@codyswann/lisa 4.84.10 → 4.84.11

package/package.json

@@ -189,7 +189,7 @@
     "qs": "^6.16.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -347,7 +347,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "b0d2d2990f94d0f93120d612d3c1ab5502dc2851",
-  "gitHead": "b0d2d2990f94d0f93120d612d3c1ab5502dc2851",
-  "lisaReleaseTag": "v4.84.10"
+  "lisaReleaseCommit": "ba54daa3c32cc916b58f9c1c0d58333aea3dc8a9",
+  "gitHead": "ba54daa3c32cc916b58f9c1c0d58333aea3dc8a9",
+  "lisaReleaseTag": "v4.84.11"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-parity-code-review/SKILL.md

@@ -2,6 +2,7 @@
 name: lisa-parity-code-review
 description: "Lisa-native code review of the…"
 allowed-tools: ["Read", "Bash", "Grep", "Glob"]
+synced-from: code-review@claude-plugins-official@1.0.1
 ---
 Lisa-native code review of the current git diff. Walks every changed hunk and reports correctness bugs, security issues, and obvious defects as severity-ranked findings with file:line references. Vendor-neutral — the cross-agent equivalent of the upstream code-review command, runnable on Codex, agy, Copilot, Cursor, and Claude.
 
@@ -10,7 +11,9 @@ Lisa-native code review of the current git diff. Walks every changed hunk and re
 
 Review the code that is *about to ship* — the current uncommitted/branch diff — for defects a reviewer would block on. This is a focused **defect hunt**: correctness, security, and obvious mistakes. It is not a style audit and not a refactor pass (use `parity-code-simplifier` for quality-only cleanup).
 
-> **Not drift-trackable.** This skill intentionally carries **no `synced-from` pin**. The upstream `code-review@claude-plugins-official` plugin publishes **no semver** (its cache version resolves to `unknown`), so a pin would be unparseable and meaningless to `scripts/plugin-parity-drift.mjs`. Drift is tracked **manually** — re-review the upstream command by hand when the curated plugin set is refreshed. This is a Lisa-native reimplementation, **not** a port of upstream code.
+> **Drift tracking.** Pinned to `code-review@claude-plugins-official@1.0.1`. Upstream published no semver until 1.0.1, so this skill used to carry no pin and was reviewed by hand; it is now tracked by `scripts/plugin-parity-drift.mjs`, which flags the pin as stale when the plugin cache holds a newer upstream version. This is a Lisa-native reimplementation, **not** a port of upstream code.
+>
+> **Reviewed against 1.0.1, partly diverged.** Adopted from upstream 1.0.1: findings print to the terminal only; every candidate finding is validated before it is reported (Step 4); and a high-signal bar governs what is blocking (relaxed to admit an input-dependent defect once its triggering input is shown to be reachable; see Step 4). Deliberately not reimplemented: upstream's `--comment` mode, which posts inline PR comments through `mcp__github_inline_comment__create_inline_comment` (use `lisa-pull-request-review` to act on a pull request), and its four-reviewer subagent pipeline. This skill is one reviewer over the local diff, because the agents it serves (Codex, agy, Copilot, Cursor, Devin) have no common subagent or inline-comment surface. The `synced-from` scalar cannot record that split, so this note does.
 
 ## Step 1: Establish the diff
 
@@ -48,7 +51,29 @@ For every changed hunk, evaluate against these lenses:
 4. **Obvious defects** — Dead code paths, unreachable branches, swallowed errors, resource leaks (unclosed handles/connections), `TODO`/`FIXME` left in shipping code, debug logging left on, broken or missing tests for the new behavior.
 5. **Contract & API** — Breaking changes to public signatures, changed return shapes, altered error semantics callers depend on.
 
-## Step 4: Output — severity-ranked findings
+## Step 4: Validate every candidate before reporting it
+
+Step 3 produces candidates, not findings. Re-check each one against the code on its own, as a skeptic whose job is to disprove it:
+
+- If it says something is undefined, unreachable, or mistyped, find the definition, the caller, or the type and confirm it.
+- If it cites a project instruction (`AGENTS.md`, `CLAUDE.md`, a rule file), quote the exact rule and confirm the rule applies to that file's path.
+- If it depends on a specific input or state, name that input and confirm the code can actually receive it.
+
+Drop every candidate you cannot confirm. A false positive costs the reader more than a missed nit, so when in doubt, leave it out.
+
+**High-signal bar.** Only a validated candidate in one of these classes may be **Critical** or **Warning**:
+
+- the code will fail to compile, parse, or resolve (syntax or type errors, missing imports, unresolved references);
+- the code produces a wrong result or an exposure (clear logic or security errors) — either for every input, or for a specific triggering input you have named and confirmed the code can actually receive in practice, as in the example under Step 5;
+- the change breaks a project instruction you can quote.
+
+Upstream 1.0.1 drops every input-dependent issue. This skill keeps one that you have validated as reachable, because a reachable null dereference or auth bypass is exactly what a reviewer must block. What it still drops is the hypothetical: an input nobody can show the code receiving.
+
+Never report: pre-existing issues on lines the change did not touch; things that look wrong but are correct; lint-only issues a linter will catch anyway (a parse, compile, correctness, or security defect stays reportable even when a linter also flags it); style or general-quality concerns that no project instruction requires; a lint or type finding that the code explicitly silences (for example with a lint-ignore comment).
+
+A suppression silences only the lint or type finding it names. It never hides a correctness or security defect in that code. A changed `eval(req.body.code)` under `eslint-disable no-eval` is still remote code execution, so report it as Critical.
+
+## Step 5: Output — severity-ranked findings
 
 Group findings by severity. Within each group, list the most impactful first. Every finding **must** carry a `file:line` reference.
 
@@ -59,7 +84,7 @@ Bugs that break correctness, leak/expose data, or introduce a security hole.
 Likely to cause problems later, or a real defect with limited blast radius.
 
 ### Suggestion (nice to have)
-Minor correctness nits or defensive improvements.
+Minor validated correctness nits or defensive improvements below the high-signal bar. This tier is a Lisa addition — upstream 1.0.1 reports nothing below its bar — so keep it short and omit it when empty.
 
 ### Finding format
 

package/plugins/lisa/skills/lisa-parity-code-review/SKILL.md

@@ -2,13 +2,16 @@
 name: lisa-parity-code-review
 description: "Lisa-native code review of the current git diff. Walks every changed hunk and reports correctness bugs, security issues, and obvious defects as severity-ranked findings with file:line references. Vendor-neutral — the cross-agent equivalent of the upstream code-review command, runnable on Codex, agy, Copilot, Cursor, and Claude."
 allowed-tools: ["Read", "Bash", "Grep", "Glob"]
+synced-from: code-review@claude-plugins-official@1.0.1
 ---
 
 # Parity Code Review
 
 Review the code that is *about to ship* — the current uncommitted/branch diff — for defects a reviewer would block on. This is a focused **defect hunt**: correctness, security, and obvious mistakes. It is not a style audit and not a refactor pass (use `parity-code-simplifier` for quality-only cleanup).
 
-> **Not drift-trackable.** This skill intentionally carries **no `synced-from` pin**. The upstream `code-review@claude-plugins-official` plugin publishes **no semver** (its cache version resolves to `unknown`), so a pin would be unparseable and meaningless to `scripts/plugin-parity-drift.mjs`. Drift is tracked **manually** — re-review the upstream command by hand when the curated plugin set is refreshed. This is a Lisa-native reimplementation, **not** a port of upstream code.
+> **Drift tracking.** Pinned to `code-review@claude-plugins-official@1.0.1`. Upstream published no semver until 1.0.1, so this skill used to carry no pin and was reviewed by hand; it is now tracked by `scripts/plugin-parity-drift.mjs`, which flags the pin as stale when the plugin cache holds a newer upstream version. This is a Lisa-native reimplementation, **not** a port of upstream code.
+>
+> **Reviewed against 1.0.1, partly diverged.** Adopted from upstream 1.0.1: findings print to the terminal only; every candidate finding is validated before it is reported (Step 4); and a high-signal bar governs what is blocking (relaxed to admit an input-dependent defect once its triggering input is shown to be reachable; see Step 4). Deliberately not reimplemented: upstream's `--comment` mode, which posts inline PR comments through `mcp__github_inline_comment__create_inline_comment` (use `lisa-pull-request-review` to act on a pull request), and its four-reviewer subagent pipeline. This skill is one reviewer over the local diff, because the agents it serves (Codex, agy, Copilot, Cursor, Devin) have no common subagent or inline-comment surface. The `synced-from` scalar cannot record that split, so this note does.
 
 ## Step 1: Establish the diff
 
@@ -46,7 +49,29 @@ For every changed hunk, evaluate against these lenses:
 4. **Obvious defects** — Dead code paths, unreachable branches, swallowed errors, resource leaks (unclosed handles/connections), `TODO`/`FIXME` left in shipping code, debug logging left on, broken or missing tests for the new behavior.
 5. **Contract & API** — Breaking changes to public signatures, changed return shapes, altered error semantics callers depend on.
 
-## Step 4: Output — severity-ranked findings
+## Step 4: Validate every candidate before reporting it
+
+Step 3 produces candidates, not findings. Re-check each one against the code on its own, as a skeptic whose job is to disprove it:
+
+- If it says something is undefined, unreachable, or mistyped, find the definition, the caller, or the type and confirm it.
+- If it cites a project instruction (`AGENTS.md`, `CLAUDE.md`, a rule file), quote the exact rule and confirm the rule applies to that file's path.
+- If it depends on a specific input or state, name that input and confirm the code can actually receive it.
+
+Drop every candidate you cannot confirm. A false positive costs the reader more than a missed nit, so when in doubt, leave it out.
+
+**High-signal bar.** Only a validated candidate in one of these classes may be **Critical** or **Warning**:
+
+- the code will fail to compile, parse, or resolve (syntax or type errors, missing imports, unresolved references);
+- the code produces a wrong result or an exposure (clear logic or security errors) — either for every input, or for a specific triggering input you have named and confirmed the code can actually receive in practice, as in the example under Step 5;
+- the change breaks a project instruction you can quote.
+
+Upstream 1.0.1 drops every input-dependent issue. This skill keeps one that you have validated as reachable, because a reachable null dereference or auth bypass is exactly what a reviewer must block. What it still drops is the hypothetical: an input nobody can show the code receiving.
+
+Never report: pre-existing issues on lines the change did not touch; things that look wrong but are correct; lint-only issues a linter will catch anyway (a parse, compile, correctness, or security defect stays reportable even when a linter also flags it); style or general-quality concerns that no project instruction requires; a lint or type finding that the code explicitly silences (for example with a lint-ignore comment).
+
+A suppression silences only the lint or type finding it names. It never hides a correctness or security defect in that code. A changed `eval(req.body.code)` under `eslint-disable no-eval` is still remote code execution, so report it as Critical.
+
+## Step 5: Output — severity-ranked findings
 
 Group findings by severity. Within each group, list the most impactful first. Every finding **must** carry a `file:line` reference.
 
@@ -57,7 +82,7 @@ Bugs that break correctness, leak/expose data, or introduce a security hole.
 Likely to cause problems later, or a real defect with limited blast radius.
 
 ### Suggestion (nice to have)
-Minor correctness nits or defensive improvements.
+Minor validated correctness nits or defensive improvements below the high-signal bar. This tier is a Lisa addition — upstream 1.0.1 reports nothing below its bar — so keep it short and omit it when empty.
 
 ### Finding format
 

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-parity-code-review/SKILL.md

@@ -2,13 +2,16 @@
 name: lisa-parity-code-review
 description: "Lisa-native code review of the current git diff. Walks every changed hunk and reports correctness bugs, security issues, and obvious defects as severity-ranked findings with file:line references. Vendor-neutral — the cross-agent equivalent of the upstream code-review command, runnable on Codex, agy, Copilot, Cursor, and Claude."
 allowed-tools: ["Read", "Bash", "Grep", "Glob"]
+synced-from: code-review@claude-plugins-official@1.0.1
 ---
 
 # Parity Code Review
 
 Review the code that is *about to ship* — the current uncommitted/branch diff — for defects a reviewer would block on. This is a focused **defect hunt**: correctness, security, and obvious mistakes. It is not a style audit and not a refactor pass (use `parity-code-simplifier` for quality-only cleanup).
 
-> **Not drift-trackable.** This skill intentionally carries **no `synced-from` pin**. The upstream `code-review@claude-plugins-official` plugin publishes **no semver** (its cache version resolves to `unknown`), so a pin would be unparseable and meaningless to `scripts/plugin-parity-drift.mjs`. Drift is tracked **manually** — re-review the upstream command by hand when the curated plugin set is refreshed. This is a Lisa-native reimplementation, **not** a port of upstream code.
+> **Drift tracking.** Pinned to `code-review@claude-plugins-official@1.0.1`. Upstream published no semver until 1.0.1, so this skill used to carry no pin and was reviewed by hand; it is now tracked by `scripts/plugin-parity-drift.mjs`, which flags the pin as stale when the plugin cache holds a newer upstream version. This is a Lisa-native reimplementation, **not** a port of upstream code.
+>
+> **Reviewed against 1.0.1, partly diverged.** Adopted from upstream 1.0.1: findings print to the terminal only; every candidate finding is validated before it is reported (Step 4); and a high-signal bar governs what is blocking (relaxed to admit an input-dependent defect once its triggering input is shown to be reachable; see Step 4). Deliberately not reimplemented: upstream's `--comment` mode, which posts inline PR comments through `mcp__github_inline_comment__create_inline_comment` (use `lisa-pull-request-review` to act on a pull request), and its four-reviewer subagent pipeline. This skill is one reviewer over the local diff, because the agents it serves (Codex, agy, Copilot, Cursor, Devin) have no common subagent or inline-comment surface. The `synced-from` scalar cannot record that split, so this note does.
 
 ## Step 1: Establish the diff
 
@@ -46,7 +49,29 @@ For every changed hunk, evaluate against these lenses:
 4. **Obvious defects** — Dead code paths, unreachable branches, swallowed errors, resource leaks (unclosed handles/connections), `TODO`/`FIXME` left in shipping code, debug logging left on, broken or missing tests for the new behavior.
 5. **Contract & API** — Breaking changes to public signatures, changed return shapes, altered error semantics callers depend on.
 
-## Step 4: Output — severity-ranked findings
+## Step 4: Validate every candidate before reporting it
+
+Step 3 produces candidates, not findings. Re-check each one against the code on its own, as a skeptic whose job is to disprove it:
+
+- If it says something is undefined, unreachable, or mistyped, find the definition, the caller, or the type and confirm it.
+- If it cites a project instruction (`AGENTS.md`, `CLAUDE.md`, a rule file), quote the exact rule and confirm the rule applies to that file's path.
+- If it depends on a specific input or state, name that input and confirm the code can actually receive it.
+
+Drop every candidate you cannot confirm. A false positive costs the reader more than a missed nit, so when in doubt, leave it out.
+
+**High-signal bar.** Only a validated candidate in one of these classes may be **Critical** or **Warning**:
+
+- the code will fail to compile, parse, or resolve (syntax or type errors, missing imports, unresolved references);
+- the code produces a wrong result or an exposure (clear logic or security errors) — either for every input, or for a specific triggering input you have named and confirmed the code can actually receive in practice, as in the example under Step 5;
+- the change breaks a project instruction you can quote.
+
+Upstream 1.0.1 drops every input-dependent issue. This skill keeps one that you have validated as reachable, because a reachable null dereference or auth bypass is exactly what a reviewer must block. What it still drops is the hypothetical: an input nobody can show the code receiving.
+
+Never report: pre-existing issues on lines the change did not touch; things that look wrong but are correct; lint-only issues a linter will catch anyway (a parse, compile, correctness, or security defect stays reportable even when a linter also flags it); style or general-quality concerns that no project instruction requires; a lint or type finding that the code explicitly silences (for example with a lint-ignore comment).
+
+A suppression silences only the lint or type finding it names. It never hides a correctness or security defect in that code. A changed `eval(req.body.code)` under `eslint-disable no-eval` is still remote code execution, so report it as Critical.
+
+## Step 5: Output — severity-ranked findings
 
 Group findings by severity. Within each group, list the most impactful first. Every finding **must** carry a `file:line` reference.
 
@@ -57,7 +82,7 @@ Bugs that break correctness, leak/expose data, or introduce a security hole.
 Likely to cause problems later, or a real defect with limited blast radius.
 
 ### Suggestion (nice to have)
-Minor correctness nits or defensive improvements.
+Minor validated correctness nits or defensive improvements below the high-signal bar. This tier is a Lisa addition — upstream 1.0.1 reports nothing below its bar — so keep it short and omit it when empty.
 
 ### Finding format
 

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-devin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-devin/.devin-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/skills/lisa-parity-code-review/SKILL.md

@@ -2,13 +2,16 @@
 name: lisa-parity-code-review
 description: "Lisa-native code review of the current git diff. Walks every changed hunk and reports correctness bugs, security issues, and obvious defects as severity-ranked findings with file:line references. Vendor-neutral — the cross-agent equivalent of the upstream code-review command, runnable on Codex, agy, Copilot, Cursor, and Claude."
 allowed-tools: ["Read", "Bash", "Grep", "Glob"]
+synced-from: code-review@claude-plugins-official@1.0.1
 ---
 
 # Parity Code Review
 
 Review the code that is *about to ship* — the current uncommitted/branch diff — for defects a reviewer would block on. This is a focused **defect hunt**: correctness, security, and obvious mistakes. It is not a style audit and not a refactor pass (use `parity-code-simplifier` for quality-only cleanup).
 
-> **Not drift-trackable.** This skill intentionally carries **no `synced-from` pin**. The upstream `code-review@claude-plugins-official` plugin publishes **no semver** (its cache version resolves to `unknown`), so a pin would be unparseable and meaningless to `scripts/plugin-parity-drift.mjs`. Drift is tracked **manually** — re-review the upstream command by hand when the curated plugin set is refreshed. This is a Lisa-native reimplementation, **not** a port of upstream code.
+> **Drift tracking.** Pinned to `code-review@claude-plugins-official@1.0.1`. Upstream published no semver until 1.0.1, so this skill used to carry no pin and was reviewed by hand; it is now tracked by `scripts/plugin-parity-drift.mjs`, which flags the pin as stale when the plugin cache holds a newer upstream version. This is a Lisa-native reimplementation, **not** a port of upstream code.
+>
+> **Reviewed against 1.0.1, partly diverged.** Adopted from upstream 1.0.1: findings print to the terminal only; every candidate finding is validated before it is reported (Step 4); and a high-signal bar governs what is blocking (relaxed to admit an input-dependent defect once its triggering input is shown to be reachable; see Step 4). Deliberately not reimplemented: upstream's `--comment` mode, which posts inline PR comments through `mcp__github_inline_comment__create_inline_comment` (use `lisa-pull-request-review` to act on a pull request), and its four-reviewer subagent pipeline. This skill is one reviewer over the local diff, because the agents it serves (Codex, agy, Copilot, Cursor, Devin) have no common subagent or inline-comment surface. The `synced-from` scalar cannot record that split, so this note does.
 
 ## Step 1: Establish the diff
 
@@ -46,7 +49,29 @@ For every changed hunk, evaluate against these lenses:
 4. **Obvious defects** — Dead code paths, unreachable branches, swallowed errors, resource leaks (unclosed handles/connections), `TODO`/`FIXME` left in shipping code, debug logging left on, broken or missing tests for the new behavior.
 5. **Contract & API** — Breaking changes to public signatures, changed return shapes, altered error semantics callers depend on.
 
-## Step 4: Output — severity-ranked findings
+## Step 4: Validate every candidate before reporting it
+
+Step 3 produces candidates, not findings. Re-check each one against the code on its own, as a skeptic whose job is to disprove it:
+
+- If it says something is undefined, unreachable, or mistyped, find the definition, the caller, or the type and confirm it.
+- If it cites a project instruction (`AGENTS.md`, `CLAUDE.md`, a rule file), quote the exact rule and confirm the rule applies to that file's path.
+- If it depends on a specific input or state, name that input and confirm the code can actually receive it.
+
+Drop every candidate you cannot confirm. A false positive costs the reader more than a missed nit, so when in doubt, leave it out.
+
+**High-signal bar.** Only a validated candidate in one of these classes may be **Critical** or **Warning**:
+
+- the code will fail to compile, parse, or resolve (syntax or type errors, missing imports, unresolved references);
+- the code produces a wrong result or an exposure (clear logic or security errors) — either for every input, or for a specific triggering input you have named and confirmed the code can actually receive in practice, as in the example under Step 5;
+- the change breaks a project instruction you can quote.
+
+Upstream 1.0.1 drops every input-dependent issue. This skill keeps one that you have validated as reachable, because a reachable null dereference or auth bypass is exactly what a reviewer must block. What it still drops is the hypothetical: an input nobody can show the code receiving.
+
+Never report: pre-existing issues on lines the change did not touch; things that look wrong but are correct; lint-only issues a linter will catch anyway (a parse, compile, correctness, or security defect stays reportable even when a linter also flags it); style or general-quality concerns that no project instruction requires; a lint or type finding that the code explicitly silences (for example with a lint-ignore comment).
+
+A suppression silences only the lint or type finding it names. It never hides a correctness or security defect in that code. A changed `eval(req.body.code)` under `eslint-disable no-eval` is still remote code execution, so report it as Critical.
+
+## Step 5: Output — severity-ranked findings
 
 Group findings by severity. Within each group, list the most impactful first. Every finding **must** carry a `file:line` reference.
 
@@ -57,7 +82,7 @@ Bugs that break correctness, leak/expose data, or introduce a security hole.
 Likely to cause problems later, or a real defect with limited blast radius.
 
 ### Suggestion (nice to have)
-Minor correctness nits or defensive improvements.
+Minor validated correctness nits or defensive improvements below the high-signal bar. This tier is a Lisa addition — upstream 1.0.1 reports nothing below its bar — so keep it short and omit it when empty.
 
 ### Finding format
 

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/skills/lisa-parity-code-review/SKILL.md

@@ -2,13 +2,16 @@
 name: lisa-parity-code-review
 description: "Lisa-native code review of the current git diff. Walks every changed hunk and reports correctness bugs, security issues, and obvious defects as severity-ranked findings with file:line references. Vendor-neutral — the cross-agent equivalent of the upstream code-review command, runnable on Codex, agy, Copilot, Cursor, and Claude."
 allowed-tools: ["Read", "Bash", "Grep", "Glob"]
+synced-from: code-review@claude-plugins-official@1.0.1
 ---
 
 # Parity Code Review
 
 Review the code that is *about to ship* — the current uncommitted/branch diff — for defects a reviewer would block on. This is a focused **defect hunt**: correctness, security, and obvious mistakes. It is not a style audit and not a refactor pass (use `parity-code-simplifier` for quality-only cleanup).
 
-> **Not drift-trackable.** This skill intentionally carries **no `synced-from` pin**. The upstream `code-review@claude-plugins-official` plugin publishes **no semver** (its cache version resolves to `unknown`), so a pin would be unparseable and meaningless to `scripts/plugin-parity-drift.mjs`. Drift is tracked **manually** — re-review the upstream command by hand when the curated plugin set is refreshed. This is a Lisa-native reimplementation, **not** a port of upstream code.
+> **Drift tracking.** Pinned to `code-review@claude-plugins-official@1.0.1`. Upstream published no semver until 1.0.1, so this skill used to carry no pin and was reviewed by hand; it is now tracked by `scripts/plugin-parity-drift.mjs`, which flags the pin as stale when the plugin cache holds a newer upstream version. This is a Lisa-native reimplementation, **not** a port of upstream code.
+>
+> **Reviewed against 1.0.1, partly diverged.** Adopted from upstream 1.0.1: findings print to the terminal only; every candidate finding is validated before it is reported (Step 4); and a high-signal bar governs what is blocking (relaxed to admit an input-dependent defect once its triggering input is shown to be reachable; see Step 4). Deliberately not reimplemented: upstream's `--comment` mode, which posts inline PR comments through `mcp__github_inline_comment__create_inline_comment` (use `lisa-pull-request-review` to act on a pull request), and its four-reviewer subagent pipeline. This skill is one reviewer over the local diff, because the agents it serves (Codex, agy, Copilot, Cursor, Devin) have no common subagent or inline-comment surface. The `synced-from` scalar cannot record that split, so this note does.
 
 ## Step 1: Establish the diff
 
@@ -46,7 +49,29 @@ For every changed hunk, evaluate against these lenses:
 4. **Obvious defects** — Dead code paths, unreachable branches, swallowed errors, resource leaks (unclosed handles/connections), `TODO`/`FIXME` left in shipping code, debug logging left on, broken or missing tests for the new behavior.
 5. **Contract & API** — Breaking changes to public signatures, changed return shapes, altered error semantics callers depend on.
 
-## Step 4: Output — severity-ranked findings
+## Step 4: Validate every candidate before reporting it
+
+Step 3 produces candidates, not findings. Re-check each one against the code on its own, as a skeptic whose job is to disprove it:
+
+- If it says something is undefined, unreachable, or mistyped, find the definition, the caller, or the type and confirm it.
+- If it cites a project instruction (`AGENTS.md`, `CLAUDE.md`, a rule file), quote the exact rule and confirm the rule applies to that file's path.
+- If it depends on a specific input or state, name that input and confirm the code can actually receive it.
+
+Drop every candidate you cannot confirm. A false positive costs the reader more than a missed nit, so when in doubt, leave it out.
+
+**High-signal bar.** Only a validated candidate in one of these classes may be **Critical** or **Warning**:
+
+- the code will fail to compile, parse, or resolve (syntax or type errors, missing imports, unresolved references);
+- the code produces a wrong result or an exposure (clear logic or security errors) — either for every input, or for a specific triggering input you have named and confirmed the code can actually receive in practice, as in the example under Step 5;
+- the change breaks a project instruction you can quote.
+
+Upstream 1.0.1 drops every input-dependent issue. This skill keeps one that you have validated as reachable, because a reachable null dereference or auth bypass is exactly what a reviewer must block. What it still drops is the hypothetical: an input nobody can show the code receiving.
+
+Never report: pre-existing issues on lines the change did not touch; things that look wrong but are correct; lint-only issues a linter will catch anyway (a parse, compile, correctness, or security defect stays reportable even when a linter also flags it); style or general-quality concerns that no project instruction requires; a lint or type finding that the code explicitly silences (for example with a lint-ignore comment).
+
+A suppression silences only the lint or type finding it names. It never hides a correctness or security defect in that code. A changed `eval(req.body.code)` under `eslint-disable no-eval` is still remote code execution, so report it as Critical.
+
+## Step 5: Output — severity-ranked findings
 
 Group findings by severity. Within each group, list the most impactful first. Every finding **must** carry a `file:line` reference.
 
@@ -57,7 +82,7 @@ Bugs that break correctness, leak/expose data, or introduce a security hole.
 Likely to cause problems later, or a real defect with limited blast radius.
 
 ### Suggestion (nice to have)
-Minor correctness nits or defensive improvements.
+Minor validated correctness nits or defensive improvements below the high-signal bar. This tier is a Lisa addition — upstream 1.0.1 reports nothing below its bar — so keep it short and omit it when empty.
 
 ### Finding format
 

package/plugins/lisa-devin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-devin/.devin-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-devin/skills/lisa-parity-code-review/SKILL.md

@@ -2,13 +2,16 @@
 name: lisa-parity-code-review
 description: "Lisa-native code review of the current git diff. Walks every changed hunk and reports correctness bugs, security issues, and obvious defects as severity-ranked findings with file:line references. Vendor-neutral — the cross-agent equivalent of the upstream code-review command, runnable on Codex, agy, Copilot, Cursor, and Claude."
 allowed-tools: ["Read", "Bash", "Grep", "Glob"]
+synced-from: code-review@claude-plugins-official@1.0.1
 ---
 
 # Parity Code Review
 
 Review the code that is *about to ship* — the current uncommitted/branch diff — for defects a reviewer would block on. This is a focused **defect hunt**: correctness, security, and obvious mistakes. It is not a style audit and not a refactor pass (use `parity-code-simplifier` for quality-only cleanup).
 
-> **Not drift-trackable.** This skill intentionally carries **no `synced-from` pin**. The upstream `code-review@claude-plugins-official` plugin publishes **no semver** (its cache version resolves to `unknown`), so a pin would be unparseable and meaningless to `scripts/plugin-parity-drift.mjs`. Drift is tracked **manually** — re-review the upstream command by hand when the curated plugin set is refreshed. This is a Lisa-native reimplementation, **not** a port of upstream code.
+> **Drift tracking.** Pinned to `code-review@claude-plugins-official@1.0.1`. Upstream published no semver until 1.0.1, so this skill used to carry no pin and was reviewed by hand; it is now tracked by `scripts/plugin-parity-drift.mjs`, which flags the pin as stale when the plugin cache holds a newer upstream version. This is a Lisa-native reimplementation, **not** a port of upstream code.
+>
+> **Reviewed against 1.0.1, partly diverged.** Adopted from upstream 1.0.1: findings print to the terminal only; every candidate finding is validated before it is reported (Step 4); and a high-signal bar governs what is blocking (relaxed to admit an input-dependent defect once its triggering input is shown to be reachable; see Step 4). Deliberately not reimplemented: upstream's `--comment` mode, which posts inline PR comments through `mcp__github_inline_comment__create_inline_comment` (use `lisa-pull-request-review` to act on a pull request), and its four-reviewer subagent pipeline. This skill is one reviewer over the local diff, because the agents it serves (Codex, agy, Copilot, Cursor, Devin) have no common subagent or inline-comment surface. The `synced-from` scalar cannot record that split, so this note does.
 
 ## Step 1: Establish the diff
 
@@ -46,7 +49,29 @@ For every changed hunk, evaluate against these lenses:
 4. **Obvious defects** — Dead code paths, unreachable branches, swallowed errors, resource leaks (unclosed handles/connections), `TODO`/`FIXME` left in shipping code, debug logging left on, broken or missing tests for the new behavior.
 5. **Contract & API** — Breaking changes to public signatures, changed return shapes, altered error semantics callers depend on.
 
-## Step 4: Output — severity-ranked findings
+## Step 4: Validate every candidate before reporting it
+
+Step 3 produces candidates, not findings. Re-check each one against the code on its own, as a skeptic whose job is to disprove it:
+
+- If it says something is undefined, unreachable, or mistyped, find the definition, the caller, or the type and confirm it.
+- If it cites a project instruction (`AGENTS.md`, `CLAUDE.md`, a rule file), quote the exact rule and confirm the rule applies to that file's path.
+- If it depends on a specific input or state, name that input and confirm the code can actually receive it.
+
+Drop every candidate you cannot confirm. A false positive costs the reader more than a missed nit, so when in doubt, leave it out.
+
+**High-signal bar.** Only a validated candidate in one of these classes may be **Critical** or **Warning**:
+
+- the code will fail to compile, parse, or resolve (syntax or type errors, missing imports, unresolved references);
+- the code produces a wrong result or an exposure (clear logic or security errors) — either for every input, or for a specific triggering input you have named and confirmed the code can actually receive in practice, as in the example under Step 5;
+- the change breaks a project instruction you can quote.
+
+Upstream 1.0.1 drops every input-dependent issue. This skill keeps one that you have validated as reachable, because a reachable null dereference or auth bypass is exactly what a reviewer must block. What it still drops is the hypothetical: an input nobody can show the code receiving.
+
+Never report: pre-existing issues on lines the change did not touch; things that look wrong but are correct; lint-only issues a linter will catch anyway (a parse, compile, correctness, or security defect stays reportable even when a linter also flags it); style or general-quality concerns that no project instruction requires; a lint or type finding that the code explicitly silences (for example with a lint-ignore comment).
+
+A suppression silences only the lint or type finding it names. It never hides a correctness or security defect in that code. A changed `eval(req.body.code)` under `eslint-disable no-eval` is still remote code execution, so report it as Critical.
+
+## Step 5: Output — severity-ranked findings
 
 Group findings by severity. Within each group, list the most impactful first. Every finding **must** carry a `file:line` reference.
 
@@ -57,7 +82,7 @@ Bugs that break correctness, leak/expose data, or introduce a security hole.
 Likely to cause problems later, or a real defect with limited blast radius.
 
 ### Suggestion (nice to have)
-Minor correctness nits or defensive improvements.
+Minor validated correctness nits or defensive improvements below the high-signal bar. This tier is a Lisa addition — upstream 1.0.1 reports nothing below its bar — so keep it short and omit it when empty.
 
 ### Finding format
 

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-devin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-devin/.devin-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.84.10",
+  "version": "4.84.11",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"