@codyswann/lisa 4.87.9 → 4.87.10

package/package.json

@@ -189,7 +189,7 @@
     "qs": "^6.16.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.87.9",
+  "version": "4.87.10",
   "description": "Governance-as-code for AI coding agents: turns a repository into agent-operated software factories with guardrails, guidance and automated enforcement for Claude Code, Codex, Cursor, OpenCode, Antigravity, Copilot and Devin",
   "main": "dist/index.js",
   "exports": {
@@ -347,7 +347,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "43da3f6a370f104973b8543b08eba3157498ab32",
-  "gitHead": "43da3f6a370f104973b8543b08eba3157498ab32",
-  "lisaReleaseTag": "v4.87.9"
+  "lisaReleaseCommit": "4f51a75361cb9455299f3e857e9156792c8c6b59",
+  "gitHead": "4f51a75361cb9455299f3e857e9156792c8c6b59",
+  "lisaReleaseTag": "v4.87.10"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.87.9",
+  "version": "4.87.10",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.87.9",
+  "version": "4.87.10",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-github-evidence/SKILL.md

@@ -54,14 +54,65 @@ If either is missing, **refuse to post**: stop and report the missing Not-establ
 3. **Upload each evidence file**
 
    ```bash
-   for f in "$EVIDENCE_DIR"/[0-9][0-9]-*.txt "$EVIDENCE_DIR"/[0-9][0-9]-*.json; do
-     [ -f "$f" ] || continue
-     name="pr-${PR_NUMBER}-$(basename "$f")"
-     gh release upload pr-assets --repo <impl-org>/<impl-repo> --clobber "$f#$name"
-   done
+   (
+     set -e
+     export LC_ALL=C
+     upload_dir=$(mktemp -d "${TMPDIR:-/tmp}/lisa-github-evidence.XXXXXXXX")
+     trap 'rm -rf "$upload_dir"' EXIT
+     expected_names="$upload_dir/expected-names.txt"
+     basenames="$upload_dir/basenames.txt"
+     : > "$expected_names"
+     : > "$basenames"
+
+     for f in "$EVIDENCE_DIR"/[0-9][0-9]-*.txt "$EVIDENCE_DIR"/[0-9][0-9]-*.json; do
+       [ -f "$f" ] || continue
+       base=$(basename "$f")
+       if [[ ! "$base" =~ ^[0-9]{2}-[a-z0-9]+(-[a-z0-9]+)*\.(txt|json)$ ]]; then
+         printf 'Invalid evidence filename; use a name like 01-health-check.json or 02-output.txt: %s\n' "$base" >&2
+         exit 1
+       fi
+       printf '%s\n' "$base" >> "$basenames"
+     done
+
+     while IFS= read -r base; do
+       name="pr-${PR_NUMBER}-${base}"
+       cp "$EVIDENCE_DIR/$base" "$upload_dir/$name"
+       gh release upload pr-assets --repo <impl-org>/<impl-repo> --clobber "$upload_dir/$name"
+       printf '%s\n' "$name" >> "$expected_names"
+     done < "$basenames"
+
+     gh release view pr-assets --repo <impl-org>/<impl-repo> \
+       --json assets --jq '.assets[].name' > "$upload_dir/asset-names.txt"
+     while IFS= read -r name; do
+       if ! grep -Fxq -- "$name" "$upload_dir/asset-names.txt"; then
+         printf 'Expected evidence asset is missing: %s\n' "$name" >&2
+         exit 1
+       fi
+       printf 'Uploaded evidence asset: %s\n' "$name"
+     done < "$expected_names"
+   )
+   upload_status=$?
+   if [ "$upload_status" -ne 0 ]; then
+     printf 'Evidence upload failed; stop before posting.\n' >&2
+     exit "$upload_status"
+   fi
    ```
 
-   The `#$name` syntax sets the asset name. `--clobber` lets re-runs overwrite.
+   Validate the complete input batch before uploading anything: use numbered,
+   ASCII kebab-case names such as `01-health-check.json`. GitHub can
+   [normalize special characters in asset names](https://docs.github.com/en/rest/releases/assets#upload-a-release-asset),
+   so invalid names are refused rather than renamed into another asset.
+
+   An asset takes its name from the uploaded file's basename. A `#` suffix only
+   sets its display label; it cannot rename the asset. Stage the copy under the
+   intended name before uploading. The subshell stops on copy, upload or release
+   read failure, checks every expected name, and removes staging on exit.
+   Run steps 4 and 5 only if the upload block exits successfully. On failure,
+   stop and report it without updating the PR or posting an issue comment.
+   `--clobber` replaces an existing asset with that same PR-prefixed name.
+
+   Link to the actual name:
+   `https://github.com/<impl-org>/<impl-repo>/releases/download/pr-assets/pr-<number>-<file>`.
 
 4. **Update the PR description**
 

package/plugins/lisa/skills/lisa-github-evidence/SKILL.md

@@ -52,14 +52,65 @@ If either is missing, **refuse to post**: stop and report the missing Not-establ
 3. **Upload each evidence file**
 
    ```bash
-   for f in "$EVIDENCE_DIR"/[0-9][0-9]-*.txt "$EVIDENCE_DIR"/[0-9][0-9]-*.json; do
-     [ -f "$f" ] || continue
-     name="pr-${PR_NUMBER}-$(basename "$f")"
-     gh release upload pr-assets --repo <impl-org>/<impl-repo> --clobber "$f#$name"
-   done
+   (
+     set -e
+     export LC_ALL=C
+     upload_dir=$(mktemp -d "${TMPDIR:-/tmp}/lisa-github-evidence.XXXXXXXX")
+     trap 'rm -rf "$upload_dir"' EXIT
+     expected_names="$upload_dir/expected-names.txt"
+     basenames="$upload_dir/basenames.txt"
+     : > "$expected_names"
+     : > "$basenames"
+
+     for f in "$EVIDENCE_DIR"/[0-9][0-9]-*.txt "$EVIDENCE_DIR"/[0-9][0-9]-*.json; do
+       [ -f "$f" ] || continue
+       base=$(basename "$f")
+       if [[ ! "$base" =~ ^[0-9]{2}-[a-z0-9]+(-[a-z0-9]+)*\.(txt|json)$ ]]; then
+         printf 'Invalid evidence filename; use a name like 01-health-check.json or 02-output.txt: %s\n' "$base" >&2
+         exit 1
+       fi
+       printf '%s\n' "$base" >> "$basenames"
+     done
+
+     while IFS= read -r base; do
+       name="pr-${PR_NUMBER}-${base}"
+       cp "$EVIDENCE_DIR/$base" "$upload_dir/$name"
+       gh release upload pr-assets --repo <impl-org>/<impl-repo> --clobber "$upload_dir/$name"
+       printf '%s\n' "$name" >> "$expected_names"
+     done < "$basenames"
+
+     gh release view pr-assets --repo <impl-org>/<impl-repo> \
+       --json assets --jq '.assets[].name' > "$upload_dir/asset-names.txt"
+     while IFS= read -r name; do
+       if ! grep -Fxq -- "$name" "$upload_dir/asset-names.txt"; then
+         printf 'Expected evidence asset is missing: %s\n' "$name" >&2
+         exit 1
+       fi
+       printf 'Uploaded evidence asset: %s\n' "$name"
+     done < "$expected_names"
+   )
+   upload_status=$?
+   if [ "$upload_status" -ne 0 ]; then
+     printf 'Evidence upload failed; stop before posting.\n' >&2
+     exit "$upload_status"
+   fi
    ```
 
-   The `#$name` syntax sets the asset name. `--clobber` lets re-runs overwrite.
+   Validate the complete input batch before uploading anything: use numbered,
+   ASCII kebab-case names such as `01-health-check.json`. GitHub can
+   [normalize special characters in asset names](https://docs.github.com/en/rest/releases/assets#upload-a-release-asset),
+   so invalid names are refused rather than renamed into another asset.
+
+   An asset takes its name from the uploaded file's basename. A `#` suffix only
+   sets its display label; it cannot rename the asset. Stage the copy under the
+   intended name before uploading. The subshell stops on copy, upload or release
+   read failure, checks every expected name, and removes staging on exit.
+   Run steps 4 and 5 only if the upload block exits successfully. On failure,
+   stop and report it without updating the PR or posting an issue comment.
+   `--clobber` replaces an existing asset with that same PR-prefixed name.
+
+   Link to the actual name:
+   `https://github.com/<impl-org>/<impl-repo>/releases/download/pr-assets/pr-<number>-<file>`.
 
 4. **Update the PR description**
 

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.87.9",
+  "version": "4.87.10",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-github-evidence/SKILL.md

@@ -52,14 +52,65 @@ If either is missing, **refuse to post**: stop and report the missing Not-establ
 3. **Upload each evidence file**
 
    ```bash
-   for f in "$EVIDENCE_DIR"/[0-9][0-9]-*.txt "$EVIDENCE_DIR"/[0-9][0-9]-*.json; do
-     [ -f "$f" ] || continue
-     name="pr-${PR_NUMBER}-$(basename "$f")"
-     gh release upload pr-assets --repo <impl-org>/<impl-repo> --clobber "$f#$name"
-   done
+   (
+     set -e
+     export LC_ALL=C
+     upload_dir=$(mktemp -d "${TMPDIR:-/tmp}/lisa-github-evidence.XXXXXXXX")
+     trap 'rm -rf "$upload_dir"' EXIT
+     expected_names="$upload_dir/expected-names.txt"
+     basenames="$upload_dir/basenames.txt"
+     : > "$expected_names"
+     : > "$basenames"
+
+     for f in "$EVIDENCE_DIR"/[0-9][0-9]-*.txt "$EVIDENCE_DIR"/[0-9][0-9]-*.json; do
+       [ -f "$f" ] || continue
+       base=$(basename "$f")
+       if [[ ! "$base" =~ ^[0-9]{2}-[a-z0-9]+(-[a-z0-9]+)*\.(txt|json)$ ]]; then
+         printf 'Invalid evidence filename; use a name like 01-health-check.json or 02-output.txt: %s\n' "$base" >&2
+         exit 1
+       fi
+       printf '%s\n' "$base" >> "$basenames"
+     done
+
+     while IFS= read -r base; do
+       name="pr-${PR_NUMBER}-${base}"
+       cp "$EVIDENCE_DIR/$base" "$upload_dir/$name"
+       gh release upload pr-assets --repo <impl-org>/<impl-repo> --clobber "$upload_dir/$name"
+       printf '%s\n' "$name" >> "$expected_names"
+     done < "$basenames"
+
+     gh release view pr-assets --repo <impl-org>/<impl-repo> \
+       --json assets --jq '.assets[].name' > "$upload_dir/asset-names.txt"
+     while IFS= read -r name; do
+       if ! grep -Fxq -- "$name" "$upload_dir/asset-names.txt"; then
+         printf 'Expected evidence asset is missing: %s\n' "$name" >&2
+         exit 1
+       fi
+       printf 'Uploaded evidence asset: %s\n' "$name"
+     done < "$expected_names"
+   )
+   upload_status=$?
+   if [ "$upload_status" -ne 0 ]; then
+     printf 'Evidence upload failed; stop before posting.\n' >&2
+     exit "$upload_status"
+   fi
    ```
 
-   The `#$name` syntax sets the asset name. `--clobber` lets re-runs overwrite.
+   Validate the complete input batch before uploading anything: use numbered,
+   ASCII kebab-case names such as `01-health-check.json`. GitHub can
+   [normalize special characters in asset names](https://docs.github.com/en/rest/releases/assets#upload-a-release-asset),
+   so invalid names are refused rather than renamed into another asset.
+
+   An asset takes its name from the uploaded file's basename. A `#` suffix only
+   sets its display label; it cannot rename the asset. Stage the copy under the
+   intended name before uploading. The subshell stops on copy, upload or release
+   read failure, checks every expected name, and removes staging on exit.
+   Run steps 4 and 5 only if the upload block exits successfully. On failure,
+   stop and report it without updating the PR or posting an issue comment.
+   `--clobber` replaces an existing asset with that same PR-prefixed name.
+
+   Link to the actual name:
+   `https://github.com/<impl-org>/<impl-repo>/releases/download/pr-assets/pr-<number>-<file>`.
 
 4. **Update the PR description**
 

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.87.9",
+  "version": "4.87.10",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.87.9",
+  "version": "4.87.10",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.87.9",
+  "version": "4.87.10",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.87.9",
+  "version": "4.87.10",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.87.9",
+  "version": "4.87.10",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-devin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.87.9",
+  "version": "4.87.10",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-devin/.devin-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.87.9",
+  "version": "4.87.10",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.87.9",
+  "version": "4.87.10",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/skills/lisa-github-evidence/SKILL.md

@@ -52,14 +52,65 @@ If either is missing, **refuse to post**: stop and report the missing Not-establ
 3. **Upload each evidence file**
 
    ```bash
-   for f in "$EVIDENCE_DIR"/[0-9][0-9]-*.txt "$EVIDENCE_DIR"/[0-9][0-9]-*.json; do
-     [ -f "$f" ] || continue
-     name="pr-${PR_NUMBER}-$(basename "$f")"
-     gh release upload pr-assets --repo <impl-org>/<impl-repo> --clobber "$f#$name"
-   done
+   (
+     set -e
+     export LC_ALL=C
+     upload_dir=$(mktemp -d "${TMPDIR:-/tmp}/lisa-github-evidence.XXXXXXXX")
+     trap 'rm -rf "$upload_dir"' EXIT
+     expected_names="$upload_dir/expected-names.txt"
+     basenames="$upload_dir/basenames.txt"
+     : > "$expected_names"
+     : > "$basenames"
+
+     for f in "$EVIDENCE_DIR"/[0-9][0-9]-*.txt "$EVIDENCE_DIR"/[0-9][0-9]-*.json; do
+       [ -f "$f" ] || continue
+       base=$(basename "$f")
+       if [[ ! "$base" =~ ^[0-9]{2}-[a-z0-9]+(-[a-z0-9]+)*\.(txt|json)$ ]]; then
+         printf 'Invalid evidence filename; use a name like 01-health-check.json or 02-output.txt: %s\n' "$base" >&2
+         exit 1
+       fi
+       printf '%s\n' "$base" >> "$basenames"
+     done
+
+     while IFS= read -r base; do
+       name="pr-${PR_NUMBER}-${base}"
+       cp "$EVIDENCE_DIR/$base" "$upload_dir/$name"
+       gh release upload pr-assets --repo <impl-org>/<impl-repo> --clobber "$upload_dir/$name"
+       printf '%s\n' "$name" >> "$expected_names"
+     done < "$basenames"
+
+     gh release view pr-assets --repo <impl-org>/<impl-repo> \
+       --json assets --jq '.assets[].name' > "$upload_dir/asset-names.txt"
+     while IFS= read -r name; do
+       if ! grep -Fxq -- "$name" "$upload_dir/asset-names.txt"; then
+         printf 'Expected evidence asset is missing: %s\n' "$name" >&2
+         exit 1
+       fi
+       printf 'Uploaded evidence asset: %s\n' "$name"
+     done < "$expected_names"
+   )
+   upload_status=$?
+   if [ "$upload_status" -ne 0 ]; then
+     printf 'Evidence upload failed; stop before posting.\n' >&2
+     exit "$upload_status"
+   fi
    ```
 
-   The `#$name` syntax sets the asset name. `--clobber` lets re-runs overwrite.
+   Validate the complete input batch before uploading anything: use numbered,
+   ASCII kebab-case names such as `01-health-check.json`. GitHub can
+   [normalize special characters in asset names](https://docs.github.com/en/rest/releases/assets#upload-a-release-asset),
+   so invalid names are refused rather than renamed into another asset.
+
+   An asset takes its name from the uploaded file's basename. A `#` suffix only
+   sets its display label; it cannot rename the asset. Stage the copy under the
+   intended name before uploading. The subshell stops on copy, upload or release
+   read failure, checks every expected name, and removes staging on exit.
+   Run steps 4 and 5 only if the upload block exits successfully. On failure,
+   stop and report it without updating the PR or posting an issue comment.
+   `--clobber` replaces an existing asset with that same PR-prefixed name.
+
+   Link to the actual name:
+   `https://github.com/<impl-org>/<impl-repo>/releases/download/pr-assets/pr-<number>-<file>`.
 
 4. **Update the PR description**
 

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.87.9",
+  "version": "4.87.10",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/skills/lisa-github-evidence/SKILL.md

@@ -52,14 +52,65 @@ If either is missing, **refuse to post**: stop and report the missing Not-establ
 3. **Upload each evidence file**
 
    ```bash
-   for f in "$EVIDENCE_DIR"/[0-9][0-9]-*.txt "$EVIDENCE_DIR"/[0-9][0-9]-*.json; do
-     [ -f "$f" ] || continue
-     name="pr-${PR_NUMBER}-$(basename "$f")"
-     gh release upload pr-assets --repo <impl-org>/<impl-repo> --clobber "$f#$name"
-   done
+   (
+     set -e
+     export LC_ALL=C
+     upload_dir=$(mktemp -d "${TMPDIR:-/tmp}/lisa-github-evidence.XXXXXXXX")
+     trap 'rm -rf "$upload_dir"' EXIT
+     expected_names="$upload_dir/expected-names.txt"
+     basenames="$upload_dir/basenames.txt"
+     : > "$expected_names"
+     : > "$basenames"
+
+     for f in "$EVIDENCE_DIR"/[0-9][0-9]-*.txt "$EVIDENCE_DIR"/[0-9][0-9]-*.json; do
+       [ -f "$f" ] || continue
+       base=$(basename "$f")
+       if [[ ! "$base" =~ ^[0-9]{2}-[a-z0-9]+(-[a-z0-9]+)*\.(txt|json)$ ]]; then
+         printf 'Invalid evidence filename; use a name like 01-health-check.json or 02-output.txt: %s\n' "$base" >&2
+         exit 1
+       fi
+       printf '%s\n' "$base" >> "$basenames"
+     done
+
+     while IFS= read -r base; do
+       name="pr-${PR_NUMBER}-${base}"
+       cp "$EVIDENCE_DIR/$base" "$upload_dir/$name"
+       gh release upload pr-assets --repo <impl-org>/<impl-repo> --clobber "$upload_dir/$name"
+       printf '%s\n' "$name" >> "$expected_names"
+     done < "$basenames"
+
+     gh release view pr-assets --repo <impl-org>/<impl-repo> \
+       --json assets --jq '.assets[].name' > "$upload_dir/asset-names.txt"
+     while IFS= read -r name; do
+       if ! grep -Fxq -- "$name" "$upload_dir/asset-names.txt"; then
+         printf 'Expected evidence asset is missing: %s\n' "$name" >&2
+         exit 1
+       fi
+       printf 'Uploaded evidence asset: %s\n' "$name"
+     done < "$expected_names"
+   )
+   upload_status=$?
+   if [ "$upload_status" -ne 0 ]; then
+     printf 'Evidence upload failed; stop before posting.\n' >&2
+     exit "$upload_status"
+   fi
    ```
 
-   The `#$name` syntax sets the asset name. `--clobber` lets re-runs overwrite.
+   Validate the complete input batch before uploading anything: use numbered,
+   ASCII kebab-case names such as `01-health-check.json`. GitHub can
+   [normalize special characters in asset names](https://docs.github.com/en/rest/releases/assets#upload-a-release-asset),
+   so invalid names are refused rather than renamed into another asset.
+
+   An asset takes its name from the uploaded file's basename. A `#` suffix only
+   sets its display label; it cannot rename the asset. Stage the copy under the
+   intended name before uploading. The subshell stops on copy, upload or release
+   read failure, checks every expected name, and removes staging on exit.
+   Run steps 4 and 5 only if the upload block exits successfully. On failure,
+   stop and report it without updating the PR or posting an issue comment.
+   `--clobber` replaces an existing asset with that same PR-prefixed name.
+
+   Link to the actual name:
+   `https://github.com/<impl-org>/<impl-repo>/releases/download/pr-assets/pr-<number>-<file>`.
 
 4. **Update the PR description**
 

package/plugins/lisa-devin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.87.9",
+  "version": "4.87.10",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-devin/.devin-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.87.9",
+  "version": "4.87.10",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-devin/skills/lisa-github-evidence/SKILL.md

@@ -52,14 +52,65 @@ If either is missing, **refuse to post**: stop and report the missing Not-establ
 3. **Upload each evidence file**
 
    ```bash
-   for f in "$EVIDENCE_DIR"/[0-9][0-9]-*.txt "$EVIDENCE_DIR"/[0-9][0-9]-*.json; do
-     [ -f "$f" ] || continue
-     name="pr-${PR_NUMBER}-$(basename "$f")"
-     gh release upload pr-assets --repo <impl-org>/<impl-repo> --clobber "$f#$name"
-   done
+   (
+     set -e
+     export LC_ALL=C
+     upload_dir=$(mktemp -d "${TMPDIR:-/tmp}/lisa-github-evidence.XXXXXXXX")
+     trap 'rm -rf "$upload_dir"' EXIT
+     expected_names="$upload_dir/expected-names.txt"
+     basenames="$upload_dir/basenames.txt"
+     : > "$expected_names"
+     : > "$basenames"
+
+     for f in "$EVIDENCE_DIR"/[0-9][0-9]-*.txt "$EVIDENCE_DIR"/[0-9][0-9]-*.json; do
+       [ -f "$f" ] || continue
+       base=$(basename "$f")
+       if [[ ! "$base" =~ ^[0-9]{2}-[a-z0-9]+(-[a-z0-9]+)*\.(txt|json)$ ]]; then
+         printf 'Invalid evidence filename; use a name like 01-health-check.json or 02-output.txt: %s\n' "$base" >&2
+         exit 1
+       fi
+       printf '%s\n' "$base" >> "$basenames"
+     done
+
+     while IFS= read -r base; do
+       name="pr-${PR_NUMBER}-${base}"
+       cp "$EVIDENCE_DIR/$base" "$upload_dir/$name"
+       gh release upload pr-assets --repo <impl-org>/<impl-repo> --clobber "$upload_dir/$name"
+       printf '%s\n' "$name" >> "$expected_names"
+     done < "$basenames"
+
+     gh release view pr-assets --repo <impl-org>/<impl-repo> \
+       --json assets --jq '.assets[].name' > "$upload_dir/asset-names.txt"
+     while IFS= read -r name; do
+       if ! grep -Fxq -- "$name" "$upload_dir/asset-names.txt"; then
+         printf 'Expected evidence asset is missing: %s\n' "$name" >&2
+         exit 1
+       fi
+       printf 'Uploaded evidence asset: %s\n' "$name"
+     done < "$expected_names"
+   )
+   upload_status=$?
+   if [ "$upload_status" -ne 0 ]; then
+     printf 'Evidence upload failed; stop before posting.\n' >&2
+     exit "$upload_status"
+   fi
    ```
 
-   The `#$name` syntax sets the asset name. `--clobber` lets re-runs overwrite.
+   Validate the complete input batch before uploading anything: use numbered,
+   ASCII kebab-case names such as `01-health-check.json`. GitHub can
+   [normalize special characters in asset names](https://docs.github.com/en/rest/releases/assets#upload-a-release-asset),
+   so invalid names are refused rather than renamed into another asset.
+
+   An asset takes its name from the uploaded file's basename. A `#` suffix only
+   sets its display label; it cannot rename the asset. Stage the copy under the
+   intended name before uploading. The subshell stops on copy, upload or release
+   read failure, checks every expected name, and removes staging on exit.
+   Run steps 4 and 5 only if the upload block exits successfully. On failure,
+   stop and report it without updating the PR or posting an issue comment.
+   `--clobber` replaces an existing asset with that same PR-prefixed name.
+
+   Link to the actual name:
+   `https://github.com/<impl-org>/<impl-repo>/releases/download/pr-assets/pr-<number>-<file>`.
 
 4. **Update the PR description**
 

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.87.9",
+  "version": "4.87.10",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.87.9",
+  "version": "4.87.10",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.87.9",
+  "version": "4.87.10",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.87.9",
+  "version": "4.87.10",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.87.9",
+  "version": "4.87.10",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-devin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.87.9",
+  "version": "4.87.10",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"