@codyswann/lisa 4.73.3 → 4.73.5

package/README.md

@@ -343,6 +343,19 @@ Diagnostics are offline and lazy: at most eight guard/template pairs (1 MiB per
 file), four 64 KiB manifests/receipts and one 4 MiB plugin registry, with one
 additional byte per read to detect overflow. After the session notice, permitted
 calls invoke no freshness helper. Later refusals re-evaluate their own evidence.
+The live anchor verifies its own process group before launching Node, so native
+qualification cannot race a separate parent/start countdown. Qualification is
+setup outside the producer timer; arbitrary native `ps` or scheduler stalls are
+not bounded by that timer.
+The optional subprocess has a one-second Bash timer independent of Node,
+leaving headroom beneath its two-second diagnostic ceiling. Slower diagnostics
+become unknown; complete results within the budget retain their attribution.
+It uses a private, trusted temporary buffer and an owned process-group anchor.
+Timeout, unavailable runner, failure or incomplete output leaves all evidence
+unknown while every original guard still runs. Complete successful output is
+accepted only after the helper's ordinary descendants are drained. The timer
+does not bound enforcement guards, operating-system scheduling or arbitrary
+native-tool startup, and cannot guarantee reaping kernel-uninterruptible I/O.
 
 | Agent | Fallback diagnostic surface |
 | --- | --- |

package/all/copy-overwrite/scripts/lib/npm-update-gh-grants.mjs

@@ -86,7 +86,10 @@ export function observeGhResponse(scope, state, request, result) {
       Buffer.byteLength(result.stdout) <= 3_145_728,
     "unbounded GH response grant"
   );
-  const value = JSON.parse(result.stdout);
+  const value =
+    request.kind === "comments"
+      ? githubBacklinkComments(result.stdout)
+      : JSON.parse(result.stdout);
   let successor;
   if (request.kind === "hierarchy") {
     const page = value.data?.repository?.issue?.subIssues;
@@ -119,7 +122,7 @@ export function observeGhResponse(scope, state, request, result) {
       };
     }
   } else if (request.kind === "comments")
-    successor = backlinkRequest(scope.subject, githubBacklinkComments(value));
+    successor = backlinkRequest(scope.subject, value);
   if (successor) state.grants.set(key(successor.args), successor);
 }
 

package/all/copy-overwrite/scripts/lisa-enforcement-fallback.sh

@@ -211,6 +211,103 @@ note_version() {
 
 plugin_tree_version=""
 
+# Node cannot supervise its own stalled startup. Bash owns a live group anchor
+# and an independent builtin-read timer instead. The real child Bash has its own
+# $$, waits for group qualification before starting Node, and drains its OWN
+# group. No remembered PID receives a later external signal. Its live anchor
+# pins the group even after Node returns, until all descendants are terminated.
+# Only this optional subprocess is bounded; enforcement below is unchanged.
+run_optional_freshness() (
+  command -v mkfifo >/dev/null 2>&1 && command -v ps >/dev/null 2>&1 || exit 1
+  ps -o pid= -p "$$" >/dev/null 2>&1 || exit 1
+  # Bash 3.2 unwinds function locals before EXIT on an explicit exit inside
+  # command substitution. This function already isolates all state in a subshell.
+  scratch="" anchor="" scratch_identity="" current_identity="" helper_status=1
+  [ -n "$notice_temp_base" ] && notice_parent_chain_trusted "$notice_temp_base" || exit 1
+  scratch="$(umask 077 && mktemp -d "$notice_temp_base/lisa-freshness.XXXXXX")" || exit 1
+  case "$scratch" in "$notice_temp_base"/lisa-freshness.*) ;; *) exit 1 ;; esac
+  [ -d "$scratch" ] && [ ! -L "$scratch" ] && [ -O "$scratch" ] || exit 1
+  scratch_identity="$(stat -f '%d:%i:%Lp' "$scratch" 2>/dev/null)" ||
+    scratch_identity="$(stat -c '%d:%i:%a' "$scratch" 2>/dev/null)" || exit 1
+  [ "${scratch_identity##*:}" = 700 ] || exit 1
+  cleanup_diagnostic() {
+    if [ -n "$anchor" ]; then
+      printf 'stop\n' >&8
+      wait "$anchor" 2>/dev/null || true
+    fi
+    exec 8>&- 9>&-
+    current_identity="$(stat -f '%d:%i:%Lp' "$scratch" 2>/dev/null)" ||
+      current_identity="$(stat -c '%d:%i:%a' "$scratch" 2>/dev/null)" || current_identity=""
+    if [ "$current_identity" = "$scratch_identity" ] &&
+      [ -d "$scratch" ] && [ ! -L "$scratch" ] && [ -O "$scratch" ] &&
+      notice_parent_chain_trusted "$notice_temp_base"; then
+      rm -rf "$scratch"
+    fi
+  }
+  trap cleanup_diagnostic EXIT
+  trap 'exit 1' HUP INT TERM
+  mkfifo "$scratch/start" "$scratch/done" || exit 1
+  exec 8<>"$scratch/start" 9<>"$scratch/done" || exit 1
+  set -m
+  /bin/bash -c '
+    set +m
+    scratch="$1"
+    shift
+    # This live anchor qualifies its own group before launching any Node work.
+    # Native qualification must not race a separate parent/start countdown.
+    [ "$(ps -o pgid= -p "$$" 2>/dev/null | tr -d " ")" = "$$" ] || exit 1
+    (
+      node "$@" </dev/null >"$scratch/output" 2>/dev/null
+      printf "%s\n" "$?" >"$scratch/status"
+      printf "done\n" >&9
+    ) &
+    # Bash 3.2 accepts integer timeouts. One second leaves headroom beneath
+    # the two-second diagnostic ceiling without delaying real enforcement.
+    if read -r -t 1 -u 9 done && [ "$done" = done ]; then
+      printf "complete\n" >"$scratch/complete"
+      # Parent acceptance or its bounded absence both terminate the group.
+      read -r -t 1 -u 8 stop || true
+    fi
+    kill -KILL -- -"$$"
+  ' lisa-freshness "$scratch" "$@" &
+  anchor=$!
+  while [ ! -f "$scratch/status" ] && [ "$(jobs -pr)" = "$anchor" ]; do sleep 0.01; done
+  printf 'stop\n' >&8
+  wait "$anchor" 2>/dev/null || true
+  anchor=""
+  [ -f "$scratch/complete" ] && [ -f "$scratch/status" ] || exit 1
+  read -r helper_status <"$scratch/status"
+  [ "$helper_status" = 0 ] || exit 1
+  cat "$scratch/output"
+)
+
+# Do not promote even one partial fact. Successful exit plus a terminal protocol
+# row and every requested guard result are required before globals are changed.
+valid_freshness_result() {
+  local line key value seen="|" complete=0 count=0
+  while IFS= read -r line; do
+    [ "$complete" -eq 0 ] || return 1
+    case "$line" in *$'\t'*) ;; *) return 1 ;; esac
+    key="${line%%$'\t'*}"
+    value="${line#*$'\t'}"
+    case "$value" in ''|*$'\t'*|*$'\r'*) return 1 ;; esac
+    case "$seen" in *"|$key|"*) return 1 ;; esac
+    seen="$seen$key|"
+    case "$key" in
+      installed|applied|plugin|marketplace|channel)
+        [[ "$value" =~ ^[0-9]{1,6}\.[0-9]{1,6}\.[0-9]{1,6}([-+][A-Za-z0-9.-]{1,48})?$ ]] || return 1 ;;
+      channel_path) ;;
+      guard[0-7])
+        [ "${key#guard}" -lt "$guard_count" ] || return 1
+        case "$value" in matching|different|unknown) ;; *) return 1 ;; esac
+        count=$((count + 1)) ;;
+      complete) [ "$value" = 1 ] || return 1; complete=1 ;;
+      *) return 1 ;;
+    esac
+  done <<< "$1"
+  [ "$complete" -eq 1 ] && [ "$count" -eq "$guard_count" ]
+}
+
 # Resolve once PER PROCESS at the existing lazy diagnostic boundary. A later
 # refusal in the same session gets fresh content evidence in its new process;
 # an already-noticed permitted call invokes neither Node nor a comparison.
@@ -220,13 +317,15 @@ resolve_vintages() {
   local config_dir="${CLAUDE_CONFIG_DIR-}"
   [ -n "$config_dir" ] || config_dir="${HOME-}/.claude"
   local helper="${BASH_SOURCE[0]%/*}/lisa-enforcement-freshness.mjs"
-  local key value state_index
+  local key value state_index result
   local state_count=0
   while [ "$state_count" -lt "$guard_count" ]; do
     host_guard_states+=("unknown")
     state_count=$((state_count + 1))
   done
-  if [ -f "$helper" ] && [ -r "$helper" ] && command -v node >/dev/null 2>&1; then
+  if [ -f "$helper" ] && [ -r "$helper" ] && command -v node >/dev/null 2>&1 &&
+    result="$(run_optional_freshness "$helper" "$repo_root" "$config_dir" "${guard_evidence_names[@]}" 2>/dev/null)" &&
+    valid_freshness_result "$result"; then
     while IFS=$'\t' read -r key value; do
       case "$key" in
         installed) installed_version="$value" ;;
@@ -240,7 +339,7 @@ resolve_vintages() {
           case "$value" in matching|different|unknown) host_guard_states[$state_index]="$value" ;; esac
           ;;
       esac
-    done < <(node "$helper" "$repo_root" "$config_dir" "${guard_evidence_names[@]}" 2>/dev/null)
+    done <<< "$result"
   fi
   note_version "$installed_version" "$repo_root/node_modules/@codyswann/lisa/package.json"
   note_version "$plugin_tree_version" "$plugin_tree"

package/all/copy-overwrite/scripts/lisa-enforcement-freshness.mjs

@@ -177,4 +177,7 @@ if (
       emit("channel_path", entry.installPath);
     }
   }
+  // Bash stages all facts until this terminal row and successful process exit;
+  // a killed or failed helper must not lend authority to its earlier output.
+  emit("complete", "1");
 }

package/all/copy-overwrite/scripts/lisa-work-item.mjs

@@ -1992,7 +1992,7 @@ export function resetGhVersionCheck() {
   ghVersionChecked = false;
 }
 
-/** The body is required by recovery; all ordinary canonical validation fields remain present. */
+/** Checkpoint history cannot exhaust capture; complete backlink candidates and all other canonical fields survive. */
 export function githubIssueViewArgs(repository, number) {
   return [
     "issue",
@@ -2002,6 +2002,8 @@ export function githubIssueViewArgs(repository, number) {
     repository,
     "--json",
     "number,url,state,body,labels,comments,closedByPullRequestsReferences",
+    "--jq",
+    '.comments |= map(select(.body | contains("[lisa-pr-link]")))',
   ];
 }
 
@@ -2593,21 +2595,58 @@ export function githubBacklinkListArgs(repository, number) {
   return [
     "api",
     "--paginate",
-    "--slurp",
     `repos/${repository}/issues/${number}/comments?per_page=100`,
+    "--jq",
+    '{sourceCount:length,comments:map(select(.body | contains("[lisa-pr-link]")))}',
   ];
 }
 
-/** Complete slurped pages remain bounded and are shared by the canonical writer and controller grant. */
-export function githubBacklinkComments(pages) {
+/**
+ * Native successful pagination emits one compact projected envelope per page.
+ * Counts precede filtering so checkpoint removal cannot evade the original
+ * 100-page/10,000-comment bounds. Decode the entire completed response before
+ * selecting any writer target; full original candidate objects stay ordered.
+ * @param {string} output Complete stdout from a successful bounded native listing.
+ * @returns {object[]} Complete marker candidates, including prose the ownership parser may refuse.
+ */
+export function githubBacklinkComments(output) {
+  if (typeof output !== "string" || !output.trim())
+    throw new Error("invalid or incomplete GitHub backlink pages");
+  const pages = output
+    .trim()
+    .split(/\r?\n/)
+    .map(line => JSON.parse(line));
   if (
-    !Array.isArray(pages) ||
-    pages.length < 1 ||
     pages.length > 100 ||
-    pages.some(page => !Array.isArray(page) || page.length > 100)
+    pages.some(
+      page =>
+        !page ||
+        typeof page !== "object" ||
+        Array.isArray(page) ||
+        Object.keys(page).length !== 2 ||
+        !Object.hasOwn(page, "sourceCount") ||
+        !Object.hasOwn(page, "comments") ||
+        !Number.isSafeInteger(page.sourceCount) ||
+        page.sourceCount < 0 ||
+        page.sourceCount > 100 ||
+        !Array.isArray(page.comments) ||
+        page.comments.length > page.sourceCount ||
+        page.comments.some(
+          comment =>
+            !comment ||
+            typeof comment.body !== "string" ||
+            !comment.body.includes(MARKER) ||
+            !(
+              (typeof comment.id === "string" ||
+                Number.isSafeInteger(comment.id)) &&
+              /^[1-9]\d*$/.test(String(comment.id))
+            )
+        )
+    ) ||
+    pages.reduce((count, page) => count + page.sourceCount, 0) > 10000
   )
     throw new Error("invalid or over-bound GitHub backlink pages");
-  return pages.flat();
+  return pages.flatMap(page => page.comments);
 }
 
 /**
@@ -2623,9 +2662,7 @@ function githubBacklink(ref, prUrl) {
     allowFailure: true,
   });
   if (listing.status !== 0) throw githubFailure(listing, ref);
-  const comments = githubBacklinkComments(
-    safeJson(listing.stdout, `GitHub comments on ${ref}`)
-  );
+  const comments = githubBacklinkComments(listing.stdout);
   // This listing is the read-before-write, and it is fetched here rather than
   // passed in for exactly that reason: the version you last wrote is not the
   // version that is live on a surface other agents also comment on.

package/all/copy-overwrite/scripts/npm-updater-helper-graph.json

@@ -474,7 +474,7 @@
       "children": []
     },
     "lib/npm-update-gh-grants.mjs": {
-      "sha256": "4be8bcfa098b7f7f9cdfe6d7a1f110e5e4fb1e6181bd12d0b7f620f569293f09",
+      "sha256": "62f81b0d6c669594356c8ad63f544d679407100f3fc46723985f286e4d033e50",
       "staticImports": [
         "lib/npm-update-contract.mjs",
         "lisa-automation-provenance.mjs",
@@ -1258,7 +1258,7 @@
       "children": []
     },
     "lisa-work-item.mjs": {
-      "sha256": "203f110fd4752ff89d906276a5115500a2f42289d00cb5435345c90c433edf46",
+      "sha256": "cd1b16e056fefac17018d5c96ad063dc4002f304e4400765e473403186b7175a",
       "staticImports": [
         "lib/invoked-as-script.mjs",
         "node:child_process",

package/dist/core/lisa-owned-hash-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA88DjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAi3DjC,CAAC"}
+{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAs9DjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAy3DjC,CAAC"}

package/dist/core/lisa-owned-hash-ledger.js

@@ -634,6 +634,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
     "scripts/lib/npm-update-gh-grants.mjs": Object.freeze([
         "39cdf37db1ceae3b104038c1e25735a7f805d04f2ab2a7001a853f633485718d",
         "4be8bcfa098b7f7f9cdfe6d7a1f110e5e4fb1e6181bd12d0b7f620f569293f09",
+        "62f81b0d6c669594356c8ad63f544d679407100f3fc46723985f286e4d033e50",
     ]),
     "scripts/lib/npm-update-gh-requests.mjs": Object.freeze([
         "0bfd950560242d6b9ecb93f8d7162e68cb420b631e39d24663ccf803712a4c22",
@@ -988,6 +989,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "f0f3c43bbb6d1e389135b0205a051e64891e539d4272df2a87841ee82a8b7a55",
     ]),
     "scripts/lisa-enforcement-fallback.sh": Object.freeze([
+        "07159250b1172ed0b15896ad251af0ffc84a22f5f24806c06b4e1478f20c9bd8",
         "1bec5f3c284b3febdc471487ee6a23ffb72bd4e7b293f9e26b0188f32318c722",
         "27f4e4b54986f49ddb9a3bf6e02b926d41d85ecd46ab2263cb17a5746820f8bd",
         "3049c2f1051c7c02dd60b62355964651e1565ebe6bdcb5e37634cd686cf1deb1",
@@ -1003,12 +1005,15 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "916b2b48a2b55c2090468c48c972b6c7c5fad39fb53956ceffebdd1ff0c69230",
         "9cab71562d01421d57c6719318a4d03a6249a45c1aea434db3ff26e3065eeb66",
         "9cfad1d691235fa70ccf97603eea2ef177bbded4a34d85aeedc41018c894b591",
+        "a61653e9a4788804249ae6e66924e6c7a69cd06b013b91881361d992b935fbcf",
+        "a7078fee6b5719d8c1f96e145091dc9f1b7a15b002b76f2fabb57909a81ba96f",
         "aafd027c4b6092da15d0389f9e8dcedbd9105e9083057e2da39f78fd5f72e0df",
         "acf05ef7bd86f58042e57b6d4dd3d519efb46131bb38c6bf3b7c05f6d15b20ad",
         "b456ad79aae18ea3af4ae462327653a88ab865ec31c84aa233c3ded512acff32",
         "b4cc14d5dc02c790ea3e51b0134b9c3d5e4a0e8ef08a652817f7485a0badde17",
         "c64765cb502797daa163dbb6cad723b633a7c527dffeb6bd99cca4989a63fcf4",
         "c9604929b1f5d3fee39ef7c3619f89002accf27712dbd38f25b6a7a0ceb0025a",
+        "ca133b6f4b5c1c95de89fc28c4e04c1a8974570737e9173d6e69e960ddb9200b",
         "d7d88e44763694bed5eae998cd3663922c957e49f9f9621d9201f0417a4128ad",
         "d922508529c0ffd6b8411d7fc618b3d14ceb70901746adfbcf49e46eb685d6b9",
         "e0f4f2b11bea5497af12bae0d52902eb3d02b4ec3a7ae8e07236fb09b59cf560",
@@ -1020,6 +1025,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
     "scripts/lisa-enforcement-freshness.mjs": Object.freeze([
         "781bb4da7d2e2ce383c9fb2f1f80d48536697f8c581458c326ffb96b8fefe8db",
         "edc243b4f79a1cbbf16890356ddec15592896d0736e74d13663ba7f548bb0c1f",
+        "f02571c6766dd2ed0914b4cf7e62b045dee8fcd33a0b2298f0be1f5ac0989639",
     ]),
     "scripts/lisa-environment-prepare.mjs": Object.freeze([
         "0c2c2aeed3a8d843b3019e5263aab26790856c0c33f028925d2f0f795a26872d",
@@ -1790,6 +1796,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "c78df9d5f0f3fc388ff60a7db5898478a2a4d6d7325833f10384b5a8c62bb34a",
         "c8cea225a598e8856ed3afac2531f6f7e1235b5cee280f85ef311e70887b6a62",
         "cb708e688daa4ae556ed95baf39bbbe89db1a908512f179cd5022797f4b1018e",
+        "cd1b16e056fefac17018d5c96ad063dc4002f304e4400765e473403186b7175a",
         "cdea136456d2b9880c3abd2bbd402fb08051822b9e92484c66cd184ec7ed7d0f",
         "ce1520dba31d32856d470cf744700e0636518dd3a767627d42ac0a77007d6813",
         "ce5ff040b1f75925bc286027dcb893649edfb408021916920b07105baa2d9949",
@@ -1916,6 +1923,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "702b455a3157565b910904a3acfcdbf4722befc660d60242c649ff020fe96b3b",
         "728bcf6bdfb82c5b312da268db0ec7b50d94ac62c64ec58c70592eb106383f09",
         "7b1d6bba391f105b9d53b91773fd207c9a5e9b5bfcd638e1e6b579d507279d7d",
+        "7c8b9d5b8f7d77dbf520c1009497d041eeb9930103c7f52bfd8b04a4492eb023",
         "8a3c46d3501797ebb53a081c8b35e78e0ceb2b060503332b48e44ccc30d6d0df",
         "8b3ef61c17d94bdf8eee99e02d396c975a12a8b8a3c2e34231eff6aaea3bf392",
         "901c52e08a53f0c7420ddc3308aa49e656429827770c1fd6a3f4ba8c9029d8ad",
@@ -2626,6 +2634,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
     "scripts/lib/npm-update-gh-grants.mjs": Object.freeze([
         "39cdf37db1ceae3b104038c1e25735a7f805d04f2ab2a7001a853f633485718d",
         "4be8bcfa098b7f7f9cdfe6d7a1f110e5e4fb1e6181bd12d0b7f620f569293f09",
+        "62f81b0d6c669594356c8ad63f544d679407100f3fc46723985f286e4d033e50",
     ]),
     "scripts/lib/npm-update-gh-requests.mjs": Object.freeze([
         "0bfd950560242d6b9ecb93f8d7162e68cb420b631e39d24663ccf803712a4c22",
@@ -2979,6 +2988,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "f0f3c43bbb6d1e389135b0205a051e64891e539d4272df2a87841ee82a8b7a55",
     ]),
     "scripts/lisa-enforcement-fallback.sh": Object.freeze([
+        "07159250b1172ed0b15896ad251af0ffc84a22f5f24806c06b4e1478f20c9bd8",
         "1bec5f3c284b3febdc471487ee6a23ffb72bd4e7b293f9e26b0188f32318c722",
         "27f4e4b54986f49ddb9a3bf6e02b926d41d85ecd46ab2263cb17a5746820f8bd",
         "3049c2f1051c7c02dd60b62355964651e1565ebe6bdcb5e37634cd686cf1deb1",
@@ -2994,12 +3004,15 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "916b2b48a2b55c2090468c48c972b6c7c5fad39fb53956ceffebdd1ff0c69230",
         "9cab71562d01421d57c6719318a4d03a6249a45c1aea434db3ff26e3065eeb66",
         "9cfad1d691235fa70ccf97603eea2ef177bbded4a34d85aeedc41018c894b591",
+        "a61653e9a4788804249ae6e66924e6c7a69cd06b013b91881361d992b935fbcf",
+        "a7078fee6b5719d8c1f96e145091dc9f1b7a15b002b76f2fabb57909a81ba96f",
         "aafd027c4b6092da15d0389f9e8dcedbd9105e9083057e2da39f78fd5f72e0df",
         "acf05ef7bd86f58042e57b6d4dd3d519efb46131bb38c6bf3b7c05f6d15b20ad",
         "b456ad79aae18ea3af4ae462327653a88ab865ec31c84aa233c3ded512acff32",
         "b4cc14d5dc02c790ea3e51b0134b9c3d5e4a0e8ef08a652817f7485a0badde17",
         "c64765cb502797daa163dbb6cad723b633a7c527dffeb6bd99cca4989a63fcf4",
         "c9604929b1f5d3fee39ef7c3619f89002accf27712dbd38f25b6a7a0ceb0025a",
+        "ca133b6f4b5c1c95de89fc28c4e04c1a8974570737e9173d6e69e960ddb9200b",
         "d7d88e44763694bed5eae998cd3663922c957e49f9f9621d9201f0417a4128ad",
         "d922508529c0ffd6b8411d7fc618b3d14ceb70901746adfbcf49e46eb685d6b9",
         "e0f4f2b11bea5497af12bae0d52902eb3d02b4ec3a7ae8e07236fb09b59cf560",
@@ -3011,6 +3024,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
     "scripts/lisa-enforcement-freshness.mjs": Object.freeze([
         "781bb4da7d2e2ce383c9fb2f1f80d48536697f8c581458c326ffb96b8fefe8db",
         "edc243b4f79a1cbbf16890356ddec15592896d0736e74d13663ba7f548bb0c1f",
+        "f02571c6766dd2ed0914b4cf7e62b045dee8fcd33a0b2298f0be1f5ac0989639",
     ]),
     "scripts/lisa-environment-prepare.mjs": Object.freeze([
         "0c2c2aeed3a8d843b3019e5263aab26790856c0c33f028925d2f0f795a26872d",
@@ -3713,6 +3727,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "c78df9d5f0f3fc388ff60a7db5898478a2a4d6d7325833f10384b5a8c62bb34a",
         "c8cea225a598e8856ed3afac2531f6f7e1235b5cee280f85ef311e70887b6a62",
         "cb708e688daa4ae556ed95baf39bbbe89db1a908512f179cd5022797f4b1018e",
+        "cd1b16e056fefac17018d5c96ad063dc4002f304e4400765e473403186b7175a",
         "cdea136456d2b9880c3abd2bbd402fb08051822b9e92484c66cd184ec7ed7d0f",
         "ce1520dba31d32856d470cf744700e0636518dd3a767627d42ac0a77007d6813",
         "ce5ff040b1f75925bc286027dcb893649edfb408021916920b07105baa2d9949",
@@ -3838,6 +3853,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "702b455a3157565b910904a3acfcdbf4722befc660d60242c649ff020fe96b3b",
         "728bcf6bdfb82c5b312da268db0ec7b50d94ac62c64ec58c70592eb106383f09",
         "7b1d6bba391f105b9d53b91773fd207c9a5e9b5bfcd638e1e6b579d507279d7d",
+        "7c8b9d5b8f7d77dbf520c1009497d041eeb9930103c7f52bfd8b04a4492eb023",
         "8a3c46d3501797ebb53a081c8b35e78e0ceb2b060503332b48e44ccc30d6d0df",
         "8b3ef61c17d94bdf8eee99e02d396c975a12a8b8a3c2e34231eff6aaea3bf392",
         "901c52e08a53f0c7420ddc3308aa49e656429827770c1fd6a3f4ba8c9029d8ad",