@codyswann/lisa 4.84.6 → 4.84.8

package/plugins/src/base/skills/lisa-tracker-evidence/references/completion-authorization.md

@@ -0,0 +1,193 @@
+# Accepted completion proof
+
+Merging a pull request makes work available for delivery. It does not authorize
+closing the work item. The canonical `scripts/lisa-work-item.mjs complete` and
+GitHub applying sweep require the same accepted-for-completion record before
+adding a terminal label, removing competing lifecycle labels, closing an issue,
+or changing a Linear item to its terminal state. Jira completion remains
+unsupported. Intermediate deployment roles retain their existing behavior.
+
+An absent record or pending delivery leaves the item open with its current owner
+and labels. The command names the pending obligation and asks for canonical
+Verify/evidence. An invalid record, unreadable provider, or failed write is a
+different outcome. A workflow must not file a delivery-failure issue merely
+because verification has not finished.
+
+## Publish after verification
+
+The canonical tracker-evidence skill performs these steps after real evidence
+uploads and exact readbacks:
+
+1. Capture the delivered behavior, required hosted checks, actual configured
+   delivery, and every local typed evidence marker. Keep historical RED captures
+   and expected refusal exits as captures; current required claims and criteria
+   must independently pass.
+2. Write canonical Verify usage, including explicit unavailable metrics when
+   needed. The future native completion time (`acceptedAt`) remains null.
+3. Prepare the record input below from actual native source and uploaded asset
+   identities. Attach a structured CONFORMS report for the complete requirement
+   conjunctions and current full specification.
+4. Execute the shipped producer:
+
+   ```sh
+   node scripts/lisa-work-item.mjs publish-completion-proof \
+     --ref acme/code#42 --record evidence/completion-record.json
+   ```
+
+   Linear uses its configured identifier and implementation GitHub repository.
+   Both providers use the implementation repository's existing `pr-assets`
+   release. The producer reads current native requirements/configuration,
+   validates the actual attachment bytes and source/delivery, uploads a uniquely
+   hash-named JSON asset without replacement, reads it back, then posts and reads
+   back an exact native-item locator. The locator alone proves nothing.
+5. Run canonical completion. Record the real native terminal readback and usage
+   acceptance afterward. A pending result is retryable after its named proof
+   obligation is satisfied; it does not authorize a manual close.
+
+For a journey requiring a pending-state screenshot or state dump, capture and
+upload that nonempty Phase-A artifact before publication/completion. Keep it
+immutable. Append the later real terminal readback as a separate Phase-B
+postcondition. Historical pending text in the earlier artifact is valid.
+
+When a final requirement includes the terminal event itself, retain its claim
+as an explicit pending postcondition in the complete phase ledger. The
+accepted record's conjunctions and CONFORMS report cover only actual transition
+inputs; they do not claim the future event passed. Keep the full final-spec
+report PARTIAL until native Phase B, then attach the actual readback and update
+the final required claim. Never fabricate a future closed state to obtain
+pre-transition CONFORMS.
+
+## Record contract
+
+Schema version 1 has kind `lisa-completion-authorization`. The producer derives
+the stable record ID, monotonic revision, predecessor digest, capture timestamp,
+native item ID/provider/scope, repository ID/name, publisher ID, production
+environment/branch and current `spec_sha256`. Input supplies:
+
+- `state`: `accepted-for-completion`, `pending`, or `revoked`. A newer trusted
+  pending, revoked or malformed revision never falls back to an older accepted
+  record. Untrusted comments cannot select or revoke a record.
+- `source`: primary `pull_request`, `pr_head`, actual `tested_head`, `merge_sha`,
+  `declaring_commits`, `production_snapshot_sha`, and `delivered_sha`. These are
+  distinct identities with native reconciliation, not a requirement that all
+  SHAs be equal. The primary PR and source commits must declare this exact work
+  item. A supplied `--pr-url` must identify that primary PR. Timeline mentions
+  and a different work item's accepted record cannot substitute.
+- `evidence`: rows with `evidence_id`, canonical `kind`, native `asset_id`, actual
+  `bytes`, `sha256`, `captured_at`, and `artifact_head_sha`.
+- `manifest`: one `{name, kind, evidence_id}` row for every local marker.
+  `EVIDENCE-REF` is non-claiming and cannot satisfy a local marker.
+- `verdicts`: actual native JSON asset pointers (`asset_id`, `bytes`, `sha256`)
+  with role `remote` or `quality`. Each is schema2 PASS with passing criteria,
+  positively established required claims, attached reaching evidence and
+  `not_established_reviewed: true`. Each claim's evidence must also occur in its
+  own verdict's evidence list with the same execution head and digest.
+- `requirements`: unique `{requirement_id, operator: "all", claim_ids}` rows.
+  Every required conjunct must be a validated required established claim.
+  Canonical `required_evidence_kinds` remain alternatives; an explicit
+  `evidence_operator: "all"` requires each listed kind.
+- `obligations`: exactly `remote`, `conformance`, `typed_manifest`, `delivery`,
+  `usage`, `linkage`, and `acceptance`. Each has an explicit boolean `required`
+  and applicable status. Required values are `pass`, except conformance uses
+  `CONFORMS` and acceptance uses `accepted-for-completion`.
+
+The conformance obligation includes `requirement_ids` and a native `report`
+asset pointer. Its JSON is `{verdict: "CONFORMS", work_item, spec_sha256,
+requirements, scenario_names}`. Requirement rows include status `pass` and must
+match the record's complete conjunction map; every primary acceptance scenario
+must be covered. The usage obligation lists the actual canonical `entry_ids`.
+The remote obligation lists empirical required `claim_ids` against the delivered
+environment/source, beyond code-unit checks.
+
+Runtime leaves require remote and delivery proof. Explicit doc-only,
+config-only and type-only no-runtime declarations permit their corresponding
+N/A reasons; no-local-markers permits only the empty manifest exemption.
+Missing or duplicate environment declarations cannot grant an exemption.
+Childless Story/Spike work remains a leaf. Container rollup is a separate path;
+older blanket container wording in evidence guidance does not grant a new
+terminal-writer bypass.
+
+Attachments must be nonempty bounded actual native assets in this repository's
+`pr-assets` release, with matching byte counts and SHA256. Canonical kinds are
+screenshot, recording, http-transcript, cli-output, log-snippet, db-query-output,
+perf-trace, test-run-log, deploy-log and state-dump. The reader validates actual
+captured structure/header, not an extension. HTTP HEAD/204 and empty query rows
+can be legitimate observations. Structure checks do not claim to evaluate the
+visual truth of an image or the business meaning of every captured line.
+
+Native JSON reads use a separate 16 MiB ceiling per response, including the
+complete slurped output of a paginated listing. The immutable proof record
+remains limited to 2 MiB. Page and row limits are additional bounds: a listing
+with at most 100 pages or 10,000 comments can still exceed its byte ceiling and
+must fail closed without a lifecycle write. Visible local evidence markers
+claim attachments; fenced or indented examples and HTML comments do not.
+
+An ordinary pending result from `complete` or the applying sweep exits zero
+because it preserves the nonterminal state. A refused `publish-completion-proof`
+exits nonzero when no locator was published. A successful bot publication with
+category `published/pending-producer` remains a successful publication; only
+completion waits for its pinned producer attempt.
+
+## Delivery and publisher configuration
+
+Configure the actual production delivery mechanism under
+`verification.completion.delivery.<environment>`. For GitHub Actions, use
+`mechanism: "github-actions"`, exact `workflow_path`, and permitted native
+`events`. Records pin each actual run's `run_id`, `workflow_id`, `workflow_path`,
+`event`, `attempt` and `head_sha`. The whole configured post-merge run must
+finish successfully and reconcile with delivered source. Pre-merge CI and an
+auxiliary green workflow cannot replace it. Artifact or external-deployment
+projects declare their applicable mechanism and empirical attached
+`evidence_refs`; npm, browser, cloud and device checks are not universal.
+
+User publishers require fresh native repository write/maintain/admin permission
+and matching stable native asset-uploader identity. Association labels, display
+names and issue edit access are insufficient. `automationPublishers` defaults
+to an empty array. A configured automation row requires stable Bot `user_id`,
+`type: "Bot"`, `repository_id`, exact `workflow_id`, `workflow_path`, allowed
+`events`, and branch `ref`. Its record producer additionally pins
+`workflow_run_id`, `workflow_attempt`, and `workflow_head`.
+
+The native asset belongs to the repository and uploader; exact native run
+repository, workflow, ref, head, attempt and upload interval corroborate that
+configured automation policy. This is not a cryptographic claim about which
+step uploaded the asset. A bot can publish during its pinned attempt and gets
+`published/pending-producer`. Completion remains pending until that exact native
+attempt succeeds, without rewriting the asset. A failed/cancelled/timed-out
+attempt cannot be upgraded by a later successful rerun. User records do not
+gain an unnecessary producer-run requirement.
+
+## Freshness and readbacks
+
+The full primary specification is hashed except positively recognized canonical
+accounting lines/tokens and closed-schema machine metadata. Unknown visible
+prose and table rows inside the usage section remain hashed, including text
+before its rollup. Fenced examples cannot declare runtime scope or machine
+blocks. Duplicate declarations are refused.
+
+Precisely delimited `lisa:completion-authorization` blocks exclude only the
+JSON locator's six exact fields: `schema_version`, `record_id`, `revision`,
+`repository`, `asset_id`, `sha256`. `lisa:completion-postcondition` blocks exclude
+only JSON with `schema_version: 1`, `provider`, canonical `ref`, real `native_id`,
+`record_sha256`, UTC `completed_at`, and native terminal `state` (`CLOSED` for
+GitHub, `completed` for Linear). Unknown keys, prose, or visible requirements
+inside either block remain part of the specification. These bookkeeping fields
+must use the exact canonical compact or two-space JSON serialization; duplicate
+keys and other raw forms remain hashed. These bookkeeping fields
+never authorize completion or replace the actual native readback; publish them
+only after observing the real terminal event. Do not add outside prose or
+spacing as if it were part of the machine metadata block.
+
+The reader checks the accepted production snapshot against a fresh native
+branch tip and fully paginates native compare commits. Newer source declaring
+this same item anywhere from delivered source through the accepted snapshot to
+the current tip requires fresh proof; unrelated newer work does not invalidate
+it. It re-reads the trusted record, native scope, canonical usage, backlink and
+lifecycle state immediately before mutation, preserving freshly observed owner
+and unrelated labels. This is bounded authoritative rereading and post-write
+verification, not a distributed atomic transaction.
+
+The shipped Node usage parser is the same implementation used by the TypeScript
+facade and works in a host without application `dist`. Local advisory Stop-hook
+files cannot authorize production writes. Protocol version 1.2.0 adds these
+verdict semantics; normal generator checks maintain its dependent versions.

package/scripts/lib/host-name-expanded-command-cases.mjs

@@ -0,0 +1,286 @@
+/** Direct expanded command-name regressions; all identities are synthetic. */
+import assert from "node:assert/strict";
+import { boundedExecFileSync } from "./bounded-spawn.mjs";
+
+/** @param {object} context Isolated actual-wrapper fixtures. @returns {Array[]} Named cases. */
+export function hostNameExpandedCommandCases(context) {
+  const { lisaCwd, unknownCwd, hostCwd, lisa, host, fixtureName, body } =
+    context;
+  const cases = [];
+  for (const [target, cwd, repo] of [
+    ["protected", lisaCwd, ` --repo ${lisa}`],
+    ["unknown", unknownCwd, ""],
+  ]) {
+    for (const [name, noun] of [
+      ["unquoted", "$N"],
+      ["double quoted", '"$N"'],
+      ["braced", '"${N}"'],
+      ["concatenated", 'is"$SUFFIX"'],
+    ]) {
+      cases.push([
+        `expanded noun ${name} ${target} write`,
+        cwd,
+        `gh ${noun} create${repo} --body '${fixtureName}'`,
+        2,
+      ]);
+    }
+    for (const [name, verb] of [
+      ["unquoted", "$V"],
+      ["double quoted", '"$V"'],
+      ["braced", '"${V}"'],
+      ["concatenated", 'cre"$TAIL"'],
+    ]) {
+      cases.push([
+        `expanded verb ${name} ${target} write`,
+        cwd,
+        `gh issue ${verb}${repo} --body '${fixtureName}'`,
+        2,
+      ]);
+    }
+    for (const [name, prefix] of [
+      ["multiple-word noun", "gh $N"],
+      ["multiple-word verb", "gh issue $V"],
+      ["noun before read-looking word", "gh $N view"],
+      ["verb before read-looking word", "gh issue $V view"],
+    ]) {
+      cases.push([
+        `expanded ${name} ${target} write`,
+        cwd,
+        `${prefix}${repo} --body '${fixtureName}'`,
+        2,
+      ]);
+    }
+    for (const [name, args] of [
+      ["API field text", `-F body=${fixtureName}`],
+      ["API field file", `-F body=@${body}`],
+      ["API attached field file", `-Fbody=@${body}`],
+      ["API raw field", `-f body=${fixtureName}`],
+      ["API input file", `--input ${body}`],
+    ]) {
+      cases.push([
+        `expanded noun possible ${name} ${target} write`,
+        cwd,
+        `gh "$N" repos/${lisa}/issues ${args}`,
+        2,
+      ]);
+    }
+    cases.push(
+      [
+        `expanded noun issue body-file ${target} write`,
+        cwd,
+        `gh "$N" create${repo} -F ${body}`,
+        2,
+      ],
+      [
+        `expanded both command positions ${target} write`,
+        cwd,
+        `gh${repo} "$N" "$V" --body '${fixtureName}'`,
+        2,
+      ]
+    );
+  }
+  cases.push(
+    [
+      "expanded PR verb protected body-file write",
+      lisaCwd,
+      `gh pr "$V" --repo ${lisa} --body-file ${body}`,
+      2,
+    ],
+    [
+      "expanded PR verb unknown body-file write",
+      unknownCwd,
+      `gh pr "$V" --body-file ${body}`,
+      2,
+    ],
+    [
+      "expanded noun literal host flag cannot certify target",
+      hostCwd,
+      `gh "$N" create --repo ${host} --body '${fixtureName}'`,
+      2,
+    ],
+    [
+      "expanded-name API GET prose with dynamic filter control",
+      lisaCwd,
+      `gh api repos/${lisa}/issues -X GET -F body=${fixtureName} -q "$FILTER"`,
+      0,
+    ],
+    [
+      "expanded-name API GET input with dynamic filter control",
+      lisaCwd,
+      `gh api repos/${lisa}/issues -X GET --input ${body} -q "$FILTER"`,
+      0,
+    ],
+    [
+      "expanded-name literal host control",
+      hostCwd,
+      `gh issue create --repo ${host} --body '${fixtureName}'`,
+      0,
+    ],
+    [
+      "expanded-name literal protected control",
+      lisaCwd,
+      `gh issue create --repo ${lisa} --body '${fixtureName}'`,
+      2,
+    ],
+    [
+      "expanded-name literal unknown control",
+      unknownCwd,
+      `gh issue create --body '${fixtureName}'`,
+      2,
+    ],
+    [
+      "expanded-name dynamic read filter control",
+      lisaCwd,
+      `gh issue list --repo ${lisa} --json title --jq "$FILTER"`,
+      0,
+    ],
+    [
+      "expanded-name dynamic read selector control",
+      lisaCwd,
+      `gh issue view "$NUMBER" --repo ${lisa} --json title --jq '${fixtureName}'`,
+      0,
+    ],
+    [
+      "expanded-name API GET dynamic filter control",
+      lisaCwd,
+      `gh api repos/${lisa}/issues -X GET -q "$FILTER"`,
+      0,
+    ],
+    [
+      "expanded-name single-quoted noun control",
+      lisaCwd,
+      `gh '$N' create --repo ${lisa} --body '${fixtureName}'`,
+      0,
+    ],
+    [
+      "expanded-name single-quoted verb control",
+      lisaCwd,
+      `gh issue '$V' --repo ${lisa} --body '${fixtureName}'`,
+      0,
+    ],
+    [
+      "expanded-name escaped noun control",
+      lisaCwd,
+      `gh \\$N create --repo ${lisa} --body '${fixtureName}'`,
+      0,
+    ],
+    [
+      "expanded-name quoted non-command control",
+      lisaCwd,
+      `printf '%s' 'gh $N create --repo ${lisa} --body ${fixtureName}'`,
+      0,
+    ],
+    [
+      "expanded-name clean prose control",
+      lisaCwd,
+      `gh "$N" create --repo ${lisa} --body 'A clean report.'`,
+      0,
+    ],
+    [
+      "expanded-name options before noun preserve prose boundaries",
+      lisaCwd,
+      `gh --repo ${lisa} --title 'view list' "$N" create --body '${fixtureName}'`,
+      2,
+    ],
+    [
+      "expanded-name literal host API control",
+      hostCwd,
+      `gh api repos/${host}/issues -F body=${fixtureName}`,
+      0,
+    ]
+  );
+  return cases;
+}
+
+/**
+ * Establish expansion premises with a Bash function that only prints argv.
+ * @param {object} context Synthetic fixtures.
+ * @param {object} env Isolated child environment.
+ * @returns {void}
+ */
+export function verifyExpandedCommandArgv(context, env) {
+  const { lisaCwd, lisa, fixtureName, body } = context;
+  const suffix = ` --repo ${lisa} --body '${fixtureName}'`;
+  for (const [name, command, values, expected] of [
+    [
+      "unquoted noun",
+      `gh $N create${suffix}`,
+      { N: "issue" },
+      ["issue", "create", "--repo", lisa, "--body", fixtureName],
+    ],
+    [
+      "quoted braced noun",
+      `gh "${"${N}"}" create${suffix}`,
+      { N: "issue" },
+      ["issue", "create", "--repo", lisa, "--body", fixtureName],
+    ],
+    [
+      "concatenated noun",
+      `gh is"$SUFFIX" create${suffix}`,
+      { SUFFIX: "sue" },
+      ["issue", "create", "--repo", lisa, "--body", fixtureName],
+    ],
+    [
+      "concatenated verb",
+      `gh issue cre"$TAIL"${suffix}`,
+      { TAIL: "ate" },
+      ["issue", "create", "--repo", lisa, "--body", fixtureName],
+    ],
+    [
+      "multiword noun before read-looking word",
+      `gh $N view${suffix}`,
+      { N: "issue create --title" },
+      [
+        "issue",
+        "create",
+        "--title",
+        "view",
+        "--repo",
+        lisa,
+        "--body",
+        fixtureName,
+      ],
+    ],
+    [
+      "multiword verb before read-looking word",
+      `gh issue $V view${suffix}`,
+      { V: "create --title" },
+      [
+        "issue",
+        "create",
+        "--title",
+        "view",
+        "--repo",
+        lisa,
+        "--body",
+        fixtureName,
+      ],
+    ],
+    [
+      "possible API field file",
+      `gh "$N" repos/${lisa}/issues -F body=@${body}`,
+      { N: "api" },
+      ["api", `repos/${lisa}/issues`, "-F", `body=@${body}`],
+    ],
+  ]) {
+    const argv = boundedExecFileSync(
+      "/bin/bash",
+      ["-c", `gh() { printf '%s\\0' "$@"; }; ${command}`],
+      { cwd: lisaCwd, env: { ...env, ...values }, encoding: "utf8" }
+    )
+      .split("\0")
+      .slice(0, -1);
+    assert.deepEqual(argv, expected, name);
+    console.log(
+      JSON.stringify({
+        localExpandedArgvControl: {
+          name,
+          command,
+          argv,
+          inspectedTrackerWriteExecuted: false,
+          ghImplementation: "Bash argv-only printer",
+        },
+      })
+    );
+  }
+}

package/scripts/lib/host-name-field-occurrence-cases.mjs

@@ -0,0 +1,60 @@
+/** Repeated typed API fields must not hide an earlier unresolved prose file. */
+export function hostNameFieldOccurrenceCases({ lisaCwd, lisa, relative }) {
+  const prefix = 'cd "$D" && gh',
+    endpoint = `repos/${lisa}/issues`,
+    clean = `${lisaCwd}/body.md`,
+    refusal = "BLOCKED: the working directory";
+  const unknown = (name, command) => [name, lisaCwd, command, 2, {}, refusal];
+  return [
+    unknown(
+      "expanded repeated field retains earlier relative prose file",
+      `${prefix} "$N" ${endpoint} --field body=@body.md --field title=clean`
+    ),
+    unknown(
+      "literal API repeated field retains earlier relative prose file",
+      `${prefix} api ${endpoint} --field body=@body.md --field title=clean`
+    ),
+    unknown(
+      "literal API repeated F before absolute clean field retains relative file",
+      `${prefix} api ${endpoint} -F body=@body.md -F title=@${clean}`
+    ),
+    unknown(
+      "expanded repeated F union retains unresolved file control",
+      `${prefix} "$N" ${endpoint} -F body=@body.md -F title=@${clean}`
+    ),
+    unknown(
+      "expanded repeated field body-last control",
+      `${prefix} "$N" ${endpoint} --field title=clean --field body=@body.md`
+    ),
+    [
+      "literal API repeated fields known cwd reads original prose file",
+      lisaCwd,
+      `cd '${relative}' && gh api ${endpoint} --field body=@body.md --field title=clean`,
+      2,
+    ],
+    [
+      "literal API repeated fields GET remains read-only",
+      lisaCwd,
+      `${prefix} api ${endpoint} -X GET --field body=@body.md --field title=clean -q "$FILTER"`,
+      0,
+    ],
+    [
+      "nonadditive body-file last value remains authoritative",
+      lisaCwd,
+      `${prefix} issue create --repo ${lisa} --body-file missing.md --body-file ${clean}`,
+      0,
+    ],
+    unknown(
+      "expanded mixed field aliases retain earlier relative file control",
+      `${prefix} "$N" ${endpoint} --field body=@body.md -F title=@${clean}`
+    ),
+    unknown(
+      "expanded repeated equal field retains earlier relative file",
+      `${prefix} "$N" ${endpoint} --field=body=@body.md --field=title=clean`
+    ),
+    unknown(
+      "literal API repeated attached F retains earlier relative file",
+      `${prefix} api ${endpoint} -Fbody=@body.md -Ftitle=@${clean}`
+    ),
+  ];
+}

package/scripts/two-channel-couplings.json

@@ -108,9 +108,9 @@
   },
   "inspected": {
     "workflows": 26,
-    "steps": 787,
+    "steps": 788,
     "couplings": 37,
-    "inventory": 186
+    "inventory": 204
   },
   "counts": {
     "package-backed": 11,

package/scripts/verify-host-name-target-scope.mjs

@@ -17,6 +17,11 @@ import path from "node:path";
 import { boundedExecFileSync, boundedSpawnSync } from "./lib/bounded-spawn.mjs";
 import { hostNameTargetCases } from "./lib/host-name-target-cases.mjs";
 import { hostNameReviewCases } from "./lib/host-name-review-cases.mjs";
+import {
+  hostNameExpandedCommandCases,
+  verifyExpandedCommandArgv,
+} from "./lib/host-name-expanded-command-cases.mjs";
+import { hostNameFieldOccurrenceCases } from "./lib/host-name-field-occurrence-cases.mjs";
 
 const root = process.cwd();
 const DETECTOR_RELATIVE = "dist/core/downstream-references.js";
@@ -118,6 +123,15 @@ try {
   const identity = {
     proverCheckoutHead: git(root, ["rev-parse", "HEAD"]),
     proverSha256: digest(new URL(import.meta.url)),
+    caseModules: [
+      "host-name-target-cases.mjs",
+      "host-name-review-cases.mjs",
+      "host-name-expanded-command-cases.mjs",
+      "host-name-field-occurrence-cases.mjs",
+    ].map(file => ({
+      file,
+      sha256: digest(new URL(`./lib/${file}`, import.meta.url)),
+    })),
     payloadRoot,
     payloadPackageVersion: JSON.parse(
       readFileSync(path.join(payloadRoot, "package.json"), "utf8")
@@ -299,7 +313,10 @@ try {
   const cases = [
     ...hostNameTargetCases(context),
     ...hostNameReviewCases(context),
+    ...hostNameExpandedCommandCases(context),
+    ...hostNameFieldOccurrenceCases(context),
   ];
+  verifyExpandedCommandArgv(context, fixtureEnv);
   for (const [
     name,
     cwd,
@@ -330,7 +347,16 @@ try {
     );
     const passed =
       run.status === expected && (expected !== 2 || output.includes(refusal));
-    records.push({ name, expected, actual: run.status, passed, output });
+    records.push({
+      name,
+      cwd,
+      command,
+      overrides,
+      expected,
+      actual: run.status,
+      passed,
+      output,
+    });
     console.log(JSON.stringify(records.at(-1)));
   }
   const failed = records.filter(record => !record.passed);

package/typescript/copy-overwrite/.prettierignore

@@ -136,6 +136,18 @@ scripts/lib/automation-provenance-contract.mjs
 scripts/lib/automation-provenance-files.mjs
 scripts/lib/automation-provenance-local.mjs
 scripts/lib/bounded-spawn.mjs
+scripts/lib/completion-authorization.mjs
+scripts/lib/completion-proof-adapters.mjs
+scripts/lib/completion-proof-conformance.mjs
+scripts/lib/completion-proof-content.mjs
+scripts/lib/completion-proof-errors.mjs
+scripts/lib/completion-proof-github.mjs
+scripts/lib/completion-proof-markdown.mjs
+scripts/lib/completion-proof-projection.mjs
+scripts/lib/completion-proof-publisher.mjs
+scripts/lib/completion-proof-reader.mjs
+scripts/lib/completion-proof-shape.mjs
+scripts/lib/completion-proof-source.mjs
 scripts/lib/gate-failure-diagnosis.mjs
 scripts/lib/github-attestation-provider.mjs
 scripts/lib/github-attestation-recovery.mjs
@@ -220,6 +232,9 @@ scripts/lib/process-tree-runner.mjs
 scripts/lib/reusable-workflow-load-adapter.mjs
 scripts/lib/reusable-workflow-load-failure.mjs
 scripts/lib/reusable-workflow-load-scan.mjs
+scripts/lib/usage-effectiveness.mjs
+scripts/lib/usage-ledger-integrity.mjs
+scripts/lib/usage-ledger.mjs
 scripts/lib/windows-process-job.mjs
 scripts/lib/worktree-dependencies.mjs
 scripts/lisa-hooks/worktree-binding-guard.mjs