@codyswann/lisa 4.74.8 → 4.75.0

package/plugins/lisa-harper-fabric-devin/hooks/enforce-config-extensions.mjs

@@ -0,0 +1,196 @@
+#!/usr/bin/env node
+import { readFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+
+const BLOCKED = 2;
+const ALLOWED = 0;
+const CONFIG_PATH = "harper-app/config.yaml";
+const ALLOWLIST_PATH = ".lisa/harper-config-extension-allowlist.json";
+
+const readStdin = () => {
+  try {
+    return readFileSync(0, "utf8");
+  } catch {
+    return "";
+  }
+};
+
+const parseHookInput = raw => {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+};
+
+const normalizePath = filePath =>
+  filePath.replace(/\\/g, "/").replace(/^\.\//, "");
+
+const isConfigPath = filePath => {
+  const normalized = normalizePath(filePath);
+  return normalized === CONFIG_PATH || normalized.endsWith(`/${CONFIG_PATH}`);
+};
+
+const repoRelativeConfigPath = filePath => {
+  const normalized = normalizePath(filePath);
+  const index = normalized.lastIndexOf(CONFIG_PATH);
+  return index === -1 ? normalized : normalized.slice(index);
+};
+
+const topLevelExtensionKeys = yamlText => {
+  const keys = [];
+  for (const line of yamlText.split(/\r?\n/)) {
+    if (/^\s*(?:#.*)?$/.test(line) || /^---\s*$/.test(line)) continue;
+    if (/^\s/.test(line)) continue;
+    if (line.startsWith("!!") || ["[", "]", "{", "}"].includes(line[0])) {
+      return null;
+    }
+    const match = line.match(/^(?:"([^"]+)"|'([^']+)'|([^:#][^:]*?)):\s*/);
+    if (!match) return null;
+    const key = match[1] ?? match[2] ?? match[3]?.trim();
+    if (key) keys.push(key);
+  }
+  return Array.from(new Set(keys)).sort();
+};
+
+const gitEnv = () =>
+  Object.fromEntries(
+    Object.entries(process.env).filter(([key]) => !key.startsWith("GIT_"))
+  );
+
+/**
+ * Milliseconds before the baseline read is presumed hung.
+ *
+ * A hang detector, not a budget. `git` reached through PATH on macOS goes via
+ * Apple's `xcrun` shim, measured over 20 seconds under load against 11ms for a
+ * real binary (CodySwannGT/lisa#2887), so a tighter deadline would make this
+ * hook's own timeout the ordinary outcome on a busy machine.
+ */
+const GIT_BUDGET_MS = 30_000;
+
+/** The baseline could not be read at all, as distinct from "there is none". */
+const UNREADABLE = Symbol("unreadable");
+
+/**
+ * The config as HEAD holds it: its text, `null` when HEAD has no such file, or
+ * `UNREADABLE` when git could not be asked.
+ *
+ * THE THREE ANSWERS ARE DELIBERATELY THREE. This used to be
+ * `result.status === 0 ? result.stdout : null`, and `status === 0` is false for
+ * a file that does not exist at HEAD **and** for a child killed at its
+ * deadline — so both became `null`, and the caller reads `null` as "no baseline
+ * to compare against, allow the edit". A busy machine therefore let through
+ * exactly the extension removal this hook exists to block, and nothing anywhere
+ * said the word "time".
+ *
+ * A deadline alone does not fix that. `spawnSync` does not throw when it kills
+ * a child; it returns `{ status: null, stdout: "" }`, which takes the same
+ * branch it always did. The discrimination has to be written, not scheduled —
+ * which is why this call site needed more than the `timeout:` its siblings did.
+ *
+ * `ETIMEDOUT` is set by Node itself, so this is a platform fact rather than a
+ * convention invented here; the shared `bounded-child.mjs` reads the same field,
+ * and this hook writes it out inline because a plugin payload materialized as a
+ * hook has no module to import from.
+ * @param {string} repoRoot Repository root.
+ * @returns {string|null|symbol} The text, `null` when absent, `UNREADABLE` when
+ *   the child was killed.
+ */
+const readGitBlob = repoRoot => {
+  const result = spawnSync(
+    "git",
+    ["-C", repoRoot, "show", `HEAD:${CONFIG_PATH}`],
+    {
+      encoding: "utf8",
+      env: gitEnv(),
+      killSignal: "SIGKILL",
+      timeout: GIT_BUDGET_MS,
+    }
+  );
+  if (result.error?.code === "ETIMEDOUT") return UNREADABLE;
+  return result.status === 0 ? result.stdout : null;
+};
+
+const readAllowlist = (repoRoot, configPath) => {
+  const allowlistFile = path.join(repoRoot, ALLOWLIST_PATH);
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(allowlistFile, "utf8"));
+  } catch {
+    return new Set();
+  }
+
+  const entry = parsed?.[configPath] ?? parsed?.[CONFIG_PATH];
+  const values = Array.isArray(entry)
+    ? entry
+    : Array.isArray(entry?.allowedRemovedExtensions)
+      ? entry.allowedRemovedExtensions
+      : [];
+  return new Set(values.filter(value => typeof value === "string"));
+};
+
+const main = () => {
+  const input = parseHookInput(readStdin());
+  const filePath = input?.tool_input?.file_path;
+  if (typeof filePath !== "string" || !isConfigPath(filePath)) return ALLOWED;
+
+  const repoRoot = process.cwd();
+  const configPath = repoRelativeConfigPath(filePath);
+  let currentText;
+  try {
+    currentText = readFileSync(path.join(repoRoot, configPath), "utf8");
+  } catch {
+    return ALLOWED;
+  }
+
+  const previousText = readGitBlob(repoRoot);
+  // FAIL CLOSED on "could not ask", ALLOW on "there is nothing to compare".
+  // Those are different findings and only the second is safe to permit: a
+  // config with no baseline at HEAD is a new file, while a baseline nobody
+  // could read is an unanswered question, and a guard that permits an edit
+  // because it was too busy to check has not checked.
+  if (previousText === UNREADABLE) {
+    process.stderr.write(
+      `Blocked: could not read HEAD:${CONFIG_PATH} — git was killed after ` +
+        `${String(GIT_BUDGET_MS)}ms without finishing, so the previous ` +
+        `extensions are unknown. This is a timeout, not a finding: nothing ` +
+        `about the edit was measured. Re-run when the machine is quieter.\n`
+    );
+    return BLOCKED;
+  }
+  if (previousText === null) return ALLOWED;
+
+  const previousExtensions = topLevelExtensionKeys(previousText);
+  const currentExtensionKeys = topLevelExtensionKeys(currentText);
+  if (previousExtensions === null || currentExtensionKeys === null)
+    return ALLOWED;
+  const currentExtensions = new Set(currentExtensionKeys);
+  const allowedRemovals = readAllowlist(repoRoot, configPath);
+  const missing = previousExtensions.filter(
+    extension =>
+      !currentExtensions.has(extension) && !allowedRemovals.has(extension)
+  );
+
+  if (missing.length === 0) return ALLOWED;
+
+  process.stderr
+    .write(`Blocked: harper-app/config.yaml dropped required Harper extension(s).
+
+Missing extension(s): ${missing.join(", ")}
+
+Harper does not merge a custom config.yaml with defaults. Removing a top-level
+extension silently disables that runtime surface and may only fail after deploy.
+Re-add the missing extension(s), or document an intentional removal in
+${ALLOWLIST_PATH}:
+
+{
+  "${CONFIG_PATH}": {
+    "allowedRemovedExtensions": ["${missing[0]}"]
+  }
+}
+`);
+  return BLOCKED;
+};
+
+process.exitCode = main();

package/plugins/lisa-harper-fabric-devin/hooks/enforce-config-extensions.sh

@@ -0,0 +1,46 @@
+#!/bin/bash
+# This file is managed by Lisa.
+# Do not edit directly - changes will be overwritten on the next `lisa` run.
+
+# PostToolUse hook: after a harper-app/config.yaml edit, compare the edited
+# extension set against HEAD and block silent removals. Harper does not merge a
+# custom config.yaml with defaults, so removing a top-level extension can disable
+# runtime surfaces without a build-time failure.
+
+PLUGIN_ROOT=${CLAUDE_PLUGIN_ROOT:-}
+if [ -z "$PLUGIN_ROOT" ]; then
+  PLUGIN_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+fi
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPT_PATH="$PLUGIN_ROOT/hooks/enforce-config-extensions.mjs"
+if [ ! -f "$SCRIPT_PATH" ]; then
+  SCRIPT_PATH="$SCRIPT_DIR/enforce-config-extensions.mjs"
+fi
+
+JSON_INPUT=$(cat)
+
+run_check() {
+  if command -v bun >/dev/null 2>&1; then
+    printf '%s' "$1" | bun "$SCRIPT_PATH"
+  else
+    printf '%s' "$1" | node "$SCRIPT_PATH"
+  fi
+}
+
+if [ -f "$SCRIPT_DIR/_extract-edit-paths.sh" ]; then
+  # shellcheck source=/dev/null
+  . "$SCRIPT_DIR/_extract-edit-paths.sh"
+  FILE_PATHS=$(lisa_extract_edit_paths "$JSON_INPUT")
+  if [ -n "$FILE_PATHS" ]; then
+    while IFS= read -r FILE_PATH; do
+      [ -n "$FILE_PATH" ] || continue
+      FILE_INPUT=$(printf '%s' "$JSON_INPUT" | jq --arg path "$FILE_PATH" '.tool_input.file_path = $path')
+      run_check "$FILE_INPUT" || exit $?
+    done <<EOF
+$FILE_PATHS
+EOF
+    exit 0
+  fi
+fi
+
+run_check "$JSON_INPUT"

package/plugins/lisa-harper-fabric-devin/hooks/inject-rules.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Reads the plugin's EAGER rules and injects them into the session context.
+#
+# `rules/eager/` only, and deliberately with NO fallback to a flat `rules/`.
+# This plugin's rules and this script ship in the same directory and are
+# installed as one unit, so there is no vintage in which a split script meets an
+# unsplit rules tree. A fallback here would buy nothing and cost the thing it
+# already cost once: this plugin shipped its whole rule body flat for months and
+# no surface complained, because a fallback that quietly succeeds is
+# indistinguishable from a tree that was never split (#3993). With the branch
+# gone, an unsplit tree injects nothing and is noticed.
+#
+# Reference bodies under `rules/reference/` install alongside and are read only
+# when an eager breadcrumb points at one.
+set -euo pipefail
+
+ROOT="${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-${CODEX_PLUGIN_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}}}"
+RULES_DIR="$ROOT/rules/eager"
+
+[ -d "$RULES_DIR" ] || exit 0
+
+for rule in "$RULES_DIR"/*.md; do
+  [ -f "$rule" ] || continue
+  printf '\n<lisa-harper-fabric-rule path="%s">\n' "$rule"
+  cat "$rule"
+  printf '\n</lisa-harper-fabric-rule>\n'
+done

package/plugins/lisa-harper-fabric-devin/hooks.json

@@ -0,0 +1,36 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "^(write|apply_patch|edit)$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/devin-tool-name-shim.sh ${CLAUDE_PLUGIN_ROOT}/hooks/block-generated-artifact-edits.sh"
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "^(write|apply_patch|edit)$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/devin-tool-name-shim.sh ${CLAUDE_PLUGIN_ROOT}/hooks/enforce-config-extensions.sh"
+          }
+        ]
+      }
+    ],
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/devin-tool-name-shim.sh ${CLAUDE_PLUGIN_ROOT}/hooks/inject-rules.sh"
+          }
+        ]
+      }
+    ]
+  }
+}

package/plugins/lisa-harper-fabric-devin/rules/eager/harper-fabric.md

@@ -0,0 +1,31 @@
+# Harper/Fabric Project Rules (load-bearing)
+
+These rules apply to Harper/Fabric component apps managed by Lisa. The head
+below is what changes behaviour in a session that never asks for it; the full
+contract — deploy surface, documentation sync, design-system detail — lives in
+the reference body.
+
+## Mandatory
+
+1. **Build the real thing.** If a change needs a Harper resource, schema
+   update, seed path, or deploy script change, make that change. Do not ship a
+   client-side workaround, a stub, or a partial path for missing backend
+   behaviour unless the user explicitly asks for a stop-gap.
+2. **TypeScript under `src/` is the source.** Every `.js` at the harper-app root
+   (`harper-app/*.js`), plus `harper-app/web/**/*.js` and `harper-app/lib/**`,
+   is a generated deploy artifact. Never edit one — change the matching
+   TypeScript and run `bun run build`.
+3. **`harper-app/config.yaml` does not merge with Harper defaults.** Keep every
+   required top-level extension declared when editing it.
+4. **UI is composed from the project design system.** Extend the design-system
+   component first, then consume it through the barrel. No raw colours, no ad
+   hoc spacing. Every UI change needs Playwright verification with screenshots —
+   typecheck and unit tests are not enough for a visual change.
+5. **Immutable data flow.** `readonly` types, pure transformations, `const` over
+   `let`. Do not mutate parameters, singletons, fixtures, or config objects. No
+   `any`, broad casts, or `ts-ignore` outside a typed adapter.
+6. **Verify before reporting completion.** `bun run build`, `bun run typecheck`,
+   and the smallest relevant test command; plus the project smoke command for
+   deploy-affecting changes. If a command cannot run, report it and the blocker.
+
+Full prose: [reference/harper-fabric.md](../reference/harper-fabric.md).

package/plugins/lisa-harper-fabric-devin/rules/reference/harper-fabric.md

@@ -0,0 +1,52 @@
+# Harper/Fabric Project Rules
+
+These rules apply to Harper/Fabric component apps managed by Lisa.
+
+## Build The Real Thing
+
+- Do not ship client-side workarounds for missing backend behavior. If a change needs a Harper resource, schema update, seed path, or deploy script change, make that change.
+- Do not silently downgrade a feature to a stub, mock, or partial path. Only use a stop-gap when the user explicitly asks for one.
+- Treat deployed Fabric behavior as part of the product. A change is unfinished until the local build and the relevant deployed or smoke path agree.
+
+## TypeScript Is Source
+
+- TypeScript under `src/` is the source of truth for Harper resources, browser modules, shared libraries, and operational scripts.
+- `harper-app/config.yaml`, `harper-app/schema.graphql`, HTML, CSS, docs, and research fixtures are source assets.
+- `harper-app/config.yaml` does not merge with Harper defaults. Keep every required top-level extension declared when editing it; the Harper Fabric hook blocks accidental extension drops unless the removal is documented in `.lisa/harper-config-extension-allowlist.json`.
+- Every `.js` at the harper-app root (`harper-app/*.js` — `resources.js`, `resource-*.js`, and any other compiled module) plus `harper-app/web/**/*.js` and `harper-app/lib/**` are generated deploy artifacts. Never edit them directly; change the matching TypeScript and run `bun run build`. Name compiled resource modules `resource-*.ts` so their output is unambiguously generated; a hand-written `.js` kept at the harper-app root must be re-included in `.gitignore` and listed in `.lisa/harper-generated-artifact-allowlist.txt` so the block hook allows editing it.
+- Deployment, bootstrap, smoke, seed, verify, preview, token, crawl, ingest, and extraction commands must run from compiled JavaScript or generated Harper assets, not stale checked-in JavaScript.
+
+## Harper/Fabric Deploy Surface
+
+- A deployable Harper app must keep `config.yaml`, `schema.graphql`, `resources.js`, and `web/**` at the component root that Fabric packages.
+- Build before symlinking, packaging, or deploying `harper-app/`.
+- Keep runtime secrets out of tracked files. Prefer environment variables or OS keychain helpers; document secret locations without recording secret values.
+- When discovering a Harper/Fabric limitation or workaround, document the symptom, root cause, fix, and tempting broken alternatives in the project runbook.
+
+## Documentation Sync
+
+- Project docs are operational contracts. When commands, schema, deploy shape, data model, seeded-data summary, crawler behavior, credential handling, or UI components change, update the matching project doc in the same change.
+- Harper schema changes must update the conceptual schema docs and any verify paths that assert joins or row counts.
+- Deploy topology, credential rotation, generated-artifact layout, and Fabric workarounds belong in the Fabric runbook.
+- UI component, token, variant, or design-system changes must update the design-system catalog.
+
+## UI Work
+
+- Browser UI must be composed from the project design system. Search the existing design-system catalog and components before adding markup.
+- Add or extend the design-system component first, then consume it from pages.
+- Pages should import UI components through the design-system barrel, not deep component paths.
+- Do not introduce raw colors or ad hoc spacing in UI styles. Use design tokens and update the token docs when adding tokens.
+- Every UI change needs Playwright verification that checks DOM behavior and captures screenshots. Type checks and unit tests are not enough for visual changes.
+
+## Immutable Code
+
+- Prefer immutable data flow: `readonly` types, pure transformations, object/array copies, and explicit returned values.
+- Do not mutate parameters, imported singletons, fixture objects, records, arrays, DOM-derived state, or config objects unless an API requires mutation and the exception is documented locally.
+- Avoid `let`; use `const` and small pure helper functions instead.
+- Avoid `any`, broad casts, and `ts-ignore`. If an external API forces an escape hatch, isolate it behind a typed adapter.
+
+## Verification
+
+- Run `bun run build`, `bun run typecheck`, and the smallest relevant test command before reporting completion.
+- For deploy-affecting changes, also run the project smoke command against the local or deployed Harper endpoint.
+- If a verification command cannot run, report the exact command and blocker.

package/plugins/lisa-harper-fabric-devin/skills/e2e-coverage-gaps/SKILL.md

@@ -0,0 +1,117 @@
+---
+name: e2e-coverage-gaps
+description: Playwright/e2e coverage-gap explorer that FEEDS THE LIFECYCLE. Use when asked to find paths the automated end-to-end suite does NOT cover — routes with no test at all, or flows that are only happy-path tested (missing error, validation, permission, empty, loading, and edge states). It inventories the app's routes and the existing Playwright tests, explores the running app to confirm each uncovered or under-covered path is real and reachable, and files bounded build-ready work for worthwhile test gaps via lisa-tracker-write. For human usability/experience issues (confusing, cramped, or broken UI), use the lisa-exploratory-qa skill instead.
+---
+
+# E2E Coverage Gaps
+
+On runtimes without the rule tree (Antigravity), read **Worth doing** in `lisa-track` for the same value and decline policy.
+
+## Overview
+
+Find where the automated end-to-end (Playwright) suite is **blind**: routes with no test at all, and
+flows that only assert the **happy path** while ignoring error, permission, empty, loading, and edge
+cases. Inventory the app's routes and the existing tests, explore the running app to confirm each gap
+is real and reachable, then group worthwhile gaps into **bounded build-ready missing-test work items** so it enters the
+Lisa lifecycle.
+
+This skill is purely about **automated-coverage gaps**. It does not judge whether the UI is confusing
+or pretty — for human usability findings, use the `lisa-exploratory-qa` skill.
+
+## Parameters
+
+- **`target-url | env`** (first positional) — the app to inventory and explore.
+- **`ready=true|false`** — build-ready state for the missing-test tickets (**default `true`**). Adding
+  missing coverage is safe to queue, so these default to build-ready; pass `ready=false` to leave them
+  in the backlog for human triage.
+
+## Core Workflow
+
+### 1. Establish Scope
+
+- Identify the target environment, account type, and browser requirement, and read the `ready` flag
+  (default `true`).
+- **Confirm the tracker is configured.** Gaps are filed as tickets, so read `tracker` from
+  `.lisa.config.json` (local overrides global). If it is unset, stop and report that the tracker must
+  be configured (via `/lisa:setup:jira` / `:github` / `:linear`) before gaps can be filed.
+
+### 2. Inventory App Routes
+
+- Enumerate every route/screen from the project's routing source — filesystem routes, the router
+  config, navigation definitions, or a generated sitemap.
+- For each route capture: its path + params, the auth/role it requires, and the primary user actions
+  reachable from it (forms, mutations, filters, flows).
+
+### 3. Inventory Existing Playwright Coverage
+
+- Inspect the Playwright config, auth/setup projects, fixtures, constants, selectors, spec directories,
+  skipped/TODO/flaky tests, retries, and viewport/device projects.
+- For each spec, record which route(s)/flow(s) it exercises and whether it asserts **behavior** or just
+  **presence**.
+- Use existing test helpers/selectors when exploring — they reveal intended flows and stable hooks.
+
+### 4. Compute the Gap Matrix
+
+Map routes/flows against existing coverage and classify each gap:
+
+- **Uncovered route/flow:** no test touches it at all.
+- **Happy-path-only:** the success case is tested but the non-happy paths are not — missing
+  error/validation, permission/denied, empty/zero-state, loading/slow, and boundary/edge scenarios.
+- **Assertion-thin:** a test exists but asserts presence rather than behavior/outcome.
+- **Skipped/TODO/flaky:** coverage exists but is disabled or unreliable.
+- **Breakpoint gap:** a flow is only tested at a single viewport when behavior changes across
+  breakpoints.
+
+### 5. Explore to Confirm
+
+- Apply `do-it-now`'s **Worth doing** guidance: missing coverage alone is not a defect. Identify a required behavior or credible material risk; decline low-value gaps without filing and group related accepted gaps.
+- Navigate each candidate gap in the running app to confirm it is real, reachable, and worth a test.
+  Discard gaps that aren't actually reachable or are intentionally out of scope.
+
+### 6. File Bounded Work for Accepted Gaps
+
+Each accepted gap or coherent group becomes a leaf **missing-test** work item created via `lisa-tracker-write` (the
+vendor-neutral writer — it dispatches to the configured tracker and runs the validation gate; never
+call a vendor `*-write-*` skill directly), `issue_type: Task`, **build-ready per the `ready` flag
+(default `true`)**. For `ready=true`, pass `build_ready: true`. For `ready=false`,
+pass `human_gate: "Coverage work explicitly held for operator prioritization"` instead.
+Each ticket MUST specify:
+
+- The **route/flow** and the exact **user behavior the test must assert**.
+- **Which scenario is missing** (uncovered vs which non-happy path: error / validation / permission /
+  empty / loading / edge / breakpoint).
+- The **stable selector / fixture / flow** to use — concrete and automatable.
+- **Three-audience description** + **Gherkin acceptance criteria** describing the test to add.
+
+### Idempotency — don't spam duplicates
+
+Before creating a ticket, follow `rejection-detection` — **Proposal rejection memory**:
+use `<!-- [lisa-e2e-coverage-gaps] key=<candidate-key> -->` with the normalized route +
+missing scenario hashed deterministically by that rule's existing formula. Search open AND
+closed tickets, including its body-enumeration fallback for search-index lag. Match by the
+marker for any constituent gap, never by title alone. Reuse open matches. For legacy issues
+without a marker or with the older `[lisa-e2e-coverage-gaps] <gap-key>` slug marker, read
+bodies and closing discussions to establish a semantic match; title similarity
+alone is insufficient. A **Not planned** decision suppresses the same accepted
+limitation, even when seen again later. Re-propose only for a materially changed
+consequence, requirement, or risk that addresses the decline. A completed fix may
+have a real regression, which must be verified before filing. Grouped work retains
+the constituent gap markers so a later pass can find it.
+
+## Output
+
+No report file. Emit a concise in-session summary:
+
+- **Route inventory:** count of routes/screens discovered.
+- **Existing coverage:** strengths and thin areas (skipped/flaky, assertion-thin, single-viewport).
+- **Gap matrix:** uncovered vs happy-path-only vs breakpoint gaps.
+- **Tickets filed:** each gap with its created/referenced ticket ref and build-ready state.
+
+## Quality Bar
+
+- Distinguish **no coverage** from **happy-path-only** — both are gaps, but the ticket must say which.
+- Every ticket must stand alone for an implementer who was not in the session and must be concretely
+  automatable (named route, behavior, and stable hook).
+- Do not refile gaps already covered or already ticketed (marker check).
+- This skill is about automated coverage only — route human usability issues to `lisa-exploratory-qa`.
+- Preserve unrelated repo changes.