@codyswann/lisa 4.72.1 → 4.72.3

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-connector-confluence/SKILL.md

@@ -2,6 +2,8 @@
 name: lisa-wiki-connector-confluence
 description: "Produce sanitized Confluence…"
 ---
+Produce sanitized Confluence source notes for lisa-wiki ingest via the Atlassian MCP. Use only when lisa-wiki-ingest routes to the confluence connector. Read-only; tenant-guarded.
+
 
 # lisa-wiki-connector-confluence
 

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-connector-docs/SKILL.md

@@ -2,6 +2,8 @@
 name: lisa-wiki-connector-docs
 description: "Ingest a local document (PDF…"
 ---
+Ingest a local document (PDF, DOCX, Markdown, text) into a sanitized source note for lisa-wiki ingest. Use only when lisa-wiki-ingest routes to the docs connector (a file-path input). Uses available local converters; no heavy bundled dependency.
+
 
 # lisa-wiki-connector-docs
 

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-connector-git/SKILL.md

@@ -2,6 +2,8 @@
 name: lisa-wiki-connector-git
 description: "Produce sanitized…"
 ---
+Produce sanitized git/PR-history source notes for lisa-wiki ingest. Use only when lisa-wiki-ingest routes to the git connector (self repo or a registered project). Read-only — never checks out, fetches, or mutates the target repo.
+
 
 # lisa-wiki-connector-git
 

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-connector-jira/SKILL.md

@@ -2,6 +2,8 @@
 name: lisa-wiki-connector-jira
 description: "Produce sanitized JIRA source…"
 ---
+Produce sanitized JIRA source notes for lisa-wiki ingest via the Atlassian MCP. Use only when lisa-wiki-ingest routes to the jira connector. Read-only; tenant-guarded.
+
 
 # lisa-wiki-connector-jira
 

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-connector-memory/SKILL.md

@@ -2,6 +2,8 @@
 name: lisa-wiki-connector-memory
 description: "Ingest the agent's…"
 ---
+Ingest the agent's PROJECT-SCOPED memory into a sanitized source note. Use only when lisa-wiki-ingest routes to the memory connector. NEVER ingests global or unrelated memory — global Codex memory and the Chronicle store are refused.
+
 
 # lisa-wiki-connector-memory
 

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-connector-notion/SKILL.md

@@ -2,6 +2,8 @@
 name: lisa-wiki-connector-notion
 description: "Produce sanitized Notion source…"
 ---
+Produce sanitized Notion source notes for lisa-wiki ingest via the Notion MCP. Use only when lisa-wiki-ingest routes to the notion connector. Read-only; teamspace-guarded.
+
 
 # lisa-wiki-connector-notion
 

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-connector-roles/SKILL.md

@@ -2,6 +2,8 @@
 name: lisa-wiki-connector-roles
 description: "Ingest the wiki's own…"
 ---
+Ingest the wiki's own digital-staff roster (config.staff[] + wiki/staff/*) into a sanitized source note. Use only when lisa-wiki-ingest routes to the roles connector. Does not run any subagent.
+
 
 # lisa-wiki-connector-roles
 

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-connector-slack/SKILL.md

@@ -2,6 +2,8 @@
 name: lisa-wiki-connector-slack
 description: "Ingest a Slack channel into…"
 ---
+Ingest a Slack channel into sanitized source notes via a user token. Use only when lisa-wiki-ingest routes to the slack connector AND the run carries explicit external-write intent (Slack OAuth opens a browser and stores a token file). Centralized stdlib-Python scripts; secrets are redacted.
+
 
 # lisa-wiki-connector-slack
 

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-connector-web/SKILL.md

@@ -2,6 +2,8 @@
 name: lisa-wiki-connector-web
 description: "Ingest a public URL into a…"
 ---
+Ingest a public URL into a sanitized source note for lisa-wiki ingest (via WebFetch). Use only when lisa-wiki-ingest routes to the web connector (a URL input). Read-only.
+
 
 # lisa-wiki-connector-web
 

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-doctor/SKILL.md

@@ -2,6 +2,8 @@
 name: lisa-wiki-doctor
 description: "Verify that a wiki is correctly…"
 ---
+Verify that a wiki is correctly set up and (after migration) fully functional. Runs the deterministic checks plus functional smoke tests, writes a doctor report, and returns an overall verdict. Use as the final gate of /migrate, after /setup, or anytime to confirm wiki health. A repo is not "migrated" until its doctor verdict is READY.
+
 
 # lisa-wiki-doctor
 

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-ingest/SKILL.md

@@ -2,6 +2,8 @@
 name: lisa-wiki-ingest
 description: "Ingest source material into the…"
 ---
+Ingest source material into the LLM Wiki. With an argument (URL, file path, or prompt) it ingests that one source; with no argument it runs a full ingest across every enabled non-external-write source. Routes to the right connector, then runs the ordered pipeline (source note → synthesis → index → log → verify → state → commit/PR). Use whenever new knowledge should enter the wiki.
+
 
 # lisa-wiki-ingest
 

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-lint/SKILL.md

@@ -2,6 +2,8 @@
 name: lisa-wiki-lint
 description: "Health-check the LLM Wiki"
 ---
+Health-check the LLM Wiki. Reports orphan pages, contradictions, stale claims, broken internal links, missing index/log coverage, structure-manifest violations, and secret/tenant leaks. Use periodically or before hardening a wiki. Read-only — it reports findings, it does not fix them.
+
 
 # lisa-wiki-lint
 

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-migrate/SKILL.md

@@ -2,6 +2,8 @@
 name: lisa-wiki-migrate
 description: "Migrate an existing…"
 ---
+Migrate an existing, hand-rolled wiki implementation onto the lisa-wiki kernel — phased and compatibility-first, with a strict no-loss guarantee. Use when adopting lisa-wiki in a repo that already has its own wiki/, ingest skills, docs, or roles. Renaming things into the canonical shape is fine; losing functionality or data is not. Ends by running /doctor.
+
 
 # lisa-wiki-migrate
 

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-onboard-me/SKILL.md

@@ -2,6 +2,8 @@
 name: lisa-wiki-onboard-me
 description: "Onboard a user to the project…"
 ---
+Onboard a user to the project via its LLM Wiki. Interviews the user about themselves in relation to the project, captures that to project-scoped memory only, then gives a guided tour of what the project is and sample questions they can ask. Use when someone is new to the project or asks to be onboarded. Read-mostly — it does not open PRs or write PII into the wiki.
+
 
 # lisa-wiki-onboard-me
 

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-query/SKILL.md

@@ -2,6 +2,8 @@
 name: lisa-wiki-query
 description: "Answer a question from the LLM…"
 ---
+Answer a question from the LLM Wiki with citations. Reads the index, drills into relevant pages, and synthesizes a cited answer. Read-only by default; only files new synthesis back into the wiki when the user explicitly asks. Use when someone asks a question the wiki should be able to answer, or wants to explore what the wiki knows.
+
 
 # lisa-wiki-query
 

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-setup/SKILL.md

@@ -2,6 +2,8 @@
 name: lisa-wiki-setup
 description: "Scaffold, repair, verify, or…"
 ---
+Scaffold, repair, verify, or upgrade a project's LLM Wiki from its config. Use when setting up the wiki in a new repo, fixing a broken/incomplete structure, or upgrading to a newer kernel version. Asks the wiki's purpose and README mode, renders the contract snapshot, scaffolds the canonical folders, and seeds the staff roster. Idempotent and non-destructive.
+
 
 # lisa-wiki-setup
 

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-setup-automations/SKILL.md

@@ -3,6 +3,8 @@ name: lisa-wiki-setup-automations
 description: "Set up the recurring LLM Wiki…"
 allowed-tools: ["Skill", "Bash", "Read"]
 ---
+Set up the recurring LLM Wiki ingest automation on the local workstation using the CURRENT runtime's native scheduler — Codex automations (the native automations / automation_update mechanism) or, on Claude, /schedule. This skill is a declarative specification: it states WHICH automation to create, how often, and with which command; it does not template schedule files or run scheduling code itself — the runtime's native automation mechanism does the creating. Creates one automation: wiki-ingest, a full /lisa-wiki:ingest cycle, once a day by default (override with cadence). Named and scoped lisa-wiki-auto-<project>-* so it never collides with or clobbers the base /setup-automations set. The wiki counterpart of /lisa:setup-automations — it lives here because the wiki plugin is standalone and installable without the base plugin. Tear down with /lisa-wiki:tear-down-automations.
+
 
 # Set up LLM Wiki automations: $ARGUMENTS
 

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-status/SKILL.md

@@ -3,6 +3,8 @@ name: lisa-wiki-status
 description: "Report Lisa wiki source…"
 allowed-tools: ["Bash", "Read"]
 ---
+Report Lisa wiki source freshness across enabled ingestion connectors. Reads wiki config, log, source notes, and state cursors, then renders a concise read-only freshness table with skipped/blocker reasons and exact next actions. Use when maintainers ask whether the wiki sources are fresh, stale, skipped, blocked, or need targeted ingest.
+
 
 # lisa-wiki-status
 

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-tear-down-automations/SKILL.md

@@ -3,6 +3,8 @@ name: lisa-wiki-tear-down-automations
 description: "Remove the recurring LLM Wiki…"
 allowed-tools: ["Skill", "Bash", "Read"]
 ---
+Remove the recurring LLM Wiki ingest automation that /lisa-wiki:setup-automations created for this project (the lisa-wiki-auto-<project>-* set) using the CURRENT runtime's native scheduler — Codex automations or, on Claude, /schedule. This skill is a declarative specification: it identifies WHICH automation to remove; it does not run teardown scripts. Removes only this project's wiki automations — never the base /setup-automations set, other projects' automations, or non-Lisa ones. The inverse of /lisa-wiki:setup-automations.
+
 
 # Tear down LLM Wiki automations: $ARGUMENTS
 

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-usage/SKILL.md

@@ -2,6 +2,8 @@
 name: lisa-wiki-usage
 description: "Explain how to browse, query…"
 ---
+Explain how to browse, query, and contribute to this project's LLM Wiki. Use when a user asks how the wiki works, where knowledge lives, how to find something, or how to add to it — the read/navigation path, not an ingestion or write workflow.
+
 
 # lisa-wiki-usage
 

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.72.1",
+  "version": "4.72.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.72.1",
+  "version": "4.72.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.72.1",
+  "version": "4.72.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/hooks/worktree-binding-guard.mjs

@@ -35,9 +35,9 @@
  * first attempt and lets the retry through is defeated by a blind retry, which
  * is the single most likely next action. So the block stands until the session
  * states, in the acknowledgement, the absolute path it now intends to work in.
- * A path that does not match what the session is actually in is refused too —
- * that is the rejection control, and it is what stops a stale acknowledgement
- * copied from another agent's transcript from silently rebinding this one.
+ * An acknowledgement can choose the observed root, return to the initial root,
+ * or accept a linked target this session was explicitly offered. A selected
+ * target does not prove a move: the next guarded call must actually be there.
  *
  * FAILING OPEN, LOUDLY. Anything this cannot determine — no session id, no
  * cwd, not a git repository, an unreadable state file — exits 0 with a line on
@@ -68,6 +68,7 @@ const GUARDED_TOOLS = new Set(["Bash", "Write", "Edit", "MultiEdit"]);
  * on its own PreToolUse pass — which is exactly where a command string arrives.
  */
 const ACCEPT_PREFIX = "lisa-worktree-binding: accept";
+const ACK_AND_SEPARATOR = Symbol("acknowledgement AND separator");
 
 /**
  * Resolve a path the way git reports one.
@@ -154,6 +155,46 @@ function mainCheckout(cwd) {
   return null;
 }
 
+/** Registered roots of the bound repository, with Git path quoting disabled. */
+function linkedWorktreeRoots(bound) {
+  const listing = git(["worktree", "list", "--porcelain", "-z"], bound);
+  if (listing === null) {
+    say(
+      "git could not identify linked worktrees; repository identity is NOT enforced"
+    );
+    return null;
+  }
+  return new Set(
+    listing
+      .split("\0")
+      .filter(record => record.startsWith("worktree "))
+      .map(record => realpath(record.slice("worktree ".length)))
+  );
+}
+
+/** Canonical common Git directory: stable identity across linked checkouts. */
+function repositoryIdentity(root) {
+  if (typeof root !== "string") return null;
+  const common = git(["rev-parse", "--git-common-dir"], root);
+  if (common === null) {
+    say("git could not compare repository identity; identity is NOT enforced");
+    return null;
+  }
+  return realpath(resolve(root, common));
+}
+
+/** A registration is only authoritative while its live repository agrees. */
+function isLinkedWorktree(
+  bound,
+  candidate,
+  roots = linkedWorktreeRoots(bound)
+) {
+  if (!roots?.has(candidate) || worktreeRoot(candidate) !== candidate)
+    return false;
+  const common = repositoryIdentity(bound);
+  return common !== null && common === repositoryIdentity(candidate);
+}
+
 /**
  * How much of an executed script this guard will read, in bytes.
  *
@@ -297,6 +338,7 @@ function executedPath(segment) {
  * fooled by exactly that and was caught only by a known-answer control.
  */
 function foreignTreeIn(text, bound, cwd) {
+  let linkedRoots;
   const code = text
     .split("\n")
     .map(line => line.replace(/^\s*#.*$/u, ""))
@@ -317,7 +359,10 @@ function foreignTreeIn(text, bound, cwd) {
     } catch {
       continue;
     }
-    if (root && root !== bound) return root;
+    if (root && root !== bound) {
+      if (linkedRoots === undefined) linkedRoots = linkedWorktreeRoots(bound);
+      if (isLinkedWorktree(bound, root, linkedRoots)) return root;
+    }
   }
   return null;
 }
@@ -496,10 +541,10 @@ function reachesOut(script, foreign, bound) {
     `  script:    ${script}`,
     `  reaches:   ${foreign}`,
     `  bound to:  ${bound}`,
-    "The directory change lives inside the file, so it happens after this",
-    "guard has measured where the session is. Run the work from the tree it",
-    "belongs to, or acknowledge the move:",
+    "The access lives inside the file, after this guard measures the session.",
+    "Run the work from the tree it belongs to, or acknowledge that target:",
     acceptanceLine(foreign),
+    "Then move to the acknowledged tree before further guarded calls.",
   ]);
 }
 
@@ -599,9 +644,8 @@ function readState(bindingKeyValue, payload) {
 /**
  * Write the session's binding state, MERGING over whatever is already there.
  *
- * Every caller below hands in all three lifecycle fields explicitly, so the
- * merge changes nothing for them — `claimedRoot: null` still clears a claim.
- * What it buys is that a field one writer owns is not silently dropped by
+ * Explicit `claimedRoot: null` still clears a claim. Merging means that a
+ * field one writer owns is not silently dropped by
  * another writer that had no opinion about it: `runtimeNoticed` is written by
  * {@link noticeRuntimeDrift} and read by nobody else, and a clobbering write
  * would turn its "reported once" into "reported again after the next
@@ -614,12 +658,24 @@ function readState(bindingKeyValue, payload) {
  */
 function writeState(bindingKeyValue, state, payload) {
   const file = stateFile(bindingKeyValue);
+  const previous = readState(bindingKeyValue, payload);
+  const originalRoot =
+    previous?.originalRoot ?? previous?.boundRoot ?? state.boundRoot;
+  const originalCommonDir =
+    previous?.originalCommonDir ?? repositoryIdentity(originalRoot);
   try {
     mkdirSync(dirname(file), { recursive: true });
     writeFileSync(
       file,
       `${JSON.stringify(
-        { ...readState(bindingKeyValue, payload), ...state },
+        {
+          ...previous,
+          ...state,
+          // Preserve the initial root after intentional rebinds. A legacy
+          // state's established root is its only proven recovery anchor.
+          originalRoot,
+          originalCommonDir,
+        },
         null,
         2
       )}\n`
@@ -746,43 +802,161 @@ function refuse(lines) {
 }
 
 function acceptanceLine(observed) {
-  return `  echo '${ACCEPT_PREFIX} ${observed}'`;
+  const literal = `${ACCEPT_PREFIX} ${observed}`.replaceAll("'", "'\\''");
+  return `  echo '${literal}'`;
+}
+
+/** Read literal shell words and AND separators without evaluating expansions. */
+function acknowledgementWords(text) {
+  const words = [];
+  let word = "",
+    active = false,
+    quote = null;
+  const emit = () => {
+    if (active) words.push(word);
+    word = "";
+    active = false;
+  };
+  for (let index = 0; index < text.length; index += 1) {
+    const char = text[index];
+    if (quote === "'") {
+      if (char === "'") quote = null;
+      else word += char;
+      continue;
+    }
+    if (char === "\\") {
+      const next = text[index + 1];
+      if (next === undefined) return null;
+      if (quote === '"' && !['"', "\\", "$", "`", "\n"].includes(next)) {
+        word += char;
+        continue;
+      }
+      index += 1;
+      if (next !== "\n") {
+        word += next;
+        active = true;
+      }
+      continue;
+    }
+    if (quote === '"') {
+      if (char === '"') quote = null;
+      else if (char === "$" || char === "`") return null;
+      else word += char;
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      quote = char;
+      active = true;
+    } else if (char === " " || char === "\t") emit();
+    else if (char === "\n") return null;
+    else if (char === "&" && text[index + 1] === "&") {
+      emit();
+      words.push(ACK_AND_SEPARATOR);
+      index += 1;
+    } else if (/[&;|<>$`*?[\]{}()]/u.test(char)) return null;
+    else {
+      word += char;
+      active = true;
+    }
+  }
+  if (quote !== null) return null;
+  emit();
+  return words;
+}
+
+/** Strip only actual shell edge whitespace in linear time. */
+function acknowledgementText(command) {
+  let start = 0,
+    end = command.length;
+  while (start < end && " \t\n".includes(command[start])) start += 1;
+  while (end > start && " \t\n".includes(command[end - 1])) end -= 1;
+  return command.slice(start, end);
+}
+
+/** A literal echo, optionally preceded by a literal cd to the stated root. */
+function acceptanceRequest(command) {
+  const text = acknowledgementText(command);
+  const words = acknowledgementWords(text.replace(/;$/u, ""));
+  if (!words) return null;
+  const direct = words.length === 2 && words[0] === "echo";
+  const moving =
+    words.length === 5 &&
+    words[0] === "cd" &&
+    typeof words[1] === "string" &&
+    words[2] === ACK_AND_SEPARATOR &&
+    words[3] === "echo";
+  if (!direct && !moving) return null;
+  const message = words.at(-1);
+  if (typeof message !== "string" || !message.startsWith(`${ACCEPT_PREFIX} `))
+    return null;
+  const stated = message.slice(ACCEPT_PREFIX.length + 1);
+  // The printed protocol names absolute roots. Empty/relative operands and
+  // cd's special ~, -, or -- forms cannot authorize a move.
+  if (!isAbsolute(stated)) return null;
+  const path = realpath(stated);
+  const destination =
+    moving && isAbsolute(words[1]) ? realpath(words[1]) : null;
+  return {
+    path,
+    validMove: !moving || (destination !== null && destination === path),
+  };
 }
 
 /**
- * Handle an acknowledgement line, or return null when the command is not one.
- *
- * The path is compared against what the session is measurably in, not against
- * what it says it wants. An acknowledgement naming somewhere else is the case
- * this is for: it means the operator is reasoning about a tree they are not in.
+ * Validate the initial recovery root against the identity captured at baseline.
+ * The current checkout may have been removed or deliberately rebound elsewhere.
  */
+function isOriginalRoot(state, path) {
+  const original = state?.originalRoot ?? state?.boundRoot;
+  if (path !== original || worktreeRoot(path) !== path) return false;
+  // Older state can only prove the repository of its established binding.
+  const common = state.originalCommonDir ?? repositoryIdentity(state.boundRoot);
+  return common !== null && common === repositoryIdentity(path);
+}
+
+/** Acknowledgements select intent; the next call must prove actual movement. */
 function handleAcceptance(payload, observed) {
   const command = payload.tool_input?.command;
   if (typeof command !== "string" || !command.includes(ACCEPT_PREFIX))
     return null;
-  const stated = command.slice(
-    command.indexOf(ACCEPT_PREFIX) + ACCEPT_PREFIX.length
-  );
-  const match = /([^\s'"]+)/.exec(stated);
-  const path = match ? realpath(resolve(match[1])) : null;
-  if (path !== observed) {
+  const request = acceptanceRequest(command);
+  if (!request) return null;
+  const { path, validMove } = request;
+  const previous = readState(bindingKey(payload), payload);
+  const original = previous?.originalRoot ?? previous?.boundRoot;
+  const recovering = isOriginalRoot(previous, path);
+  const offered =
+    path === previous?.offeredRoot &&
+    isLinkedWorktree(previous.boundRoot, path);
+  if (!validMove || (path !== observed && !recovering && !offered)) {
+    const suggestion = observed ?? original;
     return refuse([
       `worktree-binding-guard: this acknowledgement names ${path ?? "no path"},`,
-      `but this session is operating in ${observed}. Not rebinding.`,
-      `If ${observed} is where you mean to work, acknowledge that path:`,
-      acceptanceLine(observed),
+      "but it is not a valid move to the observed, original, or offered worktree. Not rebinding.",
+      ...(suggestion
+        ? [
+            "Acknowledge the measured or original worktree:",
+            acceptanceLine(suggestion),
+          ]
+        : []),
     ]);
   }
-  writeState(
+  const written = writeState(
     bindingKey(payload),
     {
-      boundRoot: observed,
+      boundRoot: path,
       claimedRoot: null,
+      offeredRoot: null,
       updatedAt: new Date().toISOString(),
     },
     payload
   );
-  say(`bound to ${observed}`);
+  if (written)
+    say(
+      path === observed
+        ? `bound to ${path}`
+        : `binding set to ${path}; move there before further guarded calls`
+    );
   return 0;
 }
 
@@ -982,6 +1156,11 @@ function evaluate(payload) {
   }
   const binding = bindingKey(payload);
   const observed = worktreeRoot(cwd);
+  // The initial-root recovery acknowledgement also works outside any repo.
+  if (GUARDED_TOOLS.has(payload.tool_name)) {
+    const accepted = handleAcceptance(payload, observed);
+    if (accepted !== null) return accepted;
+  }
   if (!observed) return 0;
 
   if (payload.hook_event_name === "SessionStart") {
@@ -993,14 +1172,18 @@ function evaluate(payload) {
     return 0;
   }
   if (payload.tool_name === "EnterWorktree") {
+    const previous = readState(binding, payload);
+    if (
+      previous?.boundRoot &&
+      previous.boundRoot !== observed &&
+      !isLinkedWorktree(previous.boundRoot, observed)
+    )
+      return 0;
     recordClaim(payload, observed);
     return 0;
   }
   if (!GUARDED_TOOLS.has(payload.tool_name)) return 0;
 
-  const accepted = handleAcceptance(payload, observed);
-  if (accepted !== null) return accepted;
-
   const state = readState(binding, payload);
   if (!state?.boundRoot) {
     // No baseline means SessionStart did not run for this session — an older
@@ -1021,6 +1204,11 @@ function evaluate(payload) {
     );
     return 0;
   }
+  if (
+    state.boundRoot !== observed &&
+    !isLinkedWorktree(state.boundRoot, observed)
+  )
+    return 0;
   if (state.claimedRoot && state.claimedRoot !== observed) {
     return unconfirmedSwitch(state.claimedRoot, observed);
   }
@@ -1030,6 +1218,7 @@ function evaluate(payload) {
       {
         boundRoot: observed,
         claimedRoot: null,
+        offeredRoot: null,
         updatedAt: new Date().toISOString(),
       },
       payload
@@ -1040,7 +1229,10 @@ function evaluate(payload) {
   // Last, and only once the session is provably where it should be: a script
   // that moves somewhere else after this check has already run.
   const reach = scriptReachingForeignTree(payload, observed);
-  if (reach) return reachesOut(reach.script, reach.foreign, observed);
+  if (reach) {
+    writeState(binding, { offeredRoot: reach.foreign }, payload);
+    return reachesOut(reach.script, reach.foreign, observed);
+  }
   return 0;
 }
 

package/plugins/src/base/rules/reference/design-source-of-truth.md

@@ -1,7 +1,7 @@
 # Design Source of Truth
 
 > Demoted from the always-on eager tier by CodySwannGT/lisa#3992. The
-> section below is the former eager head, maintained with the full
+> section below is the former eager head, preserved verbatim; the full
 > contract follows it. Reachable on demand via [the rule index](../eager/00-rule-index.md).
 
 ## Design Source of Truth (load-bearing)

package/plugins/src/base/rules/reference/rejection-detection.md

@@ -272,7 +272,7 @@ The state-only reading is what fails today, so a backward move is **not** suffic
 - **JIRA** — `lisa-atlassian-access operation: changelog key:<K>`; each changelog entry carries an `author` alongside its `from`/`to` status items.
 - **Linear** — `lisa-linear-access operation: history id:<ID>`; each history node carries an `actor` alongside `fromState` / `toState`.
 
-An actor is **this flow** when it is the configured automation identity, or when the flow's own marker note (`[lisa-repair-intake]`) sits at that transition's timestamp. Any other actor is a human. Where the surface does not expose an actor at all, the result is `unknown` — never an assumed human.
+An actor is **this flow** when it is the configured automation identity, or when the flow's own marker note (`[lisa-repair-intake]`) sits at that transition's timestamp. A different actor counts as human only when the provider positively identifies a person, rather than a bot, integration, or another automation identity. Missing or ambiguous actor information yields `unknown` — never an assumed human.
 
 **A marker and a transition on the same item say nothing until you know their order.** A hold label, a comment and a lane move routinely coexist on a reversed item, and co-occurrence reads equally well in both directions — a label applied *before* a transition guards it, the same label applied *after* records that the transition was undone. Sourcing the facts, attributing them correctly and reading the artifact all pass cleanly on an invented sequence; only ordering disconfirms it. Compare timestamps explicitly and treat an unorderable pair as `unknown`.