@codyswann/lisa 4.74.8 → 4.75.0

package/plugins/lisa-devin/skills/lisa-github-read-issue/SKILL.md

@@ -0,0 +1,305 @@
+---
+name: lisa-github-read-issue
+description: "Fetches the full scope of a GitHub Issue — metadata, body sections, all comments, native sub-issue parent and children, linked PRs, related issues parsed from `Blocks/Blocked by/Relates to/Duplicates/Cloned from` lines, and any cross-repo references. Produces a consolidated context bundle that downstream agents consume so they never act on an issue in isolation. The GitHub counterpart of lisa-jira-read-ticket."
+allowed-tools: ["Bash", "Skill"]
+---
+
+# Read GitHub Issue: $ARGUMENTS
+
+Fetch the full scope of the issue AND its related graph. Downstream agents must never act on an issue in isolation — always call this skill first so they see blockers, sibling sub-issues, linked PRs, and historical comments.
+
+This skill is the GitHub counterpart of `lisa-jira-read-ticket`. The output bundle structure mirrors the JIRA bundle so vendor-neutral consumers can parse either with minimal branching.
+
+Repository name for scoped comments and logs: `basename $(git rev-parse --show-toplevel)`.
+
+## Phase 1 — Resolve Context
+
+1. Confirm `gh auth status` succeeds.
+2. Parse `$ARGUMENTS`. Accept either:
+   - `<org>/<repo>#<number>` token, OR
+   - `https://github.com/<org>/<repo>/issues/<number>` URL.
+
+   If `$ARGUMENTS` is just `#<number>` or `<number>`, resolve `<org>/<repo>` from `.lisa.config.json` (`github.org` / `github.repo`).
+3. If the input doesn't parse cleanly, stop and report. Do NOT guess.
+
+## Phase 2 — Fetch Primary Issue
+
+```bash
+gh issue view <number> --repo <org>/<repo> --json number,title,body,state,stateReason,author,assignees,labels,milestone,createdAt,updatedAt,closedAt,url,comments,reactionGroups,projectItems
+```
+
+Extract and preserve:
+
+### Metadata
+
+- `number`, `title`, `state` (open/closed), `stateReason` (completed/not_planned/reopened/null)
+- `author` (immutable original reporter), `assignees`
+- All labels — partition by namespace: `type:<...>` (issue type), `status:<...>` (workflow status), `priority:<...>`, `component:<...>`, `points:<...>`, `fix-version:<...>`, `claude-triaged-<repo>`, plus any free-form labels
+- `milestone` (name + url)
+- `createdAt`, `updatedAt`, `closedAt`
+- `url` (canonical issue URL)
+
+### Body — parse markdown sections
+
+Walk the markdown body and capture each top-level `## ` section by name. Standard sections (per `lisa-github-write-issue` Phase 3):
+
+- `Context / Business Value`
+- `Technical Approach`
+- `Acceptance Criteria` (preserve the Gherkin code-fence verbatim)
+- `Out of Scope`
+- `Target Backend Environment`
+- `Branch Plan` (derived output per `derived-branch-plan` — parsed so callers can *compare* it against a recomputation, never so they can use it as the base branch)
+- `Sign-in Required`
+- `Repository`
+- `Source Artifacts`
+- `Source Precedence`
+- `Links`
+- `Relationship Search`
+- `Validation Journey` (preserve verbatim — pass through to verifier agents)
+- `Open Questions`
+- `Current Product`
+
+Any other `##` section: capture under `extra_sections` so callers can see PRDs that adopt non-standard sections.
+
+### Comments
+
+Fetch ALL comments, always through the paginated endpoint, flattened into one array: `gh api repos/<org>/<repo>/issues/<number>/comments --paginate --slurp | jq 'add // []'` (author, body, created_at for each). `--paginate` alone emits one JSON array per page, so reading or counting its raw output undercounts; `--slurp` plus `jq 'add'` flattens the pages first. The `comments` field of `gh issue view --json` is not the source of record — it can be capped. Do not truncate. The fetched count is the number of comments after flattening (`... | jq 'add // [] | length'`); compare it with the issue's `comments` total (`gh api repos/<org>/<repo>/issues/<number> --jq .comments`); if they differ or a page fails, set `comments_complete: false` and say so at the top of the Comments section. Flag comments that contain:
+- Credentials, reproduction steps
+- Status updates from stakeholders
+- Decisions
+- Triage headers like `[<repo>]`
+
+Pagination is unconditional — never skip `--paginate` because an issue looks short.
+
+## Phase 3 — Fetch Sub-issue Graph (Parent + Children)
+
+GitHub native sub-issues are exposed via GraphQL:
+
+```graphql
+query($org:String!,$repo:String!,$number:Int!){
+  repository(owner:$org,name:$repo){
+    issue(number:$number){
+      id
+      parent { number title state url repository { nameWithOwner } }
+      subIssues(first: 100) {
+        nodes {
+          number title state url
+          repository { nameWithOwner }
+          labels(first: 50) { nodes { name } }
+          assignees(first: 5) { nodes { login } }
+        }
+      }
+    }
+  }
+}
+```
+
+```bash
+gh api graphql -f query='<above>' -F org=<org> -F repo=<repo> -F number=<number>
+```
+
+Capture:
+- **Parent sub-issue**: number, title, state, url, repo.
+- **Child sub-issues**: list with number, title, state, url, repo, labels (especially `type:` and `status:`), assignees.
+
+If the GraphQL `parent` / `subIssues` fields aren't available (older GHES), fall back to parsing `Parent: #<n>` text in the body and recording sub-issue text references — note "GraphQL sub-issues unavailable" in the bundle so callers know parent-link is text-based.
+
+## Phase 4 — Parse Issue Links from Body
+
+The body's `## Links` section encodes typed relationships. Parse:
+
+| Pattern (case-insensitive) | Link type |
+|----------------------------|-----------|
+| `Blocks #<n>` or `Blocks <org>/<repo>#<n>` | `blocks` |
+| `Blocked by #<n>` or `Blocked by <org>/<repo>#<n>` | `is blocked by` |
+| `Relates to #<n>` or `Relates to <org>/<repo>#<n>` | `relates to` |
+| `Duplicates #<n>` or `Duplicates <org>/<repo>#<n>` | `duplicates` |
+| `Cloned from #<n>` or `Cloned from <org>/<repo>#<n>` | `clones` |
+| `Resolves #<n>` or `Closes #<n>` or `Fixes #<n>` (PR refs) | remote-link to PR |
+
+For each parsed reference, fetch the linked issue/PR:
+
+```bash
+gh issue view <link-number> --repo <link-org>/<link-repo> --json number,title,state,labels,assignees,url
+gh pr view <link-number> --repo <link-org>/<link-repo> --json number,title,state,reviewDecision,merged,mergedAt,url,reviewRequests,reviews,comments
+```
+
+For each linked **issue**, capture: number, title, state, type (from labels), status (from labels), assignees, url.
+
+For each linked **PR**, capture: number, title, state, mergedAt, reviewDecision, unresolved review comments, url.
+
+**Special handling for `is blocked by`:** include the linked issue's PR refs (parse `Resolves` lines in its body) and fetch each PR's state, so the agent knows whether the blocker is actually shipped.
+
+## Phase 5 — Fetch Sibling Sub-issues (Epic Context)
+
+If the primary issue has a parent sub-issue (i.e., is a Story / Task / Sub-task / Improvement under an Epic):
+
+1. Fetch the parent Epic in full via Phase 2 logic — full body, all comments, Validation Journey if present.
+2. Fetch the parent Epic's other sub-issues (siblings) via the same GraphQL `subIssues` query against the parent. Filter out the primary issue itself.
+3. For each sibling, capture: number, title, type label, status label, assignee, url. Read the first paragraph of each sibling's body for context. If a sibling has `status:in-progress` with an assignee different from the primary issue's assignee, **flag prominently** so the caller can avoid duplicate work.
+
+If the primary issue IS an Epic, capture all children via Phase 3's `subIssues` traversal (already done).
+
+## Phase 6 — Fetch Linked PRs and Label-Event History
+
+GitHub's native `closingIssuesReferences` and timeline give the canonical PR↔Issue relationship. The same timeline read also exposes label events, which are Lisa's GitHub-native transition history. Keep this as one GraphQL read path; do not add a second REST timeline fetch.
+
+```bash
+query='query($org:String!,$repo:String!,$number:Int!,$cursor:String){
+  repository(owner:$org,name:$repo){
+    issue(number:$number){
+      closedByPullRequestsReferences(first:50){
+        nodes{number title state merged mergedAt url repository{nameWithOwner}}
+      }
+      timelineItems(
+        first:100
+        after:$cursor
+        itemTypes:[CROSS_REFERENCED_EVENT,LABELED_EVENT,UNLABELED_EVENT]
+      ){
+        pageInfo{hasNextPage endCursor}
+        nodes{
+          ...on CrossReferencedEvent{
+            createdAt
+            actor{login}
+            source{...on PullRequest{number title state url repository{nameWithOwner}}}
+          }
+          ...on LabeledEvent{
+            createdAt
+            actor{login}
+            label{name}
+          }
+          ...on UnlabeledEvent{
+            createdAt
+            actor{login}
+            label{name}
+          }
+        }
+      }
+    }
+  }
+}'
+
+cursor=null
+while :; do
+  if [ "$cursor" = null ]; then
+    page=$(gh api graphql -f query="$query" -F org=<org> -F repo=<repo> -F number=<number>)
+  else
+    page=$(gh api graphql -f query="$query" -F org=<org> -F repo=<repo> -F number=<number> -f cursor="$cursor")
+  fi
+  printf '%s\n' "$page"
+  has_next=$(printf '%s\n' "$page" | jq -r '.data.repository.issue.timelineItems.pageInfo.hasNextPage')
+  cursor=$(printf '%s\n' "$page" | jq -r '.data.repository.issue.timelineItems.pageInfo.endCursor')
+  [ "$has_next" = true ] || break
+done
+```
+
+Capture:
+- **Linked PRs**: PR number, title, state, mergedAt, repo, url. Dedupe with PRs found in Phase 4. Preserve the existing `CrossReferencedEvent` behavior for PR linkage; widening the query must not change that consumer shape.
+- **Label-event history**: chronological `LabeledEvent` and `UnlabeledEvent` entries with event kind, label name, actor login, and `createdAt`. Preserve oldest→newest order across all pages. Status labels (`status:*`) are the GitHub transition history that downstream rejection detection consumes, but keep non-status label events too so callers can audit the full label stream.
+
+Pagination is mandatory. `timelineItems(first:100)` silently truncates busy issues unless `pageInfo.hasNextPage` / `endCursor` is followed. If a page fetch fails, record label-event history as `unknown` with the error and continue assembling the bundle; a history read failure must never block the build.
+
+For each PR, fetch unresolved review comments via `gh pr view <num> --repo <org>/<repo> --json reviews,reviewThreads`.
+
+## Phase 7 — Assemble Context Bundle
+
+Produce a single structured output that the caller can pass verbatim to downstream agents. Use this format:
+
+```text
+# Issue Context: <org>/<repo>#<number>
+
+## Primary Issue
+- Ref: <org>/<repo>#<number>
+- URL: <url>
+- Type: <type from `type:` label>
+- Status: <status from `status:` label>
+- State: <open|closed> (<stateReason>)
+- Priority: <priority from `priority:` label>
+- Author: <login>
+- Assignees: <list>
+- Parent: <parent-ref> — <parent-title>  (or "None")
+- Milestone: <name>  (or "None")
+- Labels: <comma-separated raw labels>
+- Components: <list from `component:` labels>
+- Story points: <n from `points:` label>  (or "None")
+- Fix version: <from `fix-version:` label or milestone>
+- Created: <ISO> | Updated: <ISO> | Closed: <ISO or "—">
+
+### Body sections
+#### Context / Business Value
+<verbatim>
+
+#### Technical Approach
+<verbatim>
+
+#### Acceptance Criteria
+<verbatim, including the gherkin fence>
+
+#### Validation Journey
+<verbatim or "None">
+
+#### Out of Scope
+<verbatim>
+
+#### Source Artifacts / Source Precedence / Links / Relationship Search / Repository / Sign-in Required / Target Backend Environment / Open Questions / Current Product
+<each verbatim, omit those not present>
+
+### Comments (<fetched> of <total>; comments_complete: <true|false>)
+<when incomplete: "INCOMPLETE — <fetched> of <total> comments read via <substrate>">
+<chronological comments with author + ISO timestamp + body. Flagged items called out.>
+
+## Sub-issue graph
+### Parent
+<parent block: ref, title, state, url, type label> (or "None — this is an Epic / unparented")
+
+### Sub-issues (children, <count>)
+- <ref> — <type> — <status> — <state> — <title>
+  - <one-paragraph body summary>
+  - <FLAG: in progress by other assignee> if applicable
+
+## Linked Issues (parsed from body `## Links`)
+### Blocks (<count>)
+<per-issue block>
+
+### Is Blocked By (<count>)
+<per-issue block; include shipped/not-shipped state of any linked PRs>
+
+### Relates To (<count>)
+<per-issue block>
+
+### Duplicates / Clones
+<per-issue block>
+
+## Linked Pull Requests
+### Native (closedByPullRequestsReferences + cross-references)
+- <pr-ref> — <state> — <title> — <reviewDecision>
+  <body summary + unresolved review comments>
+
+### Body-referenced (`Resolves #<n>`)
+<per-PR block>
+
+## Label-Event History
+- Status: <known|unknown>
+- Events:
+  - <ISO> — <labeled|unlabeled> — <label-name> — <actor-login>
+  - ...
+
+## Sibling Sub-issues (other children of the same parent, <count>)
+- <ref> — <type> — <status> — <assignee> — <title>  **[FLAG: in progress by other assignee]**
+
+## Summary for Downstream
+- Full graph fetched: <issue-count>
+- Blockers still open: <list>
+- Related in-flight work: <list>
+- Relevant PRs: <list with state>
+```
+
+## Rules
+
+- Never summarize or truncate the primary issue's body or Validation Journey section.
+- Never skip a link type, even if it seems unrelated — the agent downstream decides relevance.
+- If a linked issue / PR returns an access error (private repo, deleted, etc.), capture the error and continue. Do not abort the read.
+- Flag in-flight sibling work prominently so the caller can avoid duplicate implementation.
+- If the issue has no parent sub-issue, state this explicitly — do not silently skip Phase 5.
+- Output is pure context. This skill never modifies the issue.
+- The body parser must be tolerant of small format variations (different `##` casings, missing optional sections) but strict enough that downstream skills can rely on the named sections being present when they exist.

package/plugins/lisa-devin/skills/lisa-github-sync/SKILL.md

@@ -0,0 +1,201 @@
+---
+name: lisa-github-sync
+description: "Syncs plan progress to a linked GitHub Issue. Posts plan contents, progress updates, branch links, and PR links at key milestones. Use this skill throughout the plan lifecycle to keep issues in sync. The GitHub counterpart of lisa-jira-sync."
+allowed-tools: ["Bash", "Read", "Glob", "Grep"]
+---
+
+# GitHub Issue Sync
+
+Sync current plan progress to a GitHub Issue: `$ARGUMENTS`
+
+If no argument is provided, search for an issue ref (`org/repo#<number>` or `https://github.com/<org>/<repo>/issues/<n>` URL) in the active plan file (most recently modified `.md` in `plans/`).
+
+Optional arguments include `pr_url=<url>` for the live pull request and `merge_sha=<sha>` once merged.
+
+## Workflow
+
+### Step 1: Identify Issue and Context
+
+1. **Parse issue ref** from `$ARGUMENTS` or extract from the active plan file.
+2. **Fetch current issue state**:
+
+   ```bash
+   gh issue view <number> --repo <org>/<repo> --json number,title,state,labels,milestone,assignees,comments,url
+   ```
+
+3. **Determine current milestone** by checking:
+   - Does a plan file exist? → Plan created
+   - Is there a working branch? → Implementation started
+   - Are tasks in progress? → Active implementation
+   - Is there an open PR? → PR ready for review
+   - Is the PR merged? → Complete
+
+### Step 2: Gather Update Content
+
+| Milestone | Content to post |
+|-----------|-----------------|
+| **Plan created** | Plan summary, branch name, link to PR (if draft exists) |
+| **Implementation in progress** | Task completion summary (X of Y tasks done), any blockers |
+| **PR ready** | PR link, summary of changes, test results |
+| **PR merged** | Final summary, suggest moving issue to `status:done` |
+
+### Step 3: Post Update
+
+For `--rollup`, skip this milestone path and use Step 5's classifier decision.
+
+1. **Idempotency check** — read the issue's recent comments. If the most recent comment with the prefix `[claude-sync] <milestone>` matches the current milestone AND the body content is unchanged, skip the post (no duplicate).
+2. **Add the comment** using `lisa-tracker-sync` — **Agent attribution** for the agent-composed body; keep any existing disclosure:
+
+   ```bash
+   gh issue comment <number> --repo <org>/<repo> --body-file /tmp/sync-comment.md
+   ```
+
+   The body must start with `[claude-sync] <milestone>` so the next sync run can locate it for comparison.
+
+3. **Report** to the user what was synced.
+
+### Step 3b: Ensure PR Backlink
+
+When `$ARGUMENTS` includes `pr_url=<url>` for `PR ready` or `PR merged`, ensure the GitHub Issue has a durable ticket -> PR link:
+
+1. Make sure the PR body contains `Refs #<n>` (or the fully qualified cross-repo form) — never a closing keyword, per the GitHub rule in `lisa-git-submit-pr`. Read the issue side with `gh api graphql` against `issue.timelineItems`, or `gh issue view <number> --json closedByPullRequestsReferences`. **Not** `gh issue view --json timelineItems`: `timelineItems` is not a supported field for that command, so the check silently returns nothing useful rather than failing loudly.
+2. Establish the managed backlink comment by running the command that owns it — never by hand, and never by describing the procedure here:
+
+   ```bash
+   node scripts/lisa-work-item.mjs backlink --ref <work-item> --pr-url <url>
+   ```
+
+   It creates the `[lisa-pr-link]` comment or updates the one already present, instead of appending duplicates, so it is safe to run on every milestone. This is **unconditional**, not contingent on step 1 failing: under the non-closing rule GitHub never creates a native development link (that surface is the closing-reference mechanism), so this comment is the only ticket-side backlink there will be — run it whether or not native linkage exists or cannot be verified, because the required Work-Item Traceability check reads this comment and nothing else guarantees one. The comment carries the marker and the PR URL only; the milestone (`pr-ready` / `pr-merged`) and merge SHA belong in the milestone progress note, so that a rerun at a new milestone still converges on one backlink comment.
+
+Native GitHub linkage cannot be verified under the non-closing rule because it is never created in the first place, so the managed comment is not a contingency here — it is the mechanism. The issue must show the PR from at least one ticket-side surface, and this is the only one available.
+
+### Step 4: Suggest Status Transition
+
+Based on the milestone, suggest (but do NOT automatically perform) a label transition:
+
+| Milestone | Suggested label |
+|-----------|-----------------|
+| Plan created | `status:in-progress` |
+| PR ready | configured `done` label (`status:done` in this repo) |
+| PR merged | no additional build-label transition |
+
+The actual `status:in-progress` flip is owned by `lisa-github-build-intake` (claim) and `lisa-github-agent`. The configured `done` flip is owned by the build-intake owner after a successful build and evidence post. This skill never relabels.
+
+Every suggested transition is bound by the **Tracker status vocabulary** section of `lisa-tracker-sync` — cite it, do not restate the policy. GitHub has **no review lane** (`BUILD_LABEL_DEFAULTS` seeds no `review` key, and `config-resolution` records "no default review label"), so the `pr-ready` milestone suggests the configured `done` label directly; there is no intermediate hop to skip. Resolve every label through the shared resolver rather than an inlined helper.
+
+### Step 5: Parent Status Rollup (`--rollup`)
+
+When invoked with `--rollup`, this skill **derives a parent/container issue's `status:*` label from the roll-up of its child sub-issues** instead of posting a milestone update on a leaf. This implements the GitHub sub-issue-completion arm of the **Parent status rollup (the state machine)** section of the `leaf-only-lifecycle` rule — cite that rule, do not restate the policy. It is the sync-side complement to the write-time labeling (`lisa-github-write-issue`), the validate-time S15 gate (`lisa-github-validate-issue`), and the claim-time gate (`lisa-github-build-intake`); all four cite the same rule so the classification never drifts.
+
+**Resolve the child set the same way `lisa-github-read-issue` does** — native sub-issues via GraphQL, each with its `status:*` label and open/closed state:
+
+```bash
+gh api graphql -f query='
+  query($owner:String!,$repo:String!,$number:Int!){
+    repository(owner:$owner,name:$repo){
+      issue(number:$number){
+        number title state
+        subIssues(first:100){ nodes { number state labels(first:20){ nodes { name } } } }
+      }
+    }
+  }' -F owner=<org> -F repo=<repo> -F number=<parent-number>
+```
+
+If the `subIssues` field is unavailable (older GHES), fall back to body parentage exactly as `lisa-github-read-issue` does. If the issue has **no** children it is a leaf, not a parent — rollup is N/A; behave as a normal milestone sync.
+
+**Evaluate the required children over the env ladder `in-progress < dev < staging < production` (the ordered keys of the GitHub env-keyed `done` map, e.g. `status:on-dev < status:on-stg < status:done`) and take the first match** (canonical roles from `config-resolution`; the GitHub label map is `status:blocked`, `status:in-progress`, env-keyed `done`):
+
+| If among the required child leaves… | Derived parent role | GitHub label |
+|---|---|---|
+| any child carries `status:blocked` (or is otherwise blocked) | `blocked` | `status:blocked` |
+| else **every** required child has shipped to some env (each at a `done`-map label, e.g. `status:on-dev`/`status:on-stg`/`status:done`) | `done[min-env]` | the **least-advanced** env label among them (all `status:on-stg` → `status:on-stg`; mixed dev+staging → `status:on-dev`; all production → `status:done`) |
+| else any child has **started** (`status:in-progress`, or shipped to an env while a sibling has not) | `claimed` | `status:in-progress` |
+| else (children exist, none started) | — | unchanged — parent keeps its non-ready container label |
+
+- **Blocked dominates — and the rollup must say which child and which kind** — a single blocked child surfaces `status:blocked` on the parent even while siblings progress, so a human sees the parent needs attention. `status:blocked` alone is a single bit and cannot tell a child waiting on an external event from one whose acceptance criteria are unbuildable; the second never clears on its own.
+- **Run the shared classifier for every derived rollup state before writing the label or comment**, not only for `status:blocked`. Include the exact rendered state and child tally in the classifier input alongside the resolved child graph, so `change.changed` covers the complete rollup note for `status:in-progress`, every env-keyed `done`, and `status:blocked` alike:
+
+```bash
+run_rollup_classifier() {
+  local input_path="$1"
+  local attempted_paths=""
+  local seen_root=""
+  local candidate_suffix="scripts/rollup-blocker-classification.mjs"
+  local root root_real candidate candidate_real expected_candidate
+  local classifier_output
+
+  for root in "${CLAUDE_PLUGIN_ROOT:-}" "${PLUGIN_ROOT:-}"; do
+    [ -n "$root" ] || continue
+    [ "$root" != "$seen_root" ] || continue
+    seen_root="$root"
+    case "$root" in
+      /*) ;;
+      *) continue ;;
+    esac
+    case "$root" in
+      */../*|*/..|*/./*|*/.) continue ;;
+    esac
+
+    candidate="${root%/}/$candidate_suffix"
+    if [ -z "$attempted_paths" ]; then
+      attempted_paths="$candidate"
+    else
+      attempted_paths="$attempted_paths, $candidate"
+    fi
+
+    root_real="$(realpath "$root" 2>/dev/null)" || continue
+    [ -f "$candidate" ] && [ -r "$candidate" ] || continue
+    candidate_real="$(realpath "$candidate" 2>/dev/null)" || continue
+    expected_candidate="${root_real%/}/$candidate_suffix"
+    [ "$candidate_real" = "$expected_candidate" ] || continue
+
+    if classifier_output="$(
+      node "$candidate" --input="$input_path" 2>/dev/null
+    )"; then
+      printf '%s\n' "$classifier_output"
+      return 0
+    fi
+
+    printf 'Rollup classifier failed at trusted path: %.4000s\n' \
+      "$candidate" >&2
+    return 1
+  done
+
+  printf 'No usable rollup classifier; attempted paths: %.4032s\n' \
+    "$attempted_paths" >&2
+  return 1
+}
+
+if ! CLASSIFIER_REPORT="$(run_rollup_classifier "<graph.json>")"; then
+  echo "Rollup classifier failed before any lifecycle or comment write." >&2
+  exit 1
+fi
+```
+
+  When the derived state is blocked, its report names, per class, the blocking leaf, the path to it (`#1495 -> #1515 -> #1547`) and **who must act** — that text goes in the rollup comment verbatim. It exits non-zero when it classified nothing (unreadable graph, no children, no readable child): that is a strict **no-write** result. Do not change a label and do not post/update a rollup comment; report the classifier failure to the caller. Never fall through to "no blocked children", infer a class from prose, or apply the `spec_defect` marker from a flow — see `leaf-only-lifecycle` → **Classifying a hold**.
+- **Least-advanced env wins** — the parent reaches an env only when every required child has reached at least that env; it never sits ahead of its laggard child. Native closure (`gh issue close --reason completed`) fires only when the resolved env is the production `status:done`, never at `status:on-dev`/`status:on-stg`.
+- **"Required" children only** — a child labelled won't-do / optional does not hold the parent open; only leaves that must ship count toward the env-rollup check.
+- **Recursive** — a parent reaches an env only when its children have all reached at least that env; an Epic reaches it only when its Stories have themselves rolled up to it. Evaluate bottom-up.
+- **Never set the parent to `status:ready`** — `ready` is leaf-only (the human "claim this" signal). Rollup only moves the parent between non-ready container labels.
+
+**Single-environment collapse (this repo).** `.lisa.config.json` `deploy.branches` declares only `production: main`, so the env-keyed `done` resolves to the single label `status:done` — there is no `status:on-dev` / `status:on-stg` and **no dev → staging → prod promotion chain**. Resolve the env rungs via the env-keyed `done` logic in `config-resolution`, but in the single-environment case the only rung is production and it collapses to the one `status:done` value; the rollup never attempts to resolve a dev or staging `done`. Projects that DO have multiple environments keep the env-keyed map and roll the parent up to whichever `done` (including intermediate `status:on-dev`/`status:on-stg`) its leaves have collectively reached.
+
+**Apply the derived label** (only when it differs from the parent's current `status:*`): remove the parent's existing `status:*` label and add the derived one, keeping exactly one `status:*` label so the build-queue invariant holds. Re-read the labels immediately after the edit and require exactly one `status:*`; if the count differs, surface an error and stop without trying to normalize the ambiguous set automatically. Post an idempotent `[claude-sync] rollup` comment naming the derived state and the child tally (e.g. `3/4 leaves terminal, 1 blocked → status:blocked`); when the derived state is `status:blocked` the comment also carries the classifier's per-class section, so the blocking child and its actor are one read rather than a descent. Persist the classifier's `change.fingerprint` with the rollup comment and use `change.changed` as the dedupe decision for every rollup. Use `change.summary` only as display text; it describes the transition and is not a stable key.
+
+```bash
+gh issue edit <parent-number> --repo <org>/<repo> \
+  --remove-label "<current status:*>" --add-label "<derived status:*>"
+```
+
+**Safe default.** If a successfully-read rollup cannot be applied automatically (e.g. ambiguous required-set or a derived terminal that the env logic cannot resolve), this skill does **not** guess — it posts the derived suggestion as a comment and leaves the parent's label untouched. A classifier/read failure is stricter: it writes neither label nor comment. No unsafe transition is ever made.
+
+## Important Notes
+
+- **Never auto-transition labels** — always suggest and let the user / pipeline confirm. The one exception is the explicit `--rollup` parent derivation (Step 5), which moves a *parent's* `status:*` label as the `leaf-only-lifecycle` rule mandates — never a leaf's, and never to `status:ready`.
+- **Idempotent updates** — compare milestone comments as described in Step 3. For parent rollups, use `[claude-sync] rollup` only to locate the managed comment; use Step 5's persisted fingerprint and `change.changed` decision, never prefix or body equality.
+- **Comment format** — use GitHub-flavored markdown (`##` headings, fenced code blocks). The same template is used for the JIRA path (rendered as wiki markup there); keep the markdown source canonical.
+- **Rollup cites the rule by slug** — parent state derivation follows the `leaf-only-lifecycle` rule's state machine; this skill does not restate the policy.
+
+## Execution
+
+Sync the issue now.