/x". Any ambiguity fails
   # closed.
-  RM_ASSIGNMENT_NAME="$name" RM_ASSIGNMENT_COMMAND="$normalized_command_str" \
+  RM_ASSIGNMENT_NAME="$name" RM_ASSIGNMENT_COMMAND="$rm_normalized_command_str" \
     RM_ASSIGNMENT_STATEMENT="$rm_assignment_stmt" \
     python3 - <<'PY'
 import os
@@ -1766,7 +1879,7 @@ classify_rm_target() {
 # process substitution cannot deny anything either — it ends that subshell, not
 # this hook.
 rm_segments_status=0
-rm_segments="$(printf '%s' "$normalized_command_str" | tr '&|;' '\n' \
+rm_segments="$(printf '%s' "$rm_normalized_command_str" | tr '&|;' '\n' \
   | grep -Ei -- "$RM_CMD"'([[:space:]]|$)')" || rm_segments_status=$?
 case "$rm_segments_status" in
   0 | 1) ;;
@@ -2278,9 +2391,10 @@ git_segments="$(printf '%s' "$normalized_command_str" \
     -e 's/[0-9]*>&[0-9-]*/>/g' \
     -e 's/[0-9]*<&[0-9-]*/</g' \
     -e 's/||/;/g' \
-  | tr '&;' '\n')" || git_segments_status=$?
+  | tr '&;' '\n' \
+  | grep -E -- "$RM_RF_CLUSTER|$RM_RF_SPLIT")" || git_segments_status=$?
 case "$git_segments_status" in
-  0) ;;
+  0 | 1) ;;
   *) scan_failed "$git_segments_status" ;;
 esac
 while IFS= read -r git_stmt; do

package/rails/copy-overwrite/scripts/lisa-scratch-run.sh

@@ -275,6 +275,15 @@ lisa_token_is_well_formed() {
   [ "${#1}" -eq 64 ]
 }
 
+# The basename is a 96-bit locator, never the run's 256-bit authority. Keeping
+# it independent of suite length leaves Chrome's six-character temp suffix and
+# SingletonSocket within 104 bytes including NUL under canonical /private/tmp.
+# The complete token still binds the marker, acknowledgement and quarantine.
+lisa_root_matches_token() {
+  lisa_token_is_well_formed "$2" || return 1
+  [ "${1##*/}" = "$(printf 'r.%.24s' "$2")" ]
+}
+
 lisa_suite_is_well_formed() {
   case "$1" in
     "" | *[!A-Za-z0-9._-]*) return 1 ;;
@@ -325,6 +334,10 @@ lisa_authority_main() {
     lisa_die "$EX_AMBIGUOUS" "authority: unreadable or malformed arming marker"
   lisa_token_is_well_formed "$_token" ||
     lisa_die "$EX_AMBIGUOUS" "authority: malformed run token"
+  [ "$_token" = "${LISA_SCRATCH_TOKEN:-}" ] ||
+    lisa_die "$EX_AMBIGUOUS" "authority: run token differs from supervisor authority"
+  lisa_root_matches_token "$_root" "$_token" ||
+    lisa_die "$EX_AMBIGUOUS" "authority: run locator differs from full token"
   _version="$(lisa_marker_get "$_marker" version)" ||
     lisa_die "$EX_AMBIGUOUS" "authority: arming marker has no version"
   [ "$_version" = "$LISA_SCRATCH_VERSION" ] ||
@@ -503,6 +516,10 @@ lisa_remove_root() {
     printf '%s\n' "lisa-scratch-run: run root no longer well-formed; refusing to delete" >&2
     return 1
   }
+  lisa_root_matches_token "$_root" "$_token" || {
+    printf '%s\n' "lisa-scratch-run: run locator differs from full token; refusing to delete" >&2
+    return 1
+  }
   _now="$(lisa_dev_ino "$_root")" || return 1
   if [ "$_now" != "$_dev_ino" ]; then
     printf '%s\n' "lisa-scratch-run: run root filesystem identity changed; refusing to delete" >&2
@@ -546,6 +563,9 @@ lisa_launcher_main() {
   _token="$2"
   shift 2
 
+  lisa_root_matches_token "$_root" "$_token" ||
+    lisa_die "$EX_ARM" "payload run locator differs from full token; refusing"
+
   if ! lisa_isolate_group LISA_SCRATCH_LAUNCH_REENTRY \
     "$LISA_SCRATCH_SH" "$LISA_SCRATCH_SELF" --launch "$_root" "$_token" "$@"; then
     lisa_die "$EX_ARM" "cannot isolate the payload process group; refusing"
@@ -667,7 +687,11 @@ lisa_abort_arming() {
   [ -n "${LISA_SCRATCH_PAYLOAD_PID:-}" ] && kill -TERM "$LISA_SCRATCH_PAYLOAD_PID" 2>/dev/null
   [ -n "${LISA_SCRATCH_AUTHORITY_PID:-}" ] && kill -TERM "$LISA_SCRATCH_AUTHORITY_PID" 2>/dev/null
   if [ -n "${LISA_SCRATCH_ROOT:-}" ] &&
-    lisa_root_is_well_formed "$LISA_SCRATCH_ROOT" "${LISA_SCRATCH_BASE_CANONICAL:-}"; then
+    [ -n "${LISA_SCRATCH_ROOT_DEVINO:-}" ] &&
+    lisa_root_is_well_formed "$LISA_SCRATCH_ROOT" "${LISA_SCRATCH_BASE_CANONICAL:-}" &&
+    lisa_root_matches_token "$LISA_SCRATCH_ROOT" "${LISA_SCRATCH_TOKEN:-}" &&
+    [ "$(lisa_canonical_dir "$LISA_SCRATCH_ROOT")" = "$LISA_SCRATCH_ROOT" ] &&
+    [ "$(lisa_dev_ino "$LISA_SCRATCH_ROOT")" = "$LISA_SCRATCH_ROOT_DEVINO" ]; then
     rm -rf "$LISA_SCRATCH_ROOT" 2>/dev/null || true
   fi
   kill -"$_sig" $$
@@ -720,6 +744,7 @@ lisa_supervisor_main() {
   # handler is older than every resource it can be asked to release, and it
   # simply does nothing while there is nothing to release.
   LISA_SCRATCH_ROOT=""
+  LISA_SCRATCH_ROOT_DEVINO=""
   LISA_SCRATCH_BASE_CANONICAL=""
   LISA_SCRATCH_PAYLOAD_PID=""
   LISA_SCRATCH_AUTHORITY_PID=""
@@ -742,28 +767,48 @@ lisa_supervisor_main() {
     lisa_die "$EX_ARM" "cannot create scratch namespace under $_base"
   chmod 700 "$_base/$LISA_SCRATCH_NAMESPACE" 2>/dev/null || true
 
-  _root="$_base/$LISA_SCRATCH_NAMESPACE/$_suite.$_token"
+  _locator="$(printf 'r.%.24s' "$_token")"
+  _root="$_base/$LISA_SCRATCH_NAMESPACE/$_locator"
   lisa_root_is_well_formed "$_root" "$_base" ||
     lisa_die "$EX_ARM" "computed run root is not well-formed: $_root"
 
-  # The already-installed handler becomes able to act the moment these are set,
-  # which is one statement before the directory they name can exist.
+  # Naming a root does not authorize deletion: exclusive creation and its
+  # captured filesystem identity must also succeed before the handler can act.
   LISA_SCRATCH_ROOT="$_root"
   LISA_SCRATCH_TOKEN="$_token"
   LISA_SCRATCH_SUITE="$_suite"
   LISA_SCRATCH_BASE_CANONICAL="$_base"
   export LISA_SCRATCH_ROOT LISA_SCRATCH_TOKEN LISA_SCRATCH_SUITE
 
-  # Exclusive create: mkdir of an existing leaf fails, so two runs can never
-  # share a root even if a token somehow repeated.
-  mkdir "$_root" || lisa_die "$EX_ARM" "cannot exclusively create run root"
+  # Latch signals across exclusive creation and identity capture. Otherwise a
+  # signal between mkdir's success and the next assignment could either leak
+  # our newly created root or mistake a collision for something we own.
+  LISA_SCRATCH_ARM_SIGNAL=""
+  for _sig in TERM INT HUP; do
+    # shellcheck disable=SC2064
+    trap "LISA_SCRATCH_ARM_SIGNAL=$_sig" "$_sig"
+  done
+  _created=no
+  if mkdir "$_root"; then
+    _created=yes
+    LISA_SCRATCH_ROOT_DEVINO="$(lisa_dev_ino "$_root")" || LISA_SCRATCH_ROOT_DEVINO=""
+  fi
+  for _sig in TERM INT HUP; do
+    # shellcheck disable=SC2064
+    trap "lisa_abort_arming $_sig" "$_sig"
+  done
+  [ -z "$LISA_SCRATCH_ARM_SIGNAL" ] || lisa_abort_arming "$LISA_SCRATCH_ARM_SIGNAL"
+  [ "$_created" = yes ] || lisa_die "$EX_ARM" "cannot exclusively create run root"
+  [ -n "$LISA_SCRATCH_ROOT_DEVINO" ] ||
+    lisa_die "$EX_ARM" "cannot read run root filesystem identity"
   chmod 700 "$_root" 2>/dev/null || true
   _canon="$(lisa_canonical_dir "$_root")" ||
     lisa_die "$EX_ARM" "run root is not a canonical directory"
   [ "$_canon" = "$_root" ] ||
     lisa_die "$EX_ARM" "run root resolves elsewhere: $_root -> $_canon"
-  _dev_ino="$(lisa_dev_ino "$_root")" ||
-    lisa_die "$EX_ARM" "cannot read run root filesystem identity"
+  _dev_ino="$LISA_SCRATCH_ROOT_DEVINO"
+  [ "$(lisa_dev_ino "$_root")" = "$_dev_ino" ] ||
+    lisa_die "$EX_ARM" "run root filesystem identity changed during creation"
 
   lisa_trace "arm-begin suite=$_suite root=$_root"
 

package/scripts/build-plugins.sh

@@ -126,6 +126,9 @@ build_per_agent_variant() {
 }
 
 # Base plugin
+if [ -f "$ROOT_DIR/scripts/generate-scratch-supervisor-profile.mjs" ]; then
+  node "$ROOT_DIR/scripts/generate-scratch-supervisor-profile.mjs"
+fi
 build_plugin base lisa
 
 # Threshold-ratchet comparator: the canonical implementation lives in the base

package/scripts/generate-scratch-supervisor-profile.mjs

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+/**
+ * Bind the guard's reviewed public-supervisor profile to canonical source.
+ * The generated constants ship inside the guard. A host manifest or command
+ * argument cannot replace them. Source changes require generation and review.
+ * @module scripts/generate-scratch-supervisor-profile
+ */
+import { createHash } from "node:crypto";
+import { readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { invokedAsScript } from "./lib/invoked-as-script.mjs";
+
+/** Render the two fixed constants from complete canonical supervisor bytes.
+ * @param {string} guard - Editable canonical guard source.
+ * @param {Buffer} source - Complete canonical supervisor bytes.
+ * @returns {string} Guard with the exact source profile.
+ */
+export function renderScratchProfile(guard, source) {
+  const text = source.toString("utf8");
+  if (!Buffer.from(text).equals(source) || source.length > 262144) {
+    throw new Error("Canonical supervisor source is not bounded UTF8");
+  }
+  const count = [
+    ...text.matchAll(
+      /^\s*rm -rf "(\$_quarantine|\$_root|\$_entry|\$LISA_SCRATCH_ROOT)"/gm
+    ),
+  ].length;
+  if (count === 0)
+    throw new Error("Canonical supervisor cleanup profile is absent");
+  const values = {
+    SHA256: createHash("sha256").update(source).digest("hex"),
+    CLEANUP_COUNT: String(count),
+  };
+  return Object.entries(values).reduce((current, [key, value]) => {
+    const expression = new RegExp(
+      `^readonly SCRATCH_SUPERVISOR_${key}='[^'\\n]*'$`,
+      "gm"
+    );
+    if ([...current.matchAll(expression)].length !== 1) {
+      throw new Error("Canonical guard source profile is ambiguous");
+    }
+    return current.replace(
+      expression,
+      `readonly SCRATCH_SUPERVISOR_${key}='${value}'`
+    );
+  }, guard);
+}
+
+if (invokedAsScript(import.meta.url)) {
+  if (
+    process.argv.slice(2).some(argument => argument !== "--check") ||
+    process.argv.length > 3
+  ) {
+    throw new Error("Usage: generate-scratch-supervisor-profile.mjs [--check]");
+  }
+  const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+  const guardPath = path.join(
+    root,
+    "plugins/src/base/hooks/parity-safety-net.sh"
+  );
+  const current = readFileSync(guardPath, "utf8");
+  const rendered = renderScratchProfile(
+    current,
+    readFileSync(
+      path.join(root, "rails/copy-overwrite/scripts/lisa-scratch-run.sh")
+    )
+  );
+  if (process.argv.includes("--check")) {
+    if (current !== rendered)
+      throw new Error("Canonical supervisor source profile is stale");
+  } else if (current !== rendered) {
+    writeFileSync(guardPath, rendered);
+  }
+}

package/scripts/two-channel-couplings.json

@@ -105,7 +105,7 @@
     "workflows": 25,
     "steps": 798,
     "couplings": 35,
-    "inventory": 163
+    "inventory": 164
   },
   "counts": {
     "package-backed": 10,