@codyswann/lisa 4.79.2 → 4.80.1

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.79.2",
+  "version": "4.80.1",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.79.2",
+  "version": "4.80.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.79.2",
+  "version": "4.80.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.79.2",
+  "version": "4.80.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-devin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.79.2",
+  "version": "4.80.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-devin/.devin-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.79.2",
+  "version": "4.80.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/scripts/check-required-check-promotions.mjs

@@ -139,7 +139,11 @@ import fs from "node:fs";
 import path from "node:path";
 import yaml from "js-yaml";
 
-import { readGates } from "../all/copy-overwrite/scripts/lisa-gates.mjs";
+import {
+  REGISTRY,
+  jobBackedGates,
+  readGates,
+} from "../all/copy-overwrite/scripts/lisa-gates.mjs";
 import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 import { buildRulesetPayload } from "./lisa-ruleset-payload.mjs";
 
@@ -363,7 +367,7 @@ export function collectDeclaredContexts(root) {
  * jobs it declares, and whether it actually runs on every pull request.
  *
  * @param {string} absolute - absolute path to the workflow YAML.
- * @returns {{ jobs: Map<string, string>, onPullRequest: boolean, pathFilterKeys: string[] } | null}
+ * @returns {{ jobs: Map<string, string>, matrixJobs: Set<string>, onPullRequest: boolean, pathFilterKeys: string[] } | null}
  *   the parsed facts, or null when the file is absent or unparseable.
  */
 export function readWorkflow(absolute) {
@@ -395,10 +399,13 @@ export function readWorkflow(absolute) {
       ? ["paths", "paths-ignore"].filter(key => key in pullRequest)
       : [];
   const jobs = new Map();
+  const matrixJobs = new Set();
   for (const [id, job] of Object.entries(doc.jobs ?? {})) {
     jobs.set(id, typeof job?.name === "string" ? job.name : id);
+    const matrix = job?.strategy?.matrix;
+    if (typeof matrix === "object" && matrix !== null) matrixJobs.add(id);
   }
-  return { jobs, onPullRequest, pathFilterKeys };
+  return { jobs, matrixJobs, onPullRequest, pathFilterKeys };
 }
 
 /**
@@ -674,9 +681,109 @@ function calledJobProblems(entry, root, calledName) {
       },
     ];
   }
+  if (entry.job_id === DECLARED_GATES_JOB) {
+    return declaredGateLegProblems(called, entry, calledName, root);
+  }
   return jobNameProblems(called, entry.job_id, calledName, "called");
 }
 
+/** The matrix job that posts one context per declared gate leg. */
+const DECLARED_GATES_JOB = "declared_gates";
+
+/** The literal `name:` that makes each matrix leg post its gate's label. */
+const MATRIX_LABEL_NAME = "${{ matrix.label }}";
+
+/**
+ * Verify a context posted by a `declared_gates` matrix leg rather than by a
+ * hand-written job (#3052).
+ *
+ * A leg has no static `name:` to compare — it is named by the registry label
+ * of the gate it runs. So the entry names that gate, and the guard checks the
+ * three facts that together mean the leg posts this exact string: the matrix
+ * job exists and is named by `matrix.label`, the gate's registry label is the
+ * context half, and no hand-written job still owns the gate. The last one
+ * matters because `momentLegs` emits no leg for a job-backed gate, so a ledger
+ * pointing at a leg that cannot exist would vouch for a context nothing posts.
+ *
+ * @param {{ jobs: Map<string, string>, matrixJobs: Set<string> }} called - parsed called workflow.
+ * @param {object} entry - the ledger entry.
+ * @param {string} calledName - the expected called-job display name.
+ * @param {string} root - absolute repository root.
+ * @returns {{ rule: string, detail: string }[]} problems, empty when sound.
+ */
+function declaredGateLegProblems(called, entry, calledName, root) {
+  // A job named by `matrix.label` with no `strategy.matrix` has no legs, so it
+  // posts no context at all — the name alone proves nothing.
+  if (
+    called.jobs.get(DECLARED_GATES_JOB) !== MATRIX_LABEL_NAME ||
+    !called.matrixJobs.has(DECLARED_GATES_JOB)
+  ) {
+    return [
+      {
+        rule: "called-job-missing",
+        detail: `no '${DECLARED_GATES_JOB}' matrix job named '${MATRIX_LABEL_NAME}' in the called workflow, so no declared gate leg posts '${calledName}'`,
+      },
+    ];
+  }
+  const gate = entry.gate;
+  const label =
+    typeof gate === "string" && Object.hasOwn(REGISTRY, gate)
+      ? REGISTRY[gate].label
+      : undefined;
+  if (label === undefined) {
+    return [
+      {
+        rule: "leg-gate-missing",
+        detail: `a '${DECLARED_GATES_JOB}' entry must name the registry gate whose leg posts the context; got ${JSON.stringify(gate)}`,
+      },
+    ];
+  }
+  if (label !== calledName) {
+    return [
+      {
+        rule: "called-job-name-mismatch",
+        detail: `gate '${gate}' posts '${label}' but the context expects '${calledName}'`,
+      },
+    ];
+  }
+  if (jobBackedGates().includes(gate)) {
+    return [
+      {
+        rule: "leg-gate-job-backed",
+        detail: `gate '${gate}' is still owned by a hand-written job, so the runner emits no leg for it`,
+      },
+    ];
+  }
+  return legDeclarationProblems(root, gate, calledName);
+}
+
+/**
+ * Whether this repository declares the gate at a level that makes its leg run.
+ *
+ * A leg exists only for a gate the project DECLARES at pull-request. A ledger
+ * entry pointing at a leg for an undeclared gate vouches for a context nothing
+ * posts, and a required context that never posts holds every pull request.
+ *
+ * @param {string} root - absolute repository root.
+ * @param {string} gate - the gate whose leg posts the context.
+ * @param {string} calledName - the expected called-job display name.
+ * @returns {{ rule: string, detail: string }[]} problems, empty when sound.
+ */
+function legDeclarationProblems(root, gate, calledName) {
+  const declared = readGates(root).gates?.[gate]?.["pull-request"];
+  const level =
+    typeof declared === "object" && declared !== null
+      ? declared.level
+      : declared;
+  if (level === "required" || level === "optional") return [];
+  return [
+    {
+      rule: "leg-gate-undeclared",
+      detail: `gate '${gate}' is not declared at pull-request in .lisa.config.json (found ${JSON.stringify(declared ?? null)}), so no leg posts '${calledName}'`,
+    },
+  ];
+}
+
 /**
  * Read the promotion ledger.
  *

package/scripts/two-channel-couplings.json

@@ -103,7 +103,7 @@
   },
   "inspected": {
     "workflows": 26,
-    "steps": 824,
+    "steps": 765,
     "couplings": 36,
     "inventory": 186
   },

package/typescript/copy-overwrite/.prettierignore

@@ -109,6 +109,120 @@ scripts/reconcile-nightly-e2e-tracking-cli.mjs
 scripts/reconcile-nightly-e2e-tracking.mjs
 scripts/threshold-ratchet-compare.mjs
 scripts/threshold-ratchet-families.mjs
+#
+# Nested helpers are payload too. Listing only top-level scripts left every
+# scripts/lib/ module exposed: a host whose Prettier resolved a newer minor
+# than Lisa's own reformatted one of them in its pre-commit hook
+# (CodySwannGT/lisa#4450). Still enumerated, for the same reason as above: a
+# scripts/lib/ glob would also stop formatting a host's own helpers.
+scripts/bdd/baseline.mjs
+scripts/bdd/ci-summary.mjs
+scripts/bdd/contract.mjs
+scripts/bdd/discover.mjs
+scripts/bdd/envelope.mjs
+scripts/bdd/markdown-cell.mjs
+scripts/bdd/parse.mjs
+scripts/bdd/projection-model.mjs
+scripts/bdd/projection-ownership.mjs
+scripts/bdd/projection-paths.mjs
+scripts/bdd/projection-render.mjs
+scripts/bdd/projection-write.mjs
+scripts/bdd/projection.mjs
+scripts/bdd/render.mjs
+scripts/bdd/report.mjs
+scripts/bdd/validate.mjs
+scripts/bdd/waivers.mjs
+scripts/lib/automation-provenance-contract.mjs
+scripts/lib/automation-provenance-files.mjs
+scripts/lib/automation-provenance-local.mjs
+scripts/lib/bounded-spawn.mjs
+scripts/lib/gate-failure-diagnosis.mjs
+scripts/lib/github-attestation-provider.mjs
+scripts/lib/github-attestation-recovery.mjs
+scripts/lib/github-attestation-verifier.mjs
+scripts/lib/history-secret-evidence-shape.mjs
+scripts/lib/history-secret-evidence.mjs
+scripts/lib/history-secret-git.mjs
+scripts/lib/history-secret-policy.mjs
+scripts/lib/history-secret-scanner.mjs
+scripts/lib/invoked-as-script.mjs
+scripts/lib/kill-marks.mjs
+scripts/lib/npm-update-allocate.mjs
+scripts/lib/npm-update-authorization.mjs
+scripts/lib/npm-update-broker-client.mjs
+scripts/lib/npm-update-bun.mjs
+scripts/lib/npm-update-cancel-origin.mjs
+scripts/lib/npm-update-cancellation-proof.mjs
+scripts/lib/npm-update-cancellation.mjs
+scripts/lib/npm-update-checkpoint-codec.mjs
+scripts/lib/npm-update-checkpoint.mjs
+scripts/lib/npm-update-classifier-cache.mjs
+scripts/lib/npm-update-contract.mjs
+scripts/lib/npm-update-controller-broker.mjs
+scripts/lib/npm-update-controller-factory.mjs
+scripts/lib/npm-update-controller-recipe.mjs
+scripts/lib/npm-update-execution-adapter.mjs
+scripts/lib/npm-update-gate-hooks.mjs
+scripts/lib/npm-update-gate-install.mjs
+scripts/lib/npm-update-gate-proof.mjs
+scripts/lib/npm-update-gate.mjs
+scripts/lib/npm-update-gh-dispatch.mjs
+scripts/lib/npm-update-gh-grants.mjs
+scripts/lib/npm-update-gh-requests.mjs
+scripts/lib/npm-update-github.mjs
+scripts/lib/npm-update-helper-graph.mjs
+scripts/lib/npm-update-helper-inventory.mjs
+scripts/lib/npm-update-helper.mjs
+scripts/lib/npm-update-hook-installation.mjs
+scripts/lib/npm-update-hook-preload.mjs
+scripts/lib/npm-update-hook-provider.mjs
+scripts/lib/npm-update-hook-read-client.mjs
+scripts/lib/npm-update-hosted-gate.mjs
+scripts/lib/npm-update-hosted-hook.mjs
+scripts/lib/npm-update-hosted-scope.mjs
+scripts/lib/npm-update-invariants.mjs
+scripts/lib/npm-update-isolation.mjs
+scripts/lib/npm-update-leaf-contract.mjs
+scripts/lib/npm-update-leaf.mjs
+scripts/lib/npm-update-native-process.mjs
+scripts/lib/npm-update-npm.mjs
+scripts/lib/npm-update-object.mjs
+scripts/lib/npm-update-orchestrator.mjs
+scripts/lib/npm-update-owner.mjs
+scripts/lib/npm-update-policy.mjs
+scripts/lib/npm-update-prepare.mjs
+scripts/lib/npm-update-process-core.mjs
+scripts/lib/npm-update-process.mjs
+scripts/lib/npm-update-publication.mjs
+scripts/lib/npm-update-publish.mjs
+scripts/lib/npm-update-quality.mjs
+scripts/lib/npm-update-rails-mysql-daemon.mjs
+scripts/lib/npm-update-rails-mysql-resource.mjs
+scripts/lib/npm-update-rails-mysql-storage.mjs
+scripts/lib/npm-update-rails-mysql.mjs
+scripts/lib/npm-update-rails-runtime-contract.mjs
+scripts/lib/npm-update-rails-tool-downloads.mjs
+scripts/lib/npm-update-rails-tool-identity.mjs
+scripts/lib/npm-update-rails-tools.mjs
+scripts/lib/npm-update-recovery.mjs
+scripts/lib/npm-update-runtime-archive.mjs
+scripts/lib/npm-update-runtime-graph.mjs
+scripts/lib/npm-update-runtime-transport.mjs
+scripts/lib/npm-update-runtime.mjs
+scripts/lib/npm-update-supersession.mjs
+scripts/lib/npm-update-tool-launcher.mjs
+scripts/lib/npm-update-worker-environment.mjs
+scripts/lib/npm-update-worker-inspection.mjs
+scripts/lib/npm-update-worker-lifecycle.mjs
+scripts/lib/npm-update-worker-policy.mjs
+scripts/lib/placeholder-expiry.mjs
+scripts/lib/process-tree-runner.mjs
+scripts/lib/reusable-workflow-load-adapter.mjs
+scripts/lib/reusable-workflow-load-failure.mjs
+scripts/lib/reusable-workflow-load-scan.mjs
+scripts/lib/windows-process-job.mjs
+scripts/lib/worktree-dependencies.mjs
+scripts/lisa-hooks/worktree-binding-guard.mjs
 
 # Mutation gate sandbox: a full second copy of the tree written by
 # `test:mutation`. Formatting or linting it reports every source file twice, and