@codyswann/lisa 4.8.1 → 4.8.3

package/plugins/lisa-copilot/skills/lisa-doctor/SKILL.md

@@ -569,6 +569,37 @@ additive-only `addRequiredChecks`, which is still read but can never express "st
 Both surfaces name the ruleset a repair writes to, so `--ruleset` is needed only for a
 gate-DERIVED context on a repository whose rulesets are ambiguous.
 
+**2b. A gate proved OUTSIDE the quality facade names its own check-run chain.** A run-mode gate's
+required context is derived by prefixing the gate's label with the chain of jobs that reach the
+facade. When a project proves one property from a workflow of its own instead, that chain describes
+a route that never reaches the prover, and the derived name is one nothing posts — which does not
+turn a pull request red, it holds it at "Expected — Waiting for status to be reported" for ever.
+Declare the real chain on that moment:
+
+```json
+"gates": {
+  "e2e-browser": {
+    "run": "test:e2e:pr",
+    "pull-request": {
+      "level": "required",
+      "caller_chain": ["🎭 PR Browser Coverage"]
+    }
+  }
+}
+```
+
+Read the chain off a completed run, never off the YAML: a check run's reported name is the
+`/`-joined chain of the JOB names that reach it, outermost first, and the top workflow's own `name:`
+never appears in it. Take it from
+`gh api repos/OWNER/NAME/commits/SHA/check-runs --paginate --slurp`, or let
+`lisa-gates.mjs verify-contexts --posted=<file>` compare a derivation against what actually posted.
+Either spelling works — `["A", "B"]` or `"A / B"` — and the override replaces the caller's chain for
+that gate only; every other gate keeps deriving exactly what it derived before. It is declared per
+MOMENT, because the same job posts a one-level name on the pull-request path and a two-level one on
+the release path. Declaring it on the whole gate, on an `await`ing moment, at a moment that posts no
+status, or with a blank level is refused by `lisa-gates.mjs validate` — at declaration time, which
+is the last point at which any of those can still fail loudly.
+
 **3. Keep both names during a rename.** `--previous=<old label>` requires the old and the new
 context simultaneously for one release. Without it the reconciliation reports the still-live old
 context as EXTRA (and `--prune` would delete it) while in-flight pull requests wait on a context
@@ -588,6 +619,16 @@ That rule construction is itself config-driven now. `all/github-rulesets/base.js
 `policy.review.required_approving_review_count`, none of which config could express while the
 template owned them.
 
+`policy.review.require_extra_approval_for_unattributed_changes` is declarable for a reason worth
+stating, because its default is not "leave it alone". Measured against the live rulesets API on
+2026-08-25: a `pull_request` rule sent WITHOUT the parameter came back with it `true`; set
+explicitly to `false` it came back `false`; sent again without it, it came back `true`. GitHub
+re-applies its own default on every write that omits the field. So an operator who wants it OFF
+cannot hold it off unless the payload names it, and an operator who wants it ON is recording no
+choice at all — the value is whatever GitHub's default happens to be. Declaring it pins the choice
+and makes it visible to the reconciler; declaring nothing keeps the payload byte-for-byte what it
+was, parameter absent.
+
 ## Secrets configuration
 
 Run the secrets health checks through the skill that owns the contract, rather than reimplementing

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/skills/lisa-doctor/SKILL.md

@@ -569,6 +569,37 @@ additive-only `addRequiredChecks`, which is still read but can never express "st
 Both surfaces name the ruleset a repair writes to, so `--ruleset` is needed only for a
 gate-DERIVED context on a repository whose rulesets are ambiguous.
 
+**2b. A gate proved OUTSIDE the quality facade names its own check-run chain.** A run-mode gate's
+required context is derived by prefixing the gate's label with the chain of jobs that reach the
+facade. When a project proves one property from a workflow of its own instead, that chain describes
+a route that never reaches the prover, and the derived name is one nothing posts — which does not
+turn a pull request red, it holds it at "Expected — Waiting for status to be reported" for ever.
+Declare the real chain on that moment:
+
+```json
+"gates": {
+  "e2e-browser": {
+    "run": "test:e2e:pr",
+    "pull-request": {
+      "level": "required",
+      "caller_chain": ["🎭 PR Browser Coverage"]
+    }
+  }
+}
+```
+
+Read the chain off a completed run, never off the YAML: a check run's reported name is the
+`/`-joined chain of the JOB names that reach it, outermost first, and the top workflow's own `name:`
+never appears in it. Take it from
+`gh api repos/OWNER/NAME/commits/SHA/check-runs --paginate --slurp`, or let
+`lisa-gates.mjs verify-contexts --posted=<file>` compare a derivation against what actually posted.
+Either spelling works — `["A", "B"]` or `"A / B"` — and the override replaces the caller's chain for
+that gate only; every other gate keeps deriving exactly what it derived before. It is declared per
+MOMENT, because the same job posts a one-level name on the pull-request path and a two-level one on
+the release path. Declaring it on the whole gate, on an `await`ing moment, at a moment that posts no
+status, or with a blank level is refused by `lisa-gates.mjs validate` — at declaration time, which
+is the last point at which any of those can still fail loudly.
+
 **3. Keep both names during a rename.** `--previous=<old label>` requires the old and the new
 context simultaneously for one release. Without it the reconciliation reports the still-live old
 context as EXTRA (and `--prune` would delete it) while in-flight pull requests wait on a context
@@ -588,6 +619,16 @@ That rule construction is itself config-driven now. `all/github-rulesets/base.js
 `policy.review.required_approving_review_count`, none of which config could express while the
 template owned them.
 
+`policy.review.require_extra_approval_for_unattributed_changes` is declarable for a reason worth
+stating, because its default is not "leave it alone". Measured against the live rulesets API on
+2026-08-25: a `pull_request` rule sent WITHOUT the parameter came back with it `true`; set
+explicitly to `false` it came back `false`; sent again without it, it came back `true`. GitHub
+re-applies its own default on every write that omits the field. So an operator who wants it OFF
+cannot hold it off unless the payload names it, and an operator who wants it ON is recording no
+choice at all — the value is whatever GitHub's default happens to be. Declaring it pins the choice
+and makes it visible to the reconciler; declaring nothing keeps the payload byte-for-byte what it
+was, parameter absent.
+
 ## Secrets configuration
 
 Run the secrets health checks through the skill that owns the contract, rather than reimplementing

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/skills/lisa-doctor/SKILL.md

@@ -569,6 +569,37 @@ additive-only `addRequiredChecks`, which is still read but can never express "st
 Both surfaces name the ruleset a repair writes to, so `--ruleset` is needed only for a
 gate-DERIVED context on a repository whose rulesets are ambiguous.
 
+**2b. A gate proved OUTSIDE the quality facade names its own check-run chain.** A run-mode gate's
+required context is derived by prefixing the gate's label with the chain of jobs that reach the
+facade. When a project proves one property from a workflow of its own instead, that chain describes
+a route that never reaches the prover, and the derived name is one nothing posts — which does not
+turn a pull request red, it holds it at "Expected — Waiting for status to be reported" for ever.
+Declare the real chain on that moment:
+
+```json
+"gates": {
+  "e2e-browser": {
+    "run": "test:e2e:pr",
+    "pull-request": {
+      "level": "required",
+      "caller_chain": ["🎭 PR Browser Coverage"]
+    }
+  }
+}
+```
+
+Read the chain off a completed run, never off the YAML: a check run's reported name is the
+`/`-joined chain of the JOB names that reach it, outermost first, and the top workflow's own `name:`
+never appears in it. Take it from
+`gh api repos/OWNER/NAME/commits/SHA/check-runs --paginate --slurp`, or let
+`lisa-gates.mjs verify-contexts --posted=<file>` compare a derivation against what actually posted.
+Either spelling works — `["A", "B"]` or `"A / B"` — and the override replaces the caller's chain for
+that gate only; every other gate keeps deriving exactly what it derived before. It is declared per
+MOMENT, because the same job posts a one-level name on the pull-request path and a two-level one on
+the release path. Declaring it on the whole gate, on an `await`ing moment, at a moment that posts no
+status, or with a blank level is refused by `lisa-gates.mjs validate` — at declaration time, which
+is the last point at which any of those can still fail loudly.
+
 **3. Keep both names during a rename.** `--previous=<old label>` requires the old and the new
 context simultaneously for one release. Without it the reconciliation reports the still-live old
 context as EXTRA (and `--prune` would delete it) while in-flight pull requests wait on a context
@@ -588,6 +619,16 @@ That rule construction is itself config-driven now. `all/github-rulesets/base.js
 `policy.review.required_approving_review_count`, none of which config could express while the
 template owned them.
 
+`policy.review.require_extra_approval_for_unattributed_changes` is declarable for a reason worth
+stating, because its default is not "leave it alone". Measured against the live rulesets API on
+2026-08-25: a `pull_request` rule sent WITHOUT the parameter came back with it `true`; set
+explicitly to `false` it came back `false`; sent again without it, it came back `true`. GitHub
+re-applies its own default on every write that omits the field. So an operator who wants it OFF
+cannot hold it off unless the payload names it, and an operator who wants it ON is recording no
+choice at all — the value is whatever GitHub's default happens to be. Declaring it pins the choice
+and makes it visible to the reconciler; declaring nothing keeps the payload byte-for-byte what it
+was, parameter absent.
+
 ## Secrets configuration
 
 Run the secrets health checks through the skill that owns the contract, rather than reimplementing

package/scripts/lisa-github-rulesets.sh

@@ -570,11 +570,21 @@ ruleset_added_contexts() {
 # True when everything the payload asks for is ALREADY true of the live ruleset.
 #
 # Deliberately a subset test rather than an equality test: GitHub echoes back
-# parameters it filled in with its own defaults (`required_reviewers`,
-# `require_extra_approval_for_unattributed_changes`, ...) which no template
-# names. Comparing whole documents would report drift on every run and make
-# "nothing to do" unreachable — the AC's second scenario would then never hold
-# even on a repository that needs no change.
+# parameters it filled in with its own defaults (`required_reviewers`, ...)
+# which no template names. Comparing whole documents would report drift on
+# every run and make "nothing to do" unreachable — the AC's second scenario
+# would then never hold even on a repository that needs no change.
+#
+# `require_extra_approval_for_unattributed_changes` used to be listed here as
+# another such default, and that reading was measured wrong on 2026-08-25. It
+# IS filled in when omitted, but the fill is `true` and it is re-applied on
+# every write: a rule PUT without the field came back `true` even after being
+# explicitly set to `false`. Being invisible to a subset test is therefore not
+# harmless for it — an operator who wants it off cannot keep it off, and the
+# reconciliation reports no drift while GitHub turns it back on. It is now
+# declarable as `policy.review.require_extra_approval_for_unattributed_changes`
+# (CodySwannGT/lisa#3096), and once declared the payload names it, so this
+# subset test compares it like any other parameter.
 ruleset_is_current() {
   local live="$1"
   local payload="$2"

package/scripts/lisa-ruleset-payload.mjs

@@ -107,6 +107,31 @@ export const REVIEW_DEFAULTS = Object.freeze({
   require_code_owner_review: false,
 });
 
+/**
+ * The review parameter with no default here, on purpose.
+ *
+ * `require_extra_approval_for_unattributed_changes` is emitted only when the
+ * project declares it, and is left out of the payload entirely otherwise. A
+ * default of either polarity would be wrong:
+ *
+ * - `false` would send every repository a loosening it never asked for, and
+ *   would flip a live `true` off on the next apply;
+ * - `true` would send every repository a tightening it never asked for, and
+ *   would make the negative control below impossible — a project that declares
+ *   nothing must generate byte-for-byte the payload it generated before this
+ *   field was declarable.
+ *
+ * Omission is not neutral either, and that is the finding rather than a
+ * shortcoming of this choice. Measured against the live rulesets API on
+ * 2026-08-25 (a `pull_request` rule POSTed to a disabled probe ruleset, then
+ * PUT three times): omitted, it came back `true`; sent `false`, it came back
+ * `false`; sent omitted again, it came back `true` — GitHub resets it to its
+ * own default on every write that does not name it. Declaring it is therefore
+ * the ONLY way to hold it at `false`, and the only way to record `true` as a
+ * choice rather than as whatever GitHub's default happens to be that week.
+ */
+const EXTRA_APPROVAL = "require_extra_approval_for_unattributed_changes";
+
 /** Branch-protection defaults, matching the retired template. */
 export const PROTECT_DEFAULTS = Object.freeze({
   deletion: true,
@@ -245,6 +270,11 @@ function pullRequestRule(policy) {
         "conversation_resolution",
         PROTECT_DEFAULTS
       ),
+      // Spread, not `resolved`, because there is no default to resolve to.
+      // See EXTRA_APPROVAL: an undeclared project sends no such key at all.
+      ...(policy?.review?.[EXTRA_APPROVAL] === undefined
+        ? {}
+        : { [EXTRA_APPROVAL]: policy.review[EXTRA_APPROVAL] }),
       allowed_merge_methods: allowed,
     },
   };