@codyswann/lisa 4.87.5 → 4.87.7

package/dist/cli/doctor-seeded-artifacts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-seeded-artifacts.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-seeded-artifacts.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAkBjC"}
+{"version":3,"file":"doctor-seeded-artifacts.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-seeded-artifacts.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAwBjC"}

package/dist/cli/doctor-seeded-artifacts.js

@@ -1,14 +1,14 @@
 /**
- * The four checks that ask what Lisa SEEDED into this repository, and whether
+ * The five checks that ask what Lisa SEEDED into this repository, and whether
  * what it seeded still says what it meant.
  *
- * They are grouped because they are one operator question asked four ways, and
+ * They are grouped because they are one operator question asked five ways, and
  * because each of them exists for the same structural reason: the write path
  * that could have prevented the defect is reached exactly once, before the file
  * exists. A repository that received the template earlier therefore has no
  * signal of any kind — the seeding postinstall is skipped under CI, the file is
  * untracked, and the tool the file disables reports only that it found nothing.
- * A fix on the write path reaches the NEXT adoption; these four are how an
+ * A fix on the write path reaches the NEXT adoption; these five are how an
  * existing one finds itself.
  *
  * `doctor-lisa-owned-artifacts` is the inverse and deliberately stays where it
@@ -23,6 +23,7 @@ import { checkCdkPresetAdoption } from "./doctor-cdk-preset-adoption.js";
 import { checkConfigShadowing } from "./doctor-config-shadowing.js";
 import { checkRailsDeployIntent } from "./doctor-rails-deploy-intent.js";
 import { checkStaleManagedBanner } from "./doctor-stale-managed-banner.js";
+import { checkThirdPartyEvidenceSeed } from "./doctor-third-party-evidence-seed.js";
 /**
  * Run every seeded-artifact check, in the order an operator reads them.
  *
@@ -41,6 +42,12 @@ export async function checkSeededArtifacts(targetPath) {
         // The seed fix reaches new adoptions only and the apply path will not
         // rewrite a host-owned workflow (CodySwannGT/lisa#3779).
         await checkRailsDeployIntent(targetPath),
+        // Whether a host-owned workflow Lisa is FORBIDDEN to refresh still runs at
+        // all. The evidence workflow woke only on `status`, and a reviewer that
+        // reports through a check run fires none, so seeded copies silently
+        // stopped running; the seed fix reaches new adoptions only
+        // (CodySwannGT/lisa#4553).
+        await checkThirdPartyEvidenceSeed(targetPath),
         // Whether a whole stack preset was delivered to a repository that never
         // qualified for it. The detection fix reaches the next decision only, and
         // the dead-code gate it skewed reports SUCCESS (CodySwannGT/lisa#3711).

package/dist/cli/doctor-seeded-artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-seeded-artifacts.js","sourceRoot":"","sources":["../../src/cli/doctor-seeded-artifacts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAG3E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkB;IAElB,OAAO;QACL,wEAAwE;QACxE,2BAA2B;QAC3B,MAAM,oBAAoB,CAAC,UAAU,CAAC;QACtC,yEAAyE;QACzE,sEAAsE;QACtE,yDAAyD;QACzD,MAAM,sBAAsB,CAAC,UAAU,CAAC;QACxC,wEAAwE;QACxE,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,sBAAsB,CAAC,UAAU,CAAC;QACxC,qEAAqE;QACrE,yEAAyE;QACzE,4DAA4D;QAC5D,MAAM,uBAAuB,CAAC,UAAU,CAAC;KAC1C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"doctor-seeded-artifacts.js","sourceRoot":"","sources":["../../src/cli/doctor-seeded-artifacts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAGpF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkB;IAElB,OAAO;QACL,wEAAwE;QACxE,2BAA2B;QAC3B,MAAM,oBAAoB,CAAC,UAAU,CAAC;QACtC,yEAAyE;QACzE,sEAAsE;QACtE,yDAAyD;QACzD,MAAM,sBAAsB,CAAC,UAAU,CAAC;QACxC,2EAA2E;QAC3E,wEAAwE;QACxE,oEAAoE;QACpE,2DAA2D;QAC3D,2BAA2B;QAC3B,MAAM,2BAA2B,CAAC,UAAU,CAAC;QAC7C,wEAAwE;QACxE,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,sBAAsB,CAAC,UAAU,CAAC;QACxC,qEAAqE;QACrE,yEAAyE;QACzE,4DAA4D;QAC5D,MAAM,uBAAuB,CAAC,UAAU,CAAC;KAC1C,CAAC;AACJ,CAAC"}

package/dist/cli/doctor-third-party-evidence-seed.d.ts

@@ -0,0 +1,32 @@
+import { type EvidenceSeedReading } from "../core/third-party-evidence-seed.js";
+import type { DoctorCheck } from "./doctor.js";
+/** Name of the check as doctor reports it. */
+export declare const THIRD_PARTY_EVIDENCE_SEED_CHECK_NAME = "Third-party review evidence wakes on check runs?";
+/** The trigger lines to add under `on:`. */
+export declare const CHECK_RUN_TRIGGER_LINES: readonly ["  check_run:", "    types: [completed]"];
+/** The permission line to add under an existing `permissions:` block. */
+export declare const CHECKS_READ_LINE = "  checks: read";
+/** The whole block, for a copy missing any scope the prover reads with. */
+export declare const PERMISSIONS_BLOCK_LINES: readonly ["permissions:", "  contents: read", "  statuses: read", "  checks: read", "  pull-requests: read"];
+/** The values that carry the run's commit and reviewer to the prover. */
+export declare const RUN_IDENTITY_LINES: readonly ["  EVIDENCE_SHA: ${{ github.event.check_run.head_sha || github.event.sha || inputs.sha }}", "  EVIDENCE_CONTEXT: ${{ github.event.check_run.name || github.event.context }}"];
+/** The concurrency key that keeps one run from cancelling another's verdict. */
+export declare const CONCURRENCY_GROUP_LINE = "  group: third-party-review-evidence-${{ github.event_name }}-${{ github.event.check_run.head_sha || github.event.sha || inputs.sha }}-${{ github.event.check_run.name || github.event.context }}";
+/**
+ * The operator-facing finding and its exact remedy.
+ * @param reading - What the copy does
+ * @returns The detail for a stale copy
+ */
+export declare function describeStaleSeed(reading: EvidenceSeedReading): string;
+/**
+ * Report whether the seeded evidence workflow wakes on, can read, and safely
+ * judges the reviewer's check run.
+ *
+ * Warns rather than fails on a stale copy: the remedy is an edit to a
+ * host-owned file, and nothing about the project is broken locally. Fails when
+ * the question could not be answered.
+ * @param targetPath - Project path to inspect
+ * @returns Doctor check result
+ */
+export declare function checkThirdPartyEvidenceSeed(targetPath: string): Promise<DoctorCheck>;
+//# sourceMappingURL=doctor-third-party-evidence-seed.d.ts.map

package/dist/cli/doctor-third-party-evidence-seed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-third-party-evidence-seed.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-third-party-evidence-seed.ts"],"names":[],"mappings":"AA4BA,OAAO,EAML,KAAK,mBAAmB,EACzB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,8CAA8C;AAC9C,eAAO,MAAM,oCAAoC,qDACG,CAAC;AAwBrD,4CAA4C;AAC5C,eAAO,MAAM,uBAAuB,qDAG1B,CAAC;AAEX,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,mBAAmB,CAAC;AAEjD,2EAA2E;AAC3E,eAAO,MAAM,uBAAuB,8GAM1B,CAAC;AAEX,yEAAyE;AACzE,eAAO,MAAM,kBAAkB,yLAGrB,CAAC;AAEX,gFAAgF;AAChF,eAAO,MAAM,sBAAsB,sMAA2G,CAAC;AAsH/I;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAOtE;AAED;;;;;;;;;GASG;AACH,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC,CAiCtB"}

package/dist/cli/doctor-third-party-evidence-seed.js

@@ -0,0 +1,239 @@
+/**
+ * `lisa doctor` check: does this repository's seeded third-party review
+ * evidence workflow still run — and judge safely — now that the reviewer
+ * reports through a check run?
+ *
+ * The workflow woke only on `status` events. A reviewer that reports through a
+ * check run fires none, so the workflow stopped running in every repository it
+ * was seeded into, and nothing said so — a workflow that never starts produces
+ * no red run to notice (CodySwannGT/lisa#4553). The seed is fixed, but it is
+ * `create-only`: Lisa wrote it once, the host owns it, and `lisa apply` never
+ * refreshes it.
+ *
+ * This check REPORTS and names the exact lines to change. It edits nothing, for
+ * the reason `doctor-skip-jobs-migration` gives: `lisa apply` runs on
+ * postinstall, and a repair that edits a host-owned workflow there and gets it
+ * wrong is silent. `retireUnmodified` can only delete, and nothing upgrades a
+ * create-only file in place. The prover the workflow runs is copy-overwrite, so
+ * it is already current; only the workflow's own trigger, token, wiring and
+ * checkout are stale.
+ *
+ * Every filesystem answer is three-valued — present, absent, or
+ * undeterminable — and the last one fails rather than passing quietly: a
+ * workflow this check could not read is not a workflow with nothing missing.
+ * @module cli/doctor-third-party-evidence-seed
+ */
+import { readFile, stat } from "node:fs/promises";
+import * as path from "node:path";
+import { CHECK_RUN_HEAD, CHECK_RUN_NAME, isCurrentEvidenceSeed, readEvidenceSeed, THIRD_PARTY_EVIDENCE_WORKFLOW, } from "../core/third-party-evidence-seed.js";
+/** Name of the check as doctor reports it. */
+export const THIRD_PARTY_EVIDENCE_SEED_CHECK_NAME = "Third-party review evidence wakes on check runs?";
+/** Where the current seed ships inside the package, for a full comparison. */
+const SHIPPED_SEED = "typescript/create-only/.github/workflows/third-party-review-evidence.yml";
+/**
+ * Errno codes that ANSWER the question rather than refusing it: the file is
+ * genuinely not there. Anything else — a permission denial, an I/O error, a
+ * symlink loop — means the probe could not look.
+ *
+ * `ENAMETOOLONG` is deliberately NOT here, although sibling doctor checks list
+ * it. It describes the path this check built, not the file: a project nested
+ * past the platform's path limit can still hold the workflow, and calling that
+ * "never seeded" would pass a copy nobody read.
+ */
+const ABSENT_CODES = new Set(["ENOENT", "ENOTDIR"]);
+/** The commit to judge, from whichever event woke the run. */
+const SHA_EXPRESSION = `\${{ ${CHECK_RUN_HEAD} || github.event.sha || inputs.sha }}`;
+/** The reviewer to judge, from whichever event woke the run. */
+const CONTEXT_EXPRESSION = `\${{ ${CHECK_RUN_NAME} || github.event.context }}`;
+/** The trigger lines to add under `on:`. */
+export const CHECK_RUN_TRIGGER_LINES = [
+    "  check_run:",
+    "    types: [completed]",
+];
+/** The permission line to add under an existing `permissions:` block. */
+export const CHECKS_READ_LINE = "  checks: read";
+/** The whole block, for a copy missing any scope the prover reads with. */
+export const PERMISSIONS_BLOCK_LINES = [
+    "permissions:",
+    "  contents: read",
+    "  statuses: read",
+    CHECKS_READ_LINE,
+    "  pull-requests: read",
+];
+/** The values that carry the run's commit and reviewer to the prover. */
+export const RUN_IDENTITY_LINES = [
+    `  EVIDENCE_SHA: ${SHA_EXPRESSION}`,
+    `  EVIDENCE_CONTEXT: ${CONTEXT_EXPRESSION}`,
+];
+/** The concurrency key that keeps one run from cancelling another's verdict. */
+export const CONCURRENCY_GROUP_LINE = `  group: third-party-review-evidence-\${{ github.event_name }}-${SHA_EXPRESSION}-${CONTEXT_EXPRESSION}`;
+/**
+ * Read the workflow, REJECTING when the filesystem declines to say.
+ * @param projectRoot - Absolute project root
+ * @returns Workflow source, or null when the file is provably absent
+ * @throws {Error} When the file exists but could not be read
+ */
+async function readWorkflow(projectRoot) {
+    try {
+        return await readFile(path.join(projectRoot, THIRD_PARTY_EVIDENCE_WORKFLOW), "utf8");
+    }
+    catch (error) {
+        const code = typeof error === "object" && error !== null && "code" in error
+            ? String(error.code)
+            : undefined;
+        if (code !== undefined && ABSENT_CODES.has(code))
+            return null;
+        throw new Error(`could not read ${THIRD_PARTY_EVIDENCE_WORKFLOW}: ${code ?? String(error)}`, { cause: error });
+    }
+}
+/**
+ * The plain-language gaps a copy has, in the order an operator fixes them.
+ * @param reading - What the copy does
+ * @returns One clause per gap
+ */
+function gapsOf(reading) {
+    return [
+        ...(reading.wakesOnCheckRun
+            ? []
+            : [
+                "it has no `check_run` trigger, so it never starts when the reviewer reports through a check run",
+            ]),
+        ...(reading.readsChecks
+            ? []
+            : [
+                "it does not grant `checks: read`, so its prover cannot read the reviewer's check run",
+            ]),
+        ...(reading.readsStatusesAndPullRequests
+            ? []
+            : [
+                "its token cannot read statuses and pull requests, so every run would read as not being a pull request head and judge nothing",
+            ]),
+        ...(reading.readsRunIdentity
+            ? []
+            : [
+                "it never reads the check run's head SHA and name, so on a check run it would pass an empty --sha and judge nothing",
+            ]),
+        ...(reading.keysConcurrencyPerRun
+            ? []
+            : [
+                "its concurrency group is not keyed on the check run's head and name, so any app's check run can cancel the run judging the reviewer",
+            ]),
+        ...(reading.checksOutEventHead
+            ? [
+                "it checks out the head of the event that woke it, so a pull request's own code — a fork's included — runs with this repository's token and cache scope",
+            ]
+            : []),
+    ];
+}
+/**
+ * The exact lines that grant what the prover reads with.
+ *
+ * Only a copy whose block already reads statuses and pull requests gets the one
+ * `checks: read` line. Every other copy gets the whole block: a block holding
+ * only `checks: read` sets every other scope to none, and the prover could then
+ * no longer find the pull request it is judging.
+ * @param reading - What the copy does
+ * @returns The permission remedy, or nothing when the grants are there
+ */
+function permissionRemedyOf(reading) {
+    if (reading.readsChecks && reading.readsStatusesAndPullRequests)
+        return [];
+    if (reading.declaresPermissions && reading.readsStatusesAndPullRequests) {
+        return ["Add under `permissions:`:", CHECKS_READ_LINE];
+    }
+    return [
+        reading.declaresPermissions
+            ? "Make the `permissions:` block that governs the prover's job read:"
+            : "Add this block at the top level, where the file declares none:",
+        ...PERMISSIONS_BLOCK_LINES,
+    ];
+}
+/**
+ * The exact lines that close each gap.
+ * @param reading - What the copy does
+ * @returns The remedy, one line per array entry
+ */
+function remedyOf(reading) {
+    return [
+        ...(reading.wakesOnCheckRun
+            ? []
+            : ["Add under `on:`:", ...CHECK_RUN_TRIGGER_LINES]),
+        ...permissionRemedyOf(reading),
+        ...(reading.readsRunIdentity
+            ? []
+            : [
+                "Set these values in the prover step's `env:`:",
+                ...RUN_IDENTITY_LINES,
+            ]),
+        ...(reading.keysConcurrencyPerRun
+            ? []
+            : ["Set the `concurrency:` group to:", CONCURRENCY_GROUP_LINE]),
+        ...(reading.checksOutEventHead
+            ? [
+                "Delete the `ref:` line under the `actions/checkout` step. The default branch is then checked out, and the commit to judge still arrives as --sha.",
+            ]
+            : []),
+    ];
+}
+/**
+ * The operator-facing finding and its exact remedy.
+ * @param reading - What the copy does
+ * @returns The detail for a stale copy
+ */
+export function describeStaleSeed(reading) {
+    return [
+        `${THIRD_PARTY_EVIDENCE_WORKFLOW} is not ready for a reviewer that reports through a check run: ${gapsOf(reading).join("; and ")}. ` +
+            "Lisa seeded this file once and will not rewrite it; the prover it runs is already current.",
+        ...remedyOf(reading),
+        `The current seed, ${SHIPPED_SEED} in the @codyswann/lisa package, is the full reference.`,
+    ].join("\n");
+}
+/**
+ * Report whether the seeded evidence workflow wakes on, can read, and safely
+ * judges the reviewer's check run.
+ *
+ * Warns rather than fails on a stale copy: the remedy is an edit to a
+ * host-owned file, and nothing about the project is broken locally. Fails when
+ * the question could not be answered.
+ * @param targetPath - Project path to inspect
+ * @returns Doctor check result
+ */
+export async function checkThirdPartyEvidenceSeed(targetPath) {
+    try {
+        const root = await stat(targetPath);
+        if (!root.isDirectory()) {
+            throw new Error(`${targetPath} is not a directory`);
+        }
+        const workflowText = await readWorkflow(targetPath);
+        if (workflowText === null) {
+            return ok(`No ${THIRD_PARTY_EVIDENCE_WORKFLOW} in this project`);
+        }
+        const reading = readEvidenceSeed(workflowText);
+        if (isCurrentEvidenceSeed(reading)) {
+            return ok(`${THIRD_PARTY_EVIDENCE_WORKFLOW} wakes on a completed check run, can read it, and judges it from the default branch`);
+        }
+        return {
+            name: THIRD_PARTY_EVIDENCE_SEED_CHECK_NAME,
+            status: "warn",
+            detail: describeStaleSeed(reading),
+        };
+    }
+    catch (error) {
+        return {
+            name: THIRD_PARTY_EVIDENCE_SEED_CHECK_NAME,
+            status: "fail",
+            detail: `Could not determine whether ${THIRD_PARTY_EVIDENCE_WORKFLOW} wakes ` +
+                `on check runs: ${error instanceof Error ? error.message : String(error)}. Treated as a failure rather than a pass: a workflow that could ` +
+                "not be read is not one with nothing missing",
+        };
+    }
+}
+/**
+ * A passing line for this check.
+ * @param detail - What was found
+ * @returns Doctor check result
+ */
+function ok(detail) {
+    return { name: THIRD_PARTY_EVIDENCE_SEED_CHECK_NAME, status: "ok", detail };
+}
+//# sourceMappingURL=doctor-third-party-evidence-seed.js.map

package/dist/cli/doctor-third-party-evidence-seed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-third-party-evidence-seed.js","sourceRoot":"","sources":["../../src/cli/doctor-third-party-evidence-seed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EACL,cAAc,EACd,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,6BAA6B,GAE9B,MAAM,sCAAsC,CAAC;AAG9C,8CAA8C;AAC9C,MAAM,CAAC,MAAM,oCAAoC,GAC/C,kDAAkD,CAAC;AAErD,8EAA8E;AAC9E,MAAM,YAAY,GAChB,0EAA0E,CAAC;AAE7E;;;;;;;;;GASG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAEpD,8DAA8D;AAC9D,MAAM,cAAc,GAAG,QAAQ,cAAc,uCAAuC,CAAC;AAErF,gEAAgE;AAChE,MAAM,kBAAkB,GAAG,QAAQ,cAAc,6BAA6B,CAAC;AAE/E,4CAA4C;AAC5C,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,cAAc;IACd,wBAAwB;CAChB,CAAC;AAEX,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAEjD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,cAAc;IACd,kBAAkB;IAClB,kBAAkB;IAClB,gBAAgB;IAChB,uBAAuB;CACf,CAAC;AAEX,yEAAyE;AACzE,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,mBAAmB,cAAc,EAAE;IACnC,uBAAuB,kBAAkB,EAAE;CACnC,CAAC;AAEX,gFAAgF;AAChF,MAAM,CAAC,MAAM,sBAAsB,GAAG,kEAAkE,cAAc,IAAI,kBAAkB,EAAE,CAAC;AAE/I;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CAAC,WAAmB;IAC7C,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CACnB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,6BAA6B,CAAC,EACrD,MAAM,CACP,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GACR,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK;YAC5D,CAAC,CAAC,MAAM,CAAE,KAA4B,CAAC,IAAI,CAAC;YAC5C,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,IAAI,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,kBAAkB,6BAA6B,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,EAC3E,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,OAA4B;IAC1C,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,eAAe;YACzB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,iGAAiG;aAClG,CAAC;QACN,GAAG,CAAC,OAAO,CAAC,WAAW;YACrB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,sFAAsF;aACvF,CAAC;QACN,GAAG,CAAC,OAAO,CAAC,4BAA4B;YACtC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,8HAA8H;aAC/H,CAAC;QACN,GAAG,CAAC,OAAO,CAAC,gBAAgB;YAC1B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,oHAAoH;aACrH,CAAC;QACN,GAAG,CAAC,OAAO,CAAC,qBAAqB;YAC/B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,qIAAqI;aACtI,CAAC;QACN,GAAG,CAAC,OAAO,CAAC,kBAAkB;YAC5B,CAAC,CAAC;gBACE,wJAAwJ;aACzJ;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CAAC,OAA4B;IACtD,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,4BAA4B;QAAE,OAAO,EAAE,CAAC;IAC3E,IAAI,OAAO,CAAC,mBAAmB,IAAI,OAAO,CAAC,4BAA4B,EAAE,CAAC;QACxE,OAAO,CAAC,2BAA2B,EAAE,gBAAgB,CAAC,CAAC;IACzD,CAAC;IACD,OAAO;QACL,OAAO,CAAC,mBAAmB;YACzB,CAAC,CAAC,mEAAmE;YACrE,CAAC,CAAC,gEAAgE;QACpE,GAAG,uBAAuB;KAC3B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,OAA4B;IAC5C,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,eAAe;YACzB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,kBAAkB,EAAE,GAAG,uBAAuB,CAAC,CAAC;QACrD,GAAG,kBAAkB,CAAC,OAAO,CAAC;QAC9B,GAAG,CAAC,OAAO,CAAC,gBAAgB;YAC1B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,+CAA+C;gBAC/C,GAAG,kBAAkB;aACtB,CAAC;QACN,GAAG,CAAC,OAAO,CAAC,qBAAqB;YAC/B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,kCAAkC,EAAE,sBAAsB,CAAC,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,kBAAkB;YAC5B,CAAC,CAAC;gBACE,mJAAmJ;aACpJ;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA4B;IAC5D,OAAO;QACL,GAAG,6BAA6B,kEAAkE,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI;YAClI,4FAA4F;QAC9F,GAAG,QAAQ,CAAC,OAAO,CAAC;QACpB,qBAAqB,YAAY,yDAAyD;KAC3F,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,UAAkB;IAElB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,qBAAqB,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC,MAAM,6BAA6B,kBAAkB,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,CACP,GAAG,6BAA6B,qFAAqF,CACtH,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,oCAAoC;YAC1C,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC;SACnC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,oCAAoC;YAC1C,MAAM,EAAE,MAAM;YACd,MAAM,EACJ,+BAA+B,6BAA6B,SAAS;gBACrE,kBACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,mEAAmE;gBACnE,6CAA6C;SAChD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,EAAE,CAAC,MAAc;IACxB,OAAO,EAAE,IAAI,EAAE,oCAAoC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9E,CAAC"}

package/dist/cli/doctor.js

@@ -283,8 +283,8 @@ export async function runDoctor(targetPath, options, dependencies = {}) {
         await checkSonarProvider(resolvedTarget, deps),
         await checkLegacyMonitorThresholds(resolvedTarget),
         await checkLisaOwnedArtifacts(resolvedTarget),
-        // The four seeded-artifact checks, in one call because they are one
-        // operator question asked four ways: what did Lisa write into this
+        // The five seeded-artifact checks, in one call because they are one
+        // operator question asked five ways: what did Lisa write into this
         // repository, and does it still say what it meant. Each is unreachable
         // from the write path that could have prevented it — that path runs once,
         // before the file exists — so an already-seeded project has no other way

package/dist/core/lisa-owned-hash-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA2sEjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA8mEjC,CAAC"}
+{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA8sEjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAinEjC,CAAC"}

package/dist/core/lisa-owned-hash-ledger.js

@@ -414,6 +414,9 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
     ]),
     "scripts/check-third-party-review-evidence.mjs": Object.freeze([
         "225e69c41b56f2eb82cdc1a16da26770090c3ccac85fe0dad278938d8ae4f769",
+        "404b5b002d0d639fd862e19c7e136b708a81409df0c14f9f808a6400b39643f2",
+        "444fdab01527fda3ce2bb4f5177bac2079cded0ba8f0166d71fda7ec2e8dc7b3",
+        "61c6896f81d4ceec1f292cd80527a62dea3d985477a26d937d6359d129755713",
         "95f91f2a74ed4e523d064d5d374eadd1c1114f03a3a4fa41532c9b0fd32089de",
     ]),
     "scripts/check-threshold-ratchet.mjs": Object.freeze([
@@ -2662,6 +2665,9 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
     ]),
     "scripts/check-third-party-review-evidence.mjs": Object.freeze([
         "225e69c41b56f2eb82cdc1a16da26770090c3ccac85fe0dad278938d8ae4f769",
+        "404b5b002d0d639fd862e19c7e136b708a81409df0c14f9f808a6400b39643f2",
+        "444fdab01527fda3ce2bb4f5177bac2079cded0ba8f0166d71fda7ec2e8dc7b3",
+        "61c6896f81d4ceec1f292cd80527a62dea3d985477a26d937d6359d129755713",
         "95f91f2a74ed4e523d064d5d374eadd1c1114f03a3a4fa41532c9b0fd32089de",
     ]),
     "scripts/check-threshold-ratchet.mjs": Object.freeze([